New Bounds and a Generalization for Share Conversion for 3-Server PIR

Abstract

Private Information Retrieval (PIR) protocols, which allow the client to obtain data from servers without revealing its request, have many applications such as anonymous communication, media streaming, blockchain security, advertisement, etc. Multi-server PIR protocols, where the database is replicated among the non-colluding servers, provide high efficiency in the information-theoretic setting. Beimel et al. in CCC 12’ (further referred to as BIKO) put forward a paradigm for constructing multi-server PIR, capturing several previous constructions for $k\ge 3$ servers, as well as improving the best-known share complexity for 3-server PIR. A key component there is a share conversion scheme from corresponding linear three-party secret sharing schemes with respect to a certain type of “modified universal” relation. In a useful particular instantiation of the paradigm, they used a share conversion from $(2,3)$-CNF over ${\mathbb{Z}}_m$ to three-additive sharing over ${\mathbb{Z}}_p^{\beta }$ for primes $p_1,p_2,p$ where $p_1\ne p_2$ and $m=p_1·p_2$, and the relation is modified universal relation $C_{S_m}$. They reduced the question of the existence of the share conversion for a triple $(p_1,p_2,p)$ to the (in)solvability of a certain linear system over ${\mathbb{Z}}_p$, and provided an efficient (in $m,logp$) construction of such a sharing scheme. Unfortunately, the size of the system is $\mathsf{\Theta }\left(m^2\right)$ which entails the infeasibility of a direct solution for big m’s in practice. Paskin-Cherniavsky and Schmerler in 2019 proved the existence of the conversion for the case of odd $p_1$, $p_2$ when $p=p_1$, obtaining in this way infinitely many parameters for which the conversion exists, but also for infinitely many of them it remained open. In this work, using some algebraic techniques from the work of Paskin-Cherniavsky and Schmerler, we prove the existence of the conversion for even m’s in case $p=2$ (we computed $\beta$ in this case) and the absence of the conversion for even m’s in case $p>2$. This does not improve the concrete efficiency of 3-server PIR; however, our result is promising in a broader context of constructing PIR through composition techniques with $k\ge 3$ servers, using the relation $C_{S_m}$ where m has more than two prime divisors. Another our suggestion about 3-server PIR is that it’s possible to achieve a shorter server’s response using the relation $C_{S_m^{\prime }}$ for extended $S_m^{\prime }\supset S_m$. By computer search, in BIKO framework we found several such sets for small m’s which result in share conversion from $(2,3)$-CNF over ${\mathbb{Z}}_m$ to 3-additive secret sharing over ${\mathbb{Z}}_p^{{\beta }^{\prime }}$, where ${\beta }^{\prime }>0$ is several times less than $\beta$, which implies several times shorter server’s response. We also suggest that such extended sets $S_m^{\prime }$ can result in better PIR due to the potential existence of matching vector families with the higher Vapnik-Chervonenkis dimension.

1. Introduction

1.1. Private Information Retrieval

Private Information Retrieval (PIR) protocols allow the client to fetch items from the server’s database without disclosing to the server which item was requested. A main challenge in constructing PIR protocols is minimizing the communication complexity. The idea of PIR was introduced by Chor et al. [1], together with the 2-server PIR protocol having the communication complexity $O\left(n^{1/3}\right)$ for the dataset size n. PIR has a wide variety of applications such as anonymous communication [2,3], privacy-preserving media streaming [4], blockchain security [5,6], personalized advertisement [7], location and contact discovery [8,9,10], etc.

The naive approach to PIR is just to make the server send all the items in the database to the client: we stress that PIR cares only about the privacy of the client’s request but not about the privacy of the server. However, it entails a huge communication complexity equal to the size of the database. To shorten the communication complexity and still keep the privacy of the request, there are two main approaches to construct PIR:

• Historically, the first type of PIR was a Multi-Server PIR [1], where the database is replicated for $k\ge 2$ non-colluding servers. The client secret-shares its request, and servers locally compute the secret-shared response and send it back to the client. The client recovers the item from the shares of response. Multi-Server PIR protocols, such as [11,12,13,14] are relatively efficient in information-theoretic settings. The requirement of the replicated database kept by the non-colluding parties is restrictive; however, there is a space for such a PIR, preferably in blockchain databases, cloud services, multi-server enterprise ecosystems where a small number of servers (but not all) are likely to be compromised.
• Single-Server PIR protocols work in a computational setting and are built on the basis of homomorphic encryption (FHE, AHE, or SHE). The starting point in single-server PIR is the AHE-based protocol of Kushilevitz and Ostrovski [15]. The early single-server PIR constructions were both computationally and communicationally low efficient, although recently significant progress was made which allow speaking about the practically suitable one-server PIR solutions [16,17,18,19]. For instance, the OnionPIR protocol from SHE [16] achieves a 64 KB request and 128 KB response in the online phase of the protocol (and the same in the offline phase) for all the realistic database sizes.

On the high level, for both approaches, the database is represented as a function (usually, a polynomial) f such that for any key x and the correspondent value (a record) y holds $y=f\left(x\right)$. Then, the client has to send the request x to the server (servers) in a way that preserves its privacy. For the Single-Server PIR, it means that x is sent encrypted, in the Multi-Server paradigm, x is secret-shared. Encryption or secret sharing has to be homomorphic so that the server (servers) could compute the function $f\left(x\right)$ under the encryption/secret-sharing and send the encrypted or secret-shared response y back to the client.

In a 2-server computationally-secure PIR of Gilboa and Ishai [20], the request is shared as a DPF (Distributed Point Function) and has a polylog length. In this case, to compute the shares of the response, only additive operations are needed (DPF sharing is homomorphic in respect of them). However, in the information-theoretic setting, which is the focus of this work, it is still unclear how to construct efficient in terms of communication and computation PIR with the secret sharing which is homomorphic in respect of any number of additions and multiplications.

Currently, 3 generations of information-theoretic PIR protocols exist: the first generation originated from the work of Chor et al [1] is based on Reed-Muller codes and have communication complexity $n^{1/\mathsf{\Theta }\left(k\right)}$, in the second from Beimel et al. [21] they restated some of the previous results in a more arithmetic language, in terms of polynomials, and also considered a certain encoding of the inputs and element-wise secret sharing the encoding, which resulted in $n^{O\left(k\right)}$ communication complexity. The third generation from works of Efremenko [11] followed by [22,23,24,25,26], Yekhanin [12], Beimel et al. [13], Dvir and Gopi [14] is based on matching vectors and is the most computationally efficient line of protocols with the complexity $n^{o\left(1\right)}$ for database size n. In all the 3rd generation schemes, but [14], as was demonstrated by Beimel et al. [13], in fact, the combination of two secret-sharing schemes is utilized, both linear in different groups, and a share conversion with respect to some relation, allowing to locally perform some non-linear operation over the shares (apart from the case of the identity relation).

1.2. Share Conversion

Suppose that there is some number of parties, each holding a share of a secret s which was created by a secret-sharing scheme $S{h}_1$. The share conversion is defined as a process of a local computation performed by those parties based only on their shares and outputting the new shares of the secret $s^{\prime }$ in a different scheme $S{h}_2$ so that there is some predefined relation between s and $s^{\prime }$. A systematic study of share conversion was started by Cramer et al. [27] by considering the case $s=s^{\prime }$ for two arbitrary linear secret sharing systems over different fields.

Let us consider an easy illustrative example: for the function $f\left(x\right)=x_1·x_2$ over the ring $R^{\prime }$, and for the conversion’s relation $s^{\prime }=s^2$, for the input $x=(x_1,x_2)$ shared in a linear scheme over the ring R, it is possible to compute $f\left(x\right)$ in the following circuit: first, according to the linear property of the first scheme, servers locally compute shares of $x_3=x_1+x_2$, then convert shares of $x_1$, $x_2$ and $x_3$ to shares of $x_1^2$, $x_2^2$ and $x_3^2$ over $R^{\prime }$, and finally obtain shares of the response $y=2^{-1}(x_3^2-x_1^2-x_2^2)$.

This approach, however, leaves room for improvement, as such a conversion usually increases the size of the request and response in PIR, because the conversion is a local operation and therefore it is not a trivial issue: to evaluate the circuit which computes some succinct function $f\left(x\right)$ which represents the database, the client forms its request as a proper input to this circuit. In addition, not any circuit is possible to compute within the existing secret sharing and conversion schemes, which means that we are bound to only certain kinds of the circuit families and, depending on the VC-dimension of these families of those certain function families, the proper representation of request might be much larger than the size of the database. Recall that the notion of the VC-dimension was introduced by V. Vapnik and A. Chervonenkis in [28]. Informally, for the boolean function family $\mathcal{F}$, where each $f\in \mathcal{F}:D\to \{0,1\}$, VC-dimension $VC\left(\mathcal{F}\right)$ is the size of the largest $I\subset D$ such that the set $\left\{{f|}_I|f\in \mathcal{F}\right\}$ of restrictions of functions from $\mathcal{F}$ contains all the possible boolean functions over I. The higher $VC\left(\mathcal{F}\right)$ relative to $\left|D\right|$, the more efficient PIR can be built. For a precise definition, see [13].

Using homomorphic properties of secret sharing schemes to perform MPC on shared values is a widely used technique in information-theoretic MPC, initiated by the seminal work of [29]. Indeed, in order to (semi honestly) securely evaluate an algebraic circuit, the parties share their input with Shamir secret sharing. Then, linear combinations can be homomorphically evaluated ‘for free’ via local computation on the shares so that additions can be performed repeatedly any number of times. Multiplications can also be performed, however, multiplying two shared values results in a value shared according to Shamir with the doubled degree. This limits the depth of a circuit computable with (even) 1-privacy if we require that the only communication round will be sending shares for the final reconstruction. This idea transfers to PIR, where inputs come from a single party, so they may also be conveniently preprocessed by it via arbitrarily complex functions (which is not always possible for inputs distributed among multiple parties). For instance, for 3-server PIR, degree-2 polynomials can be locally evaluated if Shamir secret sharing was used. As degree-2 polynomials (over a field) in n variables have non-trivially high VC dimension ($n^2$), this allows for encoding each input via a vector of $O\left(2^{n/2}\right)$ entries and using the appropriate share conversion. For k-server PIR, different kinds of share conversion may enable us to evaluate a family of shallow circuits that both have high VC dimension and suitable secret sharing with share conversion, allowing us to locally evaluate them. In particular, note that a share conversion for a suitable relation, rather than a function suffice to evaluate circuits of that type.

