0
$\begingroup$

Consider a scenario：data owners $C$ sends a $l$ bits value $x$ to parties $P_0$ and $P_1$ via additively secret sharing scheme, for example, $C$ randomly selects $r \in_R \{0, 1\}^l$, and sends $r$ to $P_0$ and $x-r$ to $P_1$. In insecure channel, adversary $\mathcal{A}$ could obtain $r$ and $x-r$ to construct secret $x$ by eavesdroping the channel.

But there a scheme: $C$ sends $\mbox{Enc}_{{pk}_0}(r)$ to $P_0$ and sends $\mbox{Enc}_{{pk}_1}(x-r)$ to $P_1$(i.e. privacy) ,and $C$ authenticates $r$ and $x-r$ by means of digital signature(i.e. authentication). So a secure commutation over an insecure channel is achieved.

My question is：does the above scheme require the assumption of a secure channel?

The key point of this problem is that we use some technologies to implement privacy and authentication on an insecure channel, and this insecure channel can be considered, but not a secure channel. We no longer need the assumption of a secure channel based on our technology, is this right？

Improve this question
$\endgroup$
2
  • $\begingroup$ You have constructed a secure channel based on the assumption of a secure setup, i.e. the assumption that the public keys were distributed securely. $\endgroup$
    – Maeher
    May 15, 2022 at 8:28
  • $\begingroup$ Thank you for your reply，so the assumption of my scheme is no longer the secure channel, but secure public key cryptography (and public key infrastructure) ? $\endgroup$
    – Yang
    May 15, 2022 at 14:27

1 Answer 1

Reset to default
0
$\begingroup$

The difference is that when discussing the MPC protocol, we abstract away the need for a secure channel.

My question is：does the above scheme require the assumption of a secure channel?

In the case you have an insecure channel, as you stated, if implemented correctly, one can construct a secure channel based on the security of your public key infrastructure.

Improve this answer
$\endgroup$
2
  • $\begingroup$ In the computational setting the adversary is assumed to be polynomial-time. Results in this model typically assume cryptographic assumptions like the existence of trapdoor permutations. These are assumptions on the hardness of solving some problem (like factoring large integers) whose hardness has not actually be proven but is widely conjectured.We note that it is not necessary here to assume that the parties have access to ideally private channels, because such channels can be implemented using public-key encryption. $\endgroup$
    – Yang
    May 17, 2022 at 11:43
  • $\begingroup$ However, it is assumed that the communication channels between parties are authenticated; that is, if two honest parties communicate, then the adversary can eavesdrop but cannot modify any message that is sent. Such authentication can be achieved using digital signatures and a public-key infrastructure. $\endgroup$
    – Yang
    May 17, 2022 at 11:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.