Efﬁcient Secure Floating-point Arithmetic using Shamir Secret Sharing

Octavian Catrina

University Politehnica of Bucharest, Bucharest, Romania

Keywords:

Secure Multiparty Computation, Secure Floating-point Arithmetic, Secret Sharing.

Abstract:

Successful deployment of privacy preserving collaborative applications, like statistical analysis, benchmark-

ing, and optimizations, requires more efﬁcient secure computation with real numbers. We present a complete

family of protocols for secure ﬂoating-point arithmetic, constructed using a small set of building blocks that

preserve data privacy using well known primitives based on Shamir secret sharing and related cryptographic

techniques. Using new building blocks and optimizations and simpler secure ﬁxed-point arithmetic, we obtain

ﬂoating-point protocols with substantially improved efﬁciency.

1 INTRODUCTION

Secure computation enables groups of parties to run

collaborative applications without having to reveal

their private inputs: data privacy is preserved through-

out the computation by cryptographic protocols. Var-

ious applications that require secure arithmetic with

real numbers have been studied and implemented

(Aliasgari et al., 2017; Bogdanov et al., 2018; Kamm

and Willemson, 2015; Catrina and de Hoogh, 2010b).

However, the performance penalty caused by crypto-

graphic protocols remains an important deterrent for

the deployment of these applications and motivates

further research on improving current solutions (Dim-

itrov et al., 2016; Krips and Willemson, 2014).

Two frameworks based on secret sharing offer

comprehensive support for multiparty secure com-

putation with real numbers. The ﬁrst framework

(Catrina and de Hoogh, 2010a; Catrina and Saxena,

2010) provides a solid foundation for secure ﬁxed-

point computation, demonstrated by solving linear

programming problems with private data (Catrina and

de Hoogh, 2010b). Privacy is protected using well

known primitives based on Shamir secret sharing and

related techniques (Cramer et al., 2015; Cramer et al.,

2005). Follow-up work added protocols for secure

ﬂoating-point computation (Aliasgari et al., 2013) and

related applications (Aliasgari et al., 2017). The other

framework, Sharemind, was developed in parallel and

relies on additive secret sharing. Its protocols for

computing with real numbers have been gradually op-

timized (Krips and Willemson, 2014) and used in var-

ious applications (Bogdanov et al., 2018; Kamm and

Willemson, 2015). These frameworks offer similar

https://orcid.org/0000-0002-7498-9881

security and performance for passive adversary (ex-

tension to active adversary is still expensive).

An initial goal of our project was to extend the

ﬁrst framework with building blocks and optimiza-

tions that offer better support for secure computation

with real numbers. In this paper, we show how these

extensions are used to obtain important performance

gains for secure ﬂoating-point arithmetic.

The protocols provide the basic functionality and

accuracy expected by typical applications, for prac-

tical range and precision settings. We focus on im-

proving protocol performance and enabling trade-offs

between performance and precision based on appli-

cation requirements, rather than replicating the for-

mat and features speciﬁed in the IEEE Standard for

Floating-Point Arithmetic (IEEE 754). Also, we aim

at simplifying the protocols, by using a small set of

components and constructions. We selected solutions

that offer better trade-offs for the entire protocol fam-

ily, rather than optimizing particular tasks. The pa-

per is structured as follows. Section 2 is an overview

of the secure computation framework, data encod-

ing, and main building blocks. Section 3 presents

the new family of protocols for secure ﬂoating-point

arithmetic: addition and subtraction, multiplication,

division, square root, and comparison. We summa-

rize the main results in Section 4.

2 PRELIMINARIES

Secure Computation Model. The protocols pre-

sented in this paper use the secure computation frame-

work described in (Catrina and de Hoogh, 2010a),

which is based on standard primitives for secure com-

Catrina, O.

Efﬁcient Secure Floating-point Arithmetic using Shamir Secret Sharing.

DOI: 10.5220/0007834100490060

In Proceedings of the 16th International Joint Conference on e-Business and Telecommunications (ICETE 2019), pages 49-60

ISBN: 978-989-758-378-0

putation using secret sharing (Cramer et al., 2015)

and various optimizations presented in the literature

(Cramer et al., 2005; Damg

ard et al., 2006; Damg

ard

and Thorbek, 2007; Reistad and Toft, 2009). We start

with an overview of this framework.

Suppose that n > 2 parties, P

,...,P

, commu-

nicate on secure channels and want to perform a joint

computation where party P

has private input x

and

expects output y

. The parties use a linear secret-

sharing scheme to create a distributed state of the

computation where each party has a random share of

each secret variable. Then, they compute with these

shared variables to obtain the desired outputs, by run-

ning secure computation protocols.

Assuming perfectly secure channels and random

number generators, these protocols offer perfect or

statistical privacy: the views of protocol executions

(all values seen by an adversary) can be simulated

such that the distributions of real and simulated views

are perfectly or statistically indistinguishable, respec-

tively. Let X and Y be distributions with ﬁnite sample

spaces V and W . The statistical distance between X

and Y is ∆(X,Y ) =

∑

v∈V

|Pr(X = v) −Pr(Y =

v)|. The distributions are perfectly indistinguish-

able if ∆(X,Y ) = 0 and statistically indistinguish-

able if ∆(X,Y ) is negligible in some security parame-

ter. With real-life secure channels and pseudo-random

numbers, the protocols offer computational security.

The core primitives use Shamir secret sharing over

a ﬁnite ﬁeld F. These primitives provide secure arith-

metic in F with perfect privacy against a passive

threshold adversary able to corrupt t out of n par-

ties. In this model, the parties do not deviate from

the protocol and any t + 1 parties can reconstruct a

secret, while t or less parties cannot distinguish it

from random values in F. We assume |F| > n, to en-

able Shamir sharing, and n > 2t, for multiplication of

secret-shared values. Support for stronger adversary

models can be added using various techniques, albeit

with substantial performance degradation.

In this paper, we focus on protocols that use the

ﬁeld of integers modulo a prime q, denoted Z

. How-

ever, binary computations can be optimized by work-

ing in a small ﬁeld F

(Catrina and de Hoogh, 2010a;

Catrina and Saxena, 2010). The parties locally com-

pute addition/subtraction of shared ﬁeld elements by

adding/subtracting their own shares. Tasks that in-

volve multiplication of shared values require interac-

tion and are computed by dedicated protocols.

The protocols overcome the limitations of secure

arithmetic with shared ﬁeld elements, by combining

secret sharing with additive or multiplicative hiding:

for a shared variable JxK the parties jointly generate a

secret random value JrK, compute JyK = JxK + JrK or

Table 1: Complexity of core protocols (selection).

Protocol Rounds Int. Op.

JaK ← Share(a) 1 1

a ← Reveal(JaK) 1 1

JcK ← JaK + JbK 0 0

JcK ← a + JbK 0 0

JcK ← aJbK 0 0

JcK ← JaKJbK 1 1

JyK = JxK ·JrK and reveal y; this is similar to one-time

pad encryption of x with key r. For secret x ∈Z

and

random uniform r ∈Z

we obtain ∆(x +r mod q, r) =

0 and ∆(xr mod q,r) = 0, hence perfect privacy. For

x ∈ [0,2

−1], random uniform r ∈ [0, 2

k+κ

−1], and

q > 2

k+κ+1

we obtain ∆(x + r mod q,r) < 2

−κ

, hence

statistical privacy with security parameter κ. So-

lutions with statistical privacy substantially simplify

the protocols by avoiding wraparound modulo q, al-

though they require larger q for a given data range.

We evaluate the protocols using complexity met-

rics that focus on interaction between parties. Com-

munication complexity measures the amount of data

sent by each party. For our protocols, a suitable met-

ric is the number of invocations of 3 primitives dur-

ing which every party sends a share to the others: in-

put sharing, multiplication, and secret reconstruction.

Round complexity is the number of sequential invo-

cations and is relevant for network latency. Table 1

shows the complexity of the core primitives.

The protocols offer best performance for imple-

mentations that apply the following basic optimiza-

tions. Interactive operations that do not depend on

each other are executed in parallel, in a single round.

In particular, all shared random values can be precom-

puted in parallel. We use Pseudo-random Replicated

Secret Sharing (PRSS) (Cramer et al., 2005) and its

integer variant (RISS) (Damg

ard and Thorbek, 2007)

to generate without interaction shared random ﬁeld el-

ements and integers, and random sharings of 0. Some

shared random values cannot be generated without in-

teraction (e.g., random bits shared in Z

). We indicate

separately the communication complexity of the pre-

computation round.

Data Types and Data Encoding. We consider se-

cure computation with the following data types: bi-

nary values, signed integers, ﬁxed-point numbers, and

ﬂoating-point numbers. For secure computation, they

are encoded in a ﬁnite ﬁeld F. We distinguish differ-

ent representations of a number as follows: we denote

˜x a ﬁxed-point number, ¯x the integer value encoding

˜x, x the ﬁeld element that encodes ¯x, and JxK a sharing

of x; a ﬂoating-point number is denoted ˆx. The no-

SECRYPT 2019 - 16th International Conference on Security and Cryptography

tation x = (condition)? a : b means that x is assigned

the value a when condition = true and b otherwise.

