Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [multiparty-computation]

Multi-party computation (MPC) allows a set of parties, each with a private input, to securely and jointly perform any computation over their inputs.

Filter by
Sorted by
Tagged with
0 votes
0 answers
25 views

How to Securely Index Specific Elements from a Secret-Shared Vector Using a Binary Vector?

I am currently exploring a specific problem in secret sharing, which involves securely indexing elements specified by another binary secret-shared vector $\mathbf{s} \in \mathbb{R}^n$ from a secret-...
sillyg's user avatar
  • 1
1 vote
0 answers
29 views

Is there any possible way to make each party obtain the output in a MPC protocol?

I konw a fact that it is impossible to achieve complete fairness in 2-party protocol from Cleve's paper.But i wonder if it is possible to achieve fairness in multi-party setting when the number of ...
Rui T.'s user avatar
  • 31
0 votes
1 answer
49 views

Beaver Multiplication Triples in Dynamic Indexing

Suppose that we have a series of operations, including matrix multiplication $(A × B)$ where $A$ and $B$ are matrices (will be result of other computations) inside our unsupervised machine learning ...
ShokofehVS's user avatar
0 votes
1 answer
44 views

How to compute $r \cdot (a+b+c)$ for random $r$ and secret value$a,b,c$ in MPC?

Suppose Alcie,Bob,and Charlie each has a secret value $a,b,c$ respectively. they want to compute a value $r\cdot (a+b+c)$ together. $r$ is a random value, and all parties know nothing about it. I ...
Rui T.'s user avatar
  • 31
0 votes
0 answers
24 views

How to implement a SKE scheme supporting single-message multi-ciphertext using LowMC and GMW?

I currently have a LowMC scheme and a GMW scheme. How can I implement a symmetric encryption scheme that supports single-message multi-ciphertext? In simple terms, I want to implement a protocol like ...
song's user avatar
  • 11
1 vote
0 answers
58 views

Optimizing MPC multiplicative inverse protocol

My question is regarding a well-known protocol for computing the multiplicative inverse of a nonzero secret-shared field element. Given $[x]$, the parties generate shares $[r]$ of a uniformly random ...
anticommutative's user avatar
0 votes
0 answers
37 views

BGW Multiplication with byzantine adversaries

I have recently read about the BGW Multi-party Computation protocol, more specifically the multiplication gate by Gennaro et al (PDF here), however, some concepts raised questions. Context: From what ...
Miguel Faisca's user avatar
3 votes
1 answer
43 views

MPC Security- Need for Joint Distribution

The security of the multi-party computation protocol can be given by real/ideal world paradigm. The simulator based proof considers the joint distribution of adversary's output and honest parties ...
Novice_researcher's user avatar
1 vote
2 answers
65 views

Comparison in Multi-party Computation without bit decomposition

There are MPC comparison protocols which can securely compute $(a<^?0):=\begin{cases}1,\text{ if }a<0\\ 0,\text{ otherwise}\end{cases}$, where $a$ is an element of a prime-order field (of course ...
anticommutative's user avatar
0 votes
0 answers
21 views

Masking Bits in n-party Garbled Circuit

Let us consider the scenario where there are n-1 garblers and a single evaluator. The garblers together need to generate a garbled circuit. We use a distributed garbling protocol such as [BLO16] and ...
Novice_researcher's user avatar
1 vote
1 answer
89 views

Adaptive corruption in MPC

Adaptive adversaries are a class of adversaries who can decide to corrupt parties in the protocol execution process. However, I want more information about this model and the proof skills. There are ...
Jeffrey's user avatar
  • 137
1 vote
1 answer
45 views

n-Party Garbled Circuit

Yao introduced a famous notion of securely computing any function between 2 users using a concept of Garbling circuit. How can this idea be extended for n-party case? That is there are n-1 garblers ...
Novice_researcher's user avatar
1 vote
1 answer
104 views

Is it secure for A to allow B to run a garbled circuit twice with different inputs? [duplicate]

I was reviewing past exam questions and came across this one: Is it secure for A (the garbler) to allow B (the evaluator) to run a garbled circuit twice with different inputs? They aim to compute the ...
user1's user avatar
  • 35
0 votes
0 answers
40 views

Blob for Commitments

I am currently reading the paper Multiparty Unconditional Secure Protocols (https://dl.acm.org/doi/10.1145/62212.62214). They use blob for commitments. The purpose of blobs is to allow a participant $...
Novice_researcher's user avatar
0 votes
0 answers
54 views

Multiparty Computation of SHA-256

I'd like to find a mechanism to evaluate the SHA-256 compression function using multi-party computation, but I'm not sure what's possible given the current state of the art and would appreciate some ...
Reid Rankin's user avatar
1 vote
1 answer
65 views

remove trusted setup (such as CRS) via running mpc

In the MPC protocol based on the common reference string (CRS) model, the CRS can be generated by the simulator, and the simulator can obtain the backdoor information in the CRS (such as the private ...
amyyy's user avatar
  • 33
1 vote
0 answers
51 views

