MPC based on Threshold FHE

references:

1. [Can01] Canetti R. Universally composable security: A new paradigm for cryptographic protocols[C]//Proceedings 42nd IEEE Symposium on Foundations of Computer Science. IEEE, 2001: 136-145.
2. [Gol04] Oded Goldreich. Foundations of Cryptography: Volume 2, Basic Applications. Cam bridge University Press, New York, NY, USA, 1st edition, 2004.
3. [Reg05]Oded Regev. On lattices, learning with errors, random linear codes, and cryptography. In STOC, pages 84–93, 2005.
4. [LP09] Yehuda Lindell and Benny Pinkas. A proof of security of yao’s protocol for two-party computation. J. Cryptology, 22(2):161–188, 2009.
5. [AJW11] Asharov G, Jain A, López-Alt A, et al. Multiparty computation with low communication, computation and interaction via threshold FHE[C]//Advances in Cryptology–EUROCRYPT 2012: 31st Annual International Conference on the Theory and Applications of Cryptographic Techniques, Cambridge, UK, April 15-19, 2012. Proceedings 31. Springer Berlin Heidelberg, 2012: 483-501.
6. [BGV12] Brakerski Z, Gentry C, Vaikuntanathan V. (Leveled) fully homomorphic encryption without bootstrapping[J]. ACM Transactions on Computation Theory (TOCT), 2014, 6(3): 1-36.
7. [MP12] Micciancio D, Peikert C. Trapdoors for lattices: Simpler, tighter, faster, smaller[C]//Annual International Conference on the Theory and Applications of Cryptographic Techniques. Berlin, Heidelberg: Springer Berlin Heidelberg, 2012: 700-718.
8. [GSW13] Gentry C, Sahai A, Waters B. Homomorphic encryption from learning with errors: Conceptually-simpler, asymptotically-faster, attribute-based[C]//Annual Cryptology Conference. Springer, Berlin, Heidelberg, 2013: 75-92.
9. [CM15] Clear M, McGoldrick C. Multi-identity and multi-key leveled FHE from learning with errors[C]//Advances in Cryptology–CRYPTO 2015: 35th Annual Cryptology Conference, Santa Barbara, CA, USA, August 16-20, 2015, Proceedings, Part II 35. Springer Berlin Heidelberg, 2015: 630-656.
10. [MW16] Mukherjee P, Wichs D. Two round multiparty computation via multi-key FHE[C]//Advances in Cryptology–EUROCRYPT 2016: 35th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Vienna, Austria, May 8-12, 2016, Proceedings, Part II 35. Springer Berlin Heidelberg, 2016: 735-763.

Note that "TFHE" below refers to: Tthreshold FHE (distributed threshold decryption), not TFHE scheme (optimization of GSW).

3 rounds of MPC based on TFHE

FHE can naturally implement the two-party MPC protocol: Alice generates FHE public and private keys to encrypt her input, Bob also uses Alice's public key to encrypt her input, and then Bob performs homomorphic calculations and only sends the resulting ciphertext to Alice for decryption.

To directly extend the above idea to multiple participants, the following questions arise:

1. Each party independently generates its own public and private keys, so it is difficult to calculate the ciphertext encrypted by different public keys (this is actually MK-FHE, see [CM15] for details)
2. A public and private key is generated by a single participant, and other participants use this public key, so once it is compromised, the privacy of all participants will be destroyed

[AJW11] proposed threshold fully homomorphic encryption ( TFHE , threshold fully homomorphic encryption). All participants collaborate to generate a public public-private key pair . Each participant only holds the secret share of the private key . The decryption process is a distributed decryption protocol , and " smudge " needs to be added to hide their private key information. In addition, the FHE of the BGV/BFV route also needs an evaluation key, and the process of generating it is relatively complicated (while GSW does not need it and can be simplified).

TFHE can be used to construct a secure 3-round MPC protocol under the semi-honest model (honest execution, random and uniform), and the multi-party coin toss protocol and ZKP can be transformed into a secure MPC protocol under the malicious model (arbitrary execution), but the round complexity will increase. In fact, [AJW11]'s TFHE is secure under the semi-malicious model (honest execution, but arbitrarily chosen random bands), thus allowing the multi-party coin-flipping protocol to be omitted. There is NIZKP in NP language under CRS model , so a 3-round malicious secure MPC protocol can be obtained, but it is not efficient. [AJW11] designed a dedicated Sigma protocol for LWE language under RO model .

