Secure Scalar Product Protocols

Chinese Journal of ElectronicsVolume 30, Issue 6 p. 1059-1068 Original Research PaperFree Access Secure Scalar Product Protocols LI Shundong, Corresponding Author LI Shundong shundong@snnu.edu.cn School of Computer Science, Shaanxi Normal University, Xi'an, 710062 ChinaSearch for more papers by this authorZHANG Mengyu, Corresponding Author ZHANG Mengyu zhangmengyu@snnu.edu.cn School of Computer Science, Shaanxi Normal University, Xi'an, 710062 ChinaSearch for more papers by this authorXU Wenting, Corresponding Author XU Wenting xuwenting@snnu.edu.cn School of Computer Science, Shaanxi Normal University, Xi'an, 710062 ChinaSearch for more papers by this author LI Shundong, Corresponding Author LI Shundong shundong@snnu.edu.cn School of Computer Science, Shaanxi Normal University, Xi'an, 710062 ChinaSearch for more papers by this authorZHANG Mengyu, Corresponding Author ZHANG Mengyu zhangmengyu@snnu.edu.cn School of Computer Science, Shaanxi Normal University, Xi'an, 710062 ChinaSearch for more papers by this authorXU Wenting, Corresponding Author XU Wenting xuwenting@snnu.edu.cn School of Computer Science, Shaanxi Normal University, Xi'an, 710062 ChinaSearch for more papers by this author First published: 01 November 2021 https://doi.org/10.1049/cje.2021.07.018AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinked InRedditWechat Abstract Secure scalar product computation is a special secure multi-party computation problem. A secure scalar product protocol can be used by two parties to jointly compute the scalar product of their private vectors without revealing any information about the private vector of either party. Secure scalar product protocol is of great significance in privacy-preserving scientific computing, privacy preserving data mining, privacy-preserving cooperative statistical analysis and privacy-preserving geometry computation, etc. Many privacy preserving computing problems can be transformed to secure scalar product computation. At present, existing scalar product protocols cannot be used to privately compute scalar product of private vectors with both positive and negative components. Based on homomorphic encryption scheme, we design three protocols to compute scalar product of three different kinds of private vectors. The components of the first kind vector are arbitrary integers; those of the second kind are positive rational numbers and those of the third kind are arbitrary rational numbers. We use simulation paradigm proving that the protocols are secure in the semi-honest model. Theoretical analysis and experimental results show that the protocols designed in this paper are efficient. I. Introduction Secure multi-party computation (SMC) was first proposed by Yao in 1982[1]. It is an important research direction of modern cryptography, and a powerful tool for handling sensitive distributed computing problems[2]. In SMC, mutually distrusted participants P 1 , P 2 , … , P n input their own private data x i to jointly compute a function ( y 1 , y 2 , … , y n ) = f ( x 1 , x 2 , … , x n ) . After the computation, P i will just know his own private output y i [3]. SMC provides a new research direction for researchers in computation science, cryptography and information security. Cryptographic researchers have studied a variety of SMC problems, including secure data comparison problem[1,4, 5–6], secure computational geometry[7,8], secure set computation[9,10], and other secure multi-party computing applications. Although Goldreich et al.