1.3. BIKO Framework

In [13], Beimel, Ishai, Kushilevitz, and Orlov (BIKO) interpret the state of the art 3-server PIR schemes as using share conversion from a (variant) of Shamir secret sharing over a certain ring $R_m$ for small composite m, applied to circuits stemming from MV codes [30] $\{u_1,\dots ,u_h\},\{v_1,\dots ,u_h\}$ with a bounded set $S\cup \left\{0\right\}$ of $<u_i,u_j>$ values, for some $S\subseteq {\mathbb{Z}}_m\backslash \left\{0\right\}$. It has the property that $<u_i,v_i>=0$, while $<u_j,v_i>$ for $j\ne i$ is in S. We refer to such codes as S-bounded MV codes. They manage to get improved complexity of the resulting PIR, by using conversions from CNF secret sharing rather than from Shamir over certain small $R_m$, for which a conversion from Shamir for that relation does not exist (the $(t,k)$-CNF is a threshold secret sharing scheme introduced in [31]; see Section 2.2 for a detailed description). Specifically, they obtained conversions from $(2,3)$-CNF over ${\mathbb{Z}}_m$ to the additive secret sharing scheme over ${\mathbb{Z}}_p^{\beta }$ for the following relation $C_S=\left\{(0,s^{\prime })|s^{\prime }\in {\mathbb{Z}}_p^{\beta }\backslash \left\{0\right\}\right\}\cup \left\{(s,0)|s\in S\backslash \{0\}\right\}\cup \left({\mathbb{Z}}_m\backslash \left\{S\cup \left\{0\right\}\right\}\right)\times {\mathbb{Z}}_p^{\beta }$. They work with the so-called canonical set $S=S_m=\left\{x\in {\mathbb{Z}}_m|\forall ix\mathrm{is}\mathrm{either}0\mathrm{or}1\mathrm{mod}{p}_i^{e_i}\right\}\backslash \left\{0\right\}$, where $m={\prod }_{i=1}^k{p}_i^{e_i}$ is the decomposition of m into prime factors. This is a useful choice, due to the existence of good $S_m$-bounded MV codes over composite moduli m. Their approach is motivated by the existence of conversions for CNF to additive (roughly, that CNF can be converted to “any” scheme, and any scheme can be converted to additive), they use $S{h}_1$ as CNF over a certain ring, and $S{h}_2$ as additive over another ring. This relation (although not a function) suffices to evaluate the required type of circuits, arising from the MV family. There is a potential tradeoff here between the best MV codes that exist over a certain ring R, and the size (more generally, the identity) of the set S that can be achieved. On a high level:

• The smaller S is, the easier it is to find a suitable share conversion (required to evaluate functions in the circuit family induced by the MV code).
• The larger S is, the easier it is to find an MV code resulting in a family of circuits with high VC dimension. The communication complexity of the resulting PIR decreases with the VC dimension of the set (and eventually, the size of the shallow circuit to evaluate).

The concrete parameters of both constructions used so far for 3-server PIR (in their most efficient variants) follow from the following Theorem 7, and instantiations of it via known constructions of MV codes and share conversion schemes.

On a very high level, these PIR protocols consist of three steps and is shown in Construction 1.

Construction 1: BIKO Framework [13]

1  Let $f:{\{0,1\}}^{log\left(n\right)}\to \{0,1\}$ denote the server’s database. The client preprocesses its input $x\in {\{0,1\}}^{log\left(n\right)}$ into a vector $v_x\in R^h$ for a (constant) ring R, where ${\left\{v_x\right\}}_x$ is a set of vectors of an S-bounded MV code. It shares the vector coordinate-wise among the k servers via some $(2,k)$-private secret sharing scheme $S{h}_1$ (so no single server learns anything about the secret). 2  The servers use linear homomorphism properties of $S{h}_1,S{h}_2$, which are homomorphic over certain finite groups, to locally evaluate (an encoding of) f on the shared v. More concretely, $$f\left(v\right)=\sum _{\left\{i\right|f\left(i\right)=1\}}{f}_i\left(v\right)$$ where $f_i\left(v\right)=<u_i,v>$. In some more detail, each $<u_i,v>$ uses linear homomorphism of $S{h}_1$, then a share conversion from $S{h}_1$ to $S{h}_2$ relatively to $C_S$, applied to each share of $f_i\left(v\right)$, and finally linear homomorphism of $S{h}_2$ is applied to evaluate ${\sum }_i{f}_i\left(v\right)$ on the resulting shares. The share conversion is required to transform $<v_i,v>$ for $v_i=v$ into a non-zero value, and $<u_j,v>$ for $v_j\ne v$ into 0’s, making the sum non-zero iff. $f\left(v\right)=1$. Then each server sends its share to the client. 3  The client recovers the output using linear homomorphism of $S{h}_2$, and post-processing the value.

The correctness of the scheme is easy to verify.

For a 3-server PIR, Ref. [13] provides the technique for the constructing the conversion (it such a conversion exists) from (2,3)-CNF to the additive secret sharing and obtains results for some special cases. Utilizing the results of Beimel et al., Paskin-Cherniavsky and Schmerler in [32] proved that there is a share conversion from (2,3)-CNF over ${\mathbb{Z}}_m$ to 3-additive secret sharing over ${\mathbb{Z}}_p$, if $m=p_1{p}_2$, for distinct odd primes $p_1$ and $p_2$, one of which is equal to p. Thereby they found infinitely many cases when conversion falling into the BIKO framework exists.

Theorem 1

([13,32]). Let $m=p_1·p_2$, where $p_1,p_2$ are distinct primes, and p is a prime. Then, there exists a share conversion from $(2,3)$-CNF to additive over ${\mathbb{Z}}_p^{\beta }$ for the relation $C_{S_m}$ for some β in the following cases:

1 

$p_1,p_2\ne 2$, and $p\in \{p_1,p_2\}$

2. 

$p_1=2,p_2\in \{3,5,7\}$ and $p=2$.

For other cases of $m=p_1·p_2$ and p, however, the existence of the conversion was neither confirmed nor disproved. The constant $\beta$ in Theorem 1 seems to grow with m, but due to the techniques used, it has not been proven for any infinite family of parameters.

Remark 1.

However, not all the 3rd generation information-theoretic PIR protocols fall into the BIKO framework. For instance, the work of [14] could be viewed as a certain generalization of it. This beautiful work surprisingly manages to carry over "3rd generation" PIR communication complexity previously achieved for 3 or more servers, to the 2-server setting, resolving a long standing open problem, thereby illustrating the limitations of the BIKO framework, providing evidence that generalizing it in certain directions can be instrumental in the context of PIR. In some more detail, [14]’s PIR has a bilinear, rather than linear reconstruction in $S{h}_2$, and the step corresponding to share conversion can not be cleanly viewed as a share conversion from $S{h}_1$ to $S{h}_2$ according to $C_S$ (or in fact any) relation. In particular, the client essentially uses a 2-out-of-3 sharing scheme to make the share conversion work, with himself holding one of the shares.

1.4. Our Contribution

• Obtaining another infinite class of conversions from (2,3)-CNF.

Following the BIKO framework [13] and utilizing some results of [32], we prove that:

Theorem 2

(Main result, informal).

• There exists a share conversion from (2,3)-CNF over ${\mathbb{Z}}_{2q}$ to 3-additive secret-sharing scheme over ${\mathbb{Z}}_2^{(q-1)(q-2)}$ for any odd prime q.
• There is no conversion from (2,3)-CNF over ${\mathbb{Z}}_{2q}$ to ${\mathbb{Z}}_p^{\beta }$ for any odd primes q and p (including the case $q=p$) and any $\beta >0$.

In this way, we prove the existence of the conversion for infinitely many cases, and also for infinitely many cases we prove a conversion does not exist. Together with [32] for m’s which are products of two primes, it leaves open only the question of the conversion in the case when $m=p_1{p}_2$, where $p_1$ and $p_2$ are both odd and not equal to p.

Note also that for considered cases, we managed to compute the parameter $\beta$ which determines the server’s response size. We prove that $\beta$ in Theorem 7 is indeed the best for $m=6$ among $m=p_1{p}_2$ where $p_1=2$. More concretely, one of our contributions is the precise value of $\beta$ for share conversion with respect to relation $C_{S_{2q}}$. Previous techniques did not allow to compute $\beta$, as they traded generality that could allow computing $\beta$ for some additional simplicity—using a single row in $M_{\not\equiv }$ to understand the rank difference $\beta =rank\left(M_{\equiv ,\not\equiv }\right)-rank\left(M_{\equiv }\right)$.

• Computing and improving server reply size.

Another somewhat surprising observation we made is that we may sometimes increase S beyond $S_m$ so that a conversion from $(2,3)$-CNF over ${\mathbb{Z}}_m$ to ${\mathbb{Z}}_q^{\beta }$ (for the same $m,q$ as before) still exists. This may have two possible implications. A direct implication that we observed experimentally for several values of m, is that the rank difference $\beta$ sometimes goes down, but not all the way to 0. Thus, if the share conversion still exists, as follows from the BIKO technique, $\beta$ may decrease, leading to the reduced size of the server’s response. We checked this fact for some small m’s by computer search and obtained positive results, which is presented in Section 4. Indeed, we obtained smaller $\beta$ supplementing $S_m$ up to $S_m^{\prime }$ by additional values. We informally sum the result of the computer search in the following theorem.

Theorem 3.

There exists a share conversion from (2,3)-CNF over ${\mathbb{Z}}_m$ to 3-additive secret-sharing scheme over ${\mathbb{Z}}_p^{{\beta }^{\prime }}$ with respect to the relation $C_{S_m^{\prime }}$, refining β, where:

• $m=14$, $p=2$, $S_m^{\prime }=S_m\cup \left\{3\right\}$and$S_m^{\prime }=S_m\cup \left\{5\right\}$, $\beta =30$, ${\beta }^{\prime }=6$;
• $m=15$, $p=3$, $S_m^{\prime }=S_m\cup \left\{11\right\}$$\beta =24$, ${\beta }^{\prime }=12$;
• $m=21$, $p=3$, $S_m^{\prime }=S_m\cup \left\{8\right\}$, $\beta =60$, ${\beta }^{\prime }=30$;
• $m=33$, $p=3$, $S_m^{\prime }=S_m\cup \left\{23\right\}$, $\beta =180$, ${\beta }^{\prime }=90$;
• $m=15$, $p=5$, $S_m^{\prime }=S_m\cup \left(\mathit{any}\mathit{non}-\mathit{empty}\mathit{subset}\mathit{of}\{4,7,13\}\right)$, $\beta =8$, ${\beta }^{\prime }=2$;
• $m=35$, $p=5$, $S_m^{\prime }=S_m\cup \left(\mathit{any}\mathit{non}-\mathit{empty}\mathit{subset}\mathit{of}\{8,22,29\}\right)$, $\beta =120$, ${\beta }^{\prime }=30$;
• $m=21$, $p=7$, $S_m^{\prime }=S_m\cup \left(\mathit{any}\mathit{non}-\mathit{empty}\mathit{subset}\mathit{of}\{4,10,13,16,19\}\right)$, $\beta =12$, ${\beta }^{\prime }=2$;
• $m=35$, $p=7$, $S_m^{\prime }=S_m\cup \left(\mathit{any}\mathit{non}-\mathit{empty}\mathit{subset}\mathrm{of}\{6,11,16,26,31\}\right)$, $\beta =72$, ${\beta }^{\prime }=12$.

This result may also be viewed as evidence that canonical sets $S_m$ for m with a larger number r of prime factors may potentially have share conversions for $C_{S_m}$ for (significantly) smaller than $2^r-1$ number of servers (as we have conversions for $2^r-1$ servers but S larger than $S_m$, where the resulting linear system has much more rows than columns). This direction is interesting to explore, initiating a systematic search for share conversions with server sets as small as possible, resulting in PIR with share complexity polynomial in MV codeword length for m which is a factor of r primes.

In addition to our two main contributions, we identify a few minor errors in [13,32]. Nevertheless, these errors do not affect the correctness of any of their main contributions.

• We recalculated some computer search results of [13] (BIKO) as they come in contradiction with the theoretical result of Paskin-Cherniavsky and Schmerler. In particular, [13] showed the absence of the conversion for $m=35$, $p=7$, while [32] proved that the conversion for this case exists. In addition, we obtained numerical results for cases $m=22$, 26, 33 which were not considered in BIKO. Our numerical results given in Section 4 confirm both our theoretical result for $p_1=2$ and the conclusion of [32].
• We corrected some calculation mistakes made in previous work [32]. The corrigenda are shown in Appendix A.

