a590003

processing phase in exactly the same manner as the many-time adversary. We will also pick one of the L executions
at random and choose to break the one-time security of that execution. However, unline [CKV10], we
cannot simulate the other executions by sending encryptions of all-zeroes. This is because, if we did so, then
the verification performed by the clients in the offline phase will necessarily fail and in the event that one of the
clients colludes with the server (which is unique to our setting), this information will be learned by the server and
we will not be able to continue with simulation. The way around it is to simulate other executions by sending
the encryption of the message exactly as we would do in a real run of the protocol, that is as a function of ̂X,
̂R, and the secret bit b, except that we shall replace the r encrypted in ̂R, and encrypt all-zeroes instead (note
that b is not part of the secret state as this varies from execution to execution). Note that by doing this we do not
use the secret state that is carried between executions anywhere in our simulation. Now, in the offline phase, our
adversary will run the simulator for the two-party computation protocol and force the clients to output “accept”
and the result of the computation to be F (x 1 , x 2 ). Now, note that client never rejects any of these executions and
always proceeds with the computation as if it accepted it. The rest of the simulation works exactly the same as
in the case of [CKV10] and with these slight changes, our proof of security goes through. We now present more
details.
Let B be an adversary (controling a cheating D ∗ 2 and W∗ ) that succeeds with non-negligible probability in
breaking the security when executing the online phase multiple times. We shall construct an adversary A that
also succeeds in breaking the security with non-negligible probability, but when executing the online phase only
once.
- A executes the pre-processing phase in exactly the same manner as B. In other words, A executes the
pre-processing phase exactly as the simulator described in Section 4.1 does.
- Next, let L be an upper bound on the total number of online executions run by adversary B. A picks an
index 1 ≤ i ≤ L at random, and this is the execution that it will use to distinguish between the real and
ideal worlds.
- In every execution k ≠ i, A does as follows: A uses the honest client D 1 ’s input in that execution,
say x 1 , in computing the messages sent by D 1 in the online phase. However, instead of using the
random value ̂R 1,j in the online phase (for 1 ≤ j ≤ n), A will use encryptions of the all-zero string
instead. A will execute the rest of the online phase exactly as an honest D 1 would (that is, A picks
random bits b 1,j , for 1 ≤ j ≤ n and sends the ordered encryption tuples (of x 1 and 0) to W).
- In the i th execution, A does as follows: A picks the keys for the outermost layer of the FHE scheme
on its own (both the public and secret keys (pk ∗ , sk ∗ )). A upon receiving a query from the client
D 1 in the one-time execution, will prepare the query using this value and use the public key pk ∗ to
encrypt the query. A will send this value to B. Upon receiving the response from B, A will decrypt
it using sk ∗ and send this value as the value sent by the malicious worker controled by A in the
one-time execution.
Note that if B terminates the game before the i th execution, then A aborts and gives up.
- In the offline phase, for all executions k ≠ i, A will execute the simulator, S ver , for the two-party computation
protocol, Π ver along with the corrupted client B to generate a simulated execution of Π ver . At some
point during the simulation, S ver will make a query to the ideal functionality F ver with some input (say)
˜Z. At this point A will simply return F (x 1 , x 2 ) as the result of the computation to S ver . On receiving this
output value y from A, S ver continues the simulation of Π ver where it forces the output y on B. In the
offline phase for the i th execution, A will execute the protocol honestly in this phase.
The proof that A also succeeds with non-negligible probability, when B succeeds with non-negligible probability
follows via a standard hybrid argument. At a high level, note that we can argue about the success probability
22
11. How to Delegate Secure Multiparty Computation to the Cloud