Threshold FHE

The formal definition of threshold fully homomorphic encryption scheme (TFHE) is as follows:

• $KeyGen(setup)$： N N Interactive protocol among$N$$P_k,k\in \left[N\right]$ Execute the protocol together to generatethe public public key $pk$ ,public relinearization key $evk$ , andthe secret share of the private key $skk$$s{k}_k$, they imply public and private keys $sk$
• $Enc(pk,\mu )$ : non-interactive algorithm, each participant uses$pk$ independently encrypted message$m$
• $Eval(pk,f,c_1,\cdots ,c_l)$ : non-interactive algorithm, each participant uses$pk$ performs homomorphic operations independently
• $Dec(s{k}_1,\cdots ,s{k}_N,c)$：$N$ 个参与者之间的交互式协议，各个参与者 $P_k,k\in [N]$ 使用各自的 $s{k}_k$ 作为输入，协议结束后各方都获得明文 $\mu$

[AJW11] 使用 BGV 方案作为基础加密方案，密文 $c=(a,b)$ 可以被视为多变元线性多项式 ${\varphi }_c(x):=b-a^{T}x$, the decryption algorithm is$Dec(s,c)=({\varphi }_c(s)(\mathrm{mod}q))\left(mod2\right)$ . Homomorphic addition is${\varphi }_{add}(x)={\varphi }_{c_1}\left(x\right)+{\varphi }_{c_2}\left(x\right)$ , the ciphertext is still a linear polynomial; and the homomorphic multiplication is${\varphi }_{mul}\left(x\right)={\varphi }_{c_1}\left(x\right)\cdot {\varphi }_{c_2}(x)$，多项式度数上升为 $2$，因此需要 “重线性化” 运算。假设原始私钥为 $s$，新的私钥为 $s^{\prime }$，令 s [ i ] = s i , i ∈ [ n ] : = { 1 , ⋯   , n } s[i]=s_i,i \in [n]:=\{1,\cdots,n\} s[i]=si​,i∈[n]:={ 1,⋯,n} 表述私钥向量的各分量，并设置 $s[0]=1$ , then the corresponding relinearization key is:
evk : = { ψ i , j , τ ← S ym E nc ( s ′ , si ⋅ sj ⋅ 2 τ ) : i ∈ [ n ] , j ∈ [ n ] ∪ { 0 } , τ ∈ { 0 , ⋯ , ⌊ log ⁡ ( q ) ⌋ } } evk := \{\psi_{i,j,\tau} \leftarrow SymEnc(s', s_i \cdot s_j \cdot 2^\tau):\,\, i \in [n], j \in [n] \cup\{0\}, \tau \in \{0,\cdots,\lfloor\log (q)\rfloor\}\}e v k:={ psi , j , t←SymEnc(s′,si​⋅sj​⋅2t ):i∈[n],j∈[n]∪{ 0},t∈{ 0,⋯,⌊log(q)⌋}}

Key-Homomorphic

我们将判定型 LWE 问题记为 $LW{E}_{n,q,\varphi ,\chi }$，其中 $\varphi$ 是秘密 $s$ 的分布，$\chi$ 是噪声 $e$ 的分布。容易证明，当模数 $q$ 是奇数时，$LW{E}_{n,q,\varphi ,2\chi }$ 与 $LW{E}_{n,q,\varphi ,\chi }$ 一样难，其中的 $2\chi$ 是指采样 $e\leftarrow \chi$ 然后将 $2e$ 作为输出。

Uniqueness of LWE Secrets：安全参数 $\kappa$，令 $n$ 是正整数，$q$ 是素数，设置 $m>n\log (q)+w(\log (\kappa ))$ 以及 $B<q/8$，那么均匀选取的 $A\leftarrow {\mathbb{Z}}_q^{m\times n}$ 以概率 $1-negl(\kappa )$ 使得：对于任意的 $p\in {\mathbb{Z}}_q^m$，存在至多单个 $(s,e)$ 满足 $s\in {\mathbb{Z}}_q^n$ 以及 $e\in [-B,B{]}^m$，使得 $p=As+2e$。如果存在 $(s,e)\ne (s^{\prime },e^{\prime })$ 使得 $p=As+2e\_=A{s}^{\prime }+2e{\_}^{\prime }$ , then$A(s-s^{\prime })=2(e^{\prime }-e)\in [-2B,2B]\_{}^m$ , for any fixed$s^{\ast }=s-s^{\prime }$ , the uniformly selected$A$ The probability that the above formula is true is only$(4B/q{)}^m\le 2^{-m}$。

Now we give a basic encryption scheme based on LWE:

• $Setup(1^{\kappa })$：输入安全参数 $1^{\kappa }$，计算奇数 $q=q(\kappa )$，维度 $m=m(\kappa ),n=n(\kappa )$，环 ${\mathbb{Z}}_q$ 上噪声分布 $\varphi =\varphi (\kappa ),\chi =\chi (\kappa )$，输出参数 $params=(1^{\kappa },q,m,n,\varphi ,\chi )$
• $SymKeyGen(params)$：采样秘密 $s\leftarrow {\varphi }^n$，输出 $sk:=s$ 作为对称秘钥
• $PubKeyGen\left(s\right)$ : uniform sampling$A\leftarrow {\mathbb{Z}}_q^{m\times n}$, sampling noise $e\leftarrow h^m$，计算 $p=As+2e\_\in Z_q^m$(Can be regarded as $m$ ciphertexts$SymEnc(sk,0)$ ), output$pk:=(A,p)$ as the corresponding public key
• $SymEnc(sk,\mu )$ : input messageμ ∈ { 0 , 1 } \mu \in \{0,1\}m∈{ 0,1 } , uniform sampling$a\leftarrow {\mathbb{Z}}_q^n$, sampling noise $e\leftarrow \chi$，计算 $b=a^{T}s+2e\_+m\in Z_q$, output ciphertext $ct:=(a,b)$
• $PubEnc(pk,\mu )$：输入消息 μ ∈ { 0 , 1 } \mu \in \{0,1\} μ∈{ 0,1}，均匀采样 r ← { 0 , 1 } m r \leftarrow \mathbb \{0,1\}^m r←{ 0,1}m，计算 $a=r^{T}A\in {\mathbb{Z}}_q^n$ 以及 $b=r^{T}p+\mu$（若 $p=As+2e$，则 $b$ 中的噪声为 $2r^{T}e$), output ciphertext$ct:=(a,b)$
• $Dec(sk,ct)$ : input ciphertext$ct=(a,b)$，输出 $(b-a^{T}s(\mathrm{mod}q))(mod2)$