An additive secret sharing-based protocol against malicious adversaries

There is a two-party computation protocol based on 2-out-of-2 additive secret sharing in Figure 1. Party $P_0$ holds secret shares $[a]_0, [b]_0$, and party $P_1$ holds secret shares $[a]_1, [b]_1$ ...
Yang's user avatar
  • 194
1 vote
1 answer
43 views

Design a multi party Private Set Intersection protocol with unconditional zero-sharing

Unconditional zero-sharing was presented in the following paper Practical Multi-party Private Set Intersection from Symmetric-Key Techniques, by Vladimir Kolesnikov, Naor Matania, Benny Pinkas, Mike ...
Rui T.'s user avatar
  • 31
3 votes
1 answer
81 views

Converting Random VOLE to n OLEs with extra communication

I understand it is possible to convert a Random OLE (ROLE) into an OLE with desired inputs with some extra communication. My understanding is, Alice and Bob mask their desired input with the random ...
Nikola Hristov Kalamov's user avatar
1 vote
0 answers
46 views

Server parameters for Differential Zero Knowledge?

I'm working to use Differential Zero Knowledge proof on client local data before sharing with server. May I know which parameters need to be established at server side as to verify that the client is ...
Genie's user avatar
  • 83
0 votes
0 answers
120 views

What's the meaning of the assumption of "honest majority" in a mpc protocol? How to prove the security when (not) an honest majority assumption?

(1) What's the meaning of the assumption of "honest majority" in a mpc protocol? (2) How to prove the security when (not) an honest majority assumption?
Jeffrey's user avatar
  • 137
3 votes
1 answer
296 views

Must general secure two-party computation be implemented based on public-key encryption primitives?

We know that secure multi-party computation (MPC) does not have to be implemented based solely on public-key cryptographic primitives (aka asymmetric-key primitives). Many MPC protocols rely on ...
Yang's user avatar
  • 194
1 vote
1 answer
73 views

What is the standard security and leaky security, and the relation between the standard/leaky security and the leakage function?

Recently, I read some security proofs about the secure multi-party computation (MPC) protocol, which includes statements about information leakage, such as the security proof below from the paper CWL+...
Yang's user avatar
  • 194
2 votes
1 answer
67 views

Choosing $C_0$ to make second row zero for Garbled Row Reduction (GRR3)

In GRR3,we make the first row of the Garbled table to be zero by choosing a special value of $C_1$. Why don't we make the second row also zero by choosing a special value of $C_0$?
asasdasdsa's user avatar
0 votes
0 answers
42 views

I'm wondering if using the same one public key does not guarantee privacy in the computation of multiple data owners

Participating entity: multiple data owners, computing clouds Protocol: The multiple data owners send their data to the computing clouds, which perform the computation of the data. Privacy protection:...
user2642459's user avatar
1 vote
2 answers
51 views

How to avoid sender modify the final output in private set intersection under malicious setting?

I'm relatively new to this topic, and I have a question that might seem basic. I appreciate your patience. In most PSI schemes(2 party or multi party),the intersection result is always output by only ...
Rui T.'s user avatar
  • 31
-2 votes
1 answer
48 views

How to estimate operation cost/business model of Multi-Party Computation (MPC) [closed]

As the director of a privacy-preserving startup venturing into Multi-Party Computation (MPC) protocol development, we are faced with the challenge of finding the most suitable business model. Our ...
user4594525's user avatar
6 votes
1 answer
3k views

What is malicious privacy?

This paper says in the appendix, At a high-level, malicious privacy is defined similar to malicious security, but with a modified ideal functionality that is corruptible, meaning that the adversary ...
somuns Miller's user avatar
0 votes
1 answer
62 views

How does a distributed data clean room work?

I'm learning about the scheme of a distributed data clean room. It appears to be similar to an MPC (Multi-Party Computation) framework. What is the difference between them, and why does it run faster ...
haoxuan li's user avatar
1 vote
1 answer
63 views

The representation of truncation protocol in SecureML

The secure multiparty computation framework SecureML 1 has proposed a truncation protocol for decimal arithmetic in the integer field. As mentioned in this paper, In field $\mathbb{Z}_{2^l}$, $x\in [...
Mia's user avatar
  • 11
3 votes
1 answer
214 views

Resources for simple MPC proofs

Could anyone direct me to literature regarding privacy proofs in the MPC setting. For example, how can one prove the following simple problem: Suppose a setting with $n$ parties $S_1, \ldots, S_n$ ...
Kolja's user avatar
  • 143
0 votes
1 answer
88 views

Group secret agreement for clients do not have connection to each other

In my idea, $n$ clients will have the connection to a server, and clients will not be able to connect with other clients. Are there any previous design has been published to let $n$ clients agree on a ...
Anh Nguyễn Tuấn's user avatar
0 votes
1 answer
150 views

Secret Sharing Floating point numbers in IEEE-754 Format

Various papers in the literature (such as https://eprint.iacr.org/2022/322.pdf, https://eprint.iacr.org/2013/850.pdf) use the sign, exponent, and significand values to additively secret share the ...
Sumana bagchi's user avatar
1 vote
1 answer
112 views

How does the key generation of a homomorphic secret-sharing protocol works?

