Secure Point Extraction Protocol

• Secure Point Extraction Protocol is a cryptographic framework that enables clients to outsource secret polynomial evaluations while maintaining information-theoretic confidentiality and verifiability.
• It leverages bilinear pairings and linearly homomorphic encryption to efficiently compute and verify polynomial proofs, even for large-scale or terabyte-level data.
• The protocol supports dynamic coefficient updates and robust verifiable evaluation using rigorous security reductions based on discrete logarithm assumptions and t-BSDH.

A Secure Point Extraction Protocol enables a client to outsource a secret polynomial $f(X)=\sum_{i=0}^d a_i X^i \in \mathbb{F}_p[X]$ to an untrusted server, have the polynomial evaluated at public points, and efficiently verify the results while maintaining information-theoretic confidentiality of the coefficients $\{a_i\}$. This protocol, formalized in the VDPE (Verifiable Dynamic Polynomial Evaluation) framework, supports dynamic coefficient updates and underpins efficient Dynamic Proofs of Retrievability (DPoR) for large-scale remote data storage. The construction presented in the VESPo protocol leverages linearly homomorphic encryption, bilinear pairings, and polynomial-masking techniques to achieve soundness, privacy, and performance even at terabyte and million-term polynomial scales (Dumas et al., 2021).

1. System Entities and Security Definitions

The protocol involves two parties: a client $\mathcal{C}$ that holds the secret polynomial, and a server $\mathcal{S}$ that stores an encrypted (and masked) version of the polynomial along with public evaluation data. The threat model assumes a single malicious server that may arbitrarily deviate from the protocol but is computationally bounded by discrete logarithm-type hardness assumptions.

The primary goals are:

• Confidentiality: Coefficients $\{a_i\}$ remain hidden from $\mathcal{S}$.
• Soundness: Any incorrect polynomial evaluation or proof from $\mathcal{S}$ will be detected by $\mathcal{C}$, except with negligible probability.
• Privacy: No adversary (even interacting with setup, update, and evaluation APIs) can distinguish between two polynomials of the same degree.

Correctness, soundness (using a $t$-BSDH reduction), and privacy (using DLM) are guaranteed through the sequence of algorithms: $\text{Setup}$, $\{a_i\}$0, $\{a_i\}$1, $\{a_i\}$2, $\{a_i\}$3 (Dumas et al., 2021).

2. Cryptographic Foundations

Bilinear Pairings and Groups

The scheme operates in prime-order groups $\{a_i\}$4 with generators $\{a_i\}$5, $\{a_i\}$6, and an efficiently computable, non-degenerate pairing function $\{a_i\}$7 satisfying $\{a_i\}$8.

Linearly Homomorphic Encryption (LHE)

A public-key LHE scheme $\{a_i\}$9 over $\mathcal{C}$0 supports:

$\mathcal{C}$1

An example instantiation is Paillier encryption modulo an RSA composite $\mathcal{C}$2 with appropriate size constraints.

Exponent Vector Algebra

Vectors $\mathcal{C}$3 and $\mathcal{C}$4 define a "dot-product in exponents" as $\mathcal{C}$5. Similarly, for an LHE ciphertext vector, $\mathcal{C}$6.

Difference-Polynomial Identity

The central evaluation check uses the identity:

$\mathcal{C}$7

yielding, in exponent form,

$\mathcal{C}$8

This underpins the succinct verifiable proof of correct evaluation.

3. Protocol Initialization: Setup Phase

Upon input of the secret polynomial, the client executes:

1. Key generation: $\mathcal{C}$9 for LHE.
2. Randomness sampling: $\mathcal{S}$0, $\mathcal{S}$1, $\mathcal{S}$2, and a $\mathcal{S}$3 invertible $\mathcal{S}$4 with $\mathcal{S}$5 invertible.
3. Coefficient masking: $\mathcal{S}$6.
4. Encryption: $\mathcal{S}$7.
5. Auxiliary data computation: Powers of $\mathcal{S}$8 for evaluation, masked exponent generators $\mathcal{S}$9, and commitment $\{a_i\}$0.
6. Optionally, a Merkle tree over $\{a_i\}$1 is constructed for integrity in "Read".

