Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In the paper "Multiparty Computation Secure Against Continual Memory Leakage" on pg. 1239 the footnote at the bottom points out the difference between $joint$ leakage and $disjoint$ leakage. The authors say the weakly leakage resilient protocol of BGG+11 cannot be directly used because it only applies to $joint$ leakage.

My understanding is the adversary has been made more powerful and is able to perform disjoint leakage (i.e. he can make leakage requests on random modules at any time).

I was wondering if somebody could explain this footnote a bit more clearly. Why does a weakly resilient protocol not apply directly?

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.