Logical values f alse,true and bit values 0, 1 are

encoded as 0

and 1

, respectively. F can be either

or a small binary ﬁeld F

. This encoding allows

efﬁcient secure evaluation of Boolean functions using

secure arithmetic in F (Catrina and de Hoogh, 2010a).

We denote JaK ∧JbK = JaKJbK = Ja∧bK (AND) , JaK ∨

JbK = JaK + JbK −JaKJbK = Ja ∨bK (OR) and JaK ⊕

JbK = JaK + JbK −2JaKJbK = Ja ⊕bK (XOR).

Signed integer types are deﬁned as Z

hki

= {¯x ∈

Z | ¯x ∈ [−2

k−1

−1]}. They are encoded in Z

by the function ﬂd : Z

hki

7→ Z

, ﬂd( ¯x) = ¯x mod q, for

a prime q > 2

k+κ

, where κ is the security parameter

(similar to two’s complement encoding). This method

enables efﬁcient secure integer arithmetic using se-

cure arithmetic in Z

: for any ¯x

, ¯x

∈ Z

hki

and  ∈

{+,−, ·}, we have ¯x

 ¯x

= ﬂd

−1

(ﬂd( ¯x

) ﬂd( ¯x

));

also, if ¯x

| ¯x

then ¯x

/ ¯x

= ﬂd

−1

(ﬂd( ¯x

) ·ﬂd( ¯x

)

−1

Signed ﬁxed-point types are sets of rational num-

bers deﬁned as Q

hk, f i

= {˜x ∈ Q| ˜x = ¯x2

−f

, ¯x ∈ Z

hki

for f < k. They are obtained by sampling at 2

−f

in-

tervals the range of real numbers [−2

k−f −1

−

−f

]. The value 2

−f

is the resolution of the ﬁxed-

point type. Q

hk, f i

is mapped to Z

hki

by the function

int : Q

hk, f i

7→ Z

hki

, ¯x = int

( ˜x) = ˜x2

and encoded in

as described above. Secure multiplication and di-

vision of ﬁxed-point numbers require q > 2

2k+κ

Floating-point numbers ˆx ∈ Q

hl,gi

are tuples

h¯v, ¯p,s,zi, where ¯v ∈ [2

`−1

−1] ∪{0} is the un-

signed, normalized signiﬁcand, ¯p ∈ Z

hgi

is the signed

exponent, s = ( ˆx < 0)? 1 : 0, and z = ( ˆx = 0)? 1 : 0.

The value of the number is ˆx = (1−2s)· ¯v ·2

¯p

. If ˆx = 0

then z = 1, ¯v = 0, and ¯p = −2

g−1

. This encoding of

ˆx = 0 simpliﬁes secure addition with minimal nega-

tive effects on other operations. The integer signiﬁ-

cand and exponent are encoded as described above.

The parameters k, f , ` and g are not secret. The

protocols work for any setting of these parameters that

satisﬁes the type deﬁnitions. The applications usually

need k ∈[32,128], k = 2 f , ` ∈ [24,64] and g ∈[8,15],

depending on range and accuracy requirements.

The ﬂoating-point protocols are constructed using

a subset of the building blocks introduced in (Cat-

rina and de Hoogh, 2010a; Catrina and Saxena, 2010),

enhanced by optimizations added in (Catrina, 2018).

All building blocks rely on the secure computation

model described above for their own security and se-

cure composition. We summarize in the following

their functionality and the optimizations

. Table 2

lists their online and precomputation complexity.

Further details are available in the Appendix.

Multiplication and Inner Product. Standard mul-

tiplication of Shamir-shared ﬁeld elements requires an

interaction. However, this interaction can be avoided

in some cases. Denote JxK

u,i

the share of x owned by

, for a random polynomial of degree u; the default

value of the degree is t. The multiplication proto-

col computes JcK ← JaKJbK as follows (Cramer et al.,

2015): for all i ∈ [1, n], P

locally computes JaK

JbK

;

the result is JcK

2t,i

, a share of c for a non-random poly-

nomial of degree 2t (product of the polynomials used

to share a and b); then, P

shares the value JcK

2t,i

sending to the others JJcK

2t,i

, for j ∈ [1, n], j 6= i; ﬁ-

nally, P

computes its own share JcK

from the received

shares, by Lagrange interpolation.

A ﬁrst optimization applies to multiplications fol-

lowed by additive hiding: d ← Reveal(JaKJbK + JrK).

With standard protocols, this computation needs 2

rounds. We can avoid the ﬁrst round by locally ran-

domizing the share products: for all i ∈ [1,n], party i

computes JcK

2t,i

←JaK

JbK

+ J0K

2t,i

, where J0K

2t,i

are

pseudo-random shares of 0 generated with PRZS(2t)

(Cramer et al., 2005). We denote JaK ∗JbK this local

operation. The computation can now be completed

with a single interaction: d ← RevealD(JaK ∗JbK +

JrK), where RevealD is the secret reconstruction pro-

tocol for polynomials of degree 2t.

This situation occurs very often. In particular,

many of the protocols discussed below use additive

hiding of the input. We add variants of these protocols

for input shared with a random polynomial of degree

2t, and distinguish them by the sufﬁx ’D’. The differ-

ence is that they use RevealD instead of Reveal.

Another optimization is used to compute the in-

ner product of two vectors, JcK ←

∑

k=1

KJb

K, in

the protocol InnerProd: the parties locally compute

the inner product of their own shares and re-share the

result. Thus, InnerProd needs a single interaction (in-

stead of m interactions). If InnerProd is followed by

additive hiding of its output, we can also use the pre-

vious optimization. We call InnerProdD a variant that

locally computes JcK

2t,i

←

∑

k=1

+ J0K

2t,i

Multiplication and Division by 2

. The ﬂoating-

point arithmetic protocols are built using a small set

of related protocols that efﬁciently compute

b = ¯a ·2

and ¯c ≈ ¯a/2

, for secret ¯a,

b, ¯c ∈ Z

hki

and public or

secret integer m ∈[0,k −1].

If m is public we compute ¯a ·2

without interac-

tion. To compute ¯a/2

, we use the protocols Div2m

and Div2mP, introduced in (Catrina and de Hoogh,

2010a; Catrina and Saxena, 2010). Div2m rounds

to −∞ and Div2mP rounds probabilistically to the

nearest integer. We denote their outputs b¯a/2

and b¯a/2

e, respectively. Div2mP computes ¯c =

Efﬁcient Secure Floating-point Arithmetic using Shamir Secret Sharing

Table 2: Complexity of the main building blocks used in this paper, for inputs ¯a, ¯x ∈ Z

hki

Protocol Task Rounds Inter. op. Precomp.

Div2m(JaK,k,m) b¯a/2

c 3 m + 2 3m

Div2mP(JaK,k,m) b¯a/2

e 1 1 m

Div2(JaK,k) b¯a/2c 1 1 1

LTZ(JaK,k) ( ¯a < 0)? 1 : 0 3 k + 1 3k

EQZ(JaK,k) ( ¯a = 0)? 1 : 0 3 logk + 2 k + 3log k

SufOr({Ja

i=1

) {

j=i

}

i=1

2 2k −1 3k

SufMul({Ja

i=1

) {

∏

j=i

}

i=1

1 k 2k −1

PreDiv2m(JaK,k,m) {b¯a/2

i=1

3 2m + 1 4m

PreDiv2mP(JaK,k,m) {b¯a/2

i=1

1 1 m

Int2MaskG(JxK,k, m) {( ¯x = i)? 1 : 0}

k−1

i=0

5 k + m + 2 2k + 6m

b¯a/2

c+u, where u = 1 with probability p =

¯a mod 2

(e.g., if ¯a = 46 and m = 3 then ¯a/2

= 5.75; the out-

put is ¯c = 6 with probability p = 0.75 or ¯c = 5 with

probability 1 − p = 0.25). For both protocols, the

rounding error is |δ| < 1 and the output is exact if

divides ¯a. Div2mP is much more efﬁcient (Ta-

ble 2) and its output is likely more accurate. Div2

is a more efﬁcient solution for b¯a/2c. Finally, the

comparison protocol LTZ uses Div2m to compute

s = ( ¯a < 0)? 1 : 0 = −b¯a/2

k−1

If m is secret we have to extend the collection of

building blocks in (Catrina and de Hoogh, 2010a).

The goal is to use the following constructions. We

start by computing the secret bits {x

}

k−1

i=0

, x

= (m =

i)? 1 : 0. This allows us to locally compute 2

∑

k−1

i=0

and then ¯a ·2

. Moreover, we can use a sim-

ilar method for ¯a/2

: compute the secret integers

{b¯a/2

k−1

i=0

and the inner product ¯a/2

∑

k−1

i=0

The protocol PreDiv2m, suggested in (Catrina,

2018), is a generalization of Div2m that efﬁciently

computes {b¯a/2

i=1

with secret inputs and outputs.

Surprisingly, it performs a much more complex task

than Div2m in the same number of rounds, with a

modest increase of the communication complexity

(Table 2). PreDiv2mP is a generalization of Div2mP

that computes {b¯a/2

i=1

with probabilistic round-

ing to nearest, with the same complexity as Div2mP.

Protocol 1, Int2MaskG, is a generic construction

for computing {x

}

k−1

i=0

, x

= ( ¯x = i)? 1 : 0, using La-

grange polynomial interpolation in Z

, q > k, adapted

to our tasks. Given a secret ¯x ∈ [0,2

m−1

−1] and pub-

lic k ≤ 2

m−1

, it returns the secret bits {x

}

k−1

i=0

such

that x

= 1 if ¯x < k and i = ¯x, otherwise x

= 0.

