Privacy-preserving computation of a remainder

Abstract

The invention relates to a cryptographic system (010) for performing a privacy-preserving computation on secret data using a cryptographic secure multi-party computation between multiple cryptographic devices. A first cryptographic device computes a first remainder of a division based on a first additive secret-share of a secret input value, and based on a divisor; and inputs the first remainder to the multi-party computation. A second cryptographic device computes a second remainder of a division based on a second additive secret-share of the secret input value and based on the divisor; and inputs the second remainder to the multi-party computation. The cryptographic devices compute a resulting remainder of dividing the secret input value by the divisor based on the representations of the first and second remainder.

Description

[0001] PRIVACY-PRESERVING COMPUTATION OF A REMAINDER

[0002] FIELD OF THE INVENTION

[0003] The invention relates to a cryptographic system for performing a privacypreserving computation on secret data. The invention further relates to a cryptographic device for use in such a system; to a corresponding computer-implemented method; and to a computer-readable medium.

[0004] BACKGROUND OF THE INVENTION

[0005] There is a growing demand for privacy enhancing technologies (PETs), i.e., data processing techniques that intrinsically protect the privacy of the data they operate on. For example, with the cryptographic technique of secure multi-party computation (MPC), multiple parties can perform a computation on their joint input using a distributed cryptographic protocol, such that each party learns nothing beyond the output of computation and his own (private) input.

[0006] One reason for the growing demand for PETs is that citizens are becoming increasingly dependent on the digital information stored about them by various companies and institutions. Because of this increasing dependence, the consequences of a breach of personal data are getting increasingly severe. And due to the worldwide surge of cybercrime and nation-state-sponsored cyber espionage, the risk of a data breach has increased sharply in recent years. Also, data-based collaborations between separate entities (like companies, hospitals, local governments) usually implies that personal data is copied between the entities, which poses the risk of uncontrolled spreading of data, in particular personal information. PETs can enable data collaboration between entities without the need for sharing the data in clear-text form. Another factor driving demand for PETs is the emergence of legal frameworks for data protection, such as the European GDPR and the Californian CCPA legislation, and their mandatory compliance. In the context of such frameworks, PETs are valuable as technical safeguards, and typically provide concrete instantiations of abstract legal notions.

[0007] In particular, one technique to perform a privacy-preserving computation on secret data is cryptographic secure multi-party computation (MPC). MPC is a cryptographic technique in which a computation is performed in a distributed way between multiple cryptographic devices in such a way that the inputs, intermediate values, and / or outputs of the computation remain hidden from the parties performing the computation. Such values that remain hidden from the parties may be referred to as the secret values of the MPC. In general, a secret value of the MPC may have the property that a limited number of parties, up to a given threshold, does not know the secret value. However, a number of parties that exceeds the threshold may be able to derive the secret value.

[0008] An important class of MPC protocols rely in the use of secret sharing, also referred to herein simply as "sharing". A sharing may be defined as a distributed representation of a value into shares of the respective parties such that a limited number of the shares, up to the given threshold, does not allow to derive the represented value. In particular, in arithmetic secret sharing, the values being shared can be numbers modulo a certain modulus. In multi-party computation, through the use of secret values and of various protocols that allow to perform operations on secret values, various computations can be performed, while keeping the underlying values hidden from the parties that perform them, thus providing privacy-preserving computation. In particular, in the setting of arithmetic secret sharing, elementary operations that are supported typically include input, output, addition, and multiplication. Various cryptographic protocols are known in the literature that perform other operations, such as comparison and floor division, in terms of these elementary operations.

[0009] In particular, S. de Hoogh, "Design of large scale applications of secure multiparty computation: secure linear programming", PhD thesis at Eindhoven University of Technology (2012), discloses a cryptographic protocol DivNR to perform a division of one number by another number under multi-party computation using Newton-Raphson iteration. This same reference also discloses a cryptographic protocol ConvertUnary to convert a number to a standard unit vector having a one at the location indicated by the number under multi-party computation using polynomial evaluation. Both multi-party computation protocols implement these functionalities on top of the elementary operations of inputting, outputting, adding, and multiplying secret-shared values. These operations find application in various higher-level applications, e.g., cryptographic techniques for privacy-preserving data analysis.

[0010] SUMMARY OF THE INVENTION

[0011] It would be desirable to provide cryptographic multi-party computation protocols for performing operations that involve the computation of a remainder, that have improved efficiency, e.g., in terms of computation, communication, and / or round complexity.

[0012] In accordance with a first aspect of the invention, a cryptographic system for performing a privacy-preserving computation is provided, as defined by claim 1. In accordance with further aspects of the invention, a cryptographic device for use in such a system; and a cryptographic method of performing such a privacy-preserving computation are provided, as defined by claims 16 and 17, respectively. In accordance with an aspect of the invention, a computer-readable medium is provided, as defined by claim 18.

[0013] Various embodiments relate to the computation, under multi-party computation, of a remainder of dividing a secret input value by a divisor. The computation may be performed in such a way that the input value and the computed representation of the remainder remain hidden to the cryptographic devices that perform the computation. The divisor may be known to the cryptographic devices. When the remainder is represented as a number, the computation of the remainder may correspond to a modulo computation, and the result can for example be used to perform a floor division of the secret input by the divisor. When the remainder is represented as a unit vector, the techniques provide an especially efficient way of converting the input value to a unit vector, which is useful even if it is already known that the input value is smaller than the divisor.

[0014] Whichever way the remainder is represented, e.g., as a number or as a unit vector, the following mathematical observation may be used when computing it. This observation is also discussed in more detail elsewhere. Suppose the secret input is additively secret-shared among two of the cryptographic devices. If the secret input is additively secret-shared over the integers, e.g., the first device holds a first share and the second device holds a second share, and the two shares add up to or subtract to the secret input over the integers, then computing the remainder of the division of the first share by the divisor, computing the remainder of the division of the second share by the divisor, and adding up the results, almost results in the desired remainder: namely, it is equal to the desired remainder, or to the desired remainder plus the divisor. A similar observation holds if the secret input is additively secret shared, but now modulo a certain modulus. If the input is relatively small compared to the modulus (e.g., the modulus may be bigger than the secret value by a factor at least 2A10, at least 2A20, or at least 2A30), then with high probability, the addition of the respective secret shares wraps around the modulus. This means that the remainder of dividing the input value by the divisor can be computed by computing a remainder of dividing the first additive secret share plus the second additive secret share minus the modulus, by the divisor; and this computation can also be performed in terms of computing the remainder of the division of the first share by the modulus and the remainder of the division of the second share by the modulus, compensating for the wraparound.

[0015] As the inventors realized, this mathematical observation can be used to obtain an efficient cryptographic multi-party computation protocol to compute the remainder. Namely, the cryptographic device that holds the first additive secret share, can divide this first share by the divisor to obtain a first remainder. Similarly, the second cryptographic device that holds the second additive share, can divide this second share by the divisor to obtain a second remainder. Because these computations are computations on the shares themselves, as opposed to the values that are being secret-shared, these computations can be performed locally and efficiently by the cryptographic devices themselves, without having to resort to multi-party computation Newton-Raphson iterations, or the like.

