Breaking the O(nm) Bit Barrier: Secure Multiparty Computation with a Static Adversary

Transcription

1 Breakig the O(m) Bit Barrier: Secure Multiparty Computatio with a Static Adversary Varsha Dai Uiversity o New Mexico Valerie Kig Uiversity o Victoria Jared Saia Uiversity o New Mexico Mahush Mohavedi Uiversity o New Mexico Abstract We describe scalable algorithms or secure multiparty computatio (SMPC). We assume a sychroous message passig commuicatio model, but ulike most related work, we do ot assume the existece o a broadcast chael. Our mai result holds or the case where there are players, o which a 1/3 ɛ ractio are cotrolled by a adversary, or ɛ ay positive costat. We describe a SMPC algorithm or this model that requires each player to sed Õ( +m + +m ) messages ad perorm Õ( + ) computatios to compute ay uctio, where m is the size o a circuit to compute. We also cosider a model where all players are selish but ratioal. I this model, we describe a Nash equilibrium protocol that solve SMPC +m +m ad requires each player to sed Õ( ) messages ad perorm Õ( ) computatios. These results sigiicatly improve over past results or SMPC which require each player to sed a umber o bits ad perorm a umber o computatios that is θ(m).

2 1 Itroductio I 1982, Adrew Yao posed a problem that has sigiicatly impacted the weltaschauug o computer security research [22]. Two millioaires wat to determie who is wealthiest; however, either wats to reveal ay additioal iormatio about their wealth. Ca we desig a protocol to allow both millioaires to determie who is wealthiest? This problem is a example o the celebrated secure multiparty computatio (SMPC) problem. I this problem, players each have a private iput, ad their goal is to compute the value o a -ary uctio,, over its iputs, without revealig ay iormatio about the iputs. The problem is complicated by the act that a hidde subset o the players are cotrolled by a adversary that actively tries to subvert this goal. SMPC abstracts umerous importat problems i distributed security, ad so, ot surprisigly, there have bee thousads o papers writte i the last several decades addressig this problem. However, there is a strikig barrier that prevets wide-spread use: curret algorithms to solve SMPC are ot resource eiciet. I particular, i there are players ivolved i the computatio ad the uctio ca be computed by a circuit with m gates, the most algorithms require each player to sed a umber o messages ad perorm a umber o computatios that is Ω(m) (see, or example, [11, 12, 5, 2, 15, 10, 16, 17, 3]). Recet years have see excitig improvemets i the amortized cost o SMPC, where the umber o messages ad total computatio doe per player ca be sigiicatly better tha Θ(m) [7, 9, 8]. However, the results or these algorithm hold oly i the amortized case where m is much larger tha, ad all o them have additioal additive terms that are large polyomials i (e.g. 6 ). Thus, there is still a strog eed or SMPC algorithms that are eiciet i both ad m. 1.1 Formal Problem Statemet We ow ormally deie the SMPC problem. As previously stated, there are players, ad each player i has a private iput, x i. Further there is a -ary uctio that is kow to all players. The goal is to to esure that: 1) all players lear the value (x 1, x 2,..., x ); ad 2) the iputs remai as private as possible: each player i lears othig about the private iputs other tha what is revealed by (x 1, x 2,..., x ) ad x i. The mai complicatio is the act that up to a 1/3 ractio o the players are assumed to be cotrolled by a adversary that is actively tryig to prevet the computatio o the uctio. We will say that the players cotrolled by the adversary are bad ad that the remaiig players are good. The adversary is static, meaig that it must select the set o bad players at the start o the algorithm. A careul reader may ask: How ca we eve deie the problem i the bad players cotrol their ow iputs to the uctio ad thereby ca exert cotrol over the output o? The aswer to this questio is give by Figure 1. I the let illustratio i this igure, there are 5 players that are tryig to compute a uctio over their 5 private iputs. I there is a trusted exteral party, as show i the ceter o this illustratio, the problem would be easy: each player seds their iput to this trusted party, the party perorms the computatio, ad the seds the output o back to all the players. I essece, this is the situatio we wat to simulate with our SMPC algorithm. The right illustratio o Figure 1 shows this goal: the SMPC algorithm simulates the trusted party. I particular, we allow all players, both good ad bad, to submit a sigle iput to the SMPC algorithm. The SMPC algorithm the computes the uctio based o all o these submitted iputs, ad seds the output o back to all players. This problem ormulatio is quite powerul. I returs the iput that is i the majority, the 1

3 X1 X1 X5 X2 X5 SMPC X2 X4 X3 X4 X3 Figure 1: Schematic o SMPC problem SMPC eables votig. I returs a tuple cotaiig 1) the idex o the highest variable; ad 2) the value o the secod highest variable, the SMPC eables a simple Vickrey auctio, i.e. the highest bidder wis ad pays the secod highest bid. I returs the output o a digital sigig uctio, where the private key equals the sum o all player iputs modulo Z p or some prime p, the SMPC eables group digital sigatures, i.e. the etire group ca sig a documet, but o idividual player lears the secret key. I short, the oly limitatio is determied by whether or ot the uctio is computable. Our commuicatio model is as ollows. We assume there is a private ad autheticated commuicatio chael betwee ever pair o players. However, we assume that the adversary is computatioally ubouded, ad so make o cryptographic hardess assumptios. 1 Also, ulike much past work o SMPC, we do ot assume the existece o a public broadcast chael. Fially, we ote that we assume that the good players strictly ollow the protocol, ad thus do ot orm coalitios i which iormatio is exchaged (i.e. there are o so called gossipig good players) Our Results The mai result o this paper is as ollows. Theorem 1.1. Assume there are players, o more tha a 1/3 ractio o which are bad, ad a -ary uctio that ca be computed usig m gates. The i the good players ollow Algorithm 1, with high probability, they ca solve SMPC, while esurig: 1. Each player seds at most 2. Each player perorms Õ( +m + ) messages, +m Õ( ) computatios. A additioal result o this paper deals with the situatio where all players are selish but ratioal. Our precise assumptio or the ratioal players is as ollows. The ratioal players utility uctios are such that they preer to lear the output o the uctio, but also preer that other players ot lear the output. Followig previous work o ratioal secret sharig [19, 13, 14, 20], we assume all the players have the same utility uctio, which is speciied by costats U k where 1 I the cryptographic commuity, this is requetly called ucoditioal security. 2 Techically, we ca maitai privacy, eve with a certai amout o iormatio exchage amog the good players. See Sectio 3 or details. 2

