Secure Multi-Party Computation (MPC) protocol with all dishonest parties

Question

What if we consider an MPC protocol in which all parties are dishonest? Is it unattainable (even with allowing abort) or is it just meaningless to think about?

Answer 1

Secure computation against all dishonest parties is well-defined, and actually attainable under standard assumptions. The key point is that this notion is useful when we consider composable notions of MPC (e.g. MPC in the UC model). Indeed, in this case, you could have $N$ parties running a big protocol, which internally involves (among other things) $n< N$ parties running a sub-protocol. Now, you want the resulting composed protocol to remain secure even when all $n$ parties are corrupted.

This does not contradict poncho's answer: here, the $n$ parties refusing to participate would result in an abortion of the protocol (since the sub-component would never be run). In other terms, poncho explained that you cannot have security without aborts, and that the notion does not make sense in the stand-alone setting (or, rather, is trivially attained - "stand-alone" is the term used to indicate security of a protocol when the latter is run in isolation, not in a broader context). I'm pointing that, on the other hand, it makes perfect sense for composable security-with-abort (and is typically considered in Canetti's framework of universal composability).

The setting of full corruption is for example discussed here, see also pointers therein. The introduction explicitly discusses this setting.

Answer 2

What if we consider a MPC protocol in which all parties are dishonest?

If all parties are dishonest, then they all can refuse to perform whatever protocol we selected, and do whatever they want. Hence, if there is a security goal that is met by an MPC protocol that we specify, that goal is met because the parties couldn't violate it.

Answer 3

It sometimes make sense to consider all malicious parties in the context of adaptive security.

• Static security = the set of corrupt parties is fixed during the protocol execution.
• Adaptive security = additional parties can become corrupted during the protocol execution.

Security is trivial against an adversary who statically corrupts all parties -- i.e., there is nothing to simulate in this case. But security is nontrivial against an adversary who adaptively corrupts all parties eventually. When the adversary chooses to corrupt a party, it learns that party's internal state. The simulator must therefore simulate that internal state, and this is usually nontrivial to do.

You can consider a scenario where some parties start the execution honestly, but all parties are eventually corrupted by the end of the execution.

This can be a natural situation when you consider composition. Suppose there are $n$ parties, and some subset of $n' < n$ of them run a subprotocol. The adversary can adaptively corrupt some of the $n$ "outer" parties, leaving some of the uncorrupted, but causing all $n'$ of the parties involved in the subprotocol to become corrupted. So even if it's unnatural to think that all $n$ "outer" parties become corrupted, you might still need the subprotocol to be secure against all corrupt parties.