1
$\begingroup$

For semi honest MPC protocols, adding some errors can easily make the output wrong. I wonder beyond that, can malicious adversaries make some attacks against semi-honest protocols to obtain private inputs or some other private data? And if they can, how to do that?

I wish to get some answers or literature about this question.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

Suppose you give me a protocol $\Pi$, then I will use it to construct a new protocol $\Pi'$:

$\Pi'$:

  • Initially every party $P_i$ chooses a random string $r_i \gets \{0,1\}^\lambda$ and broadcasts it to all other parties.
  • Then, the parties run the $\Pi$ protocol normally, with one exception:

    If party $P_i$ ever receives a message of the form $(r_i,z)$ from party $P_j$, then $P_i$ will send all of its private inputs to $P_j$, and also immediately output $z$.

I will leave the following two observations as exercises for the curious reader:

  1. If $\Pi$ is secure against semi-honest adversaries, then so is $\Pi'$. Hint: there is negligible probability that a semi-honest execution of $\Pi$ would include a protocol message of the form $(r_i,z)$.

  2. In the presence of a malicious adversary, $\Pi'$ is maximally insecure (if there is such a thing). The adversary can learn every honest party's private input, and can force any honest party to output anything of the adversary's choice.

So, a protocol can be secure against semi-honest adversaries and totally insecure against malicious adversaries. This doesn't mean that every semi-honest protocol is insecure against malicious adversaries. But it shows that the definition of semi-honest security itself is not enough to give you any guarantees about what can happen in the presence of malicious adversaries.

I refer to protocols like $\Pi'$ as protocols with a "wings-fall-off button", after Gary Larson's Far Side cartoon:

Far Side cartoon with an airplane that has a switch labeled "Wings stay on / wings fall off"

Improve this answer
$\endgroup$
1
  • 1
    $\begingroup$ It can be interesting to note that some natural protocols also have a similar extreme failure mode in the malicious setting. For example, this is the case for the seminal construction of semi-honest OT from trapdoor permutations: a cheating receiver can trivially get both sender outputs by picking two values with known preimages instead of one (and this is undetectable). $\endgroup$
    – Geoffroy Couteau
    Commented Feb 7, 2023 at 9:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.