Tagged Questions

Multi-party computation (MPC) allows a set of parties, each with a private input, to securely and jointly perform any computation over their inputs.

learn more… | top users | synonyms (3)

0
votes
0answers
8 views

Secure(verifiable, delegated, outsourced) computation

Can we think "secure (verifiable, delegated, outsourced, 2-parties and multi-parties) computation" as a same single concept, or should we consider these secure protocols as different concepts? If ...
2
votes
2answers
71 views

Real life systems that use concepts of crypto computing

Are there any working cloud/internet solutions/products that operates on encrypted data such as systems using homomorphic encryption, secure multiparty computation, electronic voting, private ...
0
votes
1answer
85 views
+50

Secure Multiparty Sum in malicious model using threshold encryption

Suppose $n$ actors each hold a plaintext $p_i$. We wish to find $\sum p_i$, without leaking any information about individual $p_i$. Any actor (or any link in the network) could be controlled by an ...
5
votes
2answers
347 views

What does “circuits” mean in Cryptography?

I am not a hardcore cryptographer so this might be a really stupid question. I am looking through some papers in homomorphic encryption and discovered they describe computation as "circuits", why do ...
1
vote
1answer
68 views

Why can't garbled circuits be reused?

There are a bunch of papers do research on resizable garbled circuits. But I wonder why garbled circuits cannot be reused? For example, the constructor constructs a garbled circuit of "AND" like ...
2
votes
1answer
79 views

Implementation of garbled circuits using RSA

I was just reading these notes on garbled (Yao) circuits and I just stuck trying to figure out how an implementation of Table 1 would work using RSA encryption. In RSA the public key is (n,e). So for ...
1
vote
0answers
55 views

Forward pseudorandom permutation [closed]

Please consider the following scenario: The user A and B use their keys, K1 and K2 respectively. Each client have a vector of elements. Each client separately permutes his vector using his key and ...
2
votes
1answer
84 views

Secure MultiParty Computation with secret inputs for secret outputs

I want to know if it’s possible to use a SMPC (Secure Multi-Party Computation) to have $N$ entities compute the outcome of a known mathematical operation with two or more secret inputs, where each ...
1
vote
1answer
44 views

server aid secure equality test

The scenario is like this: $P_1$ has $m_1$, $P_2$ has $m_2$, they want to compare whether $m_1=m_2$ via the server $S$. After the protocol, only $S$ knows the result, and there is no interaction ...
2
votes
1answer
111 views

Hamiltonicity proof of knowledge

I'm learning the POK notion and definitions and as a self exercise I wante to prove the statement that the Hamiltonicity protocol is a POK system with knowledge error $1/2$. So the question will be ...
2
votes
1answer
98 views

Computing youngest person among 3 while keeping ages private

I already found a protocol to find out who is richer (older) between two parties, but Is there any protocol to find the youngest person among 3 parties, without revealing actual ages?
3
votes
1answer
199 views

Can I use Shamir's secret sharing scheme for multiplicative homomorphism for secure multiparty computation?

I would like to perform a dot product operation among $m$ parties using Shamir's $(m,m)$ secret sharing that is used for Secure Multiparty Computation. I am aware that Shamir's $(m,m)$ scheme is ...
3
votes
2answers
144 views

secure integer comparison

I have been going through a huge amount of papers to find a simple and a practical method to compare integer numbers without revealing their original values. I know that this falls within the area of ...
3
votes
2answers
74 views

Group membership with unique anonymous claims

Is it possible to accomplish the following scheme? There is a Server (S) and many clients. Each client enrolls with S, exposing its real identity; S saves the real identity information in its ...
4
votes
1answer
122 views

Private set intersection, using a semi-trusted server

Alice has a set $S$ of words. Bob has a set $T$ of words. They want to compute the intersection $S \cap T$ of their words, with the help of a semi-trusted third party Trent. Trent runs a central ...
1
vote
0answers
77 views

Why do authors execute a leakage resilient election protocol inside a leak-free phase?