According to the article in [Reg05], in $LW{E}_{n,q,\varphi ,}$ 假设下，上述加密方案是语义安全的，同时也是伪随机密文的。之后的一些著名全同态加密都是基于上述加密算法的，例如 BGV、BFV、CKKS 等等。除了加法同态和乘法同态，[AJW11] 进一步提出了“秘钥同态”，这可以用于构造分布式的门限解密协议。将系数 $a,A$ 以及噪声 $e$ 作为图灵机随机带，公钥生成算法的符号记为 $PubKeyGen(s;A,e)$，加密算法的符号记为 $SymEnc(sk,\mu ;a,e)$ 和 $PubEnc(pk,m;A,e)$。

Key-Homomorphic Properties : Given two private keys $s_1,s_2\in {\mathbb{Z}}_q^n$, two plaintexts μ 1 , μ 2 ∈ { 0 , 1 } \mu_1,\mu_2 \in \{0,1\}m1​,m2​∈{ 0,1}，

1. Fix a coefficient $a\in Z_q^n$, given two noises $e_1,e_2\in Z_q$, Symmetric encryption $(a,b_1)=SymEnc(s_1,m_1;a,e_1)$ 以及 $(a,b_2)=SymEnc(s_2,m_2;a,e_2)$ , Natsumimon$(a,b_1+b_2)$ 满足
   $$(a,b_1+b_2)=SymEnc(s_1+s_2,m_1+m_2;a,e_1+e_2)$$
   is the addition of the second component of the ciphertext, and the resulting new ciphertext is the homomorphic addition ciphertext under the sum of the two private keys.

2. Fix a coefficient $A\in {\mathbb{Z}}_q^{m\times n}$，任给两个噪声 $e_1,e_2\in {\mathbb{Z}}_q^m$，公钥生成 $(A,p_1)=PubKeyGen(s_1;A,e_1)$ 以及 $(A,p_2)=PubKeyGen(s_2;A,e_2)$，那么公钥 $(A,p_1+p_2)$ 满足
   $$(A,p_1+p_2)=PubKeyGen(s_1+s_2;A,e_1+e_2)$$
   is the addition of the second components of the public key, and the resulting new public key is the public key corresponding to the sum of the two private keys.

We expect the combined public key $(A,p_1+p_2)$ , the above basic encryption scheme is still semantically secure, but the combined public key distribution is different from the original distribution. [AJW11] proposed that a large noise can be used to pollute (smudge out) any small value, and then prove that the distribution of the ciphertext under the combined public key after contamination is indistinguishable from the uniform distribution.

Smudging Lemma : Security parameter $\kappa$ , let$B_1,B_2$is a positive integer, $e_1\in [-B_1,B_2]$ is a fixed integer,$e_2\leftarrow [B_2,B_2]$ is a uniform random number. Then as long as$B_1/B_2=negl\left(\kappa \right)$ ,$e_2$The distribution of $e_1+e_2$The distributions of are statistically indistinguishable.
$$D=\frac{1}{2}\sum _{x=-(B_1+B_2)}^{B_1+B_2}\left|Pr\right[e_2=x]-Pr[e_1+e_2=x\left]\right|=\frac{1}{2}\left(\sum _{x=-(B_1+B_2)}^{-B_2}\frac{1}{B_2}+\sum _{x=-\left(B_2\right)}^{B_1+B_2}\frac{1}{B_2}\right)=\frac{B_1}{B_2}$$
Security of combined keys : we define the adversary $A$ and ChallengerC \mathcal CGame between$C$$JoinKe{y}^{\mathcal{A}}(params,B_1,B_2)$，

