Client-Private Secure Aggregation for Privacy-Preserving Federated Learning
Abstract
Privacy-preserving federated learning (PPFL) is a paradigm of distributed privacypreserving machine learning training in which a set of clients, each holding siloed training data, jointly compute a shared global model under the orchestration of an aggregation server.
The system has the property that no party learns any information about any client’s training data, besides what could be inferred from the global model.
The core cryptographic component of a PPFL scheme is the secure aggregation protocol, a secure multi-party computation protocol in which the server securely aggregates the clients’ locally trained models into an aggregated global model, which it distributes to the clients.
However, in many applications the global model represents a trade secret of the consortium of clients, which they may not wish to reveal in the clear to the server.
In this work, we propose a novel model of secure aggregation, called client-private secure aggregation (CPSA), in which the server computes an encrypted global model which only the clients can decrypt.
We provide three explicit constructions of CPSA which exhibit varying trade-offs.
We also conduct experimental results to demonstrate the practicality of our constructions in the cross-silo setting when scaled to 250 clients.
Introduction
Federated learning (FL) [24] is a paradigm of distributed machine learning (ML) training in which n clients, each holding siloed training data, jointly compute a shared global model under the orchestration of an aggregation server, without revealing their training data in the clear.
This is particularly applicable in industries where sensitive data is distributed across silos and centralizing such data for analysis is infeasible.
For example, in the healthcare domain, a consortium of healthcare providers, each hosting patient-level sensitive data, can contribute towards building a shared machine learning model to improve patient care, while aiding in complying with regulatory guidelines [10, 11, 12].
Also, in the financial services industry, FL has been applied to leverage data hosted across a consortium of banks to improve their joint ability to detect credit card fraud [32].
In FL, the aggregation server maintains the current state of the global model so that when new clients join, the global model can be distributed to the new clients.
Additionally, the aggregation server facilitates communication between the consortium of clients so that the clients need not establish a complete network graph to directly communicate with each other.
In this work, we consider cross-silo FL, in which the clients are typically fixed institutions (e.g. banks, hospitals, research institutions, etc.), and total in number on the order of 100 .
FL begins with the server sending the initial global model to all clients.
Each client then locally trains the model on their training data to compute a local model update, which they send to the aggregation server.
The server aggregates the model updates from the clients to compute a global model update, which it applies to the initial model to compute a new global model.
The new global model is then broadcast to the clients.
This process can be repeated until a global optimum is reached.
Note that after an iteration of FL, each party receives the new aggregated global model without any client sharing their training data in the clear.
However, several attacks [31, 33] demonstrate that an adversary can partially reconstruct the clients’ training data from their local model updates.
The breakthrough work of [3] constructed a secure multi-party computation (MPC) protocol in which the server computes the sum of the clients’ local model updates, which it then broadcasts to the clients.
The security of the protocol enforces that no party learns any information about any client’s model update, except for what could be inferred from the sum of the clients’ model updates.
FL in which the plaintext aggregation of clients’ local model updates in replaced with a secure aggregation protocol is called privacy-preserving federated learning (PPFL).
In PPFL, instead of each client supplying their local model update as input, each client can simply supply their local model weights.
In the standard model of secure aggregation, the server ultimately computes the global model in the clear, which it then broadcasts to the clients.
However, in many cases the global model represents a trade secret of the consortium of clients, which they may not wish to leak to the server.
For example, consider the case in which a consortium of pharmaceutical companies wish to use PPFL vended by a cloud service provider (CSP) to aid with drug discovery. In this case, the global model is a trade secret of the consortium, which they do not wish to leak to the CSP.
In this work, we propose a novel model of secure aggregation, called client-private secure aggregation (CPSA), in which the server computes an encrypted global model which only the clients can decrypt.
CPSA still enjoys the security of the plain model of secure aggregation (that is, no adversarially corrupted subset of parties learns any information, beyond the protocol output, about any noncorrupted client’s input), with the additional security guarantee that an adversarial server learns no information about any client’s input, not even the protocol output.
CPSA can be combined with differential privacy (DP) to additionally enforce that any information which an adversarially corrupted subset of clients can infer from the plaintext protocol output about some non-corrupted client’s input cannot be associated with any particular client.
Finally, since in the cross-silo FL setting, the network availability of the clients is typically not an issue, we don’t seek to address client dropout in our CPSA model.
Prior Work.
Beginning with the foundational work of [3], secure aggregation protocols have been widely studied in the literature [2, 6, 7, 23, 29].
Various protocols have been constructed which offer trade-offs with respect to the security model and computational, communication, space, and round complexity.
The original work of [3] constructed a four-round secure aggregation protocol with semi-honest security (and a five-round variant with malicious security).
Their protocol works by each client choosing a random mask which locally encrypts their input as a one-time pad (OTP), but with the property that the clients’ masks all together sum to zero.
In this way, the server can sum over the
OTP’s from the clients to compute the sum of their inputs.
In [29], the authors construct a natural two-round computationally efficient secure aggregation protocol with semi-honest security using threshold additive homomorphic encryption (AHE).
The work of [2] employs a simple additive secret sharing approach to achieve a one-round maliciously secure aggregation protocol.
Their protocol is computationally and communication-efficient, but requires two independent non-colluding servers.
Recall that the security property of a secure aggregation protocol enforces that no party learns any information about any other party’s input, except for what could be inferred from the protocol output.
This begs the question if we can enforce a privacy guarantee against an adversary inferring information about a party’s input from the protocol output.
Differential privacy (DP) [14, 15] is a statistical model of privately releasing aggregate data which masks a single party’s contribution to the aggregate data.
That is, DP ensures that no adversary, given access to the differentially private aggregate data, can infer any information about any particular party’s contribution to the aggregate data.
Several secure aggregation protocols [6, 7, 20] employ DP to construct a protocol in which all parties compute a differentially private sum of the clients’ inputs.
Our Contributions.
We introduce a novel model of secure aggregation for PPFL, called clientprivate secure aggregation (CPSA), in which the server computes an encrypted global model which only the clients can decrypt.
CPSA protocols combined with differential privacy achieve complete input privacy for the clients during PPFL, precluding model inversion and membership inference attacks against all parties.
Additionally, this model enforces a stronger security guarantee against the server, namely that an adversarial server learns no information about any client’s input, not even the protocol output.
We construct three novel CPSA protocols, Π 0 , Π 1 , Π 2 , which are secure against a semi-honest adversary, and each offer varying trade-offs.
If m ∈ N is the dimension of each client’s input vector to the protocol, then we define m ′ = m ′ ( m, n ) ∈ N as the dimension of the server’s output ciphertext vector.
Π 0 is a two-round protocol, while the other two both require three rounds. Π 1 and Π 2 both achieve a constant-rate output ciphertext vector dimension of m ′ = m , while Πhas m ′
=
O ( mn 2 ) .
