a590003

s ′ 0
s ′ A
r ′ A
y ′ H
s ′ 0
s ′ A r ′ A
y ′ H
Net’
s ′ H
r ′ H
Player[H]
Sim’
y ′ A
x ′ , w
WCast
Figure 16: Security of the weak multicast protocol, when the dealer is dishonest.
execution on the left. Simulated attack in the ideal world on the right.
Real world
unidirectional network functionality Net’: (F t [X] 2 ⊥ )n → (F t [X] 2 ⊥ )n that allows the VSS dealer to
send to each party a pair of polynomials of degree at most t. See Figure 18 (right).
The VSS protocol. We turn to the actual protocol securely implementing the VSS functionality.
We first define some auxiliary functions. For any subset C ⊆ [n], let clique C : {⊥, ⊤} n×n → {⊥, ⊤}
be the function clique C (G) = ∧ i,j∈C
G[i, j]. This function is clearly monotone, and tests if C
is a clique in G. For any set A, we equip the set A ⊥ with a monotone equality-test function
eq : A ⊥ × A ⊥ → {⊥, ⊤} where eq(x, y) ≡ (x = y ≠ ⊥). Monotonicity follows from the fact that all
the pairs (x, x) such that eq(x, y) = ⊤ are maximal elements in A ⊥ × A ⊥ .
For any S ⊆ [n] of size |S| ≥ t + 1, and r ∈ F n b , let interpolate S(r) ∈ F t [X] ⊥ be the (unique)
polynomial h ∈ F t [X] such that h(S) = r[S] if such polynomial exists, and interpolate S (r) = ⊥
otherwise. For C ⊆ [n], define also a monotone function interpolate C,t : F n ⊥ → F t [Y ] ⊤ ⊥ where
interpolate C,t (r) = ∨ {interpolate S (r): S ⊆ C, |S| = |C| − t}. Notice that interpolate C,t (r) = ⊥ if
no interpolating polynomial exists, while interpolate C,t (r) = ⊤ if there are multiple solutions. Note
that if n ≥ 4t + 1 and |C| ≥ n − t, then ⊤ never occurs: Indeed, let S, S ′ ⊆ C be such that
|S| = |S| ′ = |C| − t, and such that both interpolate S (r) and interpolate S ′(r) differ from ⊥. Since
|S ∩ S ′ | ≥ |C| − 2t ≥ n − 3t ≥ t + 1, we must have interpolate S (r) = interpolate S ′(r) by the fact
that two degree t polynomials agreeing at t + 1 points are necessarily equal. For future reference,
this is summarized by the following lemma.
s ′ A
r
A
′
Net’
s ′ 0
s ′ H
r
H
′
x ′
y
H
′
Dealer
Player[H]
s ′ A r′ A
Sim
y ′ A
x ′
Int
w
WCast
y ′ H
Figure 17: Security of the weak multicast protocol, when the dealer is honest. Real world execution
on the left. Simulated attack in the ideal world on the right.
22
12. An Equational Approach to Secure Multi-party Computation