1. $C$ Generate private key$s\leftarrow SymKeyGen\left(params\right)$ , calculate the public key$(A,p)=PubKeyGen(s)$，将公钥发送给 $\mathcal{A}$
2. $\mathcal{A}$ 自适应地选择 $p^{\prime },s^{\prime },e^{\prime }$，满足 $p^{\prime }=A{s}^{\prime }+2e^{\prime }$ 以及 $\Vert e^{\prime }{\Vert }_1\le B_1$，选择明文 $\mu$，发送 $(p^{\prime },s^{\prime },e^{\prime },\mu )$ 给 $\mathcal{C}$
3. $\mathcal{C}$ 计算组合秘钥 $(A,p^{\ast }=p+p^{\prime })$，均匀掷硬币 β ← { 0 , 1 } \beta \leftarrow \{0,1\} β←{ 0,1}，当 $\beta =0$ 时均匀采样 $p{k}^{\ast }=(a^{\ast },b^{\ast })\leftarrow {\mathbb{Z}}_q^{n+1}$，当 $\beta =1$ 时计算 $(a^{\ast },b)\leftarrow PubEnc(p{k}^{\ast },\mu )$ , sampling "pollution noise"$e^{\ast }\leftarrow [-B_2,B_2]$ , set$b^{\ast }=b+2e{\_}^{\ast }$ , send "polluted ciphertext"$(a^{\ast },b^{\ast })$A$\mathcal{A}$
4. A \mathcal A Class$A$$(a^{\ast },b^{\ast })$In which case, outputβ ′ ∈ { 0 , 1 } \beta' \in \{0,1\}b′∈{ 0,1}

我们说组合秘钥是安全的，如果对于任意的 PPT 敌手 $\mathcal{A}$，都有
$$|Pr[JoinKe{y}^{\mathcal{A}}(params,B_1,B_2)=1]-\frac{1}{2}|=negl(\kappa )$$
可以证明，给定一组参数 $params$ 使得基础加密方案是语义安全的，那么对于任意的 $B_1,B_2$，满足 $B_1/B_2=negl(\kappa )$，组合秘钥是安全的。否则，存在一个 PPT 敌手 $\mathcal{A}$ 打破组合秘钥安全性。我们构造另一个敌手 $\mathcal{B}$，它的输入是公钥 $pk=(A,p)$ 和密文 $(a,b)$，它试图区分 $(a,b)$ 是真正的密文 $PubEnc(pk,0)$ 还是均匀随机数。敌手 $\mathcal{B}$ 以敌手 $\mathcal{A}$ 作为子程序，为它模拟 $JoinKe{y}^{\mathcal{A}}$ 游戏中的视图，

1. $\mathcal{B}$ 直接将 $pk$ 发送给 $\mathcal{A}$，收到回应 $(p^{\prime },s^{\prime },e^{\prime },\mu )$
2. $\mathcal{B}$ 采样噪声 $e^{\ast }\leftarrow [-B_2,B_2]$，设置 $a^{\ast }=a,b^{\ast }=b+a^T{s}^{\prime }+\mu +2e^{\ast }$，发送 $(a^{\ast },b^{\ast })$ 给 $\mathcal{A}$
3. $\mathcal{B}$ 输出 $\mathcal{A}$ 所返回的 $\beta$

易知 $\mathcal{B}$ 是 PPT 敌手。假设 $(a,b)$ 是均匀的，那么 $(a^{\ast },b^{\ast })$ 明显也是均匀的。假设 $(a,b)\leftarrow PubEnc(pk,0)$ , since$p^{\prime }=A{s}^{\prime }+2e{\_}^{\prime }$，那么有
$$b^{\ast }=(r^{T}p+2e)\_+r^T(p^{\prime }-2e{\_}^{\prime })+m+2e{\_}^{\ast }=r^T{p}^{\ast }+m+(2e{\_}^{\ast }-2r^{That\text{'}s}{it}^{\prime })$$
r$r^{That\text{'}s}{it}^{\prime }\le \Vert e^{\prime }{\Vert }_1\le B_1$, is a small constant, so according to Smudging Lemma, $b^{\ast }\stackrel{s}{\equiv }{r}^T{p}^{\ast }+m+2e{\_}^{\ast }$ , so$B$ to$A$ models statistically indistinguishable views. Thus$While\; A$ breaks the security of the combined key,$B$ also breaks the pseudo-randomness of the ciphertext of the basic encryption scheme, resulting in a contradiction. Therefore, the tainted ciphertext under the combined key is indistinguishable from the uniform random number, and the combined key is safe.

Construction

Using BGV as the basic encryption algorithm, TFHE is constructed as follows:

• $TFHE.Setup\left(\right)$ : All participants reach a consensus on all the following parameters to determine the operation$depth$$of$$BGV$$D$ , the encryption algorithm parameter of each layer is$para{m}_d:=(1^{Mr.}\_q_d,m,n,\varphi ,\chi )$ , noise range$B_{},B_{}\in Z$ , the range of pollution noise$B_{eval},B_{enc},B_{dec}\in \mathbb{Z}$，系数 { A d ← Z q d m × n } \{A_d \leftarrow \mathbb Z_{q_d}^{m \times n}\} { Ad​←Zqd​m×n​} 和 { a d , i , τ k ← Z q d n } \{a_{d,i,\tau}^k \leftarrow \mathbb Z_{q_d}^{n}\} { ad , i , tk​←Zqd​n​}

• $TFHE.KeyGen\left(setup\right)$ :a two-round interactive protocol,

  The first round of communication (generate public public key ):

