Interactive Secure Function Computation

TL;DR

This paper investigates the fundamental limits of interactive and non-interactive secure function computation between two users, providing characterizations of feasibility, optimal communication rates, and the role of randomness under various privacy constraints.

Contribution

It introduces single-letter characterizations for the feasibility and optimal rates of secure interactive computation, and analyzes the impact of common randomness and interaction.

Findings

Single-letter expressions for feasibility and optimal rates.

Characterization of functions securely computable with one message.

Bounds on message lengths in non-interactive secure computation.

Abstract

We consider interactive computation of randomized functions between two users with the following privacy requirement: the interaction should not reveal to either user any extra information about the other user's input and output other than what can be inferred from the user's own input and output. We also consider the case where privacy is required against only one of the users. For both cases, we give single-letter expressions for feasibility and optimal rates of communication. Then we discuss the role of common randomness and interaction in both privacy settings. We also study perfectly secure non-interactive computation when only one of the users computes a randomized function based on a single transmission from the other user. We characterize randomized functions which can be perfectly securely computed in this model and obtain tight bounds on the optimal message lengths in all the privacy settings.

Equations

$$p^{\text{(induced)}}(w,x^n,y^n,m_{[1:r]},z_1^n,z_2^n)=\frac{1}{2^{n{R}_0}}\prod _{i=1}^{n}q(x_i,y_i)\times$$

$$\left[\prod _{i:\text{odd}}{p}^{{\text{E}}_1}(m_i|x^n,w,m_{[1:i-1]})\prod _{j:\text{even}}{p}^{{\text{E}}_2}(m_j|y^n,w,m_{[1:j-1]})\right]$$

$$\times p^{{\text{D}}_1}(z_1^n|x^n,w,m_{[1:r]})p^{{\text{D}}_2}(z_2^n|y^n,w,m_{[1:r]}).$$

$${\Vert p_{X^n,Y^n,Z_1^n,Z_2^n}^{\text{(induced)}}-q_{X,Y,Z_1,Z_2}^{(n)}\Vert }_1$$

$$I(M_{[1:r]},W;Y^n,Z_2^n|X^n,Z_1^n)$$

$$I(M_{[1:r]},W;X^n,Z_1^n|Y^n,Z_2^n)$$

$$q_{X,Y,Z_1,Z_2}^{(n)}(x^n,y^n,z_1^n,z_2^n):=$$

$${\Pi }_{i=1}^n\left[q_{XY}(x_i,y_i)q_{Z_1{Z}_2|XY}(z_{1i},z_{2i}|x_i,y_i)\right].$$

$$R_{12}$$

$$R_{21}$$

$$U_i-(U_{[1:i-1]},X)-Y,\text{if}i\text{is}\text{odd},$$

$$U_i-(U_{[1:i-1]},Y)-X,\text{if}i\text{is}\text{even},$$

$$Z_1-(U_{[1:r]},X)-(Y,Z_2),$$

$$Z_2-(U_{[1:r]},Y)-(X,Z_1),$$

$$U_{[1:r]}-(X,Z_1)-(Y,Z_2),$$

$$U_{[1:r]}-(Y,Z_2)-(X,Z_1),$$

$$(X\oplus Y)-(U,X)-Y,$$

$$(X\oplus Y)-(U,Y)-X,$$

$$I(X\oplus Y;U)=0.$$

$$R_{12}$$

$$R_{21}$$

$$R_0+R_{12}$$

$$R_0+R_{12}+R_{21}$$

$$I(Z_1;Z_2|X,Y),$$

$$R_{12}$$

$$R_{21}$$

$$R_0+R_{12}$$

$$R_0+R_{12}+R_{21}$$

$$+I(U_{[1:r]};Z_1,Z_2|X,Y),$$

$$I(X;U_{[1:r]}|Y)$$

$$I(Y;U_{[1:r]}|X)$$

$$I(U_{[1:r]};Z_1,Z_2|X,Y)$$

$$R_{12}$$

$$R_{21}$$

$$R_0+R_{12}+R_{21}$$

$$+I(Z_1;Z_2|X,Y).$$

$$R_{12}$$

$$R_{21}$$

$$R_0+R_{12}$$

$$R_0+R_{12}+R_{21}$$

$$+I(U_{[1:r]};Z_1|X,Y),$$

$$R_{12}$$

$$R_{21}$$

$$R_0+R_{12}$$

$$R_0+R_{12}+R_{21}$$

$$+I(U_{[1:r]};Z_2|X,Y),$$

$$R_{\text{sum}}^{B-\text{pvt}}(r,0)$$

Full text

I Introduction

In his seminal work on cryptography, Shannon considered secure communication between two users in the presence of an eavesdropper [1]. How mutually trusting users can collaborate while revealing as little information about their data as possible to untrusted eavesdroppers has been studied extensively in the pages of this journal. Collaboration in the form of secure communication over a wiretap channel [2, 3], secret-key agreement via public discussion [4, 5, 6], computation and channel simulation in the presence of an eavesdropper [7, 8], secure source coding [9, 10, 11], and secure network coding [12, 13] have received considerable attention. For a more exhaustive set of references, see [14, 15]. The object of study in this work is how mutually distrusting users may collaborate while preserving privacy. Specifically, we consider a function computation problem between two users (Figure 1). They observe memoryless sources (inputs) $X$ and $Y$, respectively, and communicate interactively over a noiseless communication link to compute randomized functions (outputs) $Z_{1}$ and $Z_{2}$, respectively. Common and private randomness which is independent of the inputs $X$ and $Y$ is available to both of them. They want to compute the functions in such a way that neither of them learn any extra information about the other user’s input and output other than what their own input and output reveal. We assume that the users are honest-but-curious, i.e., they faithfully follow the given protocol, but will try to infer extra information at the end of the protocol. This secure computation problem is specified by a pair $(q_{XY},q_{Z_{1}Z_{2}|XY})$, where $q_{XY}$ is the input distribution and $q_{Z_{1}Z_{2}|XY}$ specifies the randomized function. Our goal is to determine whether a function is securely computable and, when it is computable, determine the optimal rates of interactive communication required.

There is a vast literature on two-user interactive computation (with no privacy) in computer science (see, e.g., [16, 17] and references therein) and in information theory [18, 19, 20, 21, 22]. Kaspi [18] obtained the rate-distortion trade-off for two-user interactive source coding. The rate region for optimal two-round interactive lossless computation was obtained by Orlitsky and Roche [19]. Ma and Ishwar [20] derived the optimal rate region for an arbitrary number of rounds. Using an example, they also showed that three rounds of interactions (which is clearly not needed for computation to be feasible) can strictly out-perform two rounds. Optimal interactive schemes for computing randomized functions were studied by Yassaee et al. [21] and Tyagi et al. [22].

Secure computation (with privacy against the users themselves) has been studied in cryptography under computational as well as information theoretic secrecy (see [23] and references therein). It is known that not all functions are information theoretically securely computable by two users interacting over a noiseless link, whereas, under computational secrecy, all functions are securely computable [24, 25]111Note that if the two users have access to correlated random variables or a noisy channel, a larger class of functions may be securely computed [26]. A characterization of such stochastic resources which allow any function to be securely computed is given in [27]. In this paper, we do not consider such resources.. A combinatorial characterization of two-user securely computable deterministic functions was given by Beaver [28] and Kushilevitz [29]. An alternative characterization using the common randomness generated by interactive deterministic protocols was provided by Narayan et al.  [30]. A combinatorial characterization of two-user securely computable randomized functions is still not known; some partial results were obtained by Maji et al. [27], and Data and Prabhakaran [31]. A characterization of two-user securely computable output distributions with no inputs and no common randomness was given by Wang and Ishwar [32]. In contrast to these, function computation with privacy against an eavesdropper who has access to the interactive communication was studied by Tyagi et al. [7] and Gohari et al. [8].

Secure computation among $n$ users ($n>2$) with pairwise, private, error-free communication links was studied by Ben-Or, Goldwasser, and Wigderson [33] and Chaum, Crépeau, and Damgård [34]. It was shown that any function can be securely computed even if any $t<\frac{n}{2}$ honest-but-curious users collude222For malicious cases where colluding users may arbitrarily deviate from the protocol, secure computation of all functions is feasible under a stricter threshold of $t<\frac{n}{3}$ colluding users [33, 34].. The problem of finding optimal protocols from a communication point-of-view remains mostly open [35].

Communication rate for secret-key agreement through public discussion was studied by Tyagi [36] for the two-terminal scenario, and Mukherjee et al. [37] and Chan et al. [38] for the multi-terminal scenario. Communication versus rounds trade-off for secret key and common randomness generation was studied by Bafna et al. [39].

We consider two-user interactive secure function computation in two privacy settings: (i) when privacy is required against both users, and (ii) when privacy is required against only one of the users. The users are assumed to be honest-but-curious, i.e., they follow the protocol faithfully, but attempt to obtain information about the other user’s input and output from everything they have access to at the end of the protocol. The function maybe randomized. Our main contributions are as follows:

• •

For each of the privacy settings mentioned above, we show that the set of asymptotically securely computable functions (see Definition 2) is the same as the set of one-shot, perfectly securely computable functions. We also show that such a property is not true for all secure function computation problems, in general. Function computation with privacy (only) against an eavesdropper [7] turns out to be a counterexample (see Remark 2). Furthermore, we give single-letter expressions for the asymptotic rate regions (Theorems 1, 2, 4 and 5).

• •

We show that for a class of functions (including all deterministic functions), checking secure computability (with privacy requirement against both users) is equivalent to checking whether cut-set lower bounds for computation with no privacy requirements can be met (Theorem 3).

• •

When privacy is required against both users, we give a necessary and sufficient condition for common randomness to be helpful in improving the communication rate (see Proposition 2).

• •

When no privacy is required, any function can be computed in two rounds by exchanging the inputs. However, Ma and Ishwar [20] showed that there are functions for which more rounds of interaction can strictly improve the communication rate. For a function securely computable with privacy against both users, (depending on the function) a certain minimum number of rounds of interaction may be required to securely compute it. In contrast with function computation without any privacy required, we show that further interaction does not improve the communication rate (see Proposition 1). However, when privacy is required against only one user, we show that both interaction and common randomness may help to improve the communication rate (see Propositions 3 and 4). We also give a condition under which neither interaction nor common randomness helps to enlarge the rate region (see Proposition 5).

• •

For perfectly secure computation, we derive matching upper and lower bounds on the optimal expected length of transmission in several non-interactive privacy settings where only Bob produces an output using a single transmission from Alice. We study these in a one-shot setting (i.e., with only one copy of inputs), as well as a setting where sequence of i.i.d. samples of inputs are given as inputs. The different scenarios include $(i)$ when privacy is required against both users; our results are stated in Theorem 7 (one-shot) and Corollary 2 (sequence of inputs), $(ii)$ when privacy is required only against Alice; our results are stated in Theorem 8 (one-shot) and Corollary 3 (sequence of inputs), $(iii)$ when privacy is required only against Bob; our results are stated in Theorem 10 (one-shot) and Corollary 4 (sequence of inputs). Since not all randomized functions are securely computable in the first and the third scenarios, we also give a characterization of securely computable randomized functions in these settings; see Lemma 3 in Appendix F333When there is no input distribution, Kilian [40] already gave a characterization of securely computable randomized functions when privacy is required against both the users. We extend his proof to the case when we have a probability distribution on the inputs. and Theorem 9.

The paper is organized as follows. We present our problem formulation in Section II and provide results on feasibility and rate region characterization in Section III. The role of interaction and common randomness is discussed in Section IV. We illustrate the communication cost of security using an example in Section V. Bounds on the optimal expected length of transmission for perfectly secure non-interactive computation are provided in Section VI. Open questions and future directions are discussed in Section VII.

II Problem Formulation and Definitions

A secure randomized function computation problem is specified by a pair $\left(q_{XY},q_{Z_{1}Z_{2}|XY}\right)$, where $X,Y,Z_{1}$ and $Z_{2}$ take values in finite sets $\mathcal{X},\mathcal{Y},\mathcal{Z}_{1}$ and $\mathcal{Z}_{2}$, respectively. Inputs to Alice and Bob are $X^{n}$ and $Y^{n}$, respectively, where $(X_{i},Y_{i})$, $i=1,\dots,n$, are independent and identically distributed (i.i.d.) with distribution $q_{XY}$. Both users have access to a common random variable $W$, which is independent of $(X^{n},Y^{n})$ and uniformly distributed over its alphabet $\mathcal{W}=[1:2^{nR_{0}}]$. The users interactively communicate in $r$ rounds over a noiseless bidirectional link. Their goal is to securely compute the randomized function $q_{Z_{1}Z_{2}|XY}$, i.e., to output $Z_{1}^{n}$ and $Z_{2}^{n}$, respectively, such that they are (approximately) distributed according to $q^{(n)}_{Z_{1}Z_{2}|XY}(z_{1}^{n},z_{2}^{n}|x^{n},y^{n}):=\Pi_{i=1}^{n}q_{Z_{1}Z_{2}|XY}(z_{1i},z_{2i}|x_{i},y_{i})$ while (approximately) preserving privacy in the sense that the average amount of additional information that a user learns about the input and output of the other user goes to zero as $n$ tends to infinity. The users are assumed to be honest-but-curious. We consider this problem in two different cases: (i) when privacy is required against both users, and (ii) when privacy is required against only one of the users. In both cases we wish to determine whether secure computation is feasible in any arbitrary $r\in\mathbb{N}$ number of rounds and when feasible, characterize the set of achievable rates. Next we formally state the problem assuming that Alice starts the communication.

Definition 1**.**

A protocol $\Pi_{n}$ with $r$ interactive rounds of communication consists of

• •

a set of $r$ randomized encoders with p.m.f.’s $p^{\emph{E}_{1}}(m_{i}|x^{n},w,m_{[1:i-1]})$ for odd numbers $i\in[1:r]$ and $p^{\emph{E}_{2}}(m_{i}|y^{n},w,m_{[1:i-1]})$ for even numbers $i\in[1:r]$, where $M_{i}$ is the message transmitted in the $i^{\emph{th}}$ round,

• •

two randomized decoders $p^{\emph{D}_{1}}(z_{1}^{n}|x^{n},w,m_{[1:r]})$ and $p^{\emph{D}_{2}}(z_{2}^{n}|y^{n},w,m_{[1:r]})$.

Let $p^{\text{(induced)}}_{W,X^{n},Y^{n},M_{[1:r]},Z_{1}^{n},Z_{2}^{n}}$ denote the induced distribution of the protocol $\Pi_{n}$.

[TABLE]

Definition 2**.**

$(q_{XY},q_{Z_{1}Z_{2}|XY})$* is asymptotically securely computable in $r$ rounds with privacy against both users if there exists a sequence of protocols $\Pi_{n}$ such that, for every $\epsilon>0$, there exists a large enough $n$ such that*

[TABLE]

where

[TABLE]

Note that (3) is the privacy condition against Alice. It requires that the rate of additional information that Alice learns about Bob’s input and output other than what can be inferred from her own input and output is negligible. Similarly, (4) is the privacy condition against Bob.

Definition 3**.**

$(q_{XY},q_{Z_{1}Z_{2}|XY})$* is perfectly securely computable in $r$ rounds with privacy against both users if there exists a protocol $\Pi_{n}$ with $n=1$ such that (2)-(4) are satisfied with $\epsilon=0$.*

Definition 4**.**

An $(n,R_{0},R_{12},R_{21})$ protocol is a protocol $\Pi_{n}$ such that the alphabet of $W$ is $\mathcal{W}=[1:2^{nR_{0}}]$ and

[TABLE]

where $\mathcal{M}_{i}$ is the alphabet of $M_{i}$, $i\in[1:r]$.

For a given function $(q_{XY},q_{Z_{1}Z_{2}|XY})$, a rate triple $(R_{0},R_{12},R_{21})$ is said to be achievable in $r$ rounds with privacy against both users if there exists a sequence of $(n,R_{0},R_{12},R_{21})$ protocols such that, for every $\epsilon>0$, there exists a large enough $n$ satisfying (2)-(4). The rate region $\mathcal{R}^{AB-\text{pvt}}_{A}(r)$ with privacy against both users is the closure of all the achievable rate triples $(R_{0},R_{12},R_{21})$. The subscript $A$ in $\mathcal{R}^{AB-\text{pvt}}_{A}(r)$ denotes that Alice starts the communication and the superscript AB-pvt denotes that privacy is against Alice and Bob. $\mathcal{R}^{AB-\text{pvt}}_{B}(r)$ can be defined in a similar fashion for the scenario when Bob starts the communication. We are interested in the region $\mathcal{R}^{AB-\text{pvt}}(r):=\mathcal{R}^{AB-\text{pvt}}_{A}(r)\bigcup\mathcal{R}^{AB-\text{pvt}}_{B}(r)$ and the minimum sum-rate $R^{AB-\text{pvt}}_{\text{sum}}(r,R_{0}):=\min\{R_{12}+R_{21}:(R_{0},R_{12},R_{21})\in\mathcal{R}^{AB-\text{pvt}}(r)\}$. Let $\mathcal{R}^{AB-\text{pvt}}:=\bigcup_{r=1}^{\infty}\mathcal{R}^{AB-\text{pvt}}(r)$. Notice that the above definitions are for the case when privacy is required against both users. $\mathcal{R}_{A}^{A-\text{pvt}}(r)$, $\mathcal{R}_{A}^{B-\text{pvt}}(r)$ and so on can also be defined in a similar fashion for the cases when privacy is required only against Alice and privacy is required only against Bob, respectively. For example, for the case when privacy is required only against Alice, the definitions will require (2)-(3) only and not (4).

III Feasibility and Rate Region

We present single-letter characterizations of securely computable randomized functions and the rate regions. Detailed proofs can be found in Appendix A. The following theorem is about feasibility. Part $(i)$ states that asymptotic secure computability (in $r$ rounds) of a function implies one-shot (i.e., $n=1$) perfectly secure computability (in the same number of rounds). Part $(ii)$ shows that asymptotic secure computability depends on the input distribution $q_{XY}$ only through its support, $\text{supp}(q_{XY}):=\{(x,y):q_{XY}(x,y)>0\}$. In fact, asymptotic secure computability of a function $(q_{XY},q_{Z_{1}Z_{2}|XY})$ is preserved even with another input distribution $\tilde{q}_{XY}$ whose support is a subset of $\text{supp}(q_{XY})$.

Theorem 1**.**

(i) $(q_{XY},q_{Z_{1}Z_{2}|XY})$ is asymptotically securely computable with privacy against both users using an $r$-round protocol in which Alice starts the communication if and only if there exists a conditional p.m.f. $p(u_{[1:r]}|x,y,z_{1},z_{2})$ satisfying

[TABLE]

$|\mathcal{U}_{1}|\leq|\mathcal{X}||\mathcal{Y}||\mathcal{Z}_{1}||\mathcal{Z}_{2}|+1$* and $|\mathcal{U}_{i}|\leq|\mathcal{X}||\mathcal{Y}||\mathcal{Z}_{1}||\mathcal{Z}_{2}|\prod_{j=1}^{i-1}|\mathcal{U}_{j}|+1$, $\forall i>1$.*

(ii) If a function $(q_{XY},q_{Z_{1}Z_{2}|XY})$ is asymptotically securely computable with privacy against both users using an $r$-round protocol, then $(\tilde{q}_{XY},q_{Z_{1}Z_{2}|XY})$, where $\emph{supp}(\tilde{q}_{XY})\subseteq\emph{supp}(q_{XY})$, is also asymptotically securely computable with privacy against both users using an $r$-round protocol.**

Remark 1**.**

Notice that Alice can generate common randomness by sending some of her private randomness along with the message in the first round. So, the presence or absence of common randomness should not affect the secure computability of a function $(q_{XY},q_{Z_{1}Z_{2}|XY})$. As expected, the condition in part $(i)$ does not depend on common randomness.

Remark 2**.**

Part $(i)$ of Theorem 1 shows that, for our problem, asymptotic secure computability is equivalent to one-shot perfect secure computability. It is interesting to note that this is not the case for all secure function computation problems. Consider the problem of function computation with privacy against an eavesdropper [7]. Tyagi et al. [7] considers the asymptotic setting where a group of users with correlated inputs interact noiselessly to compute a common function. The privacy requirement is that the amount of information that an eavesdropper learns about the function from the communication vanishes asymptotically. [7, Theorem 2] states that a function $g$ is asymptotically securely computable by two users with privacy against an eavesdropper if $H(g(X,Y))<I(X;Y)$ (and only if $H(g(X,Y))\leq I(X;Y)$). In this setup, perfectly secure computability with privacy against an eavesdropper can be defined analogous to the asymptotic secure computability with privacy against an eavesdropper. Below, we give an example of a function which is computable with asymptotic security (with privacy from an eavesdropper) but not with perfect security. Furthermore, unlike part $(ii)$ of Theorem 1, asymptotic secure computability with privacy against an eavesdropper depends on the input distribution $q_{XY}$ not just through its support $\text{supp}(q_{XY})$ [7, Theorem 2].

Example 1**.**

Consider a doubly symmetric binary source $\text{DSBS}(a)$ with joint distribution $q_{XY}(x,y)=0.5(1-a)\mathbbm{1}_{\{x=y\}}+0.5a\mathbbm{1}_{\{x\neq y\}}$, $a\in[0,0.5]$ and $x,y\in\{0,1\}$. Let the function to be computed by both users is $g(x,y)=x\oplus y$, where ‘$\oplus$’ is addition modulo-2. Choose $a\in(0,0.5]$ s.t. $h(a)<1-h(a)$ (where $h(\cdot)$ denotes the binary entropy function), so that $g$ is asymptotically securely computable with privacy against the eavesdropper (by [7, Theorem 2]). We show that there does not exist a protocol that perfectly securely computes $g$ with privacy from an eavesdropper. If $g$ is perfectly securely computable with privacy against an eavesdropper, then there exists some $r$ and a conditional p.m.f. $p(u_{[1:r]}|x,y)$ satisfying (5)-(8) with $Z_{1}=Z_{2}=G:=g(X,Y)$ (for correctness), and $I(G;U_{[1:r]})=0$ (for privacy against the eavesdropper). For simplicity, we write $U$ for $U_{[1:r]}$. Suppose there exists a conditional p.m.f. satisfying the above conditions. In particular, we have

[TABLE]

(11) implies that $I(X\oplus Y;Y|U,X)=0$, which in turn implies that $H(Y|U,X)=0$ (i.e., $Y$ is a function of $(U,X)$) since $H(Y|U,X,X\oplus Y)=0$. Similarly, (12) implies that $H(X|U,Y)=0$, i.e., $X$ is a function of $(U,Y)$. Now if $p(u,x,y)>0$, then we claim that $p(u)=p(u,x,y)+p(u,\bar{x},\bar{y})$ ($\bar{x}$ denotes the compliment of $x$, i.e., $\bar{x}=1-x$). To see this, if $p(u,x,y)>0$, note that $p(u,x,\bar{y})=0$ since $Y$ is a function of $(U,X)$. Similarly, $p(u,\bar{x},y)=0$ since $X$ is a function of $(U,Y)$. Hence, when $p(u)>0$, since there exists $x,y$ s.t. $p(u,x,y)>0$, we can write $p(u)=p(u,x,y)+p(u,\bar{x},\bar{y})$. Hence, $X\oplus Y$ is a function of $U$ as $x\oplus y=\bar{x}\oplus\bar{y}$, $\forall x,y\in\{0,1\}$. This is a contradiction to (13) as $a\in(0,0.5]$. Therefore, $g$ is not perfectly securely computable with privacy against an eavesdropper.

Remark 3**.**

Let us call the functions that are asymptotically securely computable in $r$ rounds, for some $r>0$, as asymptotically securely computable functions. Note that part $(i)$ of Theorem 1 does not give a computable characterization of asymptotically securely computable functions since the number of auxiliary random variables to consider is unbounded. This problem, which was partially addressed in [27, 31] for full support input distributions, remains open.

Proof sketch of Theorem 1.