1.5. Instantiations of BIKO and Future Directions of Our Work

Almost all third-generation PIR protocols falling in a BIKO framework, utilize the conversion from Shamir secret sharing instead of CNF. The existence of the conversion from Shamir secret sharing scheme implies the existence of conversion from CNF, but not vice versa [13].

The following theorem by V. Grolmusz generalizes a similar instance of the theorem for 3-servers in [13], to put our work in a broader context. It states the size of the MV families depending on the constant m which has an impact on the complexity of the PIR protocols based on them.

Theorem 4

([30]). Let $m={\prod }_{i=1}^r{p}_i$ where the $p_i$’s are distinct constant primes, and $r>1$ is constant. Then there exists an MV code family $C\subseteq {\mathbb{Z}}_m^h$ of size $\left|C\right|=exp\left(\frac{c{log}^r\left(h\right)}{{loglog\left(h\right)}^{(r-1)}}\right)$ which is $S_m$-bounded. Here $c\le p_r^{-r}$, where $p_r$ is the largest prime.

In fact, the construction in Theorem 4 generalizes to any m with r distinct prime divisors.

Next, we outline some parameters for which suitable share conversions leading to (3rd generation) PIR via the BIKO framework and MV codes from Theorem 4 exist. Note that Theorems 5 and 6 were initially stated in terms of conversion from Shamir secret sharing, but a corresponding conversion from CNF is implied.

Theorem 5

([11,26]). For each $r\ge 2$, there exists a number m with r distinct prime divisors $p_1\le \dots \le p_r$, with $p_r\ge 73$, for which there exists a share conversion from $(2,3/4·2^r)$-CNF over ${\mathbb{Z}}_m$ to $3/4·2^r$-additive over ${\mathbb{Z}}_2^{\beta }$ for some $\beta <m$, and relation $C_{S_m}$. Furthermore, such a conversion exists for every m of the form $2^t-1$ with r distinct prime divisors, if the number of parties, $3/4·2^r$, is replaced by $2^r$.

In a nutshell, the above result is obtained by [26] via a composition technique applied to [11]’s result for 3-server and $2^r$-server PIR. The reduction in the number of parties from $2^r$ to $3/4·2^r$ for m with r prime distinct divisors follows from the (somewhat surprising) 3-party conversion for $r=2$ and $m=73·7$.

In [23], the authors found 50 additional such 3-party conversions for $m=p_1·p_2$ (which need to satisfy a certain condition), leading to further improvements in the number of parties as a function of r. Note, that for all m found in [23], $p_r\ge 73$ are large, so the constant in Theorem 1 grows fast with r.

Theorem 6

([23]). For each $r\ge 104$, there exists a share conversion from $(2,{(3/4)}^{51}·2^r)$-CNF over ${\mathbb{Z}}_m$ to ${(3/4)}^{51}·2^r$-additive over ${\mathbb{Z}}_2^{\beta }$ for some $\beta <m$, and relation $C_{S_m}$. For each $r<104$, there exists a share conversion from $(2,3^{\lceil r/2\rceil })$-CNF over ${\mathbb{Z}}_m$ to $3^{\lceil r/2\rceil }$-additive over ${\mathbb{Z}}_2^{\beta }$ for some $\beta <m$, and relation $C_{S_m}$.

Note that for the above instantiations, “descending” from [11], m must be odd.

Theorem 7

(Implicit in [13]). Let $m\in \mathbb{N}$, $\left\{0\right\}\subseteq S\subseteq {\mathbb{Z}}_m$, and C an S-bounded MV code family $\left\{C_h\right\}$ of vectors in ${\mathbb{Z}}_m^h$. Assume also there exists share conversion from $(2,k)$-CNF over ${\mathbb{Z}}_m$ to ${\mathbb{Z}}_p^{\beta }$ for some constant β, for the relation $C_S$. Then there exists a k-server PIR family for databases of size $n=\left|C_h\right|$ with client’s message of size $\lceil hlog\left(m\right)\rceil$ and server’s message of size $\lceil \beta logp\rceil$.

From Theorems 6 and 7 follows

Corollary 7.

Let $r\ge 3$. Then there exists some $m={\prod }_{i=1}^r{p}_i^{e_i}$ where $p_1<\dots <p_r$ are primes where $m\left|\right(2^{\beta }-1)$ for some β. Then a $3/4·2^r$-server PIR with client communication complexity of $O(2^{2p_r·{log}^{1/r}\left(n\right)log{log}^{1-1/r}\left(n\right)})$ and (each) server’s communication complexity $\beta log\left(p\right)$, for some $\beta \le m$ exists. For $r\ge 104$, this improves to ${(3/4)}^{51}{2}^r$ servers, and $3^{\lceil r/2\rceil }$ servers for $r<104$.

We note that among the known m’s in the Corollary above for $r=2$, $p_r\ge 73$ and grows particularly fast with r for $r\ge 104$ if ${(3/4)}^{51}{2}^r$ servers (instead of $3/4·2^r$) exist.

Instantiating Theorem 7 with Theorem 4 for MV-code construction, and either Theorem 1, we obtain the best known concrete efficiency of 3-server PIR, with $2^{6\sqrt{log\left(n\right)loglog\left(n\right)}}$ communication complexity. On the other hand, for more than polynomially improved communication complexity and a larger number of servers, the best result is obtained by instantiating the share conversion via Theorem 5.

Our concrete result does not improve communication complexity for 3-server PIR, which is essentially optimal for conversion from ${\mathbb{Z}}_6$ by [13] as stated in Theorem 1. However, the technical tools developed may help understand the existence of share conversions for even m with a larger number of prime factors, with better the communication complexity of PIR and the larger number of servers. Due to the generality of BIKO’s framework, converting from CNF, one could hopefully get improved efficiency of communication complexity relatively to the number of servers. In particular, as noted above, the instantiation of BIKO as in [11] does not yield PIR protocols with even m, and the known values of m have large maximal factors and lead to PIR with high constants in the exponent. By a direct corollary from Theorems 4 and 5 similar to Corollary 7, we get a 6-server PIR with communication complexity $O\left(2^{146·{log}^{1/3}\left(n\right)log{log}^{2/3}\left(n\right)}\right)$. Using the BIKO framework instantiated Theorem 5—the ‘furthermore’ part, for 8-server PIR we obtain a complexity of $O\left(2^{34·{log}^{1/3}\left(n\right)log{log}^{2/3}\left(n\right)}\right)$, by using $m=255=3·5·17=2^8-1$, and instantiating Theorem 4 with $m=255$. Thus, as far as we know, no PIR with complexity better than $O\left(2^{146·{log}^{1/3}\left(n\right)log{log}^{2/3}\left(n\right)}\right)$ (best known 6-server PIR) exists for 7 servers. We conjecture that a 7-server PIR with much improved constants exists, by using share conversion from $(2,7)$-CNF with parameters generalizing the conversions we obtained for $m=2·p_2$.

Conjecture 1.

A share conversion from $(2,7)$-CNF over ${\mathbb{Z}}_{30}$ to ${\mathbb{Z}}_2^{\beta }$ for some constant β exists, implying a 7-server PIR for$O\left(2^{10·{log}^{1/3}\left(n\right)log{log}^{2/3}\left(n\right)}\right)$.

We hope to be able to verify the conjecture more easily by generalizing the insights we have for the existence of a share conversion for $m=2·p_2$ to a share conversion to $m=2·15$ (more generally, for $2·c$ for some composite c), and the fact that in this case of $p_1$, the analysis turned out to be rather simple. Another reason to hope we can manage with 7 servers is that $M_{\equiv }$ is in that case, has a form similar to the 3-server case considered in present work (unless, for example, 6-server case). See Section 1.6 for more details.

A broader goal is improving the number of servers one can tolerate for PIR with CC corresponding to MV codes over ${\mathbb{Z}}_m$ with r prime factors. While [26] show how to achieve ${(3/4)}^{51}{2}^r$ servers for an infinite number of r’s and corresponding m’s, and $3^{r/2}$-server PIR for finitely many r’s, it would be interesting to improve Theorem 6 to get share conversion for $3^{r/2}$-server PIR for all r. Our hope is to devise a composition theorem along the lines of [26], composing ‘gadgets’ of conversions from $(2,3)$-CNF over ${\mathbb{Z}}_m$ for coprime composite m’s. As we already have such conversions for infinitely many pairwise coprime m’s via Theorem 1, we only need a suitable composition theorem. In fact, it is not hard to show, that if we had conversions for coprime $m_1,m_2$ respectively, both to ${\mathbb{Z}}_p^{\beta }$ for the same p, say ${\mathbb{Z}}_2^{\beta }$, we would obtain the result. In particular, it is strictly easier to prove the existence of conversion from ${\mathbb{Z}}_{p_1{p}_2}$ to ${\mathbb{Z}}_2^{\beta }$ for some $\beta$ depending on $p_1,p_2$ for infinitely many coprime $p_{2i+1}·p_{2i+2}$’s (as the 51 known cases based on Mersenne-style primes in [26] are a special case). To summarize, to complete this direction, we only need to find a conversion from $(2,3)$-CNF over ${\mathbb{Z}}_{m_i}$ to ${\mathbb{Z}}_2^{{\beta }_i}$ for infinitely many coprimes $m_i$’s of the form $m_i=p_1·p_2$ where $p_1,p_2$ are distinct primes. This seems to require only moderate extension on the (linear algebraic) toolbox conversions from $(2,3)$-CNF that has been laid out in the seminal work of [13] and subsequently in [32].

A more ambitious still direction (which we expect to be more technically involved) is expected to lead to dramatic improvements in the number of servers, bringing it down from exponential to linear in r. It relies on the following composition lemma, which is not hard to prove (see full version for details).

Lemma 1.

Let $m_1=2m_1^{\prime },m_2=2m_2^{\prime }$, where $m_1^{\prime },m_2^{\prime }>1$ are odd coprime integers. Assume there exists a share conversion from $(2,k)$-CNF over ${\mathbb{Z}}_{m_1}$ to $(t_1,k)$-CNF over ${\mathbb{Z}}_2^{{\beta }_1}$ for the relation $S_{m_1}$ (and an analogous conversion exists for $m_2$). Then there exists a share conversion from $(2,k)$-CNF over ${\mathbb{Z}}_{2m_1^{\prime }{m}_2^{\prime }}$ to $(t_1+t_2+1,k)$-CNF over ${\mathbb{Z}}_2^{max({\beta }_1,{\beta }_2)}$ for $C_{S_{2m_1^{\prime }{m}_2^{\prime }}}$.

Remark 2.

More generally, slightly optimizing parameters, relatively to iteratively applying Lemma 1 for two $m_i$’s, for any $r\ge 2$, and $m_1,\dots ,m_r$ as above, we obtain a share conversion from $(2,k)$-CNF over ${\mathbb{Z}}_{2{\prod }_{i=1}^r{m}_i^{\prime }}$ to $(1+{\sum }_{i=1}^r{t}_i,k)$-CNF over ${\mathbb{Z}}_2^{max({\beta }_1,\dots ,{\beta }_r)}$ for the relations $C_{S_{2{\prod }_{i=1}^r{m}_i^{\prime }}}$.