[11-13–14] give a general scheme to solve problems. It is only theoretically proved that all SMC problems are solvable. In most practical cases, the efficiency of the general solution is too low to effectively solve specific problems. Therefore, it is necessary to seek efficient and secure computing solutions for specific problems. This paper deals with two-party secure scalar product problem. The secure scalar product problem is a specific SMC problem. Its goal is to compute the scalar product of private vectors without revealing any information about private vector of either party. Secure scalar product protocol, as a basic module, is widely used in location privacy protection[15, 16–17], privacy-preserving data mining[18, 19–20], privacy-preserving cooperative statistical analysis[21], privacy-preserving geometry computation[22-24–25] and other fields. Secure scalar product protocol is defined as follows: Alice has a private vector A = ( a 1 , a 2 , … , a n ) . Bob has a private vector B = ( b 1 , b 2 , … , b n ) . They want to privately compute u = A · B + v = ∑ i = 1 n a i · b i + v , where u is only known to Alice and v is a random number only Bob knows. That is, the scalar product is shared between Alice and Bob. To solve this problem, researchers have proposed a number of solutions. In Ref. [ 15 ] , Huang et al. propose a Privacy preserving scalar product protocol (PPSPP) which can be used to compute scalar product of arbitrary integers. They use random vectors R a , R b to transform components of the original vectors A and B into positive integers, where Alice owns R a = ( r a 1 , r a 2 , … , r a n ) and Bob owns R b = ( r b 1 , r b 2 , … , r b n ) . Then, they compute ( A + R a ) · ( B + R b ) = A · B + R a · R b + R a · B + R b · A to obtain A · B . Furthermore, in the computing process, Alice can obtain s 2 = R a · ( B + R b ) and R b . When the protocol finished, Alice can get extra information ( R a - A ) · B by computing ( s 2 - R a · R b - A · B ) . There is a certain probability to reveal ∑ i = 1 n y i of B . The solutions in Refs.[20,21] try to achieve information theoretical security by using additive noise or linear noise to hide the private data, without depending on any computation assumption. But those solutions have been proved insecure or incorrect[26]. Analysis shows that a set of linear equations can be constructed according to the specification of the protocol to compute its secret value. The solutions in Ref. [ 27 ] requires a trusted third party. Solutions of Refs.[28,29] require fully homomorphic encryption scheme, but practical fully homomorphic encryption scheme is not available at present. Yang et al. propose a scalar product protocol that can resist malicious adversaries based on verifiable encryption and discrete logarithm problems in Ref. [ 30 ] . However, the protocol requires that the vector components belong to Z n . Dong et al. transform the scalar product problem into an intersection problem in Ref. [ 26 ] , and compute the scalar product using the Goldwasser-Micali (GM) public key encryption scheme. Because the encryption process of the GM encryption scheme only requires modular multiplication, their protocol can reduce the computational complexity comparing with protocols using other public key encryption schemes. But the protocol requires the vectors to be binary ones of length n and density d. The scalar product protocol designed by Goethals et al.[19] only applies to single data 0 and 1, and limits the vector length to N. In Refs.[2,31,32], those protocols add random quantities to protect the privacy of vectors instead of using encryption scheme. The protocol designed by Zhu et al.