Secure Multiparty Computation Sample Clauses

Secure Multiparty Computation. We begin by reviewing the definition of asynchronous MPC by Xxxxxxx [13]. Let g be an n- input function, possibly randomized, where if the inputs of the parties are x = (x1, . . . , xn) then all parties should learn y ← g(x1, . . . , xn). In the real-world execution of a protocol Π computing g, each party Pi initially holds 1κ and an input xi, and an adversary A has input 1κ and auxiliary input z. The parties execute Π, and may be adaptively corrupted by A during execution of the protocol. At the end of the execution, each honest party outputs its local output (as dictated by the protocol), and A outputs its view. We let realΠ,A(κ, x, z) denote the distribution over the resulting vector of outputs as well as the set of corrupted parties. Security of Π is defined relative to an ideal-world evaluation of g by a trusted party. The parties hold inputs as above, and we now denote the adversary by S. The ideal execution proceeds as follows: • Initial corruption. S may adaptively corrupt parties and learn their inputs. • Computation with A-output quality. S sends a set CoreSet ⊆ {P1, . . . , Pn} of size at least A to the trusted party. In addition, S sends to the trusted party an input xji for each corrupted Pi ∈ CoreSet. For Pi ƒ∈ CoreSet, let xji =⊥; if Pi ∈ CoreSet is honest, then let xji = xi. The trusted party computes y ← g(x1j , . . . , xjn) and sends (y, XxxxXxx) to each party. • Additional corruption. S may corrupt additional parties.3 • Output stage. Each honest party outputs (y, CoreSet). • Post-execution corruption. S may corrupt additional parties, and then outputs an arbitrary function of its view. We let idealA g,S (κ, x, z) be the distribution over the vector of outputs and the set of cor- rupted parties following an ideal-world execution as above. Definition 15 Π f -securely computes g with A-output quality if for any ppt adversary A corrupting up to f parties, there is a ppt adversary S such that: A {idealg,S (κ, x, z)}κ∈N;x,z∈{0,1}∗ ≈c {realΠ,A(κ, x, z)}κ∈N;x,z∈{0,1}∗ . MPC We construct an MPC protocol ΠA that offers a tradeoff between communication complexity and output quality; in particular, it has subquadratic communication complexity when the output quality and the output length of the functionality being computed are sublinear in the number of parties. We provide a high-level overview of our protocol next, with a full description in Figure 5. Let t = (1 − s) · κ/3. Our protocol assumes trusted setup as follows:

Secure Multiparty Computation. → A A A We begin by reviewing the definition of asynchronous MPC by Xxxxxxx [13]. Let g be an n-input function, possibly randomized, where if the inputs of the parties are x = (x1, . . . , xn) then all parties should learn y g(x1, . . . , xn). In the real- world execution of a protocol Π computing g, each party Pi initially holds 1κ and an input xi, and an adversary has input 1κ and auxiliary input z. The parties execute Π, and may be adaptively corrupted by during execution of the protocol. At the end of the execution, each honest party outputs its local output (as dictated by the protocol), and outputs its view. We let realΠ, (κ, x, z) denote the distribution over the resulting vector of outputs as well as the set of corrupted parties. £