Assume a conversion generalizing our result from Theorem A1 for 3 servers to more servers, while keeping the conversion to a scheme $(t,k)$-CNF for sufficiently small t. Such a scheme has enough redundancy to support multiplications over the resulting field ${\mathbb{F}}_{2^{\beta }}$ unlike $(k,k)$-additive, which has none (if needed, the field characteristic 2 may be replaced with some other prime, generalizing Theorem 1 instead). Then we can obtain PIR with linear server complexity $k=O\left(r\right)$, using Theorem 4, and applying Lemma 1 $r-1$ times. More precisely, we have:

Corollary 7.

Assume there exists a (global) constant t, such that for all sufficiently large k, the following holds. For infinitely many $m_i$’s of the form $m_i=2p_i$ where all $p_i$ are odd distinct primes, there exists a share conversion from $(2,k)$-CNF to $(t,k)$-CNF over ${\mathbb{Z}}_2^{{\beta }_i}$ for the relation $C_{m_i}$. Then, for all sufficiently large r, there exists a $k=t(r-1)+1$-server PIR with communication complexity $2^{O({log}^{1/r}\left(n\right)log{log}^{1-1/r}\left(n\right))}$.

1.6. Our Techniques

As described above, one of the main contributions of [13] was an instantiation of the framework for designing PIR protocols, which reduces the question of the existence of a three-server PIR protocol to the existence of a share conversion for certain parameters $p_1,p_2,p$, and certain linear sharing schemes over Abelian rings R, $R^{\prime }$ determined by the parameters.

BIKO provides the criteria of the share conversion existence in the case when $m=p_1{p}_2$ for distinct primes $p_1$ and $p_2$ and the set $S_m=\{s_1,s_2,1\}$, where $s_{1}mod{p}_1=0$, $s_{1}mod{p}_2=1$, $s_{2}mod{p}_1=1$, $s_{2}mod{p}_2=0$. Namely, they prove that for such m and $S_m$, the share conversion from (2,3)-CNF over ${\mathbb{Z}}_m$ to 3-additive scheme over ${\mathbb{Z}}_p^{\beta }$ exists if and only if $rank\left(M_{\equiv ,\not\equiv }\right)-rank\left(M_{\equiv }\right)=\beta >0$, where the rank is computed over ${\mathbb{F}}_p$. The matrices $M_{\equiv }$ and $M_{\equiv ,\not\equiv }$ are matrices over ${\mathbb{Z}}_p$ with $3m^2$ columns and $3m^2$ and $4m^2$ rows respectively which are constructed from some specific system of equations and inequalities. Beimel et al. in [13] did not provide the general solution for this system; however, they proved existence and nonexistence of the conversion for some special cases.

While the solvability of a system can be verified efficiently for a concrete instance, it does not provide a simple condition for characterizing triples $(p_1,p_2,p)$ for which solutions exist. Moreover, the size of the matrix $M_{\equiv ,\not\equiv }$ in this system is $4m^2\times 3m^2$ which makes the numerical solution for big m’s heavy in practice (though asymptotically efficient). Before [32], where the solvability of the system for the case odd primes $p_1$ and $p_2$, if one of them equals to p was proven, even the question of whether an infinite set of such triples exists remained open.

Our concrete goal in this work is to better understand the case of $m=p_1{p}_2$, motivated by understanding the technical foundations of the broader problem for m which is a product of $r>2$ distinct primes (see Section 1.5 for details). We proceed using the BIKO characterization above. Concretely, for parameters $m=p_1{p}_2$ and p, this reduces to calculating the quantity $rank\left(M_{\equiv ,\not\equiv }\right)-rank\left(M_{\equiv }\right)=\beta$, where the rank is computed over ${\mathbb{Z}}_p$.

In [32], the case $p_1=p$ for odd $p_1$ and $p_2$ was explored. To simplify the technical task, the authors of [32] rely on the observation from [13] that $\beta >0$ iff $M_{\equiv }$ does not span $v_{\not\equiv }$ for any row $v_{\not\equiv }$ of $M_{\not\equiv }$. Thus, they replace $M_{\not\equiv }$ with some $v_{\not\equiv }$ as above, and work with that (forgoing the goal of understanding the particular value of $\beta$). Then, they proceed by bringing the matrix $M_{\equiv ,\not\equiv }$ to a more convenient form by performing a sequence of carefully tailored elimination steps on the rows of the matrix $M_{\equiv ,\not\equiv }$. The sequence of eliminations is based on a observing a 3-leveled structure of the matrix of the matrix $M_{\equiv ,\not\equiv }$, and working on blocks of decreasing coarseness as the elimination process progresses. It also involves a change of basis at some point, to make the matrix’s structure nicer for understanding. That is, rewriting the matrix so that the set of columns corresponds to a new basis—here we even manage to get fewer vectors in, as it suffices to include a set of vectors which is guaranteed to span $M_{\equiv ,\not\equiv }$. However, the resulting matrix after that process remains too complex to check whether $\beta >0$ for all parameters. The analysis up to that point (resulting in some matrix $A_{inter}=(A_{inter}^{\prime },v_{\not\equiv }^{\prime })$ to analyze) is oblivious to the particular parameters except for not looking at even m (not because it was particularly hard, but rather out of a decision to limit the scope of the paper at what was already achieved). To obtain their partial result for some of the parameters, the authors then reduce the matrix’s rows modulo a certain vector subspace (formally, multiplied it from the right by a certain square matrix L with non-trivial left kernel). Clearly, it holds that if $rank\left(A_{inter}L\right)-rank\left(A^{\prime }L\right)>0$, then $rank\left(A_{inter}\right)-rank\left(A^{\prime }\right)>0$ as well (implying the existence of a share conversion), but not necessarily the other way around. The matrix $A_{inter}L$ turns out to be sufficiently simple to analyze, and for p which is either $p_1$ or $p_2$, the resulting rank difference is non-zero. However, we do not yet understand other parameters, for which $rank\left(A_{inter}\right)-rank\left(A^{\prime }\right)=0$, or the case of even m. Also, due to the first simplification, the concrete value of $\beta$ is not found, and thus the concrete answer complexity of the resulting PIR as implied by Theorem 8 remains unknown.

Our current paper considers the case where $p_1=2$. We proceed by a quite straightforward generalization of [32]’s elimination process up until producing the matrix $A_{inter}$, except that we do not make the simplification of keeping a single row out of $M_{\not\equiv }$, but rather keep the entire matrix. The main divergence from [32] is that we do not perform the reduction modulo a subspace, but are able to directly check whether $rank\left(A_{inter}\right)-rank\left(A^{\prime }\right)>0$, and furthermore to compute the exact value of $\beta$. This is made possible, as the case where $p_1=2$ turns out to be particularly simple, and we managed to successfully analyze it directly (for all $p_2,p$). The other cases (when m is odd, and p is not equal to $p_1$ or $p_2$) remain open.

2. Preliminaries

2.1. Some Notation

Parameters of the secret sharing schemes. Throughout this paper, we fix the notation for $p_1$, $p_2$ and p being prime numbers such that $p_1\ne p_2$, and $m=p_1·p_2$ are the parameters of the secret sharing schemes and conversion. Later, considering the corner case $p_1=2$ in Section 3.4, we introduce the odd prime number q to set $p_2=q$.

Matrices and block-matrices. In this paper, we will consider matrices and block-matrices over a finite field $\mathbb{F}={\mathbb{Z}}_p$. Those matrices are defined for 3 levels. The level-2 (“big”) block-matrices we denote by letter A with correspondent indexes. The elements of level-2 matrices are level-1 block-matrices which we denote by the letter R with a lower index equal to the upper index of its “host” A. The level-0 “small” matrices are square matrices, initially having the size $m\times m$. For them, we use distinct letters.

For entry $i,j$ of some matrix X, we use the standard notation of $X[i,j]$. Addressing the elements of level-2 and level-1 matrices, we address their blocks. Such, $A^1[i,j]$ denotes the block in the ith row and jth column of $A^1$. For level-0 matrices, we address the particular elements of this matrix. More generally, for a matrix $X\in {\mathbb{F}}^{u\times v}$, for the subsets $R\subseteq \left[v\right]$ of rows and $C\subseteq \left[u\right]$ of columns, $X[R,C]$ denotes the sub-matrix with rows (or block-rows) restricted to R and columns (or block-columns) restricted to C. Those rows and columns are ordered in the original order in X. As special cases, using a single index i instead of R (C) refers to a single row (column). A “·” instead of R (C) stands for $\left[u\right]$ ($\left[v\right]$). Most of the time, index arithmetic will be done modulo the matrices’ number of (block-)rows and columns (we will however state this explicitly).

When we consider the case $p_1=2$ in Section 3.4, the level-1 matrices $R_j^i$’s are quite small and have only 2 level-0 blocks. Therefore, we omit the level-1 and address to level-0 blocks as to the entries of level-2 matrices $A^{\left(k\right),\ell }$.

Some concrete matrices and vectors. By the letter I, we denote the $m\times m$ identity matrix. If the identity matrix has a different size, we write this size down in the lower index. For instance, $I_q$ is a $q\times q$ identity matrix. By $a^{b\times c}$ we denote a $b\times c$ matrix with all elements equal to a. In case when $a=0$ and the size of this zero-block is clear from the context, we omit $b\times c$ and write 0 instead of $0^{b\times c}$. By $a^b$ we denote the row of a’s of the length b. For example, $1^m$ means the m-long string of 1’s.

By ${\mathbf{e}}_i$ we denote the unity vector. The length of this vector is, as a rule, clear from the context, or it is specified in the accompanying text. The lower index specifies the position of 1 in this vector. In Section 2.5 and subsequently in Section 3.2, when we construct matrices in the basis $B=B_1\cup B_2$, the unity vectors have double indexes ${\mathbf{e}}_{b,c}$. As explained in Section 2.5, there is the telescopic indexing system, and this double index points to the single position in the vector.

Concatenation and circular shifts over matrices. For matrices $X,Y$ with the same number of columns, $(X;Y)$ denotes the matrix comprised by concatenating Y below X. For matrices $X,Y$ with the same number of rows, we denote by $\left(X\right|Y)$ the matrix obtained by concatenating Y to the right of X.

In Section 3.4, we obtain the set of circularly shifted matrices. By $X^{<<k}$ we denote the matrix X with the circular left shift by k positions.

2.2. Secret Sharing Schemes

A secret sharing scheme is defined by pair of algorithms $Sh=(\mathsf{Share},\mathsf{Dec})$. The randomized algorithm $\mathsf{Share}$ randomly splits a secret message $s\in S$ into an n-tuple of shares, $(s_1,\dots ,s_n)$. The deterministic algorithm $\mathsf{Dec}$ reconstructs s from some allowed (qualified) subset of the shares. The set of all the qualified sets is called an access structure of the secret-sharing scheme. We say that $Sh$ is t-private, and has a threshold access structure if any t shares jointly reveal no information about the secret s.

We say that $Sh$ is linear over some finite Abelian ring G if $S\subseteq G$ and each share $s_i$ is obtained by applying a linear function over G to the vector $(s,r_1,\dots ,r_{\ell })\in G^{\ell +1}$, where $r_1$,…, $r_{\ell }$ are random and independent elements of G. A useful property of such schemes is that they allow evaluating locally linear functions of the shares such that additions and multiplications by the constant from G. In this work, we consider two types of linear secret sharing schemes:

• Additive secret sharing: the algorithm $\mathsf{Share}$ splits $s\in G$ into n random ring elements that add up to s; the algorithm Dec reconstructs s by adding up all the shares. This scheme is $(n-1)$-private. Within the limits of this work, we consider a 3-additive scheme, where $n=3$.
• CNF secret sharing: the algorithm $\mathsf{Share}$ first splits $s\in G$ into $\left(\genfrac{}{}{0pt}{}{n}{t}\right)$ additive shares $s_T$, each labeled by a distinct set $T\in \left(\genfrac{}{}{0pt}{}{\left[n\right]}{t}\right)$, and then lets each share $s_i$ be the subset of $s_T$ apart from $i\in T$. For (2,3)-CNF we consider in this work, each of 3 parties obtains 2 additive shares out of 3, such that if additive shares of s are $(a,b,c)$, then $s_1=(b,c)$, $s_2=(a,c)$, and $s_3=(a,b)$. This scheme is 1-private, as any two parties can sum their shares up to calculate the secret s.

