a590003

p
r ′ A
Net’
s ′
r ′ H
r A sA
G A
Net Graph
rH s H G H
G H
G A
p H
p
s A
r A
r ′ A
Sim
p A
G A
G A
p H
Dealer
Player[H]
VSS
Figure 20: Security of the VSS protocol when the dealer is honest.
obtain the following equations describing (Dealer | Player[H] | Net’ | Net | Graph): For any
i, j ∈ [n], and any h ∈ H, a ∈ A, we have
f
$
←
P t (p)
r ′ i = (f(·, i), f(i, ·))
r i [h] = f(i, h)
r i [a] = s a [i]
G[h, j] = eq(r h [j], f(h, j))
G[a, j] = G a [j]
∨
o h =
C⊆[n],|C|≥n−t
p h = o h (0) .
[
cliqueC (G) ∧ interpolate C,t (r h ) ]
For convenience, some simplifications have already been made: First g i and h i have been replaced
by f(·, i) and f(i, ·), respectively. Second, we used the facts that r ′ i = s′ [i] and r i [h] = s h [i] = f(i, h)
for all h ∈ H and all i ∈ [n] by the definitions of the network functionalities Net’ and Net. Finally,
we have set values for G[·, ·] according to the protocol specification (for honest players) and the
inputs G a of players a ∈ A.
In order to further simplify the system, we claim that p h = p(h) for h ∈ H. If p = ⊥, then
this is easy to see because f = ⊥ and G[h, j] = eq(r h [j], ⊥) = ⊥. Therefore, we necessarily have
clique C (G) = ⊥ for all C ⊆ [n] with |C| ≥ n − t, since |C ∩ H| ≥ n − 2t > 0. So, we only need
to prove the claim for p ≠ ⊥. Notice that the equations G[h, j] = eq(r h [j], f(h, j)), depending on
whether j = h ′ ∈ H or j = a ∈ A, can be replaced by the set of equations
G[h, h ′ ] = eq(r h [h ′ ], f(h, h ′ )) = eq(f(h, h ′ ), f(h, h ′ )) = ⊤
G[h, a] = eq(r h [a], f(h, a)) = eq(s a [h], f(h, a)) .
This in particular implies that C = H is a clique of size at least n − t in the graph defined by G,
i.e., we have clique H (G) = ⊤ by the above. Also, since r h [h ′ ] = f(h, h ′ ), we necessarily have
o h ≥ clique H (G) ∧ interpolate H,t (r h ) = ⊤ ∧ f(h, ·) = f(h, ·)
by Lemma 1. Now, let S ⊆ C be any sets such that |C| ≥ n − t and |S| = |C| − t ≥ n − 2t. Since
o h (h ′ ) = f(h, h ′ ) for all h ′ ∈ H and |S ∩ H| ≥ n − 3t ≥ t + 1, we have interpolate S (r h ) ≥ f(h, ·),
and, by Lemma 1, interpolate S (r h ) = f(h, ·). This proves that o h = interpolate C,t (r h ) = f(h, ·), and
p h = o h (0) = f(h, 0) = p(h).
Summarizing, the real system is described by the following set of equations:
24
12. An Equational Approach to Secure Multi-party Computation