Multiparty Computation with Low Communication Computation and Interaction

Multiparty Computation with Low Communication, Computation and Interaction via Threshold FHE Gilad Asharov Bar-Ilan University Abhishek Jain UCLA Adriana López-Alt NYU Eran Tromer Tel-Aviv University Vinod Vaikuntanathan University of Toronto Daniel Wichs IBM Research

2 -Party Computation Using FHE (semi-honest) a b y = f(a, b) A=Encrypt(a) Y Charlie y Y=Eval(f, A, B) Sally

Advantages Low round complexity Low communication complexity • Independent of the function f Can we get allofthese advantages • Independent Sally’s input b Lowin computation the multiparty case? • Charlie’s work is independent of f A simple template

Threshold Key Generation

Threshold Key Generation

Input Encryption a b A=Enc(a) C=Enc(c) c B=Enc(b) A B C D D=Enc(d) d

Homomorphic Evaluation A B C D Homomorphic Evaluation Y Y Homomorphic Evaluation A B C D

Delegate to a Cloud A B C D Homomorphic Evaluation Y

Threshold Decryption Y Y Dec Y Y

Threshold Decryption m m Dec m m

MPC with Threshold FHE • Threshold Key Gen • Encrypt and Evaluate • Threshold Decryption

MPC with TFHE • Threshold Key Gen • Encrypt and Evaluate • Threshold Decryption • Threshold Key. Gen and Threshold Dec can be implemented using generic MPC • Advantages: Low communication complexity (even in malicious) The homomorphic evaluation can be delegated / only one party • Disadvantages: Needs generic MPC techniques Round complexity can be high

Our Main Results • Threshold Key Gen • Encrypt and Evaluate • Threshold Decryption • Threshold Key. Gen and Threshold Dec algebraically [BV 11 b, BGV 12] (based on LWE) • Advantages: Low communication complexity (even in malicious) The homomorphic evaluation can be delegated / only one party Simple: there is no need for generic MPC protocol Extremely low round complexity Only 3 broadcast rounds (CRS model) 2 rounds reusable PKI – optimal(!)

Our Main Results (malicious) • Threshold Key Gen • Encrypt and Evaluate • Threshold Decryption • Threshold Key. Gen and Threshold Dec algebraically [BV 11 b, BGV 12] (based on LWE) • Advantages: Low communication complexity (even in malicious) The homomorphic evaluation can be delegated / only one party (assuming cs poofs / SNARGs) Simple: there is no need for generic MPC protocol Extremely low round complexity Only 3 broadcast rounds (CRS model) 2 rounds reusable PKI – optimal(!) UC security (assuming UC-NIZK)

Related Work [Cramer. Damgard. Nielsen 01]– MPC using threshold HE [Gentry 09] – MPC using threshold FHE [Bendlin. Damgard 10] – threshold version for LWE [Katz. Ostrovsky 04] – lower bound of 5 rounds for MPC in the plain model • [Myers. Sergishelat 11] – threshold version of [v. DGHV 10] • •

The LWE Assumption [Regev 05] • Distribution 1 • Distribution 2 also secure if q is odd and we choose noise to be small and even (2 e instead e)

Basic LWE-Based Encryption • Symmetric Key • Public Key

Key-Homomorphic Properties of the Basic Scheme Two public keys, same “coefficient” A A new public key with secret key: s 1+s 2, coefficient A (almost the same as El-Gammal)

Threshold Key Generation A s 1 s 2 (A, p 1) = As 1+2 e 1 (A, p 2) = As 2+2 e 2 (A, p 3) = As 3+2 e 3 (A, p 4) = As 4+2 e 4 s 3 s 4

Threshold Key Generation A s 1 s 2 (A, p 1) = As 1+2 e 1 (A, p 2) = As 2+2 e 2 (A, p 3) = As 3+2 e 3 (A, p 4) = As 4+2 e 4 s 3 s 4

Threshold Key Generation A s 1 (A, p 1) = As 1+2 e 1 s 2 (A, p 2) = As 2+2 e 2 (A, p*) (A, p 3) = As 3+2 e 3 (A, p*) = As*+2 e* (A, p*) (A, p 4) = As 4+2 e 4 s 3 Joint secret key: s*=s 1+s 2+s 3+s 4 Joint public key: p*=p 1+p 2+p 3+p 4 (A, p*) s 4

Threshold Decryption s 1 s 2 s 3 s 4

Threshold Decryption s 1 s 2 s 3 s 4

Threshold Decryption s 1 s 2 s 3 s 4

Basic LWE-Based Encryption – Homomorphism •

FHE From LWE [BV 11 b], [BGV 12] • S ! d e i f i l p im

Evaluation Key •

Threshold Key. Gen –Round 2 s 1 s 2 … … … s 3 s 4

Threshold Key. Gen – End Of Round 2 s 1 s 3 … … s 2 s 4

Threshold Key. Gen – Round 3 s 1 … … … s 2 … … s 3 … s 4

Threshold Key. Gen – End Of Round 3 s 1 s 2 s 3 s 4

Threshold FHE - Key. Gen • one round!

The MPC Protocol • Threshold Key. Gen (2 rounds) – Round 1: Creates public key – Round 2: Creates evaluation key • The parties encrypt their inputs (sent concurrently with round 2 of Key. Gen) • Threshold Dec (1 round)

Malicious •

Conclusion • TFHE based on LWE – In the paper: Ring – LWE • 3 Rounds MPC • 2 Rounds in reusable PKI - optimal(!) • Low Communication Complexity • Easy to delegate Thank You!