[0016] The first and second cryptographic devices can then provide representations of the computed remainders (e.g., as numbers, or as unit vectors), as secret inputs to the multi-party computation, e.g., using secret-sharing. Interestingly, due to the mathematical observation above, using these representations, the remainder of dividing the secret input value by the divisor can be computed, based on the representations of the first and second remainder, as a remainder of dividing the first additive secret-share plus the second additive secret-share, minus the modulus if applicable, by the divisor. Thus, by computing the remainders of the secret shares, the computation of the remainder of a potentially large secret input may essentially be reduced to the computation of a remainder of the sum of two already modulo-reduced secret representations, possibly to be corrected based on a nonsecret modulus. This computation can be implemented cryptographically relatively efficiently, e.g., without needing to resort to Newton-Raphson iterations and the like, providing an overall efficient cryptographic protocol for computing the remainder.

[0017] In particular, in the case of an additive secret sharing modulo a modulus, one particularly efficient way to correct for the modulus, is for the first and and / or second cryptographic device to subtract the modulus from the first additive secret-share plus the second additive secret share, prior to computing the remainders. For example, the first cryptographic device may compute the remainder of the first additive secret share divided by the divisor, and the second cryptographic device may compute the remainder of dividing the second additive secret share minus the modulus by the divisor. This way, the resulting remainder may be computed from the representations of the first and second remainders, without needing to correct for the modulus at that point. However, it is also possible to correct for the modulus at this point instead of in the first and second remainders. For example, in the case of vector representation, such a correction may correspond to a cyclic shift of a vector representation by a known number of positions.

[0018] For example, when the representations are numbers, and correction for the modulus has been performed in the first and second remainders if applicable, the resulting remainder may be computed by checking, under the multi-party computation, whether the sum of the first and second remainder is greater than or equal to the divisor, and if so, subtracting the divisor from this sum. When the representations are vectors, the computation of the resulting remainder may be performed by a matrix-vector multiplication, which may essentially both add the first and second remainders, and modulo reduce the result modulo the divisor. This technique is not just interesting in the case where the secret input may be larger than the divisor, but is even useful in case it is already known that the secret input is smaller than the divisor, since also in this case it provides an especially efficient way to obtain a vector representation.

[0019] Optionally, the representations of the first remainder, the second remainder, and the resulting remainder are numeric representations, e.g., representing the respective remainders as respective integers or fixed-point numbers. For example, a respective remainder may be represented as a single secret-share of the multi-party computation. In this case, the cryptographic devices may perform a secure comparison of the sum of the first remainder and the second remainder with the divisor to obtain a secret comparison output, and may compute the resulting remainder from the sum and the secret comparison output.

[0020] This way, a particularly efficient way of computing the resulting remainder can be obtained. Namely, because the sum may be smaller than twice the divisor, the resulting remainder may be obtained by subtracting the divisor zero or one times from the sum. This operation can be implemented relatively efficiently based on known techniques, in particular, using known cryptographic protocols for integer comparison under multi-party computation. This is unlike the secret input itself, which can be larger than twice the divisor. Thus, by computing the remainders using additive secret sharing as described herein, computing the remainder for the secret input may be reduced to an efficient computation of the remainder of the sum of the first and second remainders.

[0021] Optionally, in addition to the numeric representations, the cryptographic devices may be configured to provide a binary representation of the first and / or second remainder as secret inputs to the multi-party computation. Respective bits of the base 2 representation of the number, e.g., (1, 1, 0, 1) for the number 13, may be input. (This is unlike the vector representation as described herein, which may for the same number 13 for example may be (1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0).) The secure comparison may be performed based on the binary representation. By inputting the bits directly, it may be avoided to perform a bit decomposition and / or generate random masking bits as part of the secure comparison, making the secure comparison more efficient to implement. It is particularly efficient to perform the secure computation based on bits being input as values from a domain, e.g., a ring or a field, that has a small number of elements, e.g., at most 256 or at most 4; for example, the field Z2 or the field GF(4) can be used.

[0022] Optionally, the cryptographic devices may use the resulting remainder to perform a division under the multi-party computation of the secret input by the divisor. Namely, the cryptographic devices may, under the multi-party computation, correct the input value according to the resulting remainder, and multiply the corrected input value with an inverse of the divisor. By correcting the input value according to the resulting remainder, e.g., by subtracting the remainder from the input value, a value may be obtained that is properly divided by the divisor, e.g., which is zero modulo the divisor. In such a case, the multiplication of the corrected input value by the divisor may accurately represent the outcome of dividing the secret input by the divisor, e.g., according to a floor division. This is unlike the situation when the value is not properly divided by the divisor: in this case, in the mathematical structures that multi-party computation is typically defined over, multiplication by the inverse of the divisor does not correspond to a numeric division, e.g., integer division.

[0023] Optionally, the representations of the first remainder, the second remainder, and the resulting remainder are vector representations. A vector representation of a number may be a vector of elements, e.g., a vector of secret-shares, of length equal to the divisor. The vector representation may have a non-zero entry at a location indicated by the represented value. For example, the vector representation may be a standard unit vector. For example, 0 may be represented by vector (1 , 0, ...); 1 by vector (0, 1 , 0, ...), etc. It is also possible to use different values than one. The vector representation may be input modulo the same modulus according to which the secret value was originally represented, but interestingly, this is not needed, e.g., the elements of the vector representations may be input as secret values from a small domain, e.g., of size at most 256 or at most 4 values, for example the field GF(4) or the field Z2.

[0024] Accordingly, the provided techniques may be used to compute, given a secret input value smaller than the divisor, a vector representation of that secret input value, e.g., a unit vector representation of that secret input value, under multi-party computation. This is an operation that is useful per se for multi-party computation. For example, the cryptographic devices may use the vector representation of the resulting remainder to access (e.g., read from or write to) an array at a secret location indicated by the input value, as also discussed in S. de Hoogh, "Design of large scale applications of secure multiparty computation: secure linear programming" (incorporated herein by reference inasfar as secret indexing is concerned).

[0025] Optionally, the cryptographic devices may compute the secret vector representation of the resulting remainder by computing a matrix-vector product based on the secret vector representations of the first and second remainder. One of the two vectors may be interpreted as a circular shift matrix for shifting the entries of the other vector by a number of positions corresponding to the represented value. By multiplying the circular shift matrix by the other vector, an addition of the represented values may be performed, which may interestingly directly represent the remainder of the sum when divided by the divisor, without having to perform an additional remainder computation step. Interestingly, especially when using multiplicative secret sharing such as Shamir secret-sharing, this matrix-vector multiplication can be implemented efficiently as a number of inner products, needing an amount of communication that is only linear in the length of the vector.

[0026] Optionally, the resulting remainder may be computed in the form of product shares of a multiplicative secret-sharing scheme. Namely, in a multiplicative secret-sharing scheme such as Shamir, an inner product of the matrix-vector multiplication may be performed by locally computing an inner product of secret-shares to obtain the product in the form of product shares; and performing a re-sharing to convert the product shares to multiplicative secret shares. It also useful in some cases to delay the re-sharing to perform further operations on the multiplicative shares. To this end, the provided techniques may output product shares rather than multiplicative shares for the resulting remainder.

[0027] Optionally, the cryptographic devices may be further configured to compute an inner product of the vector presentation of the resulting remainder with a further vector. For example, when the further vector is a vector of secret values, secret indexing in a secret array can be performed. When the further vector is a vector of non-secret values, secret indexing in a non-secret array can be performed. By using the vector (0, 1 , 2, ...), the resulting remainder can be obtained in a numeric representation. This provides an alternative to using a secret comparison as described herein, which can be more efficient especially if the divisor is relatively small, say at most 32, at most 16, or at most 8.

