UROP report

Consider a public boolean function f : (X, Y ) → {0, 1} where X and Y are private inputs polynomial size. Let Mf be the matrix truth table of f . A protocol for securely computing f is a protocol between two parties Alice and Bob where Alice chooses x ∈ X and Bob chooses y ∈ Y , such that at the end each party knows f(x, y) but gains no more information about the other’s input. Such protocols have been known for decades for general (non-boolean, multi-party) f , for example using Yao’s garbled circuit protocol [1], but these protocols are unfair if one party aborts the computation early. If one party learns the result of f before the other and refuses to continue the computation, the result of the protocol is that one party learns the output and the other one knows that an abort occurred; this is known as being secure-with-abort. Since the development of secure-with-abort protocols a line of research has tried to develop fair secure computation, where an adversary gains little advantage by aborting early (where the definition of “advantage” has varied). An early result by Cleve [2] on the hardness of coin flipping showed that any protocol to securely compute the xor function gives one player an advantage of at least 1/r in guessing the function output, where r is the number of rounds in the protocol. This c Recently, a paper by Gordon, Hazay, Katz, and Lindell (GHKL) [3] revisited the problem of complete fairness, where aborting gives an adversary subpolynomial advantage. They gave two protocols for securely computing certain classes of functions with complete fairness. One protocol was restricted to functions with triangular Mf , but the other protocol applied to a more general class of functions.