Two-Thirds Honest-Majority MPC for Malicious Adversaries at Almost the Cost of Semi-Honest

33 Pages·2017·0.76 MB·English

Two-Thirds Honest-Majority MPC for Malicious
Adversaries at Almost the Cost of Semi-Honest󰂏
Jun Furukawa1 and Yehuda Lindell2
1 NEC Israel Research Center
[email protected]
2 Bar-Ilan University and Unbound Tech Ltd., Israel󰂏󰂏
[email protected]
Abstract. Securemultipartycomputation(MPC)enablesasetofpar-
ties to securely carry out a joint computation of their private inputs
without revealing anything but the output. Protocols for semi-honest
adversaries guarantee security as long as the corrupted parties run the
specified protocol and ensure that nothing is leaked in the transcript.
Incontrast,protocolsformaliciousadversariesguaranteesecurityinthe
presenceofarbitraryadversarieswhocanrunanyattackstrategy.Secu-
rityformaliciousadversariesistypicallywhatisneededinpractice(and
is always preferred), but comes at a significant cost.
Inthispaper,wepresentthefirstprotocolforatwo-thirdshonestmajor-
ity that achieves security in the presence of malicious adversaries at es-
sentially the exact same cost as the best known protocols for semi-honest
adversaries. Our construction is not a general transformation and thus
itispossiblethatbettersemi-honestprotocolswillbeconstructedwhich
donotsupportourtransformation.Nevertheless,forthecurrentstate-of-
the-artformanyparties(basedonShamirsharing),ourprotocolinvokes
the best semi-honest multiplication protocol exactly once per multipli-
cationgate(plussomeadditionallocalcomputationthatisnegligibleto
the overall cost). Concretely, the best version of our protocol requires
each party to send on average of just 22 elements per multiplication
3
gate (when the number of multiplication gates is at least the number
of parties). This is four times faster than the previous-best protocol of
Barak et al. (ACM CCS 2018) for small fields, and twice as fast as the
previous-best protocol of Chida et al. (CRYPTO 2018) for large fields.
1 Introduction
1.1 Background
Protocols for secure computation enable a set of parties with private inputs to
compute a joint function of their inputs while revealing nothing but the output.
󰂏 This paper appeared at ACM CCS 2019.
󰂏󰂏 Supported by the European Research Council under the ERC consolidators grant
agreement n. 615172 (HIPS), by the BIU Center for Research in Applied Cryptog-
raphy and Cyber Security in conjunction with the Israel National Cyber Bureau in
the Prime Minister’s Office, and by the Alter Family Foundation.
1
The security properties typically required from secure computation protocols
include privacy (meaning that nothing but the output is revealed), correctness
(meaningthattheoutputiscorrectlycomputed),independenceofinputs (mean-
ingthatapartycannotchooseitsinputasafunctionoftheotherparties’inputs),
fairness (meaning that if one party gets output then so do all), and guaranteed
output delivery (meaning that all parties always receive output). Formally, the
security of a protocol is proven by showing that it behaves like an ideal exe-
cution with an incorruptible trusted party who computes the function for the
parties[5,16]. Insomecases, fairnessandguaranteedoutput delivery arenot re-
quired.Thisisstandardinthecaseofnohonestmajority(sincenotallfunctions
can be computed fairly without an honest majority), but can also be the case
otherwise in order to aid the construction of highly efficient protocols (e.g., as
in [1,19]).
Protocolsforsecurecomputationmustremainsecureinthefaceofadversarial
behavior.Therearemanyparametersdeterminingtheadversary.Threethatare
of relevance to this paper are:
– Adversarial behavior: If the adversary is semi-honest, then it follows the
protocolspecificationbutmaytrytolearnmorethanisallowedbyinspecting
the protocol transcript. If the adversary is malicious, then it may follow an
arbitrary attack strategy in its attempt to break the protocol.
– Adversarial power: If the protocol is guaranteed to remain secure even if
the adversary is computationally unlimited, then the protocol is said to be
information-theoretically secure.Iftheadversaryisboundedtoprobabilistic
polynomial-time, then the protocol is computationally secure.
– Number of corruptions:Denotebytthenumberofcorruptedpartiesand
byntheoverallnumberofparties.Therearetypicallythreemainthresholds
that are considered in the literature: t<n (meaning any number of parties
maybecorrupted),t<n/2(meaningthatthereisanhonestmajority),and
t<n/3 (meaning that less than a third of the parties are corrupted).
