Questions tagged [multiparty-computation]
Multi-party computation (MPC) allows a set of parties, each with a private input, to securely and jointly perform any computation over their inputs.
324
questions
0
votes
1answer
44 views
Secret Sharing Domain Questions
all,
I have a very fundamental question on Secret Sharing schemes such as SPDZ families.
As far as I can see for now, SS schemes always assume a certain variable range. For example, suppose the bit ...
2
votes
0answers
48 views
Secure Protocol
How to show there is no secure protocol to compute OR?
I need to know the mathematical proof of this statement. I am understanding this statement using the matrix representation of $f(x,y)$ but unable ...
0
votes
1answer
31 views
LSB extraction in MPC: Doubts about correctness
I have doubts about whether the protocol below for LSB extraction (denoted Mod2) from the paper Improved Primitives for Secure Multiparty Integer Computation is correct. Clarifications will be ...
2
votes
1answer
46 views
How (generally) do modern schemes deal with an adversary with the capacity to either instantly, or over time, corrupt a majority of parties
I'm curious about the honest minority case and what cryptographers have and are currently using to get around this. My motivation is primarily the MPC space, but I'm sure there are other subfields ...
1
vote
1answer
50 views
Simulating a joint distribution of an *almost* deterministic function
The following is in the context of secure MPC.
Suppose that there is a functionality $f(x,y)$ which outputs 'answer' with probability $1-\textrm{negl}(n)$ for some security parameter $n$, and 'other ...
1
vote
1answer
37 views
Boolean circuit: can the output wire of a gate be used by many different gates in the next layer?
There are two typical secure multiparty computation paradigms using boolean circuits, namely garbled circuit and secret-sharing-based boolean computation. It is well-known that garbled circuits can be ...
3
votes
1answer
62 views
Why does verifiable secret sharing with an honest majority require a broadcast channel?
In the information-theoretic model with active adversaries, it seems to be well-known that no protocols with exact reconstruction of the secret exist for the task of verifiable secret sharing (VSS) ...
3
votes
1answer
62 views
Is there any examples of information-theoretic secure MPC for dishonest majority against malicious adversary?
My research is to propose highly secure MPC protocol with some conditions.
Especially, I want to consider that
security against malicious (active) adversary
dishonest majority setting
information-...
1
vote
0answers
51 views
Non-post quantum primitives in MPC protocols: for and against?
Is it acceptable from a security point of view for an MPC protocol to use non-post quantum cryptographic primitives?
Note that except for secret sharing, which provides information-theoretic security, ...
1
vote
2answers
236 views
Imposibility of bias-resistant coin tossing (Cleve'86) and its connection to modern notion of fairness in Secure Multiparty Computation
In modern Secure Multi-party Computation (SMPC) protocols (informally) the notion of Fairness and Guaranteed Output Delivery (GOD) is defined as follows:
Fairness: If the adversary gets the output of ...
1
vote
0answers
40 views
What's the difference between compromise and corruption in MPC?
What is the difference between corruption and compromise? Are Compromising a user and ...
2
votes
1answer
48 views
Non-interactive proof of value in MPC
Does it exist? Specifically using Shamir secret sharing based MPC and looking for a (non-)interactive way to prove that the secret value is valid. A value is valid if it is part of a set for example $[...
2
votes
1answer
67 views
MPC protocols in plain/CRS/PKI models
I have seen that in MPC multiple models in different dimensions can be envisioned, like asynchronous vs synchronous networks, access to broadcast channels, and so on. However, a particularly ...
0
votes
0answers
34 views
Model a dishonest majority controlled by several adversaries in a voting protocol?
In the context of secure multi-party computation protocols, when a dishonest majority is considered, it is assumed the worst case scenario, i.e., all the corrupted parties are controlled by the same ...
2
votes
2answers
63 views
Regarding the feasibility of MPC protocols
I know that there is a general result stating that any function can be computed in an MPC protocol. In this question, I'm interested in understanding the practicality of MPC protocols.
Are any ...
0
votes
0answers
28 views
Steiner GDH3 (n-party Diffie Hellman)
I am trying to implement a n-party Diffie Hellman protocol.
In particular I'm implementing Steiners et. al. natural extension "GDH3" (starting on page 34).
The problem is that my python ...
