Blind evaluation of a polynomial

Suppose Jennifer has a polynomial P of degree d , and Ted has a point s ∈ F p that he chose randomly. Ted wishes to learn E ( P ( s ) ) , i.e., the HH of the evaluation of P at s .

Two simple ways to do this are:

Jennifer sends P to Ted, and he computes E ( P ( s ) ) by himself.

Ted sends s to Jennifer; she computes E ( P ( s ) ) and sends it to Ted.

However, in the blind evaluation problem we want Ted to learn E ( P ( s ) ) without learning P – which precludes the first option; and, most importantly, we don’t want Jennifer to learn s , which rules out the second.

Using HH, we can perform blind evaluation as follows.

Ted sends to Jennifer the hidings E ( 1 ) , E ( s ) , … , E ( s d ) .

Jennifer computes E ( P ( s ) ) from the elements sent in the first step, and sends E ( P ( s ) ) to Ted. (Jennifer can do this since E supports linear combinations, and P ( s ) is a linear combination of 1 , s , … , s d . ).

Note that, as only hidings were sent, neither Jennifer learned s [2], nor Ted learned P .