4 k is the umber o players who lear the output. Here U 1 is the utility to a player i she aloe lears the output, U is the utility i she lears the secret ad all other players lear it as well, ad ially U is the utility whe the player does ot lear the output. We urther assume that U 1 > U 2 >... > U > U, so that the players preereces are strict. A key goal is to desig a protocol that is a Nash equilibrium i the sese that o player ca improve their utility by deviatig rom the protocol, give that all other players are ollowig the protocol. Our mai result i this model is the ollowig. Theorem 1.2. Assume there are players ad each player is ratioal with utility uctio give as above. The there exists a protocol (see Sectio 2.5) such that 1) it is a Nash equilibrium or all players to ru this protocol ad 2) whe all players ru the protocol the, with high probability, they solve SMPC, while esurig: 1. Each player seds at most 2. Each player perorms +m Õ( ) messages, +m Õ( ) computatios. The rest o this paper is orgaized as ollows. I Sectio 2, we describe our algorithms or scalable SMPC. We irst preset the case with a adversary, ad the i Sectio 2.5, describe the chages that are eeded to hadle the case where all players are ratioal. The proos o correctess or our algorithms are i Sectio 3. We coclude ad give problems or uture work i Sectio 4. 2 Our Algorithm We ow describe the algorithm that achieves our result or the model where players are either good or bad (Theorem 1.1). The mai idea behid reducig the amout o commuicatio required or the computatio is that rather tha havig each player commuicate with all the other players, we will subdivide the players ito groups called quorums o logarithmic size. The players i each group will commuicate oly with members o their ow group ad members o certai other groups. The umber o other groups a particular group is required to commuicate with is a uctio o the circuit size. I ay sigle quorum were to have too may bad players the they could severely disrupt the computatio, so the subdivisio must spread the bad players aroud so that the ractio o bad players i each quorum remais less tha 1/3. We will call a quorum good i more tha two thirds o the players i it are good. How are these quorums to be ormed? This would be easy to achieve (with high probability) i there were a trusted mediator who could orm the groups radomly ad assig each player to their group. I the absece o a mediator, the players must achieve this subdivisio themselves. To do this, we appeal to the ollowig result o Kig, Loerga, Saia ad Treha [18]. Theorem 2.1 (Theorem 2 o [18]). Let be the umber o processors i a ully asychroous ull iormatio message passig model with a static adversary. Assume that there are at least (2/3 + ɛ) good processors. The or ay positive costat ɛ, there exists a protocol which w.h.p. brigs all good processors to agreemet o good quorums; rus i polylogarithmic time; ad uses Õ( ) bits o commuicatio per processor. I all players are ratioal the algorithm rus i polylogarithmic time; ad uses Õ(1) bits o commuicatio per processor. We will also require certai primitives or multiparty protocols. A 1/3 ault-tolerat Veriiable Secret Sharig scheme or k players, heceorth VSS(k), is a algorithm or a dealer to deal shares o a secret which he holds to the players, such that (1) o set o ewer tha a third o the players 3

5 ca get ay iormatio about the secret ad (2) the secret ca be recostructed rom the shares eve i upto a third o them are missig or corrupted (i.e. i upto a third o the players are bad) Moreover, the players the ru a veriicatio protocol, at the ed o which the good players either agree that a valid secret has bee shared or agree to disqualiy the dealer (i he did ot deal shares cosistet with ay secret) ad take the secret to be a preset deault value. Such a sharig ad veriicatio scheme is described i the work o Be-Or, Goldwasser ad Wigderso (BGW) [4]. This uses a costat umber o rouds o commuicatio ad has zero probability o error. 3 BGW [4] also describe a errorless protocol or SMPC that tolerates up to a third o the players beig bad. (See BGW [4] Theorem 3). The umber o rouds o commuicatio depeds at most liearly o the size o the circuit beig computed. We will make extesive black box use o both these primitives i our algorithm. Note that these protocols ivolve all-to-all commuicatio amogst the players. For this reaso we will reer to the SMPC primitive as HEAVYWEIGHT-SMPC. However, i our protocol, at most three quorums will be ivolved i ay give ru o the black box SMPC or VSS. Thus the amout o commuicatio per ru o HEAVYWEIGHT-SMPC will have oly a polylogarithmic depedece o. We also ote that the VSS ad SMPC primitives require broadcast chaels i additio to secure private chaels. Withi our quorums, we simulate broadcast chaels usig Byzatie Agreemet to decide whether the same message was set to everyoe. Sice the quorum size is just logarithmic, we ca use ay polyomial time ad algorithm or Byzatie agreemet, such as Bracha s protocol [6]. We assume that all computatios are doe over a iite ield F. It is coveiet or presetatio to assume that all gates have i degree 2 ad out degree at most 2, but we ca tolerate arbitrary costat degrees. 2.1 Setup We irst give a high level descriptio o our algorithm. The irst step is to build a etwork, which we call G, based o the circuit C. For every gate i the circuit C, there will be a ode i G, which we will reer to as a iteral ode. I additio, G will have extra odes, correspodig to the iputs o C. We will call these iput odes. For every wire rom some gate to aother gate i C, there will be a edge coectig the correspodig odes i G. Further, or every wire rom a iput to a gate i C, there will be a edge rom the correspodig iput ode to the correspodig iteral ode i G. The players use the algorithm rom Theorem 2.1 to divide themselves ito quorums each o size θ(log ). Each quorum is assiged to some ode i G. Recall we have m + odes i G. We assume a caoical umberig o the odes i G ad o the quorums, ad we assig the quorum umbered i to to ay ode with umber j s.t. (j mod ) = i. Note that each quorum is thus assiged to at most m+ odes. 2.2 Exteded Example We ow work through a exteded example o our algorithm. The ormal descriptio o the algorithm is give i Sectio 2.4. Figure 2 illustrates the example we will use to describe our algorithm. The top let illustratio 3 This scheme uses error correctig codes to achieve the veriicatio. Other such schemes exist, which use Zero Kowledge proo techiques or veriicatio ad ca tolerate up to hal the players beig aulty; see [21]. These, however, have a expoetially small but positive probability o error. 4