[0028] Optionally, the second cryptographic device may provide the representation of the second remainder as a secret input to the multi-party computation together with a third cryptographic device. For example, the second cryptographic device may provide the second additive secret-share to the third cryptographic device for computing the second remainder, or may directly provide the second remainder. This is advantageous because in various MPC protocols, it can be more efficient for two devices to together input a value into the MPC, than it is for a single device. For example, in the case of three-party multiplicative secret-sharing, the second and third cryptographic device may input a value by computing their respective shares such that the share of the first cryptographic device is fixed, e.g., equal to zero. This is particularly advantageous in the case where the second remainder is input into the multi-party computation in vector form, since the number of elements input into the MPC may be equal to the divisor whereas it may suffice for the second cryptographic device to provide a single value to the third cryptographic device for performing the inputting.

[0029] Optionally, the first and second cryptographic device may obtain respective multiplicative secret-shares of the secret input value, e.g., Shamir secret-shares or replicated secret-shares, and may compute the first and second additive secret-shares from the respective multiplicative secret-shares. This way, the provided techniques can be incorporated into a larger multi-party computation that uses multiplicative secret-shares. For example, the multiplicative secret-shares may be according to the same secret-sharing scheme that is also used to input the representations of the first and second remainder, and to compute the resulting remainder. As is known per se, computation of the additive secretshare can typically be performed by local operations of the respective first and second cryptographic devices, e.g., by a multiplication by a constant in the case of Shamir sharing, or by selecting one of the two shares of a three-party replicated secret sharing, resulting in an additive sharing modulo the same modulus as the that of the multiplicative secret-sharing scheme. It is also possible to obtain an additive sharing over the integers, e.g., by letting the second cryptographic device input a mask into the multi-party computation that statistically masks the secret value, and letting the first cryptographic device learn the masked input value, e.g., the value plus or minus the mask, as an output of the multi-party computation, or the other way around. Interestingly, the second (or first) and third cryptographic device can also input this mask together, which can be more efficient than the second (or first) device doing this by itself, as explained above.

[0030] Optionally, the cryptographic devices may compute a further secret representation of a further remainder for a further secret input. For example, such an operation may be performed at least three times, at least 10 times, etc. In such a case, the first and second cryptographic devices that compute and input remainders, may differ from operation to operation. For example, with three cryptographic devices, there are three possible pairs of cryptographic devices, and respective computations of first and second remainders, may be performed by respective pairs. For example, each of the three pairs may perform the computation of the remainders for one or more such operations.

[0031] For example, the cryptographic devices may perform the computation of resulting remainders on a vector of input values, with respective pairs of parties being selected for respective elements of the vector, e.g., by dividing the vector into three nonempty parts, etc. Instead or in addition, the cryptographic devices may be configured to associate respective operations of the cryptographic secure multi-party computations with respective values of a program counter, as is known per se e.g. from B. Schoenmakers, "MPyC — Python package for secure multiparty computation", https: / / github. com / lschoe / mpyc. In such a case, the first and second cryptographic devices may be selected from the multiple cryptographic devices based on the program counter, e.g. by selecting the pair based on the program counter modulo 3, or the like.

[0032] It will be appreciated by those skilled in the art that two or more of the above- mentioned embodiments, implementations, and / or optional aspects of the invention may be combined in any way deemed useful. Modifications and variations of any system and / or any computer readable medium, which correspond to the described modifications and variations of a corresponding computer-implemented method, can be carried out by a person skilled in the art on the basis of the present description, and the other way round as well.

[0033] BRIEF DESCRIPTION OF THE DRAWINGS

[0034] These and other aspects of the invention will be apparent from and elucidated further with reference to the embodiments described by way of example in the following description and with reference to the accompanying drawings, in which:

[0035] Fig. 1 shows a cryptographic device;

[0036] Fig. 2 shows a cryptographic system;

[0037] Fig. 3 shows a detailed example of determining a resulting remainder;

[0038] Fig. 4 shows a detailed example of determining a resulting remainder;

[0039] Fig. 5 shows a detailed example of determining a resulting remainder;

[0040] Fig. 6 shows a computer-implemented method;

[0041] Fig. 7 shows a computer-readable medium comprising data.

[0042] It should be noted that the figures are purely diagrammatic and not drawn to scale. In the figures, elements which correspond to elements already described may have the same reference numerals.

[0043] DETAILED DESCRIPTION OF EMBODIMENTS

[0044] Fig. 1 shows a cryptographic device 100 for use in a cryptographic system as described herein, e.g., in Fig. 2. The cryptographic system may be for performing a privacypreserving computation on secret data. The computation may be performed as a cryptographic secure multi-party computation between multiple cryptographic devices, including device 100.

[0045] The device 100 may comprise a data interface 120 for accessing data 030 representing a first or second additive secret-share of a secret input value. Data interface 120 may, instead of or in addition to the secret input value, be for accessing data representing a first remainder, a second remainder, and / or a resulting remainder as secret values of the multi-party computations, e.g., as secret shares. The remainders may be represented for example as numbers, e.g., as single secret shares, or as vectors, e.g., represented as respective secret shares for respective elements of the vector.

[0046] For example, as also illustrated in Fig. 1 , the input interface may be constituted by a data storage interface 120 which may access the data 030 from a data storage 021 . For example, the data storage interface 120 may be a memory interface or a persistent storage interface, e.g., a hard disk or an SSD interface, but also a personal, local or wide area network interface such as a Bluetooth, ZigBee or Wi-Fi interface or an ethernet or fibreoptic interface. The data storage 021 may be an internal data storage of the system 100, such as a hard drive or SSD, but also an external data storage, e.g., a network- accessible data storage. In some embodiments, respective data may each be accessed from or distributed across different data storages, e.g., via a different subsystem of the data storage interface 120. Each subsystem may be of a type as is described above for data storage interface 120.

[0047] The device 100 may further comprise a processor subsystem 140.

[0048] Device 100 may be configured to act as the first cryptographic device of a cryptographic system described herein. In such a case, processor subsystem 140 may be configured to, during operation of the system 100, compute a first remainder of a division based on the first additive secret-share and a divisor, and to provide a representation of the first remainder as a secret input to the multi-party computation.

[0049] Instead or in addition, device 100 may be configured to act as the second cryptographic device of a cryptographic system described herein. In such a case, processor subsystem 140 may be configured to, during operation of the system 100, compute a second remainder of a division based on the second additive secret-share and the divisor; and to provide a representation of the second remainder as a secret input to the MPC.

[0050] Device 100 may also be configured to act both as a first cryptographic device in a first computation of a resulting remainder and as a second cryptographic device in a second, different computation of a resulting remainder, in which both above-mentioned options for the processor subsystem 140 apply.

[0051] Regardless, processor subsystem 140 may be configured to, during operation of the system 100, using the multi-party computation, compute a secret representation of a resulting remainder of dividing the secret input value by the divisor. This secret representation may be computed by processor subsystem 140 based on the representations of the first and second remainder, for example, by computing, a remainder of dividing the first additive secret-share plus the second additive secret-share minus the modulus by the divisor.

[0052] As also discussed with respect to Fig. 2. the device 100 may be further configured to provide inputs to the multi-party computation, e.g., to input the secret input and / or to output the computed secret representation.

