# What is the standard security and leaky security, and the relation between the standard/leaky security and the leakage function?

Recently, I read some security proofs about the secure multi-party computation (MPC) protocol, which includes statements about information leakage, such as the security proof below from the paper CWL+20$$^{1}$$, but I'm confused about the "security with information leakage".

(Section 4.4 Security Proof from CWL+20) Theorem 1: Protocol of SSMM (Algorithm 2) computes matrix multiplication with information leakage $$Q_e − Q_o$$ to party $$A$$ and information leakage $$P_e + P_o$$ to party $$B$$.

In this proof, a term information leakage is involved, I searched on the website and asked ChatGPT and they gave me some explanations about standard security and leakage security:

(From ChatGPT 3.5) In secure multiparty computation (MPC), the terms leaky security and standard security refer to different levels of security guarantees in the presence of information leakage.

In standard security, the goal is to ensure that the final output of the computation is secure and does not reveal any additional information about the parties' private inputs beyond what is implied by the output itself. The security guarantee is focused on preventing unauthorized parties from learning more than they should about the private inputs, given the output of the computation.

In leaky security, it acknowledges the possibility of some controlled or partial information leakage during the computation. This could be intentional or unavoidable due to practical considerations, and the protocol is designed to manage and quantify this leakage. The key idea in leaky security is to allow controlled information leakage while still providing strong guarantees about the confidentiality of sensitive information.

Indeed, standard security aims for a strict guarantee that the output alone does not reveal more than necessary, while leaky security allows for controlled and quantifiable leakage during the computation.

However, there are few references explaining the concepts of the standard security and leaky security. In these references, such as BGI16$$^{2}$$ and BCG+21$$^{3}$$ (eprint), there is a definition of leakage function, which is defined as follows:

(Page 4 in BGI16) Modeling leakage. We capture the allowable leakage by a function Leak: $$\{0,1\}^* \rightarrow \{0,1\}^*$$ ,where $$\mathsf{Leak}( \hat{f} )$$ is interpreted as the partial information about $$\hat{f}$$ that can be leaked. When $$\mathsf{Leak}$$ is omitted it is understood to output the input domain $$D_f$$ and the output domain $$R_f$$ . This will be sufficient for most classes considered in this work; for more general classes, one also needs to leak the size $$S_{\hat{f}}$$.

Therefore, my questions are:

(1) In security proofs of secure multi-party computation, are security with information leakage accepted, and are there relevant references explaining this concept?

(2) In secure multi-party computation, are there really concepts of standard security and leaky security? Are they formal definitions? Are there any relevant references explaining this concept?

(3) If the answer to (2) is yes, is there a connection between standard/leak safety and the leak function?

Reference

• I had the same confusion before on the Leak function in the ideal functionality. I vaguely remember that in a paper about election, the author defines an ideal functionality of vote including an extra Leak function that can offer tally result to simulator individually in the ideal world. However, the paper did not explain why to define the Leak function. But I guess the usage of the Leak function in this paper is to guarantee the consistency of the tally result in both worlds, so that the enviroment cannot distinguish them. Dec 11, 2023 at 4:12

We define security of MPC protocols by comparing to an ideal functionality. A secure MPC protocol is one that reveals no more than the output of the ideal functionality. "MPC protocol with leakage" just means: "a secure MPC protocol that reveals more information about the output than you might expect." For example, the functionality reveals $$f(x,y)$$ but also some "extra leakage" $$g(y)$$, and perhaps $$g$$ can be adversarially chosen from within some restricted class of allowed leakage functions (e.g., $$g$$ has just one bit of output).