5
votes
0answers
48 views
Garbling in the wild (soft question)
I am curious to know whether (Yao's) garbled circuits are actually deployed in practice. There has a lot of works on optimising garbled circuits (e.g., here and here) and I am interested in whether ...
1
vote
1answer
29 views
Secure multiparty computation… where one entity owns all parties
Here's a corner case for you.
A user produces a small amount of confidential data and would like to delegate a third-party to perform some computation on it and return the results. Data and results ...
3
votes
1answer
97 views
Is there a secure multi-party computation (SMPC) scheme that doesn't use secret sharing?
According to the Wikipedia article about SMPC:
Secure MPC is closely related and builds on to the problem of secret
sharing, and more specifically verifiable secret sharing (VSS), which
many ...
4
votes
1answer
51 views
Multiparty dataset intersection count
Typically, Private Set Intersection (PSI) protocols let you learn the subset of items on each party's dataset that are in the intersection. The problem in this case is a relaxation of these kind of ...
0
votes
0answers
94 views
CKKS Encoding scheme explanation
I have been going over the CKKS Homomorphic Encryption scheme but I can't seem to understand how the mapping takes place while encoding. I don't get what the line below is trying to convey. I saw this ...
0
votes
0answers
25 views
Stand-alone vs UC and Non-reactive vs Reactive Functionalities
I'm looking for a simple and concise explanation for the following:
What are crucial differences and similarities between UC and stand-alone security? Under what conditions does one imply the other?...
0
votes
0answers
58 views
BGW Multiplication: Linearizing the polynomial
I have some trouble understanding the linearization of the degree 2t polynomial generated by multiplication in BGW. It would be great if someone could decode this ...
0
votes
1answer
89 views
BGW Multiplication: How does it work?
I could not understand how multiplication is carried out in the BGW protocol for 3 parties. Reference: https://crypto.stanford.edu/pbc/notes/crypto/bgw.html
I've understood that in multiplication, we ...
1
vote
2answers
69 views
GMW Multiplication AND for 2 parties
I am looking into the GMW protocol's evaluation for multiplication in 2 parties. I have referred to different materials on it but I didn't exactly understand how $a_i b_j + a_j b_i$ is calculated in a ...
2
votes
2answers
79 views
Does Cut-Choose technique for yao garbled circuit provide statistical security?
Yao Garbled circuit is 2 parties secure computation protocol between Semi honest adversaries. However, the cut-and-choose mechanism complies semi-honest garbled circuits into the one secure against ...
1
vote
0answers
54 views
Can two anonymous parties determine whether they interacted before, without being able to link encounters?
Assume an anonymous communication system in which anonymous parties randomly meet in pairs to exchange information.
How could two anonymous parties determine whether they have interacted before, ...
0
votes
1answer
54 views
Example of a Two-party GMW Protocol
I have been looking for a concrete example of GMW protocol for two parties. I was trying with the following example for computing $XOR$ of two parties:
A's secret bit is $a = 0$, B's secret bit is $b ...
2
votes
1answer
62 views
Extract adversary's secret input in simulation based security proofs
I am trying to understand the simulation-based security proofs (as well as the UC framework), I find that there is a basic assumption when proving the security, i.e., the simulator could extract the ...
-1
votes
1answer
72 views
If there exists MPC protocols such that f(x1,x2,…,xn)--> y,y,…,y then there exists MPC such that f(x1,x2,…,xn)--> y1,y2,…,yn
Show that if there exists MPC for all same-output n-party functionalities then there exists MPC
for all diff-output functionalities.
1
vote
0answers
49 views
Encrypting text with AES and MPC
I'm thinking of implementing text encryption and decryption in my program using AES using key sharing thanks to MPC (the point is that the key should never be provided in full), however, all public ...
0
votes
0answers
39 views
Confidential data encryption on ethereum
I already built a supply chain that is able to collect product information on Ethereum. Now, that data can be confidential, but I still want to do Matrix calculations on it. I came across homomorphic ...
1
vote
0answers
48 views
Google Timeline: is it encrypted and if so who has the key? [closed]
Google Timeline claims (e.g. here) that "Your Timeline is private, so only you can see it."
What does that mean? As a cryptographer I would take that to mean that the Timeline data is encrypted using ...