[0053] The system 100 may also comprise a communication interface 180 configured for communication 126 with at least one further cryptographic device of the cryptographic system. Communication interface 180 may internally communicate with processor subsystem 140 via data communication 125. Communication interface 180 may be arranged for direct communication with the other devices, e.g., using USB, IEEE 1394, or similar interfaces. As illustrated in the figure, communication interface 180 may also communicate over a computer network 099, for example, a wireless personal area network, an internet, an intranet, a LAN, a WLAN, etc. For instance, communication interface 180 may comprise a connector, e.g., a wireless connector, an Ethernet connector, a Wi-Fi, 4G or 4G antenna, a ZigBee chip, etc., as appropriate for the computer network. Communication interface 180 may be an internal communication interface, e.g., a bus, an API, a storage interface, etc.

[0054] In general, each device described in this specification, including but not limited to the system 100 of Fig. 1 may be embodied as, or in, a single device or apparatus, such as a workstation or a server. The device may be an embedded device. The device or apparatus may comprise one or more microprocessors which execute appropriate software. For example, the processor subsystem of the respective system may be embodied by a single Central Processing Unit (CPU), but also by a combination or system of such CPUs and / or other types of processing units. The software may have been downloaded and / or stored in a corresponding memory, e.g., a volatile memory such as RAM or a non-volatile memory such as Flash. Alternatively, the processor subsystem of the respective system may be implemented in the device or apparatus in the form of programmable logic, e.g., as a Field-Programmable Gate Array (FPGA). In general, each functional unit of the respective system may be implemented in the form of a circuit. The respective system may also be implemented in a distributed manner, e.g., involving different devices or apparatuses, such as distributed local or cloud-based servers.

[0055] Fig. 2 shows a cryptographic system 010 for performing a privacy-preserving computation as a cryptographic secure multi-party computation. The cryptographic system 010 may in general comprise multiple input devices, multiple different cryptographic devices, and at least one result device, where the sets of input, cryptographic, and result devices may overlap with each other. As illustrated, the devices typically communicate over a computer network 099, e.g., the internet or a local network.

[0056] In particular, shown in the figure are three cryptographic devices CP1 , 221 ; CP2, 222; and CP3, 223. The cryptographic devices may be based on cryptographic device 100 of Fig. 1. Generally, the number of cryptographic devices that is used can vary depending on the particular technique used for the multi-party computation and the security properties which are desired. For example, the number of cryptographic devices CPi can be two, three, or more. Although the cryptographic devices of the cryptographic system are typically distinct devices, e.g., operated by different organizational entities, it is also possible to combine the different cryptographic devices into a single device, for example, for performing the multi-party computation as a so-called MPC-in-the-Head.

[0057] The cryptographic devices CPi may be configured to perform a secure multiparty computation (also known per se as multi-party computation, secure computation, or MPC). Generally, a multi-party computation may be a distributed protocol between the cryptographic devices for performing a computation in a privacy-preserving way. Depending on the specific technique used, MPC may ensure privacy and / or correctness of the computation against an attacker that eavesdrops or controls one or more (but typically not all) of the cryptographic devices. As known per se, any computation can be performed as a multi-party computation (in other words, “under the multi-party computation”), but concrete computational and communication efficiency can in general greatly depend on how exactly the computation is performed.

[0058] In particular, the multi-party computation can be performed based on secret sharing, in particular arithmetic secret sharing such as Shamir secret sharing, replicated secret sharing, or additive secret sharing. In arithmetic secret sharing, the shared values may be numbers defined modulo a certain modulus, e.g., a prime modulus. The modulus may have bit length at least 20 bits, at least 30 bits, or at least 60 bits. It is noted that, although the secret input value may be additively shared over the integers; still, the representations of the remainders that are input into the multi-party computation, are typically defined over a finite domain, e.g., modulo a modulus.

[0059] In particular, the arithmetic secret sharing may be a multiplicative secret sharing, such as Shamir secret-sharing or replicated secret sharing. As is known per se, multiplicative secret sharing generally admits efficiently performing additions and multiplications under multi-party computation, as well as efficient conversion to additive secret sharing, e.g., see, R. Cramer et al., "General Secure Multi-Party Computation from any Linear Secret-Sharing Scheme", proceedings EUROCRYPT 2000.

[0060] For example, the multi-party computation can be based on the techniques described in Shamir, “How to Share a Secret”, Communications ACM, 1979; Ben-Or, Goldwasser, Wigderson, “Completeness Theorems for Non-Cryptographic Fault-Tolerant Distributed Computation (Extended Abstract)”, Proceedings of the 20th Annual ACM Symposium on Theory of Computing, 1988; Chaum, Crepeau, Damgaard, “Multiparty Unconditionally Secure Protocols (Extended Abstract)”, Proceedings of the 20th Annual ACM Symposium on Theory of Computing, 1988; Ito, Saito, Nishizeki, “Secret sharing scheme realizing general access structure”, Electronics and Communications in Japan (Part III: Fundamental Electronic Science), 1989; Damgaard, Pastro, Smart, Zakarias, “Multiparty Computation from Somewhat Homomorphic Encryption”, proceedings CRYPTO 2012. Various higher-level operations such as sorting and integer comparison can be performed based on such basic multi-party computation protocols as discussed e.g. in M. Keller, "MP-SPDZ: A Versatile Framework for Multi-Party Computation", proceedings ACM CCS 2020; or as implemented in MPyC, see https: / / github.com / lschoe / mpyc.

[0061] The multi-party computation may be configured to perform operations on so called sharings, or secret shares, of values. A secret share may be a distributed representation of an input, intermediate, or output value of the MPC. A limited number of shares, up to a certain threshold t, may not allow to derive the represented value. The threshold may be configurable, with different techniques supporting different possible threshold. In particular, the multi-party computation may be an honest majority MPC, where the threshold t is strictly smaller than half the number of parties n, e.g., 1 / 2 (n - 1). Examples of sharings are multiplicative secret sharing schemes, such as Shamir secret sharing or replicated secret sharing.

[0062] Specifically, the provided techniques may be combined with a multi-party computation protocol with threshold 1 , in view of the use of additive shares of a first and second cryptographic device. For example, the multi-party computation may be a two-party protocol, e.g., based on additive secret sharing. Or, the multi-party computation may be a protocol based on a multiplicative secret sharing scheme such as replicated or Shamir secret sharing, e.g., with three parties. Use of multiplicative secret sharing is advantageous in view of the possibility to efficiently obtain additive secret shares of a secret input value shared according to the multiplicative secret sharing scheme.

[0063] A value that is computed on by the MPC but that is represented among the parties in such a way that no single party, more generally no unqualified set of parties, can derive the value from that representation, is referred to as a secret value, or private value, of the MPC. A secret value can be a secret sharing, but it is also possible in general e.g. to use a threshold encryption. For example, a secret value can be a secret input, a secret output, or a secret intermediate value. Here, a secret input may be known in the plain by the party inputting it, and known only in a secret representation by the cryptographic devices CPi; and similarly, a secret output may be learned in the plain by the party receiving it as output, but may be known only in a secret representation by the cryptographic devices CPi. A private intermediate value may be known only to the cryptographic devices CPi, and only as a secret representation. By processing values using secret representations, the data can be kept secret, at least as long as the underlying assumptions of the multi-party computations (e.g., a number and / or type of corruptions of the cryptographic devices) are satisfied.

[0064] Also shown in the figure are a number of input devices INP1 , 211 ; INP2, 212; up to INPk, 213. The input devices may input respective input data for the computation. The input devices 211-213 may use the hardware configuration discussed in Fig. 1. The number of input devices can be two, at most or at least three, or at most or at least five, for example. In many cases, the sets of inputs devices INPi and cryptographic devices CPi may wholly or partially overlap. For example, the set of input devices may be a subset or a superset of the set of cryptographic devices, or may be exactly the same.

