Multi-party computation (MPC) allows a set of parties, each with a private input, to securely and jointly perform any computation over their inputs.

learn more… | top users | synonyms (3)

4
votes
1answer
65 views

ORAM over Third Party DB

Oblivious Ram (ORAM) is a cryptographic technique that is used for secure DB querying without leakage on the access patterns. There are several schemes for ORAM, amongst the most popular ones, there ...
6
votes
1answer
81 views

Is a composition of clocked entities a clocked entity in the UC model?

In the book titled "Secure Multiparty Computation and Secret Sharing" the authors define an interactive agent and an interactive system. Further, the author defines a clocked entity for considering ...
4
votes
2answers
46 views

Motivation for the definition of statistical distance

Statistical distance is a widely used measure in cryptography for comparing two distributions. One can define various other measures for capturing the differences between two distributions, but why do ...
0
votes
0answers
31 views

Does revealing shares of the result reveals shares of the inputs?

Suppose Alive and Bob have shares of two polynomials $P,Q$, say, Alice knows $P_A,Q_A$, Bob knows $P_B,Q_B$ s.t. $P=P_A+P_B$ and $Q=Q_A+Q_B$. They perform some operation $f$ over the shared values, to ...
3
votes
1answer
37 views

Yao's Garbled circuit: Does Bob ever see the circuit?

I asked a question about whether the circuit structure for Yao's garbled circuit needs to be rearranged. I understand from Yehuda Lindell's response that the circuit structure itself does not need to ...
1
vote
1answer
295 views

An example of of an information theoretically secure protocol that is not cryptographically secure

Does there exist a protocol $\pi$ for some functionality $F$ which is information theoretically secure protocol that is not cryptographically secure for some threshold number of corrupt parties? ...
4
votes
2answers
49 views

Yao's Garbled Circuit- Why does Alice need to rearrange the circuit?

My understanding of Yao's Garbled Circuit (based mostly on this summary) is as follows: Alice creates a garbled circuit based on the function f to be computed. She then hard-codes her input into the ...
1
vote
1answer
46 views

Book recommendation about MPC? [closed]

I have hard time finding introductory book talking about details of secure multiple party computation. Is there any recommendations? Thanks for the help. Hope this is not off topic.
4
votes
1answer
74 views

Is it possible to perform an MPC protocol to compute a product in a polynomial ring?

I hope not to be asking much, but I have N parties, each one holding a polynomial in with 0-1 coefficients and fixed degree $n-1$. I was wandering if it is possible (I mean feasible) to compute the ...
4
votes
2answers
416 views

Real world use cases of Multi-Party Computation

Most of the research papers give imaginary applications of multi-party computation. Either they talk about Yao's millionares' problem or two or more corporates willing to compute some intrustion ...
1
vote
0answers
54 views

Does using a verifiable secret sharing scheme ensure robustness of a protocol if it is secure under the semi-honest adversarial model

Consider a protocol $\pi$ which uses a linear secret sharing scheme like that of Shamir secret sharing. Further assume that the protocol $\pi$ has been proven to be secure (correctness and privacy) ...
4
votes
1answer
70 views

Beavers Triple Vs BGW Multiplication on MPC

Typically MPC protocols that are secure against semi-honest adversaries recommend the use of the revised GMW multiplication protocol by Gennaro et al. This is not the case against Active adversaries ...
4
votes
1answer
66 views

Is there an example of a “robust, yet not private” SMC protocol?

I have been trying to understand the interplay between robustness and privacy of an SMC protocol. It is easy to come up with a protocol that is private but not robust. Can someone provide an example ...
4
votes
1answer
40 views

Generate a random number $r \in \{1,2, \dots , k\}$, where $k$ is not public and is distributedly held

A set of parties can securely generate a random number $r \in \{1,2,3,\dots, k\}$ when $k$ is publicly known. However, can we generate the random number $r$ if $k$ is not publicly known and is held by ...
1
vote
1answer
46 views

Optimal threshold for passive and perfect security

The authors of the book titled "Secure Multiparty Computation and Secret Sharing" claim that there exist functions which cannot be computed with passive perfect security for $t \geq n/2$ corrupt ...
3
votes
1answer
60 views

2 party AND computation under passive perfect security

In the book written by Ivan Damagard titled "Secure Multiparty Computation and Secret Sharing", at the end of the third chapter he provides a proof for why it is impossible to securely compute 2 party ...
2
votes
2answers
296 views

Practical implementations of Multiparty computations [closed]

Are there any practical implementations and or software platforms to prototype applications based on MPC ?
1
vote
1answer
38 views

How to deal with different setup in Multikey FHE?

