How do you prevent the risk of damage to the security of Fully Homomorphic Encryption?

Question

In this paper on pg. 1248 in the "preprocessing phase" section the authors say:

In the preprocessing phase, the parties run a (standard) MPC to collectively generate a key pair (pk,sk) for the FHE scheme, and to secret share sk in such a way that (a) learning the shares of corrupted parties, and leakage on each remaining share, does not damage the security of the FHE, but (b) collectively, the shares can be used to evaluate the decryption circuit in a leaky environment

Part (a) above makes me believe there is a risk with FHE security being damaged. Is it possible to use another encryption scheme where this risk is mitigated ?

Answer 1

Part (a) above makes me believe there is a risk with FHE security being damaged. Is it possible to use another encryption scheme where this risk is mitigated ?

I'm not sure what you mean by that. In what way is security damaged? All ciphers risk security being damaged by leakage. For example if the key leaks, security is damaged.

I think what they are saying is, they distribute shares of the secret key to all parties. This needs to be done in such a way that even if all corrupted parties get together and reveal their shares to each other. And additionally reveal any leaked information they have gleaned during the protocol execution, the original secret key $sk$ cannot be reconstructed.

As a more concrete example, say we are using additive secret sharing. Assume some number of parties is corrupt (say $n/2$). Thus we assume the adversary knows all of those $n/2$ shares. But there are $n/2$ shares held by uncorrupt parties that are not known to the adversary. Assume, however, that some information about those shares is leaked (not sure what that info is, perhaps they say in the paper). They are saying that even given that information, the security of the FHE should not be damaged.