Table 1: The communication complexity of n-player NIMPC protocols for arbitrary functions h : X → {0, 1}
L
where d ≤ |X
i
|,
and δ
ind
is the communication complexity of NIMPC for the set of indicator functions.
The communication complexity
Construction in (Agarwal et al., 2019) dlog
2
de + L · |X |
Construction in (Beimel et al., 2014) δ
ind
· L · |X |
Construction in (Obana and Yoshida, 2016) (δ
ind
+ L · dlog
2
(d + 1)e) · |X |
Our construction (generic) (δ
ind
+ max(2L, L + dlog
2
de)) · |X |
Our construction (concrete) (4 · dlog
2
de · n + max(2L, L + dlog
2
de)) · |X |
Table 2: The communication complexity of n-player NIMPC protocols for the set of indicator functions.
The communication complexity
Construction in (Beimel et al., 2014) d
2
· n
Construction in (Yoshida and Obana, 2016) dlog
2
(d + 1)e
2
· n
Our construction 4 · dlog
2
de · n
struction, the correlated randomness r
i
consists of ad-
ditively shared output table of the target function f
where input and output are masked with random val-
ues, and the message m
i
consists of masked output ta-
ble of f (x
1
, . . . , x
i−1
, a
i
, x
i+1
, . . . , x
n
), together with the
masked value of a
i
. Such direct construction is very
efﬁcient in the sense that the communication com-
plexity of the scheme is as small as dlog
2
de + L · |X |
where d = max
i∈[n]
{|X
i
|} and X = X
1
× · · · × X
n
. The
communication complexity of their NIMPC is close
to the lower bound on the communication complexity
shown by Yoshida and Obana in (Yoshida and Obana,
2016), though, there is still a gap between the lower
bound and the most efﬁcient scheme known so far.
To deepen understanding of theory and practice
of NIMPC, it is important to clarify to what extent
we can construct a scheme with the communication
complexity close to the lower bound. To answer the
question, we must try various approaches to construct
efﬁcient NIMPCs. One of major and prominent ap-
proaches is generic construction. Generic construc-
tion of NIMPC is methodology to construct complex
classes of function (e.g., arbitrary functions) based
on simple classes of function. All the generic con-
structions known so far employ indicator function as
a simple class of function, where indicator function
h
a
(x) : X → {0, 1} equals 1 if and only if the input x
is identical to a. There is line of research that tries
to construct an efﬁcient NIMPC with small commu-
nication complexity based on NIMPC for the set of
indicator functions (Beimel et al., 2014; Yoshida and
Obana, 2016; Obana and Yoshida, 2016).
The contribution of the paper is twofold. First, we
presents an efﬁcient generic construction of NIMPC
for arbitrary functions based on any NIMPC for the
set of indicator functions. Second, we presents an
efﬁcient construction of NIMPC for the set of indi-
cator functions. Combining the ﬁrst and the second
contributions, we obtain a concrete construction of
NIMPC for arbitrary functions with the smallest com-
munication complexity compared to existing generic
constructions of NIMPC for arbitrary functions. Ta-
bles 1 and 2 summarize the communication complex-
ity of existing NIMPC for arbitrary functions with L-
bit output, and that of existing NIMPC for the set of
indicator functions, respectively.
We see that the proposed NIMPC for the set of
indicator function is the most efﬁcient one, and the
proposed generic construction is most efﬁcient among
generic constructions based on NIMPC for the set of
indicator functions. Let δ
ind
be the communication
complexity of underlying NIMPC for set of indicator
functions, and let log
2
d = L for simplicity. Then the
communication complexity of the proposed NIMPC
for arbitrary functions is (δ
ind
+ 2L) · |X | while that
of (Obana and Yoshida, 2016) is (δ
ind
+ L
2
) · |X |.
Compared to the most efﬁcient NIMPC presented in
(Agarwal et al., 2019), proposed NIMPC is less efﬁ-
cient, though, the overhead is not so large. Again, let
dlog
2
de = L for the sake of simplicity, then the com-
munication complexity of the proposed NIMPC for
arbitrary functions becomes L ·(4n + 2) · |X |, which is
about 4n + 2 times larger than that of (Agarwal et al.,
2019).
2 PRELIMINARIES
For an integer n, let [n] be the set {1, 2, . . . , n}. For
a set X = X
1
× ··· × X
n
and T ⊆ [n], we denote
X
T
4
=
∏
i∈T
X
i
. For x ∈ X , we denote by x
T
the re-
striction of x to X
T
, and for a function h : X → Ω, a
subset T ⊆ [n], its complement T ⊆ [n], and x
T
∈ X
T
,
we denote by h|
T ,x
T
: X → Ω the function h where the
Efﬁcient Constructions of Non-interactive Secure Multiparty Computation from Pairwise Independent Hashing
323