Proof of correct decryption Sample Clauses

Proof of correct decryption. The statement consists of ek, a ciphertext c, and a decryption share d. The witness consists of a decryption key share dki, such that d = Decdki (c). The following theorem is proven in Appendix F. Theorem 15 Let 0 < s < 1/3, f ≤ (1 − 2s)n/3, and A ≤ 2+sn. Assuming the NIZK proof system MPC is universally composable, and TFHE is a threshold FHE scheme, ΠA f-securely computes g with I O A- output quality. The expected communication complexity is O(A(Iκn + κ4n) + κ5n + Oκ2n), where is the size of each party’s input and is the size of the output. The expected size of the setup is O(Aκ4 + κ5). The expected number of invocations of BA is O(A + κ). MPC Protocol ΠA − Let t = κ(1 s)/3. We describe the protocol from the point of view of a party Pi with input xi, assuming the setup described above that defines a committee C. Let g be the circuit to be computed, and let R be the number of random bits used by g. ← 1. Compute ci Encek(xi) along with a non-interactive zero-knowledge proof of plaintext knowl- edge πpopk. Erase the local randomness used to generate the ciphertext and the proof. Then, execute the VACS protocol ΠA,Qpopk using input (i, Sign (i), c , xxxxx) for the predicate Q that popk checks that the signature is correct and πpopk is a correct proof for ci. Let S be the output of the VACS containing ciphertexts with valid proofs from at least A parties. ∈ { } ← 2. Choose uniform r 0, 1 R and compute ui Encek(r) along with a non-interactive zero- knowledge proof of plaintext knowledge τ popk for ui. Erase the plaintext and the local randomness used to generate the ciphertext and the proof. Then, run Πt+1,Qpopk using input (u , τ popk) for the predicate that checks that τ popk is a correct proof for ui. Let T denote the output of the VACS. Let v be denote the ciphertext computed by adding homomorphically all ciphertexts in T . · · ∈