Steps 1-2 map ¯x to ¯x

= ( ¯x < k)? ¯x : k, ¯x

∈ [0,k].

Let α = ¯x

+ 1. We compute {x

}

k−1

i=0

by evaluating

the functions f

: [1, k + 1] → {0,1}, f

(α) = (α =

i + 1)? 1 : 0, for i ∈ [0,k −1], using their interpolation

polynomials f

(α) =

∑

j=0

i, j

. The coefﬁcients a

i, j

are pre-computed from public information (the points

that deﬁne {f

}

k−1

i=0

). Steps 3-4 compute {α

}

i=1

using

PreMul and then x

= f

(α), for i ∈ [0,k −1] (we set

α = ¯x

+ 1 because PreMul requires non-zero inputs).

The online complexity is 5 rounds and k + m + 2 in-

teractive operations.

P 1: Int2MaskG(JxK,k,m).

JdK ← LTZ(JxK −k,m + 1);1

K ← JdKJxK+ (1 −JdK)k;2

{Jy

j=1

← PreMul({Jx

K + 1}

i=1

);

foreach i ∈ [0,k −1] do4

K ← a

i,0

∑

j=1

i, j

return {Jx

k−1

i=0

3 SECURE FLOATING-POINT

ARITHMETIC

We present a family of ﬂoating-point arithmetic pro-

tocols for addition, subtraction, multiplication, divi-

sion, square root, and comparison. We focus on so-

lutions that offer the best tradeoffs for the entire fam-

ily and a broader range of applications. All protocols

are constructed using the techniques discussed in Sec-

tion 2, that support secure protocol composition. The

same security arguments apply to the entire family, so

we do not repeat them for each protocol.

Converting Fixed-point Numbers to Floating-

point Numbers. Given a ﬁxed-point number ˜a ∈

hk, f i

, Protocol 2, FX2FL, computes h¯v, ¯p,s, zi so that

ˆa = (1 −2s)¯v2

¯p

∈Q

h`,gi

, ˆa ≈ ˜a and z = ( ˆa = 0)? 1 : 0,

with secret input and output. In particular, for f = 0,

the input is an integer ¯a ∈ Z

hki

and the output is

ˆa ∈ Q

h`,gi

so that ˆa ≈ ¯a. FX2FL is also used for nor-

malizing the output of ﬂoating-point arithmetic proto-

cols.

SECRYPT 2019 - 16th International Conference on Security and Cryptography

The computation can be summarized as follows.

Let ¯a = ˜a2

. Recall that ¯a ∈ [−(2

k−1

−1),2

k−1

−1]

and ¯v ∈ [2

`−1

−1] ∪{0}. If ¯a = 0 we set ¯v = 0

and ¯p = −2

g−1

. Otherwise, |¯a| ∈ [2

m−1

−1] for

some secret m ∈ [1,k −1] and we have to compute

¯v = |¯a|2

`−m

and ¯p = −f −` + m. When k −1 > ` we

have 2 cases: if m ≤ ` then ¯v = |¯a|2

`−m

; if m > ` then

¯v = b|¯a|/2

−`+m

c. If k −1 ≤ ` then m ≤ ` and hence

¯v = |¯a|2

`−m

. Therefore, if m ≤ ` the output is ˆa = ˜a,

otherwise ˆa ≈ ˜a, with relative error ε < 2

−`

, due to

the truncation of ¯a.

Steps 1-6 compute s = ( ¯a < 0)? 1 : 0 and z =

( ¯a = 0)? 1 : 0, together with data used in steps 6-

10 for computing ¯v and ¯p: {

}

k−2

i=0

= {b|¯a|/2

k−2

i=0

}

k−2

i=0

, the binary encoding of |¯a|, and {c

}

k−2

i=0

{

k−2

j=i

}

k−2

i=0

. Note that

= ¯a(1 −2s) = |¯a| and

k−2

j=0

= 1 −z. By using PreDiv2mD instead

of PreDiv2m, the multiplication JaK(1−2JsK) is com-

puted without interaction, saving one round.

P 2: FX2FL(JaK,k, f ,`, g).

JsK ← LTZ(JaK,k); Js

K ← 1 −2JsK;1

{Jb

k−2

i=0

← PreDiv2mD(JaK ∗Js

K,k, k −2);2

k−2

K ← Jb

k−2

K;3

foreach i ∈ [0,k −3] do Ja

K ← Jb

K −2Jb

i+1

K;4

{Jc

k−2

i=0

← SufOr({Ja

k−2

i=0

);5

JzK ← 1 −Jc

K;6

foreach i ∈ [0,k −3] do Jd

K ← Jc

K −Jc

i+1

K;7

k−2

K ← Jc

k−2

K;8

if k −1 > ` then JvK ← Jb

∑

`−1

i=0

`−i−1

K+9

∑

k−`−2

i=0

`+i

KJb

i+1

else JvK ← 2

`−k+1

∑

k−2

i=0

k−i−2

K;10

JpK ← (−f −`)(1 −JzK) +

∑

k−2

i=0

K −JzK2

g−1

;11

return (JvK,JpK,JsK,JzK);12

Steps 7-10 compute ¯v. We start by computing d

(i = m −1)? 1 : 0, for i ∈ [0,k −2]. If k −1 > ` we

have to compute ¯v

= |¯a|2

`−m

, if m ∈ [1, `], and ¯v

b|¯a|/2

−`+m

c, if m ∈[`+1, k −1]. At least one of these

values is 0, so step 9 obliviously handles both cases

by computing ¯v

∑

`−1

i=0

`−i−1

= |¯a|2

`−m

, ¯v

∑

k−`−2

i=0

`+i

i+1

m−`

= b|¯a|/2

−`+m

c and ¯v = ¯v

¯v

. If k ≤ ` + 1 then m ≤` and ¯v = |¯a|2

`−m

. This case

is computed in step 10: ¯v = 2

`−k+1

∑

k−2

i=0

k−i−2

`−k+1

|¯a|2

k−m−1

= |¯a|2

`−m

Step 11 computes ¯p. If ¯a 6= 0 then

∑

k−2

i=0

= m,

since c

= 1 for i ∈[0,m −1] and c

= 0 for i ∈[m,k −

2]; otherwise,

∑

k−2

i=0

= 0. Therefore, if ¯a 6= 0 then

z = 0 and ¯p = −f −` + m, otherwise z = 1 and ¯p =

−2

g−1

, as required.

The online complexity is 9 rounds and 5k + 3 in-

teractive operations. If the sign is not secret, we can

skip step 1 and the complexity becomes 6 rounds

and 4k + 2 operations. FX2FL is simpler and more

efﬁcient than the protocol given in (Aliasgari et al.,

2013), which needs log k + 12 rounds and more than

(logk + 3)k operations. The improvement is due to

more efﬁcient solutions enabled by PreDiv2m for

computing the secret index m and the multiplication

and division by secret 2

|l−m|

We also need FX2FLE, a general tool for normal-

izing the output of ﬂoating-point arithmetic protocols.

FX2FLE is a variant of FX2FL that takes a secret in-

teger ¯x as additional input and returns h¯v, ¯p, s, zi so

that ˆa = (1 −2s) ¯v2

¯p

∈ Q

h`,gi

and ˆa ≈ 2

¯x

˜a. The differ-

ence is that step 11 computes JpK ←(JxK +JmK − f −

`)(1−JzK)−JzK2

g−1

, in parallel with the computation

of ¯v (the round complexity is the same).

Floating-point Addition and Subtraction. Proto-

col 3, AddFL, computes ˆa = ˆa

+ ˆa

, for secret

ˆa

, ˆa

, ˆa ∈ Q

h`,gi

, ˆa

= (1 − 2s

) ¯v

¯p

, ˆa

= (1 −

) ¯v

¯p

, and ˆa = (1−2s) ¯v2

¯p

. AddFL can also com-

pute ˆa = ˆa

− ˆa

by setting s

= 1 −s

The basic idea is to align the inputs’ radix point,

add the signiﬁcands and normalize the result using

FX2FLE. To simplify the notation, suppose ˆa

≥ 0,

ˆa

≥ 0, and ¯p

≥ ¯p

. We want ¯v and ¯p so that

¯v2

¯p

≈ ¯v

¯p

+ ¯v

¯p

. We can align to the larger ex-

ponent, by setting ¯p = ¯p

and ¯v = ¯v

+ b¯v

¯p

− ¯p

or to the smaller exponent, by setting ¯p = ¯p

and ¯v =

¯v

¯p

− ¯p

+ ¯v

. Which method is better? Multiplica-

tion by secret 2

¯p

− ¯p

is simpler than division, but here

it is inefﬁcient, since the result can be huge. One so-

lution is to combine the methods: use the ﬁrst method

when ¯p

− ¯p

≥ `, because b¯v

¯p

− ¯p

c = 0; other-

wise, use the second method, because ¯v

¯p

− ¯p

< 2

AddFL uses the ﬁrst method, which can be imple-

mented more efﬁciently with the new building blocks.

