Questions tagged [multiparty-computation]
Multi-party computation (MPC) allows a set of parties, each with a private input, to securely and jointly perform any computation over their inputs.
302
questions
0
votes
1answer
31 views
Example of a Two-party GMW Protocol
I have been looking for a concrete example of GMW protocol for two parties. I was trying with the following example for computing $XOR$ of two parties:
A's secret bit is $a = 0$, B's secret bit is $b ...
2
votes
1answer
37 views
Extract adversary's secret input in simulation based security proofs
I am trying to understand the simulation-based security proofs (as well as the UC framework), I find that there is a basic assumption when proving the security, i.e., the simulator could extract the ...
0
votes
1answer
55 views
If there exists MPC protocols such that f(x1,x2,…,xn)--> y,y,…,y then there exists MPC such that f(x1,x2,…,xn)--> y1,y2,…,yn
Show that if there exists MPC for all same-output n-party functionalities then there exists MPC
for all diff-output functionalities.
1
vote
0answers
39 views
Encrypting text with AES and MPC
I'm thinking of implementing text encryption and decryption in my program using AES using key sharing thanks to MPC (the point is that the key should never be provided in full), however, all public ...
0
votes
0answers
34 views
Confidential data encryption on ethereum
I already built a supply chain that is able to collect product information on Ethereum. Now, that data can be confidential, but I still want to do Matrix calculations on it. I came across homomorphic ...
1
vote
0answers
46 views
Google Timeline: is it encrypted and if so who has the key? [closed]
Google Timeline claims (e.g. here) that "Your Timeline is private, so only you can see it."
What does that mean? As a cryptographer I would take that to mean that the Timeline data is encrypted using ...
0
votes
0answers
45 views
Does secure multiplication makes sense in the case of 2 inputs?
I am looking at a protocol to securely multiply numbers, so as to preserve privacy of inputs.
In particular, suppose there are three parties $P_1$, $P_2$ and $P_3$ and 2 numbers to multiply, $a \in \...
0
votes
0answers
54 views
How to combine homomorphic encryption with secure multi-party computing?
I admit that I am a novice in cryptography, and I temporarily received a project that requires the use of homomorphic encryption technology and secure multiparty computing technology.
Our team plans ...
0
votes
0answers
15 views
Partially synchronous model in broadcast
I am confused by the different definitions attributed to partially synchronous model: for e.g., in a paper by Hevia and Micciancio (PODC 2005), they state that messages sent in one round are ...
2
votes
1answer
67 views
Threshold decryption in multi-key homomorphic encryption
I have a problem understanding the security of threshold decryption in multi-key homomorphic encryption (MKHE) with so called "noise flooding". In particular I think that it is not secure, so probably ...
0
votes
0answers
31 views
Simulation-based proof in a particular scenario
Suppose we have a two-party protocol in the semi-honest model, which is based on an additive homomorphic cryptosystem like Paillier.(P2 will generate the public and private key and publish the public ...
0
votes
0answers
31 views
Privacy by Simulation with Simulation-based Proof
In the semi-honest model for 2PC, why can we say that "if parties' views can be simulatable given the parties' inputs and outputs, then this implies that the parties learn nothing from the protocol ...
0
votes
2answers
53 views
Why this malicious behavior of corrupted sender isn't considered in malicious-secure OT?
I have read some oblivious transfer protocols, and I am confused about why they do not mention the malicious behavior that the corrupted sender may encrypt the wrong message $x_0'$ and $x_1'$ so that ...
2
votes
0answers
68 views
Multi-party computation with only 1 party?
MPC is $f(E_1(a), E_2(b)) = c$, where $E$ is encryption by different keys $k_1$ and $k_2$.
Homomorphic encryption is $f(E_1(a)) = E_1(c)$, where the input and output are encrypted.
I want $f(E_1(a)) ...
3
votes
2answers
237 views
Concept Question for Secure Computation
I think this should be a simple question and I might be missing something fairly fundamental, but I haven't been able to find the answer.
Basically, suppose there are parties $A$ and $B$. Party $A$ ...
2
votes
1answer
52 views
Security of secure two-party computation with a trusted dealer during offline phase?
In the SecureML paper, one can assume that two non-colluding servers can run secure two-party computation protocol based on secret sharing with the help of a third party (client).
The client would ...
