]> Meta

btsavage@meta.com

Mozilla

mt@lowentropy.net

Security Privacy Preserving Measurement arithmetic polynomial vector TODO About This Document The latest revision of this draft can be found at . Status information for this document may be found at . Discussion of this document takes place on the Privacy Preserving Measurement Working Group mailing list (), which is archived at . Subscribe at . Source for this draft and an issue tracker can be found at .

Introduction Multiparty Computation (MPC) can perform generic computations over inputs that are never revealed to any single entity. MPC executes an agreed function, revealing only the output of that function. This makes MPC well-suited to handling data that is sensitive or private. MPC in a three-party honest majority setting, is broadly recognized as being extremely efficient:

• Addition and subtraction have zero communication cost and negligible computation cost.
• Multiplication is possible with low communication and computation complexity.
• Strong guarantees can be made about correctness and confidentiality, relying on only information-theoretic assumptions.

This document describes the basic elements required to compute basic MPC circuits in this setting. This includes the basic elements of the replicated secret sharing scheme that is used: generating shares, share addition, and revealing shared values. The bulk of the document describes a protocol for multiplication over a binary field. The basic multiplication protocol scales linearly and involves 1 bit of communication per party. This basic multiplication protocol does not prevent an additive attack. To deal with the additive attack, a batched validation protocol is used, which adds a sub-linear overhead. This protocol comes with significant memory costs and slightly increased computational costs, but adds negligible communication overhead and latency when there are many multiplications to validate.

MPC Protocols in Binary Fields This document describes a multiplication protocol that is specialized for use with binary fields; see . Composing binary operations into a complete MPC system has proven to be more efficient than alternatives using prime fields in a number of applications. Some of the components in this document can be applied to rings or larger prime fields, but the validation process used here has been specialized for use with binary values.

Three-Party Honest Majority MPC A three-party honest majority MPC system performs computations on secret-shared values using a replicated scheme where each party receives two out of three additive shares of input values. Strong guarantees are provided regarding the confidentiality of inputs provided that no pair of parties reveals their shares to either of the other parties. The protocols described in this document depend on having three MPC parties execute them. The protocols described here are secure with abort, even when one party is not honest. Concretely, this means that a single dishonest party cannot cause the value of inputs to be revealed. Also, a single dishonest party cannot alter the output of any operation without detection. The protocol is aborted if honest parties detect an error that might indicate the actions of a dishonest party. This means that a dishonest party can disrupt the protocol

MPC Protocol Prerequisites MPC parties require channels to each of the other parties that provide confidentiality, integrity and peer authentication. Mutually-authenticated TLS provides the necessary capabilities, however, this document does not define how to arrange communication between parties; protocols that use these mechanisms need to define how communication between parties is established. The multiplication protocol described depends on shared randomness for efficiency. The protocol depends on having a way for parties to pairwise agree on random values. MPC parties can execute a coin toss protocol using the communication channel, however it is considerably more efficient to use pseudorandom secret sharing when there are a large number of multiplications. This section describes basic operations of secret sharing (), reveal protocol (), and addition (). Multiplication is more involved and is the subject of subsequent sections (, ).

Fields and Rings The basic multiplication protocol described in operates in any commutative ring, which will be referred to as simply a "ring". A ring is a group that defines addition and multiplication operations that are both associative and commutative. A ring has an additive inverse for every element, which enables subtraction. A ring contains a "zero" element that is an additive identity plus a "one" element that is a multiplicative identity. A simple realization of a ring is formed of integers modulo a chosen integer that is greater than 1. The validation protocol described in this document (see ) uses a modulo 2 ring. This ring is referred to throughput as a binary field as it is also a field and it contains two values: 0 and 1. Addition and multiplication in a binary field correspond to Boolean operations. Addition in a binary field is equivalent to the Boolean exclusive OR (XOR) operation. Multiplication in a binary field is equivalent to the Boolean AND operation. The security properties of the validation protocol depend on the use of a prime field of sufficient size. Fields support the same operations as rings, adding multiplicative inversion of elements, which enables a division operation. A prime field can be realized from integers modulo any prime. The validation protocol integrates the projection of values in a binary field to a larger prime field, rather than requiring a separate conversion step.