Steps 1-3 swap the inputs if ¯p

< ¯p

: ( ¯v

, ¯p

) =

( ¯p

< ¯p

)? ((1 − 2s

) ¯v

, ¯p

) : ((1 −2s

) ¯v

, ¯p

) and

( ¯v

, ¯p

) = ( ¯p

< ¯p

)? ((1 − 2s

) ¯v

, ¯p

) : ((1 −

) ¯v

, ¯p

). Swap computes (c = 1)? (y,x) : (x, y)

with secret inputs and outputs. Since we encode ˆa = 0

as ¯v = 0 and ¯p = −2

g−1

(smallest value), null operands

are not special cases: if ˆa

= 0 then ¯p

≥ ¯p

and

¯v

= 0, so the protocol sets ¯p = ¯p

and ¯v = ¯v

; if

ˆa

= 0, ¯p

< ¯p

and the operands are swapped.

Let ∆ = ¯p

− ¯p

≥0. Steps 4-6 compute {x

}

`−1

i=0

{(∆ = i)? 1 : 0}

`−1

i=0

and {

}

`−1

i=0

= {b¯v

`−1

i=0

(in

parallel), then step 7 computes ¯v

= ¯v

∑

`−1

i=0

¯v

+ b¯v

∆

e. Step 8 normalizes the result. If s

6= s

and ∆ = 1, |¯v

− ¯v

/2| can be close to the rounding

error, compromising the accuracy. This is avoided by

setting ¯v

= 2 ¯v

, ¯v

= 2 ¯v

, so that the division is exact,

Efﬁcient Secure Floating-point Arithmetic using Shamir Secret Sharing

and invoking FX2FLE with k = `+ 3 and ¯p

= ¯p

−1.

P 3: AddFL({Jv

K,Jp

K,Js

i=1

JcK ← LTZ(Jp

K −Jp

K,g + 1);1

K ← Jv

K(1 −2Js

K); Jv

K ← Jv

K(1 −2Js

K);2

{Jv

K,Jp

i=1

← Swap(Jc

K,{Jv

K,Jp

i=1

);3

{Jx

`−1

i=0

← Int2MaskG(Jp

K −Jp

K,`, g + 1);4

K ← Jv

K;5

{Jd

`−1

i=1

← PreDiv2mP(Jv

K,` + 1,` −1);6

K ← Jv

K +

∑

`−1

i=0

KJd

K;7

(JvK,JpK,JsK,JzK) ←8

FX2FLE(Jv

K,Jp

K,` + 2,0,`,g);

return (JvK,JpK,JsK,JzK);9

The online complexity AddFL is 19 rounds and

6`+2g +26 interactive operations. For operands with

the same, known sign the complexity is 16 rounds and

5` + 2g + 10 operations (due to simpler normaliza-

tion). With minor changes, AddFL also works when

one operand is public, with roughly the same com-

plexity. The protocol proposed in (Aliasgari et al.,

2013) needs log ` + 30 rounds and more than (log ` +

14)` + 9g operations. The improvement is due to

more efﬁcient building blocks and the simpler algo-

rithm enabled by PreDiv2mP and Int2MaskG.

Floating-point multiplication. Protocol 4, MulFL,

computes ˆa ≈ ˆa

ˆa

, for secret ˆa

, ˆa

, ˆa ∈ Q

h`,gi

, ˆa

(1 −2s

) ¯v

¯p

, ˆa

= (1 −2s

) ¯v

¯p

, ˆa = (1 −2s) ¯v2

¯p

The protocol computes ¯v

= ¯v

¯v

and ¯p

= ¯p

+ ¯p

and normalizes the result. Since ¯v

∈ [2

2`−2

−

`+1

+ 1] ∪{0}, normalization is easy: if ¯v

< 2

2`−1

then ¯v = b¯v

`−1

c and ¯p = ¯p

+ ` − 1, otherwise

¯v = b¯v

c and ¯p = ¯p

+`. Also, we efﬁciently com-

pute s = s

⊕s

, z = z

∨z

, and ¯p = ¯p(1−z)−z2

g−1

We can reduce the communication complexity by

modifying the algorithm as follows: compute ¯v

b¯v

¯v

`−1

c ∈ [2

`−1

`+1

−2

] ∪{0} and ¯p

= ¯p

¯p

+`−1; if ¯v

< 2

then set ¯v = ¯v

and ¯p = ¯p

; other-

wise, set ¯v = b¯v

/2cand ¯p = ¯p

+1. A similar method

is used in (Aliasgari et al., 2013). Our protocol is an

optimized variant.

Steps 1-3 compute h¯v

, ¯p

,s,zi as explained above

and step 4 normalizes the result using Protocol 5,

NormFLS. We use fast truncation with Div2mP, be-

cause ¯v

is in the range [2

`−1

`+1

−1]∪{0} required

for simple normalization regardless of the rounding

method (actually, we use Div2mPD, so that the mul-

tiplication Jv

KJv

K is computed without interaction).

NormFLS normalizes ¯v ∈ [2

`−1

`+1

− 1] ∪{0}

using the algorithm described above: it computes (in

parallel) b = ( ¯v < 2

)? 1 : 0 and ¯v

= b¯v/2c, then

¯v

= (b = 1)? ¯v : ¯v

and ¯p

= (b = 1)? ¯p(1 −z) :

( ¯p + 1)(1 −z), ¯p

= ¯p

−z2

g−1

The online complexity of MulFL is 5 rounds and

` + 9 interactive operations (instead of 11 rounds and

8`+10 operations reported in (Aliasgari et al., 2013)).

MulFL also works when one of the operands is public,

with minor changes and slightly lower complexity.

P 4: MulFL({Jv

K,Jp

K,Js

K,Jz

i=1

K ← Div2mPD(Jv

K ∗Jv

K,2`,` −1);1

JsK ← Js

K ⊕Js

K; JzK ← Jz

K ∨Jz

K;2

K ← Jp

K + Jp

K + ` −1;3

(JvK,JpK) ← NormFLS(Jv

K,Jp

K,JzK,` + 1,g);4

return (JvK,JpK,JsK,JzK);5

P 5: NormFLS(JvK,JpK,JzK, `, g).

JbK ← LTZ(JvK −2

,` + 1);1

K ← Div2(JvK,` + 1);2

K ← JbKJvK + (1 −JbK)Jv

K;3

K ← (JpK + 1 −JbK)(1 −JzK) −JzK2

g−1

return (Jv

K,Jp

K);5

Floating-point Division. Protocol 6, DivFL, com-

putes ˆa ≈ ˆa

/ ˆa

, for secret ˆa

, ˆa

, ˆa ∈ Q

h`,gi

, ˆa

(1 −2s

) ¯v

¯p

, ˆa

= (1 −2s

) ¯v

¯p

, ˆa

6= 0, and ˆa =

(1 −2s)¯v2

¯p

. DivFL divides the signiﬁcands using se-

cure ﬁxed-point arithmetic and normalizes the result.

Let ˜v

= ¯v

−`

, ˜v

= ¯v

−`

and ˜v

= ˜v

/ ˜v

. Observe

that ˜v

, ˜v

∈ [0.5,1) ∪{0}, ˜v

6= 0 and ˜v

∈ (0.5,2) ∪

{0}. Step 1 computes ˜v

using Protocol 7, DivGS, and

steps 2-3 compute ¯p

= ¯p

− ¯p

−` and s = s

⊕s

(z = z

). DivGS returns ¯v

∈[2

`−1

`+1

−1]∪{0} and

¯v

= ˜v

, so we can use NormFLS for normalization.

The protocol DivGS is based on a variant of Gold-

schmidt’s division algorithm (Markstein, 2004). Let

a,b ∈ R, b 6= 0. The algorithm starts with an initial

approximation w

≈ 1/b, with relative error ε

< 1,

and computes a/b iteratively, as follows: c

= aw

= ε

= 1 −bw

; for i > 0 do c

= c

i−1

(1 + d

i−1

= d

i−1

. After i iterations it obtains c

≈ a/b with

relative error ε

. If b ∈ [0.5, 1), we can start with

= 2.9142 − 2b, a linear approximation of 1/b

with relative error ε

< 0.08578 (Ercegovac and Lang,

2003). It provides about 3.5 exact bits, so for `-bit in-

puts the algorithm needs θ = dlog

3.5

e iterations.

DivGS uses this algorithm to compute ˜v

≈ ˜v

/ ˜v

with absolute error δ < 2

−`

, for ˜v

, ˜v

∈[0.5,1) ∪{0},

˜v

6= 0, and ˜v

∈ [0.5, 2) ∪{0}. The inputs and the

output are ﬁxed-point numbers with resolution 2

−`

encoded as ¯v

, ¯v

∈ [2

`−1

−1] ∪{0}, ¯v

6= 0, and

¯v

∈[2

`−1

`+1

−1]∪{0}. Fixed-point multiplication

with resolution 2

−`

is computed as double-precision

integer multiplication followed by truncation that cuts

SECRYPT 2019 - 16th International Conference on Security and Cryptography

off the least signiﬁcant ` bits. The rounding error due

to truncation is δ

< 2

−`

P 6: DivFL({Jv

K,Jp

K,Js

K,Jz

i=1

K ← DivGS(Jv

K,Jv

K,`);1

JsK ← Js

K ⊕Js

K;2

K ← Jp

K −Jp

K −`;3

(JvK,JpK) ← NormFLS(Jv

K,Jp

K,Jz

K,`, g);4

return (JvK,JpK,JsK,Jz

K);5

P 7: DivGS(Jv

K,Jv

K,`).