Feasibility. Inthelate1980s,itwasshownthatanyfunctioncanbesecurelycom-
puted.Thiswasdemonstratedinthecomputationalsettingforanyt<n[25,14],
in the information-theoretic setting with t < n/3 [4,7], and in the information-
theoreticsettingwitht<n/2assumingabroadcastchannel[23].Thesefeasibil-
ityresultsdemonstratethatsecurecomputationispossible.However,significant
improvements are necessary to make it efficient enough to use in practice.
Efficiency. In the past decade, there has been a large amount of work that
has focused on making MPC efficient and practical. This has included work
on both the dishonest majority (and two-party) setting, and the setting of an
honest majority. The current state-of-the-art is that MPC is now practical for
many practical problems of interest, and progress is fast, making it possible to
continuallyexpandthedomainofpracticalapplications.Wediscussmoreabout
these works in Section 1.3.
2
1.2 Our Results
Inthispaper,weconsiderthesettingofatwo-thirdshonestmajority.Wepresent
the first protocol for the malicious setting which is concretely as efficient as the
best known protocol for semi-honest. Specifically, our protocol works by run-
ning a semi-honest MPC, and then verifying that no cheating took place before
revealing any output. Our verification method is novel, and has very low com-
municationcost(inparticular,itisindependentofthecircuitsize).Ourmethod
is not generic, in the sense that it does not work for any semi-honest protocol.
Rather, we use a semi-honest secret-sharing based multiplication protocol that
maintains privacy in the presence of malicious adversaries, but not necessarily
correctness. Formally, we prove our method in general for multiplication proto-
cols that are secure in the presence of additive attacks, as formalized and used
in [12,13,19,8]. This essentially means that the only thing that an attacker can
do in the multiplication protocol is to make the output of the multiplication of
x and y be a (valid) sharing of x y+d, instead of x y. However, unlike the
· ·
previous best work that required two invocations of the multiplication protocol
per multiplication gate [8], we require only one. It is important to note that the
standard multiplication protocols for the honest-majority information-theoretic
settingaresecureuptoadditiveattacks,including[4,15,10].Wehighlight[10]in
particular, since this is the fastest semi-honest multiplication known. We there-
fore prove our primary protocol using the base protocol of [10] to obtain a pro-
tocol that is secure for malicious adversaries at essentially the same cost as the
best semi-honest protocol of [10].
Theideabehindournovelverificationmethodisasfollows.Ingeneral,there
are two attacks that an adversary may carry out. First, it may deal shares that
aresupposedtobeofdegree-tbutareactuallynot.Second,itmaysendincorrect
valuesthatmaketheresultofthemultiplicationgatebeincorrect.Forbothcases,
weshowthatasimplelinearcheckcanbeused,thatrequirescommunicationthat
is independent of the circuit size, and is concretely very efficient. In particular,
for the degree-t check, it suffices to verify that a random linear combination of
all dealed shares is a degree-t polynomial. Furthermore, for the correctness of
multiplication, it suffices to verify that in each multiplication gate with inputs
x,y and output z the equation z x y equals 0. This can be done efficiently
− ·
by checking that a random linear combination of all of these equations equals 0.
Althoughsuchideashavebeenusedbefore,theirapplicationinthiswayisnovel
and yields a protocol that is much more efficient than previous works.
Concretely, we present two variants of the protocol (where these version re-
late to optimized instantiations of the multiplication protocol of [10]). The first
variantisinformation-theoreticandhasanamortizedcostofeachpartysending
42 field elements per multiplication gate. The second variant is computational
3
and has an amortized cost of each party sending 22 field elements per multipli-
3
cation.Fortypicalparametersofnumberofpartiesandfieldsize(evenforsmall
fields like GF[28]), the additive cost of the verification procedure is just each
party sending 62 field elements overall.
3
3
We remark that our protocol is extremely simple. This is advantageous for
efficiency,aswellasforsecurity(sinceverifyingthatasimpleprotocoliscorrectly
implemented is easier than for a complex one).
Implementation. We implemented our protocol (and will make it open source
upon publication), and ran extensive experiments to compare the different vari-
ants and to compare it do prior work. Our experiments show that the cost of
the verification is small relative to the rest of the protocol, adding only a few
percent to the running time (this percentage is higher for a small number of
parties since in this case the overall cost is so low becomes less significant with
respect to the rest of the protocol). Our protocol also significantly outperforms
thepreviousbestprotocols.SeeSection7formoredetailsontheseexperiments.
