a590003

C.5 Secure Computation
We make use of a two-party secure computation protocol (between parties D 1 and D 2 ). We make use of such a
protocol that is secure in the standard ideal/real world paradigm.
IDEAL WORLD. In the ideal world, there is a trusted party T that computes the desired functionality F on the
inputs of the two parties. An execution of the ideal world consists of the following:
Inputs: D 1 and D 2 have inputs x 1 and x 2 respectively and send their inputs to the trusted party T. Additionally,
a corrupted party may change its input before sending them to T.
Trusted party computes output: T computes F (x 1 , x 2 ).
Adversary learns output: T returns F (x 1 , x 2 ) to A (here, either D 1 or D 2 is controlled by the adversary A).
Honest parties learn output: A determines if the honest party should get the output and sends this to T. T
sends F (x 1 , x 2 ) to this honest party (if the adversary says so) and ⊥ otherwise.
Outputs: Honest parties output whatever T gives them. Corrupted parties, wlog, output ⊥. The view of A in
the ideal world execution above includes the inputs of corrupt parties, the outputs of all parties, as well
as the entire view of all corrupt parties in the system. A can output any arbitrary function of its view and
we denote the random variable consisting of this output, along with the outputs of all honest parties, by
IDEAL F,A (x 1 , x 2 ).
REAL WORLD. In the real world, there is no trusted party and the parties interact directly with each other according
to a protocol Π 2pc . Honest parties follow all instructions of Π 2pc , while adversarial parties are coordinated by
a single adversary A and may behave arbitrarily. At the conclusion of the protocol, honest clients compute their
output as prescribed by the protocol.
For any set of adversarial parties (that is, corrupt D 1 or D 2 ) controlled by A and protocol Π 2pc for computing
function F , we let REAL π,A (x 1 , x 2 ) be the random variable denoting the output of A in the real world execution
above, along with the output of the honest parties. REAL π,A (x 1 , x 2 ) can be an arbitrary function of the view of
A that consists of the inputs (and random tape) of corrupt parties, the outputs of all parties in the protocol, as
well as the entire view of all corrupt parties in the system.
SECURITY DEFINITION. Intuitively, we require that for every adversary in the real world, there exists an
adversary in the ideal world, such that the views of these two adversaries are computationally indistinguishable.
Formally,
Definition 3 Let F and Π 2pc be as above. Protocol Π 2pc is a secure protocol for computing F if for every PPT
adversary A that corrupts either D 1 or D 2 , in the real model, there exists a PPT adversary S 2pc (that corrupts
the same party as A) in the ideal execution, such that:
D
Proof details
D.1 Indistinguishability of the Views
IDEAL F,A (x 1 , x 2 ) c ≡ REAL π,A (x 1 , x 2 )
In prover to prove Theorem 1, we consider a series of hybrid experiments H 0 , . . . , H 4 , where H 0 represents the
real world execution, while H 4 corresponds to the simulated execution in the ideal world. We will show that each
consecutive pair of hybrid experiments are computationally indistinguishable. We can therefore conclude that
H 0 and H 4 are computationally indistinguishable, as required.
19
11. How to Delegate Secure Multiparty Computation to the Cloud