θ ← dlog

3.5

e; m = 4; k ← ` + m;

K ← 2

K; Jv

K ← 2

K;2

JwK ← ﬂd(int

(2.9142)) −2Jv

K;3

JcK ← Div2mPD(Jv

K ∗JwK, 2k + 1,k);4

JdK ← Div2mPD(Jv

K ∗JwK, 2k + 1,k);5

JdK ← ﬂd(int

(1.0)) −JdK;6

foreach i ∈ [1,θ −1] do7

JcK ← JcK + Div2mPD(JcK ∗JdK, 2k + 1, k);8

K ← Div2mPD(JdK∗JdK,2k + 1,k);9

JdK ← Jd

K ← JcK + Div2mPD(JcK ∗JdK, 2k + 1, k + m);10

return Jv

K;11

We prefer this algorithm to other variants (e.g.,

Newton-Raphson) because the two multiplications of

an iteration can be computed in parallel. On the

other hand, its iterations are not self-correcting, so

rounding errors accumulate, reducing the accuracy

of the result. Moreover, if the error before the last

truncation is |δ| ≥ 2

−`

, ¯v

may be outside the range

`−1

`+1

−1] ∪{0} required by fast normalization

with NormFLS. For instance, if ¯v

= 2

`−1

and ¯v

−1 the output can be ¯v

< 2

`−1

( ˜v

= 0.5, ˜v

≈ 1,

˜v

≈0.5); also, if ¯v

= 2

−1 and ¯v

= 2

`−1

, the output

can be ¯v

> 2

`+1

−1 ( ˜v

≈ 1, ˜v

= 0.5, ˜v

≈ 2).

Let ∆ be the accumulated error before the last

truncation and suppose ∆ < γ ·2

−`

for variables with

`-bit fractional part. The error can be reduced by

terminating the algorithm with a modiﬁed Newton-

Raphson iteration (Markstein, 2004); this requires ad-

ditional rounds. DivGS reduces the error to ∆ < 2

−`

by increasing the fractional part to ` + m bits, with

m = dlogγe. For our initial approximation, error anal-

ysis shows that we need m = 3 for ` ∈ [8,14] (θ = 2)

and m = 4 for ` ∈[15, 112] (θ ∈[3, 5]). For simplicity,

we set m = 4 in the pseudocode

DivGS computes Goldschmidt’s iterations for se-

cret inputs and outputs. Steps 1-3 initialize the algo-

rithm: compute θ, m, and k = `+m; set ¯v

= ¯v

and

¯v

= ¯v

to obtain ﬁxed-point numbers with frac-

The error bound is computed starting from c

= c

(1 +

)(1 + d

). .. (1 + d

θ−1

) and assuming δ

= 2

−`

for every

multiplication, including c

= aw

and d

= 1 −bw

tional part of ` + m bits; compute ¯w =

β −2 ¯v

, the

initial approximation of 1/ ˜v

. Steps 4-6 compute in

parallel the initial values for the iteration variables:

¯c = ¯v

¯w/2

and

d = (1 − ¯v

) ¯w/2

. Steps 7-10 are the

θ iterations of the algorithm. An iteration computes in

parallel ¯c = ¯c + b( ¯c

d)/2

e and

←b

e and then

sets

d =

. The result is in the interval required for

fast normalization regardless of the rounding method

of the last truncation, so we can use Div2mP.

The online complexity of DivFL is 5 + θ rounds

and ` + 2θ + 7 interactive operations (e.g., 9 rounds

and ` + 16 operations for ` ∈ [29,56]). DivFL is more

accurate and more efﬁcient than the protocol given

in (Aliasgari et al., 2013), which does not address

the critical accuracy issues discussed above and needs

2log` + 7 rounds and 2(` + 2)log ` + 3` + 8 opera-

tions. The complexity improvement is due to better

initial approximation (less iterations) and more efﬁ-

cient secure ﬁxed-point arithmetic.

An alternative approach to ﬂoating-point division

with secret inputs and output, suggested in related

work, is to ﬁrst compute the reciprocal ˆa

= 1/ ˆa

and then ˆa

= ˆa

· ˆa

. However, DivFL has the same

complexity as a protocol that computes 1/ ˆa

and

avoids the additional secure ﬂoating-point multiplica-

tion. Also, with minor changes, DivFL can compute

ˆa

= ˆa

/ ˆa

for public ˆa

and secret ˆa

and ˆa

, with

slightly lower complexity. Finally, for public ˆa

and

secret ˆa

and ˆa

, division consists of secure multipli-

cation between ˆa

and public 1/ ˆa

Square Root. Protocol 8, SqrtFL, computes ˆa ≈

|ˆa

|, for secret ˆa

, ˆa ∈ Q

h`,gi

, |ˆa

| = ¯v

¯p

and ˆa =

¯v2

¯p

. SqrtFL is similar to DivFL and surprisingly ef-

ﬁcient. The computation is based on the following

remark. Let ˜v

= ¯v

−`

∈ [0.5, 1) ∪{0}, encoded as

˜v

∈ Q

h`,`i

. Also, let ¯p

= ¯p

+ `, u = ¯p

mod 2, and

¯p

= b ¯p

/2c. Observe that

|ˆa

| =

˜v

¯p

, so

if u = 0 then

|ˆa

| =

√

˜v

¯p

, otherwise

|ˆa

| =

√

2 ˜v

¯p

√

˜v

¯p

SqrtFL computes

√

˜v

using Protocol 9, SqrtGS,

based on Goldschmidt’s square root algorithm (Mark-

stein, 2004). Let a ∈ R, a > 0, and w

≈

√

such that

∈ [

]. The algorithm computes both

√

a and

√

iteratively, as follows: b

= aw

, c

= w

/2; for

i > 0 do d

i−1

= 0.5 −b

i−1

, b

= b

i−1

(1 + d

i−1

= c

i−1

(1 + d

i−1

). After i iterations it obtains b

≈

√

a and c

≈

√

with relative error ε

. If a ∈[0.5, 1),

we can take w

= 1.7877−0.81a, a linear approxima-

tion of

√

with relative error ε

< 0.0223. Since w

provides almost 5.5 exact bits, the algorithm needs

θ = dlog

5.5

e iterations for an `-bit input.

Efﬁcient Secure Floating-point Arithmetic using Shamir Secret Sharing

SqrtGS computes

b ≈

√

˜v for ˜v ∈[0.5, 1)∪{0}and

b ∈ [

√

,1) ∪{0} using secure ﬁxed-point arithmetic.

Rounding errors are handled like in DivGS, by ex-

tending the fractional part to k = ` +m bits. Steps 2-3

compute ˜w = 1.7877 −0.81 ˜v, the linear approxima-

tion of

√

˜v

. Steps 4-5 compute (in parallel) the initial

values of the variables,

b = b¯v ¯w/2

e and ¯c = b¯v/2c.

The steps 6-11 are the θ iterations of the algorithm.

An iteration computes

d = int

(0.5) −b

b ¯c/2

e and

then

b =

b + b

d/2

e and ¯c = ¯c + b¯c

d/2

e (steps 8-

9 in parallel). The output preserves the higher preci-

sion, so that SqrtFL can accurately compute

√

˜v.

P 8: SqrtFL(Jv

K,Jp

K,Jz

K).

m = 4; k ← ` + m;1

K ← SqrtGS(2

K,`, k);2

K ← Div2mP(ﬂd(int

(

√

2/2))Jv

K,2k, k + m);3

K ← Div2mP(Jv

K,k + m,m);4

K ← Jp

K + `; Jp

K ← Div2(Jp

K,g + 1);5

JuK ← Jp

K −2Jp

K;6

JvK ← (1 −JuK)Jv

K + JuKJv

K;7

JpK ← (Jp

K −` + JuK)(1 −Jz

K) −2

g−1

K;8

return (JvK,JpK,Jz

K);9

P 9: SqrtGS(JvK,`,k).

θ ← dlog

5.5

e; α ← ﬂd(int

(0.5));

JwK ← Div2mP(ﬂd(int

(0.81))JvK,2k,k);2

JwK ← ﬂd(int

(1.7877)) −JwK;3

JbK ← Div2mPD(JvK ∗JwK,2k + 1,k );4

JcK ← Div2(JwK,k + 1);5

foreach i ∈ [1,θ −1] do6

JdK ← α −Div2mPD(JbK ∗JcK,2k + 1,k);7

JbK ← JbK + Div2mPD(JbK ∗JdK, 2k + 1, k);8

JcK ← JcK + Div2mPD(JcK ∗JdK, 2k + 1, k);9

JdK ← α −Div2mPD(JbK ∗JcK,2k + 1,k);10

JbK ← JbK + Div2mPD(JbK ∗JdK, 2k + 1, k);11

return JbK;12

SqrtFL computes the square root of |ˆa

| as fol-

lows. Let ˜v

≈

√

˜v

∈ [

√

,1) ∪{0} and ˜v

≈

√

˜v

∈

[0.5,

√

) ∪{0}, encoded as ˜v

, ˜v

∈ Q

hk,ki

. Steps 2-4

compute ¯v

and ¯v

using SqrtGS, and steps 5-6 com-

pute ¯p

, ¯p

, and u. If u = 0 then

|ˆa

| = ˜v

¯p

so we set ¯v = b¯v

e and ¯p = ¯p

−`. Otherwise,

|ˆa

|= ˜v

¯p

; we compute ¯µ = int

(

√

) and ¯v

(¯µ ¯v

)/2

and set ¯v = b¯v

e and ¯p = ¯p

−` + 1.