Π 1 is more communication efficient over Π 0 and Π 2 , but the decryption key used by the clients in Π 1 to decrypt the ciphertext output by the server is not reusable over multiple iterations of CPSA for PPFL. Consequently, when new clients join the collaboration, the trusted setup algorithm which distributes the decryption key to the new clients must interact with the protocol participants to update the decryption key after each iteration. On the other hand, Π 2 supports reusable decryption keys, and so the trusted setup algorithm need not function as an active participant in the protocol. Finally, we provide an empirical evaluation of our protocols to demonstrate their practicality when scaled to 250 clients.
We remark that we limit the scope of this work to studying the CPSA protocol itself.
A plethora of prior works ([2, 6, 7, 29], and many more) have shown how to use PPFL with different secure aggregation protocols and DP to train high-quality models on popular standard datasets, and so it’s clear that CPSA protocols can be similarly applied in this manner.
Preliminaries 2.1 Notation
If k ∈ N , then we denote by [ k ] the set { 1 , 2 , . . .
, k } .
If q ∈ N , then we write Z q for the ring of integers (mod q ) .
For m ∈ N , we denote vectors in Z mq by bold lower-case characters x .
If x ∈ Z mq , then we denote the i th component of x by x i ∈
Z q .
If x 1 , . .
, x m ∈ Z q , then we write ( x i ) i ∈ [ m ] for the vector in Z mq whose i th component is x i .
Sets are written as S , algorithms are written as A , and probabilistic distributions are written as D .
Throughout this work, we denote the security parameter by λ ∈ N .
A quantity f ( λ ) is said to be negligible in λ , written f ( λ ) =
negl( λ ) , if f ( λ ) asymptotically tends to zero faster than any inverse polynomial in λ .
A quantity f ( λ ) is said to be polynomial in λ if f ( λ ) =
O ( λ c ) , for some constant c ∈ N .
We say that two distributions X and Y are statistically indistinguishable, written X ≡ Y , if for every probabilistic algorithm A which gives output in { 0 , 1 } , it holds that
[Equation]
In the aforementioned definition, if we instead restrict A to be a probabilistic polynomial time (PPT) algorithm, then we say that X and Y are computationally indistinguishable, and write X ≈ c Y .
[-Z mq of the clients’ inputs a vector of independentlygenerated Gaussian samples e ← N mσ , where N σ denotes the Gaussian distribution centered at 
-]
2.2 Key Agreement Scheme
[-We remark that for both the client and server, the communicationand space overhead between the two protocol constructions is quite comparable, except that theserver’s space overhead of 
-]
Here, we define a key agreement scheme [8], which is typically used for two parties to agree on a shared key for a symmetric-key cryptosystem.
Definition 1.
A key agreement scheme is a pair of PPT algorithms KA =
( Gen , Agree ) with the following syntax, correctness, and security.
Syntax:
• Gen (1 λ ) takes as input the security parameter λ and outputs a public/secret key pair (pk , sk) for some user.
• Agree (sk i , pk j ) takes as input a secret key
sk i corresponding to some user i , and a public key pk j , corresponding to some user j ̸
= i , and outputs a key k i,j from the key space K .
Correctness: Let λ be the security parameter.
If (pk 1 , sk 1 ) , (pk 2 , sk 2 ) ← Gen (1 λ ) , k 1 , 2 =
Agree (sk 1 , pk 2 ) , k 2 , 1 = Agree (sk 2 , pk 1 ) , then k 1 , 2 = k 2 , 1 .
Security: Let λ be the security parameter.
Define the following distributions:
• D 0 (1 λ ) :
Compute (pk 1 , sk 1 ) , (pk 2 , sk 2 ) ← Gen (1 λ ) , k = Agree (sk 1 , pk 2 ) , and output (pk 1 , pk 2 , k) .
• D 1 (1 λ ) : Compute (pk 1 , sk 1 ) , (pk 2 , sk 2 ) ← Gen (1 λ ) , k ← K , and output (pk 1 , pk 2 , k) .
If A is a PPT distinguishing algorithm, then ∀ b ∈ { 0 , 1 } , define
[Equation]
Then, for all PPT distinguishing adversaries A ,
[Equation]
2.3 Authenticated Encryption
Authenticated encryption (AE) is a cryptographic primitive that provides confidentiality and integrity of messages exchanged between two parties which each hold a shared symmetric key.
Definition 2.
An authenticated encryption scheme is a triple of PPT algorithms AE =
( Gen , Enc , Dec ) with the following syntax, correctness, and security.
Syntax:
• Gen (1 λ ) takes as input the security parameter λ and outputs a symmetric key k ∈ K in the key space K .
• Enc (k , m ) takes as input a symmetric key k ∈ K , a message m ∈ M in the message space M , and outputs a ciphertext c =
( c ′ , t ) ∈ C of m under k in ciphertext space C .
c ′ denotes the actual ciphertext of the message, while t denotes the message authentication code (MAC).
• Dec (k , c ) takes as input a symmetric key k ∈ K and a ciphertext c
= ( c ′ , t ) ∈ C , and outputs either a message m ∈ M or an error symbol ⊥ .
Correctness: Let λ be the security parameter.
If k ← Gen (1 λ ) , m ∈ M is a message, c ←
Enc (k , m ) , then Dec (k , c ) = m .
Semantic Security: Let λ be the security parameter.
If k ← Gen (1 λ ) , then for every PPT distinguishing adversary A and distinct messages m 0 , m 1 ∈ M , it holds that
[Equation]
Ciphertext Integrity: Let λ be the security parameter.
The AE scheme AE =
( Gen , Enc , Dec ) is said to provide ciphertext integrity if every PPT adversary A can only win the following game against a computationally unbounded challenger C with probability negl( λ ) :
Setup : C computes k ← Gen (1 λ )
Query Phase:
For all i = 1 , . . .
, r = poly( λ ) , A generates a message m i ∈ M and send m i to C .
C then computes and outputs to A the ciphertext
c i ← Enc (k , m i ) .
Challenge Phase: A produces and sends to C a ciphertext c ′ ∈ C .
A wins if c ′ / ∈ { c 1 , . . .
, c r } and
Dec (k , c ′ ) ̸
= ⊥ .
2.4 Pseudorandom Generator
Definition 3.
Let r, s ∈ N such that r < s .
A pseudorandom generator (PRG) [21, 22] is a PPT function G : { 0 , 1 } r → { 0 , 1 } s such that G (cid:0) U ( { 0 , 1 } r ) (cid:1)
≈ c U ( { 0 , 1 } s ) , where U ( { 0 , 1 } r ) and
U ( { 0 , 1 } s ) denote the uniform distributions on { 0 , 1 } r and { 0 , 1 } s , respectively.
A PRG G can be used to strecth a random shared symmetric key in the following way.
Let K be a symmetric key space and q, m ∈ N such that log 2 ( | K | ) < m log 2 ( q ) .
Then, it is easy to see that without loss of generality we can define a PRG G : K → Z mq .
