a590003

f
$
←
P t (p)
r ′ a = (f(·, a), f(a, ·))
r a [a ′ ] = s a ′[a]
r a [h] = f(a, h)
G[h, h ′ ] = (p > ⊥)
G[h, a] = eq(s a [h], f(h, a))
G[a, j] = G a [j]
p h = p(h) .
Notice that this is exactly how p h is defined by the VSS functionality. So, in order to prove security,
it is enough to give a simulator Sim that on input p A , s A , G A , outputs G, r A and r
A ′ as defined in
the above system of equations. See Figure 20 (right).
The problem faced by the simulator is that it cannot test p > ⊥ and generate f as in the equations
because it does not know the value of p, rather it only has partial information p A = p(A). The
first condition p > ⊥ is easy to check because it is equivalent to p a = p(a) > ⊥ for any a ∈ A. In
order to complete the simulation, we observe that the equations only depend on the 2t polynomials
f(·, A) and f(A, ·). The next lemma shows that, given p(A), the polynomials f(·, A) and f(A, ·) are
statistically independent from p, and their distribution can be easily sampled.
$
Lemma 2 Let p ∈ F t [X], let f ← P t (p), and for all a ∈ A, let g a = f(·, a) and h a = f(a, ·). The
conditional distribution of (g a , h a ) a∈A given p(A) is statistically independent of p, and it can be
generated by the following algorithm Samp(p A ): first pick random polynomials h a ∈ F t [Y ] independently
and uniformly at random subject to the constraint h a (0) = p a . Then, pick g a ∈ F t [X], also
independently and uniformly at random, subject to the constraint g a (A) = h A (a).
Using the algorithm from the lemma, we obtain the following simulator Sim:
Sim(p A , s A , G A ) = (G A , r A , r ′ A ):
(g A , h A ) ← Samp(p A )
r ′ A = (g A, h A )
r a [h] = h a (h) (h ∈ H, a ∈ A)
r a [a ′ ] = s a ′[a] (a, a ′ ∈ A)
G[h, h ′ ] = ∨ a∈A (p a > ⊥) (h, h ′ ∈ H)
G[h, a] = eq(s a [h], g a (h)) (h ∈ H, a ∈ A)
G[a, j] = G a [j]
(a ∈ A, j ∈ [n])
As usual, if p = ⊥, then p A = ⊥ A and by convention Samp(p A ) = {⊥, ⊥}.
Dishonest dealer security. We now look at the case where the dealer is not honest. As above,
for all A ⊆ [n] where |A| = t and n ≥ 4t + 1, define H = [n] \ A. When the players in the set
A are corrupted (and thus the players in H are honest), an execution of the VSS protocol with
dishonest dealer is given by the system (Player[H] | Net’ | Net | Graph) with inputs s ′ , r A , G A ,
and outputs r
A ′ , s A, p H and G A . As above, we start with an equational description of the system,
and will simplify it below into a form where the construction of a corresponding simulator becomes
obvious. For all i, j ∈ [n], h, h ′ ∈ H, and a ∈ A, we have
(g h , h h ) = s ′ [h]
r a ′ = s ′ [a]
r i [h] = g h (i)
r i [a] = s a [i]
G[h, h ′ ] = eq(g h ′(h), h h (h ′ ))
G[h, a] = eq(s a [h], h h (a))
G[a, j] = G a [j]
∨ [
o h =
cliqueC (G) ∧ interpolate C,t (r h ) ]
C⊆[n],|C|≥n−t
p h = o h (0) .
25
12. An Equational Approach to Secure Multi-party Computation