The two cases are obliviously computed in steps 7-

8: ¯v = (1 −u) ¯v

+ u ¯v

and ¯p = ¯p

−` + u. The result

is already normalized.

The online complexity of SqrtFL is 4 + 2θ rounds

and, surprisingly, only 3θ + 7 interactive operations

(e.g., θ = 3 for ` ∈ [24,45]). SqrtFL is much more ef-

ﬁcient than the protocol suggested in (Aliasgari et al.,

2013), that computes Goldschmidt’s iterations using

ﬂoating-point protocols.

Floating-point comparison. Protocol 10, LTFL,

computes c = ( ˆa

< ˆa

)? 1 : 0 for ˆa

, ˆa

∈ Q

h`,gi

ˆa

= (1−s

) ¯v

¯p

and ˆa

= (1−s

) ¯v

¯p

, with secret

inputs and output. The protocol is based on the fol-

lowing idea. Let ¯v

= (1 −s

) ¯v

, ¯v

= (1 −s

) ¯v

and

d = ˆa

− ˆa

= 2

¯p

( ¯v

¯p

− ¯p

− ¯v

). We want to com-

pute c = (

d < 0)? 1 : 0. Also, let z

= ( ¯p

= ¯p

)? 1 : 0,

−

= ( ¯p

< ¯p

)? 1 : 0, c

= ( ¯p

> ¯p

)? 1 : 0 and

−

= ( ¯v

< ¯v

)? 1 : 0. Observe that

d < 0 if and

only if one of the following mutually exclusive con-

ditions holds: ¯p

= ¯p

and ¯v

< ¯v

; ¯p

< ¯p

and

= 0; ¯p

> ¯p

and s

= 1. Therefore, the output

is c = z

−

+ c

−

(1 −s

) + c

(inner product).

We could compute c

−

and z

, using the protocols

LTZ and EQZ (Catrina and de Hoogh, 2010a), and

then c

= (1 − c

−

)(1 −z

). Instead, we introduce

Protocol 11, CmpZ, that computes more efﬁciently

the triple comparison. Thus, we obtain a simpler and

more efﬁcient solution for LTFL: steps 1-2 compute

−

using LTZD, step 3 computes c

−

, c

and z

using

CmpZ, and step 4 computes the output.

P 10: LTFL({Jv

K,Jp

K,Js

i=1

JdK

← (1 −2Js

K) ∗Jv

K −(1 −2Js

K) ∗Jv

K;1

−

K ← LTZD(JdK

,` + 1);2

−

K,Jc

K,Jz

K ← CmpZ(Jp

K −Jp

K,g + 1);

JcK ← Jz

KJc

−

K + Jc

−

K(1 −Js

K) + Jc

KJs

return JcK;5

P 11: CmpZ(JaK,k).

(Jr

K,Jr

K,{Jr

k−1

i=1

) ← PRandM(k,k −1);1

b ← Reveal(2

k−1

+ JaK + 2

k−1

K + Jr

K);2

← b mod 2

k−1

(Ju

K,Ju

K) ← BitCmp(b

,{Jr

k−1

i=1

);4

K ← −((JaK −(b

−Jr

K))2

−(k−1)

−Ju

K);5

K ← (1 −Jc

K)(1 −Ju

K);6

K ← (1 −Jc

K)Ju

K;7

return (Jc

K,Jc

K);8

Given a secret integer ¯a ∈ Z

hki

, CmpZ returns the

secret bits c

= ( ¯a < 0)? 1 : 0, c

= ( ¯a > 0)? 1 : 0, and

= ( ¯a = 0)? 1 : 0. CmpZ uses Protocol 12, BitCmp,

with input a public integer ¯a =

∑

i=1

i−1

and a

bitwise-shared integer

b =

∑

i=1

i−1

, and output the

secret bits u

= ( ¯a <

b)? 1 : 0 and u

= ( ¯a =

b)? 1 : 0.

CmpZ extends the protocol LTZ to compute the

bits c

and c

, besides c

. Steps 1-5 compute c

SECRYPT 2019 - 16th International Conference on Security and Cryptography

−b¯a/2

k−1

c exactly like LTZ, except that BitLT is re-

placed by BitCmp in step 4. Steps 1-3 compute and

reveal b = 2

k−1

+ ¯a +r, where r = 2

k−1

is a ran-

dom secret integer that hides ¯a with statistical secrecy

and r

∑

k−1

i=1

i−1

, with {r

}

k−1

i=1

uniformly random

secret bits. Let b

= b mod 2

k−1

and a

= ¯a mod 2

k−1

Step 4 computes u

= (b

< r

)? 1 : 0 and u

= (b

)? 1 : 0. Observe that b

= a

+ r

− 2

k−1

, so

b¯a/2

k−1

c = ( ¯a −(b

−r

))2

−(k−1)

−u

. Also, u

= 1

if ¯a = 0 or ¯a = −2

k−1

, so c

= (1 −c

)(1 −u

) and

= (1 −c

(steps 6-7, in parallel).

P 12: BitCmp(a,{Jb

i=1

foreach i ∈ [1,k] do Jd

K ← a

⊕Jb

K;1

foreach i ∈ [1,k] do c

← 1 −a

{Jp

i=1

← SufMul({Jd

+ 1K}

i=1

);3

K ← c

K +

∑

k−1

i=1

(Jp

K −Jp

i+1

K);4

K ← Mod2(Js

K,k);5

K ← Mod2(Jp

K,k);6

return (Ju

K,Ju

K);7

BitCmp is similar to the protocol BitLT given in

(Catrina and de Hoogh, 2010a). Steps 1-5 compute

exactly like BitLT, so we explain only the compu-

tation of u

. Step 3 computes p

∏

j=i

+ 1), for

i ∈ [1, k], where d

= a

⊕b

. If a = b then p

= 1,

else p

is a power of 2, so u

= p

mod 2. Steps 5-6

run in parallel, so we obtain u

almost for free.

LTFL can also be used to compute the other com-

parison operators, by observing that c = ( ˆa

< ˆa

)? 1 :

0 = ( ˆa

> ˆa

)? 1 : 0 and 1 −c = ( ˆa

≥ ˆa

)? 1 : 0 =

( ˆa

≤ ˆa

)? 1 : 0. Moreover, it also works when an

operand is public, with the same complexity.

The online complexity of BitCmp is 2 rounds and

k + 2 interactive operations (1 operation more than

BitLT) and CmpZ needs 4 rounds and k + 5 interac-

tive operations. Therefore, the online complexity of

LTFL is 5 rounds and ` + g + 7 interactive operations

(steps 2-3 in parallel). This is similar to comparison

in Q

hk, f i

using LTZ (LTFL adds 2 rounds, but usually

`+g < k, so the communication complexity is lower).

Equality of secret ˆa

, ˆa

∈ Q

h`,gi

with secret out-

put can be tested as efﬁciently as for ﬁxed-point num-

bers, based on the following remark. Let ˆa

= (1 −

) ¯v

¯p

, ˆa

= (1 −s

) ¯v

¯p

, and c = ( ˆa

= ˆa

)? 1 : 0.

Also, let ∆ = 2

`+1

( ¯p

− ¯p

)+2

( ¯s

− ¯s

)+( ¯v

− ¯v

) =

`+1

+ 2

. Observe that

∈ {−1, 0, 1} and

| < 2

. If

6= 0 and

6= 0 then 0 < |2

| <

`+1

|, hence ∆ 6= 0. Thus, ∆ = 0 if and only if

= 0,

= 0, and

= 0, hence c = (∆ = 0)? 1 : 0.

Protocol 13, EQFL, computes c = ( ˆa

= ˆa

)? 1 : 0

as described above. Its online complexity is 3 rounds

and log(`+ g +2)+2 interactive operations, the same

as for inputs in Q

hk, f i

with k > ` + g.

P 13: EQFL({Jv

K,Jp

K,Js

i=1

K ← 2

`+1

K + 2

K + Jv

K;1

K ← 2

`+1

K + 2

K + Jv

K;2

JcK ← EQZ(Jb

K −Jb

K,` + g + 2);3

return JcK;4

4 CONCLUSIONS

A broad range of privacy preserving collaborative ap-

plications require efﬁcient secure computation with

real numbers (statistical analysis, benchmarking, data

mining, and optimizations). Starting from the frame-

work introduced in (Catrina and de Hoogh, 2010a;

Catrina and Saxena, 2010), we add building blocks

and optimizations that alleviate the performance bot-

tlenecks of the previous protocols. We show that

secure ﬂoating-point arithmetic is substantially im-

proved using a small set of powerful and efﬁcient

building blocks (Table 2) and protocol constructions.

The online and precomputation complexity of the

ﬂoating-point protocols is summarized in Table 3

(with θ

,θ

∈[3,4] for ` ∈ [24,56]). All protocols are

speciﬁed for secret operands and secret result, in the

same security model. However, they can be adapted to

also work when one of the operands is public. In some

cases, the complexity is signiﬁcantly lower when part

of the input information is not secret, e.g., FX2FL for

input with known sign, AddFL for operands with the

same sign, DivFL with public divisor.