We give a proof sketch here. A detailed proof can be found in Appendix A. For part $(i)$, it is trivial to see the ‘if’ part since (5)-(10) define an $r$-round perfectly secure protocol of blocklength one, i.e., the protocol satisfies (2)-(4) with $n=1$ and $\epsilon=0$. For the ‘only if’ part, we first single-letterize the privacy constraints (3) and (4). We then single-letterize (2) and the Markov chains that are implied by the joint distribution in (1) along the lines of two-way source coding of Kaspi [18], interactive (deterministic) function computation of Ma and Ishwar [20], and channel simulation of Yassaee et al. [21]. Then by using the continuity of mutual information and total variation distance in the probability simplex, we show that, if a function is computable with asymptotic security, it is also computable with perfect security. For part $(ii)$, we show that a protocol which securely computes $(q_{XY},q_{Z_{1}Z_{2}|XY})$ will also securely compute the function $(\tilde{q}_{XY},q_{Z_{1}Z_{2}|XY})$, where $\text{supp}(\tilde{q}_{XY})\subseteq\text{supp}(q_{XY})$. ∎

Next theorem characterizes the rate region $\mathcal{R}^{AB-\text{pvt}}_{A}(r)$

Theorem 2**.**

If a function $(q_{XY},q_{Z_{1}Z_{2}|XY})$ is asymptotically securely computable with privacy against both users, then $\mathcal{R}^{AB-\emph{pvt}}_{A}(r)$ is given by the set of all non-negative rate triples $(R_{0},R_{12},R_{21})$ such that

[TABLE]

for some conditional p.m.f. $p(u_{[1:r]}|x,y,z_{1},z_{2})$ satisfying (5)-(10), $|\mathcal{U}_{1}|\leq|\mathcal{X}||\mathcal{Y}||\mathcal{Z}_{1}||\mathcal{Z}_{2}|+5$ and $|\mathcal{U}_{i}|\leq|\mathcal{X}||\mathcal{Y}||\mathcal{Z}_{1}||\mathcal{Z}_{2}|\prod_{j=1}^{i-1}|\mathcal{U}_{j}|+4$, $\forall i>1$.

Remark 4**.**

Inequality (16) on $R_{0}+R_{12}$ makes the rate region $\mathcal{R}^{AB-\text{pvt}}_{A}(r)$ possibly asymmetric. This is, in fact, due to the assumption that Alice starts the communication. This is similar to the possible asymmetry of the rate region observed in channel simulation [21, Theorem 1].

Remark 5**.**

Substituting $X=Y=\emptyset$ in part $(i)$ of Theorem 1 recovers a result of [32] which states that a distribution $q_{Z_{1},Z_{2}}$ is securely computable (i.e., securely sampleable as there are no inputs here) if and only if $C(Z_{1};Z_{2})=I(Z_{1};Z_{2})$, where $C(Z_{1};Z_{2}):=\underset{Z_{1}-W-Z_{2}}{\min}I(Z_{1},Z_{2};W)$ is Wyner common information [41]. To see this, note that $C(Z_{1};Z_{2})=I(Z_{1};Z_{2})+\underset{Z_{1}-W-Z_{2}}{\min}\left(I(Z_{1};W|Z_{2})+I(Z_{2};W|Z_{1})\right).$ Furthermore, when $R_{0}=0$, Theorem 2 implies that the optimal sum-rate is $R_{12}+R_{21}=C(Z_{1};Z_{2})=I(Z_{1};Z_{2})$. This follows from (24) (proved later) and the fact that $I(U_{1};Z_{1},Z_{2}|X,Y)\leq I(U_{[1:r]};Z_{1},Z_{2}|X,Y)$.

Remark 6**.**

For a function $(q_{XY},q_{Z_{1}Z_{2}|XY})$, which is asymptotically securely computable with privacy against both users using a one round protocol in which Alice starts the communication, (15) purports to give a lower bound on the rate of communication from Bob to Alice. However, note that this lower bound $I(Y;Z_{1}|X)$ is in fact zero. To see this, notice that if a function $(q_{XY},q_{Z_{1}Z_{2}|XY})$ is asymptotically securely computable with privacy against both users using a 1-round protocol in which Alice starts the communication, it follows from $U-X-Y$ and (23) (proved later) that $I(Y;Z_{1}|X)=0$.

Proof sketch of Theorem 2.

We give a proof sketch here. A detailed proof can be found in Appendix A. Our proof of achievability is along similar lines as the achievability proof of channel simulation [21, Theorem 1]. We modify this proof to give a protocol which also accounts for privacy. Specifically, we show how the Markov chains (9) and (10) can be turned into privacy constraints (3) and (4) retaining the correctness (2). For the converse, we first single-letterize the privacy constraints (3) and (4). The rest of the converse is in the spirit of two-way source coding of Kaspi [18], interactive (deterministic) function computation of Ma and Ishwar [20], and channel simulation of Yassaee et al. [21]. Note that such a single-letterization of privacy constraints preserving the correctness may not always be possible for any secure function computation problem (see, e.g., Remark 2). This gives a rate region defined by the set of non-negative rate triples $(R_{0},R_{12},R_{21})$ such that

[TABLE]

for conditional p.m.f. $p(u_{[1:r]},z_{1},z_{2}|x,y)$ satisfying (5)-(10). Notice that constraints (18)-(21) appear in channel simulation [21, Theorem 1] also, where the conditional p.m.f. $p(u_{[1:r]},z_{1},z_{2}|x,y)$ satisfies (5)-(8). The above region reduces to the form mentioned in Theorem 2 because of a simplification possible here due to the additional privacy constraints (9)-(10), which gives us (as shown in the detailed proof of Theorem 2 in Appendix A)

[TABLE]

∎

Remark 7**.**

Note that the lower bounds in (14) and (15) are in fact the cut-set lower bounds for non-private computation (see Appendix B for details). Thus, Theorem 2 implies that for sufficiently large common randomness rates $R_{0}$, the cut-set bounds are met for securely computable functions. The intuition is as follows: from (18)-(21) in the proof of Theorem 2, $R_{12}=I(X;U_{[1:r]}|Y)$ and $R_{21}=I(Y;U_{[1:r]}|X)$ are in the rate-region for sufficiently large $R_{0}$. Note that $I(X;U_{[1:r]}|Y)$ measures the rate of information Bob learns about Alice’s input during the protocol. When privacy against Bob is required, the rate of information that Bob learns about Alice’s input during the protocol must be equal to the rate of information about Alice’s input that can be inferred just from his output, i.e., $I(X;U_{[1:r]}|Y)=I(X;Z_{2}|Y)$. To see this, first note that $I(X;U_{[1:r]}|Y)=I(X;U_{[1:r]},Z_{2}|Y)=I(X;Z_{2}|Y)+I(X;U_{[1:r]}|Y,Z_{2})$, where the first equality follows from the correctness. Now privacy against Bob implies that $I(X,Z_{1};U_{[1:r]}|Y,Z_{2})=0$, which in turn implies that $I(X;U_{[1:r]}|Y,Z_{2})=0$. Similarly, when privacy against Alice is required, we have $I(Y;U_{[1:r]}|X)=I(Y;Z_{1}|X)$.

Let us denote the minimum number of rounds required for secure computation by $r_{\text{min}}$, i.e., the smallest $r$ such that there exists auxiliary random variables $U_{[1:r]}$ which makes the function $(q_{XY},q_{Z_{1}Z_{2}|XY})$ one-shot perfectly securely computable with either Alice or Bob starting the communication. For deterministic functions, it is known that $r_{\text{min}}<2\min\{|\mathcal{X}|,|\mathcal{Y}|\}$ [29]. No such bound is available for randomized functions in general [27, 31]. Note that Theorem 2 is for any fixed number of rounds $r$. As we remarked above, for securely computable functions, the cut-set lower bounds for non-private computation holds with equality for sufficiently large common randomness rate for every $r\geq r_{\text{min}}$. The following corollary shows that the optimal trade-off between the communication and common randomness rates is achieved in at most $r_{\text{min}}+1$ rounds. Notice that the expression for $\mathcal{R}^{AB-\text{pvt}}$ below does not involve any auxiliary random variables.

Corollary 1**.**

If $(q_{XY},q_{Z_{1}Z_{2}|XY})$ is asymptotically securely computable with privacy against both users, then $\mathcal{R}^{AB-\emph{pvt}}$ is given by the set of all non-negative rate triples $(R_{0},R_{12},R_{21})$ such that

[TABLE]

Furthermore, $\mathcal{R}^{AB-\emph{pvt}}(r_{\emph{min}}+1)=\mathcal{R}^{AB-\emph{pvt}}$.

Proof of Corollary 1.

It suffices to prove that $\mathcal{R}^{AB-\text{pvt}}(r_{\text{min}}+1)=\mathcal{R}_{\text{opt}}$, where $\mathcal{R}_{\text{opt}}$ is defined to be the set of all non-negative rate triples $(R_{0},R_{12},R_{21})$ such that (25)-(27) are satisfied. From Theorem 2 it is easy to see that $\mathcal{R}^{AB-\text{pvt}}(r_{\text{min}}+1)\subseteq\mathcal{R}_{\text{opt}}$. For the other direction, take a point $(R_{0},R_{12},R_{21})\in\mathcal{R}_{\text{opt}}$. Without loss of generality, suppose that $r_{\text{min}}$ occurs when Alice starts the communication. Then, by Theorem 2, there exists random variables $U_{[1:r_{\text{min}}]}$ with conditional p.m.f. $p(u_{[1:r_{\text{min}}]}|x,y,z_{1},z_{2})$ satisfying (5)-(10). We find new random variables $U^{\prime}_{[1:r_{\text{min}}+1]}$ so that $(R_{0},R_{12},R_{21})$ becomes a point in $\mathcal{R}_{B}^{AB-\text{pvt}}(r_{\text{min}}+1)$. Define $U_{1}^{\prime}=\emptyset$ and $U_{i}^{\prime}=U_{i-1}$ for $i>1$. This gives us that $(R_{0},R_{12},R_{21})\in\mathcal{R}_{B}^{AB-\text{pvt}}(r_{\text{min}}+1)$. Hence $(R_{0},R_{12},R_{21})\in\mathcal{R}^{AB-\text{pvt}}(r_{\text{min}}+1)$. ∎

As mentioned earlier, if a function is securely computable with privacy against both users, then the cut-set lower bounds (for function computation without any privacy requirement) are achievable. The converse is not true in general444To see this, suppose $X=Y=\emptyset$, then any function $q_{Z_{1}Z_{2}}$ can be computed by using common randomness alone (see Wyner common information problem [41]), i.e., by meeting the cut-set lower bounds which in this case are zero, $I(X;Z_{2}|Y)=0=I(Y;Z_{1}|X)$. Assume that $q_{Z_{1}Z_{2}}$ is such that $C(Z_{1};Z_{2})\neq I(Z_{1};Z_{2})$. Then $q_{Z_{1}Z_{2}}$ is not securely computable in view of Remark 5.. However, part $(ii)$ of the theorem below states that a converse holds for a class of functions including deterministic functions555The characterization of all the functions for which the converse holds remains open.. Let the rate region $\mathcal{R}_{A}^{\text{No-privacy}}(r)$ be defined analogous to $\mathcal{R}^{AB-\text{pvt}}_{A}(r)$ (except that only correctness condition (2) is required).

Theorem 3**.**

(i) If a function $(q_{XY},q_{Z_{1}Z_{2}|XY})$ is securely computable in $r$ rounds with privacy against both users, then there exists common randomness rate $R_{0}$ such that \big{(}R_{0},I(X;Z_{2}|Y),I(Y;Z_{1}|X)\big{)}\in\mathcal{R}_{A}^{\emph{No-privacy}}(r). Furthermore, a rate of $R_{0}=I(Z_{1};Z_{2}|X,Y)$ suffices for this.

(ii) Suppose the function $(q_{XY},q_{Z_{1}Z_{2}|XY})$ is such that $H(Z_{1}|X,Y,Z_{2})=0$ and $H(Z_{2}|X,Y,Z_{1})=0$ (e.g., a deterministic function). If there exists $R_{0}$ such that \big{(}R_{0},I(X;Z_{2}|Y),I(Y;Z_{1}|X)\big{)}\in\mathcal{R}_{A}^{\emph{No-privacy}}(r), then the function is securely computable in $r$ rounds with privacy against both users.**

We prove Theorem 3 in Appendix A. Part $(i)$ will follow from Theorem 2. We prove part $(ii)$ by showing that, for the class of functions mentioned in Theorem 3, any protocol for computation without privacy that meets the cut-set bounds must satisfy the privacy conditions as well.

When privacy is required against only one user:

Note that when privacy is required only against Alice, any function $(q_{XY},q_{Z_{1}Z_{2}|XY})$ can be securely computed using a 2-round protocol in which Alice starts the communication. Alice can transmit her input to Bob who can compute the function according to $q_{Z_{1}Z_{2}|XY}$, and send $Z_{1}$ back to Alice. Part $(i)$ of the following theorem considers the feasibility of $1$ round protocols. Similar to part $(i)$ of Theorem 2, it states that asymptotic secure computability implies one-shot perfectly secure computability. Part $(ii)$ characterizes the rate region for an arbitrary number of rounds $r$.

Theorem 4**.**

*(i) $(q_{XY},q_{Z_{1}Z_{2}|XY})$ is asymptotically securely computable with privacy only against Alice using a 1-round protocol in which Alice starts the communication if and only if there exists a conditional p.m.f. $p(u_{1}|x,y,z_{1},z_{2})$ satisfying $(a)$ $U_{1}-X-Y$, $(b)$ $Z_{1}-(U_{1},X)-(Y,Z_{2})$, $(c)$ $Z_{2}-(U_{1},Y)-(X,Z_{1})$, $(d)$ $U_{1}-(X,Z_{1})-(Y,Z_{2})$. Furthermore, if a function $(q_{XY},q_{Z_{1}Z_{2}|XY})$ is asymptotically securely computable with privacy only against Alice using a 1-round protocol, then $(\tilde{q}_{XY},q_{Z_{1}Z_{2}|XY})$, where $\emph{supp}(\tilde{q}_{XY})\subseteq\emph{supp}(q_{XY})$, is also asymptotically securely computable with privacy only against Alice using a 1-round protocol. *

(ii) $\mathcal{R}^{A-\emph{pvt}}_{A}(r)$ is given by the set of all non-negative rate triples $(R_{0},R_{12},R_{21})$ such that

[TABLE]

for some conditional p.m.f. $p(u_{[1:r]}|x,y,z_{1},z_{2})$ satisfying (5)-(8), (9), $|\mathcal{U}_{1}|\leq|\mathcal{X}||\mathcal{Y}||\mathcal{Z}_{1}||\mathcal{Z}_{2}|+4$ and $|\mathcal{U}_{i}|\leq|\mathcal{X}||\mathcal{Y}||\mathcal{Z}_{1}||\mathcal{Z}_{2}|\prod_{j=1}^{i-1}|\mathcal{U}_{j}|+3$, $\forall i>1$.**

When privacy is required only against Bob, any function $(q_{XY},q_{Z_{1}Z_{2}|XY})$ is securely computable in at most $3$ rounds with Alice starting the communication. To see this, note that Alice may transmit nothing in the first round, Bob can transmit his input to Alice in the second round. She can then compute the function according to $q_{Z_{1}Z_{2}|XY}$, and send $Z_{2}$ back to Bob in the third round. Part $(i)$ of the following theorem considers the feasibility of $1$ and $2$ round protocols. Similar to part $(i)$ of Theorems 2 and 4, it states that asymptotic secure computability implies perfectly secure computability. Part $(ii)$ characterizes the rate region for an arbitrary number of rounds $r$.

Theorem 5**.**

*(i) $(q_{XY},q_{Z_{1}Z_{2}|XY})$ is asymptotically securely computable with privacy only against Bob using an $r$-round protocol in which Alice starts the communication if and only if there exists a conditional p.m.f. $p(u_{[1:r]}|x,y,z_{1},z_{2})$ satisfying (5)-(8) and (10), for $r=1,2$. Furthermore, if a function $(q_{XY},q_{Z_{1}Z_{2}|XY})$ is asymptotically securely computable with privacy only against Bob using a 1(2, resp.)-round protocol, then $(\tilde{q}_{XY},q_{Z_{1}Z_{2}|XY})$, where $\emph{supp}(\tilde{q}_{XY})\subseteq\emph{supp}(q_{XY})$, is also asymptotically securely computable with privacy only against Bob using a 1(2, resp.)-round protocol. *

(ii) $\mathcal{R}^{B-\emph{pvt}}_{A}(r)$ is given by the set of all non-negative rate triples $(R_{0},R_{12},R_{21})$ such that

[TABLE]

for some conditional pmf $p(u_{[1:r]}|x,y,z_{1},z_{2})$ satisfying (5)-(8), (10), $|\mathcal{U}_{1}|\leq|\mathcal{X}||\mathcal{Y}||\mathcal{Z}_{1}||\mathcal{Z}_{2}|+4$ and $|\mathcal{U}_{i}|\leq|\mathcal{X}||\mathcal{Y}||\mathcal{Z}_{1}||\mathcal{Z}_{2}|\prod_{j=1}^{i-1}|\mathcal{U}_{j}|+3$, $\forall i>1$.**

IV Role of Interaction and Common Randomness

When no privacy is required, any function can be computed in two rounds by exchanging the inputs. However, as Ma and Ishwar [20] have shown, there are functions for which more rounds of interaction can strictly improve the communication rate. When privacy is required against both users, if a function is securely computable, depending on the function, by Theorem 1, a certain minimum number of rounds of interaction is required for secure computation. Recall that we defined $r_{\text{min}}$ to be the smallest $r$ such that there exists auxiliary random variables $U_{[1:r]}$ which makes the function $(q_{XY},q_{Z_{1}Z_{2}|XY})$ asymptotically (and perfectly) securely computable with either Alice or Bob starting the communication. The discussion on the role of interaction below will focus on whether increasing the number of rounds beyond $r_{\text{min}}$ helps to reduce the communication rate. On common randomness, it is clear from Remark 1 that its absence does not affect the secure computability of a function. The discussion on the role of common randomness will focus on its effect on the communication rate.

IV-A Privacy required against both users

It can be inferred from Corollary 1 that interaction will not help to enlarge the rate region beyond $r_{\text{min}}+1$ rounds when privacy is required against both users. Suppose a function $(q_{XY},q_{Z_{1}Z_{2}|XY})$ is securely computable with privacy against both users. Since $I(U_{1};Z_{1},Z_{2}|X,Y)\leq I(U_{[1:r]};Z_{1},Z_{2}|X,Y)=I(Z_{1};Z_{2}|X,Y)$ (equality follows from (24)), we get from Theorem 2 that, for any $r\geq r_{\text{min}}$, the optimal sum-rate $R^{AB-\text{pvt}}_{\text{sum}}(r,R_{0})$ is I(X;Z_{2}|Y)+I(Y;Z_{1}|X)+\big{[}I(Z_{1};Z_{2}|X,Y)-R_{0}\big{]}_{+}, where $[x]_{+}=\max\{x,0\}$. Also note that if $I(Z_{1};Z_{2}|X,Y)=0$, the characterization of the rate region does not involve the common randomness rate $R_{0}$666We also note that, for $R_{0}=0$, the proof of achievability can be carried out assuming there is no common randomness (not just that its rate is zero). . From this discussion, we have the following two propositions.

Proposition 1**.**

Interaction does not improve the minimum sum-rate, i.e., $R^{AB-\emph{pvt}}_{\emph{sum}}(r,R_{0})=R^{AB-\emph{pvt}}_{\emph{sum}}(r_{\emph{min}},R_{0})$, for $r\geq~{}r_{\emph{min}},R_{0}\geq 0$. Interaction does not help to enlarge the rate region when (i) $I(Z_{1};Z_{2}|X,Y)=0$, e.g., when the functions are deterministic, or (ii) the common randomness rate is large enough.

The problem of finding necessary and sufficient conditions for the interaction to not enlarge the rate region remains open. Now, since $R^{AB-\text{pvt}}_{\text{sum}}(r,R_{0})=R^{AB-\text{pvt}}_{\text{sum}}(r_{\text{min}},R_{0})$, for $r\geq~{}r_{\text{min}},R_{0}\geq 0$, we will relax the first argument $r$ of $R^{AB-\text{pvt}}_{\text{sum}}(r,R_{0})$ in the sequel and simply write $R^{AB-\text{pvt}}_{\text{sum}}(R_{0})$ for $R^{AB-\text{pvt}}_{\text{sum}}(r,R_{0})$, for any $r\geq r_{\text{min}}$.

Proposition 2**.**

For a function $\left(q_{XY},q_{Z_{1}Z_{2}|XY}\right)$, common randomness can improve the minimum sum-rate (i.e., $R^{AB-\emph{pvt}}_{\emph{sum}}(R_{0})<R^{AB-\emph{pvt}}_{\emph{sum}}(0),$ for all $R_{0}>0$) if and only if $Z_{1}$ and $Z_{2}$ are conditionally dependent given $(X,Y)$. Hence, for deterministic functions, common randomness does not reduce the sum-rate.

IV-B Privacy required against one user

When privacy is required against only one user, in contrast to the propositions above, both interaction and common randomness may help to improve the minimum sum-rate. We first show that one extra round of communication from the minimum number of rounds required for secure computability may strictly improve the minimum sum-rate.

Proposition 3**.**

When privacy is required against only one user (say, Bob), $r_{\emph{min}}+1$ rounds may strictly improve the minimum sum-rate, i.e., there exists a function $(q_{XY},q_{Z_{1}Z_{2}|XY})$ such that $R^{B-\emph{pvt}}_{\emph{sum}}(r_{\emph{min}},R_{0})>R^{B-\emph{pvt}}_{\emph{sum}}(r_{\emph{min}}+1,R_{0}),$ for all $R_{0}\geq 0$.

We prove this proposition through an example where both users compute a deterministic function of $(X,Y)$, and privacy against Bob alone is required.

Example 2**.**

Let $Y$ be an $m$-length vector of uniform binary random variables, $Y=(Y_{1},\ldots,Y_{m})$, and $X$ consists of a uniform binary random variable $V$ and a random variable $J$ which is uniformly distributed on $[1:m]$, i.e., $X=(V,J)$. We assume that $Y$, $V$, and $J$ are independent. Both users want to compute the function $Z=(J,V\wedge Y_{J})$, where “$\wedge$” represents the binary AND function, with privacy only against Bob. In this example, it is easy to see that (see below) $r_{\min}$ is 2 with Bob starting the communication. Note that $R^{B-\text{pvt}}_{\text{sum}}(r,R_{0})$ does not depend on $R_{0}$ for a deterministic function (from Theorem 5) and hence we can write $R^{B-\text{pvt}}_{\text{sum}}(r)$ for $R^{B-\text{pvt}}_{\text{sum}}(r,R_{0})$ by relaxing $R_{0}$. We show that the optimum sum-rate for two round protocols, $R^{B-\text{pvt}}_{\text{sum}}(2)$ is $\log m+1/2+m$ bits (all rates in the sequel are in bits). Then we give a three round protocol, with Alice starting the communication, which has a sum-rate of $R^{B-\text{pvt}}_{\text{sum}}(3)=\log m+1/2+1$. We also show that $\log m+1/2+1$ is the minimum achievable sum-rate with any $r$ ($r\geq 3$) rounds of protocol. Details can be found in Appendix C.

It remains open whether there is an example where further interaction leads to a further improvement in the sum-rate, i.e., $R^{B-\text{pvt}}_{\text{sum}}(r_{\text{min}}+1,R_{0})>R^{B-\text{pvt}}_{\text{sum}}(r_{\text{min}}+k,R_{0})$, for some $k>1$.

Proposition 4**.**

When privacy is required against only one user (say, Bob), then common randomness may strictly improve the minimum sum-rate, i.e., there exists a function $(q_{XY},q_{Z_{1}Z_{2}|XY})$ such that $R^{B-\emph{pvt}}_{\emph{sum}}(r,R_{0})<R^{B-\emph{pvt}}_{\emph{sum}}(r,0)$, for sufficiently large common randomness rate $R_{0}$ and $r\geq r_{\emph{min}}$.