[31] can efficiently compute scalar product of even dimensions, but it requires a secure channel and will leak partial sums of private data. In Ref. [ 32 ] , Domingo et al. design a protocol requiring a trusted agent CLARUS and a cloud Charlie that do not collude. All the solutions mentioned above cannot solve or cannot well solve the problem when vector components are of positive and negative values. Firstly, for a variety of reasons, secure channels and trusted third parties usually do not exist[33]. Even if a trusted third party can be found, it will become a communication and security bottleneck. In addition, some of them restrict components to be positive. In fact, vector components are various, such as point coordinates, medical data and so on. Therefore, it is necessary to design scalar product protocols for other data types. Finally, most existing scalar product protocols of arbitrary rational numbers generally adopt the information theory method. But those methods have been confirmed to have certain information leakage, and the information of the participants cannot be completely guaranteed[26,31]. Therefore, it is necessary to design a new secure scalar product protocol of arbitrary rational numbers. The main work of this paper is to propose three scalar product protocols based on homomorphic encryption schemes. The data types of the private vector components in Protocol 1, Protocol 2 and Protocol 3 are arbitrary integer, positive rational number, and arbitrary rational number, respectively. Data is usually stored in a computer which automatically intercepts real numbers into rational numbers based on accuracy. Therefore, the protocol designed in this paper can solve all scalar product problems. The main contributions of this paper are as follows. 1) Based on additively homomorphic encryption scheme, three scalar product protocols are proposed. The data types of the private vector components in Protocol 1, Protocol 2 and Protocol 3 are arbitrary integer, positive rational number, and arbitrary rational number, respectively. 2) Three different encoding methods are proposed for different kind vectors, which are used to facilitate the computation. 3) The efficiency analysis and experiment are carried out. Both theoretical analysis and experimental results show that the proposed protocols are efficient. II. Preliminaries 1. Semi-honest model Semi-honest participant[14] is also known as honest but curious participant. If all participants in a model are semi-honest, the computation model is called semi-honest. In this paper, we design protocols based on the semi-honest model, that is, our protocols are secure in the semi-honest model. The two participants will provide the real inputs to participate in the computation, implement the protocol as required by the protocol, and do not intentionally interrupt the execution of the protocol. However, in the computing process, both of them may record all the intermediate information they have obtained and the output of protocol. Then, they will try to use these information to infer other secret information such as the other party's input. In general, a semi-honest secure two-party computation model can be described as follows. Suppose f = ( f 1 , f 2 ) : { 0 , 1 } * × { 0 , 1 } * → { 0 , 1 } * × { 0 , 1 } * is a probabilitic polynomial time function, and π represents a secure two-party computation protocol computing f. The input of the protocol is ( x , y ) . During the implementation of protocol π, the view of first party is ( x , r 1 , m 11 , … , m 1 t ) denoted by v i e w 1 π ( x , y ) , where r 1 is the random number generated by the first party, and m 1 i is the ith message she/he received. Similarly, v i e w 2 π ( x , y ) denotes the view of the second party ( y , r 2 , m 21 , … , m 2 t ) . When protocol π ends, the output of the first party is denoted by o u t p u t 1 π ( x , y ) (analogously o u t p u t 2 π ( x , y ) represents the output of the second party). Definition 1 (The security of two semi-honest participants[14]). For a probabilistic polynomial time function f, if there exist probabilistic polynomial time algorithms S 1 and S 2 such that Eqs.