A challenge for secure arithmetic is to ﬁnd the best

complexity trade-offs, taking into account a complete

protocol family and typical applications

. We ana-

lyzed several variants of ﬂoating-point encoding and

building blocks. The selection presented in the pa-

per offers better tradeoffs for the round and commu-

nication complexity of the entire protocol family. The

additional building blocks (PreDiv2m, PreDiv2mP,

Int2MaskG, and non-interactive multiplication) im-

prove the performance of the underlying integer and

ﬁxed-point arithmetic protocols and allow us to use

simpler algorithms in the ﬂoating-point protocols.

We focused on performance, accuracy and ﬂexi-

bility, rather than trying to replicate the format and

features speciﬁed in the IEEE Standard for Floating-

Point Arithmetic (IEEE 754). The parameters ` and

Sign and magnitude encoding of the signiﬁcand of-

fers better tradeoffs. A compact encoding h¯v, ¯pi, ˆa = ¯v2

¯p

¯v ∈ [2

`−2

`−1

−1] ∪[−2

`−1

,−2

`−2

−1] ∪{0} simpliﬁes

FX2FL and AddFL, but complicates the other operations.

Also, if we remove z and ignore ¯p when ¯v = 0, we have to

compute z and ¯p = (1 −z) ¯p −z2

g−1

in AddFL (4 rounds).

Efﬁcient Secure Floating-point Arithmetic using Shamir Secret Sharing

Table 3: Complexity of ﬂoating-point protocols for ˆa, ˆa

∈ Q

h`,gi

, ˜a ∈ Q

hk, f i

Protocol Task Rounds Inter. op. Prec.

LTFL ( ˆa

< ˆa

)? 1 : 0 5 ` + g + 7 3(` + g)

EQFL ( ˆa

= ˆa

)? 1 : 0 3 log(` + g) +2 ` + g + 3 log(` + g)

FX2FL ˆa ← ˜a 9 5k + 3 10k −11

AddFL ˆa ← ˆa

+ ˆa

19 6` + 2g + 26 ≈ 13` + 9g

MulFL ˆa ← ˆa

ˆa

5 ` + 9 4` + 6

DivFL ˆa ← ˆa

/ ˆa

5 + θ

` + 2θ

+ 6 ≈ (2θ

+ 4)`

SqrtFL ˆa ←

√

ˆa

4 + 2θ

3θ

+ 7 ≈ (3θ

+ 3)`

Table 4: Running time of ﬂoating-point protocols (milliseconds/operation).

Batch size 1 Prec. 10 Prec. 20 Prec. 50 Prec. 100 Prec.

LTFL 1.88 1.83 0.46 1.08 0.39 1.10 0.30 1.04 0.27 1.04

EQFL 0.94 1.35 0.17 0.71 0.13 0.70 0.09 0.64 0.08 0.63

MulFL 1.89 1.20 0.42 1.19 0.32 1.18 0.24 1.12 0.22 1.11

DivFL 3.09 4.47 0.53 3.56 0.42 3.63 0.32 3.57 0.32 3.59

SqrtFL 3.28 4.28 0.45 3.64 0.32 3.72 0.24 3.64 0.22 3.67

AddFL 7.98 5.60 2.66 4.39 2.37 4.38 2.14 4.23 1.96 4.18

g determine the range and precision of the ﬂoating

numbers, as well as the protocols’ communication

and computation complexity (the size of the ﬁeld and

the number of interactive operations). All protocols

take ` and g as (implicit) parameters and work accu-

rately, with relative error 2

−(`−1)

, for the entire range

of practically relevant values (including standard sim-

ple and double precision). Thus, they can offer the

best tradeoff between accuracy and performance, ac-

cording to application requirements.

The protocols were tested using our Java imple-

mentation of the secure computation framework dis-

cussed in Section 2. Table 4 shows preliminary per-

formance measurements for 3 parties, ` = 32, g =

10, and dlogqe = 128. The protocols ran on com-

puters with 3.6 GHz CPU, connected to a 1 Gbps

LAN. The results show the baseline performance for

low-latency and high-bandwidth networks and single-

threaded code. Large batches of primitives can be

processed faster by splitting the load among CPU

cores. The single-thread code used only a small frac-

tion of the bandwidth

. On the other hand, longer

network latency means longer interaction rounds. A

more comprehensive performance assessment, with

broader scope, will be included in future work.

The tests ran the protocols for up to 100 parallel

operations. The table lists online and precomputation

time per operation. The results of the measurements

are well correlated with the complexity, but we expect

heavier performance penalty for protocols with larger

round complexity in networks with longer transfer de-

The load of the quad-core CPU (Intel i7-7700) was

20% and the data rate was 35-50 Mbps. Tests in a 100 Mbps

LAN showed modest performance degradation.

lays. The online time is clearly much shorter when

operations are part of larger batches, so the applica-

tions that use algorithms with high parallelism will

see important performance improvements.

Floating-point arithmetic protocols are inherently

more complex than ﬁxed-point arithmetic protocols.

This complexity is partially compensated by more

compact data encoding: the protocols run more com-

plex algorithms with smaller integers encoded in

smaller ﬁelds. Multiplication and comparison proto-

cols have similar performance for ﬂoating-point and

ﬁxed-point numbers, while ﬂoating-point division is

faster. On the other hand, secure ﬂoating-point addi-

tion remains complex and relatively slow.

On-going work, being ﬁnalized, shows important

performance gains for more complex tasks, like eval-

uating sums and polynomials, by using dedicated pro-

tocols, instead of generic constructions. However,

these optimized protocols are slower than the ﬁxed-

point versions, since adding secret-shared ﬁxed-point

numbers is just a local addition of ﬁeld elements.

This suggests combining secure ﬁxed-point and

ﬂoating-point arithmetic according to application re-

quirements, an approach we are currently studying.

REFERENCES

Aliasgari, M., Blanton, M., and Bayatbabolghani, F. (2017).

Secure Computation of Hidden Markov Models and

Secure Floating-point Arithmetic in the Malicious

Model. International Journal of Information Security,

16(6):577–601.

Aliasgari, M., Blanton, M., Zhang, Y., and Steele, A.

(2013). Secure Computation on Floating Point Num-

SECRYPT 2019 - 16th International Conference on Security and Cryptography

bers. In 20th Annual Network and Distributed System

Security Symposium (NDSS’13).

Bogdanov, D., Kamm, L., Laur, S., and Sokk, V. (2018).

Rmind: A Tool for Cryptographically Secure Statisti-

cal Analysis. IEEE Transactions On Dependable And

Secure Computing, 15(3):481–495.

Catrina, O. (2018). Round-Efﬁcient Protocols for Se-

cure Multiparty Fixed-Point Arithmetic. In 12th In-

ternational Conference on Communications (COMM

2018), pages 431–436. IEEE.

Catrina, O. and de Hoogh, S. (2010a). Improved Primitives

for Secure Multiparty Integer Computation. In Secu-

rity and Cryptography for Networks, volume 6280 of

LNCS, pages 182–199. Springer.

Catrina, O. and de Hoogh, S. (2010b). Secure Multiparty

Linear Programming Using Fixed-Point Arithmetic.

In Computer Security - ESORICS 2010, volume 6345

of LNCS, pages 134–150. Springer.

Catrina, O. and Saxena, A. (2010). Secure Computation

With Fixed-Point Numbers. In Financial Cryptogra-

phy and Data Security, volume 6052 of LNCS, pages

35–50. Springer.

Cramer, R., Damg

ard, I., and Ishai, Y. (2005). Share Con-

version, Pseudorandom Secret-sharing and Applica-

tions to Secure Computation. In Theory of Cryptogra-

phy (TCC’05), volume 3378 of LNCS, pages 342–362,

Berlin, Heidelberg. Springer.

Cramer, R., Damg

ard, I., and Nielsen, J. B. (2015). Secure

Multiparty Computation and Secret Sharing. Cam-

bridge University Press, UK.

Damg

ard, I., Fitzi, M., Kiltz, E., Nielsen, J. B., and

Toft, T. (2006). Unconditionally secure constant-

rounds multi-party computation for equality, compar-

ison, bits and exponentiation. In Theory of Cryptogra-

phy (TCC 2006), volume 3876 of LNCS, pages 285–

304. Springer.

Damg

ard, I. and Thorbek, R. (2007). Non-interactive Proofs

for Integer Multiplication. In EUROCRYPT 2007, vol-

ume 4515 of LNCS, pages 412–429. Springer.

Dimitrov, V., Kerik, L., Krips, T., Randmets, J., and

Willemson, J. (2016). Alternative Implementations of

Secure Real Numbers. In 23rd ACM Conference on

Computer and Communications Security (CCS’16),

pages 553–564. ACM.

Ercegovac, M. D. and Lang, T. (2003). Digital Arithmetic.

Morgan Kaufmann.

Kamm, L. and Willemson, J. (2015). Secure Floating

Point Arithmetic and Private Satellite Collision Anal-

ysis. International Journal of Information Security,

14(6):531–548.

Krips, T. and Willemson, J. (2014). Hybrid Model of Fixed

and Floating Point Numbers in Secure Multiparty

Computations. In Information Security (ISC 2014),

volume 8783 of LNCS, pages 179–197. Springer.