In the paper "Multiparty Computation Secure Against Continual Memory Leakage", on page 1241 (that's page 7 of the PDF) under section 2.3, the authors discuss "The Election Protocol" that they use to ...
2
votes
1answer
143 views

Shamir Secret Sharing Modular Reduction

Say players use Shamir's secret sharing to share a value $k$ such that each player now holds $k_i$, a share of $k$. How can they securely compute $k \bmod m$ for some $m$. Of course they can ...
5
votes
1answer
132 views

Secure degree reduction for Shamir's secret sharing

I understand the basic Shamir Secret Sharing protocol, and when two shares are multiplied, the degree of the polynomial increases. I've seen in a number of papers a reference to a degree reduction ...
2
votes
1answer
103 views

Where can I find source code for ideal world simulation?

In many crypto papers I see they use a Real World / Ideal World Paradigm. However, I have never see the source code of such Simulators that try to simulate the adversary. Could somebody point me to ...
0
votes
0answers
72 views

Where can I find source code of a compiler that secures a circuit (or attemps to)? [closed]

In the paper “Multiparty Computation Secure Against Continual Memory Leakage”, on page 1239 under section “Using an LDS Compiler Instead of OCL Compiler”, the authors discuss why they decided to use ...
2
votes
1answer
91 views

2PC Private Set Intersection Optimized for asymmetrically sized sets

I am researching some concepts of practical 2 party computation and was curious if anyone could point me to a research paper that is focused on private set intersection where one party has a very ...
10
votes
1answer
350 views

Shared secret: Generating Random Permutation

-- or: How to Play Poker Without a Dealer I know this question is long but it's a really interesting theoretical problem about shared secrets and multi-party computation. General Problem: "Shared ...
2
votes
0answers
71 views

How do you distribute secret shares without knowing who to first distribute them to?

Figure 1 on page 1249 of the “Multiparty Computation Secure Against Continual Memory Leakage” paper shows $m$ committees are elected in step 1 and then later in step 3 are each given a secret share. ...
3
votes
1answer
55 views

Oblivious Transfer where neither party learns the index of the message

In a traditional Oblivious Transfer setting, the sender has a list $(x_1, x_2, ... , x_n) \in G$ where $G$ is the chosen group. The receiver has $b \in \mathbb{N}$, such that engaging in the protocol ...
3
votes
1answer
243 views

Single Party Encryption, Multi Party Decryption

I am looking for an adequate protocol for public key decryption, which would allow $n$ parties to jointly decrypt a cipher text. The usage scenario for such a protocol would be a mixnet that wouldn't ...
1
vote
1answer
174 views

Outsourcing arbitrary computations securely

Consider the following scheme. Alice wants Bob to make some computations for her, but she doesn't want to reveal the data on which he's going to do it. So, she encrypts the data, sends them to Bob, he ...
2
votes
1answer
128 views

What does this step in this protocol for the Yao's Millionaire Problem mean?

I was reading “An Efficient Protocol for Yao’s Millionaires’ Problem” (Ioannidis and Grama 2003). In the proposed protocol in section three, it is written: (Step 4) For every $i$, $1 \le i \le d$, ...
1
vote
0answers
48 views

Can you clarify the proof that secure LR-two party protocols do not exist?

In the paper “Multiparty Computation Secure Against Continual Memory Leakage” on pg. 1237, the footnote #1 discuss why it is not possible to construct a leakage resilient two-party protocol. But I'm ...
1
vote
0answers
24 views

Why does a joint leakage MPC protocol not directly apply to a disjoint leakage requirement?

In the paper "Multiparty Computation Secure Against Continual Memory Leakage" on pg. 1239 the footnote at the bottom points out the difference between $joint$ leakage and $disjoint$ leakage. The ...
1
vote
1answer
73 views

How do you prevent the risk of damage to the security of Fully Homomorphic Encryption?

In this paper on pg. 1248 in the "preprocessing phase" section the authors say: In the preprocessing phase, the parties run a (standard) MPC to collectively generate a key pair (pk,sk) for the ...
2
votes
1answer
100 views

What is adaptive zero-knowledge?

In this paper on pg. 1241 the authors discuss bullet point on Adaptive Zero-Knowledge : I am new to Zero-Knowledge and I am having trouble understanding what they are saying. I think they are ...
1
vote
1answer
136 views

Secure function evaluation

Consider 3 parties, Alice, Bob and Charlie. Suppose each party has a bit as input, i.e. Alice, Bob and Charlie hold $a, b, c \in \{0, 1\}$ respectively. Show how construct a scheme with which ...
1
vote
1answer
77 views

What is the difference between a one-shot MPC protocol and a unbounded invocation of multiple MPC protocols?

