a590003

2n ciphertexts in order to be sure that he has returned the required ciphertexts. In other words, W computes the
following 2n sets of ciphertexts:
1. The n ciphertexts, one of which encrypts G(x 1 , · · · , x n ), namely:
(a) z 0 = MEval P K1 ,P K 2
(v 1 1 , v0 2 , · · · , v0 n; Eval pk (·, ·, · · · , ·, G)),
(b) z 1 = MEval P K1 ,P K 2
(v 0 1 , v1 2 , v0 3 , · · · , v0 n; Eval pk (·, ·, ·, · · · , ·, G)),
· · ·
(c) z n = MEval P K1 ,P K 2
(v 0 1 , · · · , v0 n−1 , v1 n; Eval pk (·, · · · , ·, ·, G))
2. and the n ciphertexts, one of which encrypts G(r 1 , · · · , r n ), namely:
(a) z n+1 = MEval P K1 ,P K 2
(v 0 1 , v1 2 , · · · , v1 n; Eval pk (·, ·, · · · , ·, G)),
(b) z n+2 = MEval P K1 ,P K 2
(v 1 1 , v0 2 , v1 3 , · · · , v1 n; Eval pk (·, ·, ·, · · · , ·, G)),
· · ·
(c) z 2n = MEval P K1 ,P K 2
(v 1 1 , · · · , v1 n−1 , v0 n; Eval pk (·, · · · , ·, ·, G))
The above idea ensures that the complexity of the worker remains polynomial (the complexity of the clients
are still independent of F except for the pre-processing phase). Two (linked) issues remain to be addressed: 1)
How do the clients generate the bits b 1 , · · · , b n with the required distribution without interacting with each other?
and 2) the security of the protocol. These issues are addressed in Appendix E.
5.2 Minimizing Interaction in Offline Phase
Recall that in the offline phase, the clients need to execute a secure computation protocol in order to verify and
obtain the output of the computation. Note that since we work in the pre-processing model, we can use a specific
multi-party computation protocol in order to reduce the round complexity of the clients in this phase. More
specifically, we can use any secure computation protocol, even one that makes use of pre-processing, so long as
this pre-processing is re-usable for multiple runs of the protocol. Such a protocol exists due to the construction
of Asharov et al. [AJLA + 12], which is a 2-round secure computation protocol in the re-usable pre-processing
model with CRS (note that in our case, the clients can compute the CRS needed for this protocol during the initial
pre-processing phase). Using this protocol, we can obtain a multi-party verifiable computation protocol in which
the round complexity of the clients in the offline phase is 2.
References
[AF07] Masayuki Abe and Serge Fehr. Perfect NIZK with adaptive soundness. In TCC, pages 118–136,
2007.
[AIK10]
B. Applebaum, Y. Ishai, and E. Kushilevitz. From secrecy to soundness: Efficient verification via
secure computation. In ICALP, 2010.
[AJLA + 12] Gilad Asharov, Abhishek Jain, Adriana López-Alt, Eran Tromer, Vinod Vaikuntanathan, and Daniel
Wichs. Multiparty computation with low communication, computation and interaction via threshold
fhe. In EUROCRYPT, pages 483–501, 2012.
[BCC88] Gilles Brassard, David Chaum, and Claude Crépeau. Minimum disclosure proofs of knowledge. J.
Comput. Syst. Sci., 37(2):156–189, 1988.
[BCCT12]
Nir Bitansky, Ran Canetti, Alessandro Chiesa, and Eran Tromer. From extractable collision resistance
to succinct non-interactive arguments of knowledge, and back again. In ITCS, pages 326–349,
2012.
13
11. How to Delegate Secure Multiparty Computation to the Cloud