# Efficient SMC Protocol Based on Multi-Bit Fully Homomorphic Encryption
## 5 Secure Multi-Party Computation Protocol Based on NFHE Scheme
### Security
#### 5.3.2 In Semi-Malicious Model  
To be easily expressed, \(\mathbf{\rho}_{i}=\mathbf{\eta}_{i}\mathbf{G}^{-1}\big{(}\mathbf{w}^{T}\big{)}+\mathbf{\varepsilon }_{i}=\mathbf{v}_{i}+\mathbf{\varepsilon}_{i}\) and \(\mathbf{\varepsilon}_{i}\leftarrow\chi\) are used to replace \(\mathbf{\eta}_{i}\) as part of the decryption of \(P_{i}\). If the \(\mathbf{\rho}_{i}\) obtained by simulation is indistinguishable from the real \(\mathbf{\rho}_{i}\) obtained by decrypting \(\mathbf{\eta}_{i}\), the \(\mathbf{\eta}_{i}\) obtained by the simulation will be also indistinguishable from the real \(\mathbf{\eta}_{i}\). Theorem 5.3.1: _If \(f\) is a computable function with \(N\) inputs and one output of a deterministic polynomial time (PPT), then the above protocol \(\mathbf{\pi}_{f}\) can realize that \(f\) is safe when facing a semi-malicious adversary who happens to capture \(N-1\) participants._  
Proof. : A PPT simulator \(S\) is constructed to target a semi-malicious adversary who has captured \(N-1\) users, and this static semi-malicious adversary is denoted as \(\mathbf{A}\). \(P_{h}\) is assumed as the only honest party left. Simulator \(S\) performs the following operations on behalf of \(P_{h}\). In the second round, the simulator \(S\) uses \(0\) to replace the real input of the honest party \(P_{h}\) for encryption. Then the simulator \(S\) obtains the input and private keys of \(N-1\) captured parties from the \"evidence tape\". These inputs are sent by \(S\) to an ideal machine to obtain the output \(y\). Meanwhile, the ciphertext \(C\) that performed the homomorphic calculation can be obtained. Moreover, \(S\) calculates the simulated part to decrypt \(\mathbf{\rho}_{h}^{\prime}\gets S\Big{(}\mathbf{y},\mathbf{C},h,\{sk_{i}\}_{i\in|N| \setminus\{h\}}\Big{)}\) for \(P_{h}\), and the decryption results of the simulated part are published in the third round, instead of the real decryption. **A** series of mixed attack games are used to prove that the real result and the simulated result cannot be distinguished, namely \(IDEAL_{F,S,Z}\stackrel{{\text{comp}}}{{\approx}}REAL_{\pi,A,Z}\). Z represents a specific environment. Game \(REAL_{\pi,A,Z}\): In the real environment Z, there is a semi-malicious adversary who executes protocol \(\mathbf{\pi}_{f}\). Game \(HYB_{\pi,A,Z}\): Similar to game \(REAL_{\pi,A,Z}\), the difference is that it is assumed that \(P_{h}\) obtains all the private keys \(\{sk_{i}\}_{i\in[N]\setminus\{h\}}\) after the second round, and in the third round, the simulated part is used to decrypt \(\mathbf{\rho}_{h}^{\prime}\gets S\Big{(}\mathbf{y},\mathbf{C},h,\{sk_{i}\}_{i\in[N] \setminus\{h\}}\Big{)}\) instead of the real decryption being released. Game \(IDEAL_{F,S,Z}\): Similar to game \(HYB_{\pi,A,Z}\), except that in the second round, \(P_{h}\) uses 0 to replace the real input encryption and is released. \(\square\)  
**Lemma 1**. : \(REAL_{\pi,A,Z}\overset{\text{stat}}{\approx}HYB_{\pi,A,Z}\)__  
Proof. : The difference between the two games is that the decryption \(\mathbf{\rho}_{h}^{\prime}\) of the real part of \(P_{h}\) is replaced by analog decryption \(\mathbf{\rho}_{h}^{\prime}\). So, if \(\mathbf{v}=\mathbf{\mu}\big{\lceil}\frac{q}{2}\big{\rceil}+\mathbf{e}^{\prime}\), its simulated decryption algorithm can be  
\[\mathbf{\rho}_{h}^{\prime}=N\mathbf{\mu}\Big{\lceil}\frac{q}{2}\Big{\rceil}+N\mathbf{e}^{ \prime}-\sum\limits_{i\
eq h}\mathbf{\bar{\tau}}_{i}\mathbf{C}\mathbf{G}^{-1}\Big{(}w^{T} \Big{)}+\mathbf{e}_{h}^{\prime}=N\mathbf{\mu}\Big{\lceil}\frac{q}{2}\Big{\rceil}+N\bm {e}^{\prime}+\mathbf{e}_{h}^{\prime}-\sum\limits_{i\
eq h}v_{i}\]  
where \(\mathbf{e}^{\prime}\leftarrow\chi\), \(\mathbf{e}_{h}^{\prime}\leftarrow\chi\).