We prove this proposition through the following example.

Example 3**.**

Let $X$ be an $m$-length ($m>1$) vector of mutually independent and uniform binary random variables, $X=(X_{1},\dots,X_{m})$ and $Y=\emptyset$. Also, let $Z_{1}=Z_{2}=Z=(J,X_{J})$, where $J$ is a random variable uniformly distributed on $[1:m]$. This defines a function $(q_{XY},q_{Z_{1}Z_{2}|XY})$. In this example, it is easy to that $r_{\text{min}}=1$, since Alice can sample random variable $J$ uniformly distributed on $[1:m]$ and transmit $(J,X_{J})$ to Bob without violating privacy. When the common randomness rate $R_{0}$ is sufficiently large, from Theorem 5, the minimum sum-rate is given by $I(X;Z)=1$. So, $R^{B-\text{pvt}}_{\text{sum}}(r,R_{0})=1$, for sufficiently large $R_{0}$ and $r\geq r_{\text{min}}$. We now argue that $R^{B-\text{pvt}}_{\text{sum}}(r,0)>1$. From Theorem 5, $R^{B-\text{pvt}}_{\text{sum}}(r,0)$ is given by

[TABLE]

To show $R^{B-\text{pvt}}_{\text{sum}}(r,0)>1$, we first show that $R^{B-\text{pvt}}_{\text{sum}}(r,0)=R^{B-\text{pvt}}_{\text{sum}}(1,0)$. Note that $R^{B-\text{pvt}}_{\text{sum}}(1,0)$ is given by

[TABLE]

By relaxing the constraints (5)-(7) in the optimization problem of (28), it is easy to see that $R^{B-\text{pvt}}_{\text{sum}}(r,0)\geq R^{B-\text{pvt}}_{\text{sum}}(1,0)$, for $r\geq 1$. We also have $R^{B-\text{pvt}}_{\text{sum}}(r,0)\leq R^{B-\text{pvt}}_{\text{sum}}(1,0),r>1$, since the minimum sum-rate can only improve with the number of rounds. Thus, we have $R^{B-\text{pvt}}_{\text{sum}}(r,0)=R^{B-\text{pvt}}_{\text{sum}}(1,0),r>1$. By considering $U=Z$ in (29), it is clear that $R^{B-\text{pvt}}_{\text{sum}}(1,0)\leq 1+\log(m)=\log(2m)$. In Appendix D, we show that $R^{B-\text{pvt}}_{\text{sum}}(1,0)=\log(2m)>1$.

We now give a condition under which neither interaction nor common randomness helps to enlarge the rate region.

Proposition 5**.**

If only one user computes and privacy is required against the other user, then neither interaction nor common randomness helps to enlarge the rate region.

Remark 8**.**

We mention that when privacy is required only against Bob, Example 2 (Example 3, resp.) can be modified so that only Bob computes and interaction (common randomness, resp.) helps to reduce the communication rate. Thus, it is really the combination of computation by only one user and privacy requirement against the other user that matters in Proposition 5.

Proof of Proposition 5.

Let us consider the case where only Bob computes (i.e., $Z_{1}=\emptyset$) and privacy against Alice is required. Note that every function $(q_{XY},q_{Z_{2}|XY})$ is securely computable in one round with privacy only against Alice777Note that for a deterministic function, one-sided communication implies that privacy against Alice trivially holds because conditioned on the inputs, there is only one possible output. However, for a randomized function, one-sided communication need not imply privacy against Alice, because conditioned on the inputs, the message that Alice sends to Bob can influence the output. But privacy against Alice requires that, conditioned on the inputs, Alice’s message must not influence Bob’s output. since Alice may send $X$ to Bob, and Bob, having $Y$ as his input, may output $Z_{2}$ according to $q_{Z_{2}|XY}$. By substituting $Z_{1}=\emptyset$ in Theorem 4, it can be observed that the only active constraint is $R_{12}\geq I(X;U_{[1:r]}|Y)$. Further, let us consider $R^{*}_{12}=\min I(X;U_{[1:r]}|Y)$, where the minimization is over conditional p.m.f.’s $p(u_{[1:r]}|x,y,z_{2})$ satisfying (5)-(6), and

[TABLE]

Now let us consider $R^{\prime}_{12}=\min I(X;U_{[1:r]}|Y)$, where the minimization is only under (30) and (31). Then $R^{*}_{12}\geq R^{\prime}_{12}$. Further, it can be observed that $R^{\prime}_{12}$ is the minimum rate achievable when $r=1$. So $R^{*}_{12}\leq R^{\prime}_{12}$. This shows that the rate region is given by

[TABLE]

for some conditional p.m.f. $p(u|x,y,z_{2})$ satisfying $U-X-(Y,Z_{2})$ and $Z_{2}-(U,Y)-X$. This shows that interaction and the presence of common randomness do not help in this case. ∎

V The Communication Cost of Security - An Example

Recall that Theorem 3 states that if a function is securely computable with privacy against both users, then cut-set lower bounds (for function computation without any privacy) are achievable, i.e., when a function is securely computable with privacy against both users, there is no communication cost of security. In this section, we study the communication cost of security when privacy is required against only one user and compare it with the communication cost of non-private computation. It turns out that, for a function which is securely computable with privacy against only one user, the requirement of privacy, in general, may lead to a larger optimal rate. We consider, arguably, the simplest special case of two-user secure computation where only Bob computes a function using a single round of transmission from Alice. We also compare our results with function computation without any privacy requirement. For the sake of comparison, below we state a result from [21], specialized to our setting (i.e., one-way communication from Alice to Bob and only Bob computing), for the optimal rate required when there is no privacy requirement. We denote the optimal rate by $R^{\text{No-Privacy}}$ when there is no common randomness. Note that [21] considered a more general model (where Alice and Bob communicate back and forth for multiple rounds, and both of them may produce potentially different outputs), and obtained a single-letter expression for the optimal rate, when Alice and Bob interact for arbitrary but finite number of rounds.

Theorem 6**.**

[21, Theorem 1]** For any $(q_{XY},q_{Z|XY})$,

$R^{\text{No-privacy}}\quad=\quad\displaystyle\min_{\begin{subarray}{c}p_{U|XYZ}:\\ U-X-Y\\ Z-(U,Y)-X\\ \end{subarray}}I(X,Z;U|Y),$

where cardinality of $\mathcal{U}$ satisfies $|\mathcal{U}|\leq|\mathcal{X}|\cdot|\mathcal{Y}|\cdot|\mathcal{Z}|+2$.

We define $R^{AB-\text{pvt}}$, $R^{A-\text{pvt}}$ and $R^{B-\text{pvt}}$ as the infima of all the achievable rates in the absence of common randomness when privacy is required, respectively, against both users, only against Alice, and only against Bob. Theorems 2, 4 and 5 give us expressions for $R^{AB-\text{pvt}}$, $R^{A-\text{pvt}}$ and $R^{B-\text{pvt}}$, respectively. Before we discuss the example, we present an alternative expression for $R^{A-\text{pvt}}$ in terms of conditional graph entropy [19], $H_{\mathcal{G}}(X|Y)$ (see Definition 5 in Section VI-A) which simplifies the computation. For a given $(q_{XY},q_{Z|XY})$, we define the following characteristic graph $\mathcal{G}=(\mathcal{X},\mathcal{E})$, where

[TABLE]

An independent set of $\mathcal{G}$ is a collection $\mathcal{U}\subseteq\mathcal{X}$ of vertices such that no two vertices of $\mathcal{U}$ are connected by an edge in $\mathcal{G}$. Let $W$ denote the random variable corresponding to the independent sets in $\mathcal{G}$, and let $\varGamma(\mathcal{G})$ be the set of all independent sets in $\mathcal{G}$.

Definition 5** (Conditional Graph Entropy, [19]).**

For a given $(q_{XY},q_{Z|XY})$, the conditional graph entropy of $\mathcal{G}$ is defined as

[TABLE]

where minimum is taken over all the conditional distributions $p_{W|X}$ such that $p_{W|X}(w|x)>0$ only if $x\in w$.

By the data-processing inequality, this minimization can be restricted to $W$’s ranging over maximal independent sets of $\mathcal{G}$ [19]. Note that $0\leq H_{\mathcal{G}}(X|Y)\leq H(X|Y)$ hold in general, and if $\mathcal{G}$ is a complete graph then $H_{\mathcal{G}}(X|Y)=H(X|Y)$.

Proposition 6**.**

Suppose $(q_{XY},q_{Z|XY})$ is asymptotically securely computable with privacy only against Alice, then $R^{A-\emph{pvt}}=H_{\mathcal{G}}(X|Y)$, where $H_{\mathcal{G}}(X|Y)$ is conditional graph entropy (see Definition 5 in Section VI).

Proposition 6 is proved in Appendix E.

Example 4**.**

Consider the randomized function $(q_{XY},q_{Z|XY})$ given in Figure 2.

*If $p=1$, Alice does not need to send any message, and the rate required is zero in all the four cases. So, we consider $p<1$, and analyze the randomized function under all the four cases of privacy (including no privacy) below.

Privacy against both users

It can be shown from Lemma 3 (Appendix F) that the randomized function $(q_{XY},q_{Z|XY})$ is securely computable with privacy against both users if and only if $p=0$ or $p=1$. As noted earlier, if $p=1$, the rate required is zero, i.e., $R^{AB-\text{pvt}}=0$. If $p=0$, then $R^{AB-\text{pvt}}=I(X;Z|Y)=1/2$.

Privacy only against Alice

*By Proposition 6, the optimum rate is $R^{A-\text{pvt}}=H_{\mathcal{G}}(X|Y)$. The characteristic graph (see Section VI-A) corresponding to the randomized function $(q_{XY},q_{Z|XY})$ is $\mathcal{G}=(\mathcal{V},\mathcal{E})$, where $\mathcal{V}=\{x_{1},x_{2},x_{3}\}$ and $\mathcal{E}=\{\{x_{1},x_{3}\}\}$, i.e., $\mathcal{G}$ has a single edge between $x_{1}$ and $x_{3}$. The optimal rate $R^{A-\text{pvt}}$ is equal to the conditional graph entropy $H_{\mathcal{G}}(X|Y)$ of this graph $\mathcal{G}$. Note that there are two maximal independent sets $\{x_{1},x_{2}\}$ and $\{x_{2},x_{3}\}$ in $\mathcal{G}$. It can be shown easily that $I(W;X|Y)$ is minimized when $p_{W|X}(\{x_{1},x_{2}\}|x_{1})=p_{W|X}(\{x_{1},x_{2}\}|x_{2})=1$, $p_{W|X}(\{x_{2},x_{3}\}|x_{3})=1$. This yields $I(W;X|Y)=1/2$, which implies that $H_{\mathcal{G}}(X|Y)=1/2$. We obtain $R^{A-\text{pvt}}=1/2$ for $0\leq p<1$. (When $p=1$, the graph $\mathcal{G}$ does not have any edge, and the rate required is zero, i.e., $R^{A-\text{pvt}}=0$.) *

Privacy only against Bob

From Theorem 5, the optimal rate for asymptotically securely computing $(q_{XY},q_{Z|XY})$ with privacy against Bob is equal to

[TABLE]

First we show that this randomized function is securely computable with privacy against Bob, i.e., we give a random variable $U$ that satisfies the Markov chains in (32). For that we give an encoder-decoder pair $(p_{U|X},p_{{Z}|UY})$ that perfectly securely computes $(q_{XY},q_{Z|XY})$ with privacy against Bob. The random variable $U$ has ternary alphabet $\mathcal{U}=\{u_{1},u_{2},u_{3}\}$. The encoder-decoder pair $(p_{U|X},p_{{Z}|UY})$ is defined as follows:

[TABLE]

It can be verified that the above encoder-decoder pair $(p_{U|X},p_{{Z}|UY})$ satisfies perfect privacy against Bob (i.e., it satisfies the Markov chain $U-(Y,Z)-X$) and perfect correctness (i.e., $p_{{Z}|X=x,Y=y}=q_{Z|X=x,Y=y}$ for every $x,y$ such that $q_{XY}(x,y)>0$). We will now show that the choice of auxiliary random variable in (LABEL:eq:example1-ed-privacy-bob) is optimal for the optimization problem in (32). Consider any $p_{U|XYZ}$ which satisfies the constraints in (32). Note that when $Y=y_{1}$, $Z=e$ with probability 1. This implies that $I(Z;U|Y=y_{1})=0$, which simplifies the rate-expression for $R^{B-\text{pvt}}$ to the following:

[TABLE]

*To evaluate the expression in (34), it is sufficient to take minimization over encoder-decoder pairs $(p_{U|X},p_{Z|U,Y=y_{2}})$ that perfectly securely compute $(q_{X|Y=y_{2}},q_{Z|X,Y=y_{2}})$ with privacy against Bob. Consider such an encoder-decoder pair $(p_{U|X},p_{Z|U,Y=y_{2}})$. Let $(z_{1},z_{2},z_{3})=(0,e,1)$. For $i\in[1:3]$, define $\mathcal{U}_{i}:=\{u\in\mathcal{U}:p_{Z|U,Y=y_{2}}(z_{i}|u)>0\}$. It follows from Claim 2 that $\mathcal{U}_{1}\cap\mathcal{U}_{2}\cap\mathcal{U}_{3}=\phi$ 888When we restrict Bob’s input to $y_{2}$, then Alice’s input $X$ takes values in $\{x_{1},x_{3}\}$. For securely computing $(q_{X|Y=y_{2}},q_{Z|X,Y=y_{2}})$ with $p\in(0,1)$, we have $k=3$ and $\vec{\alpha_{1}^{(y_{2})}}=(1,0)$, $\vec{\alpha_{2}^{(y_{2})}}=(1/2,1/2)$, $\vec{\alpha_{3}^{(y_{2})}}=(0,1)$. For $p=0$ we have $k=2$ and $\vec{\alpha_{1}^{(y_{2})}}=(1,0)$, $\vec{\alpha_{2}^{(y_{2})}}=(0,1)$. For definitions of $k$ and $\vec{\alpha}^{(y)}$’s, see discussion on page 46.. This means that when Bob has $y_{2}$ as his input, then $U$ determines $Z$, i.e., $H(Z|U,Y=y_{2})=0$, which implies $R^{B-\text{pvt}}=\frac{1}{2}I(Z;U|Y=y_{2})=\frac{1}{2}H(Z|Y=y_{2})=\frac{1}{2}(h(p)+(1-p))$. Thus, any encoder-decoder pair $(p_{U|X},p_{Z|UY})$ that perfectly securely computes the randomized function of Figure 2 achieves the same value for $I(Z;U|Y)$. In particular, the pair defined in (LABEL:eq:example1-ed-privacy-bob) also achieves the optimal rate in (34), which is equal to $\frac{1}{2}(h(p)+(1-p))$, for $0\leq p\leq 1$. *

No privacy

From Theorem 6, the optimal rate is equal to

[TABLE]

Note that minimization in the above expression is over all encoder-decoder pairs $(p_{U|X},p_{Z|UY})$ such that they induce the correct $q_{Z|XY}(.|x,y)$ for every $x\in\mathcal{X},y\in\mathcal{Y}$ for which $q_{XY}(x,y)>0$. Note that when $Y=y_{1}$, $Z=e$ with probability 1. Now, for any $(p_{U|X},p_{Z|UY})$, define another encoder-decoder pair $(q_{U|X},q_{Z|UY})$ as follows:

[TABLE]

It can be verified that $(q_{U|X},q_{Z|UY})$ is a valid encoder-decoder pair that correctly computes the randomized function of Figure 2. Observe that

[TABLE]

and

[TABLE]

This implies that $I(X,Z;U|Y)_{q_{UXYZ}}\leq I(X,Z;U|Y)_{p_{UXYZ}}$, which further implies that the expression for $R^{\text{No-Privacy}}$ from (35) reduces to the following:

[TABLE]

To evaluate the expression in (37), it is sufficient to take minimization over encoder-decoder pairs $(p_{U|X},p_{Z|U,Y=y_{2}})$ that compute $(q_{X|Y=y_{2}},q_{Z|X,Y=y_{2}})$ with perfect correctness. We will argue that the $(p_{U|X},p_{Z|U,Y=y_{2}})$ shown in Figure 4 includes a minimizer for (37). It is a concatenation of two symmetric erasure channels – first erasure channel is with parameter $p_{1}\in[0,1]$ and the second erasure channel is with parameter $p_{2}\in[0,1]$ – with the constraint that $(1-p_{1})(1-p_{2})=1-p$. The reason that this choice of encoder-decoder pair (which is given in Figure 4) is optimal for our problem is given next:

The minimization in (37) is related to Wyner’s common information problem **[41]**, where Alice gets an input sequence $X^{n}$ and Bob wants to generate an output sequence ${Z}^{n}$ such that $(X^{n},{Z}^{n})$ is close to the desired $(X^{n},Z^{n})$ in $\ell_{1}$-distance, where $(X_{i},Z_{i})$’s are i.i.d. according to a given $q_{XZ}$. The minimum rate required for this problem is equal to the Wyner’s common information, which is defined as $\min_{p_{U|XZ}}I(X,Z;U)$, where minimization is taken over all $p_{U|XZ}$ such that $X-U-Z$ is a Markov chain. The $p_{U|XZ}$ that satisfies $X-U-Z$ and achieves the least value for $I(X,Z;U)$ was obtained by Cuff **[42, Section II-F]** and is presented in Figure 4 (without $Y$). The expression that we want to compute is $\min_{p_{U|X,Y=y_{2},Z}}I(X,Z;U|Y=y_{2})$, where minimization is taken over all $p_{U|X,Y=y_{2},Z}$ such that $X-U-Z$ is a Markov chain. Note that we are also computing the Wyner common information for the joint distribution over $\mathcal{X}\times\mathcal{Z}$ given by the conditional distribution $q_{XZ|Y=y_{2}}$. So, the same encoder-decoder pair $(p_{U|X},p_{Z|U,Y=y_{2}})$ from Figure 4 also minimizes the rate expression in (37).

With this $(p_{U|X},p_{Z|U,Y=y_{2}})$, the objective function in (37) becomes $I(X,Z;U|Y=y_{2})=\frac{1}{2}[h(p)+(1-p_{1})(1-h(p_{2}))]$. Note that the $(p_{U|X},p_{Z|U,Y=y_{2}})$ from Figure 4 has two parameters $p_{1},p_{2}\in[0,1]$, which must satisfy the constraint $(1-p_{1})(1-p_{2})=1-p$. Hence, the minimization in (37) can be taken over all $p_{1},p_{2}\in[0,1]$ which satisfy $(1-p_{1})(1-p_{2})=1-p$. The simplified rate expression for $R^{\text{No-privacy}}$ is given below (for all values of $p\in[0,1]$):

[TABLE]

Comparison:* For convenience, we write the optimal rate expressions for asymptotic security in all the four privacy settings, and plot these in Figure 3.*

[TABLE]

VI Perfect Security: One Round of Communication; Only Bob Computes

In this section, we study perfectly secure protocols where only one user, say, Bob, produces an output. We consider three different privacy settings: one where privacy is required against both the users, and the other two where privacy is required against only one of them. We further restrict ourselves to protocols that use a single round of communication, where Alice sends a message to Bob who then produces an output. We obtain tight upper and lower bounds on the optimal expected length of transmission. Although we consider a one-sided communication model here, as we remark later (Remark 9), all the results which require privacy against Alice hold in the multiple-round communication model also.

VI-A Preliminaries

Most of our results in this section are stated in terms of various information theoretic quantities that are defined on graphs which arise from randomized function computation. For a given $(q_{XY},q_{Z|XY})$, we define the following characteristic graph $\mathcal{G}=(\mathcal{X},\mathcal{E})$, where

[TABLE]

There is a probability distribution $q_{X}$ on the vertices of $\mathcal{G}$. The intuition behind this definition of a graph comes from the randomized function computation, where Alice and Bob have inputs $X$ and $Y$, respectively, and Bob wants to produce a randomized function $q_{Z|XY}$ of these inputs. Suppose $x,x^{\prime}\in\mathcal{X},y\in\mathcal{Y},z\in\mathcal{Z}$ are such that $q_{XY}(x,y)>0,q_{XY}(x^{\prime},y)>0$ and $q_{Z|XY}(z|x,y)\neq q_{Z|XY}(z|x^{\prime},y)$. Observe that Alice cannot send the same message if her input is $x$ or $x^{\prime}$: because if she does so, and Bob happens to have $y$ as his input (which happens with positive probability), then there is no way Bob can produce an output with correct distribution. This means that Alice has to distinguish through the message whether her input is $x$ or $x^{\prime}$. This distinction is achieved by defining a graph on $\mathcal{X}$ and putting an edge between $x$ and $x^{\prime}$. An edge $\{x^{\prime},x^{\prime}\}$ means that Alice cannot send the same message if her input is $x$ or $x^{\prime}$. Per contra, if $\{x,x^{\prime}\}\notin\mathcal{E}$, then Alice does not need to distinguish between $x$ and $x^{\prime}$, because, if $q_{XY}(x,y)>0,q_{XY}(x^{\prime},y)>0$ for some $y\in\mathcal{Y}$, then $q_{Z|XY}(z|x,y)=q_{Z|XY}(z|x^{\prime},y)$ holds for every $z\in\mathcal{Z}$. So, if $\{x,x^{\prime}\}\notin\mathcal{E}$, then $x$ and $x^{\prime}$ are equivalent from the function computation point of view.

We say that a coloring $c:\mathcal{X}\to\{0,1\}^{*}$ of the vertices of $\mathcal{G}$ is proper, if both the vertices of any edge $\{x,x^{\prime}\}$ have distinct colors, i.e., $c(x)\neq c(x^{\prime})$. Note that $c(X)$ is a random variable with entropy

[TABLE]

where $\text{image}(c)$ is the image of the function $c$, $c^{-1}$ is the inverse of $c$, and $q_{X}(c^{-1}(\gamma))$ for a color $\gamma$ is defined as $q_{X}(c^{-1}(\gamma)):=\sum_{x\in\mathcal{X}:c(x)=\gamma}q_{X}(x)$. Note that the function $c$ partitions $\mathcal{X}$ into color classes, i.e., the set of vertices assigned the same color, and $H(c(X))$ is the entropy of this partition. The chromatic entropy $H_{\chi}(\mathcal{G},X)$ of $\mathcal{G}$ is defined as the lowest entropy of such a partition produced by any proper coloring of $\mathcal{G}$:

Definition 6** (Chromatic Entropy, [43]).**

For a given $(q_{XY},q_{Z|XY})$, the chromatic entropy of $\mathcal{G}$ is defined as

[TABLE]

where $c(X)$ denotes the induced distribution on colors by the coloring c.

As shown in Figure 5, Alice and Bob get $X$ and $Y$, respectively, as their inputs, where $(X,Y)$ is distributed according to $q_{XY}$; Alice sends a message $U$ to Bob, and based on $U,Y)$, Bob produces $Z$ as the output, which is required to be distributed according to $q_{Z|XY}$ while preserving privacy. We allow variable length codes. Any scheme for computing $(q_{XY},q_{Z|XY})$ is defined as a pair of stochastic maps $(p_{U|X},p_{Z|UY})$, where $U$ takes values in $\{0,1\}^{*}$ such that all the binary strings in the support set of $U$ are prefix-free. We call $p_{U|X}$ the encoder and $p_{Z|UY}$ the decoder. Let $L(U)$ denote the random variable corresponding to the length of $U$ in bits and the expected length $\mathbb{E}[L(U)]$ denote the rate of code. In this section, we give bounds on the optimal rate of communication for the three cases of privacy, i.e., privacy against both users, privacy only against Alice and privacy only against Bob. In this section, we will only consider the case when there is no common randomness available to the users. However, we show below in Proposition 7 that this is without loss of generality whenever privacy against Alice is required (i.e., when privacy is required against both Alice and Bob or only against Alice). When privacy is required only against Bob, we show through an example (Example 5) later in this section that common randomness helps to improve the rate of communication.