See [33] for a survey on secret sharing.

2.3. Share Conversion

We recall the definition of (generalized) share conversion schemes as considered in our paper. Our definition is exactly the definition in [13], in turn, adopted from previous work.

Definition 1

([13]). Let $S{h}_1$ and $S{h}_2$ be two n-party secret-sharing schemes over the domains of secrets $S_1$ and $S_2$, respectively, and let $C\subseteq S_1\times S_2$ be a relation such that, for every $a\in S_1$, there exists at least one $b\in S_2$ such that $(a,b)\in C$. A share conversion scheme $convert(s_1,\dots ,s_n)$ from $S{h}_1$ to $S{h}_2$ with respect to relation C is specified by (deterministic) local conversion functions $g_1,\dots ,g_n$ such that: If $(s_1,\dots s_n)$ is a valid sharing for some secret s in $S{h}_1$, then $g_1\left(s_1\right),\dots g_n\left(s_n\right)$ is a valid sharing for some secret $s^{\prime }$ in $S{h}_2$ such that $(s,s^{\prime })\in C$.

For a pair of Abelian groups $G_1$, $G_2$ (When $G_1,G_2$ are rings, we consider $G_1,G_2$ as groups with respect to the $“{+}^{”}$ operation of the rings), we define the relation $C_S$ as in [13].

Definition 2

(The relation $C_S$ [13]). Let $G_1$ and $G_2$ be finite Abelian groups, and let $S\subseteq G_1\backslash \left\{0\right\}$. The relation $C_S$ converts $s=0\in G_1$ to any nonzero $s^{\prime }\in G_2$ and every $s\in S$ to $s^{\prime }=0$. There is no requirement when $s\notin S\cup 0$. Formally,

$$C_S=\left\{(s,0)|s\in S\right\}\cup \left\{(0,s^{\prime }):s^{\prime }\in G_2\backslash \left\{0\right\}\right\}\cup \left\{(s,s^{\prime })|s\notin S\cup \left\{0\right\},s^{\prime }\in G_2\right\}$$

Given $m=p_1·p_2$, where $p_1\ne p_2$ are primes and p is a prime, we consider pairs of rings $G_1={\mathbb{Z}}_m,G_2={\mathbb{Z}}_p^{\beta }$. We denote the set a relation $C_{S_m}$ in this work is built with as $S_m=\left\{x\in G_1|\forall i\in \left[2\right],xmod{p}_i\in \{0,1\}\right\}\backslash \left\{0\right\}$. I.e., $S_m=\{{(0,1)}_{{\mathbb{Z}}_m},{(1,0)}_{{\mathbb{Z}}_m},{(1,1)}_{{\mathbb{Z}}_m}\}$, where ${(a,b)}_{{\mathbb{Z}}_m}$ means the element of ${\mathbb{Z}}_m$ which has the remainder a modulo $p_1$, and b modulo $p_2$. For $S=S_m$, we refer to $S_m$ as the canonical relation for ${\mathbb{Z}}_m$.

2.4. The Characterization of BIKO

In Beimel et al. [13], $S{h}_1$ is a 3-additive secret sharing scheme over ${\mathbb{Z}}_m$, and $S{h}_2$ is (2,3)-CNF sharing over ${\mathbb{Z}}_p^{\beta }$. The conversion with respect to relation $C_{S_m}$ from $S{h}_1$ to $S{h}_2$ is considered. In [13], is proven that such a conversion exists iff a certain condition is satisfied by the matrix $M_{\equiv ,\not\equiv }$ over ${\mathbb{Z}}_p$.

In matrix $M_{\equiv ,\not\equiv }$, the rows are indexed by triples $(a,b,c)\in {\mathbb{Z}}_m^3$, corresponding to $(2,3)$-CNF sharings of some $s\in S_m\cup \left\{0\right\}$. The rows corresponding to $s\ne 0$ (i.e., to $s\in S_m$) form the upper part of the matrix, denoted by $M_{\equiv }$, and the rows corresponding to $s=0$ form the lower part, denoted by $M_{\not\equiv }$. In this way, $M_{\equiv ,\not\equiv }=(M_{\equiv };M_{\not\equiv })$. The columns of $M_{\equiv ,\not\equiv }$ are indexed by values in $\left[3\right]\times {\mathbb{Z}}_m\times {\mathbb{Z}}_m$. Intuitively, an index $(i,x,y)$ of a column corresponds to share $s_i$ (of ith server) of the $(2,3)$-CNF scheme being equal to $(x,y)$. Rows are indexes by triples $(a,b,c)=(s-b-c,b,c)$. There are m possible values for a, b and c, and 4 possible values for s. For a given b and c, and for a given s there is only one possible value of $s-b-c$, hence we replace the first index by simply s, and the matrix has $4m^2$ rows. The row indexed by $(s,b,c)$ has 1 in the column $(i,x,y)$, if the 3-additive shares $(s-b-c,b,c)$ are agree with CNF-shares, and 0 otherwise. Thus, there are 1’s in cells $\left[\right(s,b,c);(1,b,c\left)\right]$, $\left[\right(s,b,c);(2,s-b-c,c\left)\right]$ and $\left[\right(s,b,c);(3,s-b-c,b\left)\right]$, and 0’s elsewhere in this row.

The work in [13] provided a quantitative lower bound on $\beta$, depending on the degree difference between $M_{\equiv }$ and $M_{\not\equiv }$.

Theorem 8

(Theorem 4.5 [13]). Let $\beta =ran{k}_{{\mathbb{F}}_p}\left(M_{\equiv ,\not\equiv }\right)-ran{k}_{{\mathbb{F}}_p}\left(M_{\equiv }\right)$. Then, we have:

• If $\beta =0$, then there is no conversion from $(2,3)$-CNF sharing over ${\mathbb{Z}}_m$ to additive sharing over ${\mathbb{Z}}_p^{\kappa }$ with respect to $C_{S_m}$, for every $\kappa >0$.
• If $\beta >0$, then there is a conversion from $(2,3)$-CNF sharing over ${\mathbb{Z}}_m$ to additive sharing over ${\mathbb{Z}}_p^{\beta }$ with respect to $C_{S_m}$. Furthermore, in this case, every row v of $M_{\not\equiv }$ is not spanned by the rows of $M_{\equiv }$.

Theorem 8 provides a full characterization via a condition that given $(p_1,p_2,p)$ can be verified in polynomial time in $(p_1,p_2,log\left(p\right))$. More precisely, the size of our matrix $M_{\equiv ,\not\equiv }$ is $4m^2\times 3m^2$, so verifying the condition amounts to solving a set of linear equations, which naïvely takes about $O\left(m^6\right)$ time, or slightly better using improved algorithms for matrix multiplication, and the running time cannot be better than $\tilde{\mathsf{\Omega }}\left(m^4\right)$ using generic matrix multiplication algorithms. Thus, the complexity of verification grows very fast with m, becoming essentially infeasible for $p_1,p_2$ circa 50.

2.5. Our Starting Point—The Result of Paskin-Cherniavsky and Schmerler

The work [32] is made within BIKO’s setting. Starting with the matrix $M_{\equiv ,\not\equiv }$ they performed the sequence of elimination steps, according to the following lemma.

Lemma 2.

Let A denote a matrix in ${\mathbb{Z}}_p^{v\times u}$, and let $b=A[v,[u\left]\right]$. Let $I_1\subseteq [v-1],I_2\subseteq \left[u\right]$ denote non-empty sets of rows and columns, respectively. $A^{\prime }$ is obtained from A by a sequence of row operations on A, so that $A^{\prime }[I_1,I_2]$ is a basis of $A^{\prime }[\left[v\right],I_2]$, and the rest of the rows in $A^{\prime }[I_1,I_2]$ are zero. Let $b^{\prime }=A^{\prime }[v,\left[u\right]]$. Then, $Rows\left(A^{\prime }[\left[v\right]\backslash I_1,\left[u\right]\backslash I_2]\right)$ span $b^{\prime }[\left[u\right]\backslash I_2]$ iff $Rows\left(A\right[[v-1],\left[u\right]\left]\right)$ span b.

In fact, the result of [32] is the proof of the existence of the conversion for finite rings $G_1={\mathbb{Z}}_{p_1{p}_2}$ to $G_2={\mathbb{Z}}_{p_1}^{\beta }$ with distinct odd $p_1$ and $p_2$, for which it was enough to prove that the first row of $M_{\not\equiv }$ is not spanned by $M_{\equiv }$. Therefore, the matrix considered in [32] contained the full matrix $M_{\equiv }$ and the single row from $M_{\not\equiv }$. (As in our work we solve the problem for 2 sets of parameters proving both positive and negative results, we consider the full $M_{\equiv ,\not\equiv }$ matrix). After two elimination steps which cut the matrix $M_{\equiv }$ to $m+m^2$ rows, and the permutation of columns, they introduced a new basis $B=B_1\cup B_2$, where

$$\begin{array}{cc}\hfill B_1=\left\{-{\mathbf{e}}_{b,i}+{\mathbf{e}}_{b,i+1}\right.& \left.\mid b\in {\mathbb{Z}}_m,i\in \{0,...,p_2-2\}\right\},\hfill \\ \hfill B_2=\left\{{\mathbf{e}}_{b,i+j·{(1,0)}_{{\mathbb{Z}}_m}}-{\mathbf{e}}_{b,i+(j+1)·{(1,0)}_{{\mathbb{Z}}_m}}\right.& \left.\mid b\in {\mathbb{Z}}_m,i\in {\mathbb{Z}}_{p_2},j\in {\mathbb{Z}}_{p_1}\backslash \{p_1-1\}\right\},\hfill \end{array}$$

(1)

where ${\mathbf{e}}_{x,y}$ is a vector of length $m^2$ having 1 in the position indexed by $(x,y)$ and 0’s elsewhere. Indexes x and y are taken modulo m.

In this new basis, the matrix $M_{\equiv ,\not\equiv }$ has the block structure and is separated into 3 “types” (layers): Type-1 and Type-2 layers compose $M_{\equiv }$, and Type-3 is $M_{\not\equiv }$ after several elimination steps and basis change. For the Type-1 matrix, the basic block is the m-component vector $(1,\dots ,1)$ and $p_1\times (p_1-1)$ block matrices $R_1^2$ and $R_1^3$ made from m-long vectors:

(2)

(3)

Basic $m\times m$ blocks of Type-2 are identity matrix I, and

(4)

Bigger blocks composed from them have the size $p_1\times (p_1-1)$ “small” $m\times m$ blocks:

(5)

(6)

(7)

(8)

The matrix $M_{\equiv }$ is brought to the form $(A^1;A^2)$, where each of matrices $A^1$ and $A^2$ are block matrices having the left and right parts (In [32], the matrices we are talking about have the additional upper index $\left(6\right)$, which is omitted here. Thus, $A^i=A^{\left(6\right),i}=\left(A^{\left(6\right),L,i}\right|A^{\left(6\right),R,i})$ for $i\in 1,2$):

$$(A^1;A^2),A^1=\left(A^{L,1}\right|A^{R,1}),A^2=\left(A^{L,2}\right|A^{R,2}),$$

(9)

where

(10)

(11)

We remark that the appearance of $A^{R,1}$ and $A^{R,2}$ are slightly different from those in the work of Paskin-Cherniavsky and Schmerler. The difference is in $p_2-1$’st block-row and comes from the computational mistake made in [32] while changing the basis to B. We correct this mistake and bring the corrigendum in Appendix A.