Future work. The focus of this paper is practical efficiency. However, the tech-
niques used here seem to be generalizable to arbitrary linear secret-sharing
schemes, and semi-honest multiplication protocols with weaker properties than
securityuptoadditiveattacks.Inparticular,itseemstosufficethattheprotocol
provides privacy against a malicious adversary before output is revealed, and if
asimulator can detect when any cheatingtook place. We leave these generaliza-
tions for future work. (These make no difference today since, as mentioned, the
protocol of [10] is the fastest we have today in any case, and it achieves security
up to additive attacks.)
1.3 Comparison to Prior Work
ThegoalofobtainingMPCforanhonestmajoritywithconstantcommunication
–meaningthateachpartysendsanamortizedconstantnumberoffieldelements
permultiplicationgate–hasbeenwellstudied,culminatinginthebreakthrough
result of [3]. The protocol of [3] was optimized in [2], reducing the constants to
aboutaquarteroftheiroriginalcost,butatthecostofnotachievingguaranteed
output delivery. The above works both achieve perfect security, and the cost
is independent of the field size. Concretely, in [2], each party communicates
an average of 13 field elements per multiplication gate. Thus, our information-
theoreticprotocolisabout1/3ofthecostof[2],andourcomputationally-secure
protocol is about 1/5 of the cost of [2]. In practice, this makes a significant
difference, as we show in our experiments in Section 7.2.
For the case of t < n/2, the result of [8] achieves security for malicious
adversaries at the cost of twice that of semi-honest (to be more exact, they
require a multiplication protocol that is secure up to additive attacks). This
protocol is statistical, with an error of 1/F and thus for small fields, it must
| |
be repeated and the cost increases. In contrast, we only need to repeat the
verificationforsmallfields,andthisonlyincursasmallcost.Thus,ourprotocol
is twice as fast as [8] for large fields, and even faster for smaller fields. However,
unlike our protocol, [8] achieve a higher corruption threshold of t < n/2 rather
than t<n/3, which is of course an important advantage.
4
There is a large body of work that has focused on achieving efficient mul-
tiparty computation, for the setting of two parties specifically, and a dishonest
majority in general. See [11] for an excellent survey of techniques and works in
this direction.
2 Preliminaries and Definitions
2.1 Preliminaries
Notation. Let P ,...,P denote the n parties participating in the computation,
1 n
and let t denote the number of corrupted parties. In this work, we assume that
t < n. Throughout the paper, we use I to denote the set of corrupted parties
3
and J =[n] I to denote the set of honest parties. We denote by F a finite field
\ s
and by F its size. We denote statistical closeness by .
| | ≡
Definitions of security. We use the standard definition of security based on the
ideal/real model paradigm [5,16], with security formalized for non-unanimous
abort. This means that the adversary first receives the output, and then de-
termines for each honest party whether they will receive abort or receive their
correct output. We distinguish between perfect, statistical and computational se-
curity,whererelevant.Whenconsideringstatisticalsecurity,werefertoaparam-
etersandrequirethatthestatisticaldistancebeatmost2 s.Whenconsidering
−
computational security, we refer to a security parameter κ.
Secret sharing. Although our work can be generalized to essentially any linear
secretsharing,wepresentitspecificallyforShamirsecretsharing,forclarity.As
such,weconsiderShamirsecretsharing[24]withF>n.Letα1,...,αn F.We
∈
have the following procedures:
– share(v): In this procedure, a dealer with a value v F, chooses random
a1,...,at ∈ F and defines p(x) = v + ti=1ai ·xi. T∈he dealer then sends
p(α ) to party P , for j = 1,...,n. We denote by [v] the case whereby all
j j
󰁓
partiesholdasharingofv.Wewillsometimesconsidersharingsviadegree-t
polynomials,andsometimesviadegree-2tpolynomials.Whenthisdistinction
is needed, we will denote such sharings by [v] and [v] , respectively.
t 2t
We stress that if the dealer is corrupted, then the shares received by the
parties may not be correct in that the dealer may define a polynomial of
degree greater than t. In such a case, we call the sharing invalid; else we call
itvalid.Weremarkthatwewillabusenotationandsaythatthepartieshold
shares [v] even if these are invalid.
– complete(v ,...,v ): Given t+1 shares v ,...,v , this procedure in-
i1 it+1 i1 it+1
terpolates to find the unique polynomial p passing through all these points,
andv =p(0).Then,completeoutputstheremainingn t 1sharesdefined
− −
by p.