I am new to cryptography and do not have sufficient background knowledge, and I am sorry for any possible vagueness in my question. I am reading a paper (https://eprint.iacr.org/2019/129.pdf) about ...
zhengyuansu's user avatar
0 votes
0 answers
58 views

Multiplicative inverse protocol for MPC that outputs 0 when input is 0

Setting: Shamir secret-sharing over the field $GF(p)$, $p$ a prime. For $a\in GF(p)$, I would like a protocol that takes a sharing $[a]$ as input, and outputs: $[a^{-1}]$ if $a\neq 0$, and $[0]$ if $a=...
anticommutative's user avatar
1 vote
1 answer
63 views

Modern proof of Kilian's result that OT is complete for 2PC

I'm looking for a textbook or article that spells out the details of Kilian's paper on the completeness of oblivious transfer for secure two-party function evaluation (2PC). Kilian's paper is in the ...
lamontap's user avatar
  • 925
0 votes
2 answers
72 views

Threshold signature computing

0 I have two questions: Can someone point me to some solution providing multi-party {t,n}-threshold ECDSA? I imagine that such a scheme works first by creating an ECDSA private key then sharding it ...
Hristo Todorov's user avatar
1 vote
1 answer
75 views

Independence of the inputs in multi-party computations

My Main Question: Do we always require to be sure that the inputs of the parties in a secure multi-party computation are independent? i.e., one party's inputs do not have dependency on the other ...
m123's user avatar
  • 283
5 votes
1 answer
145 views

difference between Covert and Security with abort

In the realm of secure Multi-Party Computation (MPC) schemes, there exist two fundamental concepts known as the covert adversary model and security with abort. From what I understand, both of these ...
Mahdi Mahdavi's user avatar
0 votes
0 answers
57 views

Is it posible to generate SNARK of MPC share validity?

Assume we have a central issuing authority that sends each participant a share that reconstructs in key $P_k$. I.e. Shamir Secret Share with $2$ out of $N$ format where $N>3$. This central ...
Peersky's user avatar
1 vote
1 answer
184 views

Multi party computation over ring and fields

I am recently reading about multi party computation and its various existing protocols. From what I understand, all the arithmetic operations are performed over a field or a ring such that when two ...
Sumana bagchi's user avatar
3 votes
0 answers
97 views

"Simulator Based" vs "Game Based" security proof for a two-party computation protocol

I am trying to find out how to write a security proof for a two-party computation problem. I have read some examples to write simulators like $x_1 ∧ x_2$ problem and the example in Goldreich's book. I ...
m123's user avatar
  • 283
0 votes
1 answer
56 views

2-PC vs Secure function evaluation vs private function evaluation

I'm currently confused about the distinctions between two-party computation (2-PC), secure function evaluation, and private function evaluation. Additionally, I came across the term secure circuit ...
Mahdi Mahdavi's user avatar
0 votes
0 answers
32 views

verifying that a private key can decrypt a payload in multi key encryption

If Bob takes a plaintext and encrypts it with their own public key and hands it to Eve who in turn encrypts it with her public key, we now have a cipher text that requires both Bob and Eve to decrypt ...
amlwwalker's user avatar
1 vote
0 answers
20 views

Rewinding and information oracle

I am working on a proof for a secure aggregation protocol in which the server aggregates values from several clients. A challenge in the proof is that the server may lie about which clients have ...
Hidde's user avatar
  • 111
1 vote
0 answers
64 views

Understanding Garbled Circuit Design in Gazelle Protocol

I have been examining the Gazelle paper, which focuses on secure inference protocols. One section constructs a Garbled Circuit using inputs cx, sx, and sy to compute the ReLU function in neural ...
Al A's user avatar
  • 43
0 votes
0 answers
19 views

Group keys with revocation in publish/subscribe IoT

I have a group of subscribers who are subscribed to a message broker in an IoT setting, let's say to the topic 'sensor/temperature'. Now, I want to create a public/private key pair in such a way that ...
kekdajeet's user avatar
0 votes
0 answers
75 views

How can I have a message signed by other shares of a private key without revealing it?

I am looking for guidance on implementing a protocol where a BLS private key is split into 2 out of 3 shares using Shamir's Secret Sharing, and signatures must be obtained without revealing the ...
xenon's user avatar
  • 225
0 votes
0 answers
56 views

Can homomorphic property of a commitment scheme be harmful?

Homomorphic properties turn out to be very useful, e.g., for achieving secure multiparty computation. As a concrete example, homomorphic commitments can be used as a building block for secure ...
user1035648's user avatar
0 votes
0 answers
98 views

After ZK-shuffle, how can we let people who got the same number card know each other without letting anyone else know?

In mental poker, we can use ZK-shuffle to deal cards to the players such that the cards are kept private to each player (https://hackmd.io/@nmohnblatt/SJKJfVqzq). Suppose we deal exactly one card to ...
Justin Zhang's user avatar

1
2 3 4 5
11