1
$\begingroup$

The BGW protocol gives us security aginst a dishonest minority of parties, with round complexity linear in the function's circuit depth. Several works (like ABT18 or LLW20) use the BGW protocol to get 2-round MPC by reducing the functions degree to 2.

However, I don't see how BGW gives us a 2-round protocol. You need one round to share the inputs, one round for the multiplications and one final round to reconstruct the result, resulting in a 3-round protocol. What am I missing here? How can the multiplication round be merged into the input sharing or the reconstruction round?

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.