# Questions tagged [multiparty-computation]

Multi-party computation (MPC) allows a set of parties, each with a private input, to securely and jointly perform any computation over their inputs.

531 questions
Filter by
Sorted by
Tagged with
4 views

### Is there any malicious secure MPC protocol to compute the sum of values belong to different paties?

Suppose Alice,Bob,Charlie each has a value $a$,$b$,$c$, they want to obtain $a+b+c$ without disclosing their value. I wonder if it is a successful attack when a malicous adversary who corrput Alice ...
• 61
14 views

### Why the simulator should be a PPT in simulation-based security?

I am wondering, if the simulator is not PPT, what intuitive and formal contradiction we will have? For example, if we can only have a simulator in exponential time. This PPT condition for simulator ...
• 121
27 views

### Can parties in an MPC protocol establish a shared secret with an external party?

Creating a shared secret(ECDH) with a single private key is easy: a·B = b·A Does the same apply to MPC? and if so how? I have been using the https://github.com/bnb-chain/tss-lib to try and achieve the ...
1 vote
44 views

### Parallel Composition in UC / CC?

I was learning about composable security frameworks, and I was wondering about the following when I was learning about Constructive Cryptography here (https://youtu.be/l7vyzRtLQCM?feature=shared&t=...
• 111
1 vote
53 views

### How to multiply a boolean share with an arithmetic share

The problem is to multiply a boolean share with an arithmetic share, a commonly used technique in functions such as multiplexing. In my opinion, a straightforward approach would be to convert the ...
• 47
70 views

### Secure Channels in Ideal World

In the real world ideal world paradigm for proving security of a multiparty protocol we consider secure channels between honest parties and the TTP (trusted third party). 1.What does secure channel ...
31 views

### BGW Protocols - Number of Rounds

What does the depth mean in the case of BGW protocol? It says a depth $d$ requires $d$ rounds of communication while using the BGW protocol. Is it because multiplication requires interaction among ...
1 vote
67 views

### Generating random numbers in MPC, but the upper bound remains secret

Suppose we are using secret sharing-based MPC over a prime-order field. Given shares of a secret integer $s$, is there a way to generate shares of uniformly random integer in $[0,s)$ such that $s$ ...
60 views

### what is exactly the meaning of fairness in MPC?

According to this paper , Gordon, D., Hazay, C., Katz, J., Lindell, Y.: Complete fairness in secure two-party computation. In: Proc. 40th Annual ACM Symposium on Theory of Computing (STOC) (2008) ...
• 61
1 vote
104 views

### EC-ElGamal scalar-to-point mapping for a secure multiparty computation setting

The ElGamal cipher is additively homomorphic for points, but not for scalars. In a single party setting, people usually get around this by mapping the scalar m to ...
28 views

### Privacy-preserving source to destination shortest path algorithms with real-time querying

I'm looking for implementations of privacy-preserving shortest path algorithms that offer real-time or near real-time query performance, where both the source and destination nodes are kept secret. I'...
• 101
1 vote
40 views

62 views

### Multiparty Computation of SHA-256

I'd like to find a mechanism to evaluate the SHA-256 compression function using multi-party computation, but I'm not sure what's possible given the current state of the art and would appreciate some ...
• 642
1 vote
75 views

### remove trusted setup (such as CRS) via running mpc

In the MPC protocol based on the common reference string (CRS) model, the CRS can be generated by the simulator, and the simulator can obtain the backdoor information in the CRS (such as the private ...
• 33
1 vote
62 views

There is a two-party computation protocol based on 2-out-of-2 additive secret sharing in Figure 1. Party $P_0$ holds secret shares $[a]_0, [b]_0$, and party $P_1$ holds secret shares $[a]_1, [b]_1$ ...
• 204
1 vote
57 views

### Design a multi party Private Set Intersection protocol with unconditional zero-sharing

Unconditional zero-sharing was presented in the following paper Practical Multi-party Private Set Intersection from Symmetric-Key Techniques, by Vladimir Kolesnikov, Naor Matania, Benny Pinkas, Mike ...
• 61
102 views

### Converting Random VOLE to n OLEs with extra communication

I understand it is possible to convert a Random OLE (ROLE) into an OLE with desired inputs with some extra communication. My understanding is, Alice and Bob mask their desired input with the random ...
1 vote
47 views

### Server parameters for Differential Zero Knowledge?

I'm working to use Differential Zero Knowledge proof on client local data before sharing with server. May I know which parameters need to be established at server side as to verify that the client is ...
• 83
168 views

### What's the meaning of the assumption of "honest majority" in a mpc protocol? How to prove the security when (not) an honest majority assumption?

(1) What's the meaning of the assumption of "honest majority" in a mpc protocol? (2) How to prove the security when (not) an honest majority assumption?
• 137
372 views

### Must general secure two-party computation be implemented based on public-key encryption primitives?

We know that secure multi-party computation (MPC) does not have to be implemented based solely on public-key cryptographic primitives (aka asymmetric-key primitives). Many MPC protocols rely on ...
• 204
1 vote
93 views

### What is the standard security and leaky security, and the relation between the standard/leaky security and the leakage function?

Recently, I read some security proofs about the secure multi-party computation (MPC) protocol, which includes statements about information leakage, such as the security proof below from the paper CWL+...
• 204
71 views

### Choosing $C_0$ to make second row zero for Garbled Row Reduction (GRR3)

In GRR3,we make the first row of the Garbled table to be zero by choosing a special value of $C_1$. Why don't we make the second row also zero by choosing a special value of $C_0$?
43 views

### I'm wondering if using the same one public key does not guarantee privacy in the computation of multiple data owners

Participating entity: multiple data owners, computing clouds Protocol: The multiple data owners send their data to the computing clouds, which perform the computation of the data. Privacy protection:...
• 161
1 vote
66 views

### How to avoid sender modify the final output in private set intersection under malicious setting?

I'm relatively new to this topic, and I have a question that might seem basic. I appreciate your patience. In most PSI schemes(2 party or multi party),the intersection result is always output by only ...
• 61
49 views

### How to estimate operation cost/business model of Multi-Party Computation (MPC) [closed]

As the director of a privacy-preserving startup venturing into Multi-Party Computation (MPC) protocol development, we are faced with the challenge of finding the most suitable business model. Our ...
3k views

### What is malicious privacy?

This paper says in the appendix， At a high-level, malicious privacy is defined similar to malicious security, but with a modified ideal functionality that is corruptible, meaning that the adversary ...