a590003

of A only in the case when A guesses correctly the first execution when B will execute the protocol maliciously.
This is because, if B executes the protocol maliciously for some execution q < i, then since A will simulate the
output of the computation to be F (x 1 , x 2 ) (in the offline phase), when in the real world the output of the computation
maybe different causing B to distinguish between the real and ideal worlds. Hence, let us consider the case
when A guesses correctly the first execution when B is malicious. Note that this happens with probability 1 L .
Now, given that the first instance that B is malicious is only in the i th execution, we have that B is honest in the
first i − 1 executions. In these executions, we can show indistinguishability of the different hybrids (where we
replace a real execution with a simulated execution in a step-by-step manner) via a simple hybrid argument as the
only difference between the real and ideal executions is that we are replacing encryptions of ̂R 1,j in the online
phase (for 1 ≤ j ≤ n) with encryptions of all zeroes and we are simulating the offline phase so that it outputs the
value F (x 1 , x 2 ) to the adversary. The first change is indistinguishable due to the semantic security of the FHE
scheme, while the second change is indistinguishable since the adversary is indeed honest in this execution and
an honest execution indeed does evaluate to F (x 1 , x @ ) (from the indistinguishability of the simulated two-party
computation protocol from the real protocol with same output value, this indistinguishability follows). Hence, if
B succeeds with probability p B , then A succeeds with probability at least p B
L
+ negl. We leave further details to
the full version of the paper.
E
Multi-party verifiable computation
Let us have the clients pick the bits b i at random from a distribution that outputs 1 with probability 1 n and 0
otherwise (such a distribution can easily be sampled; simply pick log n bits uniformly at random and outputting
1 iff all log n bits are 1). Let us look at the completeness of the protocol in this case. When all parties are honest,
the probability that exactly one b i = 1 and all other b i ’s are 0 is n× 1 n ×(1− 1 n )n−1 which is ≥ 1 e
. The probability
that there is a completeness error is bounded by 1 − 1 e
. So, if the clients repeat the above protocol (in parallel)
κ number of times, then the probability that none of the repetitions succeed will be negligibly small in κ. The
clients can check only the run of the protocol that succeeded during the offline verification phase, and obtain the
result of the computation.
The problem with this approach is that a set of corrupted clients can claim that their random bits are such that
b i = 1 for a corrupted client. Now, with constant probability, b j will be 0 for all honest clients. This means that
the colluding adversarial clients along with the server will have complete knowledge of the bits b 1 , · · · , b n in this
case and hence soundness will be completely defeated.
We get around this problem as follows. We repeat the protocol (in parallel), a total of 2en 2 κ number of times.
But now, a client D i will accept the output of the computation, iff there are at least κ number of repetitions in
which b i = 1 and b j = 0 for all j ≠ i (this will be checked in the secure computation protocol run during the
offline phase). Let us first analyze the completeness of this protocol. Note that, for a particular b i , the probability
1
that b i = 1 and all other b j ’s are 0 is at least
en
. Hence, if run 2enκ executions in parallel, except with negligible
probability (in κ, via the Chernoff bound), we get that there will be κ number of repetitions in which b i = 1 and
b j = 0 for all j ≠ i. Since we are running 2en 2 κ parallel repetitions, except with negligible probability, for all
clients D i , this condition will be met.
Now, let us analyze the security of this protocol. Note that the adversarial set of clients (totally αn clients for
constant 0 < α < 1) cannot simply set their bits such that one of their b bits is always 1 in all parallel repetitions
of the protocol. Hence, the adversarial clients must set their bits to 0 in at least (1 − α)κn executions. Now, note
that in these repetitions of the protocol, the adversary has no idea as to which honest clients bit b i = 1 (this can be
shown using the same techniques as in the proof of the two-party protocol). Since the adversarial client can force
a wrong output (by colluding with the corrupted worker) only by guessing this, the probability with which this
happens is (
1
(1−α)n )(1−α)nκ , which is negligible in the security parameter κ. Hence, a set of adversarial clients
succeed in forcing a wrong output only with negligible probability.
23
11. How to Delegate Secure Multiparty Computation to the Cloud