Proposition 7**.**

When privacy against Alice is required (i.e., when privacy is required against both users or when privacy is required only against Alice), common randomness does not help to improve the optimal rate.

Proof.

Let $(p_{U|XW},p_{Z|WUY})$ be an encoder-decoder pair (note that this pair takes in to account the common randomness also in addition to the definition of encoder-decoder pair mentioned in the paragraph above this lemma) that securely computes $(q_{XY},q_{Z|XY})$. Consider the probability distribution,

[TABLE]

where (40) follows from privacy against Alice, i.e., $(U,W)-~{}X-~{}(Y,Z)$, (41) follows from the independence of random variables $W$ and $X$. Thus we have,

[TABLE]

Now, consider the expected length,

[TABLE]

This implies that there exists $w^{*}$ such that $\mathbb{E}\left[L(U)|W=w^{*}\right]\leq\mathbb{E}[L(U)]$, i.e., there exists a p.m.f. $p(u,x,y,z|w^{*})$ achieving the same or smaller expected length and satisfying the required Markov chains. Note that (42) makes sure that correctness condition holds. ∎

VI-B Privacy required against both users

We consider protocols which provide privacy against both the users. Before proceeding further, we need some definitions.

Definition 7**.**

For any $x,x^{\prime}\in\mathcal{X}$, we say that $x\sim x^{\prime}$, if there exists $y\in\mathcal{Y}$ and $z\in\mathcal{Z}$ such that $q_{XY}(x,y)>0,q_{XY}(x^{\prime},y)>0$ and $q_{Z|XY}(z|x,y)>0$, $q_{Z|XY}(z|x^{\prime},y)>0$.

Definition 8**.**

For any two distinct elements $x,x^{\prime}$ of $\mathcal{X}$, we say that $x\equiv x^{\prime}$, if there exists a sequence $x=x_{1},x_{2},\ldots,x_{l-1},x_{l}=x^{\prime}$ for some integer $l$, where $x_{i}\sim x_{i+1}$ for every $i\in\{1,2,\ldots,l-1\}$.

It can be verified easily that the above defined relation $\equiv$ is an equivalence relation. A similar notion of equivalent inputs has been used in characterizing securely computable deterministic functions [29]. We know that an equivalence relation partitions the whole space into equivalence classes. Suppose the relation $\equiv$ partitions the space $\mathcal{X}$ as $\mathcal{X}=\mathcal{X}_{1}\biguplus\mathcal{X}_{2}\biguplus\ldots\biguplus\mathcal{X}_{k}$, where each $\mathcal{X}_{i}$ is an equivalence class, $k$ is the number of equivalence classes, and $\biguplus$ stands for disjoint union.

Let $\mathcal{X}_{\text{EQ}}:=\{x_{1},x_{2},\ldots,x_{k}\}$, where $x_{i}$ is the representative of the equivalence class $\mathcal{X}_{i}$. Now, we define ($q_{X_{\text{EQ}}Y},q_{Z|X_{\text{EQ}}Y}$) as follows:

• •

Define $q_{X_{\text{EQ}}Y}(x_{i},y):=\sum_{x\in\mathcal{X}_{i}}q_{XY}(x,y)$ for every $(x_{i},y)\in(\mathcal{X}_{\text{EQ}}\times\mathcal{Y})$.

• •

For $(x_{i},y)\in(\mathcal{X}_{\text{EQ}}\times\mathcal{Y})$, if there exists $x\in\mathcal{X}_{i}$ s.t. $q_{XY}(x,y)>0$, then define $q_{Z|X_{\text{EQ}}Y}(z|x_{i},y):=q_{Z|XY}(z|x,y)$, for every $z\in\mathcal{Z}$. If there exists no $x\in\mathcal{X}_{i}$ s.t. $q_{XY}(x,y)>0$, then it does not matter what the conditional distribution $q_{Z|X_{\text{EQ}}Y}(z|x_{i},y)$ is; in particular, we can define $q_{Z|X_{\text{EQ}}Y}(.|x_{i},y)$ to be the uniform distribution in $\{1,2,\ldots,|\mathcal{Z}|\}$.

Lemma 1**.**

Suppose $(q_{XY},q_{Z|XY})$ is perfectly securely computable with privacy against both users, and let $(q_{X_{\text{EQ}}Y},q_{Z|X_{\text{EQ}}Y})$ be the reduced problem defined as above. For every encoder-decoder pair $(p_{U|X},p_{Z|UY})$ that securely computes $(q_{XY},q_{Z|XY})$, there is another encoder-decoder pair $(p_{\tilde{U}|X_{\text{EQ}}},p_{Z|\tilde{U}Y})$ that securely computes $(p_{X_{\text{EQ}}Y},p_{Z|X_{\text{EQ}}Y})$, and vice-versa. Furthermore, $L(U)$ and $L(\tilde{U})$ have the same p.m.f., where $L(U)$ and $L(\tilde{U})$ denote the random variables corresponding to the lengths of $U$ and $\tilde{U}$ (in bits), respectively.

It follows from Lemma 1 proved in Appendix F that, to study the communication complexity of secure computation of $(q_{XY},q_{Z|XY})$, it is enough to study the communication complexity of secure computation of the reduced problem $(q_{X_{\text{EQ}}Y},q_{Z|X_{\text{EQ}}Y})$. To give a rate-optimal code for $(q_{X_{\text{EQ}}Y},q_{Z|X_{\text{EQ}}Y})$, we define the following graph $\mathcal{G}_{\text{EQ}}=(\mathcal{V}_{\text{EQ}},\mathcal{E}_{\text{EQ}})$:

• •

$\mathcal{V}_{\text{EQ}}=\mathcal{X}_{\text{EQ}}=\{x_{1},x_{2},\ldots,x_{k}\}$,

• •

$\mathcal{E}_{\text{EQ}}=\{\{x_{i},x_{j}\}:$ there exists $(y,z)$ such that $q_{X_{\text{EQ}}Y}(x_{i},y)>0$, $q_{X_{\text{EQ}}Y}(x_{j},y)>0$ and $q_{Z|X_{\text{EQ}}Y}(z|x_{i},y)\ \neq\ q_{Z|X_{\text{EQ}}Y}(z|x_{j},y)\}$.

We say that a coloring $c:\mathcal{V}\to\{0,1\}^{*}$ of the vertices of a graph $\mathcal{G}=(\mathcal{V},\mathcal{E})$ is proper, if both the vertices of any edge $\{u,v\}$ have distinct colors, i.e., $c(u)\neq c(v)$.

Claim 1**.**

Every proper coloring of the vertices of $\mathcal{G}_{\text{EQ}}$ corresponds to a secure code for $(q_{X_{\text{EQ}}Y},q_{Z|X_{\text{EQ}}Y})$, and every secure code for $(q_{X_{\text{EQ}}Y},q_{Z|X_{\text{EQ}}Y})$ corresponds to a collection of proper colorings of the vertices of $\mathcal{G}_{\text{EQ}}$.

The above claim is proved in Appendix G. The equivalence between non-secure protocols for source coding and graph coloring (for an appropriately defined graph) has been obtained in [43] using a straightforward argument. To show a similar equivalence in the case of secure protocols for function computation, first we partition the input alphabet according to an equivalence relation (see Definition 8), which reduces our problem to a problem on smaller alphabets such that we can show a similar equivalence between secure protocols and graph colorings. Proof of this claim is more involved than the corresponding proof in the source coding case; see Appendix G for details.

Now we are ready to prove upper and lower bounds on optimal expected length of the message, which is defined as $L^{*}_{AB-\text{pvt}}:=\min_{(p_{U|X},p_{{Z}|UY})}\mathbb{E}[L(U)]$, where $L(U)$ denotes the random variable corresponding to the length of $U$ in bits, and minimization is taken over all $(p_{U|X},p_{{Z}|UY})$ that perfectly securely computes $(q_{XY},q_{Z|XY})$ with privacy against both users. Having established the equivalence between secure protocols and graph colorings, in the following theorem, we prove bounds on $L^{*}_{AB-\text{pvt}}$ which can be proved along the lines of the proof of [43, Theorem 1] (which is for source coding) with appropriate modifications that arise due to the randomized nature of our secure protocols.

Theorem 7**.**

Suppose $(q_{XY},q_{Z|XY})$ is perfectly securely computable with privacy against both users. Then

[TABLE]

where chromatic entropy $H_{\chi}(.,.)$ is defined in Definition 6.

Proof.

Upper bound: Claim 1 implies that an optimal coloring of $\mathcal{G}_{\text{EQ}}$ corresponds to a secure code for $(q_{X_{\text{EQ}}Y},q_{Z|X_{\text{EQ}}Y})$. Now, since expected length of any optimal prefix-free binary encoding of a random variable $V$ is upper-bounded by $H(V)+1$ [44, Theorem 5.4.1], we have that the optimal expected length of the message from Alice to Bob is upper-bounded by $H_{\chi}(\mathcal{G}_{\text{EQ}},X_{\text{EQ}})+1$.

Lower bound: By Claim 1, every secure (randomized) code also corresponds to proper (random) colorings $(c_{\vec{r}})_{\vec{r}}$ of the graph $\mathcal{G}$. Note that the expected length $L(c_{\vec{r}})$ of any coloring $c_{\vec{r}}$ is lower-bounded by $H(c_{\vec{r}}(X))$, which follows from the fact that the expected length of any prefix-free binary code for a random variable $V$ is lower-bounded by $H(V)$ [44, Theorem 5.4.1]. Now, since entropy of any coloring is lower-bounded by $H_{\chi}(\mathcal{G}_{\text{EQ}},X_{\text{EQ}})$, entropy of the optimal coloring, it follows that $\mathbb{E}_{\vec{r}}[L(c_{\vec{r}})]\geq H_{\chi}(\mathcal{G}_{\text{EQ}},X_{\text{EQ}})$. So the expected length of the message is also lower-bounded by $H_{\chi}(\mathcal{G}_{\text{EQ}},X_{\text{EQ}})$. ∎

Remark 9**.**

In perfect security setting, when privacy against Alice is required, any multiple-round protocol can be turned into a single-round protocol without affecting the number of bits communicated. To see this, suppose that a function $(q_{XY},q_{Z|XY})$ is perfectly securely computable in $r$ rounds with privacy against Alice. Then there exists a conditional p.m.f. $p(u_{[1:r]}|x,y,z)$ satisfying (5)-(9) with $Z_{1}=\emptyset$ and $Z_{2}=Z$. Condition (9), i.e., the Markov chain $U_{[1:r]}-X-(Y,Z)$ corresponds to privacy against Alice. This implies the Markov chain $U_{[1:r]}-X-Y$ which in turn implies that the whole transcript generated by a multi-round communication protocol can be simulated by Alice conditioned on her input in a single round.

Multiple Instances. Alice and Bob have $X^{n}$ and $Y^{n}$ as their inputs, respectively, where $(X_{i},Y_{i})\sim q_{XY}$, i.i.d., and Bob wants to compute $Z^{n}$, which should be distributed according to $q_{Z^{n}|X^{n}Y^{n}}(z^{n}|x^{n},y^{n})=\prod_{i=1}^{n}q_{Z|XY}(z_{i}|x_{i},y_{i})$. Computation should be such that no user learns any additional information about other user’s data other than what can be inferred from their own data. It is easy to see that $(q_{X^{n}Y^{n}},q_{Z^{n}|X^{n}Y^{n}})$ is perfectly securely computable with privacy against both users if and only if $(q_{XY},q_{Z|XY})$ is perfectly securely computable with privacy against both users. We can define the graph $\mathcal{G}_{\text{EQ}}^{n}=(\mathcal{X}_{\text{EQ}}^{n},\mathcal{E}_{\text{EQ}}^{n})$ by extending the definition of $\mathcal{G}_{\text{EQ}}$ in a straightforward manner: $\mathcal{X}_{\text{EQ}}^{n}$ is the $n$-fold cartesian product of $\mathcal{X}_{\text{EQ}}$, and $\mathcal{E}_{\text{EQ}}^{n}=\{\{x^{n},x^{\prime n}\}\in\mathcal{X}_{\text{EQ}}^{n}\times\mathcal{X}_{\text{EQ}}^{n}:$ $\exists(y^{n},z^{n})\in\mathcal{Y}^{n}\times\mathcal{Z}^{n}$ s.t. $p_{X_{\text{EQ}}^{n}Y^{n}}(x^{n},y^{n})>0$, $p_{X_{\text{EQ}}^{n}Y^{n}}(x^{\prime n},y^{n})>0$ and $p_{Z^{n}|X_{\text{EQ}}^{n}Y^{n}}(z^{n}|x^{n},y^{n})\neq p_{Z^{n}|X_{\text{EQ}}^{n}Y^{n}}(z^{n}|x^{\prime n},y^{n})\}$. Note that we slightly abused the notation: $\mathcal{X}_{\text{EQ}}^{n}$ is defined to be the $n$-fold cartesian product of $\mathcal{X}_{\text{EQ}}$, but $\mathcal{E}_{\text{EQ}}^{n}$ is not the $n$-fold cartesian product of $\mathcal{E}_{\text{EQ}}$.

We define, analogous to the single instance case, $L_{AB-\text{pvt}-n}^{*}$ to be the optimal amortized expected length of the message that Alice sends to Bob in this setting. The following is a simple corollary of Theorem 7.

Corollary 2**.**

Suppose $(q_{XY},q_{Z|XY})$ is perfectly securely computable with privacy against both users. Then

[TABLE]

Observe that $\mathcal{G}_{\text{EQ}}^{n}$ is neither the and-product nor the or-product of the graph $\mathcal{G}_{\text{EQ}}$; and as far as we know, no single letter expression of $\frac{1}{n}H_{\chi}(\mathcal{G}_{\text{EQ}}^{n},X_{\text{EQ}}^{n})$ (not even of $\lim_{n\to\infty}\frac{1}{n}H_{\chi}(\mathcal{G}_{\text{EQ}}^{n},X_{\text{EQ}}^{n})$) is known. See [43] for definitions of and-product and or-product of graphs.

VI-C Privacy required only against Alice

We now consider the case where privacy only against Alice is required. Note that every $(q_{XY},q_{Z|XY})$ is perfectly securely computable in this case, since Alice may send $X$ to Bob, and Bob, having $Y$ as his input, may output $Z$ according to $q_{Z|XY}$; see Footnote 7 (on page 7) for a discussion on why one-sided communication does not automatically give privacy against Alice. For a given $(q_{XY},q_{Z|XY})$, we define the following characteristic graph $\mathcal{G}=(\mathcal{X},\mathcal{E})$, where the edge set is defined as follows:

[TABLE]

We define optimal expected length of the message, which is defined as $L^{*}_{A-\text{pvt}}:=\min_{(p_{U|X},p_{{Z}|UY})}\mathbb{E}[L(U)]$, where $L(U)$ denotes the random variable corresponding to the length of $U$ in bits, and minimization is taken over all $(p_{U|X},p_{{Z}|UY})$ that perfectly securely computes $(q_{XY},q_{Z|XY})$ with privacy against Alice. Then, the following upper and lower bounds hold.

Theorem 8**.**

For any $(q_{XY},q_{Z|XY})$,

$H_{\chi}(\mathcal{G},X)\leq L^{*}_{A-\emph{pvt}}<H_{\chi}(\mathcal{G},X)+1$,

where chromatic entropy $H_{\chi}(.,.)$ is defined in Definition 6.

Proof.

We first show that every proper coloring of the vertices of $\mathcal{G}$ corresponds to a perfectly secure code for $(q_{XY},q_{Z|XY})$ with privacy against Alice, and every perfectly secure code for $(q_{XY},q_{Z|XY})$ with privacy against Alice corresponds to a collection of proper colorings of the vertices of $\mathcal{G}$. This can be proved along the lines of the proof of Claim 1. Note that Claim 1 is for privacy against both users, but we did not use privacy against Bob in proving that – because Claim 1 is for $(q_{X_{\text{EQ}}Y},q_{Z|X_{\text{EQ}}Y})$, and when we transform our problem from $(q_{XY},q_{Z|XY})$ to $(q_{X_{\text{EQ}}Y},q_{Z|X_{\text{EQ}}Y})$, privacy against Bob becomes redundant. Now, Theorem 8 can be proved along the lines of the proof of Theorem 7. ∎

Note that Remark 9 holds verbatim here also, i.e., the above results hold for the multiple-round communication model as well.

Multiple Instances. The setting is analogous to the multiple instances setting described before, except that we do not require privacy against Bob. Note that we want to securely compute $(q_{X^{n}Y^{n}},q_{Z^{n}|X^{n}Y^{n}})$ with privacy against Alice, where $(X_{i},Y_{i})$’s are i.i.d. according to $q_{XY}$ and $q_{Z^{n}|X^{n}Y^{n}}$ is in product form, i.e., $q_{Z^{n}|X^{n}Y^{n}}(z^{n}|x^{n},y^{n})=\prod_{i=1}^{n}q_{Z|XY}(z_{i}|x_{i},y_{i})$. Similar to the way we defined $\mathcal{G}_{EQ}^{n}$, we can define the graph $\mathcal{G}^{n}=(\mathcal{X}^{n},\mathcal{E}^{n})$ by extending the definition of $\mathcal{G}$ analogously: $\mathcal{E}^{n}=\{\{x^{n},x^{\prime n}\}\in\mathcal{X}^{n}\times\mathcal{X}^{n}:$ $\exists(y^{n},z^{n})\in\mathcal{Y}^{n}\times\mathcal{Z}^{n}$ s.t. $q_{X^{n}Y^{n}}(x^{n},y^{n})>0$, $q_{X^{n}Y^{n}}(x^{\prime n},y^{n})>0$ and $q_{Z^{n}|X^{n}Y^{n}}(z^{n}|x^{n},y^{n})\neq q_{Z^{n}|X^{n}Y^{n}}(z^{n}|x^{\prime n},y^{n})\}$. We define, analogous to the single instance case, $L_{A-\text{pvt}-n}^{*}$ to be the optimal amortized expected length of the message that Alice sends to Bob in this setting. The following is a simple corollary of Theorem 8.

Corollary 3**.**

Suppose $(q_{XY},q_{Z|XY})$ is perfectly securely computable with privacy against both users. Then

[TABLE]

Observe that $\mathcal{G}^{n}$ is neither the and-product nor the or-product of the graph $\mathcal{G}_{\text{EQ}}$; and as far as we know, no single letter expression of $\frac{1}{n}H_{\chi}(\mathcal{G}_{\text{EQ}}^{n},X_{\text{EQ}}^{n})$ (not even of $\lim_{n\to\infty}\frac{1}{n}H_{\chi}(\mathcal{G}_{\text{EQ}}^{n},X_{\text{EQ}}^{n})$) is known.

VI-D Privacy required only against Bob

Next, we consider the case where privacy only against Bob is required. It turns out that not all $(q_{XY},q_{Z|XY})$ are securely computable in this setting.999For example, consider secure computation of the and function: Alice and Bob have binary inputs $X$ and $Y$, respectively, and Bob wants to securely compute and($X,Y$), the logical and of the two input bits. Suppose that all the four possible input pairs can occur with non-zero probability. If Bob’s input is 0 (which means that output is always 0), Alice’s message cannot distinguish whether her input is 0 or 1, otherwise privacy against Bob will be compromised. On the other hand, if Bob’s input is 1 (which means that output is always equal to $X$), Alice’s message must distinguish whether her input is 0 or 1. Now, since Alice does not know Bob’s input (because there is only one-way communication), Alice cannot send a message without violating either correctness or privacy against Bob. First we explicitly characterize $(q_{XY},q_{Z|XY})$ that are perfectly securely computable with privacy against Bob, where $q_{XY}$ has full support. None of the proofs in this section depends on the specific distribution of $q_{XY}$ as long as it has full support. So the characterization remains the same for all $q_{XY}$ that have full support.

For every $y\in\mathcal{Y}$, define a set $\mathcal{Z}^{(y)}=\{z\in\mathcal{Z}:\exists x\in\mathcal{X}\text{ s.t. }q_{Z|XY}(z|x,y)>0\}$. Essentially, the set $\mathcal{Z}^{(y)}$ discards all those elements of $\mathcal{Z}$ that never appear as an output when Bob’s input is $y$.

Definition 9**.**

For $y\in\mathcal{Y}$, define a relation $\equiv_{y}$ on the set $\mathcal{Z}^{(y)}$ as follows: for $z,z^{\prime}\in\mathcal{Z}^{(y)}$, we say that $z\equiv_{y}z^{\prime}$, if there is a constant $c>0$ such that $q_{Z|XY}(z|x,y)=c\cdot q_{Z|XY}(z^{\prime}|x,y)$ for every $x\in\mathcal{X}$.

It is easy to see that $\equiv_{y}$ is an equivalence relation for every $y\in\mathcal{Y}$, which partitions $\mathcal{Z}^{(y)}$ into equivalent classes. Consider a $y\in\mathcal{Y}$, and let $\mathcal{Z}^{(y)}=\mathcal{Z}_{1}^{(y)}\biguplus\mathcal{Z}_{2}^{(y)}\biguplus\ldots\biguplus\mathcal{Z}_{k(y)}^{(y)}$, where $k(y)$ is the number of equivalence classes in the partition generated by $\equiv_{y}$. For every equivalence class $\mathcal{Z}_{i}^{(y)}$ in this partition, define a $|\mathcal{X}|\times|\mathcal{Z}_{i}^{(y)}|$ matrix $A_{i}^{(y)}$ such that $A_{i}^{(y)}(x,z)=q_{Z|XY}(z|x,y)$ for every $(x,z)\in\mathcal{X}\times\mathcal{Z}_{i}^{(y)}$. Note that, for every $i\in[k(y)]$, all the columns of $A_{i}^{(y)}$ are multiples of each other. Since $A_{i}^{(y)}$ is a rank-one matrix, we can write it as $A_{i}^{(y)}=\vec{\alpha}_{i}^{(y)}\vec{\gamma}_{i}^{(y)}$, where $\vec{\alpha}_{i}^{(y)}$ is a column vector (whose entries are non-negative and sum up to one, which makes it a unique probability vector) and $\vec{\gamma}_{i}^{(y)}$ is a row vector. Entries of $\vec{\alpha}_{i}^{(y)}$ and $\vec{\gamma}_{i}^{(y)}$ are indexed by $x\in\mathcal{X}$ and $z\in\mathcal{Z}_{i}^{(y)}$, respectively. So $A_{i}^{(y)}(x,z)=\vec{\alpha}_{i}^{(y)}(x)\vec{\gamma}_{i}^{(y)}(z)$. Note that if $\vec{\alpha}_{i}^{(y)}=\vec{\alpha}_{j}^{(y)}$, then $i=j$.

Suppose $(q_{XY},q_{Z|XY})$ is perfectly securely computable with privacy against Bob. This implies that there exists a pair of encoder and decoder $(p_{U|X},p_{{Z}|UY})$, which induces the joint distribution $p_{XYU{Z}}=q_{XY}p_{U|X}p_{{Z}|UY}$, that satisfies correctness (i.e., $p_{XY{Z}}=q_{XY}q_{Z|XY}$) and privacy against Bob (i.e., the Markov chain $U-(Y,{Z})-X$ holds). Note that the random variable $U$ corresponds to the message that Alice sends to Bob. We define a set $\mathcal{U}_{i}^{(y)}$ to be the set of all those messages that Alice can send to Bob, and when Bob, having $y$ as his input outputs an element of $\mathcal{Z}_{i}^{(y)}$, as follows:

[TABLE]

Note that for every $y\in\mathcal{Y}$ and $i\in[1:k(y)]$, the probability vector $\vec{\alpha}_{i}^{(y)}$ corresponds to the equivalence class $\mathcal{Z}_{i}^{(y)}$. The following claim is proved in Appendix H.

Claim 2**.**

Consider any $y,y^{\prime}\in\mathcal{Y}$ and $i\in[1:k(y)]$, $j\in[1:k(y^{\prime})]$. If $\vec{\alpha}_{i}^{(y)}\neq\vec{\alpha}_{j}^{(y^{\prime})}$, then $\mathcal{U}_{i}^{(y)}\cap\mathcal{U}_{j}^{(y^{\prime})}=\phi$.

