Page 119 - Towards Trustworthy Elections New Directions in Electronic Voting by Ed Gerck (auth.), David Chaum, Markus Jakobsson, Ronald L. Rivest, Peter Y. A. Ryan, Josh Benaloh, Miroslaw Kutylowski, Ben Adida ( (z-lib.org (1)

Unconditionally Secure Electronic Voting
111
Definition 2. (Homomorphism) For a polynomial g(x) ∈F generated from a
linear combination of polynomials f 1 (x),...,f n (x) ∈F, and for a commitment
(a 1 ,...,a n ) generated by the prover, the commitment-polynomial pair (a 1 ,... ,a n )
and g(x) is called accepted by a verifier V i , if and only if the following equation
is satisfied:
n

g(x i )= a j f j (v i ).
j=1
3 Information Theoretic Primitives
3.1 Oblivious Polynomial Evaluation
Oblivious polynomial evaluation(OPE) is an extension of the basic primitive,
oblivious transfer(OT), first introduced by Naor and Pinkas [16]. OPE is a two
party protocol where Alice is given a polynomial f(x) on her private input,
and Bob is given a value x 0 on his private input. After executing a protocol,
Bob outputs a value y 0 = f(x 0 ) (with negligible error probability) in a way
that Alice has no information (or learns negligible amount of information) on
the Bob’s input x 0 and that Bob has no more information (or learns negligible
information) on the Alice’s private input f(x) than that can be implied from y 0 .

Definitions and Bounds. In [13], OPE is formalized in the information theo-
retic setting. We restate the definitions and bounds on US-OPE in the following.
Definition 3. ( -correct OPE) A OPE protocol π is called -correct if after
executing the protocol π with honest players, there exists satisfying the following
equation:
Pr(y = y 0 :(⊥,y) ← π(f, x 0 )) ≤
where y 0 is the correct output such that y 0 = f(x 0 ).
Definition 4. ( -private OPE) Let F, X and Y be the random variables repre-
senting the polynomial f on Alice’s private input, the value x 0 on Bob’s private
input, and y on Bob’s private output. A OPE protocol π is called -private for
Bob if for any possible behavior of Alice,
I(View A ; X) ≤

where I(·; ·) is Shannon’s mutual information, View A is a random variable which
represents Alice’s view after completion of the protocol π, X is a random variable
representing Bob’s input x 0 .
Similarly, an OPE protocol π is called -private for Alice if for any possible
behavior of Bob, there exists such that

I(F; X) ≤ ,

I(F; View B |XY ) ≤ .