6 G7 G7 G5 G6 G5 G6 G1 G2 G3 G4 G1 G2 G3 G4 X1 X3 X5 X7 X2 X4 X6 X8 X1+R1, Shares o R1 X2+R2, Shares o R2 X3+R3, Shares o R3 X4+R4, Shares o R4 X5+R5, Shares o R5 X6+R6, X7+R7, X8+R8, Shares o R6 Shares o R7 Shares o R8 1) 2) Shares o R9 G1 G1(x1,x2)+R9 G1 SMPC SMPC Shares o R1, x1+ R1 Shares o R2, x2+r2 G1(x1,x2)+R9 G1(x1,x2)+R9 Figure 2: Example o Quorum based SMPC i this igure describes a simple circuit with m = 7 gates ad = 8 iputs. For simplicity, this circuit is small; i a real applicatio, we would expect both m ad to be much larger. Also, or simplicity, i this example, the circuit is a tree; however, our algorithm works or a arbitrary circuit. The circuit i this example computes a 8-ary uctio,, that we wat to compute i our SMPC. The gates have labels G1,..., G8, that represet the uctios computed by each gate. Each o the players at the bottom seds its iput to some gate. The top right illustratio i the igure shows the layout o the quorums based o this circuit. Each oval i this illustratio represets a quorum. There are + m ovals, m or each gate i the circuit ad or each player. Recall that usig the algorithm rom Theorem 2.1, we ca create quorums with the properties that 1) each quorum cotais less tha a 1/3 ractio o bad players; 2) each quorum cotais θ(log ) players; ad 3) each player is i θ(log ) quorums. We will map these quorums to the m + ovals. It will be the case that the umber o ovals is larger tha the umber o actual quorums, requirig us to map some quorums to multiple ovals. However, each quorum will be mapped to at most ( + m)/ ovals. Moreover, as we will see, it will ot cause problems eve i we map the same quorum to eighborig ovals. The algorithm begis by gettig iputs rom the players. I this illustratio, each player i computes a value R i selected uiormly at radom rom all values i the ield F. It the computes x i + R i, the value o its private iput plus R i ad seds this value to all players i the quorum above it. Note that R i protects the value x i sice x i + R i is distributed completely uiormly at radom. Fially, player i uses the 5

7 veriiable secret sharig (VSS) algorithm rom [4] to create shares o R i, ad to sed oe share to each player i the quorum above. These shares have the property that ay 2/3 ractio o them ca be used to reveal the value R i, but less tha a 2/3 ractio reveals o iormatio about R i. The two illustratios i the bottom part o the igure show how three quorums compute the output o each gate. We wish to maitai the ollowig ivariat: the value computed at ay oval is the value that would be computed at the correspodig gate o C, masked by a radom elemet o the ield. The mask is joitly recostructed by suicietly may players at the oval, but it is ot kow to ay idividual player. For simplicity, these bottom illustratios ocus solely o the computatio occurrig or G1; similar computatios occur or all the other gates. Three quorums are ivolved i the computatio or G1: the two bottom quorums provide the radomized iputs, ad the top quorum provides a value (R9) that is used to radomize the output. The bottom let illustratio shows what is kow at each quorum beore the computatio o G1. All players i the bottom let quorum kow the value x 1 + R 1. Moreover, each player i this quorum has a share o the value R 1. These shares agai have a 2/3 threshold property: ay 2/3 ractio o them ca be used to recostruct R 1, but ay set o less tha 2/3 o them reveals o iormatio about R 1. The players i the bottom right quorum have similarly kowledge: they all kow x 2 + R 2 ad they each have shares o R 2 with a 2/3 threshold property. Fially, the players i the top quorum have previously ru a simple distributed algorithm to esure that they each have a share o a value, R 9 that is selected uiormly at radom rom the ield F. These shares o R 9 are costructed with the 2/3 threshold property; this property ca be esured doe by repeated applicatios o the VSS algorithm rom [4]. Fially, the players i all three quorums use HEAVYWEIGHT-SMPC to compute the value G 1 (x 1, x 2 ) + R 9. We ote two importat acts about this SMPC. First, the iputs (x 1 +R 1, x 2 +R 2, shares o R 1, shares o R 2, shares o R 9 ) cotai eough iormatio to compute the value G 1 (x 1, x 2 )+R 9 i the SMPC, eve i the bad players lie about their iputs. Secod, the SMPC algorithm occurs over oly θ(log ) players, so eve a heavyweight protocol which rus i time ad message cost polyomial i the umber o players will icur latecy ad message costs that are just polylogarithmic i. The bottom right illustratio shows the result ater the computatio o G 1. Each player i the three quorums has leared the value G 1 (x 1, x 2 ) + R 9. Note that o player at ay o the three quorums has (idividually) leared ay iormatio about the value G 1 (x 1, x 2 ), sice the mask R 9 which o idividual kows, is uiormly radom, ad hece the computed value, G 1 (x 1, x 2 ) + R 9 is also uiormly radom over the ield. I additio, ote that we ow have a situatio or the top quorum where 1) every player kows the output value plus a radom elemet R 9 ; ad 2) the shares o R 9 are distributed amog the players i such a way that the value R 9 ca be recostructed i ad oly i the good players i the quorum sed the shares to each other. Thus, the top quorum is i the same situatio ow with respect to the value G 1 (x 1, x 2 ) as the bottom quorums were i with respect to x 1 ad x 2 previously. Hece, the same procedure ca be repeated as compute the values or the gates i the ext layer o the circuit. 2.3 Some Details The output o the quorum associated with the root ode i G is the output o the etire algorithm. The last step o the algorithm is to sed this output to all players. To do that, we costruct a complete biary tree usig the quorums, with root quorum equal to the quorum that kows the output o the circuit. We the use majority ilterig to pass the output dow to all the players. Speciically, whe a player receives the output message rom all players i its paret quorum, it 6