With the help of Claim 2 we can show that for every $y,y^{\prime}\in\mathcal{Y}$, the corresponding collections of probability vectors $\{\vec{\alpha}_{i}^{(y)}:i\in[1:k(y)]\}$ and $\{\vec{\alpha}_{j}^{(y^{\prime})}:j\in[1:k(y^{\prime})]\}$ are equal. The following claim is proved in Appendix H.

Claim 3**.**

For all $y,y^{\prime}\in\mathcal{Y}$, we have the following:

$k(y)=k(y^{\prime})$. 2. 2.

$\{\vec{\alpha}_{1}^{(y)},\vec{\alpha}_{2}^{(y)},\ldots,\vec{\alpha}_{k}^{(y)}\}=\{\vec{\alpha}_{1}^{(y^{\prime})},\vec{\alpha}_{2}^{(y^{\prime})},\ldots,\vec{\alpha}_{k}^{(y^{\prime})}\}$, where $k=k(y)$ for any $y\in\mathcal{Y}$.

For ease of notation, without loss of generality, we rearrange the indices, to have $\vec{\alpha}_{j}^{(y^{\prime})}=\vec{\alpha}_{i}^{(y)}$ if and only if $i=j$. Now it follows from Claim 2 and Claim 3 that the message set $\mathcal{U}$ and the alphabet $\mathcal{Z}^{(y)}$, for every $y\in\mathcal{Y}$, can be partitioned into $k$ parts as follows:

[TABLE]

where $\mathcal{Z}_{i}^{(y)}=\{z\in\mathcal{Z}^{(y)}:p(u,z|x,y)>0\text{ for some }x\in\mathcal{X},u\in\mathcal{U}_{i}\}$. Note that the same $\mathcal{U}_{i}$ is used to define $\mathcal{Z}_{i}^{(y)}$ (and corresponds to $\vec{\alpha}_{i}^{(y)}$ also) for every $y\in\mathcal{Y}$. Now we can state the characterization theorem, which is proved in Appendix I.

Theorem 9**.**

Suppose $q_{XY}$ has full support. Then $(q_{XY},q_{Z|XY})$ is perfectly securely computable with privacy against Bob if and only if the following holds for every $y,y^{\prime}\in\mathcal{Y}$:

$\{\vec{\alpha}_{1}^{(y)},\vec{\alpha}_{2}^{(y)},\ldots,\vec{\alpha}_{k}^{(y)}\}=\{\vec{\alpha}_{1}^{(y^{\prime})},\vec{\alpha}_{2}^{(y^{\prime})},\ldots,\vec{\alpha}_{k}^{(y^{\prime})}\}$, 2. 2.

For any $i\in[k]$, $\sum_{z\in\mathcal{Z}_{i}^{(y)}}q_{Z|XY}(z|x,y)=\sum_{z\in\mathcal{Z}_{i}^{(y^{\prime})}}q_{Z|XY}(z|x,y^{\prime})$ for every $x\in\mathcal{X}$.

We introduce a new random variable $W$, which takes values in $[k]$, and is jointly distributed with $(X,Y,Z)$ as follows: define $p_{XYWZ}(x,y,i,z):=0$, if $p_{XYZ}(x,y,z)=0$; otherwise, define

[TABLE]

Comments are in order: (i) We defined $p_{W|X}(i|x)$ to be $\sum_{z\in\mathcal{Z}_{i}^{(y)}}q_{Z|XY}(z|x,y)$ in (48) – this is a valid definition because $\sum_{z\in\mathcal{Z}_{i}^{(y)}}q_{Z|XY}(z|x,y)$ is same for all $y$ (see Theorem 9). (ii) We defined $p_{Z|WY}(z|i,y)$ to be $\mathbbm{1}_{\{z\in\mathcal{Z}_{i}^{(y)}\}}\times\frac{q_{Z|XY}(z|x,y)}{\sum_{z\in\mathcal{Z}_{i}^{(y)}}q_{Z|XY}(z|x,y)}$ in (48) – this is also a valid definition because the matrix $A_{i}^{(y)}$ defined earlier is a rank-one matrix, and therefore, $\frac{q_{Z|XY}(z|\tilde{x},y)}{\sum_{z\in\mathcal{Z}_{i}^{(y)}}q_{Z|XY}(z|\tilde{x},y)}$ is same for all $\tilde{x}$’s for which $q_{Z|XY}(z|\tilde{x},y)>0$. It follows from (48) that $p_{XYWZ}(x,y,i,z)=\mathbbm{1}_{\{z\in\mathcal{Z}_{i}^{(y)}\}}\times q_{XYZ}(x,y,z)$. Note that $W$ is a deterministic function of both $U$ as well as of $(Y,Z)$. Now we are ready to prove upper and lower bounds on optimal expected length of the message, which is defined as $L^{*}_{B-\text{pvt}}:=\min_{(p_{U|X},p_{{Z}|UY})}\mathbb{E}[L(U)]$, where $L(U)$ denotes the random variable corresponding to the length of $U$ in bits, and minimization is taken over all $(p_{U|X},p_{{Z}|UY})$ that perfectly securely computes $(q_{XY},q_{Z|XY})$ with privacy only against Bob.

Theorem 10**.**

Suppose $(q_{XY},q_{Z|XY})$ is perfectly securely computable with privacy against Bob, where $q_{XY}$ has full support. Then

[TABLE]

Proof.

$L^{*}_{B-\text{pvt}}\geq H(W)$: Fix an arbitrary pair of encoder and decoder $(p_{U|X},p_{{Z}|UY})$ that perfectly securely computes this $(q_{XY},q_{Z|XY})$ with privacy against Bob, i.e., the induced joint distribution $p_{XYU{Z}}=q_{XY}p_{U|X}p_{{Z}|UY}$ satisfies correctness (i.e., $q_{XY{Z}}=q_{XY}q_{Z|XY}$) and privacy against Bob (i.e., $U-(Y,{Z})-X$ is a Markov chain). Fix a prefix-free encoding of $U$. Let $L$ denote the random variable corresponding to the length of this prefix-free encoding of $U$. We show that $\mathbb{E}[L]\geq H(W)$ in Appendix I in two steps. For this, first we show that $\mathbb{E}[L]\geq\mathbb{E}[L^{\prime}]$, where $L^{\prime}$ is the random variable corresponding to a prefix-free binary encoding of $W$ that we extract out from $L$. Then we use $\mathbb{E}[L^{\prime}]\geq H(W)$, which follows from the fact that the expected length of any prefix-free binary code for a random variable $W$ is lower bounded by $H(W)$  [44, Theorem 5.4.1]. Since this argument holds for any prefix-free encoding of $U$, we have $L^{*}_{B-\text{pvt}}\geq H(W)$.

$L^{*}_{B-\text{pvt}}<H(W)+1$: We need to show a pair of encoder and decoder $(p_{U|X},p_{{Z}|UY})$ that perfectly securely computes this $(q_{XY},q_{Z|XY})$ with privacy against Bob, i.e., the induced joint distribution $p_{XYU{Z}}=q_{XY}p_{U|X}p_{{Z}|UY}$ satisfies correctness (i.e., $p_{XY\hat{Z}}=q_{XY}q_{Z|XY}$) and privacy against Bob (i.e., $U-(Y,{Z})-X$ is a Markov chain). Note that $U=W$ is a valid choice, where $p_{XYWZ}$ is described in (48). The expected length of an optimal prefix-free binary code of $W$ is upper-bounded by $H(W)+1$ [44, Theorem 5.4.1], which implies that $L^{*}_{B-\text{pvt}}<H(W)+1$. ∎

We conclude the single instance part of this section by giving an example where common randomness helps to improve the optimal rate, when privacy is required only against Bob (as mentioned in Section VI-A).

Example 5**.**

Let $X$ be an $m$-length ($m>1$) vector of mutually independent and uniform binary random variables, $X=(X_{1},\dots,X_{m})$ and $Y=\emptyset$. Also, let $Z=(J,X_{J})$, where $J$ is a random variable uniformly distributed on $[1:m]$. This defines a function $(q_{XY},q_{Z|XY})$.

First we calculate the lower bound of $L^{*}_{B-\text{pvt}}$ for this example from the discussion about random variable $W$ above Theorem 10. It follows from (48) that $p_{XYWZ}(x,y,i,z)=\mathbbm{1}_{\{z\in\mathcal{Z}_{i}^{(y)}\}}\times q_{XYZ}(x,y,z)$. Marginalizing this over $x$ and using the fact that $Y=\emptyset$, we get, $p_{W,Z}(i,z)=\mathbbm{1}_{\{z\in\mathcal{Z}_{i}\}}q_{Z}(z)$. From the Definition 9, it is clear that $\mathcal{Z}_{i}$ is a singleton set for every $i\in[1:|\mathcal{Z}|]$. Now, fix an $i$ and marginalize $p_{W,Z}(i,z)$ over $z$, we get $p_{W}(i)=q_{Z}(z)$, such that $\mathcal{Z}_{i}=\{z\}$. Then we have $p_{W}(i)=\frac{1}{2m}$ since $q_{Z}(z)=\frac{1}{2m}$ for every $z$. This implies that $H(W)=\log 2m$. So, from Theorem 10 we have $L^{*}_{B-\text{pvt}}\geq\log 2m>1$. Whereas it turns out that a rate of $1$ is achievable when we use common randomness. To see this, let $W$ be a random variable uniformly distributed on $[1:m]$. Alice on seeing $W$ sends $X_{W}$ to Bob using only $1$ bit and Bob outputs $(W,X_{W})$ since it already has access to $W$. It is easy to see that this protocol satisfies privacy against Bob. Thus, common randomness helps to improve the optimal rate, when privacy is required only against Bob.

Multiple Instances. The setting is analogous to the multiple instances setting described before, except that we require privacy against Bob here. We define, analogous to the single instance case, $L_{B-\text{pvt}-n}^{*}$ to be the optimal amortized expected length of the message that Alice sends to Bob in this setting. We give bounds on $L^{*}_{B-\text{pvt}-n}$ for the case when $q_{XY}$ has full support; and we leave it open to give a tight bound on $L^{*}_{B-\text{pvt}-n}$ for general input distribution. The following is a simple corollary of Theorem 10.

Corollary 4**.**

Suppose $(q_{XY},q_{Z|XY})$ is perfectly securely computable with privacy against Bob, where $q_{XY}$ has full support. Then

[TABLE]

VII Discussion

We studied asymptotically secure two-user interactive function computation and gave single-letter characterizations of feasibility and rate region. Our characterization shows that asymptotically secure computability is equivalent to perfectly secure computability. In the multi-terminal setting, the communication graph plays an important role. Recently, Narayanan and Prabhakaran [45] characterized communication graphs which allow perfectly secure computability of all functions among a subset of users. This generalizes the results of Ben-Or, Goldwasser, and Wigderson [33] and Chaum, Crépeau, and Damgård [34] for complete communication graphs. Since the impossibility results in these works rely on a reduction of two-party secure computation, the same characterizations should hold for asymptotically secure computation.

However, characterizing functions which are securely computable given a communication graph remains open. As we saw in Remark 2, for the multi-terminal case, impossibility of perfectly secure computation need not imply the impossibility of asymptotically secure computation. Indeed, even for perfectly securely computation, the problem remains largely open [46, 47]. Finding a single-letter characterization for feasibility of asymptotically secure function computation among three or more terminals would indeed be interesting.

We confined our attention to the case where the users have access to only private and common randomness. As mentioned earlier, it is well-known that all functions are securely computable if the users have access to non-trivially correlated random variables or non-trivial noisy channels (see [26, 27]). Characterizing the rates of communication and stochastic resources needed would be an interesting direction of study. For obtaining the string oblivious transfer using a noisy channel, results on optimal rates of channel use have been found [48, 49, 50]. We only considered honest-but-curious users. In the malicious setting, where a corrupt user may arbitrarily deviate from the protocol, Maji et al. [51] characterized prefectly securely computable functions. Studying feasibility and rate region for asymptotically secure computation in the malicious setting is another direction of interest.

We required that each user may obtain no (or only negligible) information about the other user’s input and output except for what can be inferred from its own input and output. However, this may be too stringent in certain settings where only certain attributes of the data need to be kept private (see, e.g., [52, 53]). Studying such problems under the framework of this paper is another possible direction of future work.

Acknowledgement

We thank the reviewers for their useful comments which helped improve the manuscript. Deepesh Data was supported by a Microsoft Research India Ph.D. Fellowship. G. R. Kurri was supported by a travel fellowship from the Sarojini Damodaran Foundation. J. Ravi was supported by European Research Council (ERC) under the European Union’s Horizon 2020 research and innovation programme (grant agreement number 714161). V. M. Prabhakaran was supported in part by a Ramanujan Fellowship from the Department of Science and Technology, Government of India and by Information Technology Research Academy (ITRA), Government of India under ITRA Mobile grant ITRA/15(64)/Mobile/USEAADWN/01. G. R. Kurri and V. M. Prabhakaran are supported in part by the Department of Science and Technology, Government of India, under an Indo-Israel grant DST/INT/ISR/P-16/2017. We acknowledge support of the Department of Atomic Energy, Government of India, under project no. 12-R&D-TFR-5.01-0500.

Appendix A Proofs of Theorems 1, 2 & 3

Notation: We use capital letter to denote a random pmf (see e.g., works [54], [42]), e.g. $P_{X}$. For any two sequences of random p.m.f.’s $P_{X}^{(n)}$ and $Q_{X}^{(n)}$ on $\mathcal{X}^{(n)}$ (where $\mathcal{X}^{(n)}$ is arbitrary and can differ from the cartesian product $\mathcal{X}^{n}$), we write $P_{X^{(n)}}\overset{\epsilon}{\approx}Q_{X^{(n)}}$ if $\mathbbm{E}\lVert P_{X^{(n)}}-Q_{X^{(n)}}\rVert_{1}<\epsilon$. For any two sequences of random p.m.f.’s $P_{X^{(n)}}$ and $Q_{X^{(n)}}$ on $\mathcal{X}^{(n)}$, we write $P_{X^{(n)}}\approx Q_{X^{(n)}}$ if $\lim_{n\rightarrow\infty}\mathbbm{E}\lVert P_{X^{(n)}}-Q_{X^{(n)}}\rVert_{1}=0$.

We prove Theorem 2 first and then prove Theorems 1 & 3.

Proof of Theorem 2.

Achievability: The proof is broadly along the lines of the proof of interactive channel simulation of Yassaee et al. [21]. We consider two protocols, protocol A and protocol B, where Protocol A corresponds to the source coding side of the problem and Protocol B corresponds to our original problem (with extra shared random variables, one for each round). Each of these protocols will induce a p.m.f. on random variables defined during the protocol. We impose a series of constraints (independence constraints and constraints for the reliability of SW decoders) as done in [21, Theorem 1] so that these two distributions become almost identical. Once we find such constraints making protocol A almost identical to protocol B, we investigate the correctness and privacy properties in addition to eliminating the extra shared randomness. The main difference with the achievability of channel simulation [21] is from (61)-(62) onwards where the requirement of privacy becomes relevant.

We start from source coding side of the problem by fixing a distribution $p(u_{[1:r]},x,y,z_{[1:2]})$ satisfying (5)-(10). Let $(U_{[1:r]}^{n},X^{n},Y^{n},Z_{[1:2]}^{n})$ be i.i.d. with distribution $p(u_{[1:r]},x,y,z_{[1:2]})$. Messages $M_{i}$, extra shared randomness $F_{i}$ and the actual shared randomness $w$ are created as bin indices of $U_{[1:r]}^{n}$ in the following way: random variables $F_{1},M_{1},w$ are three independent bin indices of $U_{1}^{n}$. $F_{i}$ and $M_{i}$ are two independent bin indices of $(U_{1}^{n},\dots,U_{i}^{n})$ for $i\in[2:r]$. The alphabets of $F_{i}$, $M_{i}$ and $w$ are $[1:2^{n\hat{R}_{i}}]$, $[1:2^{nR_{i}}]$ and $[1:2^{nR_{0}}]$ respectively. Furthermore, we consider Slepian-Wolf decoders, for odd $i\in[1:r]$, for reconstructing $\hat{U}_{i}^{n}$ (an estimate of $U_{i}^{n}$) from $(U_{[1:i-1]}^{n},F_{i},M_{i},w,Y^{n})$ and for even $i\in[1:r]$, for reconstructing $\hat{U}_{i}^{n}$ from $(U_{[1:i-1]}^{n},F_{i},M_{i},w,X^{n})$. Note that the reliability and independence constraints would remain exactly the same as that of [21, Theorem 1] which are given by

• •

Independence constraints:

[TABLE]

• •

Constraints for the reliability of SW decoders:

[TABLE]

Intuitively, one can understand the above constraints in the following way: Using the OSRB theorem [54, Theorem 1] and noting that $U_{1}-X-Y$, the first independence constraint $\eqref{eqn1:IND1}$ ensures that $(F_{1},w)$ are nearly uniformly distributed and mutually independent of $(X^{n},Y^{n})$. Similarly, noting that $U_{i}-(U_{[1:i-1]},X)-Y,\text{if}\ i\ \text{is odd}$ and $U_{i}-(U_{[1:i-1]},Y)-X,\text{if}\ i\ \text{is even}$, the independence constraints $\eqref{eqn1:IND2}-\eqref{eqn1:IND3}$ ensure that $F_{i}$ is nearly uniformly distributed and independent of $(X^{n},Y^{n},U_{[1:i-1]}^{n})$ for $i\in[2:r]$. The last independence constraint ensures that $F_{[1:r]}$ is nearly independent of $(X^{n},Y^{n},Z^{n}_{[1:2]})$, which helps in eliminating the extra shared randomness. Note that $\hat{U}_{1}^{n}$ is reconstructed from $F_{1},M_{1},w$ and $Y^{n}$, where $F_{1},M_{1}$ and $w$ are the random bin indices of $U_{1}^{n}$ created by Alice, and Bob requires a rate of $H(U_{1}|Y)$ from Alice to recover $U_{1}^{n}$. This corresponds to the first SW constraint $\eqref{eqn1:SW1}$. The other SW constraints $\eqref{eqn1:SW2}-\eqref{eqn1:SW3}$ are similar with $U_{i}^{n}$ being reconstructed from $F_{i},M_{i},U_{[1:i-1]}^{n}$ and $X^{n}$ or $Y^{n}$, where $F_{i},M_{i}$ are the random bin indices of $U_{[1:i]}^{n}$ for $i\in[2:r]$. Thus (49)-(55) guarantee us the following:

[TABLE]

[TABLE]

It follows from $\eqref{eqn1:1}$ and $\eqref{eqn1:2}$ that

[TABLE]

where the expectation is taken over random binning. This implies that there exists a particular realization of the random binning with the corresponding p.m.f. $p$ so that we can replace $P$ with $p$ and denote the resulting p.m.f.’s for protocols A and B respectively with $p$ and $\hat{p}$, then

[TABLE]

[TABLE]

(59) alone was sufficient for channel simulation [21] as correctness was the only consideration there, but we need to utilize (60) also in order to account for privacy. We do this with the help of the following claim. From $\eqref{eqn1:3}$ and $\eqref{eqn1:4}$, we claim that there exists $f^{*}_{[1:r]}$ such that $p(f^{*}_{[1:r]})>0$ and

[TABLE]

[TABLE]

To see this, first we rewrite $\eqref{eqn1:3}$ and $\eqref{eqn1:4}$ as

[TABLE]

[TABLE]

where $\epsilon_{n}\rightarrow 0$ and $\delta_{n}\rightarrow 0$ as $n\rightarrow\infty$.

Note that $\hat{p}(f_{[1:r]})=p^{\text{Unif}}(f_{[1:r]})$ and $\eqref{eqn1:3`}$ implies that $p(f_{[1:r]})\overset{\epsilon_{n}}{\approx}p^{\text{Unif}}(f_{[1:r]})$. Now, using these it is easy to see that $\eqref{eqn1:3`}$ and $\eqref{eqn1:4`}$ imply

[TABLE]

[TABLE]

$\eqref{eqn1:7}$ and $\eqref{eqn1:8}$, respectively, imply

[TABLE]

[TABLE]

Adding $\eqref{eqn1:9}$ and $\eqref{eqn1:10}$ imply that there exists an instance $f^{*}_{[1:r]}$ such that $p(f^{*}_{[1:r]})>0$ and

[TABLE]

[TABLE]

This proves the claim made in $\eqref{eqn1:5}-\eqref{eqn1:6}$. Marginalizing away $m_{[1:r]}$ and $w$ from $\eqref{eqn1:6}$ and using $\eqref{eqn1:5}$ gives us correctness, $\hat{p}(x^{n},y^{n},z_{[1:2]}^{n}|f^{*}_{[1:r]})\approx p(x^{n},y^{n},z_{[1:2]}^{n})$.

For privacy, we first show that $p(x^{n},y^{n},z_{[1:2]}^{n},m_{[1:r]},w,f_{[1:r]})=p(x^{n},y^{n},z_{[1:2]}^{n})p(m_{[1:r]},w,f_{[1:r]}|x^{n},z_{1}^{n})$.

[TABLE]

where (69) follows from the fact that $p(u_{[1:r]},x,y,z_{[1:2]})$ satisfies the Markov chain $U_{[1:r]}-(X,Z_{1})-(Y,Z_{2})$. Thus, we have

[TABLE]

where $f^{*}_{[1:r]}$ is fixed in $\eqref{eqn1:5}$.

Similarly, it can be proved that $I(M_{[1:r]},W;X^{n},Z_{1}^{n}|Y^{n},Z_{2}^{n})|_{p(x^{n},y^{n},z_{[1:2]}^{n},m_{[1:r]},w|f^{*}_{[1:r]})}=0$ since $p(u_{[1:r]},x,y,z_{[1:2]})$ satisfies the Markov chain $U_{[1:r]}-(Y,Z_{2})-(X,Z_{1})$ also. Now, we have

[TABLE]

Since mutual information is a continuous function of the probability distribution, $\eqref{eqn1:cont1}-\eqref{eqn1:cont3}$ imply

[TABLE]

using the following: if two random variables $A$ and $A^{\prime}$ with same support set $\mathcal{A}$ satisfy $||p_{A}-p_{A^{\prime}}||_{1}\leq\epsilon\leq 1/4$, then it follows from [44, Theorem 17.3.3] that $|H(A)-H(A^{\prime})|\leq\eta\log|\mathcal{A}|$, where $\eta\rightarrow 0$ as $\epsilon\rightarrow 0$. Finally, eliminating $(\hat{R}_{1},\dots\hat{R}_{r})$ and $({R}_{1},\dots R_{r})$ by applying Fourier-Motzkin elimination to (49)-(55) along with $R_{12}=\sum_{i:\text{odd}}R_{i}$, $R_{21}=\sum_{i:\text{even}}R_{i}$, gives $\mathcal{R}^{AB-\text{pvt}}_{A}(r)$ by noticing that

[TABLE]

This is because,

[TABLE]

where (76) follows from (8), and (77) follows from (10).

Similarly, we can show that $I(Y;U_{[1:r]}|X)=I(Y;Z_{1}|X)$. Also,

[TABLE]

where (78) follows from (9), (79) follows from (8), and (80) follows from (10). This completes the achievability proof of the theorem.

