An MPC Protocol Sample Clauses

An MPC Protocol. Let t = κ(1 − s)/3. The protocol uses the following setup: • A randomly chosen committee C, where each party is chosen with probability κ/n. • A threshold fully-homomorphic encryption scheme TFHE = (KGen, Enc, Dec, Eval) [22] (de- fined in Appendix B.2) with threshold t. The public key is ek and the secret key dk = (dk1, . . . , dk|C|), where each party in C holds a secret key share, and all parties know ek and |C|. Each party in C also has a setup as sender for an instance of the protocol ΠRBC, whereas all other parties have a recipient-setup. • A common reference string CRS used for universally composable non-interactive zero-knowledge proofs [18]. Fix a (possibly randomized) functionality g the parties wish to compute. We assume without loss of generality that g uses exactly κ random bits (one can always use a PRG to ensure this). Very roughly, the protocol asks each party Pi to encrypt its input ci = Encek(xi) and execute the VACS protocol. The VACS allows parties to agree on a common subset of input providers. After that, parties homomorphically evaluate the function over the encrypted inputs to obtain an encrypted output. Finally, parties in C jointly decrypt the output. We deal with adaptive security by using secure-erasures: Parties will erase the relevant in- formation prior to sending the messages in each of the steps, avoiding in this way the so-called commitment problem (and also avoiding the need for an equivocal FHE scheme [16]), where the simulator needs to explain previously sent messages in a consistent manner. In the protocol, parties prove (in zero-knowledge) the correctness of values sent during the protocol execution. For this purpose we use universally composable non-interactive zero-knowledge (NIZK) proofs [18] based on a common reference string (CRS) provided by the dealer. We are interested in NIZK proofs for two relations, parameterized by a threshold FHE scheme with public encryption key ek: