A note on secure multiparty computation via higher residue symbols

1 Introduction

In secure multiparty computation (MPC), a group of parties, each of which has some secret data, wish to collaboratively compute a function on it without revealing their inputs. A common technique for this is to represent the inputs as elements of a finite field 𝔽_p and represent the function as an arithmetic circuit over that finite field, i.e. as an expression consisting of nested sums and products over 𝔽_p involving the inputs and public values, and then process this circuit gate-by-gate. For example in secret-sharing based secure multiparty computation protocols, inputs are secret shared among the parties using a linear secret sharing scheme, such as Shamir's scheme [10] or additive secret sharing. In such a scheme, addition of two secrets and multiplication of a secret by a public value can be done by simply performing the operation locally. Multiplication of two secrets can be achieved with a small amount of additional communication between the parties. See for example the book [4] for details about how this plays out in a number of secret-sharing based MPC protocols. But many other operations are more complicated to perform in a secret shared setting, especially those that do not correspond to natural operations in a finite field. Examples for this are integer comparison, integer division and modular reduction by values that are coprime to p. Protocols that compute such operations often rely on decomposing a shared value into its binary representation, after which the operation can be performed on secret shared bits [e.g. 5]. However, this decomposition involves a significant computational and communication cost, so there is much interest in more straightforward protocols for these operations. There are other protocols which do not rely on the decomposition of shared values, but still operate in a bitwise manner by using random pre-decomposed sharings [9].

An alternative idea for comparison of secret values is given in [12]. Their protocol attempts to compute the sign of a secret shared value [a]_𝔽p by computing the Legendre symbol (a | p). For this to work, they must choose the prime modulus p in such a way that all values {1, . . . , N} are quadratic residues modulo p, for a relatively large N, and that −1 is a quadratic non-residue. Then, it holds that sgn(a) = (a | p) for − N ≤ a ≤ N. Two integers a and b can then be compared by computing sgn(a − b) = (a − b | p), assuming |a − b| ≤ N. The Legendre symbol can be computed relatively easily in a secret-shared setting using a few rounds of precomputation and a single online round. Yu shows that at any given order of magnitude, a prime p can be found which satisfies the desired properties with N being of size Ω(log p). The inspiration for this protocol comes from [7], where the idea is first presented for the special case N = 2, p = 7.

In [1], the authors improve on Yu's method and extend the range where the comparison is valid by a factor of roughly three, for a given modulus size. They achieve this by computing the residue symbol on a small neighbourhood of the input value and performing a majority vote. They also provide another protocol that increases the valid range by a factor of five compared to Yu, but requires an additional online round.

Our contribution

In this paper, we present a generalization of the idea of [12] by using the residue symbol in a cyclotomic ring ℤ[ζ_r], for some odd prime r. The goal is to compute a chosen function f : A → {0, . . . , r − 1} in a limited domain A ⊂ 𝔽_p[ζ_r]. We develop a method for finding a prime number p such that the r-th power residue symbol coincides with f on the domain A, when this is possible:

As in [12], our protocol requires an offline precomputation phase, but has an online phase consisting of a single round. As an added benefit, the output of f is obtained in a one-hot encoding, which can be helpful if it is e.g. used in a condition for a branching algorithm.

Unfortunately, we are not currently aware of a practical use of our protocol, since the limitations on the size of A are too strict. However, we hope that our new ideas motivate future work that can lessen these restrictions and find applications where our idea outperforms existing solutions.

Outline of the paper

In Section 2, we present basic definitions and facts about the power residue symbol in a cyclotomic ring. We then present the idea of our protocol in Section 3, and in Section 4 we explain in detail how to compute the residue symbol. Then, in Section 5, we present a method for finding an appropriate modulus p given a desired function to compute. We give a toy example in Section 6 to illustrate our ideas. Finally, in Section 7, we compare our method to other constant-round protocols for computing arbitrary functions.

2 The power residue symbol

Let r be an odd prime. Let R = ℤ[ζ_r] be the r-th ring of cyclotomic integers, considered as a subring of ℂ. Here, ζ_r is a primitive r-th root of unity. If 𝔟 is an ideal of R, we denote by N𝔟 its norm.

If a ∈ R is coprime to r and not a unit, then there is a unique k ∈ {0, . . . , r − 1} such that ζrka is primary.

3 The basic idea

The basic idea of our protocol is the following. Suppose we are given a function f : A → {0, . . . , r − 1}, where A is a subset of R. We hope to find a prime number p such that the function f corresponds to the r-th power residue symbol with lower argument p on A. That is,

Then, we can securely compute f (a) by computing the residue symbol, which can hopefully be done more efficiently.

We will see in Section 5 how we can find such a prime p. Note however, that condition (1) often contains internal contradictions or other impossible requirements. It is then necessary to adapt A and f to resolve these.

Let us note some initial requirements on the prime p. First, we want that (p) is a prime ideal of R, which is the case whenever p is different from r and does not split in R. We need this to be the case so that we can use basic facts about (a | p)_r, and so that F = R/(p) is a finite field of size p^r−1. For reasons we will see later, we also wish for the value (ζ_r | p)_r to be ζ_r. It would be possible to fix it to another primitive root of unity, but that would complicate our analysis. We will show in Section 5 how to achieve this.

In our protocol, we will be using the fields 𝔽_p and F = R/(p). Note that an element in F can be represented by r − 1 elements of 𝔽_p via the basis {1,ζr,…,ζrr−2} . So given a linear secret sharing scheme over 𝔽_p, we can consider a sharing of an element in F as a sharing of r − 1 elements of 𝔽_p. See Section 4 for details.

Since the residue symbol (a | p)_r depends only on a modulo p, it is now possible to evaluate the function f at a ∈ A by instead evaluating (a | p)_r. We will see in Section 4 how to do this efficiently.

4 Secure computation of the residue symbol

We will show how to compute the power residue symbol based on any arithmetic black-box protocol over the field 𝔽_p, for example based on secret sharing. This is analogous to how the Legendre symbol is computed in [12]. We note that only the upper argument of the residue symbol is secret, whereas the lower argument p is public. In order to explain how we do this, we first need to detail the model in which we will work.

Secure computation model

We consider the usual situation in secure multiparty computation: n parties P₁, . . . , P_n want to jointly compute the output of certain (public) function on private inputs which belong to some of the parties, by means of some protocol in which the parties can communicate over point-to-point secure channels between each pair of parties.

We will consider a static, semi-honest adversary, that corrupts some subset of parties at the onset of the protocol, and gets to see all communication received by these parties, but cannot make them deviate from the protocol.^[1] Security in this case means the adversary cannot infer more information about non-corrupted parties’ inputs and outputs than what is already implied by the corrupted parties’ inputs and outputs.

Our techniques work in fact on top of any secure computation protocol for arithmetic operations over 𝔽_p. This means that any given party can create an encoding [x]_𝔽p of a value x ∈ 𝔽_p known to that party, so that: the adversary cannot obtain any knowledge about x from [x]_𝔽p ; there is a protocol that allows the set of all parties to recover x ∈ 𝔽_p from [x]_𝔽p ; and given sharings of elements x, y ∈ 𝔽_p (where x, y may not be known by the same party, in fact they may not be known by anybody) there are secure computation subprotocols that allow parties to compute encodings for x + y, xy and ax for public a ∈ 𝔽_p (denoted respectively [x + y]_𝔽p = [x]_𝔽p + [y]_𝔽p, [xy]_𝔽p = [x]_𝔽p [y]_𝔽p, [ax]_𝔽p = a[x]_𝔽p).

The customary example for this are secret-sharing based secure computation protocols, where the encoding [·]_𝔽p is given by a secret sharing scheme. This scheme is furthermore often linear, which allows computing [x + y]_𝔽p (resp. [ax]_𝔽p) given [x]_𝔽p, [y]_𝔽p (resp. a and [x]_𝔽p) by having each party operate locally on their shares, i.e., it requires no interaction among parties.

There exist many secret-sharing based arithmetic protocols which are secure against different types of adversaries, depending on which sets of parties the adversary can corrupt (the adversary structure) and whether we assume a restriction on the computational capabilities of the adversary or not (where we speak respectively of computational or information-theoretical security). For example, one can construct arithmetic black-box protocols which are information-theoretically secure against adversaries that can corrupt any set of t parties where t < n/2, and protocols which are computationally secure against adversaries corrupting any set of n − 1 parties.

Our protocols will inherit the security properties from the arithmetic black-box protocol over 𝔽_p, with respect to the adversary structure and adversary computational capabilities it tolerates.

Preprocessing

A usual resource in secure multiparty computation protocols is preprocessing: the fact that parties can initiate and typically carry out the heavy part of the secure computation protocol even before the (encoded) inputs are provided. That is, we can split the computation in two phases: a preprocessing, or offline phase, which is the phase carried out before the inputs are given and where the parties compute encodings of random correlated information; and an online phase, which uses the input and is typically much lighter. We will use this approach in our protocols too.

From encodings over 𝔽_p to encodings over F

As mentioned before, an encoding (e.g. a sharing) [x]_F of an element in F will simply be the encoding in 𝔽_p of each of its coordinates x_i ∈ 𝔽_p with respect to the basis {1,ζr,…,ζrr−2} , i.e. ([x]_0𝔽p, [x]_1𝔽p, . . . , [x]_r−2𝔽p). Both additions and products of F-encodings can be obtained by operating on the 𝔽_p-encodings of their coordinates. Specifically, additions of two F-encodings require r − 1 additions of 𝔽_p-encodings (by just adding coordinate-wise the vectors of 𝔽_p-encodings), so in the case of a linear secret sharing scheme it can be done locally by the shareholders. Multiplying by a public constant in R can also be done locally, but it may involve up to O(r²) additions and multiplications of 𝔽_p-encodings by 𝔽_p-constants (depending on the public constant). Finally, products of two F-encodings require O(r²) products and O(r²) additions of 𝔽_p-encodings.

Inversions of roots of unity

Our algorithms will also need to invert F-encodings of r-th roots of unity in R (seen as elements in F), that is the elements ζri, i=0,…,r−1 . Note that (ζri)−1=ζrr−1 . Moreover, in the basis {1,ζr,…,ζrr−2} , ζri is given by the i-th unit vector (numbering from 0 to r − 2) if i < r − 1, and by the vector (−1, −1, . . . , −1) if i = r − 1, since ζrr−1=−1−ζr−⋯−ζrr−2 .

Therefore, given [x]_F = ([x]_0𝔽p, [x]_1𝔽p, [x]_2𝔽p . . ., [x_r−2]_𝔽p) where x=ζri for some i, it is easy to see that

In particular, if the 𝔽_p-encoding is given by a linear secret sharing scheme, these inversions can be computed locally.

Computing random elements of F

The parties can compute a uniformly random element of F in the usual way, described in Algorithm 1. Each party P_i chooses and shares a uniformly random value [x_i]_F. These values are then summed up: [x]F=∑i=0n[xi]F . In this way, the value x is uniformly random and secret.

Arithmetic operations with random elements

Given [x]_F, [r]_F, where r is uniformly random in the sense above, opening [x + r]_F gives no additional information about x apart from the a priori knowledge parties might have about x. If parties open [xr]_F and find out that xr ≠ 0, the only new information parties may learn about x is that x ≠ 0, but all other information about x is protected.

Computing a random solved instance

In a preprocessing phase, the parties need to compute a random solved instance of the power residue symbol. That is, they want a pair of shared values ([x]_F, [x′]_F), where x′ = (x | p)_r and x is uniformly random in F^* and unknown to the parties. To do this, we proceed as in [12], and in Algorithm 2. The parties first select two uniformly random shared values [a]_F and [b]_F and multiply them: [d]_F = [a]_F[b]_F. They then compute and open f = d^r. If this is zero, they abort. Otherwise, they know that a and d are uniformly random and independent elements of F^*, since F is a finite field. The parties then compute an r-th root d^ of f in the clear. We see that d/d^ is a uniformly random r-th root of unity. Hence,

constitute a uniformly random solved instance. Recall that we require (ζ_r | p)_r = ζ_r, so that (d/d^ | p)r=d/d^