Converse: Suppose a rate triple $(R_{0},R_{12},R_{21})$ is achievable with privacy against both Alice and Bob. Then, there exists a sequence of $(n,R_{0},R_{12},R_{21})$ protocols such that for every $\epsilon>0$, there exists a large enough $n$ such that

[TABLE]

Fix an $\epsilon\in(0,\frac{1}{4}]$. Let $T$ be a random variable uniformly distributed on $[1:n]$ and independent of all other random variables. Define $U_{j}:=(M_{j},W,X^{T+1:n},Y^{1:T-1},T)$, for $1\leq j\leq r$, and $X:=X_{T},Y:=Y_{T},Z_{1}:=Z_{1T},Z_{2}:={Z_{2T}}$. First, we show that this choice of auxiliary random variables satisfies the privacy conditions by single-letterizing (82) and (83). Privacy condition against Alice $\eqref{Eq_Conv_Markov1}$ implies that

[TABLE]

where (84)-(86) follow from the following fact: if two random variables $A$ and $A^{\prime}$ with same support set $\mathcal{A}$ satisfy $||p_{A}-p_{A^{\prime}}||_{1}\leq\epsilon\leq 1/4$, then it follows from [44, Theorem 17.3.3] that $|H(A)-H(A^{\prime})|\leq\eta\log|\mathcal{A}|$, where $\eta\rightarrow 0$ as $\epsilon\rightarrow 0$. In (87), $\delta:=\epsilon_{1}+\epsilon_{2}+\epsilon_{3}$ and $\delta\rightarrow 0$ as $\epsilon\rightarrow 0$.

Privacy condition against Bob $\eqref{Eq_Conv_Markov2}$ implies that

[TABLE]

where (88) follows from the chain rule, $H(A^{n})=\sum_{i=1}^{n}H(A_{i}|A^{i+1:n})$ and (89)-(92) follow due to the same reasons as that of (84)-(87) with $\delta^{\prime}:=\epsilon_{1}^{\prime}+\epsilon_{2}^{\prime}+\epsilon_{3}^{\prime}$ so that, $\delta^{\prime}\rightarrow 0$ as $\epsilon\rightarrow 0$.

It can be shown along similar lines as [21, Theorem 1] that

[TABLE]

for conditional p.m.f. $p(u_{[1:r]},z_{1},z_{2}|x,y)$ satisfying

[TABLE]

where $g(\epsilon)\rightarrow 0$ as $\epsilon\rightarrow 0$.

So, we have shown that $(R_{0},R_{12},R_{21})\in\mathcal{S}_{\epsilon}(r)$ for every $\epsilon>0$, where $\mathcal{S}_{\epsilon}(r)$ is defined to be the set of all non-negative rate triples $(R_{0},R_{12},R_{21})$ for which there exists a p.m.f. $p(u_{[1:r]},x,y,z_{[1:2]})$ such that

[TABLE]

where $g(\epsilon),h_{1}(\epsilon)$ and $h_{2}(\epsilon)\rightarrow 0$ as $\epsilon\rightarrow 0$.

Now we argue that imposing the cardinality bounds $|\mathcal{U}_{1}|\leq|\mathcal{X}||\mathcal{Y}||\mathcal{Z}_{1}||\mathcal{Z}_{2}|+5$, $|\mathcal{U}_{i}|\leq|\mathcal{X}||\mathcal{Y}||\mathcal{Z}_{1}||\mathcal{Z}_{2}|\prod_{j=1}^{i-1}|\mathcal{U}_{j}|+4$, $\forall i>1$ on the p.m.f. does not alter the set $\mathcal{S}_{\epsilon}(r)$. The argument is along similar lines as [21, Appendix D] which uses the Convex Cover Method [55, Appendix C]. The alphabet $\mathcal{U}_{1}$ should have $|\mathcal{X}||\mathcal{Y}||\mathcal{Z}_{1}||\mathcal{Z}_{2}|-1$ elements to preserve the joint distribution $p_{X,Y,Z_{1},Z_{2}}$, which in turn preserves $H(X|Y)$, $H(Y|X)$, $H(Z_{1},Z_{2}|X,Y)$, $H(Y,Z_{2}|X,Z_{1})$, $H(X,Z_{1}|Y,Z_{2}),$ and 6 more elements to preserve $H(X|U_{[1:r]},Y)$, $H(Y|U_{[1:r]},X)$, $H(Z_{1},Z_{2}|U_{1},X,Y)$, $H(Z_{1},Z_{2}|U_{[1:r]},X,Y)$, $H(Y,Z_{2}|U_{[1:r]},X,Z_{1})$, $H(X,Z_{1}|U_{[1:r]},Y,Z_{2})$. The alphabet $\mathcal{U}_{i}$, $i>1$, should have $|\mathcal{X}||\mathcal{Y}||\mathcal{Z}_{1}||\mathcal{Z}_{2}|\prod_{j=1}^{i-1}|\mathcal{U}_{j}|-1$ elements to preserve the joint distribution $p_{X,Y,Z_{1},Z_{2},U_{[1:i-1]}}$, which in turn preserves $H(X|Y)$, $H(Y|X)$, $H(Z_{1},Z_{2}|X,Y)$, $H(Y,Z_{2}|X,Z_{1})$, $H(X,Z_{1}|Y,Z_{2})$, $H(Z_{1},Z_{2}|U_{1},X,Y),$ and 5 more elements to preserve $H(X|U_{[1:r]},Y)$, $H(Y|U_{[1:r]},X)$, $H(Z_{1},Z_{2}|U_{[1:r]},X,Y)$, $H(Y,Z_{2}|U_{[1:r]},X,Z_{1}),$ and $H(X,Z_{1}|U_{[1:r]},Y,Z_{2}).$

Using the continuity of mutual information and total variation distance in the probability simplex, it can be shown (similar to [21, Lemma 6]) that \bigcap_{\epsilon>0}\mbox{\cal{S}}_{\epsilon}(r) is equal to $\mathcal{R}^{AB-\text{pvt}}_{A}(r)$ by invoking (73)-(75). This concludes the proof of Theorem 2. ∎

Proof of Theorem 1.

Proof of part $(i)$: It is trivial to see the ‘if’ part since (5)-(10) define an $r$-round perfectly secure protocol of blocklength one, i.e., the protocol satisfies (2)-(4) with $n=1$ and $\epsilon=0$. For the ‘only if’ part, it suffices to show that every $(q_{X,Y},q_{Z_{1},Z_{2}|X,Y})$ that is computable with asymptotic security, is also computable with perfect security. Assume that $(q_{X,Y},q_{Z_{1},Z_{2}|X,Y})$ is asymptotically securely computable with privacy against both users. This implies that for every $\epsilon>0$, there exists a large enough $n$ and a protocol $\Pi_{n}$ that satisfies the following conditions:

[TABLE]

Single-letterization as done in the converse of the Theorem 2 implies that for every $\epsilon^{\prime}>0$ (by suitably selecting $\epsilon$ in (99)), there exists a p.m.f. $p(u_{[1:r]},x,y,z_{1},z_{2})$ which satisfies the following conditions.

[TABLE]

For a fixed $(q_{X,Y},q_{Z_{1},Z_{2}|X,Y})$, consider the following set.

[TABLE]

From (100), it is clear that $\mathcal{S}_{\epsilon}$ is non-empty for every $\epsilon>0$. For a monotonically decreasing sequence $\epsilon_{1}>\epsilon_{2}>\dots$ with $\lim_{k\rightarrow\infty}\epsilon_{k}=0$, it is easy to see that $\mathcal{S}_{\epsilon_{1}}\supseteq\mathcal{S}_{\epsilon_{2}}\supseteq\dots$. Now, in order to prove that $(q_{X,Y},q_{Z_{1},Z_{2}|X,Y})$ is computable with perfect security it suffices to show that $\mathcal{S}_{0}$ is non-empty. We show this by first arguing that $\lim_{k\rightarrow\infty}\bigcap_{i=1}^{k}\mathcal{S}_{\epsilon_{k}}$ is non-empty and then proving that $\mathcal{S}_{0}=\lim_{k\rightarrow\infty}\bigcap_{i=1}^{k}\mathcal{S}_{\epsilon_{k}}$. Using the continuity of total variation distance and continuity of mutual information we show below that $\mathcal{S}_{\epsilon}$ is compact (bounded and closed) for every $\epsilon>0$.

Boundedness of $\mathcal{S}_{\epsilon}$: For a given $(q_{X,Y},q_{Z_{1},Z_{2}|X,Y})$, for every $p(u,z_{1},z_{2}|x,y)$ that satisfies (A), it follows from the Convex Cover Method [55, Appendix C] along similar lines as cardinality bounds of part $(i)$ that there exists another p.m.f. $p(u,z_{1},z_{2}|x,y)$ with $|\mathcal{U}_{1}|\leq|\mathcal{X}||\mathcal{Y}||\mathcal{Z}_{1}||\mathcal{Z}_{2}|+1$, $|\mathcal{U}_{i}|\leq|\mathcal{X}||\mathcal{Y}||\mathcal{Z}_{1}||\mathcal{Z}_{2}|\prod_{j=1}^{i-1}|\mathcal{U}_{j}|+1$, $\forall i>1$ satisfying (A). This implies that all the probability vectors $p(u,z_{1},z_{2}|x,y)$ in $\mathcal{S}_{\epsilon}$ are of finite dimension and hence the set $\mathcal{S}_{\epsilon}$ is bounded.

Closedness of $\mathcal{S}_{\epsilon}$: Consider a sequence of p.m.f.’s $p^{(k)}_{U_{[1:r]},Z_{1},Z_{2}|X,Y}$ converging to a p.m.f. $r_{U_{[1:r]},Z_{1},Z_{2}|X,Y}$, where $p^{(k)}_{U_{[1:r]},Z_{1},Z_{2}|X,Y}\in\mathcal{S}_{\epsilon},\forall k\in\mathbbm{N}$. For simplicity, we abbreviate $p^{(k)}_{U_{[1:r]},Z_{1},Z_{2}|X,Y}$ and $r_{U_{[1:r]},Z_{1},Z_{2}|X,Y}$ by $p^{(k)}$ and $r$ respectively. Since mutual information is a continuous function of the distribution, it follows from the definition of the continuous function that $I_{p^{(k)}}(U_{[1:r]};X,Z_{1}|Y,Z_{2})$ converges to $I_{r}(U_{[1:r]};X,Z_{1}|Y,Z_{2})$ as $p^{(k)}$ converges to $r$. Now since $I_{p^{(k)}}(U_{[1:r]};X,Z_{1}|Y,Z_{2})\leq\epsilon$, $\forall k\in\mathbbm{N}$, it follows by taking limit $k\rightarrow\infty$ on both sides, that $I_{r}(U_{[1:r]};X,Z_{1}|Y,Z_{2})\leq\epsilon$. Similarly we can prove that $I_{r}(U_{[1:r]};Y,Z_{2}|X,Z_{1})\leq\epsilon$. Since $l_{1}$-norm is also a continuous function, $\lVert r_{X,Y,Z_{1},Z_{2}}-q_{X,Y,Z_{1},Z_{2}}\rVert_{1}\leq\epsilon$ also follows similarly. So, we have $r\in\mathcal{S}_{\epsilon}$ and hence $\mathcal{S}_{\epsilon}$ is closed.

By Cantor’s intersection theorem, which states that a decreasing nested sequence of non-empty compact sets has non-empty intersection, we have that $\lim_{k\rightarrow\infty}\bigcap_{i=1}^{k}\mathcal{S}_{\epsilon_{k}}$ is non-empty. To show $\mathcal{S}_{0}=\lim_{k\rightarrow\infty}\bigcap_{i=1}^{k}\mathcal{S}_{\epsilon_{k}}$, note that $\mathcal{S}_{0}\subseteq\lim_{k\rightarrow\infty}\bigcap_{i=1}^{k}\mathcal{S}_{\epsilon_{k}}$ holds trivially because $\mathcal{S}_{\epsilon}$ shrinks as $\epsilon$ shrinks. For the other direction, assume that $\gamma_{U_{[1:r]},Z_{1},Z_{2}|X,Y}\in\lim_{k\rightarrow\infty}\bigcap_{i=1}^{k}\mathcal{S}_{\epsilon_{k}}$. For simplicity, we abbreviate $\gamma_{U_{[1:r]},Z_{1},Z_{2}|X,Y}$ by $\gamma$ in the following. Since $\gamma\in\mathcal{S}_{\epsilon_{k}}$, $\forall k$, we have $I(U_{[1:r]};X,Z_{1}|Y,Z_{2})\leq\epsilon_{k}$, $\forall k\in\mathbb{N}$. Now since $\lim_{k\rightarrow\infty}\epsilon_{k}=0$ and mutual information is always non-negative, we have $I_{\gamma}(U_{[1:r]};X,Z_{1}|Y,Z_{2})=0$. Similarly, we can prove that $I_{\gamma}(U_{[1:r]};Y,Z_{2}|X,Z_{1})=0$ and $\lVert p_{X,Y,Z_{1},Z_{2}}-q_{X,Y,Z_{1},Z_{2}}\rVert_{1}|_{\gamma}=0$. The latter conclusion implies that $\gamma_{X,Y,Z_{1},Z_{2}}=q_{X,Y,Z_{1},Z_{2}}$. This shows that $\gamma\in\mathcal{S}_{0}$, which concludes the proof of part $(i)$.

Proof of part $(ii)$: Suppose $(q_{XY},q_{Z_{1}Z_{2}|XY})$ is asymptotically securely computable with privacy against both users using an $r$-round protocol in which Alice starts the communication. Then by part $(i)$, there exists a conditional p.m.f. $p(u_{[1:r]}|x,y,z_{1},z_{2})$ satisfying (5)-(10). So, the joint distribution can be written as

[TABLE]

Consider another joint distribution,

[TABLE]

Notice that $p(u_{[1:r]},z_{1},z_{2}|x,y)=\tilde{p}(u_{[1:r]},z_{1},z_{2}|x,y)=p(u_{[1:r]}|x,y)p(z_{1}|u_{[1:r]},x)p(z_{2}|u_{[1:r]},y)$. We show that $\tilde{p}(x,y,u_{[1:r]},z_{1},z_{2})$ also satisfies (5)-(10), thereby making the function $(\tilde{q}_{XY},q_{Z_{1}Z_{2}|XY})$ asymptotically securely computable in $r$-rounds. It is trivial to see that (5)-(8) depends only on $p(u_{[1:r]}|x,y),p(z_{1}|u_{[1:r]},x)$ and $p(z_{2}|u_{[1:r]},y)$ which are common in both the distributions $p(x,y,u_{[1:r]},z_{1},z_{2})$ and $\tilde{p}(x,y,u_{[1:r]},z_{1},z_{2})$. Hence, since the p.m.f. $p(x,y,u_{[1:r]},z_{1},z_{2})$ satisfies (5)-(8), $\tilde{p}(x,y,u_{[1:r]},z_{1},z_{2})$ also satisfies (5)-(8). It remains to show that the p.m.f. $\tilde{p}(x,y,u_{[1:r]},z_{1},z_{2})$ satisfies (9)-(10). For $x,y,z_{1},z_{2}$ s.t. $\tilde{p}(x,y,z_{1},z_{2})>0$, consider

[TABLE]

Notice that ${p}(u_{[1:r]}|x,y,z_{1},z_{2})$ is well-defined as $\text{supp}(\tilde{q}_{XY})\subseteq\text{supp}(q_{XY})$. (102) follows as $p(u_{[1:r]},z_{1},z_{2}|x,y)=\tilde{p}(u_{[1:r]},z_{1},z_{2}|x,y)$. Now, for $x,y,z_{1},z_{2}$ s.t. $\tilde{p}(x,y,z_{1},z_{2})>0$, since $\tilde{p}(u_{[1:r]}|x,y,z_{1},z_{2})={p}(u_{[1:r]}|x,y,z_{1},z_{2})$, we have that $\tilde{p}(x,y,u_{[1:r]},z_{1},z_{2})$ satisfies (9)-(10) also. This completes the proof of Theorem 1.

∎

Proof of Theorem 3.

Part $(i)$ follows directly from Theorem 2. For part $(ii)$, we show that, for the class of functions mentioned in the statement of theorem, if a scheme computes $(q_{XY},q_{Z_{1}Z_{2}|XY})$ with $R_{12}$ and $R_{21}$ equal to $I(Z_{2};X|Y)+\delta$ and $I(Z_{1};Y|X)+\delta$ respectively, and with some $R_{0}$, under no privacy, then this scheme will also satisfy the privacy conditions (3)-(4). From the converse of [21, Theorem 1], we have $nR_{12}\geq I(M_{[1:r]};X^{n}|Y^{n},W)$. Then we get

[TABLE]

where (103) is due to the independence of common randomness $W$ and $(X^{n},Y^{n})$, (104) follows from the Markov chain $Z_{2}^{n}-(W,Y^{n},M_{[1:r]})-(X^{n},Z_{1}^{n})$. We used the following fact in (106): if two random variables $A$ and $A^{\prime}$ with same support set $\mathcal{A}$ satisfy $||p_{A}-p_{A^{\prime}}||_{1}\leq\epsilon\leq 1/4$, then it follows from [44, Theorem 17.3.3] that $|H(A)-H(A^{\prime})|\leq\eta\log|\mathcal{A}|$, where $\eta\rightarrow 0$ as $\epsilon\rightarrow 0$. Now (2) implies (106), where $\epsilon_{1},\epsilon_{2}\rightarrow 0$ as $\epsilon\rightarrow 0$.

When $H(Z_{1}|X,Y,Z_{2})=0$, from (106) we have $I(M_{[1:r]},W;X^{n},Z_{1}^{n}|Y^{n},Z_{2}^{n})\leq\delta+\epsilon_{1}+\epsilon_{2}$ for $\delta\rightarrow 0$, and $\epsilon_{1},\epsilon_{2}\rightarrow 0$ as $\epsilon\rightarrow 0$, which is the required privacy condition against Bob. Similar argument holds for $R_{21}$ when $H(Z_{2}|X,Y,Z_{1})=0$. ∎

Proofs of Theorem 4 and Theorem 5 are along similar lines as that of Theorem 1 and Theorem 2 jointly, by noticing the following and hence omitted. When privacy against Alice is required,

[TABLE]

where (108) follows from (3).

[TABLE]

where (110) follows from (3). Similarly, when privacy is required against Bob, we have $I(U_{[1:r]};Z_{1},Z_{2}|X,Y)=I(U_{[1:r]};Z_{2}|X,Y)$ and $I(U_{1};Z_{1},Z_{2}|X,Y)=I(U_{1};Z_{2}|X,Y)$.

Appendix B Cut-set Bounds for Randomized Interactive Function Computation

For a randomized interactive function computation problem, we prove lower bounds for $R_{12}$ and $R_{21}$. To lower bound $R_{12}$, note that all the inequalities upto (105) in the proof of Theorem 3 will follow even for function computation without any privacy requirement. Then we get

[TABLE]

where in (112) we have used the fact: if two random variables $A$ and $A^{\prime}$ with same support set $\mathcal{A}$ satisfy $||p_{A}-p_{A^{\prime}}||_{1}\leq\epsilon\leq 1/4$, then it follows from [44, Theorem 17.3.3] that $|H(A)-H(A^{\prime})|\leq\eta\log|\mathcal{A}|$, where $\eta\rightarrow 0$ as $\epsilon\rightarrow 0$. Now (2) implies (112), where $\epsilon^{\prime}\rightarrow 0$ as $\epsilon\rightarrow 0$. Thus, we have $R_{12}\geq I(Z_{2};X|Y)-\epsilon^{\prime}$, where $\epsilon^{\prime}\rightarrow 0$ as $\epsilon\rightarrow 0$. So, as $\epsilon\rightarrow 0$ we have $R_{12}\geq I(X;Z_{2}|Y)$. Similarly, $R_{21}\geq I(Y;Z_{1}|X)$. These are the cut-set lower bounds.

Appendix C Details Omitted from Example 2

Suppose there exists a two round protocol with Alice starting the communication. If Bob is able to compute the function with a single message from Alice, then [19, Theorem 1] gives that $R_{12}$ should be greater than or equal to the conditional graph entropy of the confusability graph [19]. For this example, it can be easily verified that $R_{12}\geq\log m+1$ which is strictly greater than the cut-set bound $\log m+1/2$. This shows that secure computation is not possible with a two round protocol with Alice starting the communication (because a statement similar to Theorem 3 holds when privacy is required only against Bob with $r=2$ rounds).

Now let us consider a two round protocol with Bob starting the communication. From Theorem 5, there exists random variables $U_{1},U_{2}$ satisfying

[TABLE]

such that $R_{12}\geq I(Y;U_{[1:2]}|X)=I(Y;U_{1}|X)$ and $R_{21}\geq I(X;Z|Y)=H(Z|Y)$. We show that $U_{1}$ must be such that $H(Y|U_{1})=0$. Suppose not, i.e., $H(Y|U_{1})>0$. Then there exists $u_{1},y$ and $y^{\prime}$, where $y\neq y^{\prime}$ such that $p(y,u_{1})>0$ and $p(y^{\prime},u_{1})>0$. Let $i\in[1:m]$ be an index such that $y_{i}\neq y^{\prime}_{i}$. Since $U_{1}-Y-X$, we have

[TABLE]

Since $U_{2}-(U_{1},X)-Y$, (118) and (119) imply that there exists $u_{2}$ such that

[TABLE]

For $(J=i,V=1,Y=y)$, $Z=(i,y_{i}):=z$, whereas for $(J=i,V=1,Y=y^{\prime})$, $Z=(i,y^{\prime}_{i}):=z^{\prime}$. Note that $z\neq z^{\prime}$. Since $Z$ is a deterministic function of $(U_{1},U_{2},X)$ (this follows from (117)), (120) and (121) above imply that

[TABLE]

for some $\tilde{z}$. This is a contradiction. Hence, $H(Y|U_{1})=0$ for any choice of $U_{1}$ and

[TABLE]

Therefore, to preserve decodability and privacy, the minimum possible $R_{12}$ is $m$ which also shows that the function is not computable in $1$ round with Alice starting the communication. Rate $R_{21}$ is lower bounded by $H(Z|Y)$, the cut-set bound, which is equal to $\log m+1/2$. So the sum-rate is lower bounded by $\log m+1/2+m$. This can be achieved by first Bob communicating $U_{1}=Y$ to Alice, and Alice computing $Z$ and communicating $U_{2}=Z$ to Bob. It is easy to see that this does not violate any privacy requirements. Thus, the optimum sum-rate for two round protocols is $R^{B-\text{pvt}}_{\text{sum}}(2)=I(X;Z|Y)+I(Y;U_{[1:2]}|X)=\log m+1/2+m$.

Now let us consider a three round protocol. Alice starts the communication by sending $U_{1}=J$. Then Bob communicates $U_{2}=Y_{J}$ to Alice and in the third round Alice communicates $U_{3}=V\wedge Y_{J}$ to Bob. The sum-rate of this protocol is $I(X;Z|Y)+I(Y;U_{[1:3]}|X)=\log m+1/2+1$ which is strictly less than the optimum sum-rate for two round protocols. Now, we show that $\log m+1/2+1$ is the optimum sum-rate for any $r$ round protocol with $r\geq 3$. We use the following lemma.

Lemma 2** ([4, 5]).**

If $X$ and $Y$ are independent, then the following holds for any $U_{[1:r]}$ satisfying (5) and (6).

[TABLE]

Proof.

We prove a more general statement, i.e., for any $U_{[1:r]}$ satisfying (5) and (6), we have $I(X;Y|U_{[1:i]})\leq I(X;Y)$ for any $i\in[1:r]$. We show this by induction on $i$. The base case, for $i=1$ is true since,

[TABLE]

where (123) follows from (5). Now suppose that $I(X;Y|U_{[1:i]})\leq I(X;Y)$. Assume that $i$ is odd. Then we have

[TABLE]

where (124) follows from (6). One can prove that $I(X;Y|U_{[1:i+1]})\leq I(X;Y)$ for the case when $i$ is even using (5). This completes the proof of lemma. ∎

The proof of $\log m+1+1/2$ being the optimal sum-rate for any arbitrary rounds follows along similar lines as that of showing that $\log m+m+1/2$ to be the optimal sum-rate for two round protocols. It is outlined below. We show that $H(Y_{J}|U_{[1:r]},J)=0$. Let us assume $H(Y_{J}|U_{[1:r]},J)\neq 0$. This implies that $\exists\;u_{[1:r]}$ and $j$ such that

[TABLE]

These two further imply that $\exists\;y,y^{\prime}$ such that $y(j)=0$, $y^{\prime}(j)=1$, and

[TABLE]

Now we analyse two cases as before.