1
vote
1answer
60 views
Do garbled circuits run in constant time?
It seems like garbled circuits should not be input dependent, and hence should always run in constant time. Just wanted to clarify if this is true.
2
votes
0answers
63 views
Are there secure MPC schemes that support uneven load balancing between the parties?
In a scenario of which some of the parties have more data / compute power / trust reputation etc. than other parties - are there known methods to do secure multiparty computation with load balancing ...
2
votes
1answer
105 views
How many parties are needed to compute multiplication with BGW?
Let's say we have 3 parties and each one of them has a different secret number. Every party wants to learn the product of all the 3 numbers without learning about the other inputs.
With the BGW ...
1
vote
0answers
51 views
Why is 2PC not used as any other primitive like DH? [closed]
Why is 2PC (2-Party Computation) not used as any other primitive like Diffie-Hellman?
I'm not talking about the general secure computing, but some weaker security requirement or special case schemes.
...
1
vote
1answer
86 views
Information Theoretic Oblivious Transfer?
Do we have information theoretic oblivious transfer protocols that are that can not be broken by a computationally unbounded attacker?
1
vote
1answer
56 views
Where was the stand-alone model for simulation-based MPC proposed first?
The stand-alone model and the UC model for simulation-based proofs in multiparty computation differ in the guarantees that they provide: The stand-alone model provides security under sequential ...
3
votes
0answers
91 views
Literature question on secure multiparty computation
Consider $N$ players and assume that a private channel between each pair of players is available. Player $i \in \{ 1, \ldots,N\}$ holds a secret $S_i$, which is a sequence of $B$ random bits.
The ...
2
votes
1answer
60 views
half-gates in garble circuit
Recently I've been reading papers about MPC protocol, but when I read the paper by Zahur, S., M. Rosulek, and D. Evans. 2015 Two Halves Make a Whole- Reducing Data Transfer in Garbled Circuits Using ...
0
votes
0answers
29 views
A secure multi-party computation problem
The problem is expressed as follows:
User $u_1$ owns $a_1$, user $u_2$ owns $a_2$, $\cdots$, user $u_n$ owns $a_n$, and Alice owns a vector $\vec b = \{b_1,b_2,\cdots,b_n\}$.
Then, Alice want to ...
0
votes
0answers
28 views
How to create a generator for a $Q_3$ access structure?
I'm reading about access structures used for multiparty-computation from https://eprint.iacr.org/2004/245 and https://eprint.iacr.org/2000/037. My understand is that to actually use the access ...
1
vote
0answers
58 views
How Multi-party Computation works [closed]
I'm new to MPC. I was reading about it when I found an example that seemed to be trivial about how it works.
In the picture below, the way X1 sends its data to X2 is by generating a huge random ...
2
votes
1answer
64 views
Difference between MPC and outsourced computation
I am reading an introductory paper on multi-party computation (MPC), and it makes a distinction between outsourced computation and MPC.
In an outsourced computation, one party owns the data and ...
1
vote
1answer
66 views
What does non-collusion assumption mean in server-aided protocol based on secret sharing?
Suppose $m$ clients split their own input into $n$ shares using additive secret sharing scheme (mod something).
Then, each of the clients sends each share to each of $n$ external servers.
After ...
0
votes
0answers
37 views
Yao's millionaires problem - solution complexity
In his 82 paper, Yao gave two theorems regarding the maximum number of bits transmitted between Alice and Bob in order to privately compute a function $f$ on two private $n$-bit inputs $i$ and $j$. ...
0
votes
1answer
37 views
Order of OTs and commitments in Yao's Protocol for malicious adversaries
I was reading the book Efficient Secure Two-Party Protocols by Y. Lindell and C. Hazay. Page 92 of the book says
This check is crucial and thus the order of first running the oblivious transfer and ...
0
votes
1answer
30 views
Constant number of rounds in Yao's Protocol for semi honest adversaries
According to me, every OT takes a constant number of rounds and since we have to do an OT for every input of one party, we'll have to do O(n) OTs which would correspond to O(n) rounds. But I have read ...
2
votes
1answer
112 views
Why BGW Multiplication Gate Works?
I am reading Pragmatic MPC (link) about the BGW protocol.
I also cross-reference here (click on lecture link for slides) *The BGW Construction for the Information Theoretic Setting – Benny Pinkas
I do ...
