a590003

Online Phase. In this phase, S works in essentially the same manner as the honest client D 1 , except that it uses
the all zeros string 0 κ as its input and uses random bits b i,j (instead of pseudorandom bits).
S behaves honestly for the rest of the online phase. Let (vi,j 0 , v1 i,j , zl j ) be the tuple S receives from W∗ , where
l ∈ {0, . . . , 3}, i ∈ [2], j ∈ [n].
Offline Phase. Let S ver denote the simulator for the two-party computation protocol Π ver . In the offline phase,
S runs the simulator S ver with the corrupted client D ∗ 2 to generate a simulated execution of Π ver. At some point
during the simulation, S ver makes a query to the ideal functionality F ver with some input (say) ˜Z, S does the
following:
1. Parse ˜Z as follows:
Public values: ˜s, pk, ˜ P˜K, ˜c test
i,j , ˜cprf i
, (ṽi,j 0 , ṽ1 i,j ), ˜zl j , where i ∈ [2], j ∈ [n], l ∈ {0, . . . , 3}.
Private values: ˜x 2 , ˜ρ 2,j , ˜b 2,j , sk2 ˜ , SK ˜ 2 ,
˜d
test
2,j
prf
, ˜d , where j ∈ [n].
i
2. Perform the verification checks in the same manner manner as F ver , except the check regarding the PRF
key K 1 . (In particular, use the bits b 1,j directly computed for the checks. If any of the checks fail, then
output ⊥ to S ver . Else, if all of the checks succeed, then query the ideal functionality for F on input ˜x 2 .
Let y be the output. Return y as the output to S ver .
On receiving the output value y from S, S ver continues the simulation of Π ver where it forces the output y on A,
and finally stops. At this point, S stops as well and outputs the entire simulated view of A.
5 Extensions
5.1 Handling Multiple Clients
In this section, we shall show how we can extend our two-party verifiable computation protocol to obtain an
n-party verifiable computation that is secure against a constant fraction (α) of corrupted clients (who can collude
arbitrarily with a corrupted server).
Let us first recall a basic idea that we used in our protocol for two-party verifiable computation. The two
clients D 1 and D 2 picked random strings r 1 and r 2 in the pre-processing phase and computed an encryption
of G(r 1 , r 2 ). In the online phase, D 1 picked a random bit b 1 and sent either (x 1 , r 1 ) or (r 1 , x 1 ), both doubly
encrypted, depending on the bit b 1 . D 2 picked a random b 2 and sent either (x 2 , r 2 ) or (r 2 , x 2 ), both doubly
encrypted, depending on the bit b 2 . Let the ciphertexts sent by D 1 be denoted by (v1 0, v1 1 ) and those sent by
D 2 be denoted by (v2 0, v1 2 ) respectively. The server W, then responded with 4 ciphertexts, computed homomorphically:
namely, z 0 = MEval P K1 ,P K 2
(v1 0, v0 2 ; Eval pk(·, ·, G)), z 1 = MEval P K1 ,P K 2
(v1 0, v1 2 ; Eval pk(·, ·, G)),
z 2 = MEval P K1 ,P K 2
(v1 1, v0 2 ; Eval pk(·, ·, G)), and z 3 = MEval P K1 ,P K 2
(v1 1, v1 2 ; Eval pk(·, ·, G)) (In the real protocol,
the clients actually picked κ such random strings each and the server sent back 4κ ciphertexts evaluated
homomorphically back to the clients; but for simplicity, we will only consider one such instance here.). Note that
out of the 4 ciphertexts, one of them contained an encryption of G(r 1 , r 2 ), that was used for verification, and one
of them contained an encryption of G(x 1 , x 2 ), that was used to obtain the result of the computation.
Now, suppose we tried to extend the above idea as it is, to the n-party case. That is, the n clients each pick
r 1 , ·, r n in the pre-processing phase and compute G(r 1 , ·, r n ). In the online phase, each client D i picks a private
random bit b i and sends either (x i , r i ) or (r i , x i ), both doubly encrypted, depending on the bit b i . Unfortunately
now, since the server does not (and cannot) know the bits b i , the server must send back 2 n ciphertexts in order to
be sure that he has sent back both an encryption of G(r 1 , · · · , r n ) (to be used for verification by the n clients) as
well as encryption of G(x 1 , · · · , x n ) (to be used to obtain the result of the computation by the n clients). This
solution ends up having a non-polynomial time complexity for all parties.
Our idea to solve the above problem is to have the n clients jointly generate random bits b 1 , · · · , b n such that
exactly 1 b i = 1 (where i is random in [n]) and all other b j = 0, j ≠ i. Now, the server only needs to compute
12
11. How to Delegate Secure Multiparty Computation to the Cloud