Threshold-optimal multi-party computation

Abstract

1. A computer-implemented method for executing a multi-party computation (MPC) protocol, the computer-implemented method comprising: obtaining a circuit representation of a computable function that is evaluated based on one or more first inputs to generate one or more outputs, where each first input should be either specified or randomly generated; converting the circuit representation of the function into a multi-party representation; making the multi-party representation available to each party; executing each SSG by distributing a respective share of a respective secret to each respective party; obtaining respective shares of each output from at least a threshold number of parties, where the threshold number corresponds to a threshold number of circuits associated with the multi-party circuit; and generating respective outputs of the function, where each output is generated based on a respective output share of at least a threshold number of that output.

Description

[Technical field]

[0001] The present disclosure relates to a method for performing multi-party computation. [Background technology]

[0002] Multi-party computation (MPC) protocols were introduced by A. Yao in his seminal work Protocols for Secure Computations. A. Yao solved the Billionaire's Problem, in which two billionaires want to know who is richer without sharing any information about their wealth. This communication protocol led to the development of the rich field of secure multi-party computation (sometimes called SMPC), which considers a set of secret values ​​held by several parties and combines this information to achieve some desired result without revealing any information about the secret values ​​beyond what can be inferred from the output.

[0003] MPC protocols usually use a secret sharing scheme to share input data between the parties, and the protocol is used to evaluate each gate. Secret sharing allows distributing a secret among several parties by distributing a share to each party. An example of such a scheme is Shamir's secret sharing scheme. A secret sharing scheme can withstand an adversary controlling at most t parties out of a total of n parties, where t varies based on the scheme, the adversary can be passive or active, and different assumptions are made about the adversary's capabilities. In these MPC protocols, functions are defined by circuits over finite fields. In such circuits, the shared values ​​operated on are defined over finite fields.

[0004] A computable function is a function for which there exists an algorithm that produces the same output given the same inputs to the function. Every computable function can be represented as a "circuit". A circuit is a directed graph where vertices are either inputs, outputs, or gates, and directed edges define the order of operations. A circuit (sometimes called an arithmetic circuit) contains gates configured to perform arithmetic operations such as addition, multiplication, etc. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] A. Yao, Protocols for Secure Computations Summary of the Invention [Means for solving the problem]

[0006] A problem with current MPC protocols is that the thresholds of one or more of the inputs to the function may differ from the thresholds of one or more of the outputs of the function. That is, the thresholds of the inputs may change as the inputs are operated on by the gates of the circuit. These MPC protocols lack threshold optimality.

[0007] This disclosure describes a novel MPC protocol that achieves threshold optimality, meaning that the number of shares required to construct at least one (or each) input is the same as the number of shares required to construct each output. This novel MPC protocol is considered a "threshold" MPC protocol, that is, it is robust against parties that either wish to gain information or to poison the evaluation of the computation, i.e., malicious parties.

[0008] According to one aspect disclosed herein, a computer-implemented method for executing a multi-party computation (MPC) protocol, wherein a group includes a coordinator and a plurality of participants, the method being performed by the coordinator: obtaining a circuit representation of a computable function to be evaluated based on one or more first inputs to generate one or more outputs, where each first input should be either specified or randomly generated, the circuit representation including: a) a plurality of arithmetic gates representing respective functions for operating on one or more of the first inputs and / or one or more second inputs, where the second inputs are respective outputs of the respective gates; and b) a plurality of directed edges, where each directed edge represents that the first input or the second input is provided to the respective arithmetic gate for operation by the respective arithmetic gate; A circuit representation of a function into a multi-party representation of the function, replacing each designated first input with a respective first splitting gate (SSG), where each respective SSG represents a protocol executed by the coordinator to distribute a respective share of a respective secret to each respective party, where each secret is associated with a respective threshold; transforming by replacing each randomly generated first input with a respective second split gate (JSG), where each respective JSG gate represents a protocol executed by each party to collaboratively generate a respective share of a respective secret, where each secret is associated with a respective threshold; making the multi-party representation available to each party, where each party is configured to evaluate the function by executing the multi-party representation based on each party's respective share of a respective secret, thereby generating a respective share of each output; implementing each SSG by distributing a respective share of a respective secret to each respective party; obtaining respective shares of each output from at least a threshold number of participants, the threshold number corresponding to a threshold number of circuits associated with the multi-party circuit; generating each output of the function, each output being generated based on a respective output share of at least a threshold number of that output.

[0009] A "multi-party circuit representation" may also be called a "threshold circuit representation," an "MPC circuit representation," an "alternative circuit representation," or a "meta-circuit representation."

[0010] In an embodiment, the converting step includes inserting at least one share-redistribution gate (SRG), where each respective SRG represents a protocol executed by each participant to collaboratively generate a new respective share of each shared value input to the respective SRG, where the new respective share is associated with a threshold value of the circuit, while each shared value is associated with a higher threshold value.

[0011] According to another aspect disclosed herein, a computer-implemented method executing a multi-party computation (MPC) protocol, wherein a group includes a coordinator and a plurality of participants, the method being performed by a first one of the participants, obtaining a multi-party circuit representation of the transformed function from a circuit representation of the computable function, the function to be evaluated based on one or more first inputs to generate one or more outputs, each first input to be either specified or randomly generated, the circuit representation including: a) a plurality of arithmetic gates representing respective functions for operating on one or more of the first inputs and / or one or more second inputs, the second input being a respective output of the respective gate; and b) a plurality of directed edges, each directed edge representing that the first input or the second input is provided to its respective arithmetic gate for operation by the respective arithmetic gate; replacing each designated first input with a respective first split gate (SSG), where each respective SSG represents a protocol executed by a coordinator to distribute a respective share of a respective secret to each respective party, where each secret is associated with a respective threshold; and replacing each randomly generated first input with a respective second split gate (JSG), where each respective JSG gate represents a protocol executed by each party to collaboratively generate a respective share of a respective secret, where each secret is associated with a respective threshold; evaluating a function by executing the multi-party circuit representation based on the first respective share of each respective secret to generate a first respective share of each output; sending a first respective share of each output to a coordinator, the coordinator configured to obtain respective shares of each output from at least a threshold number of participants, the threshold number corresponding to a threshold of the circuit, the coordinator configured to generate each output of the function, each output being generated based on a respective output share of at least the threshold number of that output.

[0012] MPC protocols involve converting a circuit that defines a computation function into an alternative circuit representation, referred to herein as a "multiparty" circuit or "metacircuit." The term "metacircuit" is used herein to refer to a new circuit that is converted from an original circuit based on the original circuit using the operations described herein. The metacircuit is "multiparty" in the sense that it is to be evaluated by multiple parties. In particular, each input to the original circuit is replaced with a split gate that represents either the secret sharing scheme used to distribute the shares of the input (e.g., Shamir's secret sharing scheme) or the secret sharing scheme used to generate the shares of the input (e.g., joint random secret sharing scheme). The metacircuit is associated with a threshold of the circuit. The threshold of each output is the same as the threshold of the circuit. This means that the number of shares of each output required to reconstruct that output corresponds to the threshold of the circuit. A metacircuit is similar to a regular circuit in that it includes gates (each of which represents a function, protocol, operation, etc.) and directed edges that represent the order of operations and the flow of data to the gates.

[0013] The meta-circuit is generated by a coordinator that has access to (e.g., generates) the original circuit that represents the computable function. The coordinator may be one of the participants. The coordinator sends the meta-circuit to the participants. In other embodiments, each participant may generate the meta-circuit independently. For each split gate of the meta-circuit, the participants either receive a respective share of a respective secret input value from the coordinator or collaboratively generate a respective share of a respective secret input value. The participants execute the meta-circuit, and in so doing, each generates a respective share of one or more outputs. Each participant sends a respective output share to the coordinator, and the coordinator then constructs each output using (at least) a threshold number of shares. In this way, the threshold of each output is the same as the threshold of each input - the circuit's threshold.

[0014] In general, the MPC protocols described herein may be used to evaluate any computable function. For example, the MPC protocols may be used to generate digital threshold signatures, e.g., threshold ECDSA signatures, that involve revealing a corresponding private key. As another example, the MPC protocols may be used to verify an individual's age (or other personal data) without revealing the individual's age (or other personal data).

[0015] Computing metacircuits in an MPC context allows computations to be distributed or outsourced to a network of parties, rather than being performed by one central party. Although converting these computations into metacircuits can introduce more complexity than computing them by a single party, there are at least four distinct advantages to outsourcing computations in this way:

[0016] One benefit of often outsourcing these computations is to provide redundancy in processors (for computation) or storage (for storing shares) so that there is no single point of failure in the entire system. Thus, a coordinator might set up an MPC network of participants for its computations such that it can remove sensitive inputs and rely on the network to collectively store and reconstruct those inputs.

[0017] A further advantage of instantiating such an MPC system is that it allows computations to be performed on data in a privacy-preserving manner. For example, if a coordinator wants a computation to be performed on his data, but does not want to share or reveal his data to any third parties, the coordinator may establish an MPC network to perform the computation. In this way, the coordinator's private data may be encoded as a secret input, such that the computation may be performed without any of the participants being able to identify the private data.

[0018] A scenario for outsourcing certain computations could be the case where the network itself represents a set of stakeholders (e.g., a collection of academic institutions) and the role of the "coordinator" is interpreted as a data provider to the network. In this case, the coordinator may not necessarily care about the outcome of the computation, but the network requires some third-party injection of data unknown to it. This could, for example, motivate the MPC network to request data from the coordinator as a source of randomness for the computation, and the coordinator may reward providing this data.

[0019] Furthermore, if the coordinator does not have sufficient computational power to execute the circuit and wishes to outsource its computation to a powerful network while benefiting from the secrecy of its computation, the coordinator can have the function computed using the disclosed MPC protocol.

[0020] To facilitate an understanding of embodiments of the present disclosure and to show how such embodiments may be put into effect, reference is made by way of example only to the accompanying drawings, in which: [Brief description of the drawings]

[0021] [Figure 1] FIG. 1 is a schematic block diagram of an exemplary system for implementing an MPC protocol. [Diagram 2] FIG. 1 shows a standard circuit (LHS) and a meta circuit (RHS) corresponding to the function f(x, a, b) = ax + b. [Diagram 3] FIG. 1 shows the standard circuit (LHS) and meta circuit (RHS) corresponding to the function f(x, y) = XOR(x, y). [Figure 4] FIG. 1 shows the standard circuit (LHS) and meta circuit (RHS) corresponding to the function s(a, k) = k-1e + k-1ar. [Diagram 5] FIG. 1 shows two metacircuit representations of a function f(x, y, a, b, c). [Figure 6] FIG. 13 shows a schematic diagram of validation of the reconstruction gate from the perspective of participant i. [Figure 7A] 1 is a flow diagram of evaluation of an XOR circuit. [Figure 7B] 1 is a flow diagram of evaluation of an XOR circuit. [Figure 7C] 1 is a flow diagram of evaluation of an XOR circuit. [Figure 7D] 1 is a flow diagram of evaluation of an XOR circuit. [Figure 8] FIG. 13 is a diagram showing a metacircuit representation of the threshold tC of the ∨ operator. [Figure 9] FIG. 1 illustrates a metacircuit representation of an age verification function. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0022] 1. Cryptography 1.1 Elliptic curves The technique described herein reduces Δ:= -16(4a 3 + 27b 2 ) ≠ 0 mod p, a prime field

[0023]

number

[0024] Above y 2 = x 3 + ax + b mod p An example of such a curve is secp256k1, used in Bitcoin (RTM). The order of this curve is denoted by n herein.