Computing the residue symbol

In the online phase, described in Algorithm 3, the parties then wish to compute the residue symbol of a secret shared value [a]_F. We assume that a is known to be nonzero, which can be guaranteed by using a suitable encoding, as in Remark 6. Suppose we have a fresh random solved instance ([x]_F, [x′]_F). The parties compute and open ax, which is uniformly random in F^* and hence does not reveal any information about a. They can then compute the residue symbol (ax | p)_r in the clear, and finally obtain

Computational and communication cost

The offline phase (Algorithm 2) can be optimized using the unbounded fan-in multiplication of [9], based on [2], which takes 3 rounds, 2l invocations of Algorithm 1 and 3l − 1 multiplications to secretly multiply l values. Since the first two rounds of the unbounded fan-in multiplication protocol are independent of the inputs, the values [a]_F and [b]_F can be generated and [d]_F = [a]_F[b]_F computed at the same time. Then, [d]Fr and [a]Fr[d]F are computed, and [d]Fr opened, in the third round. This gives a total cost of 3 rounds, as well as 2r + 3 invocations of Algorithm 1 and 6r + 2 multiplications of elements in F.

The online phase costs a single multiplication in F and one opening, which can be done in a single round. Recall that computing the inverse of a root of unity can be done locally.

Recall that multiplication of elements in F is more expensive than multiplication in 𝔽_p, a naïve implementation taking O(r²) multiplications in the base field, which however can be done in parallel in a single round. Also, unbounded fan-in multiplication precludes the use of square-and-multiply methods for exponentiation. However, since the exponent r is typically very small, that is not necessary.

5 Finding the modulus

We are looking for a suitable prime modulus p by checking the conditions (1) for many primes p. While it is possible to do this by simply computing (a | p)_r for all a ∈ A, the computation of the residue symbol is relatively expensive in practice. In the following, we instead translate the conditions into equations of the form p ∈ M_a (mod N_a) for a ∈ A, where M_a ⊆ ℤ/N_aℤ and N_a > 1, which are much faster to check.

Recall from Section 3 that we want (p) to be a prime ideal of R. This is equivalent to p being a generator of the multiplicative group 𝔽r* , by [8, Theorem 2, p. 196]. Hence, this condition depends only on p modulo r. Furthermore, we wish to fix (ζ_r | p)_r = ζ_r. Since

by definition, this is equivalent to having p^r−1 ≡ r + 1 (mod r²). This gives us the first equation for p: let

Then, we require that p ∈ M₀ (mod r²).

We now wish to impose a condition of the form (a | p)r=ζrℓ for some a ∈ R \ {0} and ℓ ∈ ℤ. We need to distinguish multiple cases.

Case 1: a is a unit

By Theorem 4, we can write a=±ζrku , where k ∈ ℤ and u is a positive real unit. Applying Lemma 5, we see that

which is independent of p. Requirements of this form are hence satisfied either for all primes under consideration or for none. If it is never satisfied, the requirements need to be adjusted by choosing a new encoding as in Remark 6.

Case 2: a is coprime to r and not a unit

There is some k ∈ ℤ such that a^=ζrka is primary. So we want that p is coprime to a and

the last equation holds because the value of the residue symbol (p | â)_r depends only on p modulo N(â). This gives us another modular equation for p: let

Then, we require that p ∈ M_a (mod N(â)).

Case 3: a is not coprime to r

Let first μ=1−ζr2 , which is a prime element of R. Note that

by Lemma 5, since ζr−1−ζr is purely imaginary. The ideal (r) factors as (μ)^r−1 in R, so we can write a = μ^m ã for some m > 0 and ã coprime to r. (m is the valuation of a at (μ).) We proceed as before with ã instead of a. If ã is a unit, then as in Case 1, the requirement is either always satisfied or never. If ã is not a unit, let k ∈ ℤ such that a^=ζrka˜ is primary. We end up with the set

and we require that p ∈ M_a (mod N(â)).

6 Toy example

We present an example, in which we compute reduction modulo 3 for integers x ∈ {0, . . . , n} for some small n. We pick r = 3. This example was constructed with the help of the Sage computer algebra system [11].

