Comment on page
Blind evaluation of a polynomial
Suppose Jennifer has a polynomial P of degree d , and Ted has a point s ∈ F p that he chose randomly. Ted wishes to learn E ( P ( s ) ) , i.e., the HH of the evaluation of P at s . Two simple ways to do this are:
Jennifer sends P to Ted, and he computes E ( P ( s ) ) by himself.
Ted sends s to Jennifer; she computes E ( P ( s ) ) and sends it to Ted.
However, in the blind evaluation problem we want Ted to learn E ( P ( s ) ) without learning P – which precludes the first option; and, most importantly, we don’t want Jennifer to learn s , which rules out the second.
Using HH, we can perform blind evaluation as follows.
Ted sends to Jennifer the hidings E ( 1 ) , E ( s ) , … , E ( s d ) .
Jennifer computes E ( P ( s ) ) from the elements sent in the first step, and sends E ( P ( s ) ) to Ted. (Jennifer can do this since E supports linear combinations, and P ( s ) is a linear combination of 1 , s , … , s d . ).
Note that, as only hidings were sent, neither Jennifer learned s , nor Ted learned P .