Secret Sharing Each input value (x) is split into three shares (x₁, x₂, x₃), such that x = x₁ + x₂ + x₃. Any method can be used, but the following process is typical: Then, each party in the MPC receives a different set of two values. This document adopts the convention that P₁ receives (x₁, x₂), P₂ receives (x₂, x₃), and P₃ receives (x₃, x₁). From this sharing, no single party is able to construct the original value (x), but the values from any two parties include all three shares and can be used to reconstruct the original value. Some protocols might require that the parties construct a sharing of a value which is known to all the parties. In that case, the value of x₁ is set to the known value, with x₂ and x₃ both set to zero.

Identifying Shares and Parties This document identifies shares and parties by number. Three parties are identified as P₁, P₂, and P₃. The first, or left share, value held by each party is identified with the same subscript. The other share, or right share, held by each is the next highest-numbered share (with x₁ being the next highest after x₃). This is illustrated in :

Parties and Shares

Three parties are identified as P₁, P₂, and P₃. The three parties are logically placed in a ring, with higher numbered parties to the right of lower-numbered parties. P₃ is placed to the left of P₁. This means that if a protocol involves sending a value to the left, P₁ sends the value to P₃, P₂ sends to P₁, and P₃ sends to P₂. The sending directions are illustrated in .

Parties and Sending Directions | P₁ +--->+ P₂ +--->| P₃ +--. \ `----' `----' `----' / '---------------------------------' ]]>

Protocols are often described in terms of the actions of a single party. The party to the left of that party is P_- and the party to the right is P₊. Where necessary, the current party is identified as P₌. The two shares that each party holds are referred to as "left" and "right" shares. The "left" share is identified with a subscript of "-" (e.g., x_-); the numeric identifier for the left share at each party matches the identifier for that party, so the left share of x that P₁ holds is named x₁. The right share is designated with a subscript of "+" (e.g., y_+); the numeric identifier for the right share is one higher than the identifier for the party, so the right share at P₃ is (also) x₁.

Reveal Protocol The output of a protocol can be revealed by sending all share values to the entity that will receive the final result. This entity can validate the consistency of the values it receives by ensuring that the replicated values it receives are identical. That is, the value of x₁ received from P₁ is the same as the value of x₁ it receives from P₃ and so forth. If the value of shares are inconsistent, the protocol fails. After discarding these duplicated values, the revealed value is the sum of the shares that it receives. A value can be revealed by sending adjacent parties the one share value they do not have. That is, P₁ sends x₁ to P₂ and x₂ to P₃; P₂ sends x₂ to P₃ and x₃ to P_1; P₃ sends x₃ to P₁ and x₁ to P₂. Each party verifies that they receive the same value twice, and aborts if they do not. If the protocol is executed correctly, each party learns the revealed value, which is the sum of the two shares it holds, plus the share that was received. This basic reveal protocol requires that each party send and receive two elements. More efficient protocols are possible, but these are not defined in this document.

Addition Addition of two values in this setting is trivial and requires no communication between parties. To add x to y, each party adds their shares. That is, to compute z = x + y, each party separately computes the sum of the shares they hold: This produces shares of the sum without requiring communication. A similar process can be used for multiplication with a value that is known to all parties, negation, and subtraction.

Multiplication Protocol The product of two shared values, x and y, is computed using the following process. Since x = x₁ + x₂ + x₃ and y = y₁ + y₂ + y₃ the product z = x · y can be expanded as: This can be illustrated with a 3 by 3 table (): Multiplication by Parts

	y₁	y₂	y₃
x1	x1*y1	x1*y2	x1*y3
x2	x2*y1	x2*y2	x2*y3
x3	x3*y1	x3*y2	x3*y3

To compute the product, each party locally computes the sum of three products as follows: To visualize this, shows cells labeled with the party responsible for computing that partial product:

Multiplication by Party

The result is a non-replicated sharing of the result z = z₁ + z₂ + z₃. To reach the desired state where parties each have replicated shares of z, each party needs to send its share, z₋, to the party to its left. Unfortunately, each party cannot simply send this value to another party, as this would allow the recipient to reconstruct the full input values, x and y, using z₋. To prevent this, the value of z₋ is masked with a uniformly distributed random mask that is unknown to party P_-. Using a source of shared randomness (such as ), each pair of helpers generates a uniformly distributed random value known only to the two of them. Let r₋ denote the left value (known to P_-) and r₊ be the right value (known to P₊). Each party uses r₋ and r₊ to create a masked value of z₋ as follows: Each of these three mask values are added once and subtracted once, so this masking does not alter the result. Importantly, the value of r₊ is not known to P_-, which ensures that z₋ cannot be used by P_- to recover x or y. Thus, z₋ is safe to send to P_-. Upon receiving a value from its right -- which the recipient names z₊ — each helper is now in possession of two-of-three shares, (z₋, z₊), which is a replicated secret sharing of the product of x and y.

Validation Protocol The basic multiplication protocol in only offers semi-honest security. It is secure up to an additive attack; see . Validating multiplications allows an additive attack to be detected, ensuring that a protocol is aborted before any result is produced that might compromise the confidentiality of inputs.

Additive Attack By "additive attack", we mean that instead of sending the value z₋, a corrupted party could instead send z₋ + a. In the context of boolean circuits, the only possible additive attack is to add 1. The multiplication protocol described does not prevent this. Since the value z₋ is randomly distributed, the party (P_-) that receives this value cannot tell if an additive attack has been applied. While an additive attack does not result in information about the inputs being revealed, it corrupts the results. If a protocol depends on revealing certain values, this sort of corruption could be used to reveal information that might not otherwise be revealed. For example, if the parties were computing a function that erases a value unless it has reached some minimum such as: 1000: reveal(total_count) else: reveal(0) ]]> If a corrupted helper wanted to reveal a total_count that was less than 1000, it could add 1 to the final multiplication used to compute the condition total_count > 1000. The result is that values below the minimum are revealed (and values above the minimum are erased), violating the conditions on the protocol.

Malicious Security Before any values are revealed, the parties perform a validation protocol. This protocol confirms that all of the multiplications performed were performed correctly. That is, that no additive attack was applied by any party. If this validation protocol fails, the parties abort the protocol and no values are revealed. All parties destroy the shares they hold.

Overview of the Validation Protocol Each of the parties produces a "Zero Knowledge Proof" (ZKP) that proves to the two other parties (P_- and P₊) that all of the multiplications it performed were done correctly. The two other parties act as "verifiers" and validate this zero knowledge proof. The validation protocol is therefore executed three times, with each party acting as a prover. Each validation can occur concurrently. When operating in a boolean field, if P₌ followed the protocol correctly, this is how they would compute z₋: This can be restated as: The left hand side of this expression will equal zero if the protocol was followed correctly, but it will equal one if there was an additive attack. Validation is made more efficient by validating multiple multiplications at the same time. The above statement can be transformed to yield the result (either zero or one) as a value in a large prime field . These values can be summed across all the multiplications in a large batch. The total sum will be the count of additive attacks applied, which will be zero if the prover correctly followed the protocol. There will not be any wrapping around so long as the number of multiplications in the batch is smaller than the prime used to define the field. For this protocol, the parties will use the field of integers mod p, where p is a large prime.

Distributed Zero-Knowledge Proofs The prover (P₌) needs to prove that for each multiplication in a batch: The left verifier (P_-) knows the values of y₋, x₋, r₋, and z₋. The right verifier (P₊) knows the values of x₊, y₊, r₊. This means that the prover (P₌) does not need to send any of these values to the verifiers. Verifiers use information they already have to validate the proof. Since the two verifiers possess all of this information distributed amongst themselves, this approach is referred to as "Distributed Zero Knowledge Proofs".