[TABLE]

Case 1 $(H(V|U_{[1:r]}=u_{[1:r]},J=j)\neq 0):$

This implies the following:

[TABLE]

(129), (126) and Lemma 2 imply that

[TABLE]

Similarly, (130), (126) and Lemma 2 imply that

[TABLE]

From (131) and (132), we get $H(V\wedge Y_{J}|U_{[1:r]},Y,J)\neq 0$. Then we have $H(V\wedge Y_{J}|U_{[1:r]},Y)\neq 0$ which is a contradiction.

Case 2 $(H(V|U_{[1:r]}=u_{[1:r]},J=j)=0):$

This condition implies either

[TABLE]

or

[TABLE]

Let us consider the first case. Then (133), (134), (125) and Lemma 2 imply that $P(V=0,J=j,U_{[1:r]}=u_{[1:r]},Y=y,V\wedge Y_{j}=0)>0$ and $P(V=1,J=j,U_{[1:r]}=u_{[1:r]},Y=y,V\wedge Y_{j}=0)=0$. This violates the Markov chain $U_{[1:r]}-(Y,Z)-X$. Similarly, the second case also violates the Markov chain $U_{[1:r]}-(Y,Z)-X$. This shows that $H(V|U_{[1:r]}=u_{[1:r]},J=j)$ can not be zero.

From Theorem 5, we have $R_{21}\geq I(Y;U_{[1:r]}|X)$. Then we get the following

[TABLE]

So we have $R_{21}\geq 1$. From the cut-set bound, we have $R_{12}\geq H(Z|Y)=\log m+1/2$. This implies that sum-rate is lower bounded by $\log m+1/2+1$ by any $r$ round protocol.

Appendix D Details Omitted from Example 3

We have

[TABLE]

Let $U$ satisfy the Markov chains $Z-U-X$ and $U-Z-X$ and define $\mathcal{U}_{z}=\{u\in\mathcal{U}:p_{UZ}(u,z)>0\}$. Then we have the following claim.

Claim 4**.**

$\mathcal{U}_{z}\cap\mathcal{U}_{z^{\prime}}=\emptyset.$**

Proof.

Suppose $\mathcal{U}_{z}\cap\mathcal{U}_{z^{\prime}}\neq\emptyset$. Let $u\in\mathcal{U}_{z}\cap\mathcal{U}_{z^{\prime}}$. Then there exist $z,z^{\prime}$ such that $p_{UZ}(u,z),p_{UZ}(u,z^{\prime})>0$. Let $\alpha_{z}(x)=q_{Z|X}(z|x)$, for every $x\in\mathcal{X}$ and $\vec{\alpha}_{z}$ denote a vector with entries indexed by $x\in\mathcal{X}$. For this example, it is easy to see that $\text{supp}(\vec{\alpha}_{z})\neq\text{supp}(\vec{\alpha}_{z^{\prime}})$, for $z\neq z^{\prime}$. Assume, without loss of generality that, $\text{supp}(\vec{\alpha}_{z})\setminus\text{supp}(\vec{\alpha}_{z^{\prime}})\neq\emptyset$. Let $x\in\text{supp}(\vec{\alpha}_{z})\setminus\text{supp}(\vec{\alpha}_{z^{\prime}})$. This implies that $\vec{\alpha}_{z}(x)>0$ and $\vec{\alpha}_{z^{\prime}}(x)=0$. Since $\vec{\alpha}_{z^{\prime}}$ is a non-zero vector, there exists $x^{\prime}$ such that $\vec{\alpha}_{z^{\prime}}(x^{\prime})>0$. Note that $\vec{\alpha}_{z}(x)>0$ implies $q_{Z|X}(z|x)>0$, $\vec{\alpha}_{z^{\prime}}(x)=0$ implies $q_{Z|X}(z^{\prime}|x)=0$, and $\vec{\alpha}_{z^{\prime}}(x^{\prime})>0$ implies $q_{Z|X}(z^{\prime}|x^{\prime})>0$. These imply, by privacy against Bob, that $p_{UZ|X}(u,z|x),p_{UZ|X}(u,z^{\prime}|x^{\prime})>0$. Now consider $p_{UZ|X}(u,z^{\prime}|x^{\prime})$ and expand it as follows:

[TABLE]

$p_{U|X}(u|x^{\prime})>0$ and $p_{Z|U}(z^{\prime}|u)>0$, respectively because $p_{UZ|X}(u,z|x)>0$ and $p_{UZ|X}(u,z^{\prime}|x^{\prime})>0$. This implies $p_{UZ|X}(u,z^{\prime}|x^{\prime})>0$, which in turn implies $q_{Z|X}(z^{\prime}|x^{\prime})>0$, which is a contradiction. ∎

This shows that $Z$ is a deterministic function of $U$. Now we have $I(U;Z|X)=H(Z|X)$. This gives

[TABLE]

Notice that an optimum $U$, i.e., $U=Z$ satisfies the Markov chain $Z-(U,X)-Z$ also and hence the inequality in (135) is actually an equality, thereby giving us $R^{B-\text{pvt}}_{\text{sum}}(1,0)=1+\log(m)=\log(2m)$.

Appendix E Proof of Proposition 6

In view of Theorem 4, it suffices to show that

[TABLE]

A similar result for deterministic functions was proved by Orlitsky and Roche [19, Theorem 2]. Since we are dealing with randomized functions, the proof of this proposition is slightly more involved.

L.H.S. $\leq$ R.H.S.: Suppose $p_{W|X}$ achieves the minimum on the right hand side. Then $W$ is a random variable such that it takes values in the set $\varGamma(\mathcal{G})$ of independent sets of $\mathcal{G}$ such that $X\in W$. Now we define a joint distribution $p_{XYWZ}(x,y,w,z)$ as follows:

[TABLE]

Note that the above-defined $p_{XYWZ}$ satisfies the Markov chains $W-X-Y$ and $Z-(X,Y)-W$. These two Markov chain together implies that $W-X-(Y,Z)$ is also a Markov chain. Now we show that $p_{XYWZ}$ satisfies $Z-(W,Y)-X$ too. Consider any independent set, say $w\in\mathcal{G}$. Consider any pair $(y,z)\in\mathcal{Y}\times\mathcal{Z}$. By definition of $\mathcal{G}$, $p_{Z|XY}(z|x,y)$ is the same for all $x\in w$ with $q_{XY}(x,y)>0$. Hence, $q_{Z|XY}(z|x,y)$ can be uniquely determined from $(w,y,z)$ where $x\in w$; therefore, the Markov chain $Z-(W,Y)-X$ holds. The inequality now follows by taking $U=W$.

L.H.S. $\geq$ R.H.S.: Suppose $p_{U|X}$ achieves the minimum on the left hand side such that $U-X-(Y,Z)$ and $Z-(U,Y)-X$ hold. Now define a random variable $W$ as a function of $U$ in the following way: $w=w(u):=\{x:p_{UX}(u,x)>0\}$. We need to show that the induced conditional distribution $p_{W|X}$ satisfies the following three conditions:

1. the Markov chain $W-X-Y$ holds;
2. $X\in W$, i.e., $p_{XW}(x,w)>0\implies x\in w$; and 3) $W$ is an independent set in $\mathcal{G}=(\mathcal{X},\mathcal{E})$. We show these conditions below.

The Markov chain $W-X-Y$ holds because $U-X-(Y,Z)$ holds and $W$ is a function of $U$. 2. 2.

If $p_{WX}(w,x)>0$ then $\exists u$ s.t. $w=w(u)$ and $p_{UX}(u,x)>0$, which implies that $x\in w$. 3. 3.

To prove that $w$ is an independent set we suppose, to the contrary, that $w$ is not an independent set, which means that $\exists x,x^{\prime},u$, where $w=w(u),x,x^{\prime}\in w$, $\{x,x^{\prime}\}\in\mathcal{E}$, and such that $p_{U|X}(u|x)\cdot p_{U|X}(u|x^{\prime})>0$. By definition of $\mathcal{G}$, $\{x,x^{\prime}\}$ being an edge in $\mathcal{E}$ implies that $\exists(y,z)\in\mathcal{Y}\times\mathcal{Z}$ such that $q_{Z|XY}(z|x,y)\neq q_{Z|X,Y}(z|x^{\prime},y)$ and $q_{XY}(x,y)\cdot q_{XY}(x^{\prime},y)>0$. Assume, without loss of generality, that $q_{Z|XY}(z|x,y)>0$. Consider $(u,x,y,z)$. We can expand $p_{UZ|XY}(u,z|x,y)$ in two different ways. The first expansion is as follows:

[TABLE]

where in the second equality we used $U-X-Y$ to write $p_{U|XY}(u|x,y)=p_{U|X}(u|x)$ and $Z-(U,Y)-X$ to write $p_{Z|UXY}(z|u,x,y)=p_{Z|UY}(z|u,y)$ (note that $p_{Z|UXY}(z|u,x,y)$ is well-defined, because $p_{UXY}(u,x,y)$ = $q_{XY}(x,y)p_{U|X}(u|x)>0$). We can expand $p_{UZ|XY}(u,z|x,y)$ in the following way also:

[TABLE]

where in the second equality we used the Markov chain $U-X-(Y,Z)$ to write $p_{U|XYZ}(u|x,y,z)=p_{U|X}(u|x)$ (note that $p_{U|XYZ}(u|x,y,z)$ is well-defined, because $p_{XYZ}(x,y,z)>0$). Since $p_{U|X}(u|x)>0$, comparing (140) and (141) gives

[TABLE]

The above equality, together with $q_{Z|XY}(z|x,y)>0$, implies $p_{Z|UY}(z|u,y)>0$. Now consider $(u,x^{\prime},y,z)$, and expand $p_{UZ|XY}(u,z|x^{\prime},y)$ along the first expansion above in (140). This gives:

[TABLE]

Since all the terms on the RHS are greater than zero, we have $p_{UZ|XY}(u,z|x^{\prime},y)>0$. Now expanding $p_{UZ|XY}(u,z|x^{\prime},y)$ along the second expansion in (141) above gives

[TABLE]

On comparing (143) and (144), and using $p_{U|X}(u|x^{\prime})>0$, we get $q_{Z|XY}(z|x^{\prime},y)=p_{Z|UY}(z|u,y)$, which together with (142), leads to a contradiction to our assumption that $q_{Z|XY}(z|x,y)\neq q_{Z|XY}(z|x^{\prime},y)$.

Appendix F Proof of Lemma 1

First we explicitly characterize $(q_{XY},q_{Z|XY})$ that are perfectly securely computable with privacy against both users. Kilian [40] gave a characterization of such $q_{Z|XY}$ with no input distribution. Essentially the same characterization holds for general $(q_{XY},q_{Z|XY})$ as well, and we prove it in our language in Lemma 3; it will be useful in understanding the later results.

We say that $C\times D$, where $C\subseteq\mathcal{X},D\subseteq\mathcal{Y}$, is column monochromatic, if for every $y\in D$, if there exists $x,x^{\prime}\in C$ such that $q_{XY}(x,y),q_{XY}(x^{\prime},y)>0$, then $q_{Z|XY}(z|x,y)=q_{Z|XY}(z|x^{\prime},y)$, $\forall z\in\mathcal{Z}$.

Lemma 3**.**

[40, Lemma 5.1]** Let $\mathcal{X}=\mathcal{X}_{1}\biguplus\mathcal{X}_{2}\biguplus\ldots\biguplus\mathcal{X}_{k}$ be the partition induced by the equivalence relation $\equiv$. Then, $(q_{XY},q_{Z|XY})$ is perfectly securely computable with privacy against both users if and only if each $\mathcal{X}_{i}\times\mathcal{Y}$, $i\in\{1,2,\ldots,k\}$, is column monochromatic.

Proof.

‘Only if’ part: Let $U$ denote the message sent by Alice to Bob. Let $(p(u|x),p(z|u,y))$ be a pair of encoder and decoder that perfectly securely computes $(q_{XY},q_{Z|XY})$ with privacy against both users, i.e., the joint distribution $p(x,y,u,z)=p(x,y)p(u|x)p(z|u,y)$ satisfies the following correctness and privacy conditions:

[TABLE]

Consider an equivalence class $\mathcal{X}_{i}$. First we prove that $p(u|x)=p(u|x^{\prime})$ for every message $u$ and every $x,x^{\prime}\in\mathcal{X}_{i}$. Since $\mathcal{X}_{i}$ is an equivalence class of $\equiv$, we have $x\equiv x^{\prime}$, and by the definition of $x\equiv x^{\prime}$, there exists $x=x_{1},x_{2},\ldots,x_{l-1},x_{l}=x^{\prime}$ such that $x_{i}\sim x_{i+1}$ for every $0\leq i\leq l-1$. Consider $x_{i},x_{i+1}$ for some $i$ in this sequence. Since $x_{i}\sim x_{i+1}$, there exists $y,z$ such that $q(x_{i},y),q(x_{i+1},y),q(z|x_{i},y),q(z|x_{i+1},y)>0$. (These will ensure that all the conditional probabilities in the following equations are well-defined.) Fix a message $u$ and consider the following:

[TABLE]

where the first and third equalities follow from (146), and the second equality follows from (147). Since the above argument holds for every $i\in\{1,2,\ldots,k-1\}$, we have $p(u|x)=p(u|x^{\prime})$ for every $x,x^{\prime}\in\mathcal{X}_{i}$. Hence, $U$ is conditionally independent of $X$, conditioned on the equivalence class to which $X$ belongs.

Now take any $y\in\mathcal{Y}$. We prove that if there exists $x,x^{\prime}\in\mathcal{X}_{i}$ such that $q_{XY}(x,y)>0,q_{XY}(x^{\prime},y)>0$, then $q_{Z|XY}(z|x,y)=q_{Z|XY}(z|x^{\prime},y)$ for every $z\in\mathcal{Z}$. Take any $u$ such that $p(u|x)>0$, then $p(u|x^{\prime})=p(u|x)>0$. Take an arbitrary $z\in\mathcal{Z}$. Consider $(x,y,u,z)$ and expand $p(u,z|x,y)$ as follows:

[TABLE]

We can expand $p(u,z|x,y)$ in another way:

[TABLE]

In (149) we used (146) to write $p(u|x,y,z)=p(u|x)$. Comparing (148) and (149) we get

[TABLE]

Running the same arguments with $(x^{\prime},y,u,z)$ we get

[TABLE]

Comparing (150) and (151) gives $q(z|x,y)=q(z|x^{\prime},y)$. Since the protocol is correct, i.e., $p(z|x,y)=q_{Z|XY}(z|x,y)$, we have our desired result that $p_{Z|XY}(z|x,y)=p_{Z|XY}(z|x^{\prime},y)$.

‘If’ part: If $\mathcal{X}_{i}\times\mathcal{Y}$, $i\in\{1,2,\ldots,k\}$, is column monochromatic, then we give a simple encoder-decoder pair to perfectly securely compute $(q_{XY},q_{Z|XY})$. Take $\mathcal{U}=\{1,2,\ldots,k\}$. Now define the encoder-decoder as follows:

• •

Encoder: $p_{U|X}(i|x):=\mathbbm{1}_{\{x\in\mathcal{X}_{i}\}}$, i.e., on input $x$, Alice sends the unique index $i\in[k]$ such that $x\in\mathcal{X}_{i}$.

• •

Decoder: $p_{Z|UY}(z|i,y):=q_{Z|XY}(z|x,y)$, for any $x\in\mathcal{X}_{i}$ such that $q_{XY}(x,y)>0$. (If no such $x$ is there, leave $p_{Z|UY}(z|i,y)$ undefined.)

Upon observing $x$ as input, Alice sends the index $i$ such that $x\in\mathcal{X}_{i}$. On observing $y\in\mathcal{Y}$ and receiving $i\in[1:k]$ from Alice, Bob outputs $z$ with probability $p_{Z|UY}(z|i,y)$. Note that $p_{Z|UY}(z|i,y)$ is well-defined, because $q_{XY}(x,y)>0$. It can be easily verified that the above pair of encoder-decoder computes $(q_{XY},q_{Z|XY})$ with perfect security against both users. ∎

The above encoder-decoder may not be optimal in terms of communication complexity. Consider any two equivalence classes $\mathcal{X}_{i}$ and $\mathcal{X}_{j}$. Let $\mathcal{Y}_{i}:=\{y\in\mathcal{Y}:\exists x\in\mathcal{X}_{i}\text{ s.t. }q_{XY}(x,y)>0\}$; $\mathcal{Y}_{j}$ is defined similarly. Suppose $\mathcal{Y}_{i}\cap\mathcal{Y}_{j}=\phi$. Then, Alice can send the same message whether $x\in\mathcal{X}_{i}$ or $x\in\mathcal{X}_{j}$, and Bob will still be able to correctly compute $q_{Z|XY}$.

Consider an encoder-decoder pair $(p_{U|X},p_{Z|UY})$ that securely computes $(q_{XY},q_{Z|XY})$ with privacy against both users. For $i=1,2,\ldots,k$, define $\mathcal{U}_{i}$ as follows:

[TABLE]

Claim 5**.**

For some $i,j\in[1:k],i\neq j$, if there exists $x\in\mathcal{X}_{i}$ and $x^{\prime}\in\mathcal{X}_{j}$ such that $q_{XY}(x,y)>0,q_{XY}(x^{\prime},y)>0$ for some $y\in\mathcal{Y}$, then $\mathcal{U}_{i}\cap\mathcal{U}_{j}=\phi$.

Proof.

We prove the claim by contradiction. Suppose there exists $i,j\in[1:k],i\neq j$, and $x\in\mathcal{X}_{i}$, $x^{\prime}\in\mathcal{X}_{j}$ such that $q_{XY}(x,y)>0,q_{XY}(x^{\prime},y)>0$ for some $y\in\mathcal{Y}$, and $\mathcal{U}_{i}\cap\mathcal{U}_{j}\neq\phi$. Since $q_{XY}(x,y)>0$, there is a $z\in\mathcal{Z}$ with $q_{Z|XY}(z|x,y)>0$. Since $x$ and $x^{\prime}$ are not in the same equivalence class, we have $q_{Z|XY}(z|x^{\prime},y)=0$.

Suppose $u\in\mathcal{U}_{i}\cap\mathcal{U}_{j}$. It follows from the definition of $\mathcal{U}_{i}$ and the proof of Lemma 3 that $p(u|x)>0$ and $p(u|x^{\prime})>0$. Now consider $(x,y,u,z)$ and by expanding $p(u,z|x,y)$ in two different ways (similar to what we did in the proof of Lemma 3) we get $q_{Z|XY}(z|x,y)=p(z|u,y)$. Applying the same arguments with $(x^{\prime},y,u,z)$ gives $q_{Z|XY}(z|x^{\prime},y)=p(z|u,y)$. These imply $q_{Z|XY}(z|x,y)=q_{Z|XY}(z|x^{\prime},y)$, which is a contradiction, because by assumption $q_{Z|XY}(z|x,y)>0$ and $q_{Z|XY}(z|x^{\prime},y)=0$. Hence, $\mathcal{U}_{i}\cap\mathcal{U}_{j}$ must be empty. ∎

From the proof of Lemma 3 we have that the $U$ is conditionally independent of the input $X$ conditioned on the equivalence class to which $X$ belongs. This, together with Claim 5 suggests replacing all the elements in $\mathcal{X}_{i},i\in[1:k]$, by a single element $x_{i}$, which induces a new random variable, which we denote by $X_{\text{EQ}}$. Note that $X_{\text{EQ}}$ takes values in the set $\mathcal{X}_{\text{EQ}}:=\{x_{1},x_{2},\ldots,x_{k}\}$, where $x_{i}$ is the representative of the equivalence class $\mathcal{X}_{i}$. Thus we can define an equivalent problem ($q_{X_{\text{EQ}}Y},q_{Z|X_{\text{EQ}}Y}$) as follows:

• •

Define $q_{X_{\text{EQ}}Y}(x_{i},y):=\sum_{x\in\mathcal{X}_{i}}q_{XY}(x,y)$ for every $(x_{i},y)\in(\mathcal{X}_{\text{EQ}}\times\mathcal{Y})$.

• •

For $(x_{i},y)\in(\mathcal{X}_{\text{EQ}}\times\mathcal{Y})$, if there exists $x\in\mathcal{X}_{i}$ s.t. $q_{XY}(x,y)>0$, then define $q_{Z|X_{\text{EQ}}Y}(z|x_{i},y):=q_{Z|XY}(z|x,y)$, for every $z\in\mathcal{Z}$. If there exists no $x\in\mathcal{X}_{i}$ s.t. $q_{XY}(x,y)>0$, then it does not matter what the conditional distribution $q_{Z|X_{\text{EQ}}Y}(z|x_{i},y)$ is; in particular, we can define $q_{Z|X_{\text{EQ}}Y}(.|x_{i},y)$ to be the uniform distribution in $\{1,2,\ldots,|\mathcal{Z}|\}$.

Note that $U-X_{\text{EQ}}-X$ is a Markov chain. The above definition is for $(q_{XY},q_{Z|XY})$ which are perfectly securely computable with privacy against both users as per Lemma 3.

Remark 10**.**

Suppose $(q_{XY},q_{Z|XY})$ is securely computable. Observe that Bob always learns which equivalence class $\mathcal{X}_{i}$ Alice’s input lies in. This is because $\forall(y,z)\in\mathcal{Y}\times\mathcal{Z}$ such that $q_{YZ}(y,z)>0$, there is a unique $x\in\mathcal{X}_{\text{EQ}}$ s.t. $q_{X_{\text{EQ}}Y}(x,y)>0$ and $q_{Z|X_{\text{EQ}}Y}(z|x,y)>0$.**

Now we are ready to prove Lemma 1.

Proof of Lemma 1.

Let $(p_{U|X},p_{Z|UY})$ be an encoder-decoder pair that securely computes $(q_{XY},q_{Z|XY})$. Consider the following encoder-decoder pair $(p_{\tilde{U}|X_{\text{EQ}}},p_{Z|\tilde{U}Y})$ for securely computing the reduced function, that is $(q_{X_{\text{EQ}}Y},q_{Z|X_{\text{EQ}}Y})$. The alphabet of $X_{\text{EQ}}$ is $\mathcal{X}_{\text{EQ}}=\{x_{1},x_{2},\ldots,x_{k}\}$, where $x_{i}$ is the representative element of the equivalence class $\mathcal{X}_{i}$ in the partition $\mathcal{X}=\mathcal{X}_{1}\biguplus\mathcal{X}_{2}\biguplus\ldots\biguplus\mathcal{X}_{k}$ generated by the equivalence relation $\equiv$; see Definition 8. Encoder is defined as follows: for every $i\in[1:k]$, define $p_{\tilde{U}|X_{\text{EQ}}}(u|x_{i}):=p_{U|X}(u|x)$ for any $x\in\mathcal{X}_{i}$. This is well-defined, because $p_{U|X}(u|x)$ is identical for every $x$ in an equivalence class (see the proof of Lemma 3). Decoder remains the same, i.e., $p_{Z|\tilde{U}Y}=p_{Z|UY}$. Note that the encoder $p_{\tilde{U}|X_{\text{EQ}}}$ is defined on a subset of $\mathcal{X}$, and on that subset it is identical to $p_{U|X}$. This implies that, since $(p_{U|X},p_{Z|UY})$ securely computes $(q_{XY},q_{Z|XY})$, the above-defined $(p_{\tilde{U}|X_{\text{EQ}}},p_{Z|\tilde{U}Y})$ will also securely compute $(q_{X_{\text{EQ}}Y},q_{Z|X_{\text{EQ}}Y})$.

