Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Imagine multiple parties executing a secure multiparty computation protocol to evaluate a function securely. Let Alice be one of the parties who is intended to get all the partial results and combine these partial results into complete result at the end of the protocol.

In practice , if Alice's machine is compromised and the attacker is impersonating Alice and he has the complete results at the end of the protocol, what kind of adversary would he be in theory ?

Attacker is not passive adversary, he is not eaves dropping all the parties.

Is attacker an active adversary ( or byzantine adversary ) ? I believe active adversaries corrupt the parties to execute arbitrary/malicious code etc. But here attacker is not corrupting the parties to do some computation of his choice rather he compromised the party that is intended to get the results .

Is attacker an non-adaptive adversary ? attacker infact control only one party but he has complete results .

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

I believe what you are describing is somewhat orthogonal to typical MPC adversary models. Typically in MPC we let the adversary know all information that corrupt parties know (so if a corrupt party learns the output, the adversary is allowed to learn the output). What we care about in MPC protocols is that the adversary is not able to learn any additional information (e.g., inputs of uncorrupted parties, intermediate computation results, etc).

So, if the adversary has corrupted Alice, and Alice is intended to get the results, then the adversary is allowed to know the result and that is okay by the definition of MPC. In that case, the adversary could very well indeed be a passive adversary. You could consider it an adaptive adversary if they don't know to attack Alice in the beginning, but figure that out during execution, corrupt her, learn the output.

So, say for example we are using MPC to tally votes and the vote tally is revealed to Alice at the end of the protocol. The fact that the adversary corrupts Alice and learns the vote tally at the end is okay and still meets the security definitions of MPC. What she shouldn't be able to learn is an individual's vote.

To fix this, say let Alice learn the vote tally only if she is not corrupt, then we need some way of detecting whether or not she is corrupt.

share|improve this answer
    
may be a dumb question, what is difference between attacker and adversary ? –  sashank Aug 2 '13 at 19:16
    
No difference afaik –  mikeazo Aug 2 '13 at 19:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.