0
votes
1answer
70 views
Does secure multiplication makes sense in the case of 2 inputs?
I am looking at a protocol to securely multiply numbers, so as to preserve privacy of inputs.
In particular, suppose there are three parties $P_1$, $P_2$ and $P_3$ and 2 numbers to multiply, $a \in \...
0
votes
0answers
76 views
How to combine homomorphic encryption with secure multi-party computing?
I admit that I am a novice in cryptography, and I temporarily received a project that requires the use of homomorphic encryption technology and secure multiparty computing technology.
Our team plans ...
1
vote
0answers
20 views
Partially synchronous model in broadcast
I am confused by the different definitions attributed to partially synchronous model: for e.g., in a paper by Hevia and Micciancio (PODC 2005), they state that messages sent in one round are ...
2
votes
1answer
148 views
Threshold decryption in multi-key homomorphic encryption
I have a problem understanding the security of threshold decryption in multi-key homomorphic encryption (MKHE) with so called "noise flooding". In particular I think that it is not secure, so probably ...
0
votes
0answers
32 views
Simulation-based proof in a particular scenario
Suppose we have a two-party protocol in the semi-honest model, which is based on an additive homomorphic cryptosystem like Paillier.(P2 will generate the public and private key and publish the public ...
0
votes
0answers
31 views
Privacy by Simulation with Simulation-based Proof
In the semi-honest model for 2PC, why can we say that "if parties' views can be simulatable given the parties' inputs and outputs, then this implies that the parties learn nothing from the protocol ...
0
votes
2answers
58 views
Why this malicious behavior of corrupted sender isn't considered in malicious-secure OT?
I have read some oblivious transfer protocols, and I am confused about why they do not mention the malicious behavior that the corrupted sender may encrypt the wrong message $x_0'$ and $x_1'$ so that ...
2
votes
0answers
70 views
Multi-party computation with only 1 party?
MPC is $f(E_1(a), E_2(b)) = c$, where $E$ is encryption by different keys $k_1$ and $k_2$.
Homomorphic encryption is $f(E_1(a)) = E_1(c)$, where the input and output are encrypted.
I want $f(E_1(a)) ...
3
votes
2answers
247 views
Concept Question for Secure Computation
I think this should be a simple question and I might be missing something fairly fundamental, but I haven't been able to find the answer.
Basically, suppose there are parties $A$ and $B$. Party $A$ ...
3
votes
1answer
85 views
Security of secure two-party computation with a trusted dealer during offline phase?
In the SecureML paper, one can assume that two non-colluding servers can run secure two-party computation protocol based on secret sharing with the help of a third party (client).
The client would ...
1
vote
1answer
68 views
Do garbled circuits run in constant time?
It seems like garbled circuits should not be input dependent, and hence should always run in constant time. Just wanted to clarify if this is true.
2
votes
0answers
64 views
Are there secure MPC schemes that support uneven load balancing between the parties?
In a scenario of which some of the parties have more data / compute power / trust reputation etc. than other parties - are there known methods to do secure multiparty computation with load balancing ...
2
votes
1answer
114 views
How many parties are needed to compute multiplication with BGW?
Let's say we have 3 parties and each one of them has a different secret number. Every party wants to learn the product of all the 3 numbers without learning about the other inputs.
With the BGW ...
1
vote
0answers
53 views
Why is 2PC not used as any other primitive like DH? [closed]
Why is 2PC (2-Party Computation) not used as any other primitive like Diffie-Hellman?
I'm not talking about the general secure computing, but some weaker security requirement or special case schemes.
...
1
vote
1answer
128 views
Information Theoretic Oblivious Transfer?
Do we have information theoretic oblivious transfer protocols that are that can not be broken by a computationally unbounded attacker?
1
vote
1answer
68 views
Where was the stand-alone model for simulation-based MPC proposed first?
The stand-alone model and the UC model for simulation-based proofs in multiparty computation differ in the guarantees that they provide: The stand-alone model provides security under sequential ...
3
votes
0answers
103 views
Literature question on secure multiparty computation
Consider $N$ players and assume that a private channel between each pair of players is available. Player $i \in \{ 1, \ldots,N\}$ holds a secret $S_i$, which is a sequence of $B$ random bits.
The ...
