1
$\begingroup$

I'm currently working on a distributed threshold DSA scheme that requires to find the product of two sums via secure multi-party computation. Specifically speaking, every one of $n$ parties $P_i$ possesses a DSA key pair $(sk_i, pk_i)$, where $sk_i=d_i \in \mathbb{Z}_q$ and $pk_i = g^{d_i}$. I want to collectively generate a signature $S_{\Sigma} = k_{\Sigma}^{-1}(m+r_{\Sigma}d_{\Sigma})$, where$k_{\Sigma}=k_1+\dots k_n$, $r_{\Sigma}d_{\Sigma}=(r_1+\dots+r_n)\cdot(d_1+\dots+d_n)$. My prior question is that is there a proper paradigm to compute $r_{\Sigma}d_{\Sigma}$ without leaking information about secret keys $(d_1,\dots,d_n)$? For computing $k_{\Sigma}$, I'm using the BGW Protocol and Shamir threshold secret sharing scheme. Is it possible to compute $r_{\Sigma}d_{\Sigma}$ using BGW protocol as well?

PS: I'm new to SMPC, and English is not my first language. Sorry for the troubles. Thanks!

$\endgroup$
1
  • $\begingroup$ If you are going to compute the product of two secret numbers (in your case r*d), then, you can use Beaver's multiplication triple to do it. $\endgroup$
    – alexander
    Jun 21, 2022 at 6:21

1 Answer 1

1
$\begingroup$

Yes it is, see for example this page. Note that multiplication requires $O(n^2)$ additional communication, in contrast to addition (which is free).

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.