a590003

Notice that we have already undertaken several easy simplification steps, defining variables which
are part of the output as a function of the system inputs and of auxiliary variables g H , h H , o H ,
and r H . Specifically, to obtain the above equations starting from the original system specification,
we have used r i [j] = s j [i], where s h [i] = g h (i), together with r i ′ = s′ [i] and the definition of G[h, i],
distinguishing between the cases i = a ∈ A and i = h ′ ∈ H.
Recall that in order to prove security, we need to give a simulator Sim with input s ′ , G A , s A , p A
and output r
A ′ , r A, G A and p such that (VSS | Sim) is equivalent to the above system. (See
Figure 21.) Notice that in the system describing a real execution, all variables except p h (and
intermediate value o h ) are defined as functions of the inputs given to the simulator. So, Sim can set
all these variables just as in the system describing the real execution. The only difference between
a real execution and a simulation is that the simulator is not allowed to set p h directly. Rather, it
should specify a polynomial p ∈ F t [X] ⊥ , which implicitly defines p h = p(h) through the equations
of the ideal VSS functionality. In other words, in order to complete the description of the simulator
we need to show that Sim can determine such a polynomial p based on its inputs s ′ , G A , s A , p A
such that p(h) equals p h as defined by the above system of equations.
Before defining p, we recall the following lemma whose simple proof is standard and omitted:
Lemma 3 Let S be such that |S| ≥ t + 1 and let {g h , h h } h∈S be a set of 2·|S| polynomials of degree
t. Then, g h (h ′ ) = h h ′(h) for all h, h ′ ∈ S holds if and only if there exists a unique polynomial
f ∈ F t [X, Y ] such that f(·, h) = g h and f(h, ·) = h h for all h ∈ S.
For T ⊆ H, |T | ≥ t + 1, define interpolate2 T (s ′ ) to be the (unique) polynomial f ∈ F t [X, Y ] such
that f(·, h) = g h and f(h, ·) = h h for all h ∈ T (if it exists), and ⊥ otherwise or if s ′ [h] = ⊥ for some
h ∈ T . Also, given C ⊆ [n], define
interpolate2 C (s ′ ) = ∨ {interpolate2 S (s ′ ) : S ⊆ C, |S| ≥ |C| − t} .
Note that since |C| ≥ n − t and n ≥ 4t + 1, interpolate2 C (s ′ ) ≠ ⊤. Indeed, for any two S, S ′ ⊆ C
such that both interpolate2 S (s ′ ) and interpolate2 S ′(s ′ ) differ from ⊥, we have |S ∩ S ′ | ≥ t + 1 and
hence interpolate2 S (s ′ ) = interpolate2 S∩S ′(s ′ ) = interpolate2 S ′(s ′ ) by Lemma 3. We finally define
the polynomial p = ˜f(·, 0), where
˜f =
∨
C⊆[n],|C|≥n−t
clique C (G) ∧ interpolate2 C (s ′ ) . (7)
We first prove that p < ⊤: To this end, assume that p ≠ ⊥. Then, ˜f ≠ ⊥, and there must exist
C ⊆ [n] such that clique C (G) = ⊤. Let S = C ∩ H. Note that for all h, h ′ ∈ S, since G[h, h ′ ] = ⊤,
it must be that h h (h ′ ) = g h ′(h). Therefore, since |S| ≥ n − 2t > 2t + 1, by Lemma 3, there exists a
unique polynomial f C such that f(·, h) = g h and f(h, ·) = h h for all h ∈ S, and by the above
f C = interpolate2 C (s ′ ) = interpolate2 C∩H (s ′ ) .
Now assume that there exist two such cliques C and C ′ , with S = C ∩ H and S ′ = C ′ ∩ H. Then,
since ∣ ∣ S ∩ S ′∣ ∣ = |S| + ∣ ∣S ′∣ ∣ − ∣ ∣S ∪ S ′∣ ∣ ≥ 2(|C| − |A|) − |H| ≥ n − 3 |A| ≥ t + 1 , (8)
by Lemma 3, we necessarily have f C = f C ′ = ˜f.
26
12. An Equational Approach to Secure Multi-party Computation