Distributed Zero Knowledge Proofs describes a system of zero-knowledge proofs that rely on linear operations. This is expanded in to apply to three-party honest-majority MPC, requiring only O(logN) communication in total. These proofs are able to validate the computation of an inner product, or expressions of the form: This depends on the prover (P₌) and left verifier (P_-) both possessing the n-vector u, the prover (P₌) and the right verifier (P₊) possessing the n-vector v, and the verifiers P_- and P₊ jointly holding shares of the target value, t (that is, P_- holds t₋ and P_- holds t₊ such that t₋ + t₊ = t). However, the security of this protocol requires the vector elements u and v to be members of a large field. So the first step of the validation protocol is to take a batch of multiplications, and convert them into a dot product of vectors with elements in a large field.

Transforming into a Large Prime Field describes how to apply efficiently for binary fields. When binary values are directly lifted into a large field, the XOR operation can be computed with the expression: Using this relation, the expression that must be proven can be converted into a dot-product of two vectors, one of which is known to both P₌ and P_-, the other being known to both P₌ and P₊. Rearranging terms: Define: Then: Using: x ⊕ y = x·(1 - 2·y) + y Using: x ⊕ y = x + y - 2·x·y Distributing and rearranging terms, plus subtracting 1/2 from both sides, produces: Factoring allows this to be written as an expression with four terms, each with a component taken from the left and a component from the right. Components on the left form a vector that can be named g, and components on the right form a vector, h. The result is the dot product of two four dimensional vectors: Alternatively: From this point, each party can compute the vectors that they are able to. P₌ and P_- both compute gᵢ as follows: And where: P₌ and P₊ both compute hᵢ as follows: These vectors form the basis of later stages of the proof.

Validating a batch of multiplications Each multiplication therefore produces two vectors, with each vector being length 4. To validate a batch of m multiplications, the prover (P₌), forms two vectors of length 4m. The prover (P₌), and left verifier (P_-) both produce the vector u by concatenating the vectors from all multiplications: The prover (P₌) and right verifier (P₊) both compute the vector v in the same way: If no additive attacks were applied by the prover, the dot product of these two vectors should be:

Overview of Recursive Proof Compression Now that we have expressed the work of the prover as a simple dot product of two vectors of large field elements, we can use a recursive approach to prove this expression with O(logN) communication. The process is iterative, where at each stage there is a pair of vectors, u and v, and a target, t, where the goal is to prove that u·v = t. The values of u and v start as described in ; with t initially set to a value of -m/2. At each iteration:

1. Select a compression factor L.
2. Chunk the vectors u and v into s segments of length L.
   1. Each chunk of u uniquely defines a polynomial of degree L - 1 which are named pᵢ(x), indexed by i ∊ [0..s).
   2. Each chunk of v uniquely defines a polynomial of degree L - 1 which are named qᵢ(x), indexed by i ∊ [0..s).
3. The polynomial G(x) is defined as: sum(i=0..s, pᵢ(x) · qᵢ(x)) For x ∊ [0..L-1), this polynomial G(x) computes the inner product of a portion of u and v. So the goal becomes proving that sum(i=0..L-1, G(i)) = t. In the first iteration, the target value t is known by all parties to be -m/2, so left verifier (P₋) sets their share t₋ to -m/2 and the right verifier P₊ sets their share t₊ to zero. In subsequent iterations the target value will not be known to both verifiers.
   1. The prover will compute the value of G(0), G(1), ... , G(2L - 2), the minimal number of points required to uniquely define it.
   2. These 2L - 1 points are split into two additive secret-shares G(x)_- and G(x)_+ and sent to the verifiers P₋ and P₊, respectively. These shares form the distributed zero-knowledge proof.
   3. The verifiers each sum together the first L - 1 points they were given: P₋ computes sum₋ = sum(i=0..L-1, G(i)_-). P₊ computes sum₊ = sum(i=0..L-1, G(i)_+). where sum₋ + sum₊ = sum(0..L-1, G(i)).
   4. Now the verifiers verify the proposition sum(i=0..L-1, G(i)) = t by having P₋ compute b₋ = t₋ - sum₋ and P₊ compute b₊ = t₊ - sum₊. They send each other these values and confirm that b₋ + b₊ = 0. If this test fails, the entire protocol is aborted.
4. At this point, the prover could have produced values for G(0..L-1) that pass this test even if they had performed an additive attack. The proof needs to be validated by confirming that G(r) = sum(i=0..s, pᵢ(r) · qᵢ(r)) for a randomly selected challenge point r. As long as the prover cannot control the choice of r, the likelihood that a dishonest prover can cheat without detection is inversely proportional to the field size.
   1. If we define two new vectors u′ = { p₀(r), …, pₛ₋₁(r) }, and v′ = { <q₀(r), …, qₛ₋₁(r) }, then we can rewrite the statement that needs to be proven as: u′ · v′ = G(r). This is of the same form as the original statement, but with the new vectors u′ and v′ having length L times shorter than the original vectors.
   2. u′ and v′ need not be communicated, since the prover and left verifier (P₋) can both compute each value pᵢ(r) using Lagrange interpolation, just as the prover and right verifier (P₊) can compute each value qᵢ(r).
   3. Each of the verifiers can use the 2L - 1 points they received (their share of G(x)) to compute a share of G(r) using Lagrange interpolation. These shares become their share of a new value for t.
   4. The Fiat-Shamir heuristic can be used to generate r by hashing the distributed zero knowledge proof. This transforms this protocol from a multi-round interactive protocol into a constant round protocol.
5. The vectors u and v are replaced by u′ and v′, the value of t is set to G(r), and the next iteration is started.