2.5 Additive Secret Sharing
Let n, t, q ∈ N .
A ( t, n ) − secret sharing scheme over Z q is a pair of PPT algorithms ( Share , Rec ) with the following properties:
• Share ( x ) takes as input a secret x ∈ Z q and outputs shares { s i } i ∈ [ n ] for a set of n users, indexed by [ n ] .
• Rec ( { x i j } j ∈ [ t ] ) takes as input a subset { x i j } j ∈ [ t ] ⊆
Z q of t distinct shares of a secret x ∈ Z q , and reconstructs and outputs x ∈ Z q .
• Any subset of shares of size less than t is statistically independent of the underlying secret.
Additive secret sharing is a ( n, n ) − secret sharing scheme over Z q in which Share ( x ) chooses random s 1 , . . .
, s n − 1 ← Z q , computes s n = x − (cid:80) i ∈ [ n − 1]
s i
∈
Z q , and outputs { s i } i ∈ [ n ] .
Rec ( { s i } i ∈ [ n ] ) simply works by outputting n (cid:80) i =
1 s i ∈
Z q .
Note that any subset of { s i } ni =1 of size k < n is distributed identically to k uniformly random elements of Z q , hence is statistically independent of the secret x .
2.6 Homomorphic Encryption
Homomorphic encryption (HE) [4, 5, 16, 18, 19, 26, 27] is a cryptographic primitive which enables computation directly on encrypted data.
That is, HE is an encryption scheme which supports homomorphic addition or multiplication operations, so that a party, holding only ciphertexts of two messages m 1 , m 2 , can apply the homomorphic addition (resp., multiplication) operation to compute a ciphertext of m 1 + m 2 ( resp., m 1 · m 2 ) .
Since an arbitrary computable function f : { 0 , 1 } ∗ → { 0 , 1 } ∗ can be expressed as an arithmetic circuit, then theoretically a HE scheme allows a client C , which holds a private input x ∈ { 0 , 1 } ∗ , to outsource the computation of f ( x ) to a server S without revealing any information about x to S .
This works by C encrypting x ∈ { 0 , 1 } ∗ and sending the ciphertext to S , which can homomorphically compute a ciphertext of f ( x ) which can be decrypted by C .
The semantic security of the HE scheme ensures that S learns no information about x during the homomorphic evaluation of f ( x ) .
A partially homomorphic encryption (PHE) scheme is an HE scheme that supports either homomorphic addition or multiplication operations, but not both.
PHE schemes are either additive homomorphic encryption (AHE) schemes or multiplicative homomorphic encryption (MHE) schemes.
An example of an AHE scheme is Paillier Encryption [26], while examples of MHE schemes are
RSA [28] and ElGamal Encryption [17].
A fully homomorphic encryption (FHE) scheme is a HE scheme that supports both homomorphic addition and multiplication operations.
First constructed by Craig Gentry in [18], numerous follow-up works [4, 5, 16, 19] introduced improved constructions of FHE schemes.
Most FHE constructions rely on a computationally expensive bootstrapping operation [1, 9, 13] to refresh the ciphertexts after a fixed-length consecutive sequence of homomorphic operations.
Indeed, these bootstrapping algorithms continue to serve as the principal bottleneck in achieving FHE as a computationally practical general-purpose solution to privacy-preserving cloud-outsourced computation.
In this work, we use AHE, and so for completeness we provide a formal definition of AHE below.
Definition 4.
An additive homomorphic encryption (AHE) scheme is a quadruple of PPT algorithms
AHE =
( Gen , Enc , Dec , Add ) with the following syntax, correctness, and security.
Syntax:
• Gen (1 λ ) takes as input the security parameter λ ∈ N and outputs a public/secret key pair (pk , sk) .
• Enc (pk , m ) takes as input a public key pk and message m ∈ M in the message space M , and outputs a ciphertext c ∈ C in the ciphertext space C .
• Dec (sk , c ) takes as input a secret key sk and ciphertext c ∈ C , and outputs a message m ∈ M .
• Add ( c 1 , c 2 ) takes as input two ciphertexts c 1 , c 2 ∈ C and outputs a ciphertext c 3 ∈ C .
Correctness of Decryption: Let λ ∈ N be the security parameter, m ∈ M be a message, and suppose (pk , sk) ← Gen (1 λ ) , c ← Enc (pk , m ) .
Then, Dec (sk , c ) = m .
Correctness of Homomorphic Addition: Let λ ∈ N be the security parameter, m 1 , m 2 ∈ M be a message, and suppose (pk , sk) ← Gen (1 λ ) , c i ← Enc (pk , m i ) ∀ i ∈ { 1 , 2 } , and c 3 ← Add ( c 1 , c 2 ) .
Then, Dec (sk , c 3 ) =
m 1 + m 2 .
Semantic Security: Let λ ∈ N be the security parameter, and suppose (pk , sk) ← Gen (1 λ ) .
If A is a PPT distinguishing algorithm and m 0 , m 1 ∈ M are distinct messages, then ∀ b ∈ { 0 , 1 } define
[Equation]
Then, for every PPT distinguishing adversary A and distinct messages m 0 , m 1 ∈ M , it holds that
[Equation]
2.7 Differential Privacy
Differential privacy (DP) [14, 15] is a statistical model of private aggregate data release which masks a single party’s contribution to the aggregate data.
That is, DP ensures that no adversary, given access to the differentially private aggregate data, can infer any information about any particular party’s contribution to the aggregate data.
While an adversary may infer be able to infer information about some client’s contribution to the aggregate data, they can’t associate that inference with a particular client.
Let X, Y ⊆ R , n, m ∈ N , and f : X n → Y m be a function.
f is meant to model an aggregate function of data collected from n users which is represented as a database record x ∈ X n .
We define the function dist( · , · ) : X n × X n → Z as the hamming distance function ( i.e., dist( x , x ′ ) =
# { i ∈ [ n ] : x i ̸ = x ′ i } ) .
A differentially private mechanism for f is a PPT algorithm M f which gets oracle access to f , takes input in X n , and provides output in Y m .
We now provide a formal definition of a differentially private mechanism below.
Definition 5.
Let ε, δ > 0 .
A PPT algorithm M f is said to be an ( ε, δ ) − differentially private mechanism for f if ∀ x , x ′ ∈ X n such that dist( x , x ′ )
= 1 , and ∀ S ⊆ supp( M ) ,
[Equation]
The parameters ( ε, δ ) in the definition above are said to be the privacy parameters.
It is important to emphasize that a differentially private mechanism M f does not :
• Guarantee that the output M f ( x ) cryptographically hides either the aggregate data f ( x ) or the input record x . • Guarantee that the values of M f ( x ) and M f ( x ′ ) are the same when dist( x , x ′ )
= 1 .
A differentially private mechanism M f does guarantee is if x , x ′ ∈
X n are neighboring databases ( i.e., dist( x , x ′ )
= 1) , then the distributions M f ( x ) and M f ( x ′ ) are close.