5
– reconstruct([v] ,i): Given a sharing [v] and an index i held by the parties,
t t
all parties send their shares of [v] to P . Party P verifies that all points
t i i
lie on the same degree-t polynomial, and if yes outputs it. As long as more
than t parties are honest, this interactive protocol guarantees that if [v] is
t
not correct (see formal definition below), then P will output and abort.
i
⊥
Otherwise, if [v] is correct, then P will either output v or will abort.
t i
– open([v] ) or open([v] ): This procedure is the same as reconstruct, except
t 2t
that all parties receive the shares. Thus, naively, once can define open([v] )
t
astheexecutionofreconstruct([v] ,i)foreveryi=1,...,n.Thisisexpensive
t
since each party sends n elements overall. As shown in [3], in the ReconsPub
procedure, it is possible to run open in parallel on n t sharings of degree-t
−
at the same cost. Thus, for t<n/3 each party sends n elements in order to
open 2n/3 degree-t sharings, at an average cost of 1.5 elements per opening.
Likewise, each party sends n elements in order to open n/3 degree-2t shar-
ings, at an average cost of 3 elements per opening. It is possible to run open
onsharingsofdegree-2tsincethereare2t+1honestpartiesinourcase,and
thus it is possible to detect (but not correct) any cheating.
– Local operations:Wedenoteby[x]+[y]andc [x]thelocaloperationofeach
·
partyaddingitsshareinxwithitsshareiny,andmultiplyingitsshareinx
withascalarc,respectively.Theseoperationsalwaysresultinvalidsharings
of the result, since they are local operations only, and these can be carried
out on degree-t and degree-2t sharings.
Wealsodenoteby[x] [y]thelocaloperationofapartymultiplyingitsshare
·
in x with its share in y. Note that in this case, the result is not a valid
sharing of the same degree. However, it does hold that [x] [y] =[x y] .
t t 2t
· ·
2.2 Definition of Security
The security parameter is denoted κ; negligible functions and computational
indistinguishabilityaredefinedinthestandardway,withrespecttonon-uniform
polynomial-time distinguishers.
Ideal versus real model definition. We use the ideal/real simulation paradigm
in order to define security, where an execution in the real world is compared to
an execution in an ideal world where an incorruptible trusted party computes
the functionality for the parties [5,16]. We define security with abort (and with-
out fairness), meaning that the corrupted parties may receive output while the
honestpartiesdonot.Ourbasicdefinitiondoesnot guaranteeunanimous abort,
meaningthatsomehonestpartymayreceiveoutputwhiletheotherdoesnot.It
is easy to modify our protocols so that the honest parties unanimously abort by
running a single (weak) Byzantine agreement at the end of the execution [17];
we therefore omit this step for simplicity.
As we describe at the end of Section 6, our protocol is easily extended to
guarantee fairness. The basic definition can be modified to include fairness, as
will be described below.
6
Therealmodel. Intherealmodel,an-partyprotocolπisexecutedbytheparties.
Forsimplicity,weconsiderasynchronousnetworkthatproceedsinroundsanda
rushingadversary,meaningthattheadversaryreceivesitsincomingmessagesina
roundbeforeitsendsitsoutgoingmessage.3Theadversary canbemalicious;it
A
sendsallmessagesinplaceofthecorruptedparties,andcanfollowanyarbitrary
strategy. The honest parties follow the instructions of the protocol.
Let be a non-uniform probabilistic polynomial-time adversary controlling
A
t < n parties. Let real (x ,...,x ,κ) denote the output of the honest
3 π, (z),I 1 n
A
parties and in an real execution of π, with inputs x ,...,x , auxiliary-input
1 n
A
z for , and security parameter κ.
A
The ideal model. We define the ideal model, for any (possibly reactive) func-
tionality , receiving inputs from P ,...,P and providing them outputs. Let
1 n
F
I 1,...,n be the set of indices of the corrupted parties controlled by the
⊂ { }
adversary. The ideal execution proceeds as follows:
– Send inputs to the trusted party: Each honest party P sends its spec-
j
ified input x to the trusted party. A corrupted party P controlled by the
j i
adversary may either send its specified input x , some other x or an abort
i ′i
message.
– Early abort option:Ifthetrustedpartyreceivedabortfromtheadversary
, it sends to all parties and terminates. Otherwise, it proceeds to the
A ⊥
next step.
