Page 120 - Towards Trustworthy Elections New Directions in Electronic Voting by Ed Gerck (auth.), David Chaum, Markus Jakobsson, Ronald L. Rivest, Peter Y. A. Ryan, Josh Benaloh, Miroslaw Kutylowski, Ben Adida ( (z-lib.org (1)

A. Otsuka and H. Imai
112
where View B is a random variable which represents Bob’s view after completion
of the protocol π, Y is a random variable representing Bob’s output y 0 .
An OPE protocol π is said to be -private if it is -private for Alice and
Bob. In the special case of =0, we call the protocol π is perfectly private.
Let K A and K B be random variables representing information held by Alice
and Bob respectively before initiating the OPE protocol. The following theorem
gives the lower bound on the initial information.
Theorem 1. (Lower Bounds on Private Keys)
If a OPE protocol π is perfectly private, then π satisfies the following bounds.
H(K A ) ≥ H(F), H(K B ) ≥ H(X)+ H(Y |X)
Proofs are given in [13].

Construction. Now we will give the optimal construction of perfectly private
OPE.

Protocol OPE
Initial Information: Private Keys
Alice’s key: R(x) ∈ GF(q)[x]of degree at most n,
Bob’s key: (d, R d )where d ∈ GF(q)and R d = R(d).
OPE Phase
Alice’s input: f(x) ∈ GF(q)[x], deg f(x) ≤ n,
Bob’s input: x 0 ∈ GF(q).
1. Bob sends to Alice e = x 0 − d,
2. Alice sends to Bob g(x)= f(x + e)+ R(x),
3. Bob outputs y = g(d) − R d .

Theorem 2. The above stated protocol is a perfectly-correct and perfectly-private
oblivious polynomial evaluation. Moreover, it is optimal regarding its private key
size.

Proof. Correctness is obvious. Since if Alice and Bob are both honest, then after
the completion of the above protocol, Bob outputs the correct value f(x 0 )with
probability 1 (perfectly correct). To prove privacy for Bob, note that d is uni-
formly distributed and not known to Alice, thus H(X|K AView A )= H(X)holds.
Privacy for Alice follows from the fact that every action of Bob’s amounts to
choosing an x 0 . However, given x 0 and f(x 0 ), he can evidently simulate his view
of an execution of the above protocol: he simply chooses randomly d and R d and
polynomial g(x) such that g(d)= f(x 0 )+ R d . Since this uses no further knowl-
edge of f, the security condition H(F|K B View B ) ≤ H(F|XY |K B View B )=
H(F|XY )holds.
Size of the private keys clearly meets the lower bound in Theorem 1 assuming
uniform distribution over all inputs.