3
votes
1answer
124 views
Multiparty millionaire problem where members only know if they are the richest one
I'm looking for a generalisation of Yao's millionaire problem: $N$ parties want to know whether they are the richest one. If they are not, then they just know they are not the richest party - but do ...
7
votes
1answer
122 views
Limitations of boolean and arithmetic circuits
Much of modern cryptography is based around working with boolean or arithmetic circuits. For example in Multi-Party Computation the 'famous' results allow for the secure computation of any function ...
1
vote
1answer
57 views
Securely computing functions over source code
I have been studying multi-party computation and want to start implementing it. I think it would be interesting to do this where one of the inputs (say party 1) is some source code, say a .py file.
...
0
votes
0answers
23 views
Secure Computation with TTP using Ring-LWE Homomorphic Encryption
I was working with secure outsourced computation for multi-party computation in which security is assured by ring-LWE based asymmetric homomorphic encryption in the semi-honest model. Is it feasible ...
1
vote
1answer
58 views
How can one prove correctness of shared secrets in secret sharing schemes?
Assume we are in a centralized secret sharing setting, where one party generates the shares, and distributes them to other parties. How can the distributor who creates the shares prove to the parties ...
0
votes
0answers
27 views
Commitment HIDING ⇒ Real≈Ideal in Multiple Coin Tossing Security
I'm reading /Multiple_Coin_Tossing_Security/P2_Corrupted/ ("Information Security and Cryptography" Theorem 6.7.4 starting from page 325) and after description of Simulator for P2, the author continues ...
3
votes
1answer
84 views
MPC and Secret Sharing in not Fully-Connected Network
I have an interest in applications of MPC and Secret Sharing.
My point of view is from fields of distributed computing and Game Theory.
I want to generalize some results to arbitrary network ...
9
votes
3answers
2k views
Examples of protocols that are insecure when run concurrently
I was reading Canetti00 Universally Composable security paper. The first page of introduction says that there are some MPC protocols and Zero knowledge protocols that are insecure under concurrent ...
1
vote
1answer
67 views
Why do we use addition and multiplication in GMW protocol
So i'm reading about secure computation and the GMW protocol.
I don't understand why the protocol evaluates the addition and the multiplication ?
Why not just the multiplication ?
I didn't find any ...
1
vote
1answer
28 views
OT extensions paper: Why is $G_{m+1} \nleq m \times AND_B$?
I am reading this paper, in which Beaver shows how to take a small number of Oblivious Transfers (OTs) and extend them into an arbitrary number of OTs by implementing a pseudo-random number generator ...
1
vote
0answers
41 views
Question about the BCP cryptosystem
Is it possible to have a multiparty untrusted generation of the public parameters for the BCP cryptosystem (https://www.iacr.org/archive/asiacrypt2003/01_Session01/03_106/28940037.pdf), so that a ...
0
votes
0answers
85 views
Split TOTP/HOTP secret and generate pin without trusted dealer
Many site use time-based one time password (totp) as second factor auth method, such as aws.
So we can split the totp secret and distribute each part to different party to achieve threshold login ( ...
-1
votes
1answer
47 views
Ensuring correctness property in multi-party protocols
Can you suggest mechanisms to ensure the correctness of the protocol output, against Active Adversaries in multi-party protocols. Specifically for a dishonest majority setting?
I would like to have ...
5
votes
2answers
173 views
MPC protocols for high school kids
I was explaining MPC to a high school student. He was excited and asked me for some examples. The only ones that I could think of are by using garbled circuits. Are there some simple MPC protocols for ...
2
votes
1answer
72 views
Is it possible to represent max{a,b} as a binary polynomial?
For privacy-preserving comparison, is it possible to represent the function of $f(a,b)=\max\{a,b\}$ as a binary polynomial $p(a,b)$?
0
votes
0answers
54 views
Decentralized / Distributed Private Key Generation between Untrusted Parties?
I found an interesting concept in this paper, page 13, (Link to the paper) called "Decentralized private key generation", as follows:
"Decentralized private key generation – Multiple Enigma nodes ...
1
vote
1answer
312 views
Simulation based proofs, what am I missing?
In the example given by in the top answer of Simulation based proofs: Simple examples claims that this is insecure the semi-honest, and I need assistance in where I am failing to reason why that this ...
