# LPCP: An efficient Privacy-Preserving Protocol for Polynomial Calculation Based on CRT
## 6 Extension to Three and More Parties LPCP  
In Section 4, we present a two-party secure computation construction. Furthermore, LPCP can be extended into an MPC scheme with three and more parties utilizing the two-party LPCP scheme. In the following part, we present a three-party MPC construction. There are three parties \(P_{1}\), \(P_{2}\) and \(P_{3}\) with inputs \(m_{1},m_{2}\) and \(m_{3}\), respectively, who aim to compute a polynomial function \(F(m_{1},m_{2},m_{3})=\sum_{i}k_{i}m_{i}^{a_{i}}m_{2}^{b_{i}}m_{3}^{c_{i}}\). Our main idea is that \(P_{1}\) and \(P_{2}\) perform the LPCP protocol and then perform the other LPCP protocol with \(P_{3}\). Concretely speaking, we execute the two-party LPCP scheme between \(P_{1}\) and \(P_{2}\). Then we see \(P_{1}\) and \(P_{2}\) as a whole part and execute the other two-party LPCP scheme between this whole part and \(P_{3}\). To ensure the privacy security, the original two-party LPCP scheme is modified slightly. First, \(P_{1}\) executes the operations as the sender, and \(P_{2}\) executes the same operations as the receiver in 4, except that \(P_{1}\) does not send the last ciphertext \(C_{F}\) to \(P_{2}\) in the re-encryption phase. Instead, \(P_{1}\) encrypts the last ciphertext with its secret keys \(p_{2},q_{2}\) and begins a new round of the two-party LPCP scheme with \(P_{3}\). The true decryption phase is delayed to the end of the whole protocol, where \(P_{2}\) and \(P_{1}\) decrypt the final ciphertext to obtain the answer. Setup: The setup phase is the same as the two-party LPCP scheme. KeyGeneration: For \(i=0,1,2\), each party \(P_{i}\) randomly and independently chooses three length-equal primes \(p_{i},q_{i},s_{i}\) which satisfy \(|p_{i}|=|q_{i}|=|s_{i}|=\lambda\). Each party \(P_{i}\) generates a trapdoor permutation key pair \(sk_{P_{i}}\) and \(pk_{P_{i}}\). Then, \(P_{i}\) computes \(N_{i}=p_{i}q_{i}\) and \(T_{i}=p_{i}q_{i}s_{i}\). Encryption: \(P_{1}\) randomly chooses \(r_{1}\in\{0,1\}^{\lambda}\) and \(r_{1}^{\prime},r\in\{0,1\}^{3\lambda}\). Then \(P_{1}\) computes as follows and sends \(C_{P_{1}}\) and \(C_{1}\) to \(P_{2}\). \[C_{P_{1}} =f_{pk_{2}}(N_{1})\] \[m_{1,p_{1}} =m_{1}\bmod p_{1}\] \[m_{1,q_{1}} =m_{1}\bmod q_{1}\] \[C_{1,CRT} =p_{1}^{-1}p_{1}m_{1,q_{1}}^{q_{1}}+q_{1}^{-1}q_{1}m_{1,p_{1}}^{p_ {1}} \tag{10}\] \[C_{1} =<r_{1},r_{1}^{\prime}>\cdot<C_{1,CRT},N_{1}>\bmod T_{1}\] \[=(r_{1}(p_{1}^{-1}p_{1}m_{1,q_{1}}^{q_{1}}+q_{1}^{-1}q_{1}m_{1,p_{ 1}}^{p_{1}})+r_{1}^{\prime}N_{1})\bmod T_{1}\]  
\(P_{2}\) randomly chooses \(r_{2}\in\{0,1\}^{3\lambda}\) and computes  
\[C_{P_{2}} =f_{pk_{P_{1}}}(T_{2})\] \[m_{2,p_{2}} =m_{2}\bmod p_{2}\] \[m_{2,q_{2}} =m_{2}\bmod q_{2}\] \[C_{2,CRT} =p_{2}^{-1}p_{2}m_{2,q_{2}}^{q_{2}}+q_{2}^{-1}q_{2}m_{2,p_{2}}^{p _{2}} \tag{11}\] \[m_{1,p_{1}} =m_{1}\bmod p_{1}\]0 \[m_{1,p_{1}} =m_{1}\bmod p_{1}\]1  
\(P_{3}\) randomly chooses \(r_{3}\in\{0,1\}^{\lambda}\) and \(r_{3}^{\prime}\in\{0,1\}^{3\lambda}\). Then, \(P_{3}\) computes as follows and sends \(C_{P_{3}}\) and \(C_{3}\) to \(P_{2}\). \[m_{1,p_{1}} =m_{1}\bmod p_{1}\]2 \[m_{1,p_{1}} =m_{1}\bmod p_{1}\]3 \[m_{1,p_{1}} =m_{1}\bmod p_{1}\]4 \[m_{1,p_{1}} =m_{1}\bmod p_{1}\]5 \[m_{1,p_{1}} =m_{1}\bmod p_{1}\]6 \[m_{1,p_{1}} =m_{1}\bmod p_{1}\]7  
Re-Encryption: In the re-encryption phase, \(P_{2}\) receives the ciphertexts \(C_{P_{1}}\) and \(C_{1}\) from \(P_{1}\) and \(C_{P_{3}}\) and \(C_{3}\) from \(P_{3}\). \(P_{2}\) opens the trapdoor permutation with its secret key \(sk_{P_{2}}\), randomly chooses \(r_{2}^{\prime}\) and \(r_{2}^{{}^{\prime\prime}}\in\{0,1\}^{3\lambda}\), then re-encrypts the ciphertexts \(C_{1}\) and \(C_{3}\) as follows.