[0065] Further shown is a result device RES, 230. The result device RES may obtain a result of the MPC based on the performed privacy-preserving computation. It is also possible for multiple respective result devices to obtain multiple respective results of the multi-party computation. Although illustrated as a separate device in the figure, the result device(s) RES can be the same devices as an input device INPi and / or cryptographic device CPi. Generally, the result device may be implemented using the hardware configuration discussed w.r.t. Fig. 1.

[0066] Many known multi-party computation techniques are defined per se for the case where the input and result devices INPi and RES form a subset of the set of cryptographic devices CPi that perform the MPC. To use such techniques in a setting where an input and / or result device does not perform the MPC itself, an input device can for example determine a secret representation, e.g., a secret sharing, and distribute it among the computation devices. Similarly, a result device can for example receive a secret representation, e.g., respective secret shares, of an output from the computation devices and derive the output from the secret representation. It is also possible to use specific techniques for letting an external party provide inputs to and / or obtain outputs from a multiparty computation. For example, the techniques from the following reference can be used: T. P. Jakobsen, J. B. Nielsen, and C. Orlandi. “A framework for outsourcing of secure computation”, proceedings CCSW14. It is noted that, apart from such inputs by external parties INPi, the cryptographic devices CMPi that perform the MPC themselves typically also provide inputs to the multi-party computation as part of performing various operations, e.g., by inputting representations of the first and second remainder as described herein.

[0067] Fig. 3 shows a detailed, yet non-limiting, example of computing a remainder of dividing an input value by a divisor.

[0068] Shown in the figure is an input value x, 300. In this example, a remainder x mod n, 310, may be determined of dividing the value x by a divisor n, 320. As illustrated in this figure, the input value x can be smaller or bigger than the divisor n. The value x may be non-negative.

[0069] The input value x may be secret-shared in the form of a first additive secretshare {x}i, 341, and a second additive secret-share {x}2, 351, forming an additive secret- sharing of the input value x. In this example, the additive secret-sharing may be modulo a modulus p, 330, e.g., {x}i + {x}2= x mod p. The first and the second additive share may be random, e.g., statistically independent of x, from the point of view of the respective parties holding the shares.

[0070] The value x may be assumed to be much smaller than the modulus p, e.g., by a factor 2A10, 2A20, or 2A30 (withAdenoting power), e.g., x may be a value with headroom as known per se in the multi-party computation literature. As is common per se in the field of multi-party computation, the provided techniques may have probabilistic correctness; in this case, with an error probability x / p, bounded by B / p where B is an upper bound on possible values of the input x.

[0071] When using unit vector representations, the divisor n may be equal to the length of the unit vector to be constructed. The value x mod n, 310 may correspond to a position of a unit element in that vector to be set. If x<n, then x itself may be the position of the unit elements, so the provided techniques may in this case convert the input x to the corresponding unit vector.

[0072] If {x}i, {x}2is a random additive secret sharing, e.g., as obtained by conversion from a random multiplicative secret sharing, then the shares {x}i, {x}2may be considered random variables, uniform over [0, p).

[0073] Interestingly, as the inventors realized, if x « p, then the probability that {x}i < x is negligible. Hence, essentially, it can be expected that the sum {x}i + {x}2, 311 without modulo reduction wraps around the modulus p exactly once, e.g.,

[0074] {x}i + {x}2= X + p.

[0075] Re-arranging terms and reducing modulo n, one may obtain:

[0076] {x}i + {x}2- p = x; so

[0077] ({x}i + {x}2- p) mod n = x mod n.

[0078] This latter equation shows that the value x mod n may be computed as a remainder of dividing the value ({x}i + {x}2- p) by the divisor.

[0079] Interestingly, although the value x is secret, in the above expression, the inventors realized that the values {x}i, {x>2, -p to be reduced modulo n may all be known to at least one of the parties carrying out a multi-party computation. Accordingly, these values can be reduced modulo n in the plain without needing an interactive multi-party computation protocol. The secret value x mod n may then be computed based on these modulo-reduced values, reducing the modulo reduction x mod n to a case that can be handled relatively efficiently using multi-party computation. There are different possibilities for dealing with the value p in the above expression. For example, reducing the respective summands modulo n, in other words determining the remainder by division by n, one obtains:

[0080] (({x}i mod n) + ({x}2mod n) + (-p mod n)) mod n = x mod n. Accordingly, x mod n may be computed by local computation of ({x}i mod n); ({x}2mod n); and (-p mod n); and adding three numbers that are at most n.

[0081] Preferably, however, the value p can also already be dealt with by incorporating it in one or both additive shares, e.g., by subtracting the modulus p from the first additive secret-share {x}i plus the second additive secret share {x}2prior to computing the remainders. For example, as illustrated in the figure, the value p can be incorporated in the second additive secret share to obtain value {x}2- p, 352 to be reduced modulo n:

[0082] (({x}i mod n) + (({x}2- p) mod n)) mod n = x mod n, such that x mod n can be computed by taking the modulo-n reduction of the sum of two values y = ({x}i mod n), 349 and z = ({x}2- p) mod n), 359 that are both smaller than n. Similarly, the value p can be incorporated in the first additive share, or partly in both shares.

[0083] Fig. 4 shows a detailed, yet non-limiting, example of computing a remainder of dividing an input value by a divisor under multi-party computation. This example can optionally be based on the techniques discussed in Fig. 3, using additive secret shares modulo a modulus; or it can use additive secret shares over the integers as input. The operation and data illustrated in this figure may be distributed over multiple cryptographic devices, including in particular a first cryptographic device and a second cryptographic device.

[0084] Shown in the figure are a first additive secret-share {x}i, 441 of the first cryptographic device, and a second additive secret-share {x}2, 451 of the second cryptographic device, together forming an additive secret-sharing of a secret input value x. The additive secret sharing can be over the integers, e.g., {x}i + {x}2= x or {x}i - {x}2= x; or modulo a modulus p, e.g., {x}i + {x}2= x mod p.

[0085] The figure further shows an operation ModN, 470, for computing a remainder of a division by a divisor n. As shown in the figure, the first cryptographic device may use operation ModN to compute a first remainder y, 449 of a division based on the first additive secret-share {x}i and the divisor n. The second cryptographic device may use operation ModN to compute a second remainder z, 459 of a division based on the second additive secret-share {x}2and the divisor n. As discussed with respect to Fig. 3, the inputs to ModN can be the additive secret shares themselves, optionally corrected to subtract modulus p from the sum of the two secret shares. The figure further shows a secure multi-party computation MPC, 480, being carried out by a set of cryptographic devices. This set of devices typically includes the first and second cryptographic device, although in principle these latter devices could also be external input parties to the multi-party computation MPC. The multi-party computation MPC is typically performed over values modulo a certain modulus, or in any case from a finite domain; regardless of whether the additive secret shares {x}i + {x}2(or {x}i - {x}2) are defined modulo a modulus.

[0086] The first and second cryptographic devices may provide the first remainder y and the second remainder z, respectively, as secret inputs to the multi-party computation MPC, for example, by secret-sharing them. In this example, the first and second remainder may be represented as numbers, e.g., represented in the multi-party computation MPC by respective single arithmetic secret shares [y], [z].