[0025]

number

[0026] Multiplication of a point G on an elliptic curve with is represented by the operator '·', a G = G + G + G where "+" denotes the addition of an elliptic curve point. Multiplication can thus be understood as the addition of an elliptic curve point of G with itself a times.

[0027] Note that mod n notation will be omitted hereafter, and all arithmetic operations on integers are performed modulo n. Furthermore, it will be understood that this is just one example elliptic curve, and that in general, G can be a point on any curve for which it is possible to compute a·G without simply finding a from the result.

[0028] 1.2 Secret sharing schemes This section describes how a secret S can be divided among N participants, each of whom holds a share of the secret. The secret S can be reconstructed using more than t shares. More precisely, a "threshold" t of the shared secret S is the maximum number of secret shares that does not allow the secret to be reconstructed.

[0029] 1.2.1 Shamir's Secret Sharing Scheme (SSSS) In 1979, Shamir established a method for splitting a secret S into N shares using a polynomial of degree t, such that S can be reconstructed given at least t + 1 unique points on the polynomial, with t + 1 <= N. This method is briefly described below.

[0030] Suppose we have a secret S.

[0031]

number

[0032] A random polynomial of degree t with coefficients f(x) = β0 + β1x + + β t x t where β0 = S and the remaining coefficients β j is some arbitrary constant. We can then use this polynomial to determine the N shares.

[0033] We consider N points in a two-dimensional space as (x1, a1), ..., (x N , a N ) where the x coordinates are all distinct and nonzero. We label the x i = i, then the y coordinates are a i = f(i) Satisfy N data a1, ..., aN We say that the secret is a threshold t. Then, a coordinator who knows secret S can share each secret a i can be sent to participant i.

[0034] The secret S can be reconstructed from at least t + 1 shares using the method of Lagrangian interpolation, as outlined further below.

[0035] 1.2.2 Joint verifiable random secret sharing (JVRSS) Next, we detail Feldman's Protocol for Jointly Verifiable Random Secret Sharing (JVRSS), which is used to define and share secrets among multiple participants without a coordinator.

[0036] Suppose N participants wish to create a joint randomly-distributed secret that in the scheme can only be regenerated by at least (t + 1) of the participants. To create a shared secret for a threshold t, the following steps are taken: 1. Participants agree on a unique label for each participant, i. Each participant, i, receives t + 1 random numbers.

[0037]

number

[0038] where ∈ R teeth,

[0039]

number

[0040] Then, each participant i, for i = 1, ..., N, calculates his / her own secret polynomial of degree t. f i (x) = β i0 +β i1 x + +β it x t These secret polynomials f i (x) is the collectively shared secret polynomial

[0041]

number

[0042] where the shared secret is given by S = f(0). 2. Each participant i sends a value f to participant j using a secure communication channel only with j. i (j) is transmitted. 3. Each participant i obtains his / her private secret share of the shared secret polynomial.

[0043]

number

[0044] It is calculated as follows. 4. Each participant i obtains the obfuscated coefficients for k = 0, ..., t. β ik G where G is a generating point of the EC group of order n. 5. Each participant i has f j (i) Calculate G,

[0045]

number

[0046] Each participant j can find the polynomial point f by verifying that jCheck that you have calculated (i) correctly. If all participants verify that this formula holds for each polynomial, then the group can be collectively confident that they all created the same shared polynomial.

[0047] In the secret generation algorithm presented above, note that steps 4 and 5 are particularly relevant to the verifiability aspect of the JVRSS scheme. These verification steps may be omitted if the circumstances are appropriate. An example is when all "participants" are trustworthy. For cases such as these, we define two concepts: JRSS - a process that implements steps 1-3 of the above algorithm. It can be used in a trusted environment. No verification of the generated secret shares is performed. JVRSS - a process that performs all steps 1-5 of the above algorithm. This does not require trust between the parties since the private secret shares are explicitly verified.

[0048] 1.2.3 Reconstructing the secret Share a i With any t + 1 subsets of x(x) and the corresponding index i, a unique polynomial f(x) can be computed using Lagrange interpolation.

[0049]

number

[0050] To calculate S = a0, we evaluate f at the point x = 0.

[0051]

number

[0052] We can write the above equation as S = interpolate(a1, ..., a t+1) Note that with fewer than t + 1 of these shares, there is not enough information to reconstruct a unique polynomial of degree t.

[0053] 1.3 Operations on Shared Values finite field

[0054]

number

[0055] Arithmetic operations such as addition, multiplication, and multiplicative inverse in may be computed on the shared value (or secret, if not disclosed).

[0056] 1.3.1 Adding Shared Values Two values, threshold t a a and threshold t b b and i are shared among a group of N participants, and each participant i has a share a i and b i To compute the sum of a and b, each participant i must determine the threshold max(t a , t b ) your additive share ν corresponding to the shared value a + b i = a i + b i Calculate.

[0057] Threshold max(t a , t b ) represents the degree of the polynomial f + g, where f is the degree t related to a a where g is a polynomial of degree t related to b. b is a polynomial of

[0058] 1.3.2 Multiplication of Shared Values Two values ​​- threshold t a a and threshold t b b - is shared within a group of N participants, and each participant i has a share ai and b i To calculate the multiplication of a and b, each participant i must have a threshold t a + t b Your multiplicative share ν corresponds to the shared value ab of i = a i b i Calculate.

[0059] Threshold t a + t b represents the degree of the polynomial fg, where f is the degree t related to a a where g is a polynomial of degree t related to b. b is a polynomial of

[0060] 1.3.3 Inverse of a Shared Value In many cryptographic protocols, such as computing an ECDSA signature, it is necessary to compute the inverse of a given value. It therefore follows that in the context of MPC we must be able to inverse such a value if the value itself is shared. a To compute the inverse of a shared value a with 1. All participants were assessed using the JRSS or JVRSS protocol to determine the threshold t a Each participant i computes a shared secret b with share b i has. 2. Each participant i distributes his / her share a to all participants. i b i Broadcast. 3. Each participant i:

[0061]

number

[0062] Calculate where:

[0063]

number

[0064] and

[0065]

number

[0066] is the number of participants i + 1, ..., i + 2t a is received from 4. Each participant computes the modular inverse of μ, resulting in μ -1 = (a b ) -1 It becomes. 5. Each participant i:

[0067]

number

[0068] Calculate your inverse share by calculating:

[0069] We call b the blinding shared secret. b is the secret that is obtained by dividing the share a i is used to keep secret a hidden and not reveal the secret a in step 3.

[0070] 1.4 Redistribution of shared values In this section, we consider the threshold t a Share a for a particular shared value a i We explain how to redistribute among participants the set of new shares that each participant receives corresponding to the same value of a.

[0071]

number

[0072] The method is as follows: 1. All N participants in the new scheme use the JRSS or JVRSS protocol to verify the threshold t κ The share of blinders with κ i Generate. 2. Each participant i determines the threshold max(t a , t κ ) corresponding to the value a + κ i = a i +κ i Calculate. 3. Each participant i broadcasts its intermediate share to all participants. 4. All participants receive the middle share (max(t a , t κ ) + 1) blinded value

[0073]

number

[0074] Calculate. 5. Each participant determines the threshold t κ Your new share corresponding to the value of a

[0075]

number

[0076] Calculate.

[0077] 2. Exemplary System Overview 1 illustrates an exemplary system 100 for implementing the multi-party computation (MPC) protocol disclosed herein. The system includes a coordinator (or adjuster) 101 and one or more participants (or participants) 102. The coordinator 101 and each participant 102 are connected such that they can send and receive data. For example, the participants may be connected via a packet-switched network, e.g., a wide area internetwork such as the Internet.

[0078] For simplicity, the coordinator 101 is described as being a separate entity from the participants. However, in some examples, the coordinator 101 is one of the participants 102, and any of the participants 102 may act as the coordinator 101. That is, there may be at least one participant 102 that performs both the functions attributed to the coordinator 101 and the functions attributed to the participant 102.

[0079] For purposes of illustration, three participants 102a, 102b, 102c are shown. It will be understood that the system 100 may include many more such participants that exist and participate in the system 100, but for convenience they are not shown. Each participant 102 may be an individual, an organization, a machine, a server, etc. That is, the participants 102 may take any suitable form and are not necessarily, but are not excluded from being, a user or a group of users.

[0080] The coordinator 101 and each participant 102 operate a respective computing device (not shown). Each computing device of the coordinator 101 and each participant 102 includes a respective processing device including one or more processors, e.g., one or more CPUs, GPUs, other accelerator processors, application specific processors, and / or FPGAs. Each computing device further includes a memory, i.e., computer readable storage in the form of a non-transitory computer readable medium or multiple non-transitory computer readable media. This memory may include one or more memory units employing one or more memory media, e.g., magnetic media such as hard disks, electronic media such as SSDs, flash memories, or EEPROMs, and / or optical media such as optical disk drives. The memory of each computing device may store software including a respective instance of at least one client application arranged to execute on the processing device. It will be understood that all actions attributed herein to the coordinator 101 or a given participant 102 may be performed using software executing on the processing device of the respective computing device. Each computing device may include at least one user terminal, e.g., a desktop or laptop computer, a tablet, a smartphone, or a wearable device such as a smart watch. The computing devices may additionally or alternatively include one or more other networked resources, such as cloud computing resources, that are accessed via the user terminal.

[0081] The client application may initially be provided to the computing equipment of any given participant 102 on one or more suitable computer-readable storage media, for example downloaded from a server or provided on a removable storage device such as a removable SSD, a flash memory key, a removable EEPROM, a removable magnetic disk drive, a magnetic floppy disk or tape, an optical disk such as a CD or DVD ROM, or a removable optical drive.