– Trusted party sends output to the adversary:Thetrustedpartycom-
putes each party’s output as specified by the functionality based on the
F
inputsreceived;denotetheoutputofP byy .Thetrustedpartythensends
j j
y to the corrupted parties.
i i I
{ }∈
– Adversary instructs trusted party to continue or halt: For each j
∈
1,...,n with j / I, the adversary sends the trusted party either abort or
j
{ } ∈
continue . For each j / I:
j
∈
If the trusted party received abort then it sends P the abort value
j j
• ⊥
for output.
Ifthetrustedpartyreceivedcontinue thenitsendsP itsoutputvaluey .
j j j
•
– Outputs:Thehonestpartiesalwaysoutputtheoutputvaluetheyobtained
from the trusted party, and the corrupted parties outputs nothing.
Let be a non-uniform probabilistic polynomial-time adversary controlling
S
parties P for i I. Let ideal (x ,...,x ,κ) denote the output of the
i , (z),I 1 n
∈ F S
honest parties and in an ideal execution with the functionality , inputs
S F
x ,...,x to the parties, auxiliary-input z to , and security parameter κ.
1 n
S
3 Thismodelingisonlyforsimplicity,sinceinourprotocol,allpartiesreceiveandsend
messages in each round. Thus, by instructing each party to only send their round
i+1 messages after receiving all round-i messages, we have that an execution of
theprotocolinanasynchronousnetworkisthesameasforarushingadversaryina
synchronous network. Note that we do not guarantee output delivery, so “hanging”
of the protocol is also allowed.
7
Security. Informally speaking, the definition says that protocol π securely com-
putesf ifadversariesintheidealworldcansimulateexecutionsoftherealworld
protocol. In some of our protocols there is a statistical error that is not depen-
dent on the computational security parameter. As in [20], we formalize security
inthismodelbysayingthatthedistinguishercandistinguishwithprobabilityat
mostthiserrorplus somefactorthatisnegligibleinthesecurityparameter.This
is formally different from the standard definition of security since the statistical
error does not decrease as the security parameter increases.
Definition 2.1. Let bean-partyfunctionality,andletπbean-partyprotocol.
F
We say that π securely computes f with abort in the presence of an adversary
controlling t < n parties, if for every non-uniform probabilistic polynomial-
3
time adversary in the real world, there exists a non-uniform probabilistic
A
polynomial-time simulator/adversary in the ideal model with , such that
S F
for every I 1,...,n with I < n,
⊂{ } | | 3
c
ideal (x ,...,x ,κ) real (x ,...,x ,κ)
F, (z),I 1 n π, (z),I 1 n
S ≡ A
󰀋 󰀌 󰀋 󰀌
where x1,...,xn F∗ under the constraint that x1 = = xn , z F∗ and
∈ | | ··· | | ∈
κ N. We say that π securely computes f with abort in the presence of an
∈
adversary controlling t < n parties with statistical error 2 σ if there exists a
3 −
negligible function µ() such that the distinguishing probability of the adversary
·
is less than 2−σ+µ(κ). □
Fairness. The above definition can be modified so that fairness is guaranteed
by merely modifying the ideal model so that after the “early abort option” the
trusted party simply sends each party its output. That is, if there is no early
abort, then all parties receive output. This is the only modification required to
the definition.
The hybrid model. We prove the security of our protocols in a hybrid model,
wherepartiesrunaprotocolwithrealmessagesandalsohaveaccesstoatrusted
party computing a subfunctionality for them. The modular sequential compo-
sition theorem of [5] states that one can replace the trusted party computing
the subfunctionality with a real secure protocol computing the subfunction-
ality. When the subfunctionality is g, we say that the protocol works in the
g-hybrid model.
Universal Composability [6]. Protocols that are proven secure in the universal
composability framework have the property that they maintain their security
when run in parallel and concurrently with other secure and insecure protocols.
In[18,Theorem1.5],itwasshownthatanyprotocolthatisprovensecurewitha
black-box non-rewinding simulator and also has the property that the inputs of
all parties are fixed before the execution begins (called input availability or start
synchronization in [18]), is also secure under universal composability. Since the
input availability property holds for all of our protocols and subprotocols, it is
8
sufficient to prove security in the classic stand-alone setting and automatically
derive universal composability from [18]. We remark that this also enables us to
call the protocol and subprotocols that we use in parallel and concurrently (and
notjustsequentially),enablingustoachievemoreefficientcomputation(e.g.,by
runningmanyexecutionsinparallelorrunningeachlayerofacircuitinparallel).