[0087] Using the multi-party computation MPC, the cryptographic devices may compute a secret representation 410 of a resulting remainder of dividing the secret input value x by the divisor n, by computing, based on the representations y, z, of the first and second remainder, a remainder of dividing the first additive secret-share {x}i plus the second additive secret-share {x}2. optionally minus the modulus p by the divisor n.

[0088] In this example, given the numeric representations y, z, this computation of the resulting remainder 410 may be performed by performing a secure comparison

[0089] [y]+[z]>n, 485, of the sum [y]+[z], 419 of the first remainder [y] and the second remainder

[0090] [z] to the divisor n to obtain a secret comparison output [b], 460; and computing the resulting remainder from the sum [y]+[z] and the secret comparison output [b]. For example, as illustrated in the figure, the resulting remainder may be computed as [r] := [y] + [z] - [b]*n, where b is 1 if [y] + [z] n, and 0 otherwise. Techniques for performing such a secure comparison are known per se, e.g., from S. de Hoogh, "Design of large scale applications of secure multiparty computation: secure linear programming". The computation of the comparison can be performed in the same domain in which the numeric representations [y], [z] are input; but interestingly, it is also possible to perform the comparison in a smaller domain, e.g., the domain GF(4) or Z2, or another domain with at most 256 elements. To this end, the parties that input the values y and / or z as numeric representations, may also input these values as binary representations, e.g., may input the respective bits of the binary representation as respective inputs in the smaller domain. The comparison can then be performed over the smaller domain, improving efficiency; and the output of the comparison may then be converted to the domain of the numeric representations [y], [z]. As shown in the figure, the additive secret-shares {x}i, {x}2may be obtained by the first and second cryptographic devices obtaining respective multiplicative secretshares [x]i, 440, [x]2, 450, of the secret input value x, and applying a conversion operation Conv, 460, to compute the first additive secret-share {x}i and the second additive secretshare {x}2from the respective multiplicative secret-shares [x]i, [x]2. For example, in the case of Shamir secret-sharing modulo a certain modulus, as is known per se, such a conversion may be performed by having the devices multiply (in the finite field Z / pZ) their Shamir share by the appropriate Lagrange coefficient. This conversion may result in an additive sharing modulo this same modulus.

[0091] It is also possible to perform a conversion Conv into an additive sharing over the integers. To this end, for example, the second cryptographic device may input a random mask [r] that statistically hides the value [x] into the multi-party computation, e.g., selected from [0, M*2Ak), where M is the size of the domain of x and k is a statistical security parameter. The masked value [c]=[x+r] may be opened to the first cryptographic device. The masked value c held by the first cryptographic device and the negated mask -r held by the second cryptographic device may represent an additive sharing over the integers, in the sense that the equation x=c-r holds regardless of any modulus.

[0092] As another example, the mask [r] may be selected from [M,M*(1+2Ak)). In this case, the masked value [c]=[x]-[r] may be opened to the first cryptographic device. In this case, since the computation of [x]-[r] modulo p may involve an underflow, the equation x=c+r-p may hold over the integers, and accordingly, the masked value c of the first cryptographic device and a compensated mask r-p of the second cryptographic device (or a compensated masked value c-p and the mask r, or two compensated values), may form an additive sharing over the integers.

[0093] As also discussed elsewhere, for efficiency, the second cryptographic device may input the value r together with a second cryptographic device, for example, by both parties locally randomly generating the value from the same seed and defining their secret shares appropriately. It is also possible to change the roles of the first, second, and third cryptographic devices in any way desired.

[0094] Although not shown in this figure, the example of this figure can be extended to compute a numeric division of the input value x by the divisor n. Such a numeric division is in contrast to the multiplication of x by the inverse of n, which does not have a numerical interpretation if n does not divide x. To compute the numeric division, the input value [x] may be corrected according to the resulting remainder [r], and then the corrected input value may be multiplied with an inverse of the divisor n. For example by multiplying [x] - [r] by the inverse of n, a numeric floor division may be efficiently computed. Several variations are possible. For example, the correction with respect to modulus p, if applicable, can be performed by the first cryptographic device instead of the second cryptographic device; or it can be performed as part of the multi-party computation MPC, e.g., by computing [y] + [z] + (-p mod n), and checking whether this value is between 0 and n; between n and 2n; or between 2n and 3n, and correcting the value accordingly.

[0095] The operations Conv, ModN, MPC may be repeated for several inputs x. In this case, it is advantageous to load-balance the work Conv, ModN of the pair of the first and second cryptographic devices among the overall set of cryptographic devices, e.g., to select respective pairs of cryptographic devices for respective inputs. For example, the cryptographic devices may compute a further secret representation of a further remainder based on an additive secret-share of a third cryptographic device, different from the first and second cryptographic devices. For example, when applying the operations to a vector of inputs, respective pairs of cryptographic devices may be selected for elements of the vector. Another way of selecting the pair of cryptographic devices applies when the cryptographic devices work by associating respective operations of the cryptographic secure multi-party computations with respective values of a program counter, as is done in the MPyC framework of B. Schoenmakers, for example. In such a case, the pair of cryptographic devices can be selected from the multiple cryptographic devices based on the program counter. This way, load balancing can be achieved without additional synchronization communication between the cryptographic devices.

[0096] Fig. 5 shows a detailed, yet non-limiting, example of computing a remainder of dividing an input value by a divisor under multi-party computation. This example is based on the example of Fig. 4, and, as in that example, the illustrated operation and data may be distributed over multiple cryptographic devices.

[0097] In particular, the figure shows a first remainder y, 549, and a second remainder z, 559. The first remainder y may be computed as a first remainder of a division based on a first additive secret-share and a divisor. The second remainder z may be computed as a division based on a second additive secret-share and the divisor. This computation may be performed as discussed with respect to Fig. 4.

[0098] Based on the remainders y, z, a secret representation 510 of a resulting remainder may be computed in a multi-party computation MPC, 580.

[0099] Interestingly, in this example, the first and second cryptographic devices may provide the first and second remainder y, z, as secret inputs to the multi-party computation, in vector representations [yo], [yn-i], 548 and [zo], [zn-i], 558. The vector representation of a value y, z, may have a non-zero entry at a location indicated by the value, for example, value 0 may be represented by a vector which has a non-zero entry only at the first location in the vector; the value 1 may be represented by a vector which has a non-zero entry only at the second location in the vector; etcetera. For example, the vectors may be unit vectors, e.g. in this case standard unit vectors, although this is not strictly needed. The vector entries may be input as elements of the same domain over which the secret input value was defined, but this is not needed, e.g., the vector entries may be input as values of a smaller domain, e.g., of at most 256 or at most 8 values, e.g., the field Z2 or the field GF(4). The length of the vector may be equal to the divisor n. It is also possible e.g. to use a vector representation where only n - 1 elements are stored and the nth element is defined implicitly, e.g., as 1 minus the sum of the other elements. For example, as illustrated in the figure, the values y, z, may be represented in the multi-party computation MPC by respective secret-shares for the respective elements of the vectors.

[0100] Interestingly, a remainder y, z may be input into the multi-party computation MPC more efficiently by involving a further cryptographic device. Without loss of generality, this is now illustrated for the second remainder z. Namely, the second cryptographic device may provide the representation of the second remainder z as a secret input to the multi-party computation together with a third cryptographic device. To this end, the second device can for example provide the second additive secret-share {x}2to the third cryptographic device for computing the second remainder z, or the second cryptographic device may directly provide the second remainder z to the third cryptographic device. Since the third cryptographic device may not know the first additive secret share {x}i, this may be done without affecting the secrecy of the secret input x. It is also possible for the second cryptographic device to directly provide the second remainder z to the third cryptographic device. In any case, when obtaining the additive shares from multiplicative shares, a rerandomization of the additive shares between the first and cryptographic devices may be performed to avoid that the secret additive share {x}2leaks information.