[0082] 3. Threshold-optimal MPC The coordinator 101 is configured to obtain a circuit representation (or formula) of a computable function. As mentioned above, a computable function is a function for which there exists an algorithm that produces the same output given the same input to the function. One or more inputs may be specified by the coordinator. These are the inputs for which the function is to be evaluated. The one or more inputs may be randomly generated. For example, these inputs may represent constants or arbitrary values. A circuit is a directed graph where vertices are either inputs, outputs, or gates, and the directed edges define the order of operations. In a normal circuit, the gates represent arithmetic operations such as addition, multiplication, subtraction, division, inversion, etc. That is, each respective (arithmetic) gate may be one of i) an addition gate, ii) a subtraction gate, iii) a multiplication gate, iv) a division gate, or v) an inverse gate. The directed edges therefore represent the flow of data input to the gates to be operated on. The circuit representation is referred to herein as the "standard circuit" or "original circuit". Examples of standard circuits are shown in Figures 2 to 4. Referring to Figure 2, a function ax + b has multiple inputs (x, a, b) and a single output ω1 = f(x, a, b). The circuit includes a multiplication gate configured to multiply the inputs x, a, and an addition gate configured to add the intermediate result ax with the input b.

[0083] In general, the standard circuit may take any form. For example, the standard circuit may be represented in code, in words, or even as a schematic. Regardless of the particular format in which the standard circuit is represented, the coordinator 101 is configured to interpret the features of the standard circuit (i.e., the gates and directed edges).

[0084] The coordinator 101 may generate the standard circuit based on the computable function. Alternatively, the coordinator 101 may obtain the standard circuit from another resource, such as a different coordinator, a website, a memory, etc.

[0085] The coordinator 101 is configured to convert standard circuits into metacircuit representations of computable functions. Similarly, any of the participants 102 may also be configured to convert standard circuits into metacircuits. That is, the participants 102 may independently create metacircuits. As described below, the conversion of a standard circuit into a metacircuit may be performed by any participant who knows the MPC protocol. Converting a standard circuit into a metacircuit involves a series of steps, some of which may be performed in any order. It should be noted that the term "metacircuit" is only used as a label for the converted circuit, and the terms "converted circuit", or "modified circuit", or "multiparty circuit", or "alternative circuit" may be used instead.

[0086] Converting the standard circuit into a meta-circuit involves replacing each input to be specified by the coordinator 101 with a respective first split gate. That is, each such input is replaced with its own first split gate. The first split gates represent a protocol executed by the coordinator 101 to generate respective shares of the corresponding inputs and distribute those shares to the participants, one for each participant 102. Each input is a secret with a threshold. When the meta-circuit is executed, for each first split gate, the coordinator 101 is configured to generate and distribute to the participants 102 shares of the corresponding secret. The protocol represented by the first split gates may be Shamir's Secret Sharing Scheme (SSSS). Other dealer-based secret sharing schemes may be used instead.

[0087] Converting the standard circuit into a meta-circuit involves replacing each input to be randomly generated with a respective second split gate. That is, each such input is replaced with its own second split gate. The second split gate represents a collaborative protocol executed by each of the participants 102 to generate a respective share of the corresponding input. When the meta-circuit is executed, for each second split gate, the participants 102 are configured to cooperate to generate a respective share of the corresponding secret. The protocol represented by the second split gate may be a Joint Random Secret Sharing (JRSS) scheme or a Jointly Verifiable Random Secret Sharing (JVRSS) scheme. Other secret sharing schemes may be used instead.

[0088] In some examples, the threshold of each secret is the same. In other examples, one or more of the secrets may have different thresholds. The threshold of each individual secret may be less than, equal to, or greater than the threshold of the circuit. For example, the circuit may have a respective threshold t A and t BThe threshold of the circuit is t C The secret is the formula t A , t B ≧t C In some cases, t A > t B Including the case of t A = t B or t A ≠t B Similarly, t B = t C Cases are not excluded.

[0089] The entire circuit is associated with a circuit threshold as described above, which is the threshold of each output generated by the circuit, i.e., the output share of the threshold number required to generate each output.

[0090] As an example, the inputs (x, a, b) of the standard circuit in Figure 2 are transformed into the first and second split gates of the corresponding metacircuit. "SSG" denotes the first split gate, and "JSG" denotes the second split gate.

[0091] Converting a standard circuit into a metacircuit may involve one or more additional steps, which are discussed below.

[0092] Once the meta-circuit is generated, the coordinator 101 transmits the meta-circuit to each participant 102. As with a standard circuit, the meta-circuit may take any suitable format, e.g., computer code, text, image, etc. Each participant 102 is configured to execute the meta-circuit using one or more respective shares received from the coordinator 101 (corresponding to the first split gate) and / or generated by the participant 102 (corresponding to the second split gate). Each participant 102 executes the meta-circuit using the gates and directed edges of the meta-circuit to generate a respective share of one or more outputs.

[0093] Each participant 102 transmits its respective share of one or more outputs to the coordinator 101. The coordinator 101 then generates each output based on at least a threshold number of shares of that output, e.g., by interpolating the respective shares.

[0094] In some embodiments, converting a standard circuit into a metacircuit includes inserting one or more "reconstruction gates" into the metacircuit. Each reconstruction gate represents a protocol executed by the coordinator 101 to generate an output by interpolating the shares of the outputs fed into the reconstruction gate, i.e., sent to the coordinator 101 by the participants. The metacircuit may include a respective reconstruction gate for each output.

[0095] In some embodiments, the standard circuit includes one or more inverse gates that represent operations that compute the inverse of a non-scalar input. In these embodiments, converting the standard circuit into a meta-circuit includes replacing each inverse gate with a "share inverse gate." Each share inverse gate represents a consensus protocol executed by each participant 102 to compute the inverse of a share supplied to the share inverse gate.

[0096] Converting a standard circuit into a metacircuit may include inserting one or more "share redistribution gates" (SRGs) into the metacircuit. Each SRG represents a cooperative protocol executed by each participant 102 to generate a new respective share of a shared value (i.e., a shared secret) input to the SRG. That is, each participant 102 has a share of the shared value that is fed into the SRG, and the protocol is configured to output a new share of the same shared value. The old share has a higher threshold than the new share. The new share's threshold is the same as the circuit's threshold. Each SRG may represent the protocol described above in Section 1.4 Redistribution of Shared Values.

[0097] An SRG may only be needed if the circuit includes one or more "share multiply gates" configured to perform a multiplication operation on two shares supplied to the share multiply gate.

[0098] There are several options for inserting an SRG into a metacircuit. One option is to insert an SRG between each share multiplication gate and the next gate in the metacircuit. An example of this option is shown in Figure 2, where an SRG gate is inserted between a share multiplication gate (denoted by the label "SecM") and the next gate, which in this example is an addition gate. i and b i Multiplication of a i and b i Results with a higher threshold than ab i The SRG gate is i and b i ab with the same threshold as i Generate a share of

[0099] As an alternative, instead of inserting an SRG after each share multiplication gate, the coordinator 101 may insert an SRG before a share multiplication gate if the input to that share multiplication gate is higher than the circuit's threshold. In other words, the SRG is inserted between the previous gate and the share multiplication gate. In this alternative, the coordinator 101 also inserts an SRG before each reconstruction gate.

[0100] Examples of these two options are shown in Figure 5. On the left side (LHS), an SRG gate is inserted after each share multiplication gate. This results in the metacircuit having three SRGs, one for each share multiplication gate. In contrast, on the right side (RHS), an SRG gate is inserted between the addition gate and the share multiplication gate, since the inputs to the share multiplication gates have higher thresholds than the circuit's thresholds. The higher thresholds of the inputs are due to the share multiplication. An SRG is also inserted before the reconstruction gate. This results in the metacircuit having two SRGs.

[0101] In the following, we describe a third option for inserting an SRG. The maximum threshold circuit of the metacircuit is 2t C ≦t max < N, where N is the number of participants in the group, and t C t is the respective secret threshold. If the metacircuit includes one or more share inverse gates, the coordinator 101 checks whether the shares supplied to the share inverse gates are greater than or equal to a threshold t > t max -t C If we have, we insert an SRG between the input to the share inverse gate (i.e., the previous gate) and the share inverse gate. In addition, we set the threshold of the share output by the share multiplication gate to t max If the expected eigenvalue is higher than , the coordinator 101 inserts an SRG between one of the inputs to the share multiplication gate (i.e., the previous gate) and the share multiplication gate. An SRG is also inserted before each reconstruction gate.

[0102] There are scenarios in which the coordinator 101 and / or participants may want to verify that the metacircuit has been evaluated correctly, or that a particular stage of the metacircuit has been evaluated correctly. For example, a participant 102 may want to verify the shares distributed by the coordinator 101 as part of executing a protocol defined by the first split gate, e.g., SSSS. To do so, for each input, the coordinator 101 may send to the participants 102 obfuscated coefficients of the polynomial associated with the input. Thus, each participant 102 receives its respective share of the input and the obfuscated shares of all other participants. Each participant 102 can verify its share based on the obfuscated shares of the other participants 102.

[0103] Participants 102 may also want to verify shares generated by the protocol defined by the second split gate. Participants may generate these shares using the JVRSS, which includes the verification step defined above in section 1.2.2.

[0104] Each participant 102 may also want to verify the share of the output generated by the other participants. For example, participant A 102a may want to verify that participant B 102b and participant C have correctly evaluated the metacircuit. To do so, each participant 102 obtains the obfuscated input shares of each of the other participants, where a participant's obfuscated input shares refer to the obfuscated version of the share of the inputs generated by or distributed to that participant. For example, if there are two inputs to the metacircuit, each participant obtains an obfuscated share of each of the two inputs of each of the other participants 102. For example, participant A 102a obtains the two obfuscated input shares of participant B 102b and the two obfuscated input shares of participant C 102c. The shares may be obfuscated by multiplication with a generator or in any other suitable manner.

[0105] Each participant 102 then evaluates the metacircuit using the given participant's obfuscated input share to generate an obfuscated output share for that participant. For example, participant A 102a uses participant B's 102b's obfuscated input share to generate participant B's 102b's obfuscated output share, and participant C's 102c's obfuscated input share to generate participant C's 102c's obfuscated output share. Evaluating the metacircuit using the obfuscated input shares is done in the same way that a participant 102 evaluates the metacircuit using its own unobfuscated input shares, except that a different participant 102's obfuscated shares are used instead. Depending on the gates of the metacircuit, a participant 102 may be required to send obfuscated versions of intermediate results of the computation to other participants. Each participant 102 may then generate an obfuscated version of each output based on its obfuscated share. Each participant 102 then verifies that its unobfuscated output share was correctly calculated by comparing the output (generated based on the unobfuscated share each participant generated using its own unobfuscated input share) with the obfuscated output (generated by the given participant for itself and each of the other participants).

