Questions tagged [multiparty-computation]
Multi-party computation (MPC) allows a set of parties, each with a private input, to securely and jointly perform any computation over their inputs.
531
questions
0
votes
0
answers
4
views
Is there any malicious secure MPC protocol to compute the sum of values belong to different paties?
Suppose Alice,Bob,Charlie each has a value $a$,$b$,$c$, they want to obtain $a+b+c$ without disclosing their value. I wonder if it is a successful attack when a malicous adversary who corrput Alice ...
- 61
2
votes
1
answer
14
views
Why the simulator should be a PPT in simulation-based security?
I am wondering, if the simulator is not PPT, what intuitive and formal contradiction we will have? For example, if we can only have a simulator in exponential time.
This PPT condition for simulator ...
- 121
0
votes
0
answers
27
views
Can parties in an MPC protocol establish a shared secret with an external party?
Creating a shared secret(ECDH) with a single private key is easy:
a·B = b·A
Does the same apply to MPC? and if so how?
I have been using the https://github.com/bnb-chain/tss-lib to try and achieve the ...
1
vote
1
answer
44
views
Parallel Composition in UC / CC?
I was learning about composable security frameworks, and I was wondering about the following when I was learning about Constructive Cryptography here (https://youtu.be/l7vyzRtLQCM?feature=shared&t=...
- 111
1
vote
1
answer
53
views
How to multiply a boolean share with an arithmetic share
The problem is to multiply a boolean share with an arithmetic share, a commonly used technique in functions such as multiplexing. In my opinion, a straightforward approach would be to convert the ...
- 47
-1
votes
2
answers
70
views
Secure Channels in Ideal World
In the real world ideal world paradigm for proving security of a multiparty protocol we consider secure channels between honest parties and the TTP (trusted third party).
1.What does secure channel ...
0
votes
1
answer
31
views
BGW Protocols - Number of Rounds
What does the depth mean in the case of BGW protocol? It says a depth $d$ requires $d$ rounds of communication while using the BGW protocol. Is it because multiplication requires interaction among ...
1
vote
0
answers
67
views
Generating random numbers in MPC, but the upper bound remains secret
Suppose we are using secret sharing-based MPC over a prime-order field. Given shares of a secret integer $s$, is there a way to generate shares of uniformly random integer in $[0,s)$ such that $s$ ...
2
votes
0
answers
60
views
what is exactly the meaning of fairness in MPC?
According to this paper ,
Gordon, D., Hazay, C., Katz, J., Lindell, Y.: Complete fairness in
secure two-party computation. In: Proc. 40th Annual ACM Symposium on
Theory of Computing (STOC) (2008)
...
- 61
1
vote
1
answer
104
views
EC-ElGamal scalar-to-point mapping for a secure multiparty computation setting
The ElGamal cipher is additively homomorphic for points, but not for scalars. In a single party setting, people usually get around this by mapping the scalar m to ...
user113967
0
votes
0
answers
28
views
Privacy-preserving source to destination shortest path algorithms with real-time querying
I'm looking for implementations of privacy-preserving shortest path algorithms that offer real-time or near real-time query performance, where both the source and destination nodes are kept secret.
I'...
- 101
1
vote
0
answers
40
views
Design protocol for logarithm with arithmetic secret sharing
My question is about designing a protocol for logarithm, or any other non-linear function. In arithmetic secret sharing, an input $x$ is split into $x_i$ shares. And all of them are in a finite field $...
- 11
0
votes
0
answers
39
views
PCG (Pseudo-random Correlation Generator) for Silent OT and Beaver's Triples
I am studying this paper https://hal.science/hal-03373123/document to learn how silent OT works, but it's a bit tricky to understand for me... So I wonder if you could explain once again like the one ...
- 33
2
votes
2
answers
96
views
How to Do Beaver's Triple without a Trust Party?
I read the Q/A "
Cryptography
What are the ways to generate Beaver triples for multiplication gate?" on this site.
So, I understand how to create Beaver's triple for a single-bit value ...
- 33
1
vote
0
answers
40
views
Equality Check with FSS
Suppose that we have a condition like checking whether rows and columns ($I, J$) of a matrix $\textbf{A} (\in m \times n)$ have been changed into ($I', J'$) or noting has been added/ removed.
How ...
- 13
3
votes
2
answers
131
views
Definition of non-interactive non-commiting encryption
I'm having trouble understanding the definition of non-interactive non-committing encryption (NINCE) from the paper Separating Random Oracle Proofs from Complexity Theoretic Proofs: The Non-committing ...
- 1,094
0
votes
0
answers
63
views
Why adversary have to do hash queries in RO model?
