Questions tagged [multiparty-computation]
Multi-party computation (MPC) allows a set of parties, each with a private input, to securely and jointly perform any computation over their inputs.
491
questions
2
votes
1
answer
51
views
Choosing $C_0$ to make second row zero for Garbled Row Reduction (GRR3)
In GRR3,we make the first row of the Garbled table to be zero by choosing a special value of $C_1$.
Why don't we make the second row also zero by choosing a special value of $C_0$?
- 21
0
votes
0
answers
32
views
I'm wondering if using the same one public key does not guarantee privacy in the computation of multiple data owners
Participating entity: multiple data owners, computing clouds
Protocol: The multiple data owners send their data to the computing clouds, which perform the computation of the data.
Privacy protection:...
- 161
1
vote
2
answers
36
views
How to avoid sender modify the final output in private set intersection under malicious setting?
I'm relatively new to this topic, and I have a question that might seem basic. I appreciate your patience.
In most PSI schemes(2 party or multi party),the intersection result is always output by only ...
- 11
-2
votes
1
answer
41
views
How to estimate operation cost/business model of Multi-Party Computation (MPC) [closed]
As the director of a privacy-preserving startup venturing into Multi-Party Computation (MPC) protocol development, we are faced with the challenge of finding the most suitable business model.
Our ...
6
votes
1
answer
3k
views
What is malicious privacy?
This paper says in the appendix，
At a high-level, malicious privacy is defined similar to malicious security, but with a modified ideal functionality that is corruptible, meaning that the adversary ...
0
votes
1
answer
43
views
How does a distributed data clean room work?
I'm learning about the scheme of a distributed data clean room. It appears to be similar to an MPC (Multi-Party Computation) framework. What is the difference between them, and why does it run faster ...
- 21
1
vote
1
answer
42
views
The representation of truncation protocol in SecureML
The secure multiparty computation framework SecureML 1 has proposed a truncation protocol for decimal arithmetic in the integer field.
As mentioned in this paper,
In field $\mathbb{Z}_{2^l}$, $x\in [...
- 11
2
votes
1
answer
167
views
Resources for simple MPC proofs
Could anyone direct me to literature regarding privacy proofs in the MPC setting.
For example, how can one prove the following simple problem:
Suppose a setting with $n$ parties $S_1, \ldots, S_n$ ...
- 133
0
votes
1
answer
80
views
Group secret agreement for clients do not have connection to each other
In my idea, $n$ clients will have the connection to a server, and clients will not be able to connect with other clients. Are there any previous design has been published to let $n$ clients agree on a ...
0
votes
1
answer
89
views
Secret Sharing Floating point numbers in IEEE-754 Format
Various papers in the literature (such as https://eprint.iacr.org/2022/322.pdf, https://eprint.iacr.org/2013/850.pdf) use the sign, exponent, and significand values to additively secret share the ...
1
vote
1
answer
84
views
How does the key generation of a homomorphic secret-sharing protocol works?
I am new to cryptography and do not have sufficient background knowledge, and I am sorry for any possible vagueness in my question.
I am reading a paper (https://eprint.iacr.org/2019/129.pdf) about ...
- 13
0
votes
0
answers
51
views
Multiplicative inverse protocol for MPC that outputs 0 when input is 0
Setting: Shamir secret-sharing over the field $GF(p)$, $p$ a prime.
For $a\in GF(p)$, I would like a protocol that takes a sharing $[a]$ as input, and outputs: $[a^{-1}]$ if $a\neq 0$, and $[0]$ if $a=...
1
vote
1
answer
54
views
Modern proof of Kilian's result that OT is complete for 2PC
I'm looking for a textbook or article that spells out the details of Kilian's paper on the completeness of oblivious transfer for secure two-party function evaluation (2PC). Kilian's paper is in the ...
- 754
0
votes
2
answers
59
views
Threshold signature computing
0
I have two questions:
Can someone point me to some solution providing multi-party {t,n}-threshold ECDSA?
I imagine that such a scheme works first by creating an ECDSA private key then sharding it ...
- 101
1
vote
1
answer
64
views
Independence of the inputs in multi-party computations
My Main Question:
Do we always require to be sure that the inputs of the parties in a secure multi-party computation are independent? i.e., one party's inputs do not have dependency on the other ...
- 283
5
votes
1
answer
84
views
difference between Covert and Security with abort
In the realm of secure Multi-Party Computation (MPC) schemes, there exist two fundamental concepts known as the covert adversary model and security with abort. From what I understand, both of these ...
- 482
0
votes
0
answers
54
views
Is it posible to generate SNARK of MPC share validity?
