Secure Multi-party Computation (MPC) allows two or more parties to compute any public function over their privately-held inputs, without revealing any information beyond the result of the computation. Modern protocols for MPC generate a large amount of input-independent preprocessing material called multiplication triples, in an offline phase. This preprocessing can later be used by the parties to efficiently instantiate an input-dependent online phase computing the function.

To date, the state-of-the-art secure multi-party computation protocols in the preprocessing model are tailored to secure computation of arithmetic circuits over large fields and require little communication in the preprocessing phase, typically O(N •m) to generate m triples among N parties. In contrast, when it comes to computing preprocessing for computations that are naturally represented as Boolean circuits, the state-of-the-art techniques have not evolved since the 1980s, and in particular, require every pair of parties to execute a large number of oblivious transfers before interacting to convert them to N -party triples, which induces an Ω(N 2 • m) communication overhead.

In this paper, we introduce F4OLEAGE, which addresses this gap by introducing an efficient preprocessing protocol tailored to Boolean circuits, with semi-honest security and tolerating N -1 corruptions. F4OLEAGE has excellent concrete performance: It generates m multiplication triples over F2 using only N • m + O(N 2 • log m) bits of communication for N -parties, and can concretely produce over 12 million triples per second in the 2-party setting on one core of a commodity machine. Our result builds upon an efficient Pseudorandom Correlation Generator (PCG) for multiplication triples over the field F4. Roughly speaking, a PCG enables parties to stretch a short seed into a large number of pseudorandom correlations non-interactively, which greatly improves the efficiency of the offline phase in MPC protocols. This is achieved by introducing a number of protocol-level, algorithmic-level, and implementation-level optimizations on the recent PCG construction of Bombar et al. (Crypto 2023) from the Quasi-Abelian Syndrome Decoding assumption.

A secure multiparty computation (MPC) protocol for a public functionality f allows N parties with private inputs

, while concealing all other information about their private inputs to coalitions of corrupted parties. MPC was introduced in the seminal work of Goldreich, Micali, and Wigderson [GMW87] (GMW), and has since led to a rich body of work developing the foundations of MPC, and even practical open-source libraries [Kel20].

Two of the leading paradigms in secure computation are garbled circuits [Yao86] and secretsharing-based secure computation [GMW87]. The seminal GMW protocol is of the latter type. In a secret-sharing-based MPC protocol, the parties hold shares of the inputs and iteratively compute the circuit representing the function, gate-by-gate. Because addition gates can be computed locally by the parties holding the input shares, only multiplication gates require interaction between the parties to evaluate. As such, the major bottleneck of MPC protocols is due to the communication required to evaluate the multiplication gates in a circuit. (Note that this is also true of the garbled circuit approach where addition gates are "free" and only multiplication gates need to be garbled [KS08].)

However, a core advantage of secret-sharing-based MPC, first identified in the work of Beaver [Bea92], is that secure multiplications can be preprocessed in an input-independent precomputation phase. In particular, the parties can securely generate additive shares of many "Beaver triples" (a, b, a • b) ∈ F 3 . Then, for each multiplication gate that needs to be computed in the online phase, the parties can run a fast information-theoretically secure multiplication protocol that consumes one Beaver triple and involves communicating just two elements of F per party. This model of secure computation with preprocessing forms the basis for modern MPC protocols due to the efficiency of the online phase. However, this preprocessing paradigm only serves to push the inefficiency bottleneck of MPC to the offline phase that consists of generating many Beaver triples. We briefly survey the different techniques that have been developed in the last couple of decades for the efficient generation of Beaver triples in an MPC setting.

Modern secure computation protocols. The traditional approach for securely generating Beaver triples relies on Oblivious Transfers (OT) [Rab81,EGL82]: an N -party Beaver triple over F is generated by letting each pair of parties execute log |F| oblivious transfers [Gil99], and thanks to OT extension protocols [Bea96, IKNP03], generating a large number of OTs requires only cheap symmetric-key operations. This OT-based approach is very competitive with a small number of parties, but becomes very inefficient with many parties. Specifically, because each pair of parties needs to perform OTs, the communication and computation costs are on the order of Ω(N 2 ), which quickly becomes impractical as N grows large.

Over the past decade, the practicality of secure computation has increased tremendously [DPSZ12, KOS16,Kel20,DNNR17,HOSS18a,KPR18]. This is especially true in the setting of secure computation of arithmetic circuits over large fields. Starting with the celebrated SPDZ protocol [DPSZ12], a sequence of works has developed fast protocols that use Ring-LWE-based somewhat homomorphic encryption, or even linearly homomorphic encryption, to generate m Beaver triples with only O(m•N ) communication and computation per triple. These approaches significantly improve over the "naïve" Ω(m • N 2 ) cost of the OT-based approach. Over sufficiently large fields (e.g., larger than 2 λ ), when generating many triples, state-of-the-art protocols such as Overdrive [KPR18] achieve very good concrete efficiency.

More recently, following the line of work on silent secure computation initiated in [BCGI18, BCG + 19b, BCG + 19a], Boyle et al. [BCG + 20b] have shown how to generate a large number m of pseudorandom (as opposed to truly random) Beaver triples under the Ring-LPN assumption. Their approach uses O(log m • N 2 ) communication, followed solely by local computation, with good concrete efficiency (the authors estimated a throughput of around 10 5 triples per second on one core of a standard laptop). For sufficiently large values of m, this is highly competitive with Overdrive. However, both Overdrive and the existing PCG-based approach share a common restriction: they are only usable over large fields.

Secure computation of Boolean circuits. In contrast to the secure computation of arithmetic circuits over large fields, the fastest way to run N -party MPC protocols for Boolean circuits remains the "naïve" method of generating many pairwise OTs, at a cost of Ω(m • N 2 ) bits for m Beaver triples. This is in contrast to the two-party setting, where two-party Beaver triples can be generated very efficiently thanks to a recent line of work [BCGI18, BCG + 19b, BCG + 19a] on silent OT extension. In