  1. Parties $P_k$Independently generate the public-private key pair of each layer $\{(s_d^k,(A_d,p_d^k:=A_d{s}_d^k+2e{\_}_d^k))\}$ , where$A_d$is the public random string. Parties $P_k$independent calculation $(a_{d,i,t}^k,b_{d,i,t}^{k,k})\leftarrow BGV.SymEnc(s_d^k,2^t\cdot s_{d-1}^k[i];a_{d,i,r}^k,e_{d,i,t}^{k,k})$ 以及 $(a_{d,i,t}^l,b_{d,i,t}^{l,k})\leftarrow BGV.SymEnc(s_d^k,0;a_{d,i,r}^l,e_{d,i,t}^{l,k}),l\ne k$ , these{ bd , i , rl , k } \{b_{d,i,r}^{l,k}\}{ bd,i,rl,k​} will be used to create the relinearization key.

  2. All parties broadcast { pdk } , { bd , i , rl , k } \{p_d^k\},\{b_{d,i,r}^{l,k}\}{ pdk​},{ bd,i,rl,k​} , calculate$p_d^{\ast }:={\sum }_l{p}_d^l$，$b_{d,i,t}^l:={\sum }_l{b}_{d,i,t}^{l,k}$，将 $(A_d,p_d^{\ast })$ as the public public key of each layer, and{ bd , i , τ l } \{b_{d,i,\tau}^l\}{ bd , i , tl​} is the ciphertext of the private key fragment.

  3. 可以验证，
     $$\begin{array}{rl}(A,d,p_d^{\ast })& =BGV.PubKeyGen(p_d^{\ast };A_d,e_d^{\ast }),s_d^{\ast }:=\sum _{l=1}^N{s}_d^l,e_d^{\ast }:=\sum _{l=1}^N{e}_d^l\\ (a_{d,i,\tau }^l,b_{d,i,\tau }^l)& =BGV.SymEnc(s_d^{\ast },2^t\cdot s_{d-1}^l[i];a_{d,i,t}^l,e_{d,i,t}^l),e_{d,i,t}^l:=\sum _{k=1}^N{e}_{d,i,t}^{l,k}\end{array}$$

  The second round of communication (generate public relinearization key ):

  1. Each participant $P_k$ 采样 $(v_{d,i,j,\tau }^{l,k},w_{d,i,j,\tau }^{l,k})\leftarrow BGV.PubEnc(p_d^{\ast },0)$ 以及污染噪声 $e\leftarrow [-B_{eval},B_{eval}]$，计算 $({\alpha }_{d,i,j,\tau }^{l,k},{\beta }_{d,i,j,\tau }^{l,k}):=s_{d-1}^k[j]\cdot (a_{d,i,\tau }^l,b_{d,i,t}^l)+(v_{d,i,j,\tau }^{l,k},w_{d,i,j,\tau }^{l,k}+2e)\_$

  2. 各方广播 $\{({\alpha }_{d,i,j,\tau }^{l,k},{\beta }_{d,i,j,\tau }^{l,k})\}$，对于 $j\in [n]$ 计算 ${\varphi }_{d,i,j,\tau }:={\sum }_l{\sum }_k({\alpha }_{d,i,j,\tau }^{l,k},{\beta }_{d,i,j,\tau }^{l,k})$，对于 $j=0$ ϕ${\varphi }_{d,i,j,\tau }:={\sum }_l(a_{d,i,j,\tau }^l,b_{d,i,j,\tau }^l)$

  3. 可以验证，
     $$\begin{array}{rl}(a_{d,i,j,\tau }^{l,k},b_{d,i,j,\tau }^{l,k})& =BGV.SymEnc(s_d^{\ast },2^t\cdot s_{d-1}^l[i]\cdot s_{d-1}^k[j])\\ {\varphi }_{d,i,j,\tau }& =BGV.SymEnc(s_d^{\ast },2^t\cdot s_{d-1}^{\ast }[i]\cdot s_{d-1}^{\ast }[j])\end{array}$$

  The output of the algorithm is: public public key $pk:=(A_0,p_0^{\ast })$ , public relinearization key$evk:=\left\{p_{d,i,j,\tau }\right\}$ , participant$P_k$holds the private key $s{k}_D$Secret sharing $s_D^k$

• $TFHE.Enc(pk,\mu )$ : in parameter$para{m}_0$Calculate the ciphertext $(v,w)\leftarrow BGV.Enc(pk,\mu )$ , and then sample additional pollution noise$e\leftarrow [-B_{enc},B_{enc}]$ , output ciphertext$c:=((v,w+2e),\_level=0)$

• $TFHE.Eval(evk,f,c_1,\cdots ,c_l)$ : non-interactive algorithm, simply output$BGV.Eval(evk,f,c_1,\cdots ,c_l)$

• $TFHE.Dec(s_D^1,\cdots ,s_D^N,c)$ :a round of interactive protocol,

  1. Suppose the ciphertext is of the form $c=(v,w,D)$ , the combined private key is$s_D^{\ast }:={\sum }_k{s}_D^k$
  2. Parties $P_k$calculationwk $w^k=v^T{s}_D^k+2e{\_}_k$, where $e_k\leftarrow [-B_{dec},B_{dec}]$ is the pollution noise, which will partially decrypt the value$w^k$ broadcast to other participants
  3. 各方设备${\varphi }_c(s_D)=w-{\sum }_k{w}^k$ , output plaintext$({\varphi }_c(s)(\mathrm{mod}q{)}_D\left)\right(mod2)$

We choose a set of parameters so that the basic FHE scheme is semantically safe, and then choose the appropriate pollution noise $B_{eval},B_{enc},B_{dec}$Make the combined secret key $p_d^{\ast }={\sum }_l{p}_d^l$is safe. In addition, TFHE also needs to prove the security of its threshold decryption algorithm.

