a590003

constructions. We note that following [AF07, GW11] such “knowledge” assumptions seem unavoidable when
using SNARGs.
As we pointed out in the previous Section, SNARGs coupled with FHE would yield a conceptually simple
protocol for the multi-client case, but at the cost of using either the random oracle or a falsifiable assumption.
Our protocol instead relies on standard cryptographic assumptions (in particular the existence of FHE).
Verifiable Computation. Gennaro, Gentry and Parno [GGP10] and subsequent works [CKV10, AIK10]
present a verifiable computation (VC) scheme that allows a client to outsource any efficiently computable function
to a worker and verify the worker’s computation in constant time, where the worker’s complexity is only
linear in the size of the circuit, assuming a one-time expensive preprocessing phase depending on the function
being outsourced. We use their approach, and most specifically we use the protocol from [CKV10] as our starting
point. [PRV12] show how to construct a protocol for outsourcing computation of a smaller class of functions
starting from any attribute-based encryption scheme. Their solution does not handle input privacy however.
Server-Aided Secure Function Evaluation. The first work to explicitly consider outsourced computation in
the multi-client case is by Kamara et al [KMR11] (see also [KMR12] which reports on some optimizations of
[KMR11] and implementation results). The main limitation of these works is a non-colluding adversarial model
where the server and the clients may maliciously depart from the protocol specifications but without a common
strategy or communication. A simpler protocol is also presented in [CKKC12] but it assumes only semi-honest
parties. We stress that our work is the first to achieve full simulation security in the most stringent adversarial
model.
B
Security definition
We now formally describe the ideal and real models of computation and then give our security definition.
IDEAL WORLD. In the ideal world, there is a trusted party T that computes the desired functionality F on
the inputs of all parties. Unlike the standard ideal world model, here we allow for multiple evaluations of the
functionality on different sets of inputs. An execution of the ideal world consists of (unbounded) polynomial
number of repetitions of the following:
Inputs: D 1 and D 2 have inputs x 1 and x 2 respectively. The worker has no input. All parties send their inputs to
the trusted party T. Additionally, corrupted parties may change their inputs before sending them to T.
Trusted party computes output: T computes F (x 1 , x 2 ).
Adversary learns output: T returns F (x 1 , x 2 ) to A.
Honest parties learn output: A prepares a list of (possibly empty) set of honest clients that should get the
output and sends it to T. T sends F (x 1 , x 2 ) to this set of honest clients and ⊥ to other honest clients in the
system.
Outputs: All honest parties output whatever T gives them. Corrupted parties, wlog, output ⊥. The view of A
in the ideal world execution above includes the inputs of corrupt parties, the outputs of all parties, as well
as the entire view of all corrupt parties in the system. A can output any arbitrary function of its view and
we denote the random variable consisting of this output, along with the outputs of all honest parties, by
IDEAL F,A (x 1 , x 2 ).
REAL WORLD. In the real world, there is no trusted party and the parties interact directly with each other
according to a protocol Π. Honest parties follow all instructions of Π, while adversarial parties are coordinated
by a single adversary A and may behave arbitrarily. At the conclusion of the protocol, honest clients compute
their output as prescribed by the protocol.
16
11. How to Delegate Secure Multiparty Computation to the Cloud