Oblivious linear evaluation is a generalization of oblivious transfer, whereby two distrustful parties obliviously compute a linear function, f(x)=ax+b , i.e., each one provides their inputs that remain unknown to the other, in order to compute the output f(x) that only one of them receives. From both a structural and a security point of view, oblivious linear evaluation is fundamental for arithmetic-based secure multi-party computation protocols. In the classical case, oblivious linear evaluation protocols can be generated using oblivious transfer, and their quantum counterparts can, in principle, be constructed as straightforward extensions using quantum oblivious transfer. Here, we present the first, to the best of our knowledge, quantum protocol for oblivious linear evaluation that, furthermore, does not rely on quantum oblivious transfer. We start by presenting a semi-honest protocol, and then extend it to the dishonest setting employing a commit−and−open strategy. Our protocol uses high-dimensional quantum states to obliviously compute f(x) on Galois Fields of prime and prime-power dimension. These constructions utilize the existence of a complete set of mutually unbiased bases in prime-power dimension Hilbert spaces and their linear behaviour upon the Heisenberg-Weyl operators. We also generalize our protocol to achieve vector oblivious linear evaluation, where several instances of oblivious linear evaluation are generated, thus making the protocol more efficient. We prove the protocols to have static security in the framework of quantum universal composability.Oblivious linear evaluation is a generalization of oblivious transfer, whereby two distrustful parties obliviously compute a linear function, f(x)=ax+b , i.e., each one provides their inputs that remain unknown to the other, in order to compute the output f(x) that only one of them receives. From both a structural and a security point of view, oblivious linear evaluation is fundamental for arithmetic-based secure multi-party computation protocols. In the classical case, oblivious linear evaluation protocols can be generated using oblivious transfer, and their quantum counterparts can, in principle, be constructed as straightforward extensions using quantum oblivious transfer. Here, we present the first, to the best of our knowledge, quantum protocol for oblivious linear evaluation that, furthermore, does not rely on quantum oblivious transfer. We start by presenting a semi-honest protocol, and then extend it to the dishonest setting employing a commit−and−open strategy. Our protocol uses high-dimensional quantum states to obliviously compute f(x) on Galois Fields of prime and prime-power dimension. These constructions utilize the existence of a complete set of mutually unbiased bases in prime-power dimension Hilbert spaces and their linear behaviour upon the Heisenberg-Weyl operators. We also generalize our protocol to achieve vector oblivious linear evaluation, where several instances of oblivious linear evaluation are generated, thus making the protocol more efficient. We prove the protocols to have static security in the framework of quantum universal composability.

arXiv:2204.14171QuantumOct 23, 20241 citation

Efficient Secure Multi-party Computation

Martin Hirt, Ueli M. Maurer, Bartosz Przydatek

Lecture notes in computer scienceJan 1, 2000123 citations

Quantum linear polynomial evaluation based on XOR oblivious transfer compatible with classical partially homomorphic encryption

Li Zhi Yu, Xu, Jie, Fuqun Wang +1 more

XOR oblivious transfer is a universal cryptographic primitive that can be related to linear polynomial evaluation. We firstly introduce some bipartite quantum protocols for XOR oblivious transfer, which are not secure if one party cheats, and some of them can be combined with a classical XOR homomorphic encryption scheme for evaluation of linear polynomials modulo 2 with hybrid security. We then introduce a general protocol using modified versions of the XOR oblivious transfer protocols to evaluate linear polynomials modulo 2 with partial information-theoretic security. When combined with the ability to perform arbitrary quantum computation, this would lead to deterministic interactive two-party computation which is quite secure in the information-theoretic sense when the allowed set of inputs is large. For the task of classical function evaluation, although the quantum computation approach is still usable, we also discuss purely classical post-processing methods based on the proposed linear polynomial evaluation protocols.XOR oblivious transfer is a universal cryptographic primitive that can be related to linear polynomial evaluation. We firstly introduce some bipartite quantum protocols for XOR oblivious transfer, which are not secure if one party cheats, and some of them can be combined with a classical XOR homomorphic encryption scheme for evaluation of linear polynomials modulo 2 with hybrid security. We then introduce a general protocol using modified versions of the XOR oblivious transfer protocols to evaluate linear polynomials modulo 2 with partial information-theoretic security. When combined with the ability to perform arbitrary quantum computation, this would lead to deterministic interactive two-party computation which is quite secure in the information-theoretic sense when the allowed set of inputs is large. For the task of classical function evaluation, although the quantum computation approach is still usable, we also discuss purely classical post-processing methods based on the proposed linear polynomial evaluation protocols.

