1
$\begingroup$

In this paper on pg. 1248 in the "preprocessing phase" section the authors say:

In the preprocessing phase, the parties run a (standard) MPC to collectively generate a key pair (pk,sk) for the FHE scheme, and to secret share sk in such a way that (a) learning the shares of corrupted parties, and leakage on each remaining share, does not damage the security of the FHE, but (b) collectively, the shares can be used to evaluate the decryption circuit in a leaky environment

Part (a) above makes me believe there is a risk with FHE security being damaged. Is it possible to use another encryption scheme where this risk is mitigated ?

$\endgroup$
1
  • 1
    $\begingroup$ Page 1248? Damn. $\endgroup$
    – orlp
    Nov 27, 2013 at 7:48

1 Answer 1

1
$\begingroup$

Part (a) above makes me believe there is a risk with FHE security being damaged. Is it possible to use another encryption scheme where this risk is mitigated ?

I'm not sure what you mean by that. In what way is security damaged? All ciphers risk security being damaged by leakage. For example if the key leaks, security is damaged.

I think what they are saying is, they distribute shares of the secret key to all parties. This needs to be done in such a way that even if all corrupted parties get together and reveal their shares to each other. And additionally reveal any leaked information they have gleaned during the protocol execution, the original secret key $sk$ cannot be reconstructed.

As a more concrete example, say we are using additive secret sharing. Assume some number of parties is corrupt (say $n/2$). Thus we assume the adversary knows all of those $n/2$ shares. But there are $n/2$ shares held by uncorrupt parties that are not known to the adversary. Assume, however, that some information about those shares is leaked (not sure what that info is, perhaps they say in the paper). They are saying that even given that information, the security of the FHE should not be damaged.

$\endgroup$
1
  • $\begingroup$ I understand what you are saying - but I guess they are not clear about how exactly FHE would be damaged. $\endgroup$ Nov 30, 2013 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.