Storage Assignment

Entity	Data Held
Server ($\{a_i\}$2)	$\{a_i\}$3
Client ($\{a_i\}$4)	$\{a_i\}$5

At completion, all evaluation and verification subsequent to setup can proceed with these state variables.

4. Secure Evaluation and Verification Workflow

Evaluation Phase

Given a public challenge point $\{a_i\}$6:

• From $\{a_i\}$7:

1. Compute the LHE-encrypted evaluation $\{a_i\}$8. 2. Produce a succinct pairing-based proof $\{a_i\}$9 using the masked exponents and difference-polynomial identity, as per Algorithm 4.4.

• Server sends $\mathcal{S}$0 to the client.

Verification Phase

Upon receipt:

1. Decryption: $\mathcal{S}$1, representing $\mathcal{S}$2.
2. Auxiliary computation: Calculate $\mathcal{S}$3 via the "Projected Matrix Geometric Sum" using Algorithm 5.2.
3. Pairing checks: For $\mathcal{S}$4,

$\mathcal{S}$5

If both equalities hold, $\mathcal{S}$6 is accepted as $\mathcal{S}$7; otherwise, reject.

5. Dynamic Polynomial Updates

The protocol supports efficient, non-interactive updates to individual coefficients $\mathcal{S}$8, preserving future correctness for evaluations and verifications without full reinitialization.

• Client computes: $\mathcal{S}$9, $\mathcal{S}$0
• Update message: Client sends $\mathcal{S}$1 to the server.
• Server updates:

1. Ciphertext $\mathcal{S}$2 2. Masked exponent $\mathcal{S}$3 (coordinate-wise)

• Client updates: $\mathcal{S}$4

All update steps require $\mathcal{S}$5 group operations for affected components only.

6. Security Reductions and Complexity

The protocol’s soundness is tightly reduced to the $\mathcal{S}$6-BSDH problem in the pairing groups; thus, a successful forgery yields $\mathcal{S}$7. Extraction (for PoR) reduces to solving discrete-log via the MDDH family and a "one-coordinate hidden" argument. Privacy derives from the DLM assumption on the masked $\mathcal{S}$8 combined with Paillier encryption’s semantic security.

The complexity profile is as follows (degree $\mathcal{S}$9):

Aspect	Asymptotic Complexity
Client storage	$\mathcal{C}$0 (only secrets $\mathcal{C}$1)
Server storage	$\mathcal{C}$2 (ciphertexts and group elements)
Per evaluation communication	$\mathcal{C}$3 (one LHE ciphertext + two group elements)
Client verification time	$\mathcal{C}$4 (including pairings, field ops, decryption)
Server evaluation time	$\mathcal{C}$5, parallelizable ($\mathcal{C}$6 for $\mathcal{C}$7 cores)

Empirical Benchmarks

On a 2.6 GHz core with 254-bit pairing and 2048-bit Paillier:

Degree $\mathcal{C}$8	Server Eval (1 core)	Server Eval (4 cores)	Client Verify
$\mathcal{C}$9	0.20 s ($t$0) + 0.15 s ($t$1)	0.07 s + 0.05 s	0.7 ms
$t$2	60.8 s + 39.0 s	16.2 s + 10.9 s	0.7 ms

For a 1 TB database under DPoR instantiation, client audit is $t$3 ms, persistent client storage $t$4 KB, communication $t$5 KB, and server-side audit under a few minutes on 12 cores, incurring only 0.08% additional storage (Dumas et al., 2021).

7. Context, Applicability, and Future Prospects

Secure Point Extraction Protocols, and specifically the VESPo realization, provide verifiable and privacy-preserving outsourced polynomial evaluation with minimal client involvement. Leveraging cryptographic primitives such as bilinear pairings and LHE, they overcome previous limitations of static polynomial commitments, enabling scalability to million-term polynomials and terabyte-scale data via DPoR.

A plausible implication is that such protocols will underpin practical proof systems in remote storage platforms and privacy-preserving cloud computation. The ability to support dynamic updates and efficient audits, coupled with rigorous security reductions and real-world efficiency, suggests suitability for large distributed storage or verifiable outsourced computation scenarios. Open directions include optimizing server-side performance and extending the approach to richer function classes beyond polynomials (Dumas et al., 2021).