a590003

For any set of adversarial parties (that may include a corrupt worker and a corrupt D 1 or D 2 ) controlled by A
and protocol Π for computing function F , we let REAL π,A (x 1 , x 2 ) be the random variable denoting the output
of A in the real world execution above, along with the output of the honest parties. REAL π,A (x 1 , x 2 ) can be an
arbitrary function of the view of A that consists of the inputs (and random tape) of corrupt parties, the outputs of
all parties in the protocol, as well as the entire view of all corrupt parties in the system.
Security Definition. Intuitively, we require that for every adversary in the real world, there exists an adversary
in the ideal world, such that the views of these two adversaries are computationally indistinguishable. Formally,
Definition 2 Let F and Π be as above. We say that Π is a secure verifiable computation protocol for computing
F if for every PPT adversary A that corrupts either D 1 or D 2 , and additionally possibly corrupts the worker, in
the real model, there exists a PPT adversary S (that corrupts the same set of parties as A) in the ideal execution,
such that:
IDEAL F,A (x 1 , x 2 ) c ≡ REAL π,A (x 1 , x 2 )
C
Building Blocks
We now describe the building blocks we require in our protocol.
C.1 Statistically Binding Commitments
We shall make use of statistically binding commitments in our protocol. A statistically binding commitment
consists of two probabilistic algorithms: COM and OPEN. COM takes as input a message m from the sender and
outputs a “commitment” to m, denoted by c to the receiver and a “decommitment” to m, denoted by d, to the
sender. OPEN takes as input c and d and outputs a message m (denoting the message that was committed to)
or outputs ⊥ denoting reject. The correctness property of a commitment scheme requires that for all honestly
executed COM and OPEN, we have that OPEN(COM(m)) = m, except with negligible probability. Informally, a
statistically binding commitment scheme has the security property that no (computationally unbounded) sender
can commit to a message m and have it decommit to some other message. In other words, no computationally
unbounded sender can come up with a commitment c and two decommitments d and d ′ such that OPEN(c, d) = m
and OPEN(c, d ′ ) = m ′ for different m and m ′ . In our protocol, we shall make use of Naor’s two-round statistically
binding commitment scheme [Nao89]. At a high level, the commitment scheme, based on any pseudorandom
generator, G, from κ bits to 3κ bits, works as follows: in the commitment phase, the receiver sends a random 3κ
bit string, r to the sender. The sender picks a seed s (of length κ) to the pseudorandom generator at random and
sends G(s) to commit to 0 and G(s) ⊕ r to commit to 1. The decommitment is simply the bit and the seed s.
This scheme is statistically binding and computationally hiding.
C.2 Fully homomorphic Encryption
In our constructions, we shall make use of a fully homomorphic encryption (FHE) scheme [Gen09, BV11,
BGV12]. An FHE scheme consists of four algorithms: (a) a key generation algorithm Gen(1 κ ) that takes as
input the security parameter and outputs a public key/secret key pair (pk, sk), (b) a randomized encryption algorithm
Enc pk (m) that takes as input the public key and a message m and produces ciphertext c, (c) a decryption
algorithm Dec sk (c) that takes as input the secret key, ciphertext c and produces a message m, and (d) a deterministic
3 evaluation algorithm Eval pk (c, F ) that takes as input a ciphertext c (that encrypts a message m), the public
key, and (the circuit description of) a PPT function F and produces a ciphertext c ∗ .
The correctness of the encryption, decryption, and evaluation algorithms require that for all key
pairs output by Gen, Dec sk (Enc pk (m)) = m, for all m (except with negligible probability) and that
Dec sk (Eval pk (Enc pk (m), F )) = F (m), for all m and PPT F , (except with negligible probability). The compactness
property of an FHE scheme requires the following: let c ∗ ← Eval pk (c, F ). There exists a polynomial
3 The Eval algorithm need not be deterministic in general, but we require that the algorithm be deterministic. There are plenty of such
schemes available based on a variety of assumptions.
17
11. How to Delegate Secure Multiparty Computation to the Cloud