8 computes the majority o all messages, ad cosiders the majority o the messages as his correct output; the, it seds the output to all players i ay quorums below. Note that it may be the case that a player p participates k > 1 times i the quorums perormig HEAVYWEIGHT-SMPC i Figure 2. I such a case, we allow p to play the role o k dieret players i the SMPC, oe or each quorum to which p belogs. This esures that the ractio o bad players i the heavy-weight SMPC is always less tha 1/3. Also, the heavy-weight SMPC protocol o [21] maitais privacy guaratees eve i the ace o gossipig coalitios o costat size. Thus, p will lear o iormatio beyod the output ad its ow iputs ater ruig this protocol. We observe that the output o the last ode o G is the output o the algorithm. The last step o the algorithm is to sed the output to all players. To do that, players reuse their quorums ad build a complete biary tree with odes ad assig quorum i to ode i i the tree. Each player receives the output message rom all players i its paret ode ad cosiders the majority o the messages as its correct output. The, it seds the output to all players o its childre odes. Fially, ote that i this algorithm, each player participates i θ(log ) quorums; each quorum is resposible or at most ( + m)/ ovals; ad the SMPC perormed at a oval has resource cost which is polylogarithmic i. Moreover, each player rus the VSS algorithm to sed its iput to a sigle quorum iitially. Thus, i this algorithm, each player seds i the computatio o ) gates. Õ( +m Õ( +m ) bits ad is ivolved 2.4 Formal Descriptio We assume the the uctio to be computed is preseted as a circuit C with c gates, umbered 1, 2,..., m, where the gate umbered 1 is the output gate. The high level picture o the commiicatio etwork is a directed graph G, with c + odes umbered 1, 2,... c +. The irst c o these are gate odes, ode i correspodig with gate i o the circuit, ad there are edges betwee pairs o them wheever the correspodig pair o gates is coected by a wire. The directio o the edge is the directio o low o computatio i the circuit C. Note that the ode umbered 1 is the ode correspodig to the output gate. We will sometimes reer to this as the root ode ad deote it ρ. The additioal odes are iput odes ad iput ode i has a edge poitig to gate ode j i the ith iput wire eeds ito gate j i C. For a give ode v, we will reer to ay ode w to which v has a edge as a paret o v, ad we will reer to ay ode x which has a edge to v as a child o v. Fially, or a give ode v, we will say the height o v is the umber o edges o the logest path rom ay lea ode to v. The basic structure o the algorithm is as ollows. First, all the players orm quorums ad each quorum is assiged to multiple odes i G, so that each ode i G is represeted by a uique quorum (Algorithm 2). The each player commits its iput to the quorum at the correspodig iput ode i G (Algorithm 3). The all quorums represetig gate odes geerate shares o uiormly radom ield elemets. These shares will be eeded as iputs to the subsequet heavyweight SMPC protocols. Next we begi computatio o the gates o the circuit. For every ode g i G associated with a gate i C, we do the ollowig. At a time proportioal to the height o the gate g, all participats i the computatio o g (i.e. the quorums at g ad the quorums at the two odes poitig to g i the circuit) will ru a heavyweight SMPC protocol to compute a masked versio o the value at g. (Algorithm 5). The the quorum at the root ode will umask the output (Algorithm 6) ad it will be set to all the players via a biary tree (Algorithm 7). I order or the players to coordiate their operatios, we will eed to deie the ollowig quatities. Let 7

9 T QF = T QF () deote a upper boud o the time take or players to ru the quorum ormatio algorithm. T VSS = T VSS (log ) deote a upper boud o the iput commitmet via VSS. T R = T R (log ) is the maximum time take by the players i a sigle quorum to joitly geerate shares o a radom ield elemet. T SMPC = T SMPC (log ) deote a upper boud o the time it takes O(log ) players to perorm a heavyweight SMPC. We remid the reader that i our model local computatio is istataeous, ad that a sigle time uit reers to the time take or a message set by a processor to reach its iteded recipiet. We ow preset a ormal descriptio o our scalable SMPC protocol i Algorithm 1 ad related subrouties. For coveiece, we will sometimes abuse otatio by allowig a ode v G to reer both to the ode itsel ad to the quorum associated with the ode. Algorithm 1 Mai Algorithm Phase 1 1. At time t = 0 all players ru the quorum ormatio algorithm (Algorithm 2). 2. At time t = T QF all players ru the iput commitmet algorithm (Algorithm 3). 3. At time t = T QF + T VSS, or each gate simultaeously, ru the radom umber geeratio algorithm (Algorithm 4). 4. At time t = T QF + T VSS + T R, or each gate g simultaeously, iitiate the computatio o gate g (Algorithm 5). Phase 2 5. At time t = T QF + T VSS + T R + h ρ T SMPC, the players at the root ode recostruct the output (Algorithm 6). Here h ρ is the height o the root ode. 6. At time t = T QF + T VSS + T R + (h ρ + 1)T SMPC, all players perorm the output propagatio algorithm (Algorithm 7) 2.5 Ratioal Players We ow show how to modiy Algorithm 1 to hadle ratioal players (Theorem 1.2); First, we ote or the ratioal case, the graph G is equivalet to that i Algorithm 1. Moreover, the mappig rom quorums to odes i G is equivalet, except or the eiciecy o the algorithm that creates the quorums. I particular, i the case where all players are ratioal, as is stated i Theorem 2.1, we require each player to sed oly Õ(1) bits i order to create the set o quorums. Oce the quorums have bee ormed, much o the algorithm, remais the same, icludig the iput commitmet ad the (masked) computatio o each gate. It is oly at the output recostructio stage o the algorithm that thigs eed to chage. The problem is that the SMPC protocol beig used as a black box does ot make ay guaratees about all the players learig 8

