4

I hope not to be asking much, but I have N parties, each one holding a polynomial in with 0-1 coefficients and fixed degree $n-1$. I was wandering if it is possible (I mean feasible) to compute the product of all of these polynomials with an MPC protocol.

Actually, for security I would need the result modulo $X^n+1$, so my actual request is the following : Given $N$ polynomials $P_1,P_2,\dots,P_N$ with $0-1$ coefficients and degree $n-1$, compute $(\prod P_i)\mod(X^n+1)$ with a multiparty computation protocol where each party holds a $P_i$.

My question regards the complexity of such a product ($O(n \log n\log N)$ integer multiplications if an FFT algorithm is used ?)

It is my first question here, so please attach a welcome message to you answer :-)

user31482
  • 41
  • 1
  • Hello. Do you know homomorphic encryption schemes like YASHE? They operate over polynomials mod another polynomial. There is also the multi-key homomorphic encryption schemes... Maybe you can use them to solve it trivially. – Hilder Vitor Lima Pereira Feb 15 '16 at 11:23
  • Hi, thank you this is a good remark. But my problem actually comes from this type of homomorphic encryption schemes, If I do as you propose I risk stepping on my tail. I did in fact considered such a solution, but in spite of the last, it is not practical (huge depth...) – user31482 Feb 15 '16 at 11:39
  • I see... It will be hard if the $N$ gets big... – Hilder Vitor Lima Pereira Feb 15 '16 at 18:15
  • 1
    What do you mean by "feasible"? Typically feasible means "possible in principle" but I think that you possibly mean "practically". What level of security are you talking about? Are you considering semi-honest adversaries, an honest majority? All of these parameters have to be defined. – Yehuda Lindell Feb 15 '16 at 20:03
  • Thanks for your comments. You are right, I mean practical. The security I was referring to was not related to MPC, I just meant to motivate the polynomial reduction (it is difficult to compute GCD's in that ring). I don't want to enter in boring details, but actually I would be satisfied if it was possible at all, with honest parties, since in my case I have a way to tell (with the result) who cheated and how. So yes, let me rephrase the question : Is it practical to do such a multi-party computation with honest parties (strictly following the protocol) ? Can FFT be used ? – user31482 Feb 15 '16 at 22:09
  • Your question seems like NTRU cryptosystem and it supports homomorphic addition and multiplication – Infinity Mar 02 '17 at 06:00

2 Answers2

1

You mention a ring but you are only using the multiplication operation. So it's really just a protocol for a group operation that you want. If the group is abelian, then there is a simple classical protocol for $n$-party group product:

  • Each party performs $n$-out-of-$n$ multiplicative secret sharing of their input. In more detail, party $i$ has input $P_i$ and chooses random polynomials $P_{i,j}$ so that $\prod_j P_{i,j} = P_i$, then privately sends $P_{i,j}$ to party $j$.

  • Each party $j$ now has $\{ P_{i,j} \mid i \in [n] \}$. He/she computes their product $P'_j = \prod_i P_{i,j}$ and publicly announces $P'_j$.

  • If the group is abelian, then $\prod_j P'_j = \prod_{i,j} P_{i,j} = \prod_i P_i$, so everyone can compute the final answer from the public $P'_j$ values.

Furthermore, the view of any number of colluding semi-honest parties leaks no more than the final result.

Mikero
  • 13,187
  • 2
  • 33
  • 51
0

For $N=2$, there are protocols to perform multiparty internal products between vectors (a quick google search finds some articles on this). Since each coefficient of the result can be written as an internal product (an interesting exercise actually), they can proceed with these protocols for each coefficient. At the end, one party holds the product $fg+r$ while the other party holds random $r$. I should add that these protocols are strictly exchanges of random numbers, and they don't leak nothing more than the desired output. As for $N>2$, I am not ready to give an answer

Tal-Botvinnik
  • 524
  • 3
  • 12