In this paper on pg. 1236, under the section "Security Against Continual Leakage", the authors say: "We further remark that the weaker security notion previously achieved cannot be extended ...
3
votes
2answers
62 views

Why do the outputs of parties in an MPC protocol have to be indistinguishable from the ideal / real world (as opposed to inputs)?

In this paper at the bottom of pg. 1235 and beginning of pg. 1236 it says: An MPC protocol is said to be secure, if for every real world leakage adversary A there exists an ideal world ...
1
vote
1answer
64 views

Why do authors say conflicting things regarding leak-free stages in their paper?

In this paper the last sentence of the first paragraph in the abstract states: We assume a (necessary) “leak-free” preprocessing stage. But then later on in section 1.4 they say Another ...
1
vote
2answers
398 views

garbled circuit vs fully homomorphic encryption

Consider an outsourced database to an untrusted cloud (think CryptDb), the question is how to compute a function $f(.)$ on the data. I think I understand how (fully or partially) homomorphic ...
2
votes
2answers
81 views

How to get the same calculation result on an untrusted computer, while withholding some information?

Consider this command on a trusted computer: result = function(public data, secret data) or shorter: r = f(p,s). How could a ...
2
votes
2answers
161 views

Privately Sum Values without Dealers, MPC

Suppose $n$ actors each hold a plaintext $p_i$. We wish to find $\sum p_i$, without leaking any information about individual $p_i$. Any actor (or any link in the network) could be controlled by an ...
1
vote
1answer
165 views

General-purpose non-interactive multi-party computation protocol

Most of general purpose multi-party computation protocols are highly interactive. Especially the ones with Shamir's secret scheme, as there is a degree reduction step in multiplication that needs the ...
0
votes
1answer
87 views

What kind of adversary is a compromised party?

Imagine multiple parties executing a secure multiparty computation protocol to evaluate a function securely. Let Alice be one of the parties who is intended to get all the partial results and combine ...
3
votes
1answer
167 views

What's efficient MPC protocol for determining if sum's bigger than y?

My secure multi-party computation (MPC) in need is simply to determine if a sum of two private variable is bigger than a given value $y$, as $f(x_0, x_1) = [(x_0 + x_1) > y]$ in which the value ...
3
votes
1answer
221 views

Addition with Shamir secret sharing

When performing Shamir secret sharing I'm trying to find $z_i$, such that $z = x + y$. Where $n = 6$ and $t = 3$. I believe this would be the correct solution (correct me if I'm wrong): Each party ...
2
votes
1answer
56 views

Equivalents to a physical hat+shaking?

I would like a multiparty protocol, secure in the honest-but-curious model at least, but hopefully other situations as well, that can do the following: every party among $\{P_1, P_2, \ldots P_n\}$ ...
1
vote
1answer
249 views

Real world use cases of Multi Party Computation

Most of the research papers give imaginary applications of multi party computation. Either they talk about millionare's problem or two or more corporates willing to compute some Intrustion detection ...
2
votes
1answer
265 views

Exact mathematical definition of simulation based security?

I've been trying to understand cryptographic protocols and how to define their security. The problem is that while I can understand what the intuitive definition says, I have trouble understanding how ...
1
vote
2answers
200 views

homomorphic encryption special case of multi party computation?

I read that Fully Homomorphic Encryption schemes are special case of Secure MPC in page no 3. Especially , generalization of two party computation problems stated by Yao But is there any additional ...
1
vote
2answers
144 views

Practical implementations of Multiparty computations [closed]

Are there any practical implementations and or software platforms to prototype applications based on MPC ?
1
vote
1answer
252 views

Are there any multiparty homomorphic encryption schemes?

Are there any multiparty homomorphic encryption schemes ? Most of the literature is about two party schemes . Is there any generalization made for n party ?
1
vote
2answers
233 views

Relation between Threshold Cryptosystem and Secure Multiparty Computation ?

Is there any relation between secure multiparty computation and threshold cryptosystem ?
3
votes
1answer
420 views

What kind of multiparty computation is this?

The classic multiparty computation protocols are defined around " Untrusted parties trying to compute something together". But is there a cryptographic abstraction for, "Trusted parties trying to ...