# Efficient SMC Protocol Based on Multi-Bit Fully Homomorphic Encryption
## 5 Secure Multi-Party Computation Protocol Based on NFHE Scheme  
### SMC Protocol Based on Leveled NFHE Scheme  
The basic NFHE scheme in this paper is leveled, which can only carry out a limited number of homomorphic operations. Although this limitation can be removed by bootstrapping to achieve any number of homomorphic operations, most of the advantages of the scheme will also be destroyed. Therefore, an SMC protocol based on the leveled NFHE scheme can be constructed.  
\(\pi_{f}\): Under the CRS model, a protocol for safely computing a single-valued function \(f\) is constructed, which is always safe under the semi-honest model and the semi-malicious model. The details are as follows.  
**Preprocessing**: Set parameter, ensuring that all participants share parameter settings. Choose a lattice dimension parameter \(n\), where \(\lambda\) is the security parameter. Pick an error distribution \(\chi\) and a modulus \(q\), such that for \(l=\lfloor\log q\rfloor+1\), the some-are-errorless \(LWE_{n,q,l,\chi}\) holds. Let \(\overline{m}=n\cdot l\). A common random string matrix \(A\stackrel{{ R}}{{\leftarrow}}\mathbb{Z}_{q}^{n\times n}\) is selected.  
**Input**: For \(i\in[N]\), each participant \(P_{i}\) inputs private data \(x_{i}\in\{0,1\}\), then calculate the function \(f\Big{(}\{0,1\}^{N}\rightarrow\{0,1\}\Big{)}\). \(d\) is the circuit depth of \(f\).  
**Round 1**. For \(P_{i}\), the following is operated.  
* Generate \((pk_{i},sk_{i})\leftarrow\) NFHE.Keygen\((n,q)\).
* Release the public key \(\{pk_{i}\}_{i\in[N]}\).  
**Round 2**. Each \(P_{i}\) receives the public key \(\{pk_{i}\}_{i\in[N]\setminus\{i\}}\) of others and performs the following operations.  
* Calculate the joint public key \(pk=\overline{K}=\frac{1}{N}\sum\limits_{i=1}^{N}\overline{K}_{i}\).
* \(pk\) is used to calculate ciphertext \(C=\text{mbFlatten}\big{(}\mathbf{\mu}\cdot\mathbf{I}_{N}+\text{mbDpt}\big{(}\mathbf{C}^{ \prime}\big{)}\big{)}\) and publish ciphertext \(\{C_{i}\}_{i\in[N]}\).  
**Round 3**. Each party \(P_{i}\) receives the ciphertext \(\{C_{i}\}_{i\in[N]\setminus\{i\}}\) of others and performs the following operations.  
* Perform homomorphic operations.
* Perform threshold decryption. \(P_{i}\) selects a random vector \(\gamma_{i}^{\prime}\leftarrow\mathbf{\chi}^{\overline{m}-l}\). Let \(\gamma_{i}=\big{(}\gamma_{i}^{\prime},0,\cdots,0\big{)}\in\mathbf{\chi}^{\overline {m}}\), then calculate the partial decryption result \(\mathbf{\eta}_{i}=\bar{\mathbf{\imath}}_{i}\cdot\mathbf{C}+\gamma_{i}\in\mathbb{Z}_{q}^{ \overline{m}}\). Finally, release \(\eta_{i}\).  
**Output**: Each participant \(P_{i}\) accepts others to decrypt \(\{\eta_{i}\}_{i\in[N]\setminus\{i\}}\). Calculate \(\mathbf{\eta}=\frac{1}{N}\sum\limits_{i=1}^{N}\mathbf{\eta}_{i}=\bar{\mathbf{t}}\mathbf{C}+ \frac{1}{N}\sum\limits_{i=1}^{N}\gamma_{i}=\bar{\mathbf{t}}\mathbf{C}+\gamma\), then calculate \(v=\mathbf{\eta}G^{-1}\big{(}\mathbf{w}^{T}\big{)}\), where \(G^{-1}\big{(}\mathbf{w}^{T}\big{)}\) is a bit decomposition of \(\mathbf{w}^{T}\) and \(w=\big{(}0,0,\cdots,\big{[}\frac{q}{2}\big{]}\big{)}\). If the value of \(v\) is close to 0, then \(\mu=0\). If the value of \(v\) is close to \(\big{[}\frac{q}{2}\big{]}\), then \(\mu=1\).