a590003

P such that |c ∗ | ≤ P (κ). (In other words, the size of c ∗ is independent of the size of circuit description of F .)
Finally, the security definition for an FHE scheme is that of standard semantic security for encryption schemes.
We note that FHE schemes are known to exist from a variety of cryptographic assumptions such as the
learning with errors (LWE) assumption [Reg05].
C.3 Multikey Fully Homomorphic Encryption
In our construction, we will use a multikey fully homomorphic encryption (MFHE) scheme [LTV12] to avoid interaction
between the players during the online phase of our protocol. An MFHE scheme is defined as a four-tuple
of algorithms (MGen, MEnc, MEval, MDec): (a) a key generation algorithm (MP K, MSK) ← MGen(1 κ )
that takes as input the security parameter and outputs a public key/secret key pair (MP K, MSK), (b) a randomized
encryption algorithm c ← MEnc MP K (m) that takes as input the public key and a message m and
produces a ciphertext c, (c) a decryption algorithm m ← MDec MSK1 ,...,MSK n
(c) that takes as input n secret
keys MSK i and a ciphertext c, and outputs a message m, and (d) a deterministic evaluation algorithm
c ∗ ← MEval MP K1 ,...,MP K n
(c 1 , . . . , c n , C) that takes as a input (the circuit description of) a PPT function F , a
list of ciphertexts c 1 , . . . , c n along with the corresponding public keys MP K 1 , . . . , MP K n , and produces a new
ciphertext c ∗ .
An MFHE scheme must satisfy the following two requirements:(a) Correctness: For every c ∗ ←
MEval MP K1 ,...,MP K n
(c 1 , . . . , c n , F ), where c i ← MEnc MP Ki (m i ), it must be that MDec MSK1 ,...,MSK n
(c ∗ ) =
C(m 1 , . . . , m t ). (b) Compactness: Let c ∗ ← MEval MP K1 ,...,MP K n
(c 1 , . . . , c n , F ). Then, there exists a polynomial
P such that |c ∗ | ≤ P (κ, n).
The security definition for an MFHE scheme is that of standard semantic security for encryption schemes. We
remark that in the above description, for simplicity of notation, we do not explictly mention “evaluation keys”,
and simply assume that they are part of the public keys.
We note that an MFHE scheme was recently constructed by López-Alt et al. [LTV12] based on NTRU
[HPS98].
C.4 Single-Client Verifiable Computation
As a building block for our solution we use the recently proposed method for single-client verifiable computations
[CKV10]. For concreteness, we briefly describe the solution in [CKV10] which can be based on any Fully
Homomorphic Encryption (FHE) scheme [Gen09]. The high level idea for their protocol to outsource a function
F is as follows. The client picks a random r and computes F (r) in the preprocessing phase. Next, in the online
phase, after receiving the input x, the client picks a random bit b and sends either (x, r) or (r, x) to the server
(depending on the bit b). The server must compute F on both x and r and return the responses back to the
client. The client will check that F (r) matches the pre-computed value and if so accept the other response as the
correct F (x). Now, suppose x comes from the uniform distribution, then this protocol is a sound protocol and a
cheating server can succeed only with probability 1 2
(as he cannot distinguish (x, r) from (r, x) with probability
better than 1 2
). For arbitrary distributions, this approach fails, but this can be rectified by having the client
additionally pick a public key for an FHE scheme (in the preprocessing phase) and sending (Enc pk (x), Enc pk (r))
or (Enc pk (r), Enc pk (x)), depending on bit b in the online phase. The server will homomorphically evaluate the
function F and respond back with Enc pk (F (x)) and Enc pk (F (r)). Now, this protocol is sound for arbitrary
distributions of x (as a cheating server cannot distinguish (Enc pk (x), Enc pk (r)) from (Enc pk (r), Enc pk (x))).
One can boost the soundness error to be negligibly small by picking random r 1 , · · · , r κ and having the client
pick b 1 , · · · , b κ and send (Enc pk (x), Enc pk (r i )) (or the other way around, depending on b i ). The client will
check that all values of F (r i ) were correct and that the κ different values for F (x) were identical and if so,
accept F (x). In order to make this protocol re-usable with the same values of r 1 , · · · , r κ , [CKV10] need to run
this entire protocol under one more layer of fully homomorphic Encryption.
18
11. How to Delegate Secure Multiparty Computation to the Cloud