Suppose $m$ clients split their own input into $n$ shares using additive secret sharing scheme (mod something). Then, each of the clients sends each share to each of $n$ external servers. After receiving the shares from the clients, the servers run MPC protocols where no client will be involved in the protocol. (Later, some or all clients receive the output share from the servers and reconstruct the result.)

General assumption is on non-collusion assumption, meaning that the protocol is safe (at least no client input is leaked) as long as $t (\leq m)$ servers do not collude.

I have a question regarding the assumption.

Does the "collusion" mean any possibility that $t$ shares in the servers are somehow assembled?

If so, do the followings have all the same meaning in the assumption?

  • server operators are all malicious and share their information about clients' shares (and assemble them)

  • some clients are malicious and get access to more than $t$ servers to see clients shares (and assemble them)

  • some malicious guys (who are neither any of the clients nor any of the server operators) hack the servers and assemble the shares on them.


1 Answer 1


Does the "collusion" mean any possibility that t shares in the servers are somehow assembled?

It refers to the possibility that t or more server admins/owners collude to pool their shares to break protocol.

Regarding the follow-up questions: non-collusion is in this context in regards to server operators being malicious. Malicious clients are considered a non issue in the context since clients should not have access to each others shares. Hacking of servers or data leaks is considered out-of-scope since it has nothing to do with the scheme in question.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.