10 Algorithm 2 Quorum Formatio This algorithm begis at time t = 0 ad all players participate. 1. Ru the algorithm i [18] to orm good quorums o size O(log ), umbered 1, 2,...,, with the ollowig properties: All quorums have at least a 2/3 ractio o good players. Each player participates i O(log ) quorums. 2. Each player idetiies the odes i G represeted by his quorums, ad the eighborig odes i the graph G. The rule here is that quorum i represets gate j i i = j mod. 3. At the ed o this protocol, each player kows which O(log ) quorums to participate i; which other players are i each o those quorums; which gates/odes are represeted by those quorums; ad which quorums represet the eighborig odes (with whom it is ecessary to commuicate) ad which players are i each o those quorums. Algorithm 3 Iput Commitmet This protocol or each iput ode begis at time t = T QF. Recall that x i is the iput associated with player i. 1. Each player i chooses a uiormly radom elemet r i F. 2. Each player i computes s i x i + r i 3. Each player i creates VSS shares o r i or each player i the quorum at iput ode m + i, usig the BGW scheme, ad seds oe share to each member o this quorum. These shares have the property that r i ca be recostructed rom them eve i upto a third o them are suppressed or misrepreseted. 4. Each player i seds s i to each member o the quorum at iput ode m + i. 5. Quorums mapped to each iput ode m+i do the ollowig: Ru the VSS veriicatio protocol to determie whether a valid secret has bee shared. Also veriy, usig Byzatie agreemet, that the same s i has bee set to everyoe. I either o these checks ails, set x i to some preset deault value, r i ad its shares to zero. 9

11 Algorithm 4 Radom Number Geeratio This protocol is ru simultaeously by each quorum associated with each gate ode v G at time t = T QF + T VSS. The ollowig is doe by each player p v: 1. Player p v chooses uiormly at radom a elemet r p,v F (this must be doe idepedetly each time this algorithm is ru ad idepedetly o all other radomess used to geerate shares o iputs etc.) 2. Player p creates veriiable secret shares o r p,v or each player i g ad deals these shares to all players i g (icludig itsel). 3. Player p participates i the veriicatio protocol or each received share. I the veriicatio ails, set the particular share value to zero. 4. Player p adds together all the shares (icludig the oe it dealt to itsel). This sum will be player p s share o the value r v. Algorithm 5 Computatio o a gate This protocol is ru simultaeously or each gate ode g G, startig at time t = T QF + T VSS + T R + (h g 1)T SMPC, where h g is the height o g. Let v 1, v 2,... v k be the childre o the ode g i the graph G; ad let O 1, O 2,..., O k be the outputs o the gates associated with these childre. The algorithm maitais the ivariat that or each child ode v i, there is a uiormly radom elemet r i F ad a value s i = O i + r i, such that each player i v i kows s i ad a uique VSS share o r i. Also, each player at g has a VSS share o a value r g that is a uiormly radom elemet o F. Let g (O 1, O 2,..., O k ) be the uctio computed by the gate i the circuit C associated with g. 1. Every player i the quorums g, v 1, v 2,..., v k ru HEAVYWEIGHT-SMPC with the iputs (s 1, shares o r 1, s 2, shares o r 2,..., s k, shares o r k, shares o r g ) to compute a value s g, where s g = g (O 1, O 2,..., O k ) + r g. I a sigle player p appears i k > 1 o these quorums p plays the role o k dieret players i HEAVYWEIGHT-SMPC, oe or each quorum to which p belogs. 2. The players i the quorum at g ow have s g ad shares o r g Algorithm 6 Output Recostructio This protocol is ru by all players i the quorum at the root ode ρ, at time t = T QF + T VSS + T R + h ρ T SMPC. 1. Recostruct r ρ rom its shares usig VSS. 2. Set the output o s ρ r ρ. 3. Sed o to all players i the quorums umbered 2 ad 3 10

12 Algorithm 7 Output Propagatio Perormed by the players at each ode by the players at each quorum, q other tha the quorum umbered 1, startig at time t = T QF + T VSS + T R + (h ρ + 1)T SMPC wait) 1. i quorum umber o q 2. Each player p q waits util it receives values rom at least a 2/3 ractio o the players i the quorum umbered i/2, ad sets o the uique value that occurs as at least 2/3 o the received values. 3. Each player p q seds o to all the players i quorums umbered 2i ad 2i + 1. the output at the same time. This did ot matter or the computatios at iteral gates sice the itermediate output there was masked ad thereore uiormly radom, ad gave the players o iormatio about either the output or aybody s iput. However at the ed o the output recostructio stage, players at the root actually lear the output. Thus i ay sigle player lears it irst, the he may simply stop sedig messages ad the other players will ot lear the output. To overcome this diiculty, i the output recostructio phase, istead o usig the usual heavyweight SMPC protocol, we use a ratioal SMPC protocol due to Abraham, Dolev, Goe ad Halper [1, Theorem 2(a)]. This esures that all players at the root ode lear the output simultaeously. Fially the players at the root use Algorithm 7 i order to sed the output to all players. We ote that to ru Algorithm 7 at this poit is a Nash equilibrium sice i all other players are ruig Algorithm 7, there is o expected gai i utility or a sigle player by deviatig rom Algorithm 7. 3 Aalysis I this sectio, we give the proo o Theorem 1.1. We begi by otig that the error probability i Theorem 1.1 comes etirely rom the possibility that the quorum ormatio algorithm o Loerga et al. [18] may ail to result i good quorums (see Theorem 2.1). All other compoets o our algorithm: the VSS ad heavyweight black boxes, Byzatie agreemet ad majority ilterig, are all exact algorithms with o error probability. For the remaider o this sectio we will assume that we are i the good evet, i.e. that the players have successully ormed good quorums. For each ode j i the graph G, let V j be the value o the ode i the computatio o. Thus, or iput odes, V j is the iput which has bee committed to by the correspodig player (set to a deault value i the player aulted o the iput commitmet algorithm), while or gate odes, V j is the value o the output wires o the gate associated with j i the circuit, oce the iputs have bee ixed to the committed values. Also or each ode j we have a mask r j F. For iput odes, r j is the radom umber set by the player i the iput commitmet algorithm (set to zero i the player aulted). For gate odes, r j is the radom umber joitly geerated by the quorum at j. Let G be the set o all odes i G which are either iput odes correspodig to good players or gate odes. Lemma 1. The masks {r j } j G are ully idepedet ad uiormly radom i F. Proo. The masks correspodig to iput odes or good players are uiormly radom by choice (see Algorithm 3). To see that the masks or the gates are uiormly radom, recall that i j is 11