3 Building Blocks and Sub-Protocols
Inthissection,wedefineaseriesofbuildingblocksthatweneedforourprotocol.
Most of these are used in previous works, like [3,19,2,8]. Our presentation is
similar,withsomemodificationswherepossibleduetousworkinginthescenario
of t<n/3 (rather than t<n/2 like in [19,8]).
3.1 Generating Random Shares and Coins
We define the ideal functionality to generate a sharing of a random value
rand
F
unknown to the parties. A formal description appears in Functionality 3.1. The
functionality lets the adversary choose the corrupted parties’ shares, which to-
gether with the random secret chosen by the functionality, are used to compute
the shares of the honest parties.
FUNCTIONALITY 3.1 ( – Generating Random Shares)
Frand
Uponreceivingr foreachcorruptedpartyP withi Ifromtheidealadversary ,
i i
∈ S
the ideal functionality rand chooses a random r F and generates a sharing [r]t
F ∈
undertheconstraintthattheshareofP isr foreveryP I.Then, sends
i i i rand
∈ F
each honest party P its share in [r] .
j t
The functionality double is defined similarly to , but generates double
Frand Frand
sharings that are defined to be two sharings of the same random value r, but
where one is of degree-t and the other of degree-2t.
FUNCTIONALITY 3.2 ( double – Random Double Sharings)
Frand
Uponreceivingri,ri′foreachcorruptedpartyPiwithi∈Ifromtheidealadversary
S, the ideal functionality Frdaonudble chooses a random r∈F, and generates sharings
[r] and [r] undertheconstraintthatthesharesofP in [r] and [r] arer and
t 2t i t 2t i
ri′,respectively,foreveryi∈I.Then,FrdaonudblesendseachhonestpartyPj itsshares
in [r] and [r] .
t 2t
9
Method and complexity: We use the method called DoubleShareRandom from [2]
which is based on [3] in order to generate double random sharings with perfect
security in the presence of malicious adversaries where t < n/3. This protocol
generates n 2t double-random sharings at the cost of 2n+2(n 2t) elements
− −
sent by each party. For t < n/3, this generates n/3 sharings at the average
cost of 2n+2n/3 =8 elements per party per double-sharing generated. Although
n/3
single random shares, as in , can be generated more efficiently than double
rand
F
random sharings, we only need a few of these. Thus, we will only use double,
Frand
and will discard the 2t-degree share where not needed. This is the most efficient
since double generates many random double sharings at once, and for typical
Frand
parameters one call to double is enough for the entire protocol.
Frand
Generating random coins. is an ideal functionality that chooses a random
coin
F
element from F and hands it to all parties. The simplest way to compute coin
F
securely(inthesenseofusingexistingbuildingblocks)istouse togenerate
rand
F
a random sharing and then open it. The security of this protocol is immediate,
and the cost of the protocol is one call to and one execution of open (the
rand
F
latter which costs sending n elements per party).
3.2 Checking Equality to 0
Inourprotocol,wewillneedtocheckwhetheragivensharingisasharingofthe
value 0, without revealing any further information on the shared value. For this
purpose, we use a variant of the protocol presented in [8]. The idea behind the
protocol is simple. Holding a sharing [v], the parties generate a random sharing
[r]andmultiplyitwith[v](usinglocalmultiplicationoftheirshares).Then,the
parties open the obtained sharing and check equality to 0. This works since if
v =0,thenmultiplyingitwitharandomr willstillyield0.Incontrast,ifv =0,
∕
then the multiplication will result with 0 only when r =0, which happens with
probability 1 .Byrepeatingsufficientlymanytimes,thisprobabilityoferrorcan
F
be made neg|li|gible. However, in order to ensure that nothing is revealed by the
opening,weneedtorerandomizethesharingofr v byaddingarandomdegree-
·
2t sharing of 0. This is easy to achieve by constructing a double random sharing
[ρ] and [ρ] , opening the degree-t sharing to obtain ρ and then computing
t 2t
[0] =[ρ] ρ. In order to reduce the number of rounds required, we open [ρ]
2t 2t t
−
together with [r v+ρ] and just verify that the values are equal to each other;
2t
·
this is equivalent to r v being equal to 0.
·
The zero-checking protocol that we present here is a bit more efficient than
that of [8], since here we have a single opening of a share. In contrast, the
protocol for checking equality to 0 in [8] first runs a multiplication protocol
involving opening and then has another opening.
Theidealfunctionality forcheckingequalityto0isformallydefined
checkZero
F
in Functionality 3.3.
10