[0106] An example of this process is shown in Figure 6. Each participant 102 computes an unobfuscated output share using its unobfuscated input share, which is used to generate an unobfuscated output of the metacircuit. This is the "private computation" pass. Each participant 102 also computes an obfuscated output share using each of the other participants' obfuscated input shares, which is used to generate an obfuscated output of the metacircuit. This is the "public computation" pass. The unobfuscated output from the private computation pass may be obfuscated and compared to the obfuscated output from the public computation pass.

[0107] 4. Efficient threshold-optimal MPC (ETOM) This section describes a specific implementation of the MPC protocol described above. It is assumed that all N participants are honest, and therefore the circuit does not require any verification.

[0108] 4.1 Metacircuits As mentioned above, given a circuit C, the coordinator 101 can convert the circuit C into a new representation that contains the gates required to perform the ETOM computation. Each of the inputs is subject to the same threshold t C Even if the threshold may change to some value t during the computation of the metacircuit, the ETOM protocol ensures that the output of the metacircuit is within the threshold t C We guarantee that.

[0109] Below are described exemplary gates that the coordinator 101 may use to construct a metacircuit.

[0110] 4.1.1 Input gate To evaluate a meta-circuit, all inputs to the circuit are appropriately divided among the participants of the ETOM scheme. There are two input types: dealt and random. Therefore, we introduce a new related circuit gate that divides the inputs among the participants. Shamir-splitting gate (SSG) - threshold t C Through the SSG gate, the coordinator distributes the input a0 to the participants. The gate runs the SSSS and shares the input a i and divide them into shares a i Each participant i receives a share a of a0. i The SSG is an example of the first split gate mentioned above. JRSS-splitting gate (JSG) - threshold t CThrough the JSG gate, participants execute JRSS (Section 1.2.2). Each participant i has his / her own private polynomial

[0111]

number

[0112] After creating the share, all participants will i The shares correspond to a value a. The JSG is an example of the second split gate mentioned above.

[0113] 4.1.2 Addition gate An addition gate takes two operands and adds them together to produce an output. In the context of ETOM, the operands can be either scalars (constant-valued parts of the metacircuit) or shares of values. For example, if two operands a, b are added together above a threshold t a and t b If the shared value of t a , t b ) a + b.

[0114] 4.1.3 Multiplication gates A multiplication gate is a circuit gate that multiplies two operands and outputs the result. Multiplication of two shared values ​​produces a new shared value that raises the threshold. Since this is the only gate that may raise the threshold, we distinguish between the two cases as follows: Scalar Multiplication (ScaM) Gate - takes one scalar value and one shared share as input and multiplies them. The output has a threshold equal to the number of shares shared. Share Multiplication (SecM) gate - takes two different shared values ​​as inputs and multiplies them. For example, if two inputs a and b are multiplied by a threshold t a and t b If the shared value of is t, the SecM gate a + t bOutput ab of.

[0115] 4.1.4 Reconstruction Gate (RG) The reconstruction gate can be used by each participant to reconstruct the shared value of the threshold t. The reconstruction gate requires that a participant requests t shares from at least t participants. Its own share a1 and the t received shares a2, ..., a t+1 Using a and b, the reconstruction gate calculates the shared value output a using Lagrange interpolation, as described in detail above. interpolate(a1, ..., a t+1 ) = a Calculate.

[0116] 4.1.5 Share Redistribution Gate (SRG) This gate is used to lower the shared value threshold. It takes the shared value of threshold t as input, applies the value redistribution scheme of Section 1.4, and lowers the shared value threshold t C Distribute the new shared value of among the ETOM participants. We recall that the value redistribution scheme uses the JRSS protocol and requires all participants to communicate to create the blinding shared value.

[0117] Moreover, we can express SRG gates with full granularity. i If,i,is the input to the gate, participants,i,perform the following steps that collectively define an,SRG. 1. JSG Gate: β i (Participant i's share) 2. Addition gate: a i +β i 3. Reconstruction gate: a +β 4. ScaM gate: (-1)β i 5. Addition gate: (a +β) + (-1)β i

[0118] A practical example would be to insert an SRG gate after the SecM gate. The SecM gate has a threshold of 2t C When outputting the shared value of , we set the threshold to t C This prevents the intermediate product shares of the circuit from becoming inflated.

[0119] 4.1.6 Reverse Gate These gates take one operand as input and output its additive or multiplicative inverse. The additive inverse can be calculated using the following gates: ·Additional Inverse Gate - Share a i The input is the field

[0120]

number

[0121] -a i This is equivalent to performing a ScaM gate on the scalar −1, as seen in step 4 of the SRG. Because the share inverse of a shared value needs to be computed using the method outlined in § 1.3, we distinguish between scalar inversion and share inversion as follows. Scalar Inverse Gate (ScI) - takes a scalar α as input and

[0122]

number

[0123] Alpha -1 Output. ·Share Inverse Gate (IVG) - Share a i Take the input and invert it by executing the method in Section 2.3.

[0124]

number

[0125] We output the

[0126]

number

[0127] Recall that to compute, all participants need to communicate, and they all create a blinding shared secret.

[0128] Furthermore, we can express IVG gates with full granularity. i If,i,is the input to the gate, then participants,i,perform the following steps which collectively define the,IVG. 1. JSG Gate: β i (Participant i's share) 2. SecM Gate: a i β i 3. Reassembly gate: Aβ 4. ScI gate: (aβ) -1 5. ScaM gate: (aβ) -1 β i

[0129] The output of participant i corresponds to the shared value α (αβ) -1 β i It is.

[0130] 4.2 ETOM Scheme Consider a coordinator 101 that wants to outsource the computation of a function to an ETOM network of peers 102. An exemplary scheme that specifies how the function can be evaluated by this network is as follows: Input: Function = f(x1, x2, x3, ...), Inputs = (x1, x2, x3, ...) Output: (ω1, ω2, ω3, ...) = f(x1, x2, x3, ...) 1. The coordinator 101 selects a function f(x1, x2, x3, ...) and all the distribution inputs (x1, x2, x3, ...) over which the function is to be evaluated. 2. The coordinator 101 creates a circuit representation C S Create a. 3. The coordinator 101 creates this circuit C S Let's make a meta-circuit C M The coordinator 101 does this by: a. Replacing each distributed input with an SSG to distribute the input b. Replace each random input by the JSG c. Replace each inverse gate with a non-scalar input by an IVG. d. Inserting an SRG between each SecM gate and the next gate 4. Coordinator 101 creates meta-circuit C M and the circuit threshold t C to all participants 102. Broadcasting may refer to publishing on a shared resource, for example a message bus. 5. The coordinator 101 executes all incoming SSG gates. 6. Each participant 102 creates a meta-circuit C M Rate the following. 7. After evaluating the circuit, each participant i assigns its output share ω ik to the coordinator 101, where ω k represents the k-th output of the circuit. 8. The coordinator 101 receives the C + 1 output share, perform Lagrange interpolation to find the kth output ω k This is represented as a reconstruction gate (RG) in the metacircuit.

[0131] 4.3 Example Here, three worked examples are given: one covering linear functions, one showing how we can perform logical operators with ETOM, and one showing how the ECDSA threshold signature protocol can be modeled by ETOM.

[0132] We use variables x, y, and z to represent the distributed variables that are converted to shared values ​​using SSSS that are used in the rest of the circuit. Conversely, we use variables a, b, and c to represent the random inputs that are generated using JRSS.

[0133] 4.3.1 Simple algebraic circuits In this section, we show how simple linear functions can be computed using metacircuits. Consider a function f(x, a, b) = ax + b that takes a mixture of distributed and random inputs x and a, b, respectively. Since the function involves multiplication of shared values, we can compute ... C + Assuming there is one participant, compute f by following the protocol in Section 4.2. Input: Function = ax + b, Inputs = (x, a, b) Output: ω1 = f(x, a, b) 1. The coordinator 101 selects a function ax + b and an input x over which the function is to be evaluated. 2. The coordinator 101 creates a circuit representation C of f, as shown in the LHS of Figure 2. S Create a. 3. The coordinator 101 creates a metacircuit C M Convert to. 1. Replace the input x by an SSG gate 2. Replace the random inputs a and b with a JSG gate 3. (SecM) Insert an SRG gate after the multiplication gate 4. Coordinator 101 creates meta-circuit C M and the circuit threshold tC Broadcast to all interested parties. 5. The coordinator 101 executes the SSG gate. 6. Each participant 102 creates a meta-circuit C M Rate the following. 7. After evaluating the circuit, each participant 102 sends its output share to the coordinator. 8. The coordinator 101 receives the C + Perform Lagrangian interpolation on the 1 output share to obtain the result ω1.

[0134] We consider the threshold t C Share of a i and x i The SecM multiplication gate between C Output share of a i x i Note that by executing the SRG gate, participant i generates a threshold t C Share of i By calculating a i x i Lower the threshold.

[0135] 4.3.2 Boolean circuits The next class of circuits we consider are Boolean circuits, which can be used to describe functions of logical operators such as AND, XOR, and NOT. It is important to consider such circuits because all Turing machines can be computed using logical operators. In practice, computational units (e.g., CPUs, GPUs) are built from circuits composed of logical operators.

[0136] To construct a Boolean metacircuit, we write the logical operators using addition and multiplication, and using the protocol of Section 4.2, we obtain a metacircuit. As an example, algebraically, f(x, y) = XOR(x, y) = (x - y) 2 = (x - y) (x - y) Consider a logical XOR function that can be written as: where the values ​​of x and y are either 0 or 1. In terms of the ETOM we introduced in Section 3.1, x and y are distributive inputs. As seen in the example in Section 4.3.1, the function f(x, y) is obtained using multiplication, so we can assume that the function f(x, y) is at least 2t C + Assume there is one participant 102. The coordinator 101 and the participant execute steps according to the protocol in section 4.2. Input: Function = (x - y) 2 , input = (x, y) Output: ω1 = f(x, y) 1. The coordinator 101 selects a function f(x, y) and inputs x, y ∈ {0, 1} over which the function is to be evaluated. 2. The coordinator 101 creates a circuit representation C of f, as shown in the left hand side of Figure 3. S Create a. 3. The coordinator 101 creates a metacircuit C M Convert to. a. Replace each distribution input x, y with an SSG gate. b. Insert an SRG gate after each SecM gate 4. Coordinator 101 creates meta-circuit C M and the circuit threshold t C to all participants 102. 5. The coordinator 101 executes two SSG gates. 6. Each participant 102 creates a meta-circuit C M Rate the following. 7. After evaluating the circuit, each participant 102 sends its output share to the coordinator 101. 8. The coordinator 101 receives the C + Perform Lagrangian interpolation on the 1 output share to obtain the result ω1.