Consequently, no adversary can distinguish between the cases in which it sees M f ( x ) and M f ( x ′ ) , thus masking a particular user’s contribution to the aggregate data.
It follows that any information the adversary could possibly infer from M f ( x ) can’t be associated with a particular user i ∈ [ n ] . All differentially private mechanisms work by into [Equation]
In this section, we define our model of client-private secure aggregation and describe its security model.
Secure Aggregation. Let λ ∈ N be the security parameter and n = n ( λ ) , q = q ( λ ) , m = m ( λ ) . A secure aggregation protocol is a secure multi-party computation (MPC) protocol executed among a set of parties P = {C 1 , . .
, C n , S} consisting of n clients C 1 , . .
, C n and a server S .
The protocol utilizes the star network graph in which each client C i has an established secure communication channel with the server S .
Each client C i holds a private input x i ∈
Z mq , the server has no input, and all parties securely compute z
= (cid:80)
i x i
∈ Z mq .
In each round of the protocol, every client sends a message to the server, and the server responds with a message for each client.
Client-Private Secure Aggregation.
Here we define a novel model of secure aggregation which we call client-private secure aggregation (CPSA).
The syntax of a CPSA protocol Π is described in Figure 1.
In CPSA, the server outputs a ciphertext c of the sum z
= (cid:80) i x i of the clients’ inputs, which only the clients can decrypt to z .
Intuitively, the security of the protocol enforces that an adversarial server learns no information about any client’s input, not even the sum of their inputs.
Additionally, no adversary which corrupts a subset of parties containing at least one client learns any information about any non-corrupted client’s input, except for what could be inferred from the sum of the clients’ inputs.
We formally define the security model of CPSA in Section 3.1.
Notation: Let λ ∈ N be the security parameter and n = n ( λ ) , q = q ( λ ) , m = m ( λ ) , m ′ = m ′ ( λ ) ∈ N .
The protocol participants are n clients C 1 , . .
, C n and a server S .
Let
C be the ciphertext space of an encryption scheme.
Input:
Each client C i ( i ∈ [ n
) receives as input x i ∈
Z mq ; the server S has no [Figure] Adding Differential Privacy. We briefly describe a generic method to integrate differential privacy (DP) into CPSA.
By adding DP to CPSA, we can enforce the additional security property that any information which an adversarial subset of parties containing at least one client can infer from the sum of the clients’ inputs about some client’s input cannot be associated with any particular client.
Following the distributed DP approach outlined in [29], each client C i can employ the
Gaussian Mechanism M σ ( σ > 0) to perturb their input x i ∈
Z m q by an independent sample e i ← N mσ encoded component-wise into the domain Z mq of the protocol 2 , where N σ is the Gaussian distribution with mean 0 and variance σ 2 .
If ε ∈ (0 , 1) and δ > 0 , then by Theorem 3.22 in [15],
M σ is ( ε, δ ) − differentially privacy when σ > (cid:112) ∆ 2 ( f ) /ε · (cid:0) ln(25 δ/ 16) (cid:1) 1 / 4 , where ∆ 2 ( f ) is the ℓ 2 − sensitivity of the sum function f : ( Z mq ) n → R m defined by f (cid:0) ( x 1 , . . .
, x n ) (cid:1) = (cid:80) i x i .
In order to obtain a reasonable bound on ∆ 2 ( f ) , we can employ the norm clipping technique outlined in [30]: in PPFL, after each client C i locally trains their model and obtains a vector v i ∈
R m of model weights, they can clip v i by rescaling v ′
i :
= v i / max { 1 , ||
v i || /C } .
It turns out that we can now bound ∆ 2 ( f ) ≤ 2 C/k , where C > 0 is the clipping threshold and k ∈ N is the minimum client dataset size (Lemma 1 of [30]).
Since the Gaussian distribution is additive with respect to the variance of independent samples (cid:0) i.e. , if e i ← N σ i ∀ i ∈ { 1 , 2 } ( σ 1 , σ 2 > 0) , then e 1 + e 2 ← N σ ′ where σ ′ =
(cid:112) σ 21 + σ 22 (cid:1) , then each client can locally perturb its input by an independent sample e i ← N mσ for σ > (cid:112) 2 C/ ( knε ) · (cid:0) ln(25 δ/ 16) (cid:1) 1 / 4 .
Then, at the end of the protocol, each client outputs (cid:80) i v i + (cid:80) i e i , where (cid:80) i e i ← N σ √ n and σ √ n > (cid:112) 2 C/ ( kε ) · (cid:0) ln(25 δ/ 16) (cid:1) 1 / 4 , as desired.
3.1 Security Model
We next describe the security model of CPSA. Let Π be a CPSA protocol.
We define two notions of security:
S1: No information about any client’s input, other than the protocol output, is revealed to any other party.
S2: No information about any client’s input, not even the protocol output, is revealed to the server.
Additionally, we are concerned with the threats:
T1:
A subset of colluding clients attempts to learn information about another client’s input.
T2: The server alone attempts to learn information about some client’s input.
T3:
A subset of clients collude with the server to attempt to steal information about another client’s input.
Our security model of client-private secure aggregation enforces S1 against against all threats, and S against T2 .
Since by definition of client-private secure aggregation, each client computes the protocol output in the clear, then it is not possible to enforce S2 against T3 .
We formally prove each notion of security using the standard real/ideal world paradigm.
Let A be a PPT adversary controlling a corrupted subset C ⊆ P of parties.
We define the view of A in Π as the distribution that includes the input and random coins from each P ∈ C , as well as the messages sent to each P ∈ C from the non-corrupted parties.
Let Sim be a PPT simulation algorithm which simulates the view of A in an ideal execution of Π , without access to the non-corrupted parties’ inputs.
The ideal execution of Π is defined in Figure 2.
We define the following random variables:
• Real Π ,P,C, A (cid:16) 1 λ , { x i } i ∈ [ n ] (cid:17) is the view of A during a real execution of Π . • Ideal Π ,P,C, A , Sim (cid:18) 1 λ , { x i } i ∈ [ n ] s.t. C i ∈ C (cid:19) is the view of A during an ideal execution of Π . We say that Π is secure against A controlling C if there exists a PPT simulation
algorithm Sim such that Real Π ,P
[Equation] C [Equation] x
[Equation] i ∈ [Equation] There are two types of adversaries we are concerned with: semi-honest and malicious adversaries.
A semi-honest adversary instructs the corrupted parties to follow the protocol honestly, but attempts to infer information about the non-corrupted parties’ inputs from its view.
In contrast, a malicious adversary can instruct the corrupted parties to deviate from the protocol, sending arbitrary messages or dishonestly forwarding messages to parties, to attempt to infer information about the non-corrupted parties from its view.