In MPC，it is common to use hash to extract the real input of malicious adversary under RO model. But I wonder why the adversary have to do hash queries rather than just select random values as the ...
- 61
2
votes
3
answers
196
views
How to anonymously vote?
I have a group of $n$ people (say small constant). Each person votes for $A$ or $B$, and we want to know who won without knowing each individual's vote. How would one design a scheme for this?
My ...
- 23
2
votes
0
answers
44
views
Beaver's Triple Generation: Offline Phase
I know that the Beaver's triple generation is used to reduce the complexity in the online phase during multiplication gate.
However, how are the triples generated during offline place?
Are there ...
0
votes
0
answers
32
views
How to Securely Index Specific Elements from a Secret-Shared Vector Using a Binary Vector?
I am currently exploring a specific problem in secret sharing, which involves securely indexing elements specified by another binary secret-shared vector $\mathbf{s} \in \mathbb{R}^n$ from a secret-...
- 1
1
vote
0
answers
42
views
Is there any possible way to make each party obtain the output in a MPC protocol?
I konw a fact that it is impossible to achieve complete fairness in 2-party protocol from Cleve's paper.But i wonder if it is possible to achieve fairness in multi-party setting when the number of ...
- 61
0
votes
1
answer
55
views
Beaver Multiplication Triples in Dynamic Indexing
Suppose that we have a series of operations, including matrix multiplication $(A × B)$ where $A$ and $B$ are matrices (will be result of other computations) inside our unsupervised machine learning ...
- 13
0
votes
1
answer
46
views
How to compute $r \cdot (a+b+c)$ for random $r$ and secret value$a,b,c$ in MPC?
Suppose Alcie,Bob,and Charlie each has a secret value $a,b,c$ respectively. they want to compute a value $r\cdot (a+b+c)$ together. $r$ is a random value, and all parties know nothing about it.
I ...
- 61
0
votes
0
answers
25
views
How to implement a SKE scheme supporting single-message multi-ciphertext using LowMC and GMW?
I currently have a LowMC scheme and a GMW scheme. How can I implement a symmetric encryption scheme that supports single-message multi-ciphertext? In simple terms, I want to implement a protocol like ...
- 11
1
vote
0
answers
61
views
Optimizing MPC multiplicative inverse protocol
My question is regarding a well-known protocol for computing the multiplicative inverse of a nonzero secret-shared field element. Given $[x]$, the parties generate shares $[r]$ of a uniformly random ...
0
votes
0
answers
42
views
BGW Multiplication with byzantine adversaries
I have recently read about the BGW Multi-party Computation protocol, more specifically the multiplication gate by Gennaro et al (PDF here), however, some concepts raised questions.
Context: From what ...
3
votes
1
answer
49
views
MPC Security- Need for Joint Distribution
The security of the multi-party computation protocol can be given by real/ideal world paradigm. The simulator based proof considers the joint distribution of adversary's output and honest parties ...
1
vote
2
answers
100
views
Comparison in Multi-party Computation without bit decomposition
There are MPC comparison protocols which can securely compute $(a<^?0):=\begin{cases}1,\text{ if }a<0\\ 0,\text{ otherwise}\end{cases}$, where $a$ is an element of a prime-order field (of course ...
0
votes
0
answers
25
views
Masking Bits in n-party Garbled Circuit
Let us consider the scenario where there are n-1 garblers and a single evaluator. The garblers together need to generate a garbled circuit. We use a distributed garbling protocol such as [BLO16] and ...
1
vote
1
answer
107
views
Adaptive corruption in MPC
Adaptive adversaries are a class of adversaries who can decide to corrupt parties in the protocol execution process. However, I want more information about this model and the proof skills. There are ...
- 137
1
vote
1
answer
76
views
n-Party Garbled Circuit
Yao introduced a famous notion of securely computing any function between 2 users using a concept of Garbling circuit. How can this idea be extended for n-party case? That is there are n-1 garblers ...
1
vote
1
answer
115
views
Is it secure for A to allow B to run a garbled circuit twice with different inputs? [duplicate]
I was reviewing past exam questions and came across this one:
Is it secure for A (the garbler) to allow B (the evaluator) to
run a garbled circuit twice with different inputs? They
aim to compute the ...
- 35
0
votes
0
answers
40
views
Blob for Commitments
I am currently reading the paper Multiparty Unconditional Secure Protocols (https://dl.acm.org/doi/10.1145/62212.62214). They use blob for commitments. The purpose of blobs is to allow a participant $...
