Suppose I run a multiparty protocol. At the output stage, I have the function output in a secret shared manner among all parties.

Now I want all the parties to commit to their value of the secret shares

In essence, suppose every party $P_i$ has a share $Y_i$.
Every party should commit their value = $Com(Y_i)$

My problem is that I want to ensure that party $P_i$ doesn't commit to an incorrect value

$Com(Y'_i)$ s.t $Y'_i \not= Y_i$

before moving to the next stage in the protocol. I also do not want to reconstruct the output value until a later stage in the protocol.

Is there any efficient way in which you can perform such a commitment while ensuring that every party commits to the right value?

  • $\begingroup$ If reconstruction takes everyone and the storage requirements are nearly minimal, then that's simply impossible. ​ (xor sharing satisfies those two conditions.) ​ If the secret sharing scheme instead merely doesn't provide a way to verify shares individually, then I don't see any way to avoid having the multi-party computation protocol internally "reconstruct the output value". ​ ​ ​ (... continued) ​ ​ ​ ​ ​ ​ ​ ​ $\endgroup$ – user991 Apr 13 '16 at 16:26
  • $\begingroup$ (continued ...) ​ ​ ​ (I might be able to prove that, for example, Shamir has no such way if I had a definition of what it means for a multi-party computation protocol internally "reconstruct the output value".) ​ The obvious alternative is having the initial multi-party computation protocol output encapsulations of the shares to everyone and give each party decapsulating info for its share. ​ ​ ​ ​ ​ ​ ​ ​ $\endgroup$ – user991 Apr 13 '16 at 16:26
  • $\begingroup$ Let me see if I understand correctly, you want each party to commit to a share that is the result of some MPC. You want to be able to check that the commitment is valid without reconstructing the value that the share comes from? $\endgroup$ – mikeazo Apr 13 '16 at 18:55
  • $\begingroup$ @mikeazo exactly $\endgroup$ – pd176 Apr 14 '16 at 12:41
  • 1
    $\begingroup$ Is the purpose of this to short-circuit the computation if someone is not behaving properly? It has been a while since I looked into some of the dishonest majority protocols like SPDZ, but I believe it has a MAC that gets updated during computation that can be checked. $\endgroup$ – mikeazo Apr 14 '16 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.