Markstein, P. (2004). Software Division and Square Root

Using Goldschmidt’s Algorithms. In 6th Conference

on Real Numbers and Computers, pages 146–157.

Reistad, T. I. and Toft, T. (2009). Linear, Constant-Rounds

Bit-Decomposition. In International Conference on

Information Security and Cryptology, volume 3329 of

LNCS, pages 245–257. Springer.

APPENDIX

This appendix provides (for convenience) pseudocode

and further details for building blocks presented in

previous work and used in this paper.

Given a secret signed integer ¯a ∈ Z

hki

and a pub-

lic integer m ∈ [1,k −1], Protocol 14, Div2mP, re-

turns secret ¯a/2

with probabilistic rounding to near-

est (Catrina and de Hoogh, 2010a).

Div2mP computes ¯c = b¯a/2

c+ u, for u ∈{0, 1}.

Let

d = 2

k−1

+ ¯a and ¯a

= ¯a mod 2

. Observe that

d ≥ 0 and

d mod 2

= ¯a

for any m ∈ [1, k −1]. The

protocol reveals b = d + r, where r = 2

+ r

is a

random secret integer that hides d with statistical se-

crecy and r

∑

i=1

, with {r

}

i=1

uniformly ran-

dom secret bits. Observe that b

= (d + r) mod 2

+ r

−2

u, where u = ((b

< r

)? 1 : 0). Therefore,

¯c = ( ¯a − ¯a

+ 2

u)2

−m

= b¯a/2

c+ u.

P 14: Div2mP(JaK,k,m).

(Jr

K,Jr

K,{Jr

i=1

) ← PRandM(k,m);1

b ← Reveal(2

k−1

+ JaK + 2

K + Jr

K);2

← b mod 2

JcK ← (JaK −(b

−Jr

K))2

−m

return JcK;5

P 15: Div2m(JaK,k,m).

(Jr

K,Jr

K,{Jr

i=1

) ← PRandM(k,m);1

b ← Reveal(2

k−1

+ JaK + 2

K + Jr

K);2

← b mod 2

JuK ← BitLT(b

,{Jr

i=1

);4

JcK ← (JaK −(b

−Jr

K))2

−m

−JuK;5

return JcK;6

P 16: Div2(JaK,k).

(Jr

K,Jr

K) ← PRandM(k,1);1

b ← Reveal(2

k−1

+ JaK + 2Jr

K + Jr

K);2

K ← b

+ Jr

K −2b

K;3

JcK ← (JaK −Ja

K)2

−1

return JcK;5

Protocol 15, Div2m, is a variant that computes

¯a/2

with deterministic rounding to −∞ (Catrina and

de Hoogh, 2010a). This is achieved by computing the

bit u using the protocol BitLT. The online complex-

ity of Div2m is 3 rounds and m + 2 interactive opera-

tions. Div2mP needs a single online interaction, so it

is much more efﬁcient. However, certain applications

require deterministic rounding. Protocol 16, Div2, is

a variant of Div2m optimized for m = 1, that needs a

single interactive operation.

Protocol 17, PreDiv2mP, is a generalization of

Div2mP that computes {¯a

}

i=1

= {b¯a/2

i=1

with

Efﬁcient Secure Floating-point Arithmetic using Shamir Secret Sharing

probabilistic rounding to nearest. Similarly, Proto-

col 18, PreDiv2m, computes {¯a

}

i=1

= {b¯a/2

i=1

with deterministic rounding to −∞. PreDiv2m uses

the protocol PreBitLT, a generalization of BitLT, to

efﬁciently compute {u

}

i=1

= {(b

< r

)? 1 : 0}

i=1

P 17: PreDiv2mP(JaK,k,m).

(Jr

K,Jr

K,{Jr

i=1

) ← PRandM(k,m);1

b ← Reveal(2

k−1

+ JaK + 2

K + Jr

K);2

foreach i ∈ [1,m] do3

← b mod 2

; Js

K ←

∑

i−1

j=0

K ← (JaK −(b

−Js

K))2

−i

return {Ja

i=1

P 18: PreDiv2m(JaK,k,m).

(Jr

K,Jr

K,{Jr

i=1

) ← PRandM(k,m);1

b ← Reveal(2

k−1

+ JaK + 2

K + Jr

K);2

foreach i ∈ [1,m] do3

← b mod 2

; Js

K ←

∑

i−1

j=0

{Ju

i=1

← PreBitLT(b, {Jr

i=1

);5

foreach i ∈ [1,m] do6

K ← (JaK −(b

−Js

K))2

−i

−Ju

K;7

return {Ja

i=1

The complexity of PreDiv2m is 3 rounds and

2m + 1 interactive operations, so it performs a much

more complex task then Div2m with the same round

complexity and slightly higher communication com-

plexity. PreDiv2mP needs a single online interaction,

so we use it instead of PreDiv2m whenever possible.

The efﬁcient solutions described above are based

on Protocol 19, BitLT (“bitwise less than”) (Cat-

rina and de Hoogh, 2010a), and its generalization

PreBitLT (Catrina, 2018).

BitLT computes the secret bit u = (a < b)? 1 : 0

for a non-secret integer a =

∑

i=1

i−1

and a bitwise-

shared integer b =

∑

i=1

i−1

. Steps 1-2 compute

= a

⊕b

and the products p

∏

j=i

+ 1), for

i ∈ [1, k]; SufMul is the protocol PreMul in (Catrina

and de Hoogh, 2010a), with inputs and outputs in

inverse order. Observe that d

+ 1 = 2

, so p

∏

j=i

= 2

∑

j=i

. Step 3 computes s = (1 −a

∑

k−1

i=1

(1 −a

)(p

− p

i+1

). Since p

− p

i+1

= d

i+1

, it

follows that s = (1 −a

∑

k−1

i=1

(1 −a

∑

j=i+1

Assume a 6= b and let m ≤ k be the secret in-

dex of the most signiﬁcant different bit. The ex-

pected result is u = 1 −a

. If m < k, d

= 1 and

= 0 for all i ∈ [m + 1, k], so s = 1 −a

+ 2(1 −

m−1

∑

m−2

i=1

(1−a

∑

m−1

j=i+1

. The output is

u = s mod 2 = 1 −a

. If m = k, then d

= 1 and s =

1 −a

+ 2(1 −a

k−1

+ 2

∑

k−2

i=1

(1 −a

∑

k−1

j=i+1

The output is u = s mod 2 = 1 −a

. Finally, if a = b,

the expected result is u = 0. In this case, d

= 0 for all

i ∈ [1,k], so s = 0 and the output is u = 0.

P 19: BitLT(a,{Jb

i=1

foreach i ∈ [1,k] do Jd

K ← a

+ Jb

K −2a

K;1

{Jp

i=1

← SufMul({Jd

+ 1K}

i=1

);2

JsK ←(1−a

)Jd

K+

∑

k−1

i=1

(1−a

)(Jp

K−Jp

i+1

K);3

JuK ← Mod2(JsK,k);4

return JuK;5

Protocol 20, PreBitLT, is an efﬁcient gener-

alization of BitLT: given a non-secret integer

a =

∑

i=1

i−1

and a bitwise shared integer b =

∑

i=1

i−1

, it computes the secret bits {u

}

i=1

{(a

< b

)? 1 : 0}

i=1

, where a

∑

j=1

j−1

and

∑

j=1

j−1

(Catrina, 2018).

P 20: PreBitLT(a,{Jb

i=1

foreach i ∈ [1,k] do Jd

K ← a

+ Jb

K −2a

K;1

({Jp

K,Jp

i=1

) ← SufMulInv({Jd

K + 1}

i=1

);2

K ← (1 −a

)(Jp

K −Jp

K);3

foreach i ∈ [2,k −1] do4

K ← Js

i−1

K + (1 −a

)(Jp

K −Jp

i+1

K);5

K ← Js

k−1

K + (1 −a

)Jd

K;6

foreach i ∈ [1,k −1] do7

K ← Mod2D(Js

K ∗Jp

i+1

K,k);

K ← Mod2(Js

K,k);9

return {Ju

i=1

;10

For u

= (a

< b

)? 1 : 0, PreBitLT works exactly

like BitLT: it computes s

= (1 −a

∑

k−1

i=1

(1 −

)(p

−p

i+1

) and then u

= s

mod 2.

For u

= (a

< b

)? 1 : 0, with ` ∈ [1, k − 1],

PreBitLT computes s

∑

i=1

(1 − a

)(p

− p

i+1

Since s

∑

i=1

(1 − a

∑

j=i+1

and p

`+1

∑

j=`+1

, it follows that s

= p

`+1

((1 − a

∑

`−1

i=1

(1 −a

∑

j=i+1

). Therefore, we can compute

= (s

`+1

) mod 2 (like in BitLT). Since p

`+1

| s

the integer division can be computed in Z

, as s

−1

`+1

SufMulInv computes {p

}

i=1

= {

∏

j=i

}

i=1

and

−1

}

i=1

= {

∏

j=i

−1

}

i=1

. It extends the protocol

PreMul and has the same complexity.

The online complexity of BitLT is 2 rounds and

k + 1 interactive operations. PreBitLT needs 2 rounds

and 2k interactive operations.

SECRYPT 2019 - 16th International Conference on Security and Cryptography