[0137] 4.3.3 ECDSA This example shows how the threshold optimal Elliptic Curve Digital Signature Algorithm (ECDSA) can be modeled as a particular case of the ETOM scheme described in Section 4.2. The following signing function takes a private key a and an ephemeral key k as input, for a given message, and produces the s part of the ECDSA signature as output. We define this function as s(a, k) = k -1 (e + ar) = k -1 e + k -1 ar where e is the hash digest of the message being signed and the r part of the signature is r = [k G] x and all operations in the formula are performed modulo n.

[0138] In the context of ETOM, the private key a is the distributed input and the ephemeral key k is the random input. The steps of the protocol in Section 4.2 are as follows: Input: Function = s(a, k), Input = (a, k) Output: ω1 = s(a, k) 1. The coordinator 101 selects a function s(a, k) and a distribution input a over which the function is to be evaluated. 2. The coordinator 101 creates a circuit representation C of f, as shown in the LHS of Figure 4. S Create a. 3. The coordinator 101 creates a metacircuit C M Convert to. a. Replace distributed input a with an SSG gate b. Replace the random input k by the JSG gate c. Replace inverse gates with non-scalar inputs with IVGs d. Insert an SRG between the SecM gate and the next gate 4. Coordinator 101 creates meta-circuit C M and the circuit threshold t C to all participants 102. 5. The coordinator 101 executes all SSG gates. 6. Each participant 102 creates a meta-circuit C M Rate the following. 7. After evaluating the circuit, each participant 102 sends its output share to the coordinator 101. 8. The coordinator 101 receives the C + Perform Lagrange interpolation on one output share to get output ω1 = s(a, k) = k -1 e + k -1 Ask for ar.

[0139] The bottom left region of the metacircuit in Figure 4 represents the computation of the private key, which may be precomputed once per scheme. The output of this circuit is the input to the circuit in the middle region, which contains the message-independent term k -1 represents the precomputation phase of computing ar, which may be precomputed once per signature. The signature generation phase is represented by the top right region of Figure 4 and includes the message-dependent term k -1 Compute e. This is done for each message.

[0140] 4.4 Optimization of circuit evaluation Three strategies that can be adopted to modify the ETOM protocol to reduce or optimize the overall computational overhead for evaluating a circuit are next described.

[0141] 4.4.1 Preprocessing Executing the JRSS protocol as part of the JSG, IVG, and SRG gates is time consuming since all participants 102 need to communicate for the distribution of shares associated with the value. To avoid such overhead, participants 102 can periodically pre-compute JRSS values ​​that can be used later in the circuit. That is, participants 102 can set up JRSS values ​​in advance that are ready to be used when needed. In terms of implementation, the computation of JRSS values ​​can be performed in parallel while evaluating the meta-circuit, and each participant 102 can store a cache or database of unused shares associated with the value. Once a share is used, the participant 102 removes it from the database. Failure to remove a share does not pose a security issue, but participants 102 may start to have storage issues by storing too many shares.

[0142] 4.4.2 SRG Delay Inserting an SRG gate after each SecM multiplication gate may increase the number of JRSS values ​​required. Take for example a function f(x, y, a, b, c) = (ax + by) c with x, y as distribution inputs and a, b, c as random inputs. It has three SecM gates and three corresponding SRG gates as in Fig. 5(i). To reduce the number of SRG gates, the coordinator 101 may instead insert only one SRG gate after we compute ax + by and before the multiplication with c, and one SRG gate before we send the shares to the coordinator, as seen in Fig. 5(ii). Furthermore, the coordinator 101 may remove the last SRG gate and instead insert 2t C + You can wait for 1 share.

[0143] In summary, step 3.d. in section 4.2 may be replaced by the following: 3.d. The input to the SecM gate is t C If it has a higher threshold, insert an SRG gate between the input and the SecM gate. 3.e. The coordinator 101 sets a threshold t C If we need the output of,an SRG gate is inserted before the last reconstruction gate of the,metacircuit.

[0144] 4.4.3 Maximum Threshold Taking step 3.e. above a step further, we find that we have a maximum acceptable threshold of 2t C ≦t max We can let the threshold increase as we compute the circuit until we reach < N. We replace steps 3.c. and 3.d. in Section 4.2 with the following: 3.c. Replace each inverse gate with a non-scalar input by an IVG gate. The input to the IVG gate is a threshold t > t max -t C If we have, we introduce an SRG gate between the input and the IVG gate. 3.d. The expected output threshold of the SecM gate is t max If the SecM gate has a higher threshold, insert an SRG gate between one of the inputs and the SecM gate. If the expected output of the SecM gate has a threshold of t max If it is still higher than (e.g., when both inputs have high thresholds), insert an additional SRG gate between the other input and the SecM gate. 3.e. The coordinator 101 sets a threshold t C If we need the output of,an SRG gate is inserted before the last reconstruction gate of the,metacircuit.

[0145] When the IVG gate is executed, the input of threshold t is C multiplied by the blinding share of t + t C We increase the threshold to at most t max Therefore, t + t C ≦t max and so that t≦t max -t C Therefore, t > t max -t CWhenever , we need to lower the input threshold using an SRG gate. This is captured by step 3.c.

[0146] Verifiability Without verification of the metacircuit, an attacker in a dishonest setting could inject false intermediate values ​​at any point in the circuit to ensure that the final result output by the circuit is inaccurate. To prevent such attacks, a verification step may be inserted into the process of circuit evaluation. We approach verification with a strategy of checking whether the computations made by ETOM participants with respect to the metacircuit are correct.

[0147] 4.5.1 Validation Framework We can think of the validation as two layers. In the first layer, each participant 102 submits his / her share a i In the second layer, each participant 102 computes each gate using the obfuscated share a of the other participants, which is a private computation. j We compute each gate using G, which is a public computation. This is analogous to the fact that the shares take a form similar to a private key, and the obfuscated shares resemble a public key. The verification process compares the result of the private computation with the result of the corresponding public computation.

[0148] a i The obfuscated input associated with

[0149]

number

[0150] Therefore, a i If corresponds to the shared share of value a, then

[0151]

number

[0152] corresponds to the shared share of the value aG. As we will see later,

[0153]

number

[0154] A i It does not have to be equal to G.

[0155] 4.5.2 Input Validation The first step towards a verifiable metacircuit is to enable verification of the SSG and JSG input gates. Let β0 be the input distributed by the coordinator, and

[0156]

number

[0157] Let us assume that,is the related polynomial. Each participant,i,has a share,a,. i = f(i) and the obfuscated shares a of all other participants j Receive G. SSG Verification Verification of the SSG gate is as follows. 1. The coordinator creates an obfuscated coefficient β k Broadcast G, k = 0, ..., t to all participants. 2. Each participant i has equal probability for all j = 1, ..., N.

[0158]

number

[0159] Validate the input by checking JSG Verification To verify the JSG gate, each participant runs the JVRSS scheme as part of the JSG gate, instead of the JRSS. The steps of the JVRSS scheme are detailed in Section 2.2.2. In addition, β is the threshold t generated by the JVRSS (through the JSG gate). C If the shared value of

[0160]

number

[0161] can be calculated separately, where β i,l G is the polynomial of participant i

[0162]

number

[0163] are the obfuscated coefficients of

[0164] Besides the input gates (SSG and JSG), the only other gate in the circuit that may require verification is the reconstruction gate, because each participant i needs to ensure that the shares used for the interpolation in the reconstruction gate were correctly calculated by the corresponding participant.

[0165] By not verifying, an honest participant i runs the risk that the output from the reconstruction gate and all subsequent results that use that output are incorrect. The reconstruction gate verification is a synchronization point between the private and public computations where the private output is compared to the public obfuscated output. Figure 6 is an example of a reconstruction gate verification.

[0166] Here, we consider public computation, whereby party i reproduces party j's computation using obfuscated input.

[0167] 4.5.3 Public Computations We now explain in detail how the public computation (top band of Fig. 6) is performed with respect to the different gates. Each gate of the metacircuit has a corresponding public gate whose inputs and outputs are obfuscated versions of the shares used for the private computation (bottom band of Fig. 6).

[0168] Addition Gate To compute the summation gate, each participant i computes the summation gate for each participant j = i, i + 1, ..., i + max(t a , t b ) Obfuscated input

[0169]

number

[0170] and

[0171]

number

[0172] Each participant i has knowledge of the output of each corresponding j.

[0173]

number

[0174] A similar calculation is performed for the ScaM gate.

[0175] SecM Gate For each participant i, the private computation of the SecM gate is i , b i Take the output o i = a i b i Recall that for public computation, each participant i returns a threshold t b Obfuscated share of b

[0176]

number

[0177] Each participant i performs the following steps: 1.

[0178]

number

[0179] where ECint is the same as interpolate (i.e., Lagrange interpolation) except that modular summation is replaced by a summation of the points of the elliptic curve. 2. Verification Share

[0180]

number

[0181] Calculate and broadcast. 3. Each party j = i + 1, ..., i + t a from

[0182]

number

[0183] Receive.

[0184] share

[0185]

number

[0186] is the obfuscated output of the public computation of the SecM gate received from the participant j. Therefore, the share

[0187]

number

[0188] becomes the obfuscated input to the next gate in the public computation of the circuit.

[0189] Reconstruction Gate Participant i is the obfuscated input

[0190]

number

[0191] Whenever we execute a reconstruction gate in, the public computation of the gate is

[0192]

number

[0193] Output. Finally, we consider the SSG and JSG inputs to be C Since we have t a and t b is the value t C or 0 (when the input comes from a reconstruction gate).

[0194] 4.5.4 Verification of RG calculation The verification is done by using the obfuscated output of the corresponding public computation of the reconstruction gate.

[0195]

number

[0196] The output o of the reconstruction gate is verified against We carry out the following two steps. 1. Calculate oG 2.

[0197]

number

[0198] Check if it is

[0199] For example, i = a i + b i and b i = c i d i where a, c, and d are the thresholds t C Let us assume that the shared value of is the obfuscated share

[0200]

number

[0201] is the threshold t calculated by the public computation of SecM. C is the verification share. Therefore, o i is the threshold 2t C while

[0202]

number

[0203] is the threshold t C The shared values ​​o and

[0204]

number

[0205] are computed through the reconstruction gate in the private and public computations, respectively. Then, to complete the verification of the RG gate,

[0206]

number

[0207] By checking whether o and

[0208]

number

[0209] It is sufficient to compare with

[0210] 4.5.5 Circuit Verification We have explained in detail how the input gates (SSG and JSG gates) can be verified and how each individual reconstruction gate (RG) can be verified.