The recursion ends when the vectors u and v have length less than L. The verifiers validate the soundness of the final iteration of the proof in a simpler, more direct way; see .

Detailed Validation Algorithm

Selecting the Compression Factor For the first iteration, the parties will use a compression factor (L) of 32. In all subsequent rounds they will use a compression factor of 8. Note: A larger value for L increases the compression factor, which reduces the overall communication cost. However, because the computation of the proof requires Lagrange interpolation (which is O(L²) computation), a larger compression factor quickly becomes expensive. A slightly larger compression factor on the first round is possible because there are only a small number of possible input values, so the work can be reduced with the use of lookup tables if necessary.

Producing Polynomials p(x) and q(x) The prover (P₌) and the left verifier (P_-), chunk the vector u into s chunks of length L.

• chunk 0: <u₀, u₁, …, u_L-1>
• chunk 1: <u_L, u_L+1, …, u_2L-1>
• …
• chunk s-1: <u_(s-1)L, u_(s-1)L+1, …, u_sL-1>

If the length of u is not divisible by L, then the final chunk will be padded with zeros. In the first iteration there will be s = ceil(4m / L) chunks, as the original vectors u and v have length 4m. In subsequent iterations there will be fewer chunks. They will interpret each chunk as L points lying on a polynomial, pᵢ(x) of degree L-1, corresponding to the x coordinates { 0, 1, …, L-1 }, that is to say they will interpret them as { pᵢ(0), pᵢ(1), …, pᵢ(L-1) }. The prover (P₌) and left verifier (P_-) can find the value of pᵢ(x) for any other value of x using Lagrange interpolation. The prover (P₌) uses Lagrange interpolation to compute the values { pᵢ(L), pᵢ(L+1), …, pᵢ(2L-2) }. The same process is applied for the vector v with the right verifier, (P₊). The prover (P₌) and the right verifier (P₊), chunk the vector v into s chunks of length L.

• chunk 0: <v₀, v₁, …, v_L-1>
• chunk 1: <v_L, v_L+1, …, v_2L-1>
• …
• chunk s-1: <v_(s-1)L, v_(s-1)L+1, …, v_sL-1>

As before, if the length of v is not a multiple of L, the final chunk will be padded with zeros. Each chunk is interpreted as L points on a polynomial. From this the values { qᵢ(L), qᵢ(L+1), …, qᵢ(2L-2) } are found using using Lagrange interpolation.