arXiv:2305.11114May 18, 20230 citations

Fast Vector Oblivious Linear Evaluation from Ring Learning with Errors

Leo de Castro, Chiraag Juvekar, Vinod Vaikuntanathan

Oblivious linear evaluation (OLE) is a fundamental building block in multi-party computation protocols. In OLE, a sender holds a description of an affine function $f_α,β (z)=α z+β$ , the receiver holds an input x, and gets α x+β$ (where all computations are done over some field, or more generally, a ring). Vector OLE (VOLE) is a generalization where the sender has many affine functions and the receiver learns the evaluation of all of these functions on a single point x. The state-of-the-art semi-honest VOLE protocols generally fall into two groups. The first group relies on standard assumptions to achieve security but lacks in concrete efficiency. These constructions are mostly based on additively homomorphic encryption (AHE) and are classified as "folklore". The second group relies on less standard assumptions, usually properties of sparse, random linear codes, but they manage to achieve concrete practical efficiency. In this work, we present a conceptually simple VOLE protocol that derives its security from a standard assumption, namely Ring Learning with Errors (RLWE), while still achieving concrete efficiency comparable to the fastest VOLE protocols from non-standard coding assumptions~\citeADI+17, BCGI18, SGRR19. Furthermore, our protocol admits a natural extension to batch OLE (BOLE), which is yet another variant of OLE that computes many OLEs in parallel.Oblivious linear evaluation (OLE) is a fundamental building block in multi-party computation protocols. In OLE, a sender holds a description of an affine function $f_α,β (z)=α z+β$, the receiver holds an input x, and gets α x+β$ (where all computations are done over some field, or more generally, a ring). Vector OLE (VOLE) is a generalization where the sender has many affine functions and the receiver learns the evaluation of all of these functions on a single point x. The state-of-the-art semi-honest VOLE protocols generally fall into two groups. The first group relies on standard assumptions to achieve security but lacks in concrete efficiency. These constructions are mostly based on additively homomorphic encryption (AHE) and are classified as "folklore". The second group relies on less standard assumptions, usually properties of sparse, random linear codes, but they manage to achieve concrete practical efficiency. In this work, we present a conceptually simple VOLE protocol that derives its security from a standard assumption, namely Ring Learning with Errors (RLWE), while still achieving concrete efficiency comparable to the fastest VOLE protocols from non-standard coding assumptions~\citeADI+17, BCGI18, SGRR19. Furthermore, our protocol admits a natural extension to batch OLE (BOLE), which is yet another variant of OLE that computes many OLEs in parallel.

Nov 5, 202119 citations

Oblivious linear evaluation (OLE) is a fundamental building block in multi-party computation protocols. In OLE, a sender holds a description of an affine function

f_α,β (z)=α z+β

, the receiver holds an input x, and gets α x+β$ (where all computations are done over some field, or more generally, a ring). Vector OLE (VOLE) is a generalization where the sender has many affine functions and the receiver learns the evaluation of all of these functions on a single point x. The state-of-the-art semi-honest VOLE protocols generally fall into two groups. The first group relies on standard assumptions to achieve security but lacks in concrete efficiency. These constructions are mostly based on additively homomorphic encryption (AHE) and are classified as "folklore". The second group relies on less standard assumptions, usually properties of sparse, random linear codes, but they manage to achieve concrete practical efficiency. In this work, we present a conceptually simple VOLE protocol that derives its security from a standard assumption, namely Ring Learning with Errors (RLWE), while still achieving concrete efficiency comparable to the fastest VOLE protocols from non-standard coding assumptions~\citeADI+17, BCGI18, SGRR19. Furthermore, our protocol admits a natural extension to batch OLE (BOLE), which is yet another variant of OLE that computes many OLEs in parallel.