We say that Π is secure in the semi-honest model (resp., secure in the malicious model ), if for every semi-honest (resp., malicious) adversary A , and every subset C ⊆ P of corrupted parties, Π is secure against A controlling C .
Explicit Constructions of CPSA
In this section, we provide three explicit constructions of CPSA, and discuss their trade-offs.
Actually, our first protocol construction Π 0 is just a simple modification of the two-round secure aggregation protocol of [3] described in [7]: their protocol works by the clients C 1 , . . . , C n computing random elements r 1 , . . . , r n ← Z q , respectively, such that (cid:80) i r i = {+
 ∈+}
Z q .
Each client C i , holding input x i ∈
Z q , then computes a one-time pad
y i := x i
+ r i ∈
Z q of their input and sends y i to the server S .
S then computes z = (cid:80) i y i = (cid:80) i x i ∈ Z q , and outputs z to each client.
The protocol Π 0 simply has
Notation: Let λ ∈ N be the security parameter and n = n ( λ ) , q = q ( λ ) , m = m ( λ ) , m ′ = m ′ ( λ ) ∈ N .
The protocol participants are a set P
= {C 1 , . .
, C n , S} consisting of n clients C 1 , . .
, C n and a server S .
Let ( Gen , Enc , Dec ) be an encryption scheme with ciphertext space C .
Let A be a PPT adversary which controls a subset C ⊆ P of corrupted parties, and Sim be a PPT simulation algorithm which simulates the distribution of messages sent from the non-corrupted parties to the corrupted parties. Input: Each client C i ∈ C receives as input x i ∈
Z mq ; the server S has no input.
The simulation algorithm Sim does not have access to the non-corrupted clients’ inputs.
Output: The server S computes and outputs a vector c ∈ C m ′ to each client C i ; each client C i outputs n (cid:80) i = 1 x i ∈ Z mq .
Simulation: In each round of Π , every corrupted client C i ∈ C computes its output message according to A , and sends that message to S .
Every non-corrupted client
C j ∈ {C 1 , . .
, C n }\ C computes its output message according to Sim , and sends that message to S .
If S is corrupted (resp., non-corrupted), then S computes its output messages for each client according to A (resp., Sim ), and sends each client their corresponding message.
Criterion ΠΠΠ
Rounds
Client Computational Complexity
O ( mn )
O ( mn )
O ( mn )
Server Computational Complexity
O ( mn 2 )
O ( n ( m + n ))
O ( mn 2 )
Client Communication Complexity
O ( mn )
O ( m + n )
O ( mn )
Server Communication Complexity
O ( mn 2 )
O ( n ( m + n ))
O ( mn 2 )
Client Storage Complexity
O ( m + n )
O ( m + n )
O ( m + n )
Server Storage Complexity
O ( mn 2 )
O ( [Table]
key criterion refers to whether the decryption key which the clients use at the end of the protocol to decrypt the encrypted sum of their inputs can be used over multiple iterations of each client C i use an authenticated encryption scheme to encrypt y i for every other client C j under a shared symmetric key
k i,j .
The server S simply forwards the appropriate ciphertexts to each client, who can then compute z = (cid:80)
[Equation]
y
[Equation]
= (cid:80) i x i
∈ Z q .
We formally describe the protocol Π 0 in Appendix
A.
We now construct two more CPSA protocols: Π 1 and Π 2 .
Table 1 provides a theoretical evaluation and comparison of the three protocols Π 0 , Π 1 , Π 2 .
Π 1 is optimal with respect to almost every criterion, except that Π 0 is two-round protocol and Π 2 supports a reusable decryption key.
The latter point means that the key which the clients use at the end of the protocol to decrypt the encrypted sum of their inputs can be reused over multiple iterations of CPSA.
This is important since when applied to PPFL, if the decryption key is not reusable and a client joins the collaboration in a future iteration of PPFL, in order to decrypt the encrypted initial global model from the server, a trusted setup algorithm would have to distribute the decryption key from the previous iteration of PPFL to the new client.
This requires interaction between the protocol participants and the trusted setup algorithm to update the decryption key in each iteration of PPFL.
On the other hand, CPSA schemes which support a reusable decryption key allow the trusted setup algorithm to simply distribute a fixed decryption key to the new client upon joining the collaboration, without the need for interaction with the protocol participants to update the decryption key after each iteration.
Additionally, letting m ′ ∈ N be the dimension of the ciphertext vector which the server computes in the last round of
CPSA, we have m ′ =
O ( mn 2 ) in Π 0 , while m ′ =
m in Π 1 and Π 2 .
We next proceed to the explicit constructions of Π 1 and Π 2 .
4.1 Protocol Π
Here, we construct a three-round CPSA protocol Π 1 with semi-honest security.
At a high level, the protocol works by each client C
i choosing a uniformly random s
i ← Z q , and the clients all jointly computing s :
= (cid:80) i s i ← Z q , which is kept secret from the server S .
Then, clients C 1 , . .
, C n compute random vectors r 1 , . . .
{+, r n ← Z q , respectively, such that (cid:80) i r i = 
+}
∈
Z q .
Each client C i , holding input x i ∈
Z q , then computes y i :
= x i + s i
+ r i ∈
Z q , and sends y i to S .
The server S then computes c := (cid:80) i y i = (cid:80) i x i + s ∈ Z q and outputs c to each client. Each client C i then computes z :=
c − s = (cid:80) i x i ∈ Z q .
Note that the server computes a one-time pad c of z which each client can decrypt to z . The full protocol description is detailed in Figure 3.
[Table]
• C i → S : Generate (pk ( b ) i , sk ( b ) i ) ← KA . Gen (1 λ ) , ∀ b ∈ { 0 , 1 } , and output (pk (0) i , pk (1) i ) .
• S
→ C i : Output (cid:110) (pk (0) j , pk (1) j ) (cid:111) j ∈ [ n
• S → C i y i • C i : Receive c
Z
Correctness.
We now prove the correctness of Π 1 , captured by Lemma 6 below.
Lemma 6.
After an execution of Π 1 , the server computes and outputs c ′ = (cid:80) i x i + s ∈ Z mq , and each client outputs (cid:80)
[Equation]
Proof.
In Round 3, the server computes [Equation] The key observation is that for each distinct pair ( i, j ) , r i,j = G (cid:16) KA . Agree (sk (1) i , pk (1) j ) (cid:17) =
G (cid:16) KA .
Agree (sk (1) j , pk (1) i ) (cid:17) =
r j,i , hence (cid:80) i>j r i,j − (cid:80)
{+i<j r i,j = 
+}
∈
Z mq .
We thus have that (8) = (cid:80) i x i + s ∈ Z mq .
Each client, holding both c ′ and s , then computes c ′ − s = (cid:80) i x i
∈
Z mq .
Security.
We now prove the security of P 1 .
Specifically, we prove the security property S1 against threats T1 and T3 (Lemmas 7 and 8, resp.), and security property S2 against the threat of T2 (Lemma 9).
Lemma 7.