[0211] For readability, we recall that the obfuscated shares are of four different kinds, each computed by a public computation. JSG, SSG gates:

[0212]

number

[0213] , Addition gate:

[0214]

number

[0215] , · ScaM Gate:

[0216]

number

[0217] , where k is a constant, and SecM Gate:

[0218]

number

[0219] (also known as the "validation share"). This allows us to define how the execution of a metacircuit among a group of participants can be realized in a completely verifiable way: in particular, if verification of all input gates and all reconstruction gates is performed for the circuit, then the entire execution of the circuit can be considered as a verifiable execution.

[0220] To ensure that all of the reconstruction gates can be verified, a participant may perform a public computation on all gates in the circuit. This will ensure that all obfuscated shares required as inputs to the public computation of RG are

[0221]

number

[0222] is available so that verification of the RG can be performed.

[0223] 4.5.6 - Example Verification - XOR To clarify the verification protocol, we consider that this is an XOR circuit, XOR(x, y) = (x - y). 2 We show how this can be done for , recalling the schematic as presented in Section 4.3.2. We have three ETOM participants and C Assume a threshold of 1. We describe the computation steps of the XOR metacircuit from the perspective of each participant i = 1, 2, 3 as follows, giving the output of each gate. G1. SSG Gate: x i G2. SSG gate: y i G3. ScaM gate: c i = (-1)y i G4. Addition gate: d i = x i + c i G5. SecM Gate: e i = d i d i SRG: G6. JSG Gate: β i G7. Addition gate: f i = e i +β i G8. Reconstruction gate: f = e +β G9. ScaM gate: g i = (-1)β i G10. Addition gate: h i = f + g i G11. Reconstruction gate: h

[0224] The above metacircuit assumes an untrusted coordinator 101 that is not part of the computation and does not have access to the communications of the ETOM participants 102. Thus, the coordinator cannot infer any intermediate private values ​​from the participants' computations. When the coordinator is part of the computation or has access to the communications of the ETOM participants, the coordinator can compute the value of e. However, in this case, the SRG gate is unnecessary and can be removed to maintain the security of the scheme. The SRG gate is introduced for the coordinator that is not part of the computation, so that the coordinator can only infer the value of t C There is no need to interpolate more shares.

[0225] To introduce a verification of the above calculation, we will verify gates G1, G2, G6, G8, and G11. To see this more clearly, we can represent the calculation in a flow chart as given in Figure 7.

[0226] In Figure 7, we assume that we have a coordinator that delegates execution to a set of N = 3 participants, and that the circuit has a threshold t C = 1. The input values ​​x, y are polynomials of degree 1.

[0227]

number

[0228] ,

[0229]

number

[0230] shared by the coordinator using

[0231]

number

[0232] It is.

[0233] 5. Example Use Case – Age Verification In this section, we present a use case that allows age verification, i.e., a customer can prove to a merchant that he is at least 18 years old without revealing his age. This prevents sensitive customer data from being known to the merchant. This example shows how to implement a "less than" operator using a metacircuit. Being able to implement comparison operators in this way can lead to more complex circuits.

[0234] We rely on Damgard's implementation of a less-than operator that takes two integers a and b represented in bits and outputs whether a < b.

[0235]

number

[0236] and

[0237]

number

[0238] is the bit expansion of a and b represented in big endian format - a l , b l Let a be the most significant bit -. Then, the function to compare a and b is

[0239] [Table 1]

[0240] where:

[0241]

number

[0242] is the XOR operator, ∨ is the OR operator, and

[0243]

number

[0244] The function returns 1 if a < b and 0 if a ≥ b. For a and b representing human ages, it is sufficient to take l = 6, which allows representing values ​​up to 127. To adapt the above algorithm to age verification, we take b = 18, whose binary representation is

[0245]

number

[0246] The expression is

[0247]

number

[0248] Since is fixed, we optimize the LT function as follows: 1. We use the binary representation

[0249]

number

[0250] Simplify the allocation of array c based on c0← a0, c1← 1 - a1, c2← a2, c3← a3, c4← 1 - a4, c5← a5, c6← a6 2. We reuse array a, a1←1-a1, a4←1-a4 There is no need to allocate array c since we can just reallocate 3. Since only b1 and b4 are non-zero, x simplifies to x = e1 + e4. 4. Based on observation 3 above, it is sufficient to compute e1← d1- d2 and e4← d4- d5. 5. We:

[0251]

number

[0252] Note that, then, d i -d i+1 teeth, c i ∨d i+1 -d i+1 = d i+1 + c i -d i+1 c i -d i+1 = c i (1 - d i+1 ) where we have the identity α∨β=α+β-αβ Using the reallocation of observations 1 and 2, we found that e4 ← c4(1 - d5) = a4(1 - a5 ∨ a6), and e1← c1(1 - d2) = a1(1 - d5∨a4∨a3∨a2) get. 6. The least significant bit, a0, is unused and need not be filled in. 7. Instead of returning x, the function should return 1 - x = 1 - e1- e4, such that if a >= b, then it outputs 1, and otherwise it outputs 0.

[0253] Therefore, the age verification function reduces to:

[0254] [Table 2]

[0255] The function returns 1 if a >= 18, otherwise it returns 0. Before describing the metacircuit and the protocol, two examples are given that prove that the function age_verify behaves as expected.

[0256] Case a = 18 The binary representation of a is (0,1,0,0,1,0,0). Then a1 = a4 = 1 and a0 = a1 = a2 = a3 = a5 = a6 = 0. After execution of the first two lines of the function age_verify, we have a1 = a4 = 0.

[0257] As a result, immediately the third and fourth lines of the function give d5 = d2 = 0, and finally the fifth line returns the value 1, which means that a >= 18.

[0258] Case a = 15 The binary representation of a is (1,1,1,1,0,0,0). Then a0 = a1 = a2 = a3 = 1 and a4 = a5 = a6 = 0. After executing the first two lines, we have a1 = 0 and a4 = 1.

[0259] Furthermore, the third line gives d5 = 0, and the fourth line gives d2 = 1. Then, the fifth line gives 1 - (a1(1 - d2) + a4(1 - d5)) = 1 - (0 + 1·1) = 0 It is evaluated as follows.

[0260] Therefore, we correctly evaluated a < 18, because the function returns the value 0.

[0261] 5.1 Meta-circuit representation Using the arithmetic representation of the OR operators, the corresponding metacircuit is constructed as shown in Figure 8. Replacing each OR operator with its circuit representation, Figure 9 represents the complete metacircuit for the function age_verify. We now describe in detail the steps that the customer and the ETOM party take to prove to the merchant that the customer is at least 18 years old. In this situation, the customer is the coordinator 101. The steps of the protocol are as follows: 1. A customer expresses his / her age value a in binary.

[0262]

number

[0263] and a0 can be discarded. 2. The SSG protocol is run for each a1,...,a6, and shares are distributed to the ETOM participants. 3. All ETOM participants use the inputs given by their shares to calculate the threshold t C Execute the metacircuit. 4. To know whether a customer is over 18 years old, i.e., whether a ≥ 18, the merchant must provide at least t C + Interpolating metacircuit output from one ETOM participant.

[0264] Note that we do not perform the SRG gate computation after each SecM gate, which can be expensive. To optimize, we delay the SRG gate computation, which results in only one redistribution and threshold reduction.

[0265] 5.2 Hardware Parallelization This section briefly describes how we may achieve hardware parallelism such that ETOM participants can rapidly process the age_verify function for their shares. For this, we require participants to use FPGA boards. We assume for the purpose of explanation that addition and multiplication are atomic operations and are not elaborated at the hardware level. Furthermore, we expand each ∨ operation to an addition and a multiplication. Thus, the age_verify introduced in the above section has to perform 25 sequential operations, which computes 6 SecM gates. This number can be calculated by counting the non-SRG gates in Figure 9 and expanding the ∨ circuits in the representation of those circuits as shown in Figure 8. An FPGA board has several computational units that can be used to perform different tasks simultaneously. We call each computational unit a CU. i Label by i = 1, ..., N CUwhere N CU is the number of units available on the board. Using this architecture, our proposed implementation is: 1. In parallel, CU1 calculates m1 = -a1, CU2 calculates m2 = -a4, CU3 calculates m3 = a3 + a2, CU4 calculates m4 = a3a2, CU5 calculates m5 = a6 + a5, CU6 calculates m6 = a6a5. 2. In parallel, CU1 is m7 = 1 + m1 Calculate = a1 ← 1 - a1, CU2 is m8 = 1 + m2 Calculate = a4 ← 1 - a4, CU4 is m9 = -m4 Calculate = -a3a2, CU6 is m 10 = -m6 Calculate = -a6a5. 3. In parallel, CU1 is m 11 Calculate = -m7= -a1, CU2 is m 12 Calculate = -m8= -a4, CU3 is m 13 = m3+ m9 Calculate = a3+ a2- a3a2= a3∨a2, CU5 is m 14 = m5+ m 10 Calculate = a6+ a5- a6a5= a6∨a5= d5. 4. In parallel, CU2 is m 15 = m8+ m 14 Calculate = a4 + a6 ∨ a5, CU3 is m 22 = -m 13 Calculate = -a3 ∨ a2, CU5 is m16 = m8m 14 Calculate = a4d5, CU6 is m 17 = m 12 m 14 Calculate a4(a6 ∨ a5). 5. In parallel, CU2 is m 18 = m 15 + m 17 Calculate = a4+ a6∨a5- a4(a6∨a5) = a4∨a5∨a6, CU5 is m 19 = m 12 + m 16 Calculate = -a4+ a4d5= -a4(1 - d5). 6. In parallel, CU3 is m 20 = m 13 + m 18 Calculate = a3 ∨ a2 + a4 ∨ a5 ∨ a6, CU2 is m 21 = m 22 m 18 Calculate a3 ∨ a2)(a4 ∨ a5 ∨ a6). 7. CU3 is m 23 = m 20 + m 21 = a3∨a2+ a4∨a5∨a6- (a3∨a2)(a4∨a5∨a6) Calculate = a2∨a3∨a4∨a5∨a6= d2. 8. CU3 is m 25 = m7m 23 Calculate a1d2 = a1d2. 9. In parallel, CU3 is m 26 = m 11 + m 25 Calculate = -a1+ a1d2= -a1(1 - d2), CU5 is m 27 = 1 + m19 Calculate = 1 - a4(1 - d5). 10. CU3 is m 28 = m 26 + m 27 Calculate a1(1 - d2) + a4(1 - d5) = 1 - (a1(1 - d2) + a4(1 - d5)).

[0266] The algorithm reduces the process from 25 sequential calculations to 10 sequential calculations. In addition to reducing the number of sequential steps by 60%, this technique can have a large practical impact: while SecM multiplication gates need to be introduced to raise the threshold and SRG gates to lower the threshold, additions and scalar multiplications do not incur any computational overhead. The parallelized solution reduces the number of sequential multiplications (SecM gates) from six to only four (steps 1, 4, 6, and 8).

