In this paper on pg. 1236, under the section "Security Against Continual Leakage", the authors say:
"We further remark that the weaker security notion previously achieved cannot be extended meaningfully to continual leakage in the MPC setting. That is, it cannot address the setting where the $n$ users do not just perform a one-shot MPC protocol, but rather engage in an unbounded number of MPC protocols for many functions, and during each MPC invocation the adversary leaks $\ell$ bits from each of the honest party’s internal state."
I'm confused about the difference between a "one-shot" MPC protocol vs. "unbounded number" of MPC protocols.
I am envisioning something like:
- MPC protocol 1: leaks $\ell$ bits from each honest party's internal state
- MPC protocol 2: leaks $\ell$ new bits from each honest party's internal state
- MPC protocol 3: leaks $\ell$ new bits from each honest party's internal state
- MPC protocol $k$: leaks $\ell$ new bits from each honest party's internal state
If there are a total of $n$ honest parties, then you have a total leakage of $n \times \ell \times k$ bits.
But if you consider the "one-shot" MPC protocol, you get just $n \times \ell$ bits leaked.
They give an example of threshold cryptography and say that, when you have a bunch of parties that compute a decryption function jointly, you may end up with the entire decryption key leaked, because every time $\ell$ bits are leaked, you can think of it as if $\ell$ bits of the decryption key were leaked.
Why are the authors even considering this "unbounded number" of MPC protocols ?