A d-multiplicative secret sharing (d-MSS) scheme allows the players to multiply d shared secrets without recovering the secrets by converting their shares locally into an additive sharing of the product. It has been proved that the d-MSS among n players is possible if and only if no d unauthorized sets of players cover the whole set of players (type Qd). Although this result implies some limitations on SS in the context of MPC, the d-multiplicative property is still useful for simplifying complex tasks of MPC by computing the product of d field elements directly and non-interactively without any setup. This paper aims to improve the usefulness of the d-MSS by enhancing the security against malicious adversaries. First, we introduce the notion of verifiably multiplicative SS, verifiably MSS for short, which is mainly formalized for detecting malicious behaviors. Informally, an SS scheme is verifiably d-multiplicative if the scheme is d-multiplicative and further enables the players to locally generate a share of a proof that the summed value is correct (i.e., the product of d shared secrets). Secondly, we prove that there is no error-free verifiably MSS scheme whose decoder of the proof is additive, and that by accepting an error probability that can be chosen arbitrarily, there exists a verifiably d-MSS scheme realizing a given access structure if and only if the access structure is of type Qd. In the proposed construction, each share of a proof consists of only two field elements. This result means that we can efficiently achieve the optimal resiliency of the standard d-MSS even against malicious adversaries. We note that by allowing a general class of decoders that includes a linear one, there is an error-free verifiably d-MSS scheme if the access structure is of type Qd+1. Finally, we generalize the d-multiplicative property to a d-or-less version where the number d' of multiplied secrets with d' ≤ d is not known in advance. We show that a d-or-less MSS scheme can be constructed from any d-MSS scheme of the same access structure with a constant overhead, and the feasibility of (verifiably) d-MSS implies that of (verifiably) d-or-less MSS.

Secure multi-party computation (MPC) enables multiple players to cooperatively evaluate various functions in the presence of adversaries. In this paper, we consider non-interactive MPC (NIMPC) against honest-but-curious adversaries in the information-theoretic setting, which was introduced by Beimel et al. at CRYPTO 2014. Their main focus is to realize stronger security while completely avoiding interaction, and succeeded to show that every function admits a fully robust NIMPC protocol. In this paper, we further develop the study of NIMPC. We first present a simple lower bound on the communication complexity derived from the correctness requirement of NIMPC. Secondly, we present an efficient NIMPC protocol for indicator functions, which is an important building block of NIMPC protocols. An NIMPC protocol for arbitrary functions is also constructed from the proposed NIMPC for indicator functions by using the generic compiler introduced by Beimel et al. in CRYPTO 2014. The communication complexities of NIMPC protocols presented in this paper are much more efficient than the previous ones. In fact, the gap between the lower and upper bounds of the communication complexity is reduced from exponential in the input length to quadratic . Finally, we show some improvements on the efficiency in the so-called offline-online model. Specifically, for some sets of functions, the exponential amount of offline communication reduces the online communication to almost optimum amount in the standard model.