[0101] In any case, advantageously, the second and third cryptographic device may provide the vector representation z as input to the multi-party computation MPC more efficiently than the second cryptographic device itself, e.g., by computing their respective shares such that the share of the first cryptographic device is fixed, e.g., equal to zero. For example, the second cryptographic device may communicate z in numeric form to the third cryptographic device, whereafter the second and third cryptographic devices may input z into the multi-party computation in vector form without communication. It is noted that inputting by second and third cryptographic devices is also technically possible with numeric representations of the first and second remainder e.g. as in Fig. 4, but in this case there may be less or no improvement in communication because of this. As also discussed with respect to Fig. 3 and Fig. 4, the resulting remainder 510 may be computed by computing a remainder of dividing the first additive secret-share plus the second additive secret-share, optionally minus the modulus, by the divisor. In this example, also the resulting remainder 510 may be represented as a vector [xo], [xn-i].

[0102] Interestingly, when using vector representations, the resulting remainder [xj may be computed by computing a matrix-vector product MatMul, 585 based on the secret vector representations of the first remainder [yj and second remainder [zj. Namely, it may be observed that the operation that circularly shifts a length-n unit vector by a number of positions indicated by another length-n unit vector, can be interpreted as addition modulo n. Accordingly, the output of the matrix-vector multiplication may effectively be a vector representation of the sum of the first and second remainder.

[0103] This operation MatMul may be implemented by interpreting one of the vectors, e.g., the vector [zj, as a circular shift matrix, by means of constructing a matrix where the first row equals [zj and for the remaining rows it holds that every row is a circularly-shifted (by one position) copy of the previous row. This circular shift matrix representation for one of the remainders may be multiplied with the vector representation of the other remainder. This is illustrated in the figure by showing a circular shift matrix 557 for the second remainder 558. In particular, operation MatMul may compute the matrix-vector product y*Z of first remainder y and matrix representation Z of the second remainder. The matrix-vector product may also be computed as Zt*y, with Zt denoting the transpose of the circular shift matrix. It is similarly also possible to compute the matrix-vector product by interpreting the first remainder as a circular shift matrix and multiplying this matrix by the vector representation of the second remainder.

[0104] In any case, performing matrix-vector multiplication MatMul under a multiparty computation MPC is known per se in the art, and can interestingly be performed especially efficiently on secret shares of a multiplicative secret sharing, by implementing an inner product in terms of a single resharing, as is known e.g., from "Design of large scale applications of secure multiparty computation: secure linear programming". Depending on the further use, is also possible to further improve efficiency by not performing the resharing and thus outputting the resulting remainder 410 in product-shared form.

[0105] Preferably, performing the matrix-vector multiplication MatMul does not comprise explicitly representing all respective elements of the circular shift matrix in memory. Instead, the circular shift matrix may be accessed by translating an access of a certain cell of the circular shift matrix to an index in the corresponding vector representation of the remainder, and accessing the vector at this index. This way, the matrix-vector multiplication can be implemented using an amount of memory that only scales linearly in the divisor n. For example, such a matrix-vector multiplication can be implemented by using a nullary expression as supported e.g. by the eigen library, or the like.

[0106] As discussed with respect to Fig. 4., if applicable, the subtraction of the modulus in the computation of the resulting remainder may be accounted for in the first and / or second remainder, in which case the matrix multiplication output can directly result in the vector representation 510 of the resulting remainder. However, it is also possible to account for the modulus after performing the matrix-vector multiplication, by applying a public shift by (-p mod n) positions to the matrix-vector multiplication output.

[0107] In any case, interestingly, the resulting remainder 510 may be computed in vector representation in a relatively efficient way by means of the provided techniques; in particular, with a favorable communication complexity that is only linear in n.

[0108] As illustrated in the figure, the resulting remainder 510 may further be subjected to the computation Prod, 586, of an inner product [xoCo]+[xn-iCn-i], 599 with a further vector. For example, the further vector can be the vector (0, 1 , 2, ...). This way, a numeric representation of the resulting remainder can be obtained. As illustrated in the figure, an alternative is to use a vector [co], [cn-i] , 590 of secret values. This way, a secret indexing of the vector 590 can be achieved with the secret value as index.

[0109] Fig. 6 shows a block-diagram of a cryptographic method 1000 of performing a privacy-preserving computation. The method 1000 may be computer-implemented. The privacy-preserving computation may be performed by a cryptographic device as a secure multi-party computation between multiple cryptographic devices comprising the cryptographic device. For example, the cryptographic device can be device 100 of Fig. 1. e.g., acting as a first, second, or further cryptographic device as discussed with respect to that figure. However, this is not a limitation, in that the method 1000 may also be performed using another system, apparatus or device.

[0110] The method 1000 may further comprise the carrying out of the secure multiparty computation by the other cryptographic devices. For example, the method 1000 may be carried out by a cryptographic system, e.g., cryptographic system 010 of Fig. 2. Although the roles of the multi-party computation parties are typically carried out by distinct devices, it is also possible to combine the roles of multiple parties in a single device, e.g., in a method of performing the privacy-computation as a MPC-in-the-Head.

[0111] The method 1000 may comprise, in an operation titled "COMMUNICATE", communicating 1010 with at least one further cryptographic device of the cryptographic system. The method 1000 may comprise, in an operation titled "ACCESS ADDITIVE SHARE", accessing 1020 data representing a first or second additive secret-share of a secret input value.

[0112] The method 1000 may comprise, in an operation titled "COMPUTE FIRST REMAINDER", computing 1030 a first remainder of a division based on the first additive secret-share and a divisor. The method 1000 may further comprise, in an operation titled "INPUT FIRST REMAINDER", providing 1040 a representation of the first remainder as a secret input to the multi-party computation. Operations 1030, 1040 may be performed as part of performing the role of the first cryptographic device of the multi-party computation.

[0113] Instead of or in addition to operations 1030, 1040, the method 1000 may comprise, an operation titled "COMPUTE SECOND REMAINDER", computing 1050 a second remainder of a division based on the second additive secret-share and the divisor. In this case, the method may further comprise, an in operation titled "INPUT SECOND REMAINDER", providing 1060 a representation of the second remainder as a secret input to the multi-party computation. Operations 1050, 1060 may be performed as part of performing the role of the second cryptographic device of the multi-party computation.

[0114] Method 1000 may also comprise both operations 1030, 1040 and operations 1050, 1060, e.g., in the case where method is performed by multiple distinct cryptographic devices or in the case where the method is performed by a single cryptographic device in a MPC in the Head setting.

[0115] The method may further comprise, e.g., following operation 1040 or following operation 1060, in an operation titled "COMPUTE RESULTING REMAINDER", using the multi-party computation, computing 1070 a secret representation of a resulting remainder of dividing the secret input value by the divisor. The computation 1070 of the resulting remainder may comprise, in an operation titled "COMBINE ADDITIVE SHARES", computing 1075, based on the representations of the first and second remainder, a remainder of dividing the first additive secret-share plus the second additive secret-share, optionally minus the modulus, by the divisor.

