Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

In this paper on pg. 1248 in the "preprocessing phase" section the authors say:

In the preprocessing phase, the parties run a (standard) MPC to collectively generate a key pair (pk,sk) for the FHE scheme, and to secret share sk in such a way that (a) learning the shares of corrupted parties, and leakage on each remaining share, does not damage the security of the FHE, but (b) collectively, the shares can be used to evaluate the decryption circuit in a leaky environment

Part (a) above makes me believe there is a risk with FHE security being damaged. Is it possible to use another encryption scheme where this risk is mitigated ?

share|improve this question
    
Page 1248? Damn. –  nightcracker Nov 27 '13 at 7:48

1 Answer 1

up vote 1 down vote accepted

Part (a) above makes me believe there is a risk with FHE security being damaged. Is it possible to use another encryption scheme where this risk is mitigated ?

I'm not sure what you mean by that. In what way is security damaged? All ciphers risk security being damaged by leakage. For example if the key leaks, security is damaged.

I think what they are saying is, they distribute shares of the secret key to all parties. This needs to be done in such a way that even if all corrupted parties get together and reveal their shares to each other. And additionally reveal any leaked information they have gleaned during the protocol execution, the original secret key $sk$ cannot be reconstructed.

As a more concrete example, say we are using additive secret sharing. Assume some number of parties is corrupt (say $n/2$). Thus we assume the adversary knows all of those $n/2$ shares. But there are $n/2$ shares held by uncorrupt parties that are not known to the adversary. Assume, however, that some information about those shares is leaked (not sure what that info is, perhaps they say in the paper). They are saying that even given that information, the security of the FHE should not be damaged.

share|improve this answer
    
I understand what you are saying - but I guess they are not clear about how exactly FHE would be damaged. –  user1068636 Nov 30 '13 at 15:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.