Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Most of the research papers give imaginary applications of multi-party computation.

Either they talk about Yao's millionares' problem or two or more corporates willing to compute some intrustion detection stuff collectively on their private data without revealing their network logs or similar.

In reality, what are the practical use cases for multi-party computation?

Sharemind is trying to achieve cloud privacy of data computations (of single party) by distributing to multiple cloud servers but here there are no multiple parties as such.

While Homomorphic encryption is touted as special case of SMC, but its still single party outsourcing computations.

share|improve this question
2  
eprint.iacr.org/2008/068.pdf $\:$ – Ricky Demer Oct 29 '12 at 8:26
    
Thanks Ricky , how did i forget this Sugar beet auction , thanks anyway ! , any other usecases ? – sashank Oct 29 '12 at 9:00
    
In 2015, Sharemind was also used in a privacy-preserving statistical study on two private, secret shared governmental databases to determine whether working during university studies correlates with failing to graduate in time (eprint). – jotik Apr 29 at 20:50
    
Secure multi-party computation (although in a somewhat different form) can also be used as a side-channel attack countermeasure. – Aleph Apr 30 at 8:38
    
@Aleph i heard of this some where else too but any references ? – sashank Apr 30 at 9:42
up vote 3 down vote accepted

There have been almost no examples of multi-party computation being used and deployed in the real world to date.

(The primary example is the sugar beet auctions. There are many other proposals, but they have not been deployed anywhere as far as I know. For example, there are cryptographic voting schemes that have been proposed, but have not been widely used. And there are applications to, e.g., genomic privacy that have been proposed in research papers but have not, to my knowledge, been deployed in practice. Some other uses that have been proposed, but not deployed or used in practice, as far as I know, include secure supply chain management and avoiding satellite collisions.)

It's still very cool stuff, nonetheless....

share|improve this answer

As I mentioned in a comment, a relatively new application of multi-party computation is its use as a countermeasure against (mainly hardware) side-channel attacks. In particular, there is a method called "threshold implementations" which is based on a form of secret sharing.

A relevant reference would be the paper Secure Hardware Implementations of Nonlinear Functions in the Presence of Glitches by S. Nikova, V. Rijmen and M. Schläffer. Extensions to higher-order DPA attacks have also been proposed.

Let's say you wish to securely implement a Boolean function $f$ with $n$ input bits. The (secret) input $x = (x_1, \ldots, x_n)$ is then "shared" by (randomly) choosing additive shares $x_{i, j}$ such that

$$x_i = \bigoplus_{j = 1}^{s_{in}}x_{i, j}.$$

I'll write $\mathbf{x} = (x_{1, 1}, x_{1, 2}, \ldots, x_{1, s_{in}}, x_{2, 1}, \ldots, x_{n, s_{in}})$ for convenience below.

The idea is then to share $f$ too, in such a way that for all inputs $x$ and correct sharings $\mathbf{x}$

$$f(x) = \bigoplus_{i = 1}^{s_{out}} f_i (\mathbf{x}).$$

This is called the correctness property. We now also require that $f_i$ is independent of every $i$th share of $x$. So each $f_i$ actually operates on $n(s_{in} - 1)$ rather than $ns_{in}$ inputs. This is called the non-completeness property.

Under the non-completeness assumption, the paper shows that if $x$ is shared with independent uniformly chosen shares, then $f_i$ (as well as any intermediate result) is independent of the input shares $x_{k, i}$ with $k = 1, \ldots, n$. This then leads to pipelined implementations which are secure against first-order (i.e. using first-order statistical moments) side-channel attacks. For more details, take a look at the paper (or other papers on the same subject).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.