13 a gate ode r j = i r j,i where r j,i is the value selected by player i i Algorithm 4. The players commit to the r j,i values by sedig each other VSS shares o them ad the ruig the veriicatio protocol o the shares. I player i is good, r j,i is uiormly radom. I player i is bad the r j,i could be aythig (icludig zero, i player i s shares ailed the subsequet veriicatio). However, oce the players have committed to the values the bad players ca o loger iluece the sum o the r j,i, or ca they bias the distributios o the r j,i i ay way, because o the security provided by the VSS algorithm. Sice the sum o elemets o F is uiormly radom i at least oe o them is uiormly radom, it ollows that r j is uiormly radom. The idepedece o the {r j }, j G ollows rom the act that all players have sampled their values idepedetly. I the ollowig, the computatio o a ode j will reer either 1) the iput commitmet algorithm i j is a iput odes; or 2) Algorithm 5 i j is a gate ode. Lemma 2. For each ode j i G, ater the computatio o j each player i the correspodig quorum kows a share o a umber r j. Moreover all good players i the quorum at j agree o a value s j F such that s j r j = V j. Proo. The players already have the shares o r j at the ed o the radom umber geeratio stage. We prove the claims about s j by iductio. For the base case, ote that or each iput ode, sice the correspodig quorum has at least two thirds good players, the coclusio ollows rom the correctess o the VSS protocol, ad the Byzatie agreemet protocol used i the iput commitmet algorithm. Now let j be a gate ode ad suppose or all odes j whose height is less tha the height o j, that all the good players at j agree o s j ad s j r j = V j. The the iductive hypothesis holds or all odes v 1, v 2, v k whose outputs are coected to the iputs o j. Thus, we ca assume that or all i betwee 1 ad k, the players at ode v i have shares o some value r i chose uiormly at radom i F, ad that all players i ode v i kow the value s i = V i + r i. I the computatio at ode j, the k + 1 quorums ivolved ru HEAVYWEIGHT-SMPC with iputs s 1, s 2,... s k ad the shares o r j, r 1, r 2,..., r k. At the ed o this protocol, all good players agree o a commo value s g. (This is by the correctess o HEAVYWEIGHT-SMPC). To see that this commo value is actually V g + r g we ote that the uctio computed by HEAVYWEIGHT-SMPC cosists o recostructig r g, r 1, r 2..., r k rom their shares; ierrig the values V 1, V 2,..., V k ; computig V g rom them; ad addig r g back i. (All o this will, o course, be opaque to the players ivolved.) Attempts to corrupt this computatio by lyig about s 1, s 2,..., s k are easily thwarted, because o the high redudacy i these as iputs. For each o these values, at least twice as may players provide them correctly as try to lie (sice each o the iput quorums have at most a third bad players). Moreover, ote that the VSS used to recostruct the masks rom the shares ca tolerate up to a third o the shares beig corrupted. Thus, sice all quorums are good, eve i the bad players lie about their shares o the masks, they caot chage the value o the computatio. It ollows that s g = V g + r g. By iductio, all the odes i G compute the correct masked values Corollary 1. Ater the Output Recostructio (Algorithm 6), all players at the root ode kow the output. Proo. By Lemma 2, at the ed o Phase 1 o the mai algorithm, all the players at the root ode kow the value s ρ ad shares o r ρ, where s ρ r ρ is the output o the circuit. Durig Algorithm 6, these players ru the VSS secret recostructio protocol. Sice at least two thirds o them are 12