[0116] It will be appreciated that, in general, the operations of method 1000 of Fig. 10 may be performed in any suitable order, e.g., consecutively, simultaneously, or a combination thereof, subject to, where applicable, a particular order being necessitated, e.g., by input / output relations.

[0117] The method(s) may be implemented on a computer as a computer implemented method, as dedicated hardware, or as a combination of both. As also illustrated in Fig. 7, instructions for the computer, e.g., executable code, may be stored on a computer readable medium 1100, e.g., in the form of a series 1110 of machine-readable physical marks and / or as a series of elements having different electrical, e.g., magnetic, or optical properties or values. The medium 1100 may be transitory or non -transitory.

[0118] Examples of computer readable mediums include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Fig. 11 shows an optical disc 1100.

[0119] The instructions may be instructions for one or more particular devices of the cryptographic system, e.g., instructions to act as a first, second, and / or further cryptographic device of a cryptographic system as described herein.

[0120] Examples, embodiments or optional features, whether indicated as nonlimiting or not, are not to be understood as limiting the invention as claimed.

[0121] It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design many alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. Use of the verb "comprise" and its conjugations does not exclude the presence of elements or stages other than those stated in a claim. The article "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. Expressions such as “at least one of” when preceding a list or group of elements represent a selection of all or of any subset of elements from the list or group. For example, the expression, “at least one of A, B, and C” should be understood as including only A, only B, only C, both A and B, both A and C, both B and C, or all of A, B, and C. The invention may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In the device claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

Claims

CLAIMS1. A cryptographic system (010) for performing a privacy-preserving computation on secret data, wherein the cryptographic system comprises multiple cryptographic devices (100, 221,221, 223), wherein the multiple cryptographic devices are configured to perform the computation as a cryptographic secure multi-party computation between the multiple cryptographic devices, wherein: a first and second cryptographic device of the multiple cryptographic devices are configured to respectively obtain a first and a second additive secret-share forming an additive secret-sharing of a secret input value; the first cryptographic device is configured to compute a first remainder of a division based on the first additive secret-share and a divisor; and to provide a representation of the first remainder as a secret input to the multi-party computation; the second cryptographic device is configured to compute a second remainder of a division based on the second additive secret-share and the divisor; and to provide a representation of the second remainder as a secret input to the multi-party computation; the cryptographic devices are configured to, using the multi-party computation, compute a secret representation of a resulting remainder of dividing the secret input value by the divisor based on the representations of the first and second remainder.

2. The cryptographic system (010) of claim 1 , wherein the additive secretsharing is over the integers, and wherein the cryptographic devices are configured to compute the secret representation of the resulting remainder by computing a sum of the first additive secret share and the second additive secret share, and computing a remainder of dividing the sum by the divisor.

3. The cryptographic system (010) of claim 1 , wherein the additive secretsharing is modulo a modulus, and wherein the cryptographic devices are configured to compute the secret representation of the resulting remainder by computing, based on the representations of the first and second remainder, a sum of the first additive secret-share plus the second additive secret-share minus the modulus, and computing a remainder of dividing the sum by the divisor.

4. The cryptographic system (010) of claim 3, wherein the first and and / or second cryptographic device are configured to subtract the modulus from the first additive secret-share plus the second additive secret-share prior to computing the remainders.

5. The cryptographic system (010) of any one of claims 2-4, wherein: the representations of the first remainder, the second remainder, and the resulting remainder are numeric representations; and the cryptographic devices are configured to compute the resulting remainder by performing a secure comparison of the sum to obtain a secret comparison output; and computing the resulting remainder from the sum and the secret comparison output.

6. The cryptographic system (010) of claim 5, wherein the cryptographic devices are configured to further provide a binary representation of the first and / or second remainder as secret inputs to the multi-party computation, and to perform the secure comparison based on the binary representation.

7. The cryptographic system (010) of claim 5 or 6, wherein the cryptographic devices are further configured to, under the multi-party computation, correct the input value according to the resulting remainder, and multiply the corrected input value with an inverse of the divisor.

8. The cryptographic system (010) of any one of claims 1-4, wherein the representations of the first remainder, the second remainder, and the resulting remainder are vector representations, wherein a vector representation of a value has a non-zero entry at a location indicated by the value.

9. The cryptographic system (010) of claim 8, wherein the cryptographic devices are configured to compute the secret vector representation of the resulting remainder by computing a matrix-vector product based on the secret vector representations of the first and second remainder.

10. The cryptographic system (010) of claim 8 or 9, wherein the cryptographic devices are configured to compute the resulting remainder in the form of product shares of a multiplicative secret-sharing scheme.

11. The cryptographic system (010) of any one of claims 8-10, wherein the cryptographic devices are further configured to compute an inner product of the vector presentation of the resulting remainder with a further vector.

12. The cryptographic system (010) of any preceding claim, wherein the second cryptographic device is configured to provide the representation of the second remainder as a secret input to the multi-party computation together with a third cryptographic device.

13. The cryptographic system (010) of any preceding claim, wherein the first and second cryptographic device are configured to obtain respective multiplicative secret-shares of the secret input value, and to compute the first and second additive secret-shares from the respective multiplicative secret-shares.

14. The cryptographic system (010) of any preceding claim, wherein the cryptographic devices are further configured to compute a further secret representation of a further remainder based on an additive secret-share of a third cryptographic device, different from the first and second cryptographic devices.

15. The cryptographic system (010) of claim 14, wherein the cryptographic devices are configured to associate respective operations of the cryptographic secure multiparty computations with respective values of a program counter, and to select the first and second cryptographic devices from the multiple cryptographic devices based on the program counter.

16. A cryptographic device (100, 221-223) for use in the cryptographic system (010) comprising multiple cryptographic devices according to any one of claims 1 -15, wherein the cryptographic device is for performing a privacy-preserving computation as a cryptographic secure multi-party computation between the multiple cryptographic devices, wherein the cryptographic device comprises: a communication interface (180) configured for communication with at least one further cryptographic device of the cryptographic system; a data interface (120) for accessing data (030) representing a first or second additive secret-share of a secret input value; a processor subsystem (140) configured to:compute a first remainder of a division based on the first additive secret-share and a divisor; and provide a representation of the first remainder as a secret input to the multi-party computation; or compute a second remainder of a division based on the second additive secret-share and the divisor; and provide a representation of the second remainder as a secret input to the multi-party computation; wherein the processor subsystem (140) is further configured to, using the multi-party computation, compute a secret representation of a resulting remainder of dividing the secret input value by the divisor based on the representations of the first and second remainder.

17. A cryptographic method (1000) of performing a privacy-preserving computation, wherein the privacy-preserving computation is performed by a cryptographic device as a secure multi-party computation between multiple cryptographic devices comprising the cryptographic device, wherein the method comprises: communicating (1010) with at least one further cryptographic device of the cryptographic system; accessing (1020) data representing a first or second additive secret-share of a secret input value; computing (1030) a first remainder of a division based on the first additive secret-share and a divisor, and providing (1040) a representation of the first remainder as a secret input to the multi-party computation; or: computing (1050) a second remainder of a division based on the second additive secret-share and the divisor, and providing (1060) a representation of the second remainder as a secret input to the multi-party computation; using the multi-party computation, computing (1070) a secret representation of a resulting remainder of dividing the secret input value by the divisor based on the representations of the first and second remainder.

18. A transitory or non-transitory computer-readable medium (1100) comprising data (1110) representing instructions which, when executed by a processor system, cause the processor system to perform the cryptographic method of claim 17.

Images