Multi-Party FHE

The core mechanism of Multi-Party FHE where the secret key is split into shares held by distinct parties. Decryption requires a minimum threshold (e.g., 3 out of 5) to collaborate. This eliminates the single point of trust inherent in standard FHE, ensuring that a compromised server or rogue administrator cannot unilaterally decrypt sensitive computational results.

A cryptographic protocol that allows multiple mutually distrusting parties to jointly generate a shared public key without any single party ever constructing or seeing the complete private key. Each party holds only a secret share. This process is critical for establishing the initial trust model, as the full decryption key never exists in a single memory location at any point in the system's lifecycle.

In standard FHE, bootstrapping refreshes a ciphertext's noise budget using an encrypted secret key. In the multi-party variant, this process becomes interactive. Parties must collaboratively evaluate the decryption circuit on encrypted shares. This distributed noise management is the most computationally intensive phase, requiring secure communication rounds to homomorphically combine partial decryptions without revealing individual key shares.

A public set of parameters generated during the setup phase that all parties must use. The CRS includes the lattice parameters, modulus chain, and random public matrices required for the RLWE-based scheme. Its integrity is paramount; a maliciously crafted CRS can break the system's security. In practice, the CRS is often generated via a multi-party ceremony to ensure it is free from trapdoors.

Unlike single-key FHE where decryption is a local operation, Multi-Party FHE requires a multi-round protocol. Each party takes the final ciphertext, computes a partial decryption using its secret share, and broadcasts this share. A combiner then aggregates these partial decryptions to reconstruct the plaintext. The protocol ensures that individual shares reveal zero information about the secret key or the plaintext.

Security guarantees vary based on the adversary model. Static corruption assumes the adversary chooses which parties to compromise before the protocol starts. Adaptive corruption allows the adversary to corrupt parties dynamically during execution based on observed messages. Robust Multi-Party FHE schemes often rely on non-interactive zero-knowledge proofs to ensure that partial decryptions are correct even in the presence of actively malicious participants.

A public string of random values generated during a trusted setup phase, used by all parties in a Multi-Party FHE protocol to ensure consistency and security during distributed key generation and encryption. The CRS model is essential for achieving IND-CPA security in many threshold cryptosystems. While the setup must be executed honestly, techniques like multi-party computation for setup or updatable CRS schemes mitigate the risk of a single point of failure during initialization.

A cryptographic protocol that allows a set of mutually distrusting parties to jointly generate a public key and corresponding secret key shares without any single party ever knowing the full private key. In the context of Multi-Party FHE, DKG eliminates the need for a trusted dealer. Each party contributes randomness to the key generation process, and the final public key is an aggregation of their contributions, ensuring the decryption capability is truly distributed from inception.

The process of refreshing the noise budget of a ciphertext in a Multi-Party FHE setting without decrypting it. Since the full secret key is never assembled, parties must engage in a secure multi-party computation protocol to homomorphically evaluate the decryption circuit. This is often the computational bottleneck in Multi-Party FHE, requiring efficient interactive protocols to perform the necessary key-switching and modulus operations in a distributed manner.

A deployment architecture where a machine learning model is evaluated on encrypted data, and the resulting encrypted prediction can only be decrypted with the consent of a quorum of stakeholders. For example, a medical diagnosis model might require a hospital board, a patient advocate, and a regulatory body to jointly authorize the decryption of a sensitive result. This enforces circuit privacy and strict access control policies cryptographically.

A security hardening technique where secret key shares held by parties in a Multi-Party FHE scheme are periodically refreshed without changing the underlying public key or secret. This limits the window of vulnerability for an adversary who is slowly compromising nodes. Old shares are invalidated, and new, independent shares are generated through a distributed re-randomization protocol, ensuring long-term security against mobile adversaries.