(1) and (2) hold, then the protocol is considered to compute the function f confidentially. { ( S 1 ( x , f 1 ( x , y ) ) , f 2 ( x , y ) ) } x , y ≡ c { ( v i e w 1 π ( x , y ) , o u t p u t 2 π ( x , y ) ) } x , y (1) { ( f 1 ( x , y ) , S 2 ( x , f 2 ( x , y ) ) ) } x , y ≡ c { ( o u t p u t 1 π ( x , y ) , v i e w 2 π ( x , y ) ) } x , y (2)When the function f is deterministic, Eqs.(1) and (2) can be simplified to: { S 1 ( x , f 1 ( x , y ) ) } x , y ≡ c { v i e w 1 π ( x , y ) } x , y (3) { S 2 ( x , f 2 ( x , y ) ) } x , y ≡ c { v i e w 2 π ( x , y ) } x , y (4)where the S 1 and S 2 are simulators, and ≡ c means computationally indistinguishable. When proving a protocol securely computing a deterministic function, it is necessary to construct simulators S 1 and S 2 such that Eqs.(3) and (4) hold. The three protocols designed in this paper compute deterministic functions. It is of great practical significance to study the SMC in the semi-honest model, for the following three reasons: First of all, most of the members participating in the computation are semi-honest. Although they may be curious about the data of other participants, they will still honestly participate in the computation following the requirements of the protocol due to technology and time constraints. Secondly, the general transforming method proposed by Goldreich can be used to convert a protocol π designed to privately compute f in the semi-honest model into a protocol π ' which can also privately compute f in the malicious model. The protocol π ' can force malicious participants to participate in the protocol in a semi-honest manner. Finally, malicious protocol is usually based on semi-honest protocol. By analyzing the possible malicious behaviors of malicious participants in the semi-honest model, we can take some precautions to prevent the malicious behavior such that it is secure for malicious participants. 2. Homomorphic encryption The concept of homomorphic encryption was proposed by Rivest et al.[34]. It means that the ciphertext obtained by directly performing some operation on the two ciphertexts without decryption is equal to the ciphertext obtained by encrypting the result of performing some operation on the plaintexts. No plaintext information is disclosed during the process. This property can be used to solve many SMC problems. As an important tool of SMC, homomorphic encryption is an asymmetric and semantically secure encryption scheme. A homomorphic encryption scheme E has four algorithms: K e y G e n E , E n c r y p t E , D e c r y p t E and E v a l u a t e E . Given a security parameter λ, K e y G e n E outputs public key p k and private key s k . Using p k , E n c r y p t E outputs ciphertext c of plaintext m. In turn, D e c r y p t E outputs plaintext m of ciphertext c using s k . Based on p k , operation f, ciphertext c 1 = E ( m 1 ) and c 2 = E ( m 2 ) , E v a l u a t e E outputs E ( f ( m 1 , m 2 ) ) . RSA is the first encryption scheme with homomorphism. After it, researchers have successively constructed a variety of encryption schemes with different homomorphism, such as: ElGamal[35], Paillier[36], GM[37], BGN[38], BGV[39] and so on. Homomorphic encryption can be divided into additively homomorphic encryption, multiplicatively homomorphic encryption and XOR homomorphic encryption. This paper uses additively homomorphic encryption scheme, which is briefly described as follows. For any messages m 1 and