# Verifiable Threshold Multi-Party Fully Homomorphic Encryption from Share Resharing
## 5 Correctness, Security, and Performance Analysis
### Security  
This section discusses the security of the VTMFHE scheme. To formally model and prove security, we define the corresponding adversarial model. We begin with a static passive adversary model (i.e., semi-honest, as defined by [PERSON] et al. [21]), where the adversary \(\mathcal{A}\) can corrupt up to \(t-1\) parties before the protocol starts. In the passive setting, corrupted parties follow the protocol honestly, and \(\mathcal{A}\) is allowed to access their internal state. However, existing TMFHE schemes typically provide security only under semi-honest adversaries. When facing malicious adversaries, a corrupted group may disrupt correctness or privacy by submitting invalid outputs (e.g., incorrect partial decryption results) or performing biased decryption. Therefore, we extend the model to an active malicious adversary setting, where corrupted parties are allowed to behave arbitrarily, such as going offline, submitting malformed data, or sending invalid verification messages at any point in time. Moreover, the adversary may observe and interfere with protocol interactions, or attempt to forge valid outputs. Compared to the scheme by [PERSON] et al. [21], our approach significantly improves security by incorporating a verification mechanism based on commitments and NIZK in key generation, encryption, and threshold decryption. We prove that the scheme achieves IND-CPA security and is secure against active attacks from malicious adversaries. In terms of semantic security, for the security parameter \(\lambda\), the circuit depth bound \(l\), and the set of parties \(P=\{P_{1},\ldots,P_{N}\}\) in the VTMFHE scheme, a PPT simulator \(Sim\) exists, such that for a static and passive PPT adversary \(\mathcal{A}\), the hybrid experiments in the following real world and ideal world are indistinguishable, where the adversary \(\mathcal{A}\) can corrupt up to \(t-1\) parties:  
\(\boldsymbol{Game_{real}}\): This is a real-world IND-CPA game between a challenger and the adversary \(\mathcal{A}\). 1. Input \(\left(1^{\lambda},1^{l}\right)\); the adversary \(\mathcal{A}\) outputs the threshold access structure \(\mathbb{A}_{t}\). 2. The challenger \(\mathsf{runs}\enskip\enskip\enskip\enskip\enskip\enskip\enskip\enskip \enskip\enskip\enskip\enskip\enskip\enskip\enskip\enskip\enskip\enskip \enskip\enskip\enskip\enskip\enskip\enskip\enskip\enskip\enskip\enskip\enskip \enskip\enskip\enskip\enskip\enskip\enskip\enskip\enskip\enskip\enskip\enskip \enskip\enskip\enskip\enskip\enskip\enskip\enskip\enskip\enskip\enskip\enskip \enskip\enskip\enskip\enskip\enskip\enskip\enskip\enskip\enskip\enskip\enskip \  
key shares included in the partial decryption results \(p_{i}\) is computationally hidden by the smudging noise \(\epsilon_{i}^{sm}\). This means that the public key, ciphertexts, and partial decryption results are computationally indistinguishable from random values and unrelated to the messages. Therefore, our VTMFHE scheme is IND-CPA-secure. The execution of the protocol should not disclose any knowledge about the secret key shares or the messages \(\mu_{1},\ldots,\mu_{k}\) through the partial decryption results beyond what is already included in the homomorphic evaluation result. Additionally, corrupted parties should be unable to send incorrect information that leads to the leakage of privacy or decryption failure. Next, we further set up an active malicious adversary to verify that our scheme is actively secure. To verify the source of information, prevent the adversary from forging legitimate information, and ensure that ciphertexts are not tampered with during transmission, we construct a verification mechanism through commitment and NIZK. This verifies the correctness of the scheme's execution process, including distributed key generation, encryption, and threshold decryption. We simulate proofs through a series of hybrid experiments:  
\(\mathbf{Game_{0}}\): This is the execution of our scheme in the real world with a malicious adversary \(\mathcal{A}\). 1.