Setting A = {0, . . . , n} and f (x) = x mod 3 cannot work for this, since (x | p)_r = 1 for all valid primes p and x ∈ ℤ with p ∤ x, by Lemma 5. Instead, we encode the problem as follows. Let n = 18, and

This encoding was found by trial and error. Then, following our procedure from Section 5, we get

For e.g. a = 11 + 5ζ_r, we have f (a) = ℓ = 2, so we want (a | p)r=ζr2 . We have N(a) = 91, so a is coprime to 3. Furthermore, â = ζ_ra = 6ζ_r − 5 is primary, so k = 1. We hence get

Similarly, we find M_a for all other a ∈ A.

Finally, we use brute force to find a prime p which lies in M₀ and in each M_a after the appropriate modular reduction. The smallest one is

We conclude that

for 0 ≤ x ≤ 18.

One can show that it is not possible to extend the example above to a = 11 + 19ζ_r.

7 Alternatives

There are several alternatives for computing an arbitrary function f : A → {0, . . . , r − 1} in a secret shared manner using a constant number of rounds.^[3]

For example, one may use Lagrange interpolation to find a degree |A| − 1 polynomial F ∈ R[x] that agrees with f on A. The polynomial can then be evaluated in three rounds using unbounded fan-in multiplication [2, 9], the first two of which can be done in precomputation. This compares favourably to our protocol, which has three offline and one online round. Furthermore, polynomial interpolation works for any prime modulus larger than max{|A|, r}, whereas our protocol requires a specific and much larger prime modulus. On the other hand, our protocol has the advantage of requiring fewer multiplications, namely O(r) instead of O(|A|).

One could also consider decomposing f into a sequence of two-valued functions f₁, . . . , f_k : A → {0, 1} and computing each using the Legendre symbol. It would then be necessary to find k different (affine) encodings E_i : A → ℤ, 1 ≤ i ≤ k, and a prime p such that f_i(a) agrees with 2(E_i(a) | p) − 1 simultaneously for all i. Such encodings could be found using similar ideas to those presented in Section 5.3 and [12]. If we assume that the E_i have disjoint images, and that the residue symbol on the elements of these images are uniformly random and independent, this would give us a p of expected size O(2^k|A|k|A|). If we use a one-hot encoding to represent f (x) = 1f₁(x) + · · · + (r − 1)f_r−1(x), we get k = r − 1, which results in a much larger estimate for p than in our method. One could instead choose k = ⌈log₂ r⌉ and encode f as a Boolean circuit in the f_i. This would result in a similar expected size for p as in our protocol, but may require extra rounds to evaluate the circuit, especially if a one-hot encoding of the output is desired. Compared to our protocol, this method takes the same number of offline rounds, but either gives a larger expected p or requires extra online rounds. In some cases, the estimate for p can be improved by choosing E_i with overlapping images. For example, using a one-hot encoding for the function f (x) = x mod 3 of our toy example, one may notice that f₂(x) = f₁(x − 1) and so use two mostly overlapping encodings.

8 Conclusion

We have introduced a protocol for secure multiparty computation which allows the evaluation of certain desired functions f : A → {0, . . . , r − 1} on secret shared values, for a small subset A ⊂ ℤ[ζ_r] of the r-th cyclotomic ring, where r is a small prime. Our protocol is a generalization of a protocol by Yu [12], and makes use of the residue symbol of ℤ[ζ_r], by getting it to agree with the desired function on A. It uses only a single round in the online phase, and a constant number of offline preprocessing rounds.

We can then use this idea to compute a function g over a more “natural” domain, like A′ ⊂ ℤ, by first encoding it as a function f : A → {0, . . . , r − 1} in a suitable way. As we have shown in the example, there may be different ways of doing this encoding, and the feasibility and performance of our technique may depend on the chosen encoding.

It is an open question to find concrete applications where our protocol has significant advantages over alternative solutions, such as polynomial interpolation. It is also of interest to improve and formalize the methods of encoding a desired function in such a way as to be compatible with the residue symbol, and so that p remains reasonably small, which so far we have mostly done by trial and error.