Let A be a semi-honest adversary which corrupts a subset C ⊂ {C 1 , . .
C n } of clients.
Then, Π 1 is secure against A controlling C .
Proof.
Let T =
{ i ∈ [ n ] : C i / ∈ C } , and assume WLOG that T ̸
= ∅ .
Observe that in the protocol Π 1 , the only messages which fall into the view of A that are dependent on { x i } i ∈ T is the computation c ′ = n (cid:80) i =
1 x i + s ∈ Z mq sent from the server to each client in the last round of the protocol.
Since each client holds s ∈ Z mq , and each corrupted client C i ∈ C holds their input x i ∈
Z mq , then nothing more than z := (cid:80) i ∈
T x i =
c ′ − (cid:80) i/ ∈ T x i − s ∈
Z m q is revealed to A .
So, the simulation algorithm Sim which is the same as Π 1 , except that each noncorrupted client C j is given input x ′ j ← Z mq such that (cid:80) j ∈ T x j
= z ∈
Z mq , is such that the view of A in this simulation is distributed identically to Real Π 1 ,P,C, A (cid:16) 1 λ , { x i } i ∈ [ n ] (cid:17) .
Hence we have Real Π 1 ,P,C, A (cid:16) 1 λ , { x i } i ∈ [ n ] (cid:17) ≡ Ideal Π 1 ,P,C, A , Sim (cid:18) 1 λ , { x i } i/ ∈ T , z (cid:19) , which completes the proof.
Lemma 8.
Let A be a semi-honest adversary which corrupts a subset C ⊂ P of parties containing the server S and at least one client.
Then, Π 1 is secure against A controlling C .
Proof.
Let Real Π 1 ,P,C, A (cid:16) 1 λ , { x i } i ∈ [ n ] (cid:17) denote the distribution of the view of A in a real execution of Π 1 in which A corrupts C .
We’ll construct a PPT simulation algorithm Sim which simulates the view of A without access to the non-corrupted clients’ inputs.
By definition of the ideal execution of Π 1 (Figure 2), this completes the proof.
Let T =
{ i ∈ [ n ] : C i / ∈ C } .
We may assume WLOG that
T ̸ = ∅ .
We’ll actually make one small modification to the ideal execution of Π 1 in this case.
Although the simulation algorithm Sim is not given access to the non-corrupted parties’ inputs, we will endow
Sim with the sum z := (cid:80) i ∈
T x i + (cid:80) i ∈
T s i ∈
Z mq of the non-corrupted parties’ inputs.
Note that this is without loss of generality since any adversary, given the server’s output (cid:80) i ∈ [ n ] x i + s ∈ Z mq , and the values (cid:8) ( x i , s i ) (cid:9) i/ ∈ T ⊆
Z mq × Z mq held by the corrupted parties can efficiently compute z .
We thus replace Ideal Π 1 ,P,C, A , Sim (cid:18) 1 λ , { x i }
i/ ∈ T
(cid:19)
with Ideal Π 1 ,P,C, A , Sim
(cid:18) 1 λ , { x i } i/ ∈ T , z (cid:19) .
We now proceed by a standard hybrid argument:
• H 0 :
This hybrid is simply a real execution of Π 1 .
{+• H 
+}
: This hybrid is the same as H 0 except that in Round 3, for each C i ∈ {C 1 , . . .
, C n }\ C , we choose r i ← Z mq such that (cid:80) i ∈
T r i =
z ∈ Z mq , and C i instead lets y i :=
r i ∈
Z mq .
By Lemma
1 in [3], we have that H 0 ≡ H 1 .
We define Sim by H 1 , and it follows that Real Π 1 ,P,C, A (cid:16) 1 λ , { x i } i ∈ [ n ] (cid:17) ≡ H 0 ≡ H 1 ≡
Ideal Π 1 ,P,C, A , Sim (cid:18) 1 λ , { x i } i/ ∈ T , z (cid:19) .
Lemma 9.
Let A be a semi-honest adversary which corrupts the server S .
Then, Π 1 is secure against
A controlling C = {S} .
Proof.
Let Sim be the simulation algorithm which is the same as Π 1 , except that in Round 3, each client C i chooses u i ← Z mq and instead sends y i :=
u i + s i ∈
Z mq to the server.
Since the distribution of each s i is computationally indistinguishable from the uniform distribution on Z mq , it follows that
Real
[Equation]
1 ,P,C, A (cid:16)
[Equation]
[Equation]
[Equation]
4.2 Protocol Π
We now construct a second novel CPSA protocol Π 2 which achieves semi-honest security.
While the computational and communication complexity of Π 2 is greater than Π 1 , in Π 2 the server computes a ciphertext of the sum of the clients’ inputs under an asymmetric key pair shared by the clients, which can be reused over multiple iterations of CPSA for PPFL.
At a high level, the protocol works by each client C i first receiving a public/secret key pair (pk , sk) for an additive homomorphic encryption (AHE) scheme from a trusted setup algorithm.
Next, each client C i splits their input x i ∈
Z q into n additive secret shares { s i,j } j ∈ [ n ] ⊆
Z q , one for every client, and distributes each share s i,j to Client
C j by way of the server.
Now, each client C i holds shares { s j,i } j ∈ [ n ] ⊆
Z m q , and sums over the shares to compute t
i = (cid:80) j ∈ [ n ] s j,i ∈
Z q , which is a share of the sum z = (cid:80) r ∈ [ n ] x r ∈ Z q .
Each client C i then uses the AHE scheme to encrypt their share t i under pk to obtain a ciphertext c
i which they send to the server.
The server homomorphically reconstructs z by homomorphically adding { c i } i ∈
[ n ] , obtaining a ciphertext c ′ of z .
The server then outputs c ′ to each client, which uses sk to decrypt c ′ to z .
The full protocol description is detailed in Figure 4.
Remark.
Note that in our protocol Π 2 , each client C i holds the same AHE secret key sk .
Although this is not typical in homomorphic encryption solutions to MPC when the number of parties is greater than 2, in this application the AHE scheme is used to hide the protocol output, which can be viewed as a secret shared by all clients, from the server.
If an adversary controlling the server corrupts a client, then the AHE secret key sk falls into the view of the adversary.
Thus the adversary learns all of the clients’ shares of the sum z ∈ Z mq , and hence the plaintext sum z falls into the adversary’s view.
But, since the adversary has corrupted the client, then z already falls into its view, and so no further information about any non-corrupted client’s input is revealed to the adversary.
Correctness. We now prove the correctness of Π 2 , captured by Lemma 10 below. Lemma 10. After an execution of Π 2 , the server outputs a vector of ciphertexts c ′′ ∈ C m to each client, and each client outputs (cid:80)
[Equation] Proof. After the end of Round 1, each client C i holds their secret key sk i and a public key pk j from every other client C j ( j ̸ = i ) for the key agreement scheme KA . So, in Round 2, each client C i computes a shared symmetric key k
i,j with every other client C j .
