I am looking at a protocol to securely multiply numbers, so as to preserve privacy of inputs.

In particular, suppose there are three parties $P_1$, $P_2$ and $P_3$ and 2 numbers to multiply, $a \in \mathbb{F}$ and $b \in \mathbb{F}$ such that $\mathbb{F}$ is a finite field of prime order $p$. More precisely, $a$ is the $P_1$'s input, $b$ is $P_2$'s input and $P_3$ has no input. $P_1$ and $P_2$ shares their input among the parties using 2-out-of-3 secret sharing and, in this way, each party can compute a share of the product. Then, shares of the product are securely summed and all the parties can compute the result.

In this aim, I am wondering whether does it make sense when we have only two parties?

If $p$ is big enough (such that $a \cdot b < p$) , once $P_1$ knows $a \cdot b \mod p$, by knowing $a$, it could easily compute the secret value $b$.

For this reason, I do not see the point of using secure multiplication in this case. Could somebody help me understand this?

  • $\begingroup$ Note that if $P_1$ picks $a=0$ they don't learn anything about $b$. $\endgroup$
    – SEJPM
    Feb 29, 2020 at 12:38
  • $\begingroup$ True. I have seen the classical example of secure dating, in which the possible inputs were just 0 or 1. What about in general? $\endgroup$
    – Lorenzo
    Feb 29, 2020 at 17:11

1 Answer 1


There is no way to avoid that a party infers knowledge about another party input by looking at the result and his or her input. This is not considered a security issue of the protocol.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.