14 good, by properties o VSS, they correctly recostruct r ρ. Sice all players at the root ode kow the value o s ρ, subtractig rom it the recostructed r ρ, they all lear the correct output. Lemma 3. At the ed o the algorithm, the correct output is leared by all good players. Proo. This ollows by iductio. Sice quorum 1 is at the root, Corollary 1 provides a base case. Now suppose the correct output has bee leared by all the players i quorums umbered j or all j < i. Cosider the players i quorum i. Durig the ru o the output propagatio algorithm, they will receive putative values or the output rom the players at quorum i/2. Sice at least two thirds o the players at quorum i/2 are good, ad by iductio hypothesis have leared the correct output, it ollows that at least two thirds o the values received by the players at quorum i equal correct output. Sice good players set their output to be the the uique value that occurs as at least 2/3 o the received values, they get the correct output. By iductio, all the players lear the correct value. We devote the rest o the sectio to showig that privacy o the iputs is preserved. We remark that privacy is oly gurarateed with high probability. However, as i the case o correctess, the error arises oly rom the possibility that the quorum ormatio algorithm ails to spread the bad players out so that less tha a third o the players i ay quorum are bad. Thus i we coditio o havig ormed good quorums, the all the privacy claims hold with probability 1. For what ollows we will cotiue to coditio o this good evet. As discussed i previous works (see [21]), we have o recourse agaist players who volutarily sed their iputs to other players, aturally we caot preserve the privacy o such players. I particular, we are oly cocered with preservig the privacy o good players, who perorm o actios except those speciied by the protocol. We are primarily cocered with preservig the privacy o iputs o players. However, ote that i some player s iput eeds ito a multiplicatio gate the learig that the value i the computatio o that gate is zero, icreases the Bayesia probability that the player s iput is zero, ad this is a privacy violatio. Thus we are also cocered about the ability o players to lear the value o a gate other tha the root or output gate. Recall that G is the set o odes i G that are either iput odes correspodig to good players or gate odes. Lemma 4. Let j be ay ode i G, other tha the root ode, ρ. Usig oly messages set to him as part o the algorithm, o player ca lear ay iormatio about the value V j, except what is implicit i his ow iput ad the ial output o the circuit. Proo. We prove this or a gate ode g. By Lemmas 1 ad 2, the value recovered by HEAVYWEIGHT- SMPC durig the computatio o g is s g = V g + r g, where r g is a uiormly radom elemet o F, idepedet o all other radomess i the algorithm. I particular this meas that s g holds o iormatio about V g. I the player i is ot i ay o the quorums at g or its eighbors, the all the messages he receives durig the algorithm are idepedet o r g, ad hece s g, ad hece he caot lear aythig about V g. O the other had, i player i is ivolved i the computatio o g or oe o its eighbors, the he may hold a share r g as well as shares o other shares. I this case we appeal to to the privacy o HEAVYWEIGHT-SMPC ad the embedded VSS algorithm to see that although he may lear s g, he caot lear ay iormatio about the shares o r g ad hece about r g itsel. Thus, he caot lear ay iormatio about V g except what is implicit i his iput ad the circuit output. 13

15 The proo or a iput ode o a good player is similar except that we will have to appeal to the privacy o the black box VSS protocol rather tha the privacy o HEAVYWEIGHT-SMPC. We ow explore a stroger otio o privacy. BGW [4] distiguish betwee the two kids o deviat behaviour amog players. The bad players are players cotrolled by a adversary who may idulge i arbitrary kids o erratic behaviour to try to break the protocol i ay way they ca. However BGW also cosider players who are good, i the sese that they ollow the protocol, but may also sed ad receive messages exteral to the protocol, to attempt to lear whatever additioal iormatio they ca. Such players are called gossipig players. A protocol is called t-private i o coalitio o size t (icludig coalitios o gossipig players) ca lear aythig more tha what is implied by their private iputs ad the circuit output. The SMPC protocol o BGW [4] is (/3 δ)-private or ay δ > 0. We ote that our algorithm is susceptible to adaptively chose coalitios o gossipig players. Ideed, i all the players i a quorum at a ode j gossip with each other, they ca recostruct the correspodig radom mask r j ad hece the value V j. I particular, the players i the quorum at a iput ode ca joitly recostruct the correspodig iput. However, we ca establish the ollowig result, which shows that or large coalitios chose o-adaptively (i particular, the adversarial players) we our algorithm will preserve privacy. Lemma 5. Let S be ay set o players such that or every quorum Q, S Q cotais ewer tha a third o the players i Q. Let j be ay ode i G. The the coalitio S caot lear ay iormatio about V j that caot be computed rom their (collective) private iputs ad the circuit output. Proo. Oce agai we prove this oly or gate ode g i G. The proo or a iput ode is similar. We kow that HEAVYWEIGHT-SMPC whe ru at g computes s g = V g +r g, where r g is uiorm i F ad idepedet o all other radomess i the algorithm. As oted i the proo o Lemma 4, the players i S who are ot i the quorums at g or ay o its eighbors are irrelevat to the coalitio: all o the iormatio that they hold is completely idepedet o r g ad s g, so they caot assist i ucoverig ay iormatio about V g, except what is implicit i their private iputs. Now cosider the players i the quorums at g or ay o its eighbors. These players participate i oe or more o the SMPCs which ivolve g: the computatio o g itsel or the computatios i which the output o g is a iput. Here we appeal to the privacy o HEAVYWEIGHT-SMPC to see that the players caot lear ay additioal iormatio that is ot implied by their iputs. The players i S are uable to directly determie r g, sice the oly relevat iputs are the shares o r g, ad they do ot have eough o those. Fially, let us cosider the players rom S at g itsel. These players also do ot have eough shares o r g to recostruct it o their ow. However, they recieve shares o each o the other shares o r g multiple times: oce durig the iput commitmet phase o each SMPC i which g is ivolved. Each time, they do ot get eough shares o shares r g to recostruct ay shares o r g. However, ca they combie the shares o shares rom dieret rus o the VSS protocol or the same secret to gai some iormatio? Sice resh, idepedet radomess was used by the dealers creatig these shares o each ru, the shares rom each ru are idepedet o the other rus, ad so they do ot collectively give ay more iormatio tha each o the rus give separately. Sice each ru o the VSS iput commitmet does ot give the players i S eough shares to recostruct aythig, it ollows that they do ot lear ay iormatio about r g. Sice r g is uiormly radom, so is s g ad it ollows that the coalitio S caot get ay extra iormatio about V g. 14