Producing the Zero Knowledge Proof In order to prove that u·v = t, the prover will compute the value of 2L-1 points on the polynomial G(x), which is defined as: The prover computes the values of { G(0), G(1), …, G(2L-2) } by incrementally aggregating the products of { pᵢ(0), pᵢ(1), …, pᵢ(2L-21) } and { qᵢ(L), qᵢ(L+1), …, qᵢ(2L-2) }, for each chunk. These 2L-1 points on the polynomial G(x) constitute the zero-knowledge proof that u·v = t. An equivalent method of proving u·v = t, is to show that sum(i=0..L-1, G(i)) = t.

Masking the Zero-Knowledge Proof The prover (P₌), cannot simply send this zero-knowledge proof to the verifiers, as doing so would release private information. Instead, the prover produces a two-part additive secret-sharing of these 2L-1 points, sending one share to each verifier. The prover (P₌) and the right verifier (P₊) generate one share using their shared randomness, which means that no communication is needed. This share is denoted G(x)_+. The prover (P₌) computes the other share via subtraction. That is, G₋(x) = G(x) - G₊(x). This value is sent to the left verifier (P_-). Transmitting this share G(x)_- involves sending 2L-1 field values.

Validating the Proof Increment To check that sum(i=0..L-1, G(i)) = t, the left verifier (P_-) computes: Similarly, the right verifier (P₊) computes: The two verifiers will reveal these values b₋ and b₊ to one another, so that each can reconstruct the full sum, b = b₋ + b₊. Each confirms that b is zero. If it is not, the parties abort and destroy their shares.

Random Challenge Now that the verifiers have confirmed that the proof says that there was no additive attack, they need to validate that this was indeed a legitimate zero-knowledge proof. The prover knows the value of t, even if each verifier only has shares of t after the first round. Therefore, it is trivial for a prover to falsify G(x). To demonstrate that the prover has provided a valid G(x), a random field element, r, is chosen from the range [L, p) (that is, a value that is not part of the proof). The prover then has to show that the value of G(r) matches what the verifiers hold. The verifiers could jointly compute this value using the values of pᵢ(x) and qᵢ(x). The key requirement in choosing r is that the prover cannot influence the choice.

Fiat-Shamir Challenge Selection To minimize the rounds of communication, instead of having the verifiers select this random point, we utilize the Fiat-Shamir transform to produce a constant-round proof system. The prover (P₌) hashes the zero-knowledge proof shares it has generated onto a field element as follows: This computation does not use the entire output of the hash function, just enough to ensure that the value of r has minimal bias. For SHA-256 and a prime field modulo 2⁶¹-1, the bias is in the order of 2^-67, which is negligible. The verifiers generate the same point r independently. Each verifier only has access to one set of shares from G(x) so they each compute a hash of the shares they have. They then send that hash to each other, after which they can concatenate the two hash values and compute the challenge point. Note that one verifier does not need to receive their shares of G(x) from the prover, so they are able to compute their hash before even starting any computation. Consequently, though each round depends on communication, the total latency is two rounds. In the first, the prover sends shares of G(x) to the left verifier. Concurrently, the right verifier sends a hash of their shares to the left verifier. In the second round, the left verifier sends a hash of their shares to the right verifier.

Recursive Proof At the end of each round, the prover is left with the task of proving that G(r) is correct based on the random challenge. r. Recall the definition of G(x): This is equivalent to providing that u′ · v′ = G(r), where: v′ = ]]> This is a problem of exactly the same form as the original problem, except that the length of u′ and v′ is now a factor of L shorter than the original length of u and v. The prover (P₌) and left verifier (P_-) use Lagrange interpolation to compute the value of pᵢ(r) for all chunks in the range 0..s and set this as the new vector u. Similarly, the prover (P₌) and right verifier (P₊) use Lagrange interpolation to compute the value of qᵢ(r) and set this as the new vector v. The target value t is set to G(r). The two verifiers do not learn G(r). Instead, each uses Lagrange interpolation to compute a share of G(r). That is:

The Final Iteration The proof proceeds recursively until the length of the vectors u and v are strictly less than the compression factor L. Next, the prover (P₌) and left verifier (P_-) jointly generate a random field value pₘ using shared secrets. Similarly, the prover (P₌) and right verifier (P₊) generate a random field value qₘ using shared secrets. The prover (P₌) and left verifier (P_-) move u₀ to index L-1. No data will be lost as this replaces a zero value; the length of u is strictly less than L. The value at index 0 is replaced with pₘ. The prover (P₌) and right verifier (P₊) move v₀ to index L-1 and place the value qₘ at index 0. The prover generates a zero knowledge proof from these polynomials exactly as before, sending each verifier 2L-1 shares of G(x). The process of validation then proceeds differently. Firstly, when the verifiers compute their shares of b, they ignore the random value at index 0 of G(x). That is: Verifiers confirm that b₋ + b₊ is zero by exchanging their shares of b. Finally, the left verifier (P_-) computes both p₀(r) and G₋(r), right verifier (P₊) computes q₀(r) and G₊(r), and then the verifiers reveal all of these values to each other. They then both verify that: The addition of random masks (pₘ and qₘ) ensure that revealing G(r) in this way does not reveal anything about the value of the polynomials held by the other party. Revealing q₀(r), which was computed from the random values, only confirms that the prover did not cheat.

Conditions of Usage This protocol requires integration into a larger protocol, which will need to:

• set or negotiate parameters,
• provide communication channels,
• agree on shared secrets, and
• arrange the multiplications that are to be validated into batches.

Recommended Parameters This document recommends several parameters, which are used in the security analysis. Alternative parameters can be used, provided that they meet the stated requirements. For shared secrets, pseudorandom secret sharing is used. For PRSS parameters, HPKE with DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, and AES-128-GCM is RECOMMENDED, with the same KDF being used for PRSS and AES-128 as the PRP. For validation, the prime field used is modulo the Mersenne prime 2⁶¹-1 validation. Any sufficiently large prime can be used, but this value provides both good performance on 64-bit hardware and useful security margins for typical batch sizes; see TODO/below for an analysis of the batch size requirements and security properties that can be obtained by using this particular prime. The Fiat-Shamir transform used in the validation proofs can use SHA-256. However, any preimage and collision-resistant hash function can be used provided that it has a enough output entropy to avoid bias in the selected field value.

Performance Characteristics TODO

• Communication - number of bits sent/received
• Computation - how many times you invoke PRSS
• Vectorization - why it is useful and good
• How to multiply in parallel - sending and receiving, stalling, etc…
• Memory requirements
  • Compression factor and choice
  • Trade-offs - time/memory (factor of 64 during generation of r, for Fiat-Shamir version)
• Multiple rounds or Fiat-Shamir

Security Considerations TODO

• Parameter choice and security margins
  • Talk about trade-off between attack success probability and prime size.
  • Show equation for how many bits of security you get when validating N multiplications
• You can't just use the multiplication protocol without the validation protocol due to the additive attack (explain why)
• Communication security (authentication)
• Constant time and implications thereof
• Fiat-Shamir vs more rounds

IANA Considerations This document has no IANA considerations.

References Normative References Informative References This document specifies version 1.3 of the Transport Layer Security (TLS) protocol. TLS allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery. This document updates RFCs 5705 and 6066, and obsoletes RFCs 5077, 5246, and 6961. This document also specifies new requirements for TLS 1.2 implementations. Springer International Publishing Springer International Publishing USENIX Association This document describes a scheme for hybrid public key encryption (HPKE). This scheme provides a variant of public key encryption of arbitrary-sized plaintexts for a recipient public key. It also includes three authenticated variants, including one that authenticates possession of a pre-shared key and two optional ones that authenticate possession of a key encapsulation mechanism (KEM) private key. HPKE works for any combination of an asymmetric KEM, key derivation function (KDF), and authenticated encryption with additional data (AEAD) encryption function. Some authenticated variants may not be supported by all KEMs. We provide instantiations of the scheme using widely used and efficient primitives, such as Elliptic Curve Diffie-Hellman (ECDH) key agreement, HMAC-based key derivation function (HKDF), and SHA2. This document is a product of the Crypto Forum Research Group (CFRG) in the IRTF.

Acknowledgments This work is a direct implementation of the protocols described in , which builds on a lot of prior academic work on MPC.