Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I would like to perform a dot product operation among $m$ parties using Shamir's $(m,m)$ secret sharing that is used for Secure Multiparty Computation.

I am aware that Shamir's $(m,m)$ scheme is additively homomorphic, but can someone please provide an example of how I can use it for multiplicative homomorphism for SMC?

share|improve this question

migrated from mathoverflow.net Apr 4 at 15:00

This question came from our site for professional mathematicians.

    
Welcome to Crypto.SE :) Remember to sign up on this site and link your accounts to reclaim ownership of your question. –  figlesquidge Apr 4 at 15:03
    
Sorry for the edit clash DrL –  figlesquidge Apr 4 at 15:05
    
@figlesquidge no problem ;) –  DrLecter Apr 4 at 15:07
    
This might help: research.cyber.ee/~peeter/teaching/seminar07k/bogdanov.pdf –  rphv Apr 4 at 19:15
    
Thanks. This paper does explain multiplicative homomorphism using Shamir's scheme. However what i want to do is multiplication e.g. using 3 parties and each of them has a secret and acts as a dealer. Can someone provide an example for this. –  nie_11 Apr 7 at 2:32

1 Answer 1

As far as I know, you can not do multiplication with (m,m) shamir secret sharing. The typical method to do multiplication on shamir secret shares increases the degree of the sharing polynomial, which is why the parties run an additional protocol to reduce the degree. That is why the degree of the sharing polynomial must be less than $m/2$ if there are $m$ parties.

If you indeed need (m,m) (or $m$ out of $m$ parties must be present to do reconstruction and multiplication), and the only operation you need to compute is multiplication (which I'm not sure about since your comments state you want to do multiplication, but your question mentions dot product), then I'd suggest using multiplicative secret sharing.

If instead you need $m$ out of $m$ computation/reconstruction, but need to do both addition and multiplication operations, you'll have to go with some of the newer MPC constructions which achieve full-threshold security (SPDZ and some of it's references or subsequent works which cite it).

share|improve this answer
    
Thanks for the info. I agree multiplicative secret sharing would work to multiply the values. However my scenario has boolean values at each distributed site. In that case for a '0' if i send shares; one of them will be zero and that will disclose the secret. Any pointers? –  nie_11 Apr 11 at 10:15
    
Also could you suggest a paper with the multiplicative secret sharing scheme that you have explained in your earlier post. Thanks. –  nie_11 Apr 11 at 11:33
1  
@nie_11 I was never able to find a paper on multiplicative secret sharing which is why I asked about it here. In some sense, multiplicative secret sharing is just additive secret sharing in a multiplicative group. Which leads us to 0 (and something I hadn't thought about previously). If we consider the multiplicative group of integers modulo some $n$, 0 is not in that group. So it makes sense 0 won't work. –  mikeazo Apr 11 at 11:53
    
Thanks a ton. That means i have to think of some homomorphic cryptographic scheme which is not something i wanted to do in the first place. –  nie_11 Apr 12 at 19:01
    
[link]google.co.in/… does use multiplicative secret sharing . p10 and 21. Although its a different setting.@mikeazo –  nie_11 Apr 12 at 19:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.