In [32], only the first row from the Type-3 layer was constructed. For our purposes of obtaining $\beta$, we need the full Type-3 matrix. Therefore, we write here down the general formula for Type-3 rows taken from [32], and we use it in our next work to construct the entire Type-3 matrix in the basis B:

$${\mathbf{e}}_{(B,C)}-{\mathbf{e}}_{(B,C+{(0,1)}_{{\mathbb{Z}}_m})}-\sum _{k=0}^{{(-1,0)}_{{\mathbb{Z}}_m}}\left({\mathbf{e}}_{B+k,C}-{\mathbf{e}}_{B+k,C+1}\right),\mathrm{where}B,C\in {\mathbb{Z}}_m.$$

(12)

3. Our Result

3.1. Starting Point and Main Technical Tool

Our goal is to compute the difference between ranks of matrices $M_{\equiv }$ and $M_{\equiv ,\not\equiv }$. We start from the matrix $M_{\equiv }$ brought to the form (9) and we also construct the result of initial elimination steps over the matrix $M_{\not\equiv }$ from (12), obtained in [32]. We continue the process of elimination using Lemma 2 considering the case $m=2q$, where q is an odd prime number.

3.2. Construction of Type-3 matrix

First, as we need to compute the rank of the matrix $M_{\equiv ,\not\equiv }$, it is not enough to consider only a single row from the Type-3 matrix (which is the result of the sequence of elimination steps over $M_{\not\equiv }$. Therefore, our first step is to reconstruct this matrix from (12) and to perform initial elimination steps similar to those were made over matrix $A^2$ in [32] to bring it to the form (11).

To be consistent, we denote the initial Type-3 matrix as $A^{(-1),3}$, the intermediate result of the inner elimination steps over this matrix as $A^{\left(0\right),3}$, and the final result (on the same stage as (9)) as $A^3$. Next we describe the process of obtaining Type-3 matrix from (12). Recall that each of matrices A is separated in the left and right parts, where the left part contains indexes of vectors from basis $B_1$, and right—from $B_2$. Each row of $A^{(-1),3}$ is indexed by $i,j,b$ such that the largest blocks are indexed by $i\in {\mathbb{Z}}_{p_2}$, and contains blocks indexes by $j\in {\mathbb{Z}}_{p_1}$. The smallest blocks indexed by $b\in {\mathbb{Z}}_m$ are, in turn, parts of middle-size blocks.

First, rewrite (12) as

$$\begin{array}{c}{\mathbf{e}}_{(B,C)}-{\mathbf{e}}_{(B,C+{(0,1)}_{{\mathbb{Z}}_m})}-{\mathbf{e}}_{(B,C)}+{\mathbf{e}}_{(B,C+1)}-{\displaystyle \sum _{k=1}^{{(-1,0)}_{{\mathbb{Z}}_m}}}\left({\mathbf{e}}_{B+k,C}-{\mathbf{e}}_{B+k,C+1}\right)=\\ ={\mathbf{e}}_{(B,C+1)}-{\mathbf{e}}_{(B,C+1-{(1,0)}_{{\mathbb{Z}}_m})}-{\displaystyle \sum _{k=1}^{{(-1,0)}_{{\mathbb{Z}}_m}}}\left({\mathbf{e}}_{B+k,C}-{\mathbf{e}}_{B+k,C+1}\right).\end{array}$$

(13)

• Consider the case when $i\ne p_2-1$, $j\ne 0$. Each row indexed by $(i,j,b)$ is determined by (13), where $B=b$, $C=i+j{(1,0)}_{{\mathbb{Z}}_m}$. Then the first two terms in (13) are

  $${\mathbf{e}}_{B,C+1}-{\mathbf{e}}_{B,C+1-{(1,0)}_{{\mathbb{Z}}_m}}={\mathbf{e}}_{b,(i+1)+j{(1,0)}_{{\mathbb{Z}}_m}}-{\mathbf{e}}_{B,(i+1)+(j-1){(1,0)}_{{\mathbb{Z}}_m}}=B_2[(i+1),(j-1),b].$$

  (14)
  The term in the sum in (13) is

  $$\begin{array}{c}{\mathbf{e}}_{B+k,C}-{\mathbf{e}}_{B+k,C+1}={\mathbf{e}}_{b+k,i}-{\mathbf{e}}_{b+k,i}+{\mathbf{e}}_{b+k,i+{(1,0)}_{{\mathbb{Z}}_m}}-...+{\mathbf{e}}_{b+k,i+j{(1,0)}_{{\mathbb{Z}}_m}}-\\ -{\mathbf{e}}_{b+k,i+1}+{\mathbf{e}}_{b+k,i+1}-{\mathbf{e}}_{b+k,i+1+{(1,0)}_{{\mathbb{Z}}_m}}-...-{\mathbf{e}}_{b+k,i+1+j{(1,0)}_{{\mathbb{Z}}_m}}=\\ =B_1[i,(b+k)]+{\displaystyle \sum _{\ell =0}^{j-1}}\left(B_2[i,\ell ,b+k]-B_2[(i+1),\ell ,b+k]\right).\end{array}$$

  (15)
• When $j=0$, $i\ne p_2-1$ the sum in (15) turns to 0. As for (14), the first two terms in (13) are:

  $${\mathbf{e}}_{B,C+1}-{\mathbf{e}}_{B,C+1-{(1,0)}_{{\mathbb{Z}}_m}}={\mathbf{e}}_{b,i+1}-{\mathbf{e}}_{B,i-{(1,0)}_{{\mathbb{Z}}_m}}=-\sum _{\ell =0}^{p_1-2}{B}_2[(i+1),\ell ,b].$$

  (16)
• When $j\ne 0$, $i=p_2-1$, the first two terms of (13) are the same as in (14). The only difference is the sum of terms:

  $$\begin{array}{c}{\mathbf{e}}_{B+k,C}-{\mathbf{e}}_{B+k,C+1}={\mathbf{e}}_{b+k,(p_2-1)+j{(1,0)}_{{\mathbb{Z}}_m}}-{\mathbf{e}}_{b+k,p_2+j{(1,0)}_{{\mathbb{Z}}_m}}=\\ =-{\mathbf{e}}_{b+k,0}+{\mathbf{e}}_{b+k,p_2-1}-{\displaystyle \sum _{\ell =0}^{p_2-1+j}}({\mathbf{e}}_{b+k,\ell {(1,0)}_{{\mathbb{Z}}_m}}-{\mathbf{e}}_{b+k,(\ell +1){(1,0)}_{{\mathbb{Z}}_m}})+\\ +{\displaystyle \sum _{\ell =0}^{j-1}}({\mathbf{e}}_{b+k,(p_2-1)+\ell {(1,0)}_{{\mathbb{Z}}_m}}-{\mathbf{e}}_{b+k,(p_2-1)+(\ell +1){(1,0)}_{{\mathbb{Z}}_m}})=\\ =-{\displaystyle \sum _{\ell =0}^{p_2-2}}{B}_1[\ell ,b+k]-{\displaystyle \sum _{\ell =0}^{p_2-1+j}}{B}_2[0,\ell ,b+k]+{\displaystyle \sum _{\ell =0}^{j-1}}{B}_2[(p_2-1),\ell ,b+k].\end{array}$$

  (17)
• Finally, for $i=p_2-1$, $j=0$, the first two terms in (13) are according (16), and the terms in sum are as in (17), except from the term ${\sum }_{\ell =0}^{j-1}{B}_2[(p_2-1),\ell ,b+k]$, i.e.,

  $$-\sum _{\ell =0}^{p_2-2}{B}_1[\ell ,b+k]-\sum _{\ell =0}^{p_2-1+j}{B}_2[0,\ell ,b+k].$$

  (18)

Substituting expressions (14)–(18) to (13) for appropriate $i,j,b$, we obtain the matrix which has the structure similar to $A^2$:

$$A^{(-1),3}=\left(A^{(-1),L,3}|A^{(-1),R,3}\right),$$

(19)

where

Here block matrices $R_3^2$ and $R_3^3$ are of the same form as $R_2^2$ (6) and $R_2^3$ (7) respectively, where the blocks $T_2$ are replaced with the blocks $T_3$:

(20)

The matrix $R_3^1$ is similar to $R_2^1$, but with the opposite sign, and permuted rows:

(21)

The matrix $R_3^4$ can be obtained from $R_3^1$ with the circular permutation of rows:

(22)

3.3. Elimination Steps in Type-3 Matrix

Following the way in [32] for elimination steps in $A^2$, we first sum the block-rows in (19) with ordinal numbers from 0 to $p_1-2$ to the last block-row. The resulting matrix $A^{\left(0\right),3}$ equals $A^{(-1),3}$ except the last row, where $A^{\left(0\right),L,3}[p_2-1,·]$ is 0-block, and

$$A^{\left(0\right),R,3}[p_2-1,·]=\left(R_3^2+R_3^4-R_3^3|R_3^1|...|R_3^1\right).$$

The second elimination step is an inner step in every block-row except from the last one (as those block-rows are the same in $A^{(-1),3}$ and $A^{\left(0\right),3}$, we can say that this step is performed over (19)). Namely, in any level-2 block-row $A^{\left(0\right),3}[i,·]$ where $i\in \{0,...,p_1-2\}$, we subtract the level-1 block-row with the ordinal number 0 from all other sub-rows in this block-row. As a result, $A^3=\left(A^{L,3}|A^{R,3}\right)$, where the left-side matrix takes the form

(23)

and the right-side matrix is

(24)

where

(25)

3.4. The Case of the Even m ($p_1=2$, $p_2=q$)

In this section, we consider the case $p_1=2$, $p_2>2$ for both $p=2$ and $p>2$ (including the case $p_2=p$). We obtain the feasibility results and, moreover, in the case of $p=2$ when the conversion from (2,3)-CNF over ${\mathbb{Z}}_{2p_2}$ to three-additive secret sharing over ${\mathbb{Z}}_2^{\beta }$ (as we prove) exists, we also compute $\beta$. We adopt the following notation in this section: $p_2=q>2$, and p are prime numbers, and $m=2q$ (later we split this case into subcases $p=2$ and $p>2$). Our starting point is the block matrix $A=\left(A^2;A^1;A^3\right)$ over ${\mathbb{Z}}_p$, where $A^1$ and $A^2$ are described in (9), and $A^3$ in (23) and (24).

We next consider the matrices in the case when $m=2q$, where q is an odd prime number. Below we write down the block matrices completing the matrix A. Each of the following matrices contains two square $m\times m$ blocks:

$$\begin{array}{cc}\hfill R_2^1=R_3^1=R_3^4=\left(\begin{array}{c}I\\ -I\end{array}\right)& ;R_2^4=R_3^5=\left(\begin{array}{c}I\\ -2I\end{array}\right);\hfill \\ \hfill R_2^2=\left(\begin{array}{c}0\\ T_2\end{array}\right);R_2^3=\left(\begin{array}{c}{T}_2\\ 0\end{array}\right)& ;R_3^2=\left(\begin{array}{c}0\\ T_3\end{array}\right);R_3^3=\left(\begin{array}{c}{T}_3\\ 0\end{array}\right).\hfill \end{array}$$

(26)

We would like to remind that $1^m=(1,...,1)$ is an m-element vector of 1’s, also $1^q$ is the q-element vector of 1’s. I is a $m\times m$ identity matrix, and $I_q$ is a $q\times q$ identity matrix.

