a590003

[KMR11]
[KMR12]
[Lip12]
[LTV12]
Seny Kamara, Payman Mohassel, and Mariana Raykova. Outsourcing multi-party computation.
IACR Cryptology ePrint Archive, 2011:272, 2011.
Seny Kamara, Payman Mohassel, and Ben Riva. Salus: a system for server-aided secure function
evaluation. In ACM Conference on Computer and Communications Security, pages 797–808, 2012.
Helger Lipmaa. Progression-free sets and sublinear pairing-based non-interactive zero-knowledge
arguments. In TCC, volume 7194 of Lecture Notes in Computer Science, pages 169–189. Springer,
2012.
Adriana López-Alt, Eran Tromer, and Vinod Vaikuntanathan. On-the-fly multiparty computation on
the cloud via multikey fully homomorphic encryption. In STOC, pages 1219–1234, 2012.
[Mic94] Silvio Micali. Cs proofs (extended abstracts). In FOCS, pages 436–453, 1994.
[Nao89] Moni Naor. Bit commitment using pseudo-randomness. In CRYPTO, pages 128–136, 1989.
[Nao03] Moni Naor. On cryptographic assumptions and challenges. In CRYPTO, pages 96–109, 2003.
[PRV12]
[Reg05]
[Yao82]
Bryan Parno, Mariana Raykova, and Vinod Vaikuntanathan. How to delegate and verify in public:
Verifiable computation from attribute-based encryption. In TCC, pages 422–439, 2012.
Oded Regev. On lattices, learning with errors, random linear codes, and cryptography. In STOC,
pages 84–93, 2005.
Andrew Chi-Chih Yao. Protocols for secure computations (extended abstract). In FOCS, pages
160–164, 1982.
A
Related works
Interactive Solutions. Goldwasser et al. [GKR08] show how to build an interactive proof between a client and
a server to verify arbitrary polynomial time computations in almost linear time. Because of the interactive nature,
this protocol is not suited to the multi-client case (as we discussed above this would require the clients to be all
present and interacting with the server during the computation – our model enforces a single message exchanged
between server and client during the online phase) 2 .
SNARGs. A class of solutions is based on succint non-interactive arguments (or SNARGs): (computationally
sound [BCC88]) proofs that are very short and very efficient to verify, regardless of the complexity of the function
being evaluated. Solutions of this type are usually constructed using Probabilistically Checkable Proofs (PCPs),
long proofs that the verifier can check in only very few places (in particular only a constant number of bits
of the proofs are needed for NP languages). Kilian [Kil92] showed how to use PCPs to construct interactive
succint arguments by committing to the entire PCP string using a Merkle tree. Micali [Mic94] removed the
interaction by use of a random oracle. Recent work [BCCT12, GLR11, DFH12] has replaced the random oracle
with an “extractable collision-resistant hash functions” (ECRHs), a non-falsifiable [Nao03], assumption that any
algorithm that computes an image of the ECRH must ”know” the corresponding pre-image.
There are alternative constructions of SNARGs based on different forms of arithmetization of Boolean computations
used together with cryptographic constructions based on bilinear maps (e.g. [Gro10, Lip12, GGPR12]).
Those protocols also rely on non-falsifiable ”knowledge” assumptions over the cryptographic groups used in the
2 A non-interactive argument for a restricted class of functions is also presented in [GKR08]. We did not investigate if this could be
turned into a multi-client non-interactive protocol (though we suspect it could, when coupled with an FHE), because the focus of this
paper is a general solution for arbitrary polynomial computations.
15
11. How to Delegate Secure Multiparty Computation to the Cloud