C i then splits its private input into additive secret shares { s i,j } j ∈ [ n ] ⊆
Z mq for every client, encrypts each C j ’s share s i,j ( j ̸ = i ) with the authenticated encryption scheme AE under the shared symmetric key k i,j , and sends the resulting ciphertexts to the server.
The server then forwards to each client C i ciphertexts of its shares s j,i from every other client C j , which it decrypts in Round 3 to obtain { s j,i } j ∈ [ n ] .
C i then computes t i = (cid:80) j ∈ [ n ] s j,i ∈
Z mq , which it follows is a share of z := (cid:80) j ∈ [ n ] x i ∈
Z mq .
Finally, C i uses the additive homomorphic encryption scheme AHE to encrypt t i under pk , obtaining a ciphertext c i , which it sends to the server.
By definition of additive secret sharing, it follows that (cid:80) i ∈
[ n ] t i =
z ∈ Z mq .
So, the server, each holding AHE ciphertext vectors c ′ 1 , . .
. , c ′ n of t 1 , . . . , t n , respectively, component-wise homomorphically adds { c ′ 1 , . . .
, c ′ n } to obtain a ciphertext c ′′ of z , which it outputs to each client.
Each client then computes z = AHE . Dec (sk , c ′′ ) .
Security.
We now prove that Π 2 is secure with respect to S1 and S2 in the semi-honest model.
Let A be a semi-honest adversary controlling a subset C ⊆ P of corrupted parties.
First, we note that the security S2 of Π 2 when C = {S} follows immediately from the semantic security of the authenticated encryption and additive homomorphic encryption schemes.
It thus suffices to prove the security S1 of Π 2 when there exists some client C i ∈ C .
Lemma 11 below completes the proof of security.
Lemma 11 (Security) .
Let A be a semi-honest adversary which corrupts a subset C ⊂ P of parties containing at least one client.
Then, Π 2 is secure against A controlling C .
Proof.
We may assume without loss of generality that T :
= { i ∈ [ n ] : C i / ∈ C } ̸ = ∅ .
Let z = (cid:80) i ∈
T x i ∈
Z mq .
We’ll actually make one small modification to the ideal execution of Πin this case.
Although the simulation algorithm Sim is not given access to the non-corrupted parties’ inputs, we will endow Sim with the sum z := (cid:80) i ∈
T x i ∈
Z mq of the non-corrupted parties’ inputs.
Note that this is without loss of generality since any adversary, given the protocol output (cid:80) i ∈ [ n ] x i ∈
Z mq and the corrupted parties inputs { x i } i/ ∈ T ⊆
Z mq can efficiently compute z .
We thus replace Ideal Π 2 ,P,C, A , Sim (cid:18) 1 λ , { x i } i/ ∈ T (cid:19) with Ideal Π 2 ,P,C, A , Sim (cid:18) 1 λ , { x i } i/ ∈ T , z (cid:19) .
We now proceed by a standard hybrid argument. [Table] [Table]
• H 0 :
This hybrid is simply a real execution of Π 2 .
• H {+
+} : This hybrid is the same as H 0 , except that for each non-corrupted client C i ∈ {C 1 , . . .
, C n }\ C , in Round 2, for each C j ∈ C , we set s i,j ← Z mq .
Since the view of the adversary after Round 2 contains { s i,j } i ∈ T j/ ∈ T , then by the security of the additive secret sharing scheme we have that H
≡ H 1 . • H {+
+} In this hybrid, it will be more convenient to index the non-corrupted clients by C i 1 , . . .
, C i r .
For each j ∈ [ r − 1] , in Round 2, C i j generates shares { s i j ,t } t ∈ [ n ] of 0 , while C i r generates shares { s i r ,t } t ∈ [ n ] of z ′ .
Similarly, by the security of the additive secret sharing scheme we have that H 1 ≡ H 2 .
We define Sim by H 2 , and it follows that Real Π 2 ,P,C, A (1 λ , { x i } i ∈ [ n ] ) ≡ H 0 ≡ H 1 ≡ H 2 ≡ Ideal Π 2 ,P,C, A , Sim (cid:18) 1 λ , { x i } i/ ∈ T , z (cid:19) .  Experimental Results In this section, we empirically evaluate our CPSA protocols Π 0 , Π 1 , Π 2 with respect to their running time, communication overhead, and space overhead.
We implemented both protocols in Python, using Elliptic Curve Diffie-Hellman for a key agreement scheme, AES-GCM for an authenticated encryption scheme, AES-CTR for a pseudorandom generator, and Paillier Encryption [26] for an additive homomorphic encryption scheme.
For each protocol construction, we conducted the following experiments: • Measure running time for client and server for number n of clients, dimension m of clients’ input vector, and modulus q , when n ∈ { 50 , 100 , 250 } , m = 100 , q = 2 128 . • Measure communication and space overhead for client and server when n = 100 , m = 100 , q = 2 128 . All experiments were run on a MacBook Pro with Intel Core i7 6-core 2.6 GHz CPU, and each party was simulated as a sub-process.
Our experiments only measure the local performance of the protocol, and in particular ignore network latency.
Table 2 compares the running times vs. number n ∈ { 50 , 100 , 250 } of clients between the three protocols for the client and server, respectively.
Our experiments indicate that the running times of Π 1 are most performant.
We can see that while our theoretical analysis of the computational complexity of protocols Π 2 and Π 0 indicates they are identical, in reality the running time of Π 2 for both the client and server is noticeably higher than that of Π 0 .
This is due to the cost of the homomorphic operations of Paillier Encryption.
However, note that the running times for Π 2 are still practical, with the client and server obtaining running times less than 19 s and 2 s, respectively, even when scaled to 250 clients.
Table 3 displays the client and server communication and space overhead for each protocol construction when n = 100 and m = 100 .
Again, our experiments indicate that Π 1 is generally most performant with respect to both communication and space overhead; this confirms our theoretical analysis (Table 1) which shows that Π 1 achieves linear communication complexity.
Between Πand Π 2 , we remark that for both the client and server, the communication and space overhead are quite comparable, except that the server’s space overhead of 5 . 72 MB in Π 2 is significantly lower than for Π 0 (86 .
791 MB ) .
This is because in Π 2 , the server outputs to each client a single m − dimensional vector of ciphertexts, while in Π 0 , the server outputs to each client an ( n − 1) − sized set of m − dimensional ciphertext vectors.
Conclusions and Future Work
In this work, we propose a novel model of secure aggregation, called client-private secure aggregation (CPSA), in which the server computes an encrypted global model that can only be decrypted by the clients.
When composed with differential privacy, the security property is that no party learns any information beyond the global model about any client’s dataset, and any possibly inferred information from the global model cannot be associated with any particular client.