Assume we have a central issuing authority that sends each participant a share that reconstructs in key $P_k$. I.e. Shamir Secret Share with $2$ out of $N$ format where $N>3$.
This central ...
- 1
0
votes
1
answer
135
views
Multi party computation over ring and fields
I am recently reading about multi party computation and its various existing protocols. From what I understand, all the arithmetic operations are performed over a field or a ring such that when two ...
3
votes
0
answers
65
views
"Simulator Based" vs "Game Based" security proof for a two-party computation protocol
I am trying to find out how to write a security proof for a two-party computation problem.
I have read some examples to write simulators like $x_1 ∧ x_2$ problem and the example in Goldreich's book. I ...
- 283
0
votes
1
answer
34
views
2-PC vs Secure function evaluation vs private function evaluation
I'm currently confused about the distinctions between two-party computation (2-PC), secure function evaluation, and private function evaluation. Additionally, I came across the term secure circuit ...
- 482
0
votes
0
answers
28
views
verifying that a private key can decrypt a payload in multi key encryption
If Bob takes a plaintext and encrypts it with their own public key and hands it to Eve who in turn encrypts it with her public key, we now have a cipher text that requires both Bob and Eve to decrypt ...
- 101
1
vote
0
answers
18
views
Rewinding and information oracle
I am working on a proof for a secure aggregation protocol in which the server aggregates values from several clients. A challenge in the proof is that the server may lie about which clients have ...
- 111
1
vote
0
answers
59
views
Understanding Garbled Circuit Design in Gazelle Protocol
I have been examining the Gazelle paper, which focuses on secure inference protocols. One section constructs a Garbled Circuit using inputs cx, sx, and sy to compute the ReLU function in neural ...
- 33
0
votes
0
answers
17
views
Group keys with revocation in publish/subscribe IoT
I have a group of subscribers who are subscribed to a message broker in an IoT setting, let's say to the topic 'sensor/temperature'. Now, I want to create a public/private key pair in such a way that ...
0
votes
0
answers
63
views
How can I have a message signed by other shares of a private key without revealing it?
I am looking for guidance on implementing a protocol where a BLS private key is split into 2 out of 3 shares using Shamir's Secret Sharing, and signatures must be obtained without revealing the ...
- 225
0
votes
0
answers
42
views
Can homomorphic property of a commitment scheme be harmful?
Homomorphic properties turn out to be very useful, e.g., for achieving secure multiparty
computation.
As a concrete example, homomorphic commitments can be used as a building block for secure ...
- 363
0
votes
0
answers
64
views
After ZK-shuffle, how can we let people who got the same number card know each other without letting anyone else know?
In mental poker, we can use ZK-shuffle to deal cards to the players such that the cards are kept private to each player (https://hackmd.io/@nmohnblatt/SJKJfVqzq). Suppose we deal exactly one card to ...
- 101
0
votes
1
answer
66
views
Trustless voting where the total number of votes each candidate get is kept private
Given n voters and p candidates, how can we design a trustless voting algorithm that satisfies the following properties. Each voter can only vote for exactly one candidate.
The algorithm needs to:
...
- 101
0
votes
1
answer
59
views
How to calculate inverse of an element using MPC and secret sharing
Suppose we have multiple parties ${P_i}$ each holding a secret share $(y_i,k_i)$ of the secret $(y,k)$. How can we calculate the inverse value $(y+k)^{-1}$ using multiparty computation such that these ...
0
votes
2
answers
94
views
Securely computing the addition of n numbers owned by n people
Assume that we have n people each owning a secret number. Now we want to collaboratively compute the addition of all these numbers without anyone revealing their numbers. Then the result will be made ...
- 101
3
votes
1
answer
182
views
Reference for basic secret sharing and MPC arithmetic algorithms
I am looking for references for the most basic secret sharing and MPC arithmetic algorithms for generic rings or prime fields.
Problem:
Suppose there are $m$ parties $P_1, \ldots, P_m$ which wish to ...
- 133
1
vote
1
answer
79
views
Secure multiparty computation protocols for stable matching?
Are you aware of papers proposing secure multiparty computation protocols for stable matching problems such as Stable Roommates and Stable Marriage problems?
Specifically, I would like the ranking of ...
- 139
2
votes
1
answer
85
views
Is there any secure deterministic two-party computation protocol?
The notion of security considered here is privacy. Is there a secure two-party protocol does not rely on randomness at all when considering passive adversaries (or active adversaries)? If the answer ...
- 21
7
votes
1
answer
275
views
Generating suitable prime numbers for Paillier key pair in GG18
I am working on MPCs (multi party computation) in crypto, and now I am developing a implementation of GG 18.