16 Corollary 2. The bad players caot lear ay iormatio, except what is implied by the output ad the iputs to which they committed, about the iput o ay good player. Proo. This ollows immediately rom Lemma 5, sice each quorum cosists o o more tha a third bad players. Let q be the size o the smallest quorum. Recall that q = Θ(log ). Corollary 3. Our algorithm is q/3-private. Proo. Sice q is the size o the smallest quorum, ay set o size q/3 itersects a quorum Q i at most a third o its members. The result ollows rom Lemma 5 We ed with a simple aalysis o the resource cost o our algorithm. Lemma 6. I all good players ollow Algorithm 1, with high probability, each players seds at most + ) messages. m is size o G Õ( +m Proo. To aalyze the cost o algorithm 1, we have to irst aalyze the cost o its sub-algorithms. Cost o Algorithm 2 ad Algorithm 3: Based o the theorem 2.1 we eed to sed Õ( ) messages to build the quorums. I Algorithm 3, each player must commit its secret ad a radom variable usig veriied secret sharig betwee O(log ) players o a quorum (iput ode). This requires sedig a polylogarithmic umber o messages. Cost o Algorithm 5: Each player will participate i θ(log ) quorums. For each quorum, he has to participate i a secure multi-party computatio or θ( m+ ) (m is umber o operatios i circuit G)) gates betwee three quorums or 3 log players which is polylogarithmic, so this +c algorithm requires sedig Õ(log ) messages. Cost o Algorithm 7: output tree, Each player should sed Õ(1) messages (output message) to the players o its childre. +m So the cost o the algorithm 1 is Õ( + ). 4 Coclusio We have described scalable algorithms to perorm Secure Multiparty Computatio i a scalable +m maer. Our algorithms are scalable i the sese that they require each player to sed Õ( + ) +m messages ad perorm Õ( + ) computatios. They tolerate a adversary that cotrols up to a 1/3 ɛ ractio o the players, or ɛ ay positive costat. We have also described a variat o this algorithm that tolerates the case where all players are ratioal; this variat requires each +m +m player to sed Õ( ) messages ad perorm Õ( ) computatios. May ope problems remai icludig the ollowig. First, Ca we desig scalable algorithms to solve SMPC i the completely asychroous commuicatio model? We believe this is possible with some work. Secod, Ca we prove lower bouds or the commuicatio ad computatio costs or Mote Carlo SMPC? Fially, Ca we implemet ad adapt these algorithms to make them practical or a SMPC problem such as the oe described i [5]. 15

17 Reereces [1] I. Abraham, D. Dolev, R. Goe, ad J. Halper. Distributed computig meets game theory: robust mechaisms or ratioal secret sharig ad multiparty computatio. I Proceedigs o the twety-ith aual ACM symposium o Priciples o distributed computig, pages ACM, [2] B. Applebaum, Y. Ishai, ad E. Kushilevitz. From secrecy to soudess: eiciet veriicatio via secure computatio. Automata, Laguages ad Programmig, pages , [3] Z. Beerliova ad M. Hirt. Eiciet multi-party computatio with dispute cotrol. I Theory o Cryptography Coerece, [4] Michael Be-Or, Shai Goldwasser, ad Avi Wigderso. Completeess theorems or ocryptographic ault-tolerat distributed computig. I Proceedigs o the Twetieth ACM Symposium o the Theory o Computig (STOC), pages 1 10, [5] P. Bogetot, D. Christese, I. Damgård, M. Geisler, T. Jakobse, M. Krøigaard, J. Nielse, J. Nielse, K. Nielse, J. Pagter, et al. Secure multiparty computatio goes live. Fiacial Cryptography ad Data Security, pages , [6] Gabriel Bracha. A asychroous [( - 1)/3]-resiliet cosesus protocol. I PODC 84: Proceedigs o the third aual ACM symposium o Priciples o distributed computig, pages , New York, NY, USA, ACM. [7] I. Damgård ad Y. Ishai. Scalable secure multiparty computatio. Advaces i Cryptology- CRYPTO 2006, pages , [8] I. Damgård, Y. Ishai, M. Krøigaard, J. Nielse, ad A. Smith. Scalable multiparty computatio with early optimal work ad resiliece. Advaces i Cryptology CRYPTO 2008, pages , [9] I. Damgård ad J.B. Nielse. Scalable ad ucoditioally secure multiparty computatio. I Proceedigs o the 27th aual iteratioal cryptology coerece o Advaces i cryptology, pages Spriger-Verlag, [10] W. Du ad M.J. Atallah. Secure multi-party computatio problems ad their applicatios: a review ad ope problems. I Proceedigs o the 2001 workshop o New security paradigms, pages ACM, [11] K.B. Frikke. Secure multiparty computatio. I Algorithms ad theory o computatio hadbook, pages Chapma & Hall/CRC, [12] O. Goldreich. Secure multi-party computatio. Mauscript. Prelimiary versio, [13] S. Gordo ad J. Katz. Ratioal secret sharig, revisited. Security ad Cryptography or Networks, pages , [14] J. Halper ad V. Teague. Ratioal secret sharig ad multiparty computatio: exteded abstract. I Proceedigs o the thirty-sixth aual ACM symposium o Theory o computig, page 632. ACM,

18 [15] W. Heecka, A.R. Sadeghi, T. Scheider, I. Wehreberg, et al. Tasty: Tool or automatig secure two-party computatios. I Proceedigs o the 17th ACM coerece o Computer ad commuicatios security, pages ACM, [16] M. Hirt ad U. Maurer. Robustess or ree i ucoditioal multi-party computatio. I Advaces i CryptologyCRYPTO 2001, pages Spriger, [17] M. Hirt ad J. Nielse. Upper bouds o the commuicatio complexity o optimally resiliet cryptographic multiparty computatio. Advaces i Cryptology-ASIACRYPT 2005, pages 79 99, [18] V. Kig, S. Loerga, J. Saia, ad A. Treha. Load balaced scalable byzatie agreemet through quorum buildig, with ull iormatio. I Iteratioal Coerece o Distributed Computig ad Networkig (ICDCN), [19] G. Kol ad M. Naor. Games or exchagig iormatio. I Proceedigs o the 40th aual ACM symposium o Theory o computig, pages ACM, [20] A. Lysyaskaya ad N. Triadopoulos. Ratioality ad adversarial behavior i multi-party computatio. Advaces i Cryptology-CRYPTO 2006, pages , [21] T. Rabi ad M. Be-Or. Veriiable secret sharig ad multiparty protocols with hoest majority. I Proceedigs o the twety-irst aual ACM symposium o Theory o computig, pages ACM, [22] A.C. Yao. Protocols or secure computatios. I Proceedigs o the 23rd Aual Symposium o Foudatios o Computer Sciece, pages ,