For the other direction, let $(p_{\tilde{U}|X_{\text{EQ}}},p_{Z|\tilde{U}Y})$ securely computes $(q_{X_{\text{EQ}}Y},q_{Z|X_{\text{EQ}}Y})$. Now consider the following encoder-decoder pair $(p_{U|X},p_{Z|UY})$ for securely computing $(q_{XY},q_{Z|XY})$. Encoder is defined as follows: for any $x\in\mathcal{X}$, define $p_{U|X}(u|x):=p_{\tilde{U}|X_{\text{EQ}}}(u|x_{i})$, where $x\in\mathcal{X}_{i}$. Decoder remains the same, i.e., $p_{Z|UY}=p_{Z|\tilde{U}Y}$. Note that $p_{U|X}(u|x)$ must be identical for every $x$ in an equivalence class (see the proof of Lemma 3). Therefore, since $p_{\tilde{U}|X_{\text{EQ}}}(u|x_{i})$ is a valid choice for $p_{U|X}(u|x_{i})$, where $x_{i}$ is the representative element of the equivalence class $\mathcal{X}_{i}$, it follows that the above-defined encoder-decoder pair $(p_{U|X},p_{Z|UY})$ will also securely compute $(q_{XY},q_{Z|XY})$.

In the following we show that $L(U)$ and $L(\tilde{U})$ have the same p.m.f. For simplicity, let $L=L(U)$ and $\tilde{L}=L(\tilde{U})$.

[TABLE]

Equality (a) follows from the fact that $l(u)$, the length of $u$, is a deterministic function of $u$. In (b) we used our definition of the encoder $p_{\tilde{U}|X_{\text{EQ}}}(u|x_{i})=p_{U|X}(u|x)$, where $x_{i}$ is the representative element of the equivalence class $\mathcal{X}_{i}$. We also used the definition of $p_{X_{\text{EQ}}}(x_{i})=\sum_{x\in\mathcal{X}_{i}}q_{X}(x)$ in (c). ∎

It follows from Lemma 1 that, to study the communication complexity of secure computation of $(q_{XY},q_{Z|XY})$, it is enough to study the communication complexity of secure computation of the reduced problem $(q_{X_{\text{EQ}}Y},q_{Z|X_{\text{EQ}}Y})$.

Appendix G Proof of Claim 1

‘Only if’ part: Let $c:\mathcal{X}_{\text{EQ}}\to\{0,1\}^{*}$ be a proper coloring of the vertices of $\mathcal{G}_{\text{EQ}}$ that Alice and Bob agree upon. We will give a pair of encoder-decoder $(p_{U|X_{\text{EQ}}},p_{Z|UY})$ that securely computes $(q_{X_{\text{EQ}}Y},q_{Z|X_{\text{EQ}}Y})$. Our encoder will be a deterministic map, which is defined as $p_{U|X_{\text{EQ}}}(u|x):=\mathbbm{1}_{\{u=c(x)\}}$. The alphabet of $U$ is $\mathcal{U}=\{a\in\{0,1\}^{*}:\exists x\in\mathcal{X}_{\text{EQ}}\text{ s.t. }c(x)=a\}$. We define our decoder as $p_{Z|UY}(z|u,y):=p_{Z|X_{\text{EQ}}Y}(z|x,y)$, for any $x\in\mathcal{X}_{\text{EQ}}$ such that $c(x)=u$ and $q_{X_{\text{EQ}}Y}(x,y)>0$. The decoder is well-defined, since $c$ is a proper coloring (if $x,x^{\prime}$ are such that $c(x)=c(x^{\prime})$, then $\{x,x^{\prime}\}\notin\mathcal{E}_{\text{EQ}}$; therefore, for every $(y,z)\in\mathcal{Y}\times\mathcal{Z}$, $q_{Z|X_{\text{EQ}}Y}(z|x,y)=q_{Z|X_{\text{EQ}}Y}(z|x^{\prime},y)$, whenever $q_{X_{\text{EQ}}Y}(x,y)>0,q_{X_{\text{EQ}}Y}(x^{\prime},y)>0$). Note that this pair of encoder-decoder $(p_{U|X_{\text{EQ}}},p_{Z|UY})$ correctly computes $(q_{X_{\text{EQ}}Y},q_{Z|X_{\text{EQ}}Y})$. It also satisfies privacy against both users. Privacy against Alice follows from the fact that our encoder is a deterministic function, in which $U$ is deterministic function of $X_{\text{EQ}}$, which implies that the Markov chain $U-X_{\text{EQ}}-(Y,Z)$ trivially holds. Privacy against Bob follows from the fact that $X_{\text{EQ}}$ is a deterministic function of $(Y,Z)$; see Remark 10.

‘If’ part: Fix a code $\mathcal{C}=(p_{U|X_{\text{EQ}}},p_{Z|UY})$ that securely computes $(q_{X_{\text{EQ}}Y},q_{Z|X_{\text{EQ}}Y})$, i.e., the induced joint distribution

[TABLE]

satisfies the two Markov chains $U-X_{\text{EQ}}-(Y,Z)$ and $U-(Y,Z)-X_{\text{EQ}}$, which correspond to privacy against Alice and privacy against Bob, respectively. Now we show that, without loss of generality, we can always take the encoder $p_{U|X_{\text{EQ}}}$ to be a deterministic map.

First note that privacy against Alice $U-X_{\text{EQ}}-(Y,Z)$ implies that $U-(X_{\text{EQ}},Y)-Z$ is a Markov chain. This follows from $0=I(U;Y,Z|X_{\text{EQ}})\geq I(U;Z|X_{\text{EQ}},Y)$ and the fact that conditional mutual information is always non-negative. The Markov chain $U-(X_{\text{EQ}},Y)-Z$ implies that, for every $x\in\mathcal{X}_{\text{EQ}},y\in\mathcal{Y}$ such that $q_{X_{\text{EQ}}Y}(x,y)>0$, we have

[TABLE]

In (154) we used the (152) to write $p_{Z|UX_{\text{EQ}}Y}(z|u,x,y)=p_{Z|UY}(z|u,y)$. It follows from (153)-(154) that, for each $x\in\mathcal{X}_{\text{EQ}}$, if we pick an arbitrary $\hat{u}\in\mathcal{U}$ such that $p_{U|X}(\hat{u}|x)>0$, and define our encoder as $E(x):=\hat{u}$ (and leave the decoder as before), then the resulting encoder-decoder pair $(E(X_{\text{EQ}}),p_{Z|UY})$ computes $(q_{X_{\text{EQ}}Y},q_{Z|X_{\text{EQ}}Y})$ with zero-error. Note that $(E(X_{\text{EQ}}),p_{Z|UY})$ satisfies privacy against both users: privacy against Alice comes from the fact that the above-defined encoder $U=E(X_{\text{EQ}})$ is a deterministic function of Alice’s input $X_{\text{EQ}}$, which implies that the Markov chain $U-X_{\text{EQ}}-(Y,Z)$ trivially holds; privacy against Bob follows from the fact that $X_{\text{EQ}}$ is a deterministic function of $(Y,Z)$ (see Remark 10), which implies that the Markov chain $U-(Y,Z)-X_{\text{EQ}}$ trivially holds.

Note that the encoder $p_{U|X_{\text{EQ}}}$ in the given code $\mathcal{C}$ may be a randomized function of Alice’s input, but once we fix the random coins of the encoder, the encoder becomes deterministic. For fixed random coins $\vec{r}$ of the encoder, let $E_{\vec{r}}:\mathcal{X}_{\text{EQ}}\to\mathcal{U}$ denote the resulting deterministic encoder, and let $\mathcal{C}_{\vec{r}}=(E_{\vec{r}}(X_{\text{EQ}}),p_{Z|UY})$ denote the resulting secure code with this deterministic encoder. As argued above, for every choice of random coins $\vec{r}$ of the encoder, the code $\mathcal{C}_{\vec{r}}$ securely computes $(q_{X_{\text{EQ}}Y},q_{Z|X_{\text{EQ}}Y})$. Since $\mathcal{C}_{\vec{r}}$ is a secure code with zero-error, the coloring defined by $c_{\vec{r}}(x):=E_{\vec{r}}(x),\forall x\in\mathcal{X}_{\text{EQ}}$ will be a proper coloring of the vertices of $\mathcal{G}_{\text{EQ}}$. Run through the possible random coins $\vec{r}$ of the encoder; this will produce a random coloring $(c_{\vec{r}})_{\vec{r}}$ of the vertices, where for any randomness $\vec{r}$, the corresponding coloring $c_{\vec{r}}$ is a proper coloring.

Appendix H Proofs of Claims 2 & 3

Proof of Claim 2.

We prove this by contradiction. Suppose $\vec{\alpha}_{i}^{(y)}\neq\vec{\alpha}_{j}^{(y^{\prime})}$ and $\mathcal{U}_{i}^{(y)}\cap\mathcal{U}_{j}^{(y^{\prime})}\neq\phi$. Let $u\in\mathcal{U}_{i}^{(y)}\cap\mathcal{U}_{j}^{(y^{\prime})}$. Define two sets $\text{Supp}(\vec{\alpha}_{i}^{(y)})=\{x\in\mathcal{X}:\vec{\alpha}_{i}^{(y)}(x)>0\}$ and $\text{Supp}(\vec{\alpha}_{j}^{(y^{\prime})})=\{x\in\mathcal{X}:\vec{\alpha}_{j}^{(y^{\prime})}(x)>0\}$. We analyze two cases, one when these two sets are equal, and the other, when they are not.

Case 1. $\text{Supp}(\vec{\alpha}_{i}^{(y)})=\text{Supp}(\vec{\alpha}_{j}^{(y^{\prime})})$: since $\vec{\alpha}_{i}^{(y)}$ and $\vec{\alpha}_{j}^{(y^{\prime})}$ are distinct probability vectors with same support, there must exist $x$ and $x^{\prime}$ such that $\vec{\alpha}_{i}^{(y)}(x)>0$, $\vec{\alpha}_{j}^{(y^{\prime})}(x)>0$, $\vec{\alpha}_{i}^{(y)}(x^{\prime})>0$, $\vec{\alpha}_{j}^{(y^{\prime})}(x^{\prime})>0$, and $\frac{\vec{\alpha}_{i}^{(y)}(x^{\prime})}{\vec{\alpha}_{i}^{(y)}(x)}\neq\frac{\vec{\alpha}_{j}^{(y^{\prime})}(x^{\prime})}{\vec{\alpha}_{j}^{(y^{\prime})}(x)}$. Since $\vec{\alpha}_{i}^{(y)}(x)>0,\vec{\alpha}_{i}^{(y)}(x^{\prime})>0$, we have $q_{Z|XY}(z|x,y)>0$ and $q_{Z|XY}(z|x^{\prime},y)>0$ for every $z\in\mathcal{Z}_{i}^{(y)}$ . Similarly, since $\vec{\alpha}_{j}^{(y^{\prime})}(x)>0,\vec{\alpha}_{j}^{(y^{\prime})}(x^{\prime})>0$, we have $q_{Z|XY}(z^{\prime}|x,y^{\prime})>0$ and $q_{Z|XY}(z^{\prime}|x^{\prime},y^{\prime})>0$ for every $z^{\prime}\in\mathcal{Z}_{j}^{(y^{\prime})}$. Note that $\frac{\vec{\alpha}_{i}^{(y)}(x^{\prime})}{\vec{\alpha}_{i}^{(y)}(x)}=\frac{q_{Z|XY}(z|x^{\prime},y)}{q_{Z|XY}(z|x,y)}$ and $\frac{\vec{\alpha}_{j}^{(y^{\prime})}(x^{\prime})}{\vec{\alpha}_{j}^{(y^{\prime})}(x)}=\frac{q_{Z|XY}(z^{\prime}|x^{\prime},y^{\prime})}{q_{Z|XY}(z^{\prime}|x,y^{\prime})}$, where, by hypothesis, $\frac{q_{Z|XY}(z|x^{\prime},y)}{q_{Z|XY}(z|x,y)}\neq\frac{q_{Z|XY}(z^{\prime}|x^{\prime},y^{\prime})}{q_{Z|XY}(z^{\prime}|x,y^{\prime})}$.

Since $u\in\mathcal{U}_{i}^{(y)}$, there exists $z\in\mathcal{Z}_{i}^{(y)}$ such that $p(u,z|y)>0$. This implies – by privacy against Bob – that $p(u,z|x,y)>0$ and $p(u,z|x^{\prime},y)>0$. Consider $p_{UZ|XY}(u,z|x,y)$ and expand it as follows:

[TABLE]

Since $p_{UZ|XY}(u,z|x,y)>0$, all the terms above are non-zero and well-defined. In the last equality we used privacy against Bob to write $p_{U|XYZ}(u|x,y,z)=p_{U|YZ}(u|y,z)$. Now expand $p_{UZ|XY}(u,z|x,y)$ in another way as follows:

[TABLE]

Again, all the terms above are non-zero and well-defined because $p_{UZ|XY}(u,z|x,y)>0$. We used $U-X-Y$ to write $p_{U|XY}(u|x,y)=p_{U|X}(u|x)$ and $Z-(U,Y)-X$ to write $p_{Z|UXY}(z|u,x,y)=p_{Z|UY}(z|u,y)$ in (156). Now comparing (155) and (156) gives the following:

[TABLE]

Since $p_{UZ|XY}(u,z|x^{\prime},y)>0$, we can apply the same arguments as above with $p_{UZ|XY}(u,z|x^{\prime},y)$ and get the following:

[TABLE]

Note that all the terms on both sides of (157) and (158) are non-zero. Dividing (157) by (158) gives the following:

[TABLE]

Similarly, since $u\in\mathcal{U}_{j}^{(y^{\prime})}$, there exists $z^{\prime}\in\mathcal{Z}_{j}^{(y^{\prime})}$ such that $p(u,z^{\prime}|y^{\prime})>0$. This implies – by privacy against Bob – that $p(u,z^{\prime}|x,y^{\prime})>0$ and $p(u,z^{\prime}|x^{\prime},y^{\prime})>0$. Applying the above arguments with $p(u,z^{\prime}|x,y^{\prime})>0$ and $p(u,z^{\prime}|x^{\prime},y^{\prime})>0$ gives

[TABLE]

Comparing (159) and (160) gives $\frac{q_{Z|XY}(z|x,y)}{q_{Z|XY}(z|x^{\prime},y)}=\frac{q_{Z|XY}(z^{\prime}|x,y^{\prime})}{q_{Z|XY}(z^{\prime}|x^{\prime},y^{\prime})}$, which is a contradiction.

Case 2. $\text{Supp}(\vec{\alpha}_{i}^{(y)})\neq\text{Supp}(\vec{\alpha}_{j}^{(y^{\prime})})$: assume, without loss of generality, that $\text{Supp}(\vec{\alpha}_{i}^{(y)})\setminus\text{Supp}(\vec{\alpha}_{j}^{(y^{\prime})})\neq\phi$. Let $x\in\text{Supp}(\vec{\alpha}_{i}^{(y)})\setminus\text{Supp}(\vec{\alpha}_{j}^{(y^{\prime})})$. This implies that $\vec{\alpha}_{i}^{(y)}(x)>0$ and $\vec{\alpha}_{j}^{(y^{\prime})}(x)=0$. Since $\text{Supp}(\vec{\alpha}_{j}^{(y^{\prime})})\neq\phi$ (because $\vec{\alpha}_{j}^{(y^{\prime})}$ is not a zero vector), there exists $x^{\prime}\in\text{Supp}(\vec{\alpha}_{j}^{(y^{\prime})})$ such that $\vec{\alpha}_{j}^{(y^{\prime})}(x^{\prime})>0$. Note that $\vec{\alpha}_{i}^{(y)}(x)>0$ implies $q_{Z|XY}(z|x,y)>0$ for every $z\in\mathcal{Z}_{i}^{(y)}$; $\vec{\alpha}_{j}^{(y^{\prime})}(x)=0$ implies $q_{Z|XY}(z^{\prime}|x,y^{\prime})=0$ for every $z^{\prime}\in\mathcal{Z}_{j}^{(y^{\prime})}$; and $\vec{\alpha}_{j}^{(y^{\prime})}(x^{\prime})>0$ implies $q_{Z|XY}(z^{\prime}|x^{\prime},y^{\prime})>0$ for every $z^{\prime}\in\mathcal{Z}_{j}^{(y^{\prime})}$. Since $u\in\mathcal{U}_{i}^{(y)}\cap\mathcal{U}_{j}^{(y^{\prime})}$, there exists $z\in\mathcal{Z}_{i}^{(y)}$ and $z^{\prime}\in\mathcal{Z}_{j}^{(y^{\prime})}$ such that $p(u,z|y)>0$ and $p(u,z^{\prime}|y^{\prime})>0$. These imply – by privacy against Bob – that $p(u,z|x,y)>0$ and $p(u,z^{\prime}|x^{\prime},y^{\prime})>0$. Now consider $p(u,z^{\prime}|x,y^{\prime})$ and expand it as follows:

[TABLE]

We used the Markov chain $U-X-Y$ to write $p(u|x,y^{\prime})=p(u|x)$, where $p(u|x)>0$ because $p(u,z|x,y)>0$. We used the Markov chain $Z-(Y,U)-X$ to write $p(z^{\prime}|x,y^{\prime},u)=p(z^{\prime}|y^{\prime},u)$ in (161), which is greater than zero because $p(u,z^{\prime}|x^{\prime},y^{\prime})>0$. Putting all these together in (162) gives $p(u,z^{\prime}|x,y^{\prime})>0$, which implies $q_{Z|XY}(z^{\prime}|x,y^{\prime})>0$, a contradiction. ∎

Proof of Claim 3.

Since the Markov chain $U-X-Y$ holds, we have that the set of messages that Alice sends to Bob are same for all inputs of Bob. Now it follows from Claim 2 that for every $y\in\mathcal{Y}$ we can partition the set of all possible messages $\mathcal{U}$ as follows: $\mathcal{U}=\mathcal{U}_{1}^{(y)}\biguplus\mathcal{U}_{2}^{(y)}\biguplus\ldots\biguplus\mathcal{U}_{k(y)}^{(y)}$, where $\mathcal{U}_{i}^{(y)}$ is as defined earlier in (46). Consider any two $y,y^{\prime}\in\mathcal{Y}$. We have

[TABLE]

First observe that $k(y)=k(y^{\prime})$. Otherwise, there exists $i\in[k(y)]$ and $j\in[k(y^{\prime})]$ such that $\mathcal{U}_{i}^{(y)}\cap\mathcal{U}_{j}^{(y^{\prime})}\neq\phi$ and $\vec{\alpha}_{i}^{(y)}\neq\vec{\alpha}_{j}^{(y^{\prime})}$, which contradicts Claim 2. From now on we denote $k(y)$ by $k$ for every $y\in\mathcal{Y}$.

Suppose $\{\vec{\alpha}_{1}^{(y)},\vec{\alpha}_{2}^{(y)},\ldots,\vec{\alpha}_{k}^{(y)}\}\neq\{\vec{\alpha}_{1}^{(y^{\prime})},\vec{\alpha}_{2}^{(y^{\prime})},\ldots,\vec{\alpha}_{k}^{(y^{\prime})}\}$. It means that there exists an $i\in[k]$ such that $\vec{\alpha}_{i}^{(y)}\notin\{\vec{\alpha}_{1}^{(y^{\prime})},\vec{\alpha}_{2}^{(y^{\prime})},\ldots,\vec{\alpha}_{k}^{(y^{\prime})}\}$. Since $\mathcal{U}_{i}^{(y)}$ is associated with $\vec{\alpha}_{i}^{(y)}$, we have by (163) that $\mathcal{U}_{i}^{(y)}\notin\mathcal{U}_{1}^{(y^{\prime})}\biguplus\mathcal{U}_{2}^{(y^{\prime})}\biguplus\ldots\biguplus\mathcal{U}_{k}^{(y^{\prime})}$. This contradicts (163). ∎

Appendix I Proofs of Theorems 9 and 10

Proof of Theorem 9.

‘Only if’ part: (1) has been shown in Claim 3. (2) follows from the following argument: take any $x\in\mathcal{X}$ and consider the following set of equalities:

[TABLE]

where (a) and (c) follow from the fact that Bob’s output $Z$ belongs to $\mathcal{Z}_{i}^{(y)}$, when his input is $y$ (or belongs to $\mathcal{Z}_{i}^{(y^{\prime})}$, when his input is $y^{\prime}$) if and only if the message $U$ that Alice sends to Bob belongs to $\mathcal{U}_{i}$. (b) follows from the Markov chain $U-X-Y$.

‘If’ part: We show this direction by giving a secure protocol in Figure 6. Now we prove that this protocol is perfectly secure, i.e., it satisfies perfect correctness and perfect privacy.

Correctness: Suppose the protocol of Figure 6 produces an output according to the p.m.f. $p_{Z|XY}(z|x,y)$. We show below that $p_{Z|XY}(z|xy)$ is equal to $q_{Z|XY}(z|x,y)$.

[TABLE]

In (165) we assume that $z\in\mathcal{Z}_{i}^{(y)}$, and (165) is an equality because the message that Alice sends to Bob is a deterministic function of Bob’s input and output. In (166) we used the Markov chain $U-X-Y$ to write $p(u_{i}|x,y)=p(u_{i}|x)$ and $Z-(U,Y)-X$ to write $p(z|u_{i},x,y)=p(z|u_{i},y)$. In (167) we substituted the values of $p(u_{i}|x,y)$ and $p(z|u_{i},y)$ from the protocol of Figure 6. In (168) we used the facts that $\sum_{z\in\mathcal{Z}_{i}^{(y)}}q_{Z|XY}(z|x,y_{1})=\sum_{z\in\mathcal{Z}_{i}^{(y)}}q_{Z|XY}(z|x,y)$ (which follows from the assumption – see the second item in the theorem statement) and $\frac{q_{Z|XY}(z|x^{\prime},y)}{\sum_{z\in\mathcal{Z}_{i}^{(y)}}q_{Z|XY}(z|x^{\prime},y)}=\frac{q_{Z|XY}(z|x,y)}{\sum_{z\in\mathcal{Z}_{i}^{(y)}}q_{Z|XY}(z|x,y)}$ (which follows from the fact that the matrix $A_{i}^{(y)}=\vec{\alpha}_{i}^{(y)}\times\vec{\gamma}_{i}^{(y)}$, defined earlier, is a rank-one matrix).

Privacy: we need to show that if $p_{Z|XY}(z|x_{1},y)>0$ and $p_{Z|XY}(z|x_{2},y)>0$ for some $x_{1},x_{2},y,z$, then for every $u_{i}$, $p(u_{i}|x_{1},y,z)=p(u_{i}|x_{2},y,z)$ must hold. This follows because $p(u_{i}|x,y,z)=\mathbbm{1}_{\{z\in\mathcal{Z}_{i}^{(y)}\}}$, i.e., $u_{i}$ is a deterministic function of $(y,z)$ and is independent of Alice’s input. ∎

Remaining proof of Theorem 10.

Here we only show that $\mathbb{E}[L]\geq H(W)$, where $L,W$ are defined in the proof of Theorem 10.

[TABLE]

(169) holds because $l(u)$ is deterministic function of $u$. (170) follows from the Markov chain $U-X-Y$. (171) follows from the fact that when Bob has $y_{1}$ as his input, his output $Z$ belongs to $\mathcal{Z}_{i}^{(y)}$ if and only if $U$ belongs to $\mathcal{U}_{i}$. In (172) we used the equality $p_{W|X}(i|x)=\sum_{z\in\mathcal{Z}_{i}^{(y)}}q_{Z|XY}(z|x,y)$ (see (48)). Since $l(u)_{i\in\mathcal{U}}$’s are lengths of a valid prefix-free encoding of $U$, and $l_{i}=\min_{u\in\mathcal{U}_{i}}l(u)$ for $i\in[k]$, it can be verified that $l_{1},l_{2},\ldots,l_{k}$ are lengths of a valid prefix-free encoding of $W$. The random variable $L^{\prime}$ in (173) corresponds to this prefix-free encoding of $W$, where $\Pr\{L^{\prime}=l_{i}\}=p_{W}(i)$. Inequality (174) follows from the fact that the expected length of any prefix-free binary code for a random variable $W$ is lower-bounded by $H(W)$ [44, Theorem 5.4.1]. Since this argument holds for any prefix-free encoding of $U$, we have $L^{*}_{B-\text{pvt}}\geq H(W)$.

∎