In sign phase, algorithm needs MtA (Multiplicative to Additive) and uses a Paillier key ...
- 83
1
vote
1
answer
69
views
Does game-theoretical fairness work in when the goal of one party is randomness
When we take the coin flip in Blum's algorithm in "Coin flipping by telephone a protocol for solving impossible problems", where Alice and Bob both want ownership over the same car, then one ...
- 13
1
vote
0
answers
51
views
Constructing OR gate with OT
I am constructing a two-party OR gate and trying to do this with oblivious transfer. Yet I am very new to oblivious transfer, wishing to know whether the following construction makes sense.
Goal: ...
- 11
1
vote
1
answer
40
views
How to build a secure multiparty computation protocol using oblivious transfer as a blackbox?
The following statements seems to be a consensus in cryptography community.
Oblivious tranfer is a complete primitive for secure multiparty computation (SMC).
But I cannot find any explicit ...
- 13
3
votes
0
answers
57
views
On the Adaptive Security of MPC Protocols
In adversarial context of MPC, the corruption behavior
refers to the assumptions about the corrupted parties’ deviation level from the protocol
specification. Three main types of corruption behaviors ...
- 538
5
votes
2
answers
2k
views
Is there a way to calculate a hash with two people so that no one knows the pre-image but if they get together they do?
I'm trying to find a way to have multi party hash computation, more specifically for SHA256. I want for two people to be able to compute a hash so that none of them knows the pre-image but when they ...
- 140
2
votes
0
answers
34
views
What's the fastest way to generate matrix vector Beaver triplets?
$\vec{u_0} + \vec{u_1} = (M_0 + M_1)\cdot (\vec{v_0} + \vec{v_1})$
$P_i$ gets $(\vec{u_i}, M_i, \vec{v_i})$ where $M_i$ is a matrix , $\vec{u_i},\vec{v_i}$ are vectors, with all entries uniformly ...
- 499
2
votes
0
answers
25
views
Why zero sharings are used to mask secret value to the masked value appears to be a random value?
Some interpretations say "By masking a secret value with a uniformly random zero sharing, the masked value appears to be a random value drawn from a uniform distribution. This randomness helps ...
- 21
2
votes
1
answer
185
views
Implementing ECDSA threshold using a secret sharing scheme
My question might be a duplicate but I wasn't able to find a similar question.
I recently developed a wallet-like app and I am trying to implement some MPC features.
I searched a little and even asked ...
- 21
1
vote
0
answers
43
views
How is a message $\mu$ encrypted in a witness encryption scheme below? What does C(x) = 1 mean below?
I was reading this paper, where I came across the following statement on Pg 4 under the Homomorphic Commitments:
A witness encryption scheme, associated with a
NP language, consists of an encryption ...
- 41
1
vote
1
answer
223
views
What does a semi-malicious setting mean in MPC? How is it different from malicious or semi-honest setting?
I was reading this paper, where I came across the following statement:
We consider the problem of unbounded MPC with security against semi-malicious adversaries in the dishonest majority setting. In ...
- 41
3
votes
1
answer
125
views
Garbled circuit and secret sharing
Recently, I was reading the paper One Hot Garbling published on CCS 2021. I noticed a sentence in it:
In this work, we forgo the standard GC notation of garbled labels in
favor of garbled sharings of ...
- 112
2
votes
0
answers
54
views
Why does joint distribution of simulation output and functionality output is required?
I was going through this simulation tutorial.
For example, let x and y be lists of data elements, and
let f be a functionality that outputs an independent random sample of x ∪ y of some predetermined
...
- 41
3
votes
0
answers
102
views
Dynamic Distributed Key Generation for elGamal
I am looking for a scheme for dynamic threshold public-key encryption, which includes dynamic distributed key generation.
Namely, the number of parties that participate in DKG is bounded, but unknown. ...
1
vote
1
answer
119
views
Question about Secure Multi-Party Computation
I am doing research about Non-interactive Secure Multi-party Computation and encounter a dilemma that I am not quite sure if it is possible and wonder if there are better thoughts that could help.
...
- 13
2
votes
1
answer
89
views
Multi party authentication or encryption
I rent a room in a building. There are also 9 others who rent other rooms in this building. Just like everyone else who rents a room I only have one key of this building.
With my key I can open the ...
- 123
0
votes
1
answer
45
views
SMCQL practical examples
I am looking for some practical examples on how to use SMCQL on some typical SQL queries. The paper seems to be oriented more towards theory. Can somebody point me to some examples to understand it ...
- 181