0 55 4 - 19 89

Each of two parties P I and P 2 holds an n -bit input, x and y, respectively. They wish to privately compute the value off (x 'Y). That is, PI should not learn any additiorlal infonnation about y (in the infonnationtheoretic sense) other than what follows from its input x and the function value, f (x 'Y), and similarly, P 2 ~hou1d not learn any additional infonnation about x . In this paper we consider two ba~ic questions in the theqry of private computations: I) Which functions can be privately computed? .~) What is the communication complexity of protocols U\at privately compute a function f (in the case that such protocols eXi&b ? A complete combinatorial characterization df privately computable functions is given. We use this characteri~tion to derive tight bounds on the rounds complexity of aqr privately computable function, and to design optimal private protocols that compute these functions. We show that for every ISg(n)S2'2 there are functions that can be privately computed with g(n) -rounds of cpmmunication, but not with g (n}-I -rounds of communication. This implies that the communication costs of private protocols can be exponentially higher than the commpnication costs of non-private protocols. Iq~restingly, randomization does not help neither to increase th~ set of privately computable functions, nor to improve ,the rounds complexity of these functions. T ec hn io n C om pu te r Sc ie nc e D ep ar tm en t T eh ni ca l R ep or t C S0 55 4 19 89