[0267] Note that the hardware fingerprint (measured by the number of compute units used) is low, with only 6 compute units required at its highest load (step 1).

[0268] Further optimizations can be performed, i.e., by computing a1d2 more finely, the circuit can be run in nine sequential steps, which increases the number of sequential multiplications. This can be done if there are a sufficient number of participants such that we do not need to add many SRG gates to lower the threshold.

[0269] 6. Further Special Notes Other variations or use cases of the disclosed technology will be apparent to one of ordinary skill in the art given the disclosure herein. The scope of the present disclosure is not limited by the described embodiments, but only by the claims that follow.

[0270] It will be appreciated that the above embodiments have been described by way of example only. More broadly, there may be provided a method, apparatus or program according to any one or more of the following statements:

[0271] Statement 1. 1. A computer-implemented method for executing a multi-party computation (MPC) protocol, the group including a coordinator and a plurality of participants, the method being performed by the coordinator; obtaining a circuit representation of a computable function to be evaluated based on one or more first inputs to generate one or more outputs, where each first input should be either specified or randomly generated, the circuit representation including: a) a plurality of arithmetic gates representing respective functions for operating on one or more of the first inputs and / or one or more second inputs, the second inputs being respective outputs of the respective gates; and b) a plurality of directed edges, each directed edge representing that the first input or the second input is provided to the respective arithmetic gate for operation by the respective arithmetic gate; A circuit representation of a function into a multi-party representation of the function, replacing each designated first input with a respective first split gate (SSG), where each respective SSG represents a protocol executed by the coordinator to distribute a respective share of a respective secret to each respective party, where each secret is associated with a respective threshold; transforming by replacing each randomly generated first input with a respective second split gate (JSG), where each respective JSG gate represents a protocol executed by each party to collaboratively generate a respective share of a respective secret, where each secret is associated with a respective threshold; making the multi-party representation available to each party, where each party is configured to evaluate the function by executing the multi-party representation based on each party's respective share of a respective secret, thereby generating a respective share of each output; implementing each SSG by distributing a respective share of a respective secret to each respective party; obtaining respective shares of each output from at least a threshold number of participants, the threshold number corresponding to a threshold number of circuits associated with the multi-party circuit; generating each output of the function, each output being generated based on a respective output share of at least a threshold number of that output.

[0272] Statement 2. 13. The method of claim 1, wherein the multi-party circuit representation includes, for each output to be generated, a respective reconstruction gate (RG), and each respective RG gate represents a protocol executed by the coordinator to generate a respective output by interpolating the respective output shares input to the respective RG.

[0273] Statement 3. The circuit representation includes one or more inverse gates representing a function configured to output a respective inverse of a respective non-scalar input, and the converting step includes: The method of statement 1 or statement 2, including replacing each of the one or more inverse gates with a respective share inverse gate (IVG), each respective IVG representing a protocol executed by each party to cooperatively generate a respective inverse share for each share input to the IVG.

[0274] Statement 4.

[0023] The circuit representation may include one or more share multiplication (SecM) gates, each respective SecM gate representing a function configured to multiply two respective shares input to the SecM gate and output the result of the multiplication to a respective next gate in the multi-party circuit representation, and the converting step may include: The method of any preceding statement includes inserting a respective share redistribution gate (SRG) between each respective SecM gate and each subsequent gate, where each respective SRG represents a protocol executed by each party to cooperatively generate a new respective share of a respective shared value input to the respective SRG, where the new respective share is associated with a threshold value of the circuit while the respective shared value is associated with a higher threshold value.

[0275] Statement 5.

[0023] The circuit representation may include one or more share multiplication (SecM) gates, each respective SecM gate representing a function configured to multiply two respective shares input to the SecM gate and output the result of the multiplication to a respective next gate in the multi-party circuit representation, and the converting step may include: inserting a respective share redistribution gate (SRG) between each SecM gate and each previous gate if the respective share input to the respective SecM gate has a higher threshold than the respective secret threshold, where each respective SRG represents a protocol executed by each party to cooperatively generate a new respective share of the respective shared value input to the respective SRG, the new respective share being associated with the circuit's threshold while the respective shared value is associated with the higher threshold; and inserting a respective SRG before each respective RG gate for each output generated.

[0276] Statement 6. Multi-party circuits are subject to a maximum threshold of 2t C ≦t max < N, where N is the number of participants in the group, and t C are respective secret thresholds, the circuit representation includes one or more share multiplication (SecM) gates, where each respective SecM gate represents a function configured to multiply two respective shares input to the SecM gate and output the result of the multiplication to a respective next gate in the multi-party circuit representation, and said converting step represents Each share input to each IVG is a threshold t > t max -t C inserting a respective share redistribution gate (SRG) between each respective IVG gate and each respective previous gate, where each respective SRG represents a protocol executed by each participant to cooperatively generate a new respective share of a respective shared value input to the respective SRG, where the new respective share is associated with a threshold value of the circuit while the respective shared value is associated with a higher threshold value; The expected output threshold of each share output by each SecM gate is t max inserting an SRG between one or both of the respective shares input to each SecM gate and each SecM gate if the respective shares are higher than and inserting a respective SRG before each respective RG gate for each output generated.

[0277] Statement 7. The method of any preceding statement, wherein the protocol executed by the coordinator to distribute each share of each secret to each respective party includes Shamir's Secret Sharing Scheme (SSSS).

[0278] Statement 8. The method of any preceding statement, wherein the protocol executed by each party to cooperatively generate their respective shares of their respective secrets includes a Joint Random Secret Sharing Scheme (JRSS) or a Joint Verifiable Random Secret Sharing Scheme (JVRSS).

[0279] Statement 9. The method of any preceding statement, wherein the step of obtaining a circuit representation of the function includes generating a circuit representation.

[0280] Statement 10. The method of any preceding statement comprising, for each respective secret generated by the coordinator, sending obfuscated coefficients of the corresponding respective polynomial to each party for verifying the respective secret.

[0281] Statement 11. The method of any preceding statement wherein the computable function is an ECDSA signature generation function. The signature generation function may be ECDSA.

[0282] Statement 12. The method of any preceding statement wherein the computable function is an age verification function.

[0283] Statement 13. Any of the preceding statements wherein the coordinator is one of the participants.

[0284] Statement 14. 1. A computer-implemented method executing a multi-party computation (MPC) protocol, the group including a coordinator and a plurality of participants, the method being executed by a first of the participants; obtaining a multi-party circuit representation of the transformed function from a circuit representation of the computable function, the function to be evaluated based on one or more first inputs to generate one or more outputs, each first input to be either specified or randomly generated, the circuit representation including: a) a plurality of arithmetic gates representing respective functions for operating on one or more of the first inputs and / or one or more second inputs, the second input being a respective output of the respective gate; and b) a plurality of directed edges, each directed edge representing that the first input or the second input is provided to its respective arithmetic gate for operation by the respective arithmetic gate; replacing each designated first input with a respective first split gate (SSG), where each respective SSG represents a protocol executed by a coordinator to distribute a respective share of a respective secret to each respective party, where each secret is associated with a respective threshold; and replacing each randomly generated first input with a respective second split gate (JSG), where each respective JSG gate represents a protocol executed by each party to collaboratively generate a respective share of a respective secret, where each secret is associated with a respective threshold; evaluating a function by executing the multi-party circuit representation based on the first respective share of each respective secret to generate a first respective share of each output; sending a first respective share of each output to a coordinator, the coordinator configured to obtain respective shares of each output from at least a threshold number of participants, the threshold number corresponding to a threshold of the circuit, the coordinator configured to generate each output of the function, each output being generated based on a respective output share of at least the threshold number of that output.

[0285] Statement 15. 15. The method of statement 14, wherein the protocol executed by each party to cooperatively generate their respective shares of their respective secrets includes a Joint Random Secret Sharing Scheme (JRSS) or a Joint Verifiable Secret Sharing Scheme (JVRSS), and the method includes using JRSS or JVRSS to generate one or more first respective shares of the respective secrets.

[0286] Statement 16. 16. The method of statement 14 or statement 15, wherein the protocol executed by the coordinator to distribute the respective shares of the respective secrets to each respective party includes a Shamir Secret Sharing Scheme (SSSS), and the method includes receiving one or more first respective shares of the respective secrets generated using the SSSS.

[0287] Statement 17. receiving, for each respective secret generated by the coordinator, obfuscated coefficients of a corresponding respective polynomial from the coordinator; 17. The method of any of statements 14 to 16, comprising: verifying each secret based on the obfuscated coefficients.

[0288] Statement 18. With respect to each of the other parties: receiving a respective obfuscated share of a respective secret and executing a multi-party circuit representation based on the respective obfuscated share of the respective secret to generate a respective obfuscated share of each output; receiving an obfuscated share of each candidate for each output; and verifying that each candidate obfuscated share for each output corresponds to a respective generated obfuscated share for that output.

[0289] Statement 19. 19. The method of any of statements 14 to 18, wherein the obtaining of the multi-party circuit representation includes receiving the multi-party circuit representation from a coordinator.

[0290] Statement 20. 19. The method of any of statements 14 to 18, wherein the obtaining of a multi-party circuit representation includes generating a multi-party circuit representation.

[0291] Statement 21. Any of statements 14 to 20 in which the coordinator is one of the participants.

[0292] Statement 22. a memory including one or more memory units; a processing device including one or more processing units, wherein the memory stores code arranged to be executed on the processing device, the code being configured, when on the processing device, to perform the method of any of statements 1 to 21.

[0293] Statement 23. A computer program embodied on a computer readable storage and configured to perform the method of any of statements 1 to 21 when executed on one or more processors.

[0294] According to another aspect disclosed herein, a method may be provided that includes the actions of a coordinator and multiple participants.

