Assume we have two computing parties for SPDZ protocol. The two parties are also the input parties. How can they share the MACs on their input shares assuming one party is the master who owns the MAC key and one is the client who do not have the key ?


The MAC key is not pre-owned by someone but generated in the offline phase. Each party $P_i$ chooses a random value $\Delta_i$ and the sum $\Delta = \sum \Delta_i$ is the MAC key. To ensure $\Delta_i$ is consistently used in all shares, ciphertexts of $\Delta_i$ are exchanged and zero-knowledge proofs are used to prove they are correct.

See for example the protocol in Fig 4 in the Overdrive paper.

| improve this answer | |
  • $\begingroup$ Thank you, I have another question. Can each party simply submit a commitment on Δ𝑖 at the before starting the computations, then at the end open the commitments to reveal Δ𝑖? $\endgroup$ – Mahmoud Nabil Feb 18 '19 at 16:14
  • 1
    $\begingroup$ It would not be too much different, the parties still need to prove that they use the correct $\Delta_i$ in the offline phase to generate all random values and triples. A commitment would not suffice, and zero-knowledge proofs are still needed. $\endgroup$ – Changyu Dong Feb 18 '19 at 20:00
  • $\begingroup$ Sorry for bothering you, but why it would not suffice? what is achieved by the zero-knowledge proof and cannot be achieved by the commitments alone? $\endgroup$ – Mahmoud Nabil Feb 18 '19 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.