Semi-Malicious MPC

Now, we use the above TFHE, and immediately get a general MPC protocol: let f : ( { 0 , 1 } lin ) N → { 0 , 1 } loutf:(\{0,1\}^{l_{in}})^N \to \{0,1\}^{l_{out}}f:({ 0,1}lin​)N→{ 0,1}lout​is a deterministic function of any common output , and the multiplication depth of the corresponding logic circuit is $D$ , protocol${Pi}_f$Proceed as follows:

1. Initialization: Each participant negotiates the parameter $setup$ , let$P_k$The input is xk ∈ { 0 , 1 } lin x_k \in \{0,1\}^{l_{in}}xk​∈{ 0,1}lin​

2. The first round of communication: each participant $P_k$执行$TFHE.$ The first round of$Key$$G$$e$$n$$($$se$$t$$u$$p$$)$$pk$ and private key secret share$s{k}_k$

3. The second round of communication: each participant $P_k$Use the obtained $pk$ encrypts xk x_kbit by bit$x_k$, get ciphertext $c_{k,i}\leftarrow TFHE.Enc(pk,x_k[i])$ . Simultaneously execute$The\; second\; round\; of\; TFHE.KeyGen\left(setup\right)$ , obtain the public relinearization key$evk$，将( { ck , i } , evk ) (\{c_{k,i}\},evk)({ ck,i​},e v k ) pack and broadcast to other participants

4. The third round of communication: order $f_j$is the function $The\; operation\; function\; of\; each\; output\; bit\; of\; f$ , the homomorphic calculation of all partiescj = E val ( evk , fj , { ck , i } ) c_j = Eval(evk,f_j,\{c_{k,i}\})cj​=Eval(evk,fj​,{ ck,i​}) . When decryption is required, all participants cooperate to execute$y_j=TFHE.Dec(s_D^1,\cdots ,s_D^N,c_j)$ to obtain the output value$y=f(x_1,\cdots ,x_N)$

According to the standard transformation technique in [Gol04], for any random function $g(x_1,\cdots ,x_N;r)\mapsto y$ , we can define a deterministic function
$$f((x_1,r_1),\cdots ,(x_N,r_N)):=g(x_1,\cdots ,x_N;\underset{i=1}{\overset{N}{⨂}}{r}_i)$$
As long as there is a participant who flips a coin evenly, then${⨂}_{i=1}^N{r}_i$will be an unbiased random string. The above conversion process does not increase the round complexity of MPC.

According to the standard transformation technique in [LP09], for any private output function $g(x_1,\cdots ,x_N)\mapsto (y_1,\cdots ,y_N)$ , we can all define a common output function
$$f((x_1,s_1),\cdots ,(x_N,s_N)):=y_1\otimes s_1\Vert \cdots \Vert y_N\otimes s_N$$
where $s_k$is a symmetric encrypted private key independently selected by each party. Execute the MPC protocol to calculate the above functions, and finally each participant $P_k$For yk ⊗ sk y_k \otimes s_k in the calculation result$y_k\otimes s_k$Partially decrypted. This only adds a local post-processing pass with minimal overhead and does not increase the round complexity of MPC.

It can be proved that the above MPC protocol is semi-malicious and secure under the UC framework. The UC framework is described in [Can01], the paper has more than 100 pages, and I haven't read it yet, so I won't write the security proof here. The "semi-malicious adversary" here is a stronger concept proposed by [AJW11] than the semi-honest adversary, so it will be easier to switch from a semi-malicious security protocol to a malicious security protocol.

Universal Composability Framework ([Can01]): Define PPT environment $Z$ , input as security parameter$1^{\kappa }$ and auxiliary input$z$ , which operates in the real or ideal world.

• Ideal world : There are several virtual participants ${\tilde{P}}_1,\cdots ,{\tilde{P}}_N$, an ideal rival $S$ invades some virtual participants, they calculate a functional$\mathcal{F}$
• Real World : There are several PPT participants $P_1,\cdots ,P_N$, a real adversary $A$ has hacked some participants, they execute a protocol$Pi$
• Environment $Z$ provides input to the participantinteracts with the adversaryduring execution, and finally$Z$ judgeswhether it is in the real world or an ideal world. Define random variables$IDEA{L}_{\mathcal{F},S,\mathcal{Z}}(1^{Mr.}\_z)$ is the view after interaction between the environment and the participants and opponents in the ideal world, let$IDEA{L}_{\mathcal{F},S,\mathcal{Z}}$is a distribution cluster. Define the random variable $REA{L}_{\pi ,A,}(1^{Mr.}\_z)$ is the view after interaction between the environment and the participants and adversaries in the ideal world, let$REA{L}_{\pi ,A,}$is a distribution cluster.