The scenario : using a Multikey FHE scheme, let's say LTV-FHE scheme, parties delegate the computation of some function to the mighty cloud. In LTV-FHE scheme the parties generate their keys and ...
3
votes
1answer
50 views

About the necessity simulators set adversary random-tape

In the ideal/real proof paradigm we sometimes find simulators with the capacity of set adversary random tape. My question: when do we have to consider the necessity of simulators set adversary ...
2
votes
2answers
249 views

Simulation based proofs: Simple examples

I am aware that,(in theory) in order to proof that a scheme is secure using simulation based proof we replace an adversary in real world with a simulator in ideal world. Then we try to show that their ...
5
votes
2answers
89 views

How many polynomials are used in Secure Multiparty Computation?

Secure Multiparty Computation based on Samir Secret sharing methods rely on Polynomials. Imagine corpus of data should be outsourced to bunch of untrusted servers for any computations. Now the data ...
7
votes
2answers
564 views

What is an example of a secure sigma proof?

I want to implement Threshold Elgamal as described in section 6.3.1 and in the decryption phase each party must broadcast a sigma proof to show that it actually has a valid secret share of the secret ...
6
votes
2answers
206 views

Hamiltonicity proof of knowledge

I'm learning the POK notion and definitions and as a self exercise I wante to prove the statement that the Hamiltonicity protocol is a POK system with knowledge error $1/2$. So the question will be ...
5
votes
0answers
40 views

An MPC protocol from Elgamal is a good solution a homomorphic multiplication?

I want to compute a multiplication between many secret values and then distribute the result to everyone involved. For this, I thought about an MPC protocol built from Threshold Homomorphic Elgamal. ...
4
votes
0answers
84 views

How can I implement decryption for NTRU homomorphic encryption scheme?

I have come across this paper On-the-fly multiparty computation via on-the-cloud Multikey from Fully Homomorphic Encryption by Lopez-Alt et al., where authors describe a NTRU-based homomorphic ...
2
votes
1answer
59 views

How to test an implementation of a homomorphic scheme?

I want to implement the following homomorphic encryption scheme from On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption by Lopez-Alt et al. I use C++ and I want ...
1
vote
1answer
34 views

Multi Party System with n-1 adversaries

Novice here. Is there a MPC function where no information is leaked even if all parties are not trustworthy ?
1
vote
1answer
27 views

Secure Multiparty Computation with Secret Output

Is there any MPC scheme that allows a function with several secret inputs to be computed, while the output can only become known to one specific party? If not, is this even possible?
0
votes
0answers
83 views

What type of encryption scheme can prevent cheating in this coin flip protocol? [duplicate]

Consider the following protocol for two parties to flip a fair coin: Trusted party $T$ publishes her public key $p_k$ A chooses a random bit $b_A$, encrypts it under $p_k$, and announces the ...
3
votes
1answer
64 views

Multi-Party Encryption for a Shared Document

Is there an encryption algorithm/protocol where any of a pre-defined set of keys/passwords will succeed in decrypting a document? The number of keys can be fixed, say, 10 or 20 possible passwords. ...
3
votes
0answers
52 views

How about a homomorphic integer sorting in a MPC context?

I want to implement the ATV-FHE scheme as described by Adriana López-Alt, Eran Tromer, Vinod Vaikuntanathan: On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption ...
17
votes
1answer
195 views

What are the roles of the simulator in simulation based proofs

I'm trying to better understand simulation based proofs in the UC model - but the guidelines to construct a simulator confuse me. To my understanding, the simulator is activated in two ways: ...
2
votes
0answers
40 views

Are there any FHE-MPC schemes implemented?

I want to know if there are any publicly available multiparty computation schemes derived from fully homomorphic encryption schemes. An example would be the implementation of this scheme ...
3
votes
1answer
65 views

Forcing participants to be honest in Secure Multiparty Communication

Alice and Bob engage to compute a secure function f(a,b) where a and b must be present in a ...
1
vote
0answers
21 views

Proving for a single input vs several inputs. Is there any difference?

