Is there any MPC scheme that allows a function with several secret inputs to be computed, while the output can only become known to one specific party?
If not, is this even possible?
$\begingroup$
$\endgroup$
3
-
$\begingroup$ Sounds like any usable fully-homomorphic encryption. $\endgroup$– Artjom B.Dec 17, 2015 at 13:13
-
1$\begingroup$ This is built in the definition of MPC: if you want a party to not receive output, define its output to be the empty string. So, any valid MPC scheme allows this by definition. $\endgroup$– fkraiemDec 17, 2015 at 13:20
-
$\begingroup$ Thanks to all of you for the quick answers to a stupid question! From my very inexperienced reading of the explanations and literature it seemed to me like the output was public by default. I'm very excited about the prospects of this technology! :D $\endgroup$– hyperfektDec 17, 2015 at 13:25
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
Yes, all of them support this.
Garbled Circuits
I'll focus on the 2-party case when it comes to garbled circuit based schemes. In these schemes, you typically have one party that garbles the circuit and their own inputs. The second party executes the garbled circuit. To input their values into the computation, an oblivious transfer protocol is often used.
So, say the party that should receive the output is the one executing the circuit. If the party who constructed the circuit, constructs it so that the output "wires" are plaintext, then the executing party gets the answer. Now they simply just don't send the output to the first party and the output remains private to them.
On the other hand, if the party that should receive the output is the one who garbles the circuit, they can simply mask the output wires with a random value. Then the party doing the circuit execution cannot know the outputs. That party sends the output values to the first party, who can unmask them.
Secret Sharing
The other type of MPC we typically see is secret sharing based. In this variant, each party secret shares their inputs with the other parties in the computation. They then compute on the secret shares. At the end, they have shares of the output values. If everyone is suppose to know the output, the parties simply broadcast their shares of the output to all other parties. If only some parties are suppose to know the output, each party can instead send their shares of the output to those authorized to know the output. As long as the thresholds of non-corrupt parties are met, a corrupt party who is not suppose to learn the output cannot.