UC Security : Given a positive integer $N$ , let$F$ is a$N-$ variable functionality,$\pi$ is a$N-$ party agreement. We say$\pi$ safe calculation$F$ , if for any PPT real adversary$A$ , both exist in the PPT ideal opponent$S$ , such that any PPT environment$Z$都有
$$REA{L}_{\pi ,A,}\stackrel{c}{\equiv }IDEA{L}_{\mathcal{F},S,\mathcal{Z}}$$
In order to facilitate the construction of the protocol, we often restrict the capabilities of the adversary, for example: semi-honest adversary, malicious adversary, only a certain number of participants can be hacked, and so on. There is also " security-with-abort ", where the ideal opponent $S$ can abort, resulting in no functional output on some participants; and "fairness" means that the adversary does not have the ability to abort, and honest participants will always obtain functional output.

Semi-Malicious Adversaries : A semi-malicious adversary is an interactive Turing machine, which has a " witness tape " in addition to the standard input-output tape and random tape . In each round of interaction of the protocol, the adversary replaces $P_k$send message $m$ , and write the tuple$(x,r)$ , making the opponent$P_k^{\ast }$The history records exactly match the honest execution $P_k(x,r)$ view. In each round, after receiving the message from the honest party, the adversary adaptively chooses$(m,(x,r))$ , written ( x , r ) (x,r)in different rounds$(x,r)$ can be inconsistent. At the same time, the adversary can terminate the agreement in any round of interaction.

Any semi-honest adversary chooses random bands evenly, and can simply write the random bands on the witness tape, so semi-malicious opponents are more free than semi-honest adversaries. At the same time, all the actions of the semi-malicious adversary are written in ( x , r ) (x,r) on the witness tape$(x,r)$ , so it is indeed more limited than a malicious adversary. The capabilities of a semi-malicious adversary lie strictly between those of a semi-honest adversary and a malicious adversary.

Full-Malicious MPC

In order to obtain a secure MPC protocol under a malicious model, a standard compiler can be used to convert a semi-honest security protocol, which requires a fair coin-toss protocol and a zero-knowledge proof protocol. Since the MPC protocol based on TFHE constructed by [AJW11] is semi-malicious and secure , the coin tossing link can be omitted . There is a general NIZKP protocol under the CRS model, but it is less efficient. Therefore [AJW11] designed an efficient Gap Sigma protocol (the weakening of the Sigma protocol) for LWE language, and the NIZKP protocol under the RO model can be obtained by using the FS heuristic.

Gap Sigma Protocol：令 ${\mathcal{R}}_{zk}\subseteq R_{sound}$are two NP relations, and the corresponding language is $L_{zk}\subseteq L_{sound}$. About language $(L_{zk},L_{sound})$ Gap Sigma protocol$⟨P,V⟩$ , is a three-round interactive protocol that states$x$ , given$w$ , process$⟨P(w),V⟩\left(x\right)$ produces copies of the form$(a,c,z)$ . It satisfies the following properties:

1. Correctness : For any $(x,w)\in {\mathcal{R}}_{zk}$, have $⟨P(w),V⟩(x)=1$
2. Special Soundness : Exist PPT Extractor $E$ , any statementxxTwo acceptable copies of$x$$(a,c,z),(a,c^{\prime },z^{\prime }),c\ne c^{\prime }$，那么 $E(x,a,c,z,c^{\prime },z^{\prime })\in {\mathcal{R}}_{sound}(x)$
3. Honest-Verifier Zero-Knowledge : There is a PPT simulator $S$ , given any statement$x\in L_{zk}$and challenge $c$，使得 $(a^{\prime },z^{\prime })\leftarrow S(x,c)$ 满足 $\{(a^{\prime },c,z^{\prime })\}\stackrel{s}{\equiv }\{(a,c,z)\}$ , where$(a,c,z)$ is determined by both parties$⟨P(w),V⟩\left(x\right)$ generated interactively

In the Gap Sigma protocol, its completeness and zero knowledge are about the relation ${\mathcal{R}}_{zk}$, while reliability is about the relation $R_{sound}$, satisfy the relation $R_{zk}\subseteq R_{sound}$. That is, in $R_{zk}$( x , w ) in $(x,w)$ all satisfy the above three properties; and for$R_{sound}$Some of ( x , w ) in $(x,w)$ Only reliability is satisfied, and the protocol does not guarantee correctness and zero-knowledge.

