1
$\begingroup$

When I read the AFL16 paper by Araki, each party's share is adding a correlated randomness, like r1 = (a1b1−x1y1+α)/3 , r2 = (a2b2−x2y2+β)/3, r3 = (a3b3−x3y3+γ)/3 with α+β+γ=0, and use AES to generate that. Also in the ABY3 paper they add the similiar randomness to each party in arithmetic operations. I wonder why this is necessary. I notice that even without that randomness, the protocol is still correct. Did this miss any security guarantee? The full name of the paper is "High-Throughput Semi-Honest Secure Three-Party Computation with an Honest Majority", can anybody help to explain it?

$\endgroup$
1
$\begingroup$

The multiplication is indeed correct without adding the randomness, but it is no longer private (i.e., it leaks information). By adding the correlated randomness, it ensures that what any single party sees during the computation is just uniformly distributed and reveals nothing.

$\endgroup$
  • $\begingroup$ Thanks for the answer. I have another question about the arithmetic secret sharing part. I notice that the dealer randomly choose x1 +x2 +x3 = 0. So this is two random source e.g. x1 and x2 are independently chose. My question is can I build a protocol with only one random source? e.g. x1 is the random source and P1 have x1, P2 have v+x1 and P3 have v+2x1. I derived the correctness in this case with a special open operation, not a simple add for all shares, but is like 2z1+2z2-z3 to get the mul result. I just wonder if this broke the private guarantee. $\endgroup$ – Pszzz Nov 11 '20 at 9:40
  • $\begingroup$ I don't know. You would have to try and prove it. $\endgroup$ – Yehuda Lindell Nov 12 '20 at 7:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.