[0295] According to another aspect disclosed herein, a system may be provided that includes computer devices of a coordinator and a plurality of participants. [Explanation of symbols]

[0296] 100 Exemplary System 101 Coordinator (or Adjuster) 102 Stakeholder (or participant), peer 102a Person concerned, Person concerned A 102b Person in Charge, Person in Charge B 102c Related Party, Related Party C

Claims

1. 1. A computer-implemented method for executing a multi-party computation (MPC) protocol, the group including a coordinator and a number of participants, the method being performed by the coordinator; obtaining a circuit representation of a computable function to be evaluated based on one or more first inputs to generate one or more outputs, each first input being either specified or randomly generated, said circuit representation including: a) a plurality of arithmetic gates representing respective functions for operating on one or more of the first inputs and / or one or more second inputs, the second inputs being respective outputs of the respective gates; and b) a plurality of directed edges, each directed edge representing that the first input or the second input is provided to the respective arithmetic gate for operation by the respective arithmetic gate; the circuit representation of the function into a multi-party representation of the function; replacing each designated first input with a respective first split gate (SSG), each respective SSG representing a protocol executed by the coordinator to distribute a respective share of a respective secret to each respective party, the respective secret being associated with a respective threshold; transforming by replacing each randomly generated first input with a respective second split gate (JSG), where each respective JSG gate represents a protocol executed by each party to collaboratively generate a respective share of a respective secret, said respective secret being associated with a respective threshold; making the multi-party representation available to each party, each party being configured to evaluate the function by executing the multi-party representation based on each party's respective share of the respective secret, thereby generating a respective share of each output; executing each SSG by distributing said respective shares of said respective secrets to each respective party; obtaining respective shares of each output from at least a threshold number of participants, said threshold number corresponding to a threshold number of circuits associated with the multi-party circuit; generating respective outputs of the function, each output being generated based on the respective output shares of at least the threshold number of the outputs.

2. 2. The method of claim 1, wherein the multi-party circuit representation includes, for each output to be generated, a respective reconstruction gate (RG), each respective RG gate representing a protocol executed by the coordinator to generate a respective output by interpolating the respective output shares input to the respective RG.

3. the circuit representation includes one or more inverse gates representing a function configured to output a respective inverse of a respective non-scalar input, and the converting step comprises:

2. The method of claim 1, comprising replacing each of the one or more inverse gates with a respective share inverse gate (IVG), each respective IVG representing a protocol executed by respective parties to cooperatively generate a respective inverse share for each share input into the IVG.

4. the circuit representation includes one or more share multiplication (SecM) gates, each respective SecM gate representing a function configured to multiply two respective shares input to the SecM gate and output the result of the multiplication to a respective next gate in the multi-party circuit representation, and the converting step comprises:

2. The method of claim 1, comprising inserting a respective share redistribution gate (SRG) between each respective SecM gate and the respective next gate, where each respective SRG represents a protocol executed by each party to cooperatively generate a new respective share of a respective shared value input to the respective SRG, the new respective share being associated with a threshold of the circuit while the respective shared value is associated with a higher threshold.

5. the circuit representation includes one or more share multiplication (SecM) gates, each respective SecM gate representing a function configured to multiply two respective shares input to the SecM gate and output the result of the multiplication to a respective next gate in the multi-party circuit representation, and the converting step comprises: if the respective share input to the respective SecM gate has a higher threshold than the threshold of the respective secret, inserting a respective share redistribution gate (SRG) between the respective SecM gate and a respective previous gate, where each respective SRG represents a protocol executed by each party to cooperatively generate a new respective share of the respective shared value input to the respective SRG, the new respective share being associated with the threshold of the circuit while the respective shared value is associated with the higher threshold; and inserting a respective SRG before each respective RG gate for each output generated.

6. The circuit representation includes one or more inverse gates representing a function configured to output a respective inverse of a respective non-scalar input, and the converting step includes replacing each of the one or more inverse gates with a respective share inverse gate (IVG), each respective IVG representing a protocol executed by each party to cooperatively generate a respective inverse share of a respective share input to the IVG, and the multi-party circuit is configured to convert the one or more inverse gates into a respective inverse share over a maximum threshold 2t C ≦t max < N, where N is the number of participants in the group, and t C is the threshold value of the respective secrets, the circuit representation includes one or more share multiplication (SecM) gates, where each respective SecM gate represents a function configured to multiply two respective shares input to the SecM gate and output the result of the multiplication to a respective next gate in the multi-party circuit representation, and the converting step comprises: The respective shares input to the respective IVGs are equal to or smaller than a threshold t > t max -t C inserting a respective Share Redistribution Gate (SRG) between each respective IVG gate and each previous gate, where each respective SRG represents a protocol executed by each participant to cooperatively generate a new respective share of a respective shared value input to said respective SRG, said new respective share being associated with a threshold value of said circuit, while said respective shared value being associated with a higher threshold value; The expected output threshold of each share output by each SecM gate is t max if the SecM gate is greater than 0, inserting an SRG between one or both of the respective shares input to the SecM gate and the respective SecM gate; and inserting a respective SRG before each respective RG gate for each output generated.

7. 2. The method of claim 1, wherein the protocol executed by the coordinator to distribute respective shares of the respective secrets to each respective party comprises Shamir's Secret Sharing Scheme (SSSS).

8. 2. The method of claim 1, wherein the protocol executed by each party to cooperatively generate their respective shares of their respective secrets comprises a Joint Random Secret Sharing Scheme (JRSS) or a Joint Verifiable Random Secret Sharing Scheme (JVRSS).

9. The method of claim 1 , wherein obtaining the circuit representation of the function comprises generating the circuit representation.

10. 2. The method of claim 1, comprising, for each respective secret generated by the coordinator, sending obfuscated coefficients of a corresponding respective polynomial to each party for verifying the respective secret.

11. The method of claim 1 , wherein the computable function is an ECSDA signature generation function.

12. The method of claim 1 , wherein the computable function is an age verification function.

13. The method of claim 1 , wherein the coordinator is one of the participants.

14. 1. A computer-implemented method executing a multi-party computation (MPC) protocol, the group including a coordinator and a plurality of participants, the method being performed by a first one of the participants; obtaining a multi-party circuit representation of a computable function transformed from a circuit representation of the function, the function being evaluated based on one or more first inputs to generate one or more outputs, each first input being to be either specified or randomly generated, the circuit representation comprising: a) a plurality of arithmetic gates representing respective functions for operating on one or more of the first inputs and / or one or more second inputs, the second inputs being respective outputs of the respective gates; and b) a plurality of directed edges, each directed edge representing that the first input or the second input is provided to the respective arithmetic gate for operation by the respective arithmetic gate; replacing each designated first input with a respective first split gate (SSG), each respective SSG representing a protocol executed by the coordinator to distribute a respective share of a respective secret to each respective party, the respective secret being associated with a respective threshold; and replacing each randomly generated first input with a respective second split gate (JSG), where each respective JSG gate represents a protocol executed by each party to collaboratively generate a respective share of a respective secret, said respective secret being associated with a respective threshold; evaluating the function by executing the multi-party circuit representation based on a first respective share of each respective secret to generate a first respective share of each output; sending the first respective share of each output to the coordinator, the coordinator configured to obtain respective shares of each output from at least a threshold number of participants, the threshold number corresponding to a circuit threshold, and the coordinator configured to generate each output of the function, each output being generated based on the respective output shares of at least the threshold number of outputs.

15. 15. The method of claim 14, wherein the protocol performed by each party to cooperatively generate their respective shares of the respective secrets comprises a Joint Random Secret Sharing Scheme (JRSS) or a Joint Verifiable Secret Sharing Scheme (JVRSS), the method comprising using JRSS or JVRSS to generate one or more first respective shares of the respective secrets.

16. 15. The method of claim 14, wherein the protocol executed by the coordinator to distribute respective shares of the respective secrets to each respective party includes a Shamir's Secret Sharing Scheme (SSSS), the method including receiving one or more first respective shares of the respective secrets generated using SSSS.

17. receiving, for each respective secret generated by the coordinator, obfuscated coefficients of a corresponding respective polynomial from the coordinator; and verifying the respective secrets based on the obfuscated coefficients.

18. With respect to each of the other parties: receiving a respective obfuscated share of the respective secret and executing the multi-party circuit representation based on the respective obfuscated share of the respective secret to generate a respective obfuscated share of each output; receiving an obfuscated share of each candidate for each output; and verifying that the respective candidate obfuscated share of each output corresponds to the generated respective obfuscated share of the output.

19. 1. A computer program embodied on a computer readable storage and configured to, when executed on one or more processors of a coordinator of a group including a coordinator and a plurality of participants, perform a method for executing a multi-party computation (MPC) protocol, the method comprising: obtaining a circuit representation of a computable function to be evaluated based on one or more first inputs to generate one or more outputs, each first input being either specified or randomly generated, said circuit representation including: a) a plurality of arithmetic gates representing respective functions for operating on one or more of the first inputs and / or one or more second inputs, the second inputs being respective outputs of the respective gates; and b) a plurality of directed edges, each directed edge representing that the first input or the second input is provided to the respective arithmetic gate for operation by the respective arithmetic gate; the circuit representation of the function into a multi-party representation of the function; replacing each designated first input with a respective first split gate (SSG), each respective SSG representing a protocol executed by the coordinator to distribute a respective share of a respective secret to each respective party, the respective secret being associated with a respective threshold; transforming by replacing each randomly generated first input with a respective second split gate (JSG), where each respective JSG gate represents a protocol executed by each party to collaboratively generate a respective share of a respective secret, said respective secret being associated with a respective threshold; making the multi-party representation available to each party, each party being configured to evaluate the function by executing the multi-party representation based on each party's respective share of the respective secret, thereby generating a respective share of each output; executing each SSG by distributing said respective shares of said respective secrets to each respective party; obtaining respective shares of each output from at least a threshold number of participants, said threshold number corresponding to a threshold number of circuits associated with the multi-party circuit; generating respective outputs of the function, each output being generated based on the respective output shares of at least the threshold number of the outputs.

20. 1. A computer program embodied on a computer readable storage and configured to perform, when executed on one or more processors of a first participant of a group including a coordinator and a plurality of participants, a method for executing a multi-party computation (MPC) protocol, the method comprising: obtaining a multi-party circuit representation of a computable function transformed from a circuit representation of the function, the function being evaluated based on one or more first inputs to generate one or more outputs, each first input being to be either specified or randomly generated, the circuit representation comprising: a) a plurality of arithmetic gates representing respective functions for operating on one or more of the first inputs and / or one or more second inputs, the second inputs being respective outputs of the respective gates; and b) a plurality of directed edges, each directed edge representing that the first input or the second input is provided to the respective arithmetic gate for operation by the respective arithmetic gate; replacing each designated first input with a respective first split gate (SSG), each respective SSG representing a protocol executed by the coordinator to distribute a respective share of a respective secret to each respective party, the respective secret being associated with a respective threshold; and replacing each randomly generated first input with a respective second split gate (JSG), where each respective JSG gate represents a protocol executed by each party to collaboratively generate a respective share of a respective secret, said respective secret being associated with a respective threshold; evaluating the function by executing the multi-party circuit representation based on a first respective share of each respective secret to generate a first respective share of each output; sending the first respective shares of each output to the coordinator, the coordinator configured to obtain respective shares of each output from at least a threshold number of participants, the threshold number corresponding to a circuit threshold; and the coordinator configured to generate each output of the function, each output being generated based on the respective output shares of at least the threshold number of outputs.

Images