1

My question is regarding a well-known protocol for computing the multiplicative inverse of a nonzero secret-shared field element. Given $[x]$, the parties generate shares $[r]$ of a uniformly random field element $r$, compute $[rx]$ and reveal. If $rx=0$, they restart. Otherwise, they compute $(rx)^{-1}=r^{-1}x^{-1}$. Then $[x^{-1}]=r^{-1}x^{-1}[r]$.

In this post: How to do division in secure multi-party computation (mpc)?, an answer mentions this protocol and states

"This protocol will cost you one multiplication and one opening. If you have special preprocessing tuples like $([r],[r^{-1}])$ then you can do better."

Does anyone know how such a tuple could be used to optimize the protocol?

0 Answers0