In particular, the server learns no information about any client’s dataset, not even the global model. We provide three explicit constructions of CPSA, each with varying trade-offs, and prove correctness and security in the semi-honest model for each construction. Finally, we empirically evaluate our three constructions to demonstrate their practicality and illustrate the trade-offs offered by each protocol. There are several elements of future work which we seek to incorporate into the full version of this work.
First, we believe it’s possible to prove that (a simple modification to) each of these protocols is secure against a malicious adversary.
Also, we believe we can employ techniques to mitigate the client and server running time of our implementation of Π 2 . For example, it may be possible to use the additive homomorphic version of ElGamal Encryption [17], which works over small input domains, and is more computationally efficient than Paillier Encryption. Alternatively, we wish to investigate packing Paillier ciphertexts, following [25], to improve the client and server running times. Acknowledgements.
We thank Xianrui Meng for fruitful conversations and feedback on this work.
Additionally, we thank the anonymous reviewers of FL-NeurIPS’22 for their helpful suggestions and feedback.
A Protocol Π
The protocol Π 0 , described below, achieves a client-private secure aggregation protocol with semihonest security through a simple modification to the two-round semi-honest secure variant of [3] (the two-round variant is described in [7]).
At a high level, the protocol works by each client C
i computing a quasi-one-time pad of its private input x i ∈
Z mq as y i := x i + r i ∈
Z mq , where the clients’ random masks r 1 , . . .
, r n ← Z mq are chosen such that (cid:80) i r i =
∈
Z mq .
Each client C i then simply encrypts y i for every other client C j under a shared symmetric key k
i,j , and sends the ciphertexts to the server, which routes them to the appropriate clients.
Each client C i then has a set of one-time pads { y j } j ∈ [ n ] whose random masks sum to zero, hence the client computes z := (cid:80) j ∈ [ n ] y j = (cid:80) j ∈ [ n ] x j , as desired.
Figure 4 contains the full protocol description of Π 0 . • C i → S Generate i
output
• S → C i : Output (cid:110) pk n j = all j ∈ [ n ] \{ i } , k ∈ [ m ] compute c j,k ← Enc (k (0) i,j , y i,k ) all j ∈ [ n ] \{ i
, let c i,j = ( c i,j,k ) k ∈
[ m ] ∈ C m .
Output { c i,j } j ∈ [ n ] \{ i } j ∈ [ n ] w j ∈ Z
Correctness. We prove the correctness of Π 0 in Lemma 12 below.
Lemma 12 (Correctness) .
After an execution of Π 0 , the server outputs to each client C
i
i ∈ [ n ]) ciphertexts { c j,i } j ∈
[ n ] \{ i } ∈ C m ( n − 1) , and each client outputs (cid:80) i x i ∈
Z mq .
Proof.
In Round 1, each client C i uses the key agreement scheme to generate two sets of public/secret key pairs (cid:0) (pk ( b ) i , sk ( b ) i ) (cid:1) b ∈{ 0 , 1 } , and sends (pk (0) i , pk (1) i ) to the server.
The server then forwards (pk (0) i , pk (1) i ) i ∈
[ n ] to each client.
For each pair of clients ( C i , C j ) ( i ̸ = j ) , and for each b ∈ { 0 , 1 } , C i (resp., C j ) uses their secret key sk ( b ) i ( resp.
, sk ( b ) j ) and the public key pk ( b ) j ( resp., pk ( b ) i ) of client C j ( resp., C i ) to compute a shared random key k ( b ) i,j = k ( b ) j,i .
Now, each client C i computes r i,j = G (k (1) i,j ) , ∀ j ∈ [ n ] \{ i } , y i
= x i + (cid:80) j<i r i,j − (cid:80) j>i r i,j ∈ Z mq , uses the authenticated encryption scheme to encrypt each component of y i under k (0) i,j to obtain a vector of ciphertexts c
i,j , ∀ j ∈ [ n ] \{ i } , and outputs { c i,j } j ∈ [ n ] \{ i } to the server.
The server forwards { c j,i } j ∈ [ n ] \{ i } to each client C i .
Now, each client C i uses the authenticated encryption scheme to decrypt the components of each c j,i , using k (0) i,j , to recover y j ∈ Z mq , ∀ j ∈ [ n ] \{ i } .
C i then computes z = (cid:80) j ∈ [ n ] y j = (cid:80) j ∈ [ n ] x j + (cid:80) j<k r j,k + (cid:80) j>k r j,k = (cid:80) j ∈ [ n ] x j + (cid:80) j<k r j,k − (cid:80) j>k r k,j = (cid:80) j ∈ [ n ] x j , since each r j,k = r k,j .
Security.
We now prove that Π 0 is secure with respect to S1 and S2 in the semi-honest model.
Let A be a semi-honest adversary controlling a subset C ⊆ P of corrupted parties.
First, we note that the security S2 of Π 0 when C = {S} follows immediately from the semantic security of the authenticated encryption scheme.
So, it suffices to prove the security S1 of Π 0 when there exists some client C i ∈ C .
Lemma 13 below completes the security proof.
Lemma 13 (Security) .
Let A be a semi-honest adversary which corrupts a subset C ⊆ P of parties such that some client C i ∈ C .
Then, Π 0 is secure against A controlling C .
Proof.
Let C ⊆ P , and Real Π 0 ,P,C, A (1 λ , { x i } i ∈ [ n ] ) denote the distribution of the view of A in a real execution of Π 0 in which A corrupts C .
We’ll construct a PPT simulation algorithm Sim which simulates the view of A without access to the non-corrupted clients’ inputs.
By definition of the ideal execution of Π 0 (Figure 2), this completes the proof.
Let T =
{ i ∈ [ n ] : C i / ∈ C } .
We may assume
WLOG that T ̸ = ∅ .
Just as in the proof of Lemma 11, we may endow Sim with the sum z := (cid:80) i ∈
T x i ∈
Z mq of the non-corrupted parties’ inputs.
We thus replace Ideal Π 0 ,P,C, A , Sim (cid:18) 1 λ , { x i } i/ ∈ T (cid:19) with Ideal Π 0 ,P,C, A , Sim
[Equation]
We now proceed by a standard hybrid argument.
• H 0 :
This hybrid is simply a real execution of Π 0 .
• H 1 :
For each C i ∈ {C 1 , . . .
, C n }\ C , we choose r i ← Z mq such that (cid:80) i ∈
T r i =
z ∈ Z mq , and C i instead lets y i :=
r i ∈ Z mq .
Note that since the adversary corrupts some client C j , then each symmetric key k (0) i,j ( i ∈ [ n ] s.t. C i / ∈ C ) falls into the adversary’s view, hence so does each y i .
By Lemma 6.1 in [3], we have that H 0 ≡ H 1 .
We define Sim by H 1 , and it follows that Real Π 0 ,P,C, A (1 λ , { x i } i ∈ [ n ] ) ≡ H 0 ≡ H 1 ≡
Ideal Π 0 ,P,C, A , Sim (cid:18) 1 λ , { x i } i/ ∈ T , z (cid:19) .