[AJW11] constructed a Gap Sigma protocol for the LWE language. Order $B$ is the scale of noise, we define an NP relation:
$${\mathcal{R}}_{LWE}^B:=\{((A,b),(s,2e\left)\right):b=As+2e,A\in {\mathbb{Z}}_q^{m\times n},b\in Z_q^m,s\in Z_q^n,2e\_\in [-B,B{]}^m\}$$
Its corresponding language is recorded as$L_{LWE}^B$, for $B^{\ast }\ge B$，易知 ${\mathcal{R}}_{LWE}^B\subseteq R_{LWE}^{B^{\ast }}$ 以及 $L_{LWE}^B\subseteq L_{LWE}^{B^{\ast }}$. Now we construct about $({\mathcal{R}}_{LWE}^B,R_{LWE}^{B^{\ast }})$ Gap Sigma protocol$⟨P,V{⟩}_{LW}$, statement for $(A,b)\in L_{LWE}^B$, given that $(s,2e)\_\in {\mathcal{R}}_{LWE}^B(A,b)$，

1. $P$ uniform sampling mask$s^{\prime }\leftarrow {\mathbb{Z}}_q^n$And even noise $2e{\_}^{\prime }\leftarrow [-(B^{\ast }/2-B),B^{\ast }/2-B{]}^m$ , calculate$b^{\prime }=A{s}^{\prime }+2e{\_}^{’}$ and send to$V$
2. $V$ randomly chooses to challengec ∈ { 0 , 1 } c \in \{0,1\}c∈{ 0,1 } Send to$P$
3. $P$ calculation$z=s^{\prime }+cs$ and send to$V$
4. $V$ calculation$2e{\_}^{\ast }=b^{\prime }+cb-Az$ , judge whether it is a short even noise$2e{\_}^{\ast }\in [-B^{\ast }/2,B^{\ast }/2{]}^m$

It can be proved that when $B/B^{\ast }=negl(\kappa )\; ,\; the\; above\; protocolis$ a Gap Sigma protocol.

• Proof completeness: for the honest prover $P$ , easy to verify$Thez=(b^{\prime }-2e{\_}^{\prime })+c(b-2e)\_=b^{\prime }+cb-2(e^{\prime }+e)$，其中 $2e{\_}^{\prime }\in [-(B^{\ast }/2-B),B^{\ast }/2-B{]}^m,2e\_\in [-B,B]$，therefore$b^{\prime }+cb-Thez=2(e^{\prime }+e)$ is a short even noise
• Proving special reliability: Given the statement $(A,$Two acceptable copies of$b$$)$$(b^{\prime },1,z_1),(b^{\prime },0,z_2)$ , we construct the extractor$E$ , which computes$s^{\ast }=z_1-z_2$ 和 $2e{\_}^{\ast }=b-A{s}^{\ast }$ , output$(s^{\ast },2e{\_}^{\ast })$. It is easy to verify that$b=A{s}^{\ast }+2e{\_}^{\ast }$ 且 $2e{\_}^{\ast }\in [-B^{\ast },B^{\ast }]$,let$(s^{\ast },2e{\_}^{\ast })\in {\mathcal{R}}_{LWE}^{B^{\ast }}(A,b)$ is a proof.
• Prove that the honest verifier is zero-knowledgeable: given $(A,b)$ and$c$ , we construct the simulator$E$ , which uniformly samples$z\leftarrow {\mathbb{Z}}_q^n$ 和 $2e{\_}^{\ast }\leftarrow [-(B^{\ast }/2-B),B^{\ast }/2-B{]}^m$ , calculate$b^{\prime }=Thez+2e{\_}^{\ast }-cb$ , output simulation view$(b^{\prime },c,z)$。由于 $b^{\prime }=Thez+2e{\_}^{\ast }-c(As+2e)$ , so let$s^{\prime }=z-cs,2e{\_}^{\prime }=2e{\_}^{\ast }-2ce$ , then$b^{\prime }=A{s}^{\prime }+2e{\_}^{\text{'}}$ . when$c=0$ , the analog view is exactly the same as$The\; real\; view\; of\; V$ is identically distributed. When$c=1$ , in the real view$b^{\prime }=A{s}^{\prime }+2e{\_}^{\prime }$，其中 $2e{\_}^{\prime }\leftarrow [-(B^{\ast }/2-B),B^{\ast }/2-B{]}^m$ . Whereas b ′ = A s ′ + 2 e ′ b'=As'+2e'in the simulation view$b^{\prime }=A{s}^{\prime }+2e{\_}^{\prime }$ , of which$2e{\_}^{\prime }=2e{\_}^{\ast }-2e$ , where$2e\_\in [-B,B{]}^m$ is a fixed small noise, because$2e{\_}^{\ast }\leftarrow [-(B^{\ast }/2-B),B^{\ast }/2-B{]}^m$ . According to Smudging Lemma, when$B/B^{\ast }=When\; negl\left(\kappa \right)$ , 2 e ′ 2e'in the simulated view and the real view$2e{\_}^{’}$ distribution is statistically indistinguishable.

Using the above protocol $⟨P,V{⟩}_{LW}$, can construct multiple ZKP protocols on other related languages, and then use the FS heuristic to obtain NIZKP under the RO model. Assemble them into the semi-malicious secure MPC protocol based on TFHE, and force all participants to implement the protocol honestly, so as to realize the maliciously secure MPC protocol. In addition, it needs to be proved that the gap does not affect the security of the protocol.