3
$\begingroup$

I would like to perform a dot product operation among $m$ parties using Shamir's $(m,m)$ secret sharing that is used for Secure Multiparty Computation.

I am aware that Shamir's $(m,m)$ scheme is additively homomorphic, but can someone please provide an example of how I can use it for multiplicative homomorphism for SMC?

Improve this question
$\endgroup$
6
  • $\begingroup$ Welcome to Crypto.SE :) Remember to sign up on this site and link your accounts to reclaim ownership of your question. $\endgroup$
    – Cryptographeur
    Apr 4, 2014 at 15:03
  • $\begingroup$ Sorry for the edit clash DrL $\endgroup$
    – Cryptographeur
    Apr 4, 2014 at 15:05
  • $\begingroup$ @figlesquidge no problem ;) $\endgroup$
    – DrLecter
    Apr 4, 2014 at 15:07
  • $\begingroup$ This might help: research.cyber.ee/~peeter/teaching/seminar07k/bogdanov.pdf‎ $\endgroup$
    – rphv
    Apr 4, 2014 at 19:15
  • $\begingroup$ Thanks. This paper does explain multiplicative homomorphism using Shamir's scheme. However what i want to do is multiplication e.g. using 3 parties and each of them has a secret and acts as a dealer. Can someone provide an example for this. $\endgroup$
    – nie_11
    Apr 7, 2014 at 2:32

1 Answer 1

Reset to default
3
$\begingroup$

As far as I know, you can not do multiplication with (m,m) shamir secret sharing. The typical method to do multiplication on shamir secret shares increases the degree of the sharing polynomial, which is why the parties run an additional protocol to reduce the degree. That is why the degree of the sharing polynomial must be less than $m/2$ if there are $m$ parties.

If you indeed need (m,m) (or $m$ out of $m$ parties must be present to do reconstruction and multiplication), and the only operation you need to compute is multiplication (which I'm not sure about since your comments state you want to do multiplication, but your question mentions dot product), then I'd suggest using multiplicative secret sharing.

If instead you need $m$ out of $m$ computation/reconstruction, but need to do both addition and multiplication operations, you'll have to go with some of the newer MPC constructions which achieve full-threshold security (SPDZ and some of it's references or subsequent works which cite it).

Improve this answer
$\endgroup$
7
  • $\begingroup$ Thanks for the info. I agree multiplicative secret sharing would work to multiply the values. However my scenario has boolean values at each distributed site. In that case for a '0' if i send shares; one of them will be zero and that will disclose the secret. Any pointers? $\endgroup$
    – nie_11
    Apr 11, 2014 at 10:15
  • $\begingroup$ Also could you suggest a paper with the multiplicative secret sharing scheme that you have explained in your earlier post. Thanks. $\endgroup$
    – nie_11
    Apr 11, 2014 at 11:33
  • 1
    $\begingroup$ @nie_11 I was never able to find a paper on multiplicative secret sharing which is why I asked about it here. In some sense, multiplicative secret sharing is just additive secret sharing in a multiplicative group. Which leads us to 0 (and something I hadn't thought about previously). If we consider the multiplicative group of integers modulo some $n$, 0 is not in that group. So it makes sense 0 won't work. $\endgroup$
    – mikeazo
    Apr 11, 2014 at 11:53
  • $\begingroup$ Thanks a ton. That means i have to think of some homomorphic cryptographic scheme which is not something i wanted to do in the first place. $\endgroup$
    – nie_11
    Apr 12, 2014 at 19:01
  • $\begingroup$ [link]google.co.in/… does use multiplicative secret sharing . p10 and 21. Although its a different setting.@mikeazo $\endgroup$
    – nie_11
    Apr 12, 2014 at 19:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.