m 2 , encrypt m 1 and m 2 to get E ( m 1 ) and E ( m 2 ) . If the following formula holds, the encryption system E has additive homomorphism. E ( m 1 ) ⊙ E ( m 2 ) = E ( m 1 + m 2 ) E ( m 1 ) m 2 = E ( m 1 ⊙ m 2 ) 3. Paillier public key encryption scheme Paillier encryption scheme[36] is based on composite degree residuosity classes. The concrete construction of the encryption scheme is as follows. Key generation k is a given security parameter. Select two k-bit prime numbers p and q and compute N = p × q . λ = lcm ( p - 1 , q - 1 ) is the least common multiple of p - 1 and q - 1 . Randomly select g ∈ Z N * such that gcd ( L ( g λ mod N 2 ) , N ) = 1 where L ( x ) is defined as x - 1 N . The public key of the algorithm is ( g , N ) , and the private key is λ. Encryption For a plaintext m < N , select a random number r < N , then, we can use the following formula to compute the ciphertext c. c = g m r N mod N 2 Decryption For a ciphertext c < N 2 , we can get the plaintext m by computing m = L ( c λ mod N 2 ) L ( g λ mod N 2 ) mod N The encryption scheme is probabilistic and satisfies the following two properties. E ( m 1 ) · E ( m 2 ) = E ( m 1 + m 2 ) ( E ( m 1 ) ) m 2 = E ( m 1 · m 2 ) III. Scalar Product of Integer Vectors 1. Basic principles of protocol Problem description Alice and Bob own vectors A = ( a 1 , a 2 , … , a n ) and B = ( b 1 , b 2 , … , b n ) , respectively, where a i and b i are arbitrary integers. Alice and Bob want to know the scalar product of A and B , but they do not want to reveal any information of their private vectors. To solve this problem, we first propose the following encoding method. Encoding method 1 Given a vector A = ( a 1 , a 2 , … , a n ) , it can be encoded as a unique two-dimensional array X [ i , j ] where i ∈ { 0 , 1 } and 1 ≤ j ≤ n . X [ 0 , j ] = a j , a j ≥ 0 0 , a j < 0 (5) X [ 1 , j ] = 0 , a j ≥ 0 - a j , a j < 0 (6) Principle description A vector A = ( a 1 , a 2 , … , a n ) can be split into two vectors A 0 = ( a 01 , a 02 , ⋯ , a 0 n ) and A 1 = ( a 11 , a 12 , … , a 1 n ) such that A = A 0 - A 1 . If a i ≥ 0 , a 0 i = a i and a 1 i = 0 . Conversely, if a i < 0 , a 0 i = 0 and a 1 i = - a i . The components of A 0 and A 1 are both positive. Similarly, B can be split into B 0 and B 1 . Thus, the scalar product of A and B can be obtained by the following formula. A · B = ( A 0 - A 1 ) · ( B 0 - B 1 ) = A 0 B 0 + A 1 B 1 - A 0 B 1 - A 1 B 0 = ∑ b 0 i ≠ 0 a 0 i · b 0 i + ∑ b 1 i ≠ 0 a 1 i · b 1 i - ∑ b 1 i ≠ 0 a 0 i · b 1 i - ∑ b 0 i ≠ 0 a 1 i · b 0 i = ∑ b i ≥ 0 a 0 i · b i + ∑ b i < 0 a 1 i · - b i - ∑ b i < 0 a 0 i · - b i + ∑ b i ≥ 0 a 1 i · b i By the above formula, the sum of the non-zero components in B 0 and B 1 is at most n, and at most 2 n multiplication operations are necessary to obtain A · B . First of all, we compute ∑ i = 1 n a i · b i using Eq.(7). And using Eq.(8), we compute ∑ i = 1 n a i · b i again. The subtraction of the above two computing results is the scalar product of A and B . a i · b i = a 0 i · b i , b i ≥ 0 a 1 i · ( - b i ) , b i < 0 (7) a i · b i = a 1 i · b i , b i ≥ 0 a 0 i · ( - b i ) , b i < 0 (8) Set the sign bit s to be 0 for positive and 1 for negative. Storing A 0 in the first line of the array X (analogous storing A 1 in the second line of the array X), then the above computing process can be expressed by the following formula. u = A · B = ∑ i = 1 n X [ s b i , i ] · | b i | - ∑ i = 1 n X [ s ¯ b i , i ] · | b i | Example 1 Alice and Bob own A = ( 1 , - 2 , 7 , 9 ) and B = ( - 3 , - 4 , 5 , 2 ) , respectively. 1) According to Eqs.