# On the Security of Offloading Post-Processing
## 3 Outsourcing Information Reconciliation
### Multiparty Computation-Based Outsourcing  
In the previous subsections, we presented an efficient solution for offloading direct reconciliation (DR) to a single server and discussed the problems with RR. Although relying on a single untrusted server seems to be the most desirable use case, it is natural to ask how efficient a multi-server configuration would be in cases where single-server offloading is not possible. If multiple servers are available, then ITS multiparty computation protocols (MPCs) based on secret sharing --as introduced by [PERSON] et al. [30] and [PERSON] et al. [31]can be used to obliviously compute arbitrary functions on sensitive data, and thus they can also be used in CV-QKD because the inputs are kept private from the servers. The respective class of MPC protocols with ITS security operates in the honest majority setting (i.e., under the assumption that an adversary corrupts less than half of the MPC-computing nodes). Aside from the non-collusion assumption, the protocols also rely on secure channels, which can be assured by different means, as discussed in Section 5. More concretely, in MPCs, a set of parties can jointly evaluate a function without leaking any information to any of the participating parties beyond what can be derived from their own inputs and the computation result itself. Thus, an MPC provides _input secrecy_ (or _input privacy_) (i.e., no party learns the input values of any other party) and _correctness_ (i.e., the receiver of the result is ensured that the result is correct). In an honest majority setting with less than half of the servers being corrupt, ITS MPCs are among the most performant approaches for computing with encrypted data and achieve practical performance in many application scenarios. We therefore looked into the problem of MPC-based information reconciliation with ITS security on the basis of secret sharing [32]. If IR is performed in MPCs, the decoding can be accomplished without learning anything about the error syndrome \(\mathbf{s}_{e}\) (private input) or error vector \(\mathbf{e}\) (private output), but the parity check matrix can still be kept clear. In this model, the peer ([PERSON] for RR) offloading IR is encoding the error syndrome as private input for the MPC system. The MPC system then obliviously computes the bit flip vector by executing a distributed protocol realizing a privacy-preserving LDPC decoder. The result of the computation is secretly shared among the MPC nodes after the protocol run and sent back to the peer ([PERSON]), who can reconstruct it. To demonstrate the feasibility of the solution, we study the practical efficiency of error decoding for low-density parity check (LDPC) codes in an existing MPC framework and estimate the performance that can be achieved. To the best of our knowledge, this is the first time this problem is considered. The only known related work was presented by [PERSON] and [PERSON] [33], who only considered Berlekamp-Welch decoding for Reed-Solomon codes. In general, we distinguish two main types of message-passing algorithms for LDPC decoding: bit-flipping algorithms and belief propagation [34]. The decoding approach typically used in QKD is from the category of belief propagation (BP) and specifically uses sum-product mechanisms to update beliefs, an approach which works very efficiently on plaintext data. Unfortunately, this approach is not well suited for direct application in MPCs. This is because the algorithm works on floating point numbers and uses trigonometric functions in the belief update part, with both being very inefficient in MPCs. Thus, to initiate the research topic, we focused on bit-flipping (BF) algorithms first in our implementation approach because they seemed to be more promising, although they suffer from inferior performance in terms of information rate. BF algorithms have a very simple structure and work extremely fast (e.g., if implemented in hardware).