I am working on a new protocol for pattern matching. While defining the ideal functionality, it is possible to say: Alice sends $p$ and Bob sends $T$ to the ideal functionality. i.e. searching for ...
2
votes
1answer
85 views

What is the difference between “securely realizes” and “securely implements”?

In some security proofs it is stated that "a protocol securely realizes an ideal functionality" while in some others "a protocol securely implements an ideal functionality". Is there a meaningful ...
5
votes
1answer
56 views

Is it possible for a simulator to always abort?

In this paper of J. Baron, et al. (PDF), simulator always aborts the ideal functionality before client outputs its pattern-matching result obtained from the ideal functionality. (See bottom of page ...
1
vote
2answers
62 views

Can several run of a semi-honest protocol be used to infer malicious security?

In the ideal world, $A$ sends several inputs $x_1,...,x_\lambda$ to the functionality and $B$ sends input $y$. Functionality sends $f(x_1,y),...,f(x_\lambda,y)$ to $A$ and nothing to $B$. Suppose ...
1
vote
1answer
41 views

how does the simulator work when the corrupted party has no input?

"the only thing the simulator can do in the ideal model is to choose the corrupted parties' inputs." Yehuda Lindell said. 1- what will happen when the corrupted parties have no inputs to the ...
2
votes
2answers
86 views

regular expression matching on encrypted data using secure multiparty computation

Lets consider Secure Multiparty Computation based on Secret Sharing schemes (rather than Garbled Circuits approach). If we have to do regular expression matching on secret shares of words of texts. ...
5
votes
1answer
72 views

Designing Secure Multi-Party Computation Sub-Protocols Based on Homomorphic Encryption

When designing SMPC protocols using secret-sharing, it is a common approach to compose a protocol from several sub-protocols (each proven secure under the formal definition of security w.r.t. ...
2
votes
1answer
35 views

Leakage in Secure Two party Computation

Am trying to understand Garbled Circuit based approach for Secure Two party Computation. There isn't much leakage in the classic millionaire's problem where the comparison circuit is used. But ...
3
votes
1answer
120 views

Why can't garbled circuits be reused?

There are a bunch of papers do research on resizable garbled circuits. But I wonder why garbled circuits cannot be reused? For example, the constructor constructs a garbled circuit of "AND" like ...
2
votes
2answers
166 views

What if OT breaks in Yao's garbled circuit?

Two semi-honest parties are computing F with Yao's garbled circuit. Sender garbles it with his inputs baked in then sends it to the receiver. At this point the receiver must use OT to get his keys. ...
1
vote
2answers
754 views

garbled circuit vs fully homomorphic encryption

Consider an outsourced database to an untrusted cloud (think CryptDb), the question is how to compute a function $f(.)$ on the data. I think I understand how (fully or partially) homomorphic ...
2
votes
3answers
409 views

homomorphic encryption special case of multi party computation?

I read that Fully Homomorphic Encryption schemes are special case of Secure MPC in page no 3. Especially , generalization of two party computation problems stated by Yao But is there any additional ...
2
votes
1answer
185 views

Simulation Based Proof: How the Corrupted Party's Input is Given To Simulator

Imagine we have a 3-party protocol, including client $A$,client $B$ and a server. In this protocol client $B$ encrypts its input under its public key and sends it to the server. The server performs ...
1
vote
1answer
278 views

Simulation Based Proof: What Can / Can not Simulator Do?

I have seen some examples in "Foundation of cryptography" and "Efficient two party computation", in which simulator can do some things that in the real world model the parties cannot do, for instance: ...
2
votes
2answers
70 views

Simulator in Private Outsourced Computation over Outsourced Datasets

Please, consider two honest parties $A$ and $B$ outsourced their private data to a malicious server $S$. So the parties store their data in the server. Then at a later point in time they want to ask ...
2
votes
2answers
50 views

Correctness of ideal protocol of MPC in presence of malicious adversary

In presence of malicious adversaries in ideal protocol of Multi Party Computation, how can honest parties get the correct output? i.e., corrupted parties modify their inputs and give to the trusted ...