Taking into account (26), the block matrix $A=\left(A^2;A^1;A^3\right)$ according to (9), (23) and (24) is the following:

(27)

(28)

(29)

The left-side and the right-side matrices are divided by the double vertical line. All the subsequent matrices which we will obtain from A will have the additional upper indexes: $A^{\left(i\right)}=\left(A^{\left(i\right),2};A^{\left(i\right),1};A^{\left(i\right),3}\right)$, where i is the ordinal number of the matrix in the sequence of transformation steps. Within the limits of this section, we consider matrices $A^{(·),\ell }$ as if they have level-0 blocks as the entries, and we, therefore, address to level-0 blocks as to the entries of level-2 matrices $A^{(·),\ell }$.

First of all, we subtract $A^2$ from $A^3$ and rewrite all the matrices such that first go all the block-rows for $i<p_2-1$, $j=0$, and then the block-rows for $i<p_2-1$, $j=1$ and two last block-rows remain where they were before.

Matrices $T_2$ and $T_3$ depend on values ${(0,1)}_{{\mathbb{Z}}_m}=q+1$ and ${(1,0)}_{{\mathbb{Z}}_m}=q$. We introduce the new block $T=T_3-T_2$ and note that with respect to (26),

(30)

(31)

(32)

(33)

We note that the last block-row in $A^{\left(1\right),2}$ is the same as the previous one up to sign. The same observation we can make about $A^{\left(1\right),3}$.

3.4.1. Internal Transformations in Matrices on the Level-2

We made some quite obvious steps inside each of the matrices $A^{\left(1\right),·}$ to reach a more comfortable form. In $A^{\left(1\right),2}$ we eliminate the last block-row. In addition, we add all the block-rows from $A^{\left(1\right),2}\left[i\right]$ for $i\in \{q-1,...,2q-3\}$ to block-row $A^{\left(1\right),2}[2q-2]$ and change the sign of this row. The resulting matrix is

(34)

In $A^{\left(1\right),1}$, we change the sign of the pre-last row, move it to the position $p_2-1=q-1$ and make telescopic elimination by the following sequence of steps: starting with the row $i=q$, we subtract the previous row from ith, then change the sign of the ith row. Then we increment i by 1. We repeat this algorithm up to the last row of this matrix. Note, that the last row turns to 0, so we eliminate it from the matrix. The result is the matrix with $(2q-1)$ rows:

(35)

The same transformation we perform in $A^{\left(2\right),3}$, working with block-rows instead of rows. The result is the following matrix with $(2q-1)$ block-rows:

(36)

3.4.2. Resolution of the Level-0 Blocks in $A^{\left(2\right),3}$

Consider the block-rows of the appearance $\left(\begin{array}{ccc}\cdots |& T+2I& |\cdots \end{array}\right)$ in (36). According (30), it equals to the matrix , where first q rows are the same as q last ones, and those q rows can be eliminated from the matrix. According to our notation, the $q\times m$-block equal to the concatenation of two $I_q$’s is denoted as $\left(I_q\right|I_q)$. The rows we just considered belong to the local basis of $A^{\left(2\right),3}$.

Then we consider the block-rows $\left(\begin{array}{cccccc}\cdots & \left|T\right|& \cdots & |-I|& I|& \cdots \end{array}\right)$ in (36). Subtracting from this block-row the basis vectors from two corresponding block-rows $\left(\begin{array}{ccc}\cdots & \left|\right(I_q\left|I_q\right)|& \cdots \end{array}\right)$ and taking into account (30), we transform it to:

Again, the first q rows in this block-row can be crossed out from the matrix, as they are the same as q following ones up to the sign. Then the resulting matrix contains only $q(2q-1)$ rows of the local basis:

(37)

3.4.3. Resolution of the Level-0 Blocks in ($A^{\left(2\right),2};A^{\left(2\right),1}$)

First, we consider block-rows of appearance $\left(\begin{array}{ccccc}\cdots & \left|T_2\right|& \cdots & \left|I\right|& \cdots \end{array}\right)$ in $A^{\left(2\right),2}$ (Equation (34)). For each $j>q$, $T_2\left[j\right]=T_2\left[0\right]+T_2\left[q\right]-T[j-q]$, hence we can bring all the $T_2\left[j\right]$ to 0 by the inner linear operations of rows in the block-row, which result in the following appearance of the block-row under the consideration:

(38)

where $T_2^{\prime }=T_2[\{0,...,q\},·]$, and J is a $(q-1)\times q$-size matrix:

(39)

The set of all the upper block-rows as in (38) is in the echelon form and belongs to the basis of our matrix. Now, we pay attention to $q-1$ first rows in $A^{\left(2\right),1}$ (Equation (35)), taking into account that $1^m=T_2^{\prime }\left[0\right]+T_2^{\prime }\left[q\right]$. Subtracting the correspondent rows of $A^{\left(2\right),2}$ from $A^{\left(2\right),1}$, we bring the rows of the appearance $A^{\left(2\right),1}[i,·]=\left(\begin{array}{cccc}\cdots & \left|1^m\right|& \cdots & ||\cdots \end{array}\right)$ to the form $\left(\begin{array}{cccc}0||& \cdots & \left|(-{\mathbf{e}}_0|-{\mathbf{e}}_0)\right|& \cdots \end{array}\right)$. Considering this resulting row together with the second block-row from (38), we can see that those are easily transformable to the form $\left(\begin{array}{cccc}0||& \cdots & \left|\left(I_q\right|I_q)\right|& \cdots \end{array}\right)$. As block-rows of the appearance $\left(\begin{array}{cccc}0||& \cdots & \left|\left(I_q\right|I_q)\right|& \cdots \end{array}\right)$ are composed from transformed rows of both matrices $A^{\left(2\right),2}$ and $A^{\left(2\right),1}$, we denote this merged matrix of $q-1$ block-rows as $A_{q-1}^{\left(3\right),1\&2}$:

(40)

This matrix is in the left echelon form and thus consisted from the basis vectors of $M_{\equiv ,\not\equiv }$.

In addition, we consider the last block-row of $A^{\left(2\right),2}$, namely, $\left(\begin{array}{cccccc}0||& I|& I|& \cdots & \left|I\right|& T_2-I\end{array}\right)$ and subtract from there all the correspondent basis vectors of (40). Each block I then turns to . Adding the upper half of the resulting block-row to the lower (and changing the sign of the upper one), we get . We subtract the last row of $A^{\left(2\right),1}$ from each of last q rows of this block-row. Then these last q rows come to the form $\left(\begin{array}{ccc}0||& \cdots & |\left(I_q\right|I_q)\end{array}\right)$, and we append them to (40) to complete the matrix $A^{\left(3\right),1\&2}$. Then, subtracting the appropriate rows of the block $\left(I_q\right|I_q)$ from the block $(I-T_2)[0,...,q-1]$, we transform it to the form $\left(0^{q\times q}\right|I_q-N)$, where N is a q-dimension matrix

(41)

Finally, we consider the block-rows in $A^{\left(2\right),2}$ in (34) of the appearance $\left(\begin{array}{ccccc}0||& \cdots & \left|T_2-2I\right|& -T_2|& \cdots \end{array}\right)$. Let us consider the result of the elimination the basis $\left(I_q\right|I_q)$ from the block

(42)

The result of the elimination is . For the block $-T_2$, the result of the elimination is . Thus, each block-row under the consideration turns to the following q-row block-row $\left(\begin{array}{ccccc}0||& \cdots & \left|\left(0\right|N)\right|& \left(0\right|2I_q-N)|& \cdots \end{array}\right)$.

Thus, the result of all the transformations over $\left(A^{\left(2\right),2};A^{\left(2\right),1}\right)$ above is $\left(A^{\left(3\right),2};A^{\left(3\right),1\&2}\right)$, where

(43)

We note, that all the rows of $A^{\left(2\right),1}$ in (35) of the appearance $\left(\begin{array}{cccc}0||& \cdots & \left|1^m\right|& \cdots \end{array}\right)$ are spanned by $A^{\left(3\right),1\&2}$ as the row’s sums over the correspondent block-row.

3.4.4. Resolution of the $A^{\left(3\right),1\&2}$ Basis

To apply Lemma 2, it is necessary to subtract vectors of basis $A^{\left(3\right),1\&2}$ from the first $(q-1)$ block-rows of $A^{\left(3\right),2}$. The matrix $A^{\left(3\right),3}$ contains exactly the same block-rows as $A^{\left(3\right),1\&2}$ which can be simply crossed out.

Subtracting block $\left(I_q\right|I_q)$ from block $\left(I_{q+1}\right|0)$, we obtain the latest in form . We denote the $(q+1)\times q$ block $\left(\frac{-I_q}{{\mathbf{e}}_0}\right)$ as $(-I_{q+1}^{\prime })$. Then, after applying Lemma 2 to remove the basis $A^{\left(3\right),1\&2}$ and corresponding columns, we obtain the matrix

$$A^{\left(4\right)}=\left(A^{\left(4\right),2};A^{\left(4\right),3}\right),$$

where

(44)

3.4.5. Elimination of the Left-Side Matrices

We note that each row in block $\left(I_q\right|-I_q)$ is spanned by the rows of $T_2^{\prime }$, namely, $\left(I_q\right|-I_q)\left[j\right]=T_2^{\prime }\left[j\right]-T_2^{\prime }[j+1]$ ($j\in \{0,...,q-1\}$). Subtracting the correspondent rows of $A^{\left(4\right),2}$ from $A^{\left(4\right),3}$, and applying Lemma 2, we obtain

(45)

Here, the left side is crossed out, and matrix $A^{\left(5\right)}=\left(A^{\left(5\right),2};A^{\left(5\right),3}\right)$ is the matrix of $q\times q$ level-0 blocks.

3.4.6. Resolution of N and $2I_q-N$ Blocks

Up to this moment, we performed transformations in matrices without connection to any particular modulus. Considering blocks N and $2I_q-N$ in $A^{\left(5\right),2}$ (Equation (45)), we can see two different situations taking into account the prime modulus $p=2$ or $p>2$:

• In the case of $p>2$, each N defined in (41) can be transformed to $I_q$ by the linear transformation steps such as additions of rows, multiplications by (−1) and $2^{-1}$ (which exists due to the fact that p is odd). Applying the same transformations to the adjacent block $2I_q-N$, we turn it into $-I_q^{*}$, where

  (46)
• In the case of $p=2$, each block-row of the appearance $\left(\begin{array}{cccc}\cdots & \left|N\right|& 2I_q-N|& \cdots \end{array}\right)$ in (45) contains q equal rows $\left(\begin{array}{cccc}\cdots & \left|1^q\right|& 1^q|& \cdots \end{array}\right)$.

According to the dichotomy above, we next consider two cases.

