New answers tagged

0

ORAM can be built on a multi-party scenario, where the data belongs to various parties using Secure Multiparty Computation. Recent research calls this approach ORAM for Secure Computation (SC-ORAM). Given that writing and reading are required, it is my believe this would be the best approach. In the typical SC-ORAM setting, several parties store ...


1

When you compose $2$ interactive systems $\mathcal{IS}_1$ and $\mathcal{IS}_2$ into $\mathcal{IS}_1 \circ \mathcal{IS}_2$, the book indicates that you're simply connecting the matching ports between them. In your example $\mathcal{IS} \circ D$ is a clocked entity because when $B$ calls $D$ then $D$ makes a recursive call to $\mathcal{IS}$ by sending the ...


3

An operational meaning of the statistical distance between two random variables defined by $$\delta(X_1,X_2) = \dfrac{1}{2}\sum\limits_{x \in D_1 \cup D_2}\left|Pr(X_1 = x) - Pr(X_2 = x)\right|$$ is that an optimal function $f$ distinguishing between $X_1$ and $X_2$ can be defined on $D_1 \cup D_2$ via $$ f(z)=\left\{ \begin{array}{lcl} X_1 ...


3

Statistical indistinguishability (i.e., negligible statistical distance) implies computational indistinguishability, but is typically easier to prove since it does not require a computational argument with a reduction and all that stuff. Of course, it is not always possible to prove computational indistinguishability in that way; statistical ...


2

That summary, on which you are basing your understanding, seems bogus to me. Clearly the same $K_i^b$ values are being used as one-time pad keys, but are being used more than once. This is a major red flag. Here's an even simpler attack: if you XOR together all 4 ciphertexts $X_s^{i,j}$ you will get $\Delta = K_k^0 \oplus K_k^1$. Since the functionality of ...


5

In order for information-theoretic security to imply computational security, you need to require that the simulator run in time that is polynomial in the running time of the real adversary. This is the standard definition, specifically to avoid protocols such as you presented in your question. So, the answer is: If you allow the simulator to be unbounded ...


3

Alice does not need to hard-code her input and does not need to shuffle the gates (it is only necessary to shuffle the ciphertexts inside each gate). Bob needs to hold a key on every input wire. For the input wires associated with Alice's input, she can just send the appropriate key (this reveals nothing since both the 0 and 1 values are just random).


1

I don't understand why Alice needed to hard-code her input and rearrange the gates. Could she not have just given Bob the circuit as is and the keys to her inputs? Alice needs to hardcode her input because both parties must NOT learn each other's input values. The whole point of the Garbled Circuit is to devise a way where both parties will learn the ...


1

The only book I know of regarding Secure Multiparty Computation is Secure Multiparty Computation and Secret Sharing by Ronald Cramer, Ivan Bjerre Damgård and Jesper Buus Nielsen. Yet, I could hardly classify it as introductory. This is its official site.


3

As I mentioned in a comment, a relatively new application of multi-party computation is its use as a countermeasure against (mainly hardware) side-channel attacks. In particular, there is a method called "threshold implementations" which is based on a form of secret sharing. A relevant reference would be the paper Secure Hardware Implementations of ...



Top 50 recent answers are included