(5) and (6), Alice encode vector A as array X = x 01 x 02 ⋯ x 0 n x 11 x 12 ⋯ x 1 n 2) Bob computes Y 1 = 3 · 0 + 4 · 2 + 5 · 7 + 2 · 9 = 61 Y 2 = 3 · 1 + 4 · 0 + 5 · 0 + 2 · 0 = 3 3) Alice computes u = Y 1 - Y 2 = 61 - 3 = 58 . u is the scalar product of A and B . In fact, ( - 3 ) × 1 + ( - 4 ) × ( - 2 ) + 5 × 7 + 2 × 9 = 58 . 2. Scalar product protocol 1 Protocol 1 Secure scalar product protocol 1: Inputs: Alice's vector A , Bob's vector B . Output: u. Setup: ( G , E , D ) is Paillier homomorphic encryption scheme. τ is a security parameter. Alice runs G ( τ ) to generate public and private keys, and publishes the public key. 1) Using Eqs.(5) and (6), Alice convert A = ( a 1 , a 2 , … , a n ) to array X. Then, she sends the encrypted array E ( X ) to Bob. X = x 01 x 02 ⋯ x 0 n x 11 x 12 ⋯ x 1 n 2) Bob does the following. ➀ Firstly, he computes E c 1 = ∏ i = 1 n E X s b i i b i E c 2 = ∏ i = 1 n E X s ¯ b i , i b i ➁ Then, he randomly selects two positive integers m 1 and m 2 , and computes E ( Y 1 ) = E ( c 1 ) · E ( m 1 ) , E ( Y 2 ) = E ( c 2 ) · E ( m 2 ) ➂ Finally, he sends E ( Y 1 ) and E ( Y 2 ) to Alice. 3) Alice decrypts E ( Y 1 ) and E ( Y 2 ) to get Y 1 and Y 2 , and computes Y 1 - Y 2 . Output u = Y 1 - Y 2 . 3. Analysis Correctness The correctness of Protocol 1 is guaranteed by the principles described in Section III.1, which will not be described in detail again. We only explain random numbers m 1 and m 2 . m 1 and m 2 can help hide information without affecting the correctness of the protocol. The final output in Protocol 1 is u = A · B + v where v = m 1 - m 2 . u is held by Alice, v is held by Bob, and A · B is shared between Alice and Bob. Security In Protocol 1, the security of Alice's vector is guaranteed by Paillier homomorphic encryption scheme, while the security of Bob's vector is based on the principle of the protocol. Bob computes Y 1 and Y 2 in ciphertexts. Because the Paillier homomorphic encryption scheme is semantically secure, random numbers and ciphertexts are computationally indistinguishable. Therefore, Bob cannot obtain additional information about A . Since m 1 , m 2 are randomly selected by Bob, Alice cannot know c 1 , c 2 nor other extra information though she can get Y 1 , Y 2 . Finally, we will use the simulation paradigm to prove the security in detail. Theorem 1 Protocol 1 is secure in the semi-honest model. Proof Theorem 1 can be proved by constructing simulators S 1 and S 2 such that Eqs.(3) and (4) hold. Given input ( A , u ) , S 1 will run as follows. 1) S 1 constructs B ' such that u = A · B = u ' = A · B ' . According to Eqs.(5) and (6), S 1 encodes A as array X. X = x 01 x 02 ⋯ x 0 n x 11 x 12 ⋯ x 1 n 2) Then, S 1 encrypts the array X to obtain E ( X ) = ( E ( x 01 ) , … , E ( x 0 n ) , E ( x 11 ) , … , E ( x 1 n ) ) 3) S 1 computes c 1 ' and c 2 ' . After randomly choosing two positive integers m 1 ' , m 2 ' , S 1 computes E ( Y 1 ' ) = E ( c 1 ' ) · E ( m 1 ' ) , E ( Y 2 ' ) = E ( c 2 ' ) · E ( m 2 ' ) 4) S 1 decrypts E ( Y 1 ' ) , E ( Y 2 ' ) , and computes u ' = Y 1 ' - Y 2 ' . In Protocol 1, v i e w 1 π ( A , B ) = { X , r 1 , E ( Y 1 ) , E ( Y 2 ) , u } Let S 1 ( A , u ) = { X , r 1 , E ( Y 1 ' ) , E ( Y 2 ' ) , u ' } From the first step, u ' = u . Because the Paillier homomorphic encryption scheme is semantically secure, E ( Y 1 ' ) ≡ c E ( Y 1 ) , E ( Y 2 ' ) ≡ c E ( Y 2 ) . And all the other parameters are equal. Therefore, { S 1 ( A , u ) } A , B ≡ c { v i e w 1 π ( A , B ) } A , B The simulator S 2 that makes the following formula true can be constructed in the similar way. { S 2 ( B , u ) } A , B ≡ c { v i e w 2 π ( A , B ) } A , B IV. Scalar Product of Positive Rational Vectors 1. Basic principles of protocol Problem description Alice and Bob own vectors A = ( a 1 , a 2 , … , a n ) and B = ( b 1 , b 2 , … , b n ) , respectively, where a i and b i are positive rational numbers. Alice and Bob want to know the scalar product of A and B , but they do not want to reveal any information of their private vectors. To solve this problem, we need the following encoding scheme. Encoding method 2 Suppose a i = q i / p i , a given vector A = ( a 1 , a 2 , … , a n ) can be encoded as a unique one-dimensional array T [ i ] by Eq.