The BGW protocol gives us security aginst a dishonest minority of parties, with round complexity linear in the function's circuit depth. Several works (like ABT18 or LLW20) use the BGW protocol to get 2-round MPC by reducing the functions degree to 2.

However, I don't see how BGW gives us a 2-round protocol. You need one round to share the inputs, one round for the multiplications and one final round to reconstruct the result, resulting in a 3-round protocol. What am I missing here? How can the multiplication round be merged into the input sharing or the reconstruction round?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.