# LPCP: An efficient Privacy-Preserving Protocol for Polynomial Calculation Based on CRT
## 6 Extension to Three and More Parties LPCP
\[m_{1,p_{1}} =m_{1}\bmod p_{1}\]8 \[m_{1,p_{1}} =m_{1}\bmod p_{1}\]9 \[m_{1,q_{1}} =m_{1}\bmod q_{1}\]0 \[m_{1,q_{1}} =m_{1}\bmod q_{1}\]1 \[m_{1,q_{1}} =m_{1}\bmod q_{1}\]2 \[m_{1,q_{1}} =m_{1}\bmod q_{1}\]3 \[m_{1,q_{1}} =m_{1}\bmod q_{1}\]4 \[m_{1,q_{1}} =m_{1}\bmod q_{1}\]5 \[m_{1,q_{1}} =m_{1}\bmod q_{1}\]6 \[m_{1,q_{1}} =m_{1}\bmod q_{1}\]7  
After the re-encryption, \(P_{2}\) sends the re-encrypted ciphertexts \(C_{1}^{re-enc}\) and \(C_{3}^{re-enc}\) back to \(P_{1}\). \(P_{1}\) randomly chooses \(r_{4}\in\{0,1\}^{3\lambda}\) and re-encrypts \(C_{3}^{re-enc}\) as follows. \[ \begin{split} C_{3,p2}^{re-mc}&=C_{3}^{re-mc}\bmod p_{1}\\ C_{3,d2}^{re-enc}&=C_{3}^{re-enc}\bmod q_{1}\\ C_{3}^{re-enc^{\prime}}&=(p_{1}^{-1}p_{1}C_{3,d2}^{ re-emcq1}+q_{1}^{-1}q_{1}C_{3,p_{2}}^{re-encP2}+r_{4}N_{1})\bmod T_{1}\end{split}  \tag{14}\]  
Evaluation Round1: In the first round of the evaluation phase, \(P_{1}\) encrypts the resulting ciphertext \(C_{round1}\) instead of sending it back to \(P_{2}\). \(P_{1}\) randomly chooses \(r_{5}\in\{0,1\}^{\lambda}\) and \(r_{5}^{\prime}\in\{0,1\}^{3\lambda}\). \[ \begin{split} T_{2}&=f_{sk_{P_{1}}}(C_{P_{2}}),\\ C_{1,real}&=r_{1}^{-1}C_{1}^{re-enc}\bmod T_{2}\\ C_{2,real}&=C_{2}\bmod T_{2}\\ C_{term_{i}}&=k_{i}C_{1,real}^{a_{i}}C_{2,real}^{b_{i} }\bmod T_{2}\\ C_{round1}&=\sum_{i=1}^{n}C_{term_{i}}\end{split}  \tag{15}\]  
Then \(P_{2}\) computes the ciphertext \(C_{round1}^{\prime}\) and sends it to the third participant party \(P_{3}\). \[ \begin{split} C_{round1,p_{1}}&=C_{round1}\bmod p_{ 1}\\ C_{round1,q_{1}}&=C_{round1}\bmod q_{1}\\ C_{round1,CRT}&=p_{1}^{-1}p_{1}C_{round1,q_{1}}^{q_ {1}}+q_{1}^{-1}q_{1}C_{round1,p_{1}}^{p_{1}}\\ C_{round1}^{\prime}&=<r_{5},r_{5}^{\prime}>.<C_{round1,CRT},N_{1}>\bmod T_{1}\\ &=(r_{5}(p_{1}^{-1}p_{1}C_{round1,q_{1}}^{q_{1}}+q_{1}^{-1}q_{1}C_ {round1,p_{1}}^{p_{1}})+r_{5}^{\prime}N_{1})\bmod T_{1}\end{split}  \tag{16}\]  
Evaluation Round2 \(P_{3}\) receives the ciphertext \(C_{round1}^{\prime}\) and \(C_{3}^{re-enc^{\prime}}\), then computes as follows. \[ \begin{split} C_{round1,eval}^{\prime}&=r_{3}^{-1}C_ {round1}^{\prime}\bmod T_{1}\\ C_{3,eval}^{re-enc^{\prime}}&=C_{3}^{re-enc^{\prime}} \bmod T_{1}\\ C_{term_{i}}^{\prime}&=C_{round1,eval}^{\prime}C_{3,eval}^{re-enc^{\prime}}\bmod T_{1}\\ C_{round2}&=\sum_{i=1}^{n}C_{term_{i}}^{\prime} \end{split}  \tag{17}\]  
After the evaluation, the ciphertext \(C_{round2}\) is sent to \(P_{1}\) for partial decryption. Decryption In the decryption phase, \(P_{1}\) performs the first decryption, then \(P_{2}\) performs the second decryption. \[ \begin{split} C_{F}&=C_{round2}\bmod N_{1}\\ Output&=C_{F}\bmod N_{2}\\ Output&=F(m_{1},m_{2},m_{3})\end{split}  \tag{18}\]  
The existence of two rounds of evaluation is to make sure the ciphertexts are encrypted by the same private space and lie in the same ring space. When there are more than three parties, we can make use of the paradigm above to modify our LPCP scheme. However, the more parties there are, the more communication rounds there will be. When the party number grows large, the communication overhead increases rapidly, which leads to high latency. We will research this problem in our later work.