(9), where 1 ≤ i ≤ n . Let [ p 1 , p 2 , … , p n ] be the least common multiple of p 1 , p 2 , … , p n . Then, T [ i ] = a i · [ p 1 , p 2 , ⋯ , p n ] (9) Principle description Any rational number can be written as a fraction, therefore A = ( a 1 , a 2 , ⋯ , a n ) = ( q 1 p 1 , q 2 p 2 , ⋯ , q n p n ) B = ( b 1 , b 2 , ⋯ , b n ) = ( d 1 c 1 , d 2 c 2 , ⋯ , d n c n ) Let L 1 = [ p 1 , p 2 , ⋯ , p n ] , L 2 = [ c 1 , c 2 , … , c n ] , vectors A and B can be written as A = 1 L 1 ( a 1 · L 1 , a 2 · L 1 , ⋯ , a n · L 1 ) B = 1 L 2 ( b 1 · L 2 , b 2 · L 2 , ⋯ , b n · L 2 ) Let A ' = ( a 1 ' , a 2 ' , … , a n ' ) denote ( a 1 · L 1 , a 2 · L 1 , … , a n · L 1 ) and B ' = ( b 1 ' , b 2 ' , … , b n ' ) denote ( b 1 · L 2 , b 2 · L 2 , … , b n · L 2 ) , where a i ' , b i ' are all positive integers. Then, A · B can be computed by A · B = A ' · B ' L 1 · L 2 Store A ' and B ' in T 1 = { t 1 , t 2 , … , t n } and T 2 = { s 1 , s 2 , … , s n } , respectively. Then, A ' · B ' = ∑ i = 1 n t i · s i Example 2 Alice and Bob own A = ( 1 3 , 5 11 , 3 7 , 4 13 ) and B = ( 2 5 , 4 15 , 1 7 , 2 9 ) , respectively. 1) Alice computes L 1 = 3003 , and encodes A as T 1 = { 1001 , 1365 , 1287 , 924 } by Eq.(9). 2) Bob computes L 2 = 315 , and encodes B as T 2 = { 126 , 84 , 45 , 70 } by Eq.(9). Then, he computes Y 1 = 1001 · 126 + 1365 · 84 + 1287 · 45 + 924 · 70 = 363381 Y 2 = L 2 = 315 3) Alice computes u = Y 1 / ( L 1 · Y 2 ) = 363381 ÷ ( 3003 × 315 ) = 121127 315315 . u is the scalar product of A and B . In fact, 1 3 × 2 5 + 5 11 × 4 15 + 3 7 × 1 7 + 4 13 × 2 9 = 121127 315315 2. Scalar product protocol 2 Protocol 2 Secure scalar product protocol 2: Inputs: Alice's vector A , Bob's vector B . Output: u. Setup: ( G , E , D ) is Paillier homomorphic encryption scheme. τ is a security parameter. Alice runs G ( τ ) to generate public and private keys, and publishes the public key. 1) Alice computes L 1 = [ p 1 , p 2 , … , p n ] , and encode A = ( a 1 , a 2 , … , a n ) as T 1 = { t 1 , t 2 , … , t n } by Eq.(9). Then, she sends the encrypted array E ( T 1 ) to Bob. 2) Bob computes L 2 = [ c 1 , c 2 , … , c n ] . According to Eq.(9), Bob encode B = ( b 1 , … , b n ) as T 2 = { s 1 , s 2 , … , s n } . Then, he does the following. ➀ He computes E ( Y 11 ) = ∏ i = 1 n E ( t i ) s i = E ( ∑ i = 1 n t i · s i ) ➁ He randomly chooses a positive integer m 1 , and computes E ( Y 1 ) = E ( Y 11 ) m 1 = E ( Y 11 · m 1 ) ➂ He randomly chooses another positive integer m 2 , and computes E ( Y 2 ) = E ( L 2 · m 2 ) ➃ Bob sends E ( Y 1 ) and E ( Y 2 ) to Alice. 3) Alice decrypts E ( Y 1 ) , E ( Y 2 ) to get Y 1 , Y 2 , and computes Y 1 / ( Y 2 · L 1 ) . Output u = Y 1 / ( Y 2 · L 1 ) . 3. Analysis Correctness The correctness of Protocol 2 is guaranteed by the principles described in Section IV.1. We only explain random numbers m 1 and m 2 . m 1 and m 2 can help hide information without affecting correctness of the protocol. The final output in Protocol 2 is u = A · B · v where v = m 1 / m 2 . u is held by Alice, v is held by Bob, and A · B is shared between Alice and Bob. Security In Protocol 2, the security of Alice's vector is guaranteed by Paillier homomorphic encryption scheme, while the security of Bob's vector is based on the principle of the protocol. Bob computes Y 1 and Y 2 in ciphertexts. The Paillier ho