0
votes
0
answers
62
views
Multiparty Computation of SHA-256
I'd like to find a mechanism to evaluate the SHA-256 compression function using multi-party computation, but I'm not sure what's possible given the current state of the art and would appreciate some ...
- 642
1
vote
1
answer
75
views
remove trusted setup (such as CRS) via running mpc
In the MPC protocol based on the common reference string (CRS) model, the CRS can be generated by the simulator, and the simulator can obtain the backdoor information in the CRS (such as the private ...
- 33
1
vote
0
answers
62
views
An additive secret sharing-based protocol against malicious adversaries
There is a two-party computation protocol based on 2-out-of-2 additive secret sharing in Figure 1. Party $P_0$ holds secret shares $[a]_0, [b]_0$, and party $P_1$ holds secret shares $[a]_1, [b]_1$ ...
- 204
1
vote
1
answer
57
views
Design a multi party Private Set Intersection protocol with unconditional zero-sharing
Unconditional zero-sharing was presented in the following paper
Practical Multi-party Private Set Intersection from Symmetric-Key Techniques, by Vladimir Kolesnikov, Naor Matania, Benny Pinkas, Mike ...
- 61
3
votes
1
answer
102
views
Converting Random VOLE to n OLEs with extra communication
I understand it is possible to convert a Random OLE (ROLE) into an OLE with desired inputs with some extra communication. My understanding is, Alice and Bob mask their desired input with the random ...
1
vote
0
answers
47
views
Server parameters for Differential Zero Knowledge?
I'm working to use Differential Zero Knowledge proof on client local data before sharing with server. May I know which parameters need to be established at server side as to verify that the client is ...
- 83
0
votes
0
answers
168
views
What's the meaning of the assumption of "honest majority" in a mpc protocol? How to prove the security when (not) an honest majority assumption?
(1) What's the meaning of the assumption of "honest majority" in a mpc protocol?
(2) How to prove the security when (not) an honest majority assumption?
- 137
4
votes
1
answer
372
views
Must general secure two-party computation be implemented based on public-key encryption primitives?
We know that secure multi-party computation (MPC) does not have to be implemented based solely on public-key cryptographic primitives (aka asymmetric-key primitives). Many MPC protocols rely on ...
- 204
1
vote
1
answer
93
views
What is the standard security and leaky security, and the relation between the standard/leaky security and the leakage function?
Recently, I read some security proofs about the secure multi-party computation (MPC) protocol, which includes statements about information leakage, such as the security proof below from the paper CWL+...
- 204
2
votes
1
answer
71
views
Choosing $C_0$ to make second row zero for Garbled Row Reduction (GRR3)
In GRR3,we make the first row of the Garbled table to be zero by choosing a special value of $C_1$.
Why don't we make the second row also zero by choosing a special value of $C_0$?
- 21
0
votes
0
answers
43
views
I'm wondering if using the same one public key does not guarantee privacy in the computation of multiple data owners
Participating entity: multiple data owners, computing clouds
Protocol: The multiple data owners send their data to the computing clouds, which perform the computation of the data.
Privacy protection:...
- 161
1
vote
2
answers
66
views
How to avoid sender modify the final output in private set intersection under malicious setting?
I'm relatively new to this topic, and I have a question that might seem basic. I appreciate your patience.
In most PSI schemes(2 party or multi party),the intersection result is always output by only ...
- 61
-2
votes
1
answer
49
views
How to estimate operation cost/business model of Multi-Party Computation (MPC) [closed]
As the director of a privacy-preserving startup venturing into Multi-Party Computation (MPC) protocol development, we are faced with the challenge of finding the most suitable business model.
Our ...
6
votes
1
answer
3k
views
What is malicious privacy?
This paper says in the appendix，
At a high-level, malicious privacy is defined similar to malicious security, but with a modified ideal functionality that is corruptible, meaning that the adversary ...
0
votes
1
answer
80
views
How does a distributed data clean room work?
I'm learning about the scheme of a distributed data clean room. It appears to be similar to an MPC (Multi-Party Computation) framework. What is the difference between them, and why does it run faster ...
- 21
1
vote
1
answer
72
views
The representation of truncation protocol in SecureML
The secure multiparty computation framework SecureML 1 has proposed a truncation protocol for decimal arithmetic in the integer field.
As mentioned in this paper,
In field $\mathbb{Z}_{2^l}$, $x\in [...
- 11
3
votes
1
answer
238
views
Resources for simple MPC proofs
Could anyone direct me to literature regarding privacy proofs in the MPC setting.
For example, how can one prove the following simple problem:
Suppose a setting with $n$ parties $S_1, \ldots, S_n$ ...
- 155