3.4.7. Case $p_1=2$, $p_2=q$, $p>2$

As described in the previous subsection, we start from matrix $A^{\left(6\right)}=\left(A^{\left(6\right),2};A^{\left(6\right),3}\right)$, where

Performing inside each block-row of $A^{\left(6\right),3}$ two operations: multiplication rows at indexes from 0 to $q-1$ by (−1), and circular permutation of rows, we transform $A^{\left(6\right),3}$ to the form

which is obviously spanned by rows of $A^{\left(6\right),2}$, and therefore $rank\left(M_{\equiv ,\not\equiv }\right)=rank\left(M_{\equiv }\right)$.

Theorem 9.

Assume $m=2q$, and $p,q$ are odd prime numbers. Then there is no share conversion from (2,3)-CNF over ${\mathbb{Z}}_{2q}$ to three-additive secret-sharing scheme over ${\mathbb{Z}}_p^{\beta }$ for any β.

Proof. 

The proof follows from Theorem 8 and the fact that $rank\left(M_{\equiv ,\not\equiv }\right)=rank\left(M_{\equiv }\right)$. □

3.4.8. Case $p_1=2$, $p_2=q$, $p=2$

Here, we start from matrix $A^{\left(6\right)}=\left(A^{\left(6\right),2};A^{\left(6\right),3}\right)$, where

Performing the same permutation of rows in each block-row in $A^{\left(6\right),3}$ as for the case $p>2$, we obtain block-rows in form $\left(\begin{array}{cccc}\cdots & \left|I_q\right|& I_q^{<<1}|& \cdots \end{array}\right)$, where $I_q^{<<k}$ according to our notation is the result of the left k-bit circular shift in $I_q$. We remark that $I_q^{<<k_1}{I}_q^{<<k_2}=I_q^{<<(k_1+k_2)modq}$. Subtracting the last block-row of $A^{\left(6\right),2}$ from the first block-row of $A^{\left(6\right),3}$, we obtain

$$A^{\left(7\right),3}\left[0\right]=\left(\begin{array}{cccccc}0|& I_q\oplus I_q^{<<1}& \left|I_q\right|& \cdots & \left|I_q\right|& I_q\oplus N\end{array}\right).$$

The matrix $I_q\oplus I_q^{<<1}$ is an invertible matrix, hence it is the linear transformation matrix. We subtract the row $(I_q\oplus I_q^{<<1})A^{\left(7\right),3}\left[1\right]$ from $A^{\left(7\right),3}\left[0\right]$ to obtain

$$A^{\left(7\right),3}\left[0\right]=\left(\begin{array}{cccccc}0& \left|0\right|& I_q\oplus (I_q\oplus I_q^{<<1})I_q^{<<1}& |\cdots & \left|I_q\right|& I_q\oplus N\end{array}\right).$$

We stress, that $I_q\oplus (I_q\oplus I_q^{<<1})I_q^{<<1}=I_q\oplus I_q^{<<1}\oplus I_q^{<<2}$. Then we similarly subtract the 3rd block-row multiplied by the 3rd element of the first block-row, then 4th, and so on. As a result, the first block-row takes the form:

$$A^{\left(7\right),3}\left[0\right]=\left(\begin{array}{cccccc}0|& 0|& 0|& \cdots & \left|0\right|& I_q\oplus N\oplus I_q^{<<1}\oplus I_q^{<<2}\oplus \cdots \oplus I_q^{<<(q-1)}\end{array}\right).$$

Taking into account that ${⨁}_{k=0}^{q-1}{I}_q^{<<k}=1^{q\times q}=N$, the first block-row of $A^{\left(7\right),3}\left[0\right]$ equals zero and can be crossed out of the matrix.

Now, we make some elimination steps to bring matrix $A^{\left(6\right),2}$ to the echelon form (such that all the rows there are basis rows). For this, we subtract all the rows with even ordinal numbers from the first row of the last block-row. The resulting last block-row in $A^{\left(6\right),2}$ turns to $\left(\begin{array}{ccccc}K|& K|& \cdots |& K|& K\oplus N\end{array}\right)$, where

(47)

In both blocks K and $K\oplus N$, the first row is spanned by others (as their sum), thus the first row of this block-row can be crossed out. The remaining rows in this block-row are basis vectors, which do not span $A^{\left(7\right),3}$, and thus, according to Lemma 2 can be thrown out the next consideration (together with the first row which also does not span $A^{\left(7\right),3}$). Then $A^{\left(7\right)}=\left(A^{\left(7\right),2};A^{\left(7\right),3}\right)$, where

Matrix $A^{\left(7\right),3}$ contains $(q-2)$ block-rows with q rows each. We make the last elimination step by subtracting each row of $A^{\left(7\right),2}$ from the first row of the correspondent block-row of $A^{\left(7\right),2}$. Then each block $I_q$ turns to K, and each $I_q^{<<1}$ turns to $K^{<<1}$, where the first row is the sum of others. Hence, each block-row in $A^{\left(7\right),3}$ loses the first row, and the rest of them are not spanned by the basis vectors of $A^{\left(7\right),2}$. Thereby, there are $(q-2)$ block-rows with $(q-1)$ rows each, and $rank\left(M_{\equiv ,\not\equiv }\right)-rank\left(M_{\equiv }\right)=(q-1)(q-2)$.

Theorem 10.

Assume $m=2q$, where q is an odd prime number. Then there exists a share conversion from (2,3)-CNF over ${\mathbb{Z}}_{2q}$ to a three-additive secret-sharing scheme over ${\mathbb{Z}}_2^{(q-1)(q-2)}$.

Proof. 

The proof follows from Theorem 8 and $rank\left(M_{\equiv ,\not\equiv }\right)-rank\left(M_{\equiv }\right)=(q-1)(q-2)$. □

4. Computer Search Results on the Set ${\mathit{S}}_{\mathit{m}}$ and the Extended Set ${\mathit{S}}_{\mathit{m}}^{\prime }$

Table 4 in the work of Beimel et al. [13] reports ranks of the matrices $M_{\equiv }$ and $M_{\equiv ,\not\equiv }$ for $m=6$, 10, 14, 15, 21, 35 and $p=2$, 5, 7, 11. Unfortunately, some of the data there go against the proven properties of those matrices. For instance, in [32] it was proven that there exists a share conversion in case $m=p_1·p_2$ and $p=p_1$, where $p_1$ and $p_2$ are distinct odd primes. At the same time, Table 4 in [13] shows that for the case $m=5·7$ it holds that $rank\left(M_{\equiv }\right)=rank\left(M_{\equiv ,\not\equiv }\right)$ over ${\mathbb{Z}}_7$, which means the absence of the conversion. Moreover, $rank\left(M_{\equiv }\right)$ cannot be less than $m^2$, since the matrix $M_{\equiv }$ has an identity block matrix of the size $m^2\times m^2$ in the upper left corner. However, for case $m=35$ in Table 4 in [13], this rank appears to be less. Therefore, we recalculated this table (also by computer search) in

Table 1. Rank of $M_{\equiv }$ and difference between ranks $M_{\equiv }$ and $M_{\equiv ,\not\equiv }$ ($rank\left(M_{\equiv }\right)$; $\beta$) for some even m over different ${\mathbb{Z}}_p$.

m	$2·3=6$	$2·5=10$	$2·7=14$	$2·11=22$	$2·13=26$
$S_m$	$\{1,3,4\}$	$\{1,5,6\}$	$\{1,7,8\}$	$\{1,11,12\}$	$\{1,13,14\}$
$p=2$	87 ; 2	247 ; 12	487 ; 30	1207 ; 90	1687 ; 132
$p=3$	89 ; 0	259 ; 0	517 ; 0	1297 ; 0	1819 ; 0
$p=5$	89 ; 0	259 ; 0	517 ; 0	1297 ; 0	1819 ; 0
$p=7$	89 ; 0	259 ; 0	517 ; 0	1297 ; 0	1819 ; 0

and

Table 2. Rank of $M_{\equiv }$ and difference between ranks $M_{\equiv }$ and $M_{\equiv ,\not\equiv }$ ($rank\left(M_{\equiv }\right)$; $\beta$) for some odd m over different ${\mathbb{Z}}_p$.

m	$3·5=15$	$3·7=21$	$3·11=33$	$5·7=35$
$S_m$	$\{1,6,10\}$	$\{1,7,15\}$	$\{1,12,22\}$	$\{1,15,21\}$
$p=2$	617 ; 0	1229 ; 0	3077 ; 0	3529 ; 0
$p=3$	593 ; 24	1169 ; 60	2897 ; 180	3529 ; 0
$p=5$	609 ; 8	1229 ; 0	3077 ; 0	3409 ; 120
$p=7$	617 ; 0	1217 ; 12	3077 ; 0	3457 ; 72

to correct the result of [13] as well as to check the soundness of our derivations.

The results in Table 1 confirm our conclusions. Indeed, for the case of $m=2q$ there is a conversion if and only if the modulus of the group is 2, and in this case $\beta =(q-1)(q-2)$. Table 2 is relevant to the result of [32]. For the case of odd $m=p_1·p_2$, there is a conversion if the modulus of the group p equals either $p_1$ or $p_2$.

In this paper, as well as in [32], only the case of the set $S_m$ of size 3 was considered. However, as we noted in the Introduction, the larger sets if the conversion for them exists, could result in MV families with higher VC dimension and hence in better PIR. For cases when the conversion exists in respect to the relation $C_{S_m}$, we also decided to check the extended sets $S_m^{\prime }$, trying different additional values from ${\mathbb{Z}}_m$ and checking the ranks of $M_{\equiv }$ and $M_{\equiv ,\not\equiv }$.

For even m, we only tested possible extensions for $S_m$ modulo 2 (because if there is no conversion for a set $S_m$, then there is no conversion for any extended set). Of all the cases in Table 1, only for $m=2·7$ there are extended sets $S_m^{\prime }=\{1,3,7,8\}$ and $\{1,5,7,8\}$ with $\beta >0$ (namely, $\beta =6$). The set $S_m^{\prime }=\{1,3,5,7,8\}$ provides $\beta =0$ and therefore the absence of the conversion.

Surprisingly, for odd m’s the result is more encouraging: for all m and p in Table 2 which provide $\beta >0$ for $S_m$, there were also extended sets $S_m^{\prime }$ with non-zero $\beta$. We summed them in

Table 3. Extensions for some sets $S_m$ allowing the share conversion.

p	3	3	3	5	5	7	7
m	$3·5=15$	$3·7=21$	$3·11=33$	$3·5=15$	$5·7=35$	$3·7=21$	$5·7=35$
$S_m^{\prime }\backslash S_m$	$\left\{11\right\}$	$\left\{8\right\}$	$\left\{23\right\}$	$\{4,7,13\}$	$\{8,22,29\}$	$\{4,10,13,16,19\}$	$\{6,11,16,26,31\}$
$rank\left(M_{\equiv }\right)$	607	1201	2989	627	3511	1257	3547
$\beta$	12	30	90	2	30	2	12

. In the row $S_m^{\prime }\backslash S_m$, there is a subset extending $S_m$ up to $S_m^{\prime }$. It is interesting that any number of entries added from $S_m^{\prime }\backslash S_m$ to $S_m$ gives the same $rank\left(M_{\equiv }\right)$ and $\beta$. It is also interesting that the set $S_m^{\prime }$ in all the checked cases with the odd m contains all the entries which are equal to 1 modulo $p_2$ (taking $p_1=p$) except from 1 and ${(0,1)}_{{\mathbb{Z}}_m}$ which are already in $S_m$. Namely, $S_m^{\prime }\backslash S_m=\left\{{(2,1)}_{{\mathbb{Z}}_m},...,{(p-1,1)}_{{\mathbb{Z}}_m}\right\}$.