More Communication Lower Bounds for Information-Theoretic MPC
IACR Cryptology ePrint Archive
We prove two classes of lower bounds on the communication complexity of information-theoretically secure multiparty computation. The first lower bound applies to perfect passive secure multiparty computation, in the standard model with n = 2t + 1 parties of which t are corrupted. We show a lower bound that applies to secure evaluation of any function, assuming that each party can choose to learn to learn or not learn the output. Specifically, we show that there is a function H * such that for
... y protocol that evaluates yi = bi • f (x1, ..., xn) with perfect passive security (where bi is a private boolean input), the total communication must be at least 1 2 n i=1 H * f (xi) bits of information. The second lower bound applies to the perfect maliciously secure setting with n = 3t + 1 parties. We show that for any n and all large enough S, there exists a reactive functionality FS taking an S-bit string as input (and with short output) such that any protocol implementing FS with perfect malicious security must communicate Ω(nS) bits. Since the functionalities we study can be implemented with linear size circuits, the result can equivalently be stated as follows: for any n and all large enough g ∈ N there exists a reactive functionality FC doing computation specified by a Boolean circuit C with g gates, where any perfectly secure protocol implementing FC must communicate Ω(ng) bits. The results easily extends to constructing similar functionalities defined over any fixed finite field. Using known techniques, we also show an upper bound that matches the lower bound up to a constant factor (existing upper bounds are a factor lg n off for Boolean circuits). Both results also extend to the case where the threshold t is suboptimal. Namely if n = kt + s the bound is weakened by a factor O(s), which corresponds to known optimizations via packed secret-sharing.