Questions tagged [multiparty-computation]

Multi-party computation (MPC) allows a set of parties, each with a private input, to securely and jointly perform any computation over their inputs.

Filter by
Sorted by
Tagged with
4
votes
0answers
40 views

Garbling in the wild (soft question)

I am curious to know whether (Yao's) garbled circuits are actually deployed in practice. There has a lot of works on optimising garbled circuits (e.g., here and here) and I am interested in whether ...
1
vote
1answer
27 views

Secure multiparty computation… where one entity owns all parties

Here's a corner case for you. A user produces a small amount of confidential data and would like to delegate a third-party to perform some computation on it and return the results. Data and results ...
2
votes
1answer
42 views

Is there a secure multi-party computation (SMPC) scheme that doesn't use secret sharing?

According to the Wikipedia article about SMPC: Secure MPC is closely related and builds on to the problem of secret sharing, and more specifically verifiable secret sharing (VSS), which many ...
4
votes
1answer
38 views

Multiparty dataset intersection count

Typically, Private Set Intersection (PSI) protocols let you learn the subset of items on each party's dataset that are in the intersection. The problem in this case is a relaxation of these kind of ...
0
votes
0answers
37 views

CKKS Encoding scheme explanation

I have been going over the CKKS Homomorphic Encryption scheme but I can't seem to understand how the mapping takes place while encoding. I don't get what the line below is trying to convey. I saw this ...
0
votes
0answers
24 views

Stand-alone vs UC and Non-reactive vs Reactive Functionalities

I'm looking for a simple and concise explanation for the following: What are crucial differences and similarities between UC and stand-alone security? Under what conditions does one imply the other?...
0
votes
0answers
51 views

BGW Multiplication: Linearizing the polynomial

I have some trouble understanding the linearization of the degree 2t polynomial generated by multiplication in BGW. It would be great if someone could decode this ...
0
votes
1answer
55 views

BGW Multiplication: How does it work?

I could not understand how multiplication is carried out in the BGW protocol for 3 parties. Reference: https://crypto.stanford.edu/pbc/notes/crypto/bgw.html I've understood that in multiplication, we ...
1
vote
2answers
61 views

GMW Multiplication AND for 2 parties

I am looking into the GMW protocol's evaluation for multiplication in 2 parties. I have referred to different materials on it but I didn't exactly understand how $a_i b_j + a_j b_i$ is calculated in a ...
2
votes
2answers
74 views

Does Cut-Choose technique for yao garbled circuit provide statistical security?

Yao Garbled circuit is 2 parties secure computation protocol between Semi honest adversaries. However, the cut-and-choose mechanism complies semi-honest garbled circuits into the one secure against ...
1
vote
0answers
53 views

Can two anonymous parties determine whether they interacted before, without being able to link encounters?

Assume an anonymous communication system in which anonymous parties randomly meet in pairs to exchange information. How could two anonymous parties determine whether they have interacted before, ...
0
votes
1answer
39 views

Example of a Two-party GMW Protocol

I have been looking for a concrete example of GMW protocol for two parties. I was trying with the following example for computing $XOR$ of two parties: A's secret bit is $a = 0$, B's secret bit is $b ...
2
votes
1answer
59 views

Extract adversary's secret input in simulation based security proofs

I am trying to understand the simulation-based security proofs (as well as the UC framework), I find that there is a basic assumption when proving the security, i.e., the simulator could extract the ...
0
votes
1answer
61 views

If there exists MPC protocols such that f(x1,x2,…,xn)--> y,y,…,y then there exists MPC such that f(x1,x2,…,xn)--> y1,y2,…,yn

Show that if there exists MPC for all same-output n-party functionalities then there exists MPC for all diff-output functionalities.
1
vote
0answers
48 views

Encrypting text with AES and MPC

I'm thinking of implementing text encryption and decryption in my program using AES using key sharing thanks to MPC (the point is that the key should never be provided in full), however, all public ...
0
votes
0answers
37 views

Confidential data encryption on ethereum

I already built a supply chain that is able to collect product information on Ethereum. Now, that data can be confidential, but I still want to do Matrix calculations on it. I came across homomorphic ...
1
vote
0answers
47 views

Google Timeline: is it encrypted and if so who has the key? [closed]

Google Timeline claims (e.g. here) that "Your Timeline is private, so only you can see it." What does that mean? As a cryptographer I would take that to mean that the Timeline data is encrypted using ...
0
votes
1answer
69 views

Does secure multiplication makes sense in the case of 2 inputs?

I am looking at a protocol to securely multiply numbers, so as to preserve privacy of inputs. In particular, suppose there are three parties $P_1$, $P_2$ and $P_3$ and 2 numbers to multiply, $a \in \...
0
votes
0answers
64 views

How to combine homomorphic encryption with secure multi-party computing?

I admit that I am a novice in cryptography, and I temporarily received a project that requires the use of homomorphic encryption technology and secure multiparty computing technology. Our team plans ...
1
vote
0answers
19 views

Partially synchronous model in broadcast

I am confused by the different definitions attributed to partially synchronous model: for e.g., in a paper by Hevia and Micciancio (PODC 2005), they state that messages sent in one round are ...
2
votes
1answer
96 views

Threshold decryption in multi-key homomorphic encryption

I have a problem understanding the security of threshold decryption in multi-key homomorphic encryption (MKHE) with so called "noise flooding". In particular I think that it is not secure, so probably ...
0
votes
0answers
31 views

Simulation-based proof in a particular scenario

Suppose we have a two-party protocol in the semi-honest model, which is based on an additive homomorphic cryptosystem like Paillier.(P2 will generate the public and private key and publish the public ...
0
votes
0answers
31 views

Privacy by Simulation with Simulation-based Proof

In the semi-honest model for 2PC, why can we say that "if parties' views can be simulatable given the parties' inputs and outputs, then this implies that the parties learn nothing from the protocol ...
0
votes
2answers
54 views

Why this malicious behavior of corrupted sender isn't considered in malicious-secure OT?

I have read some oblivious transfer protocols, and I am confused about why they do not mention the malicious behavior that the corrupted sender may encrypt the wrong message $x_0'$ and $x_1'$ so that ...
2
votes
0answers
69 views

Multi-party computation with only 1 party?

MPC is $f(E_1(a), E_2(b)) = c$, where $E$ is encryption by different keys $k_1$ and $k_2$. Homomorphic encryption is $f(E_1(a)) = E_1(c)$, where the input and output are encrypted. I want $f(E_1(a)) ...
3
votes
2answers
242 views

Concept Question for Secure Computation

I think this should be a simple question and I might be missing something fairly fundamental, but I haven't been able to find the answer. Basically, suppose there are parties $A$ and $B$. Party $A$ ...
2
votes
1answer
59 views

Security of secure two-party computation with a trusted dealer during offline phase?

In the SecureML paper, one can assume that two non-colluding servers can run secure two-party computation protocol based on secret sharing with the help of a third party (client). The client would ...
1
vote
1answer
64 views

Do garbled circuits run in constant time?

It seems like garbled circuits should not be input dependent, and hence should always run in constant time. Just wanted to clarify if this is true.
2
votes
0answers
64 views

Are there secure MPC schemes that support uneven load balancing between the parties?

In a scenario of which some of the parties have more data / compute power / trust reputation etc. than other parties - are there known methods to do secure multiparty computation with load balancing ...
2
votes
1answer
113 views

How many parties are needed to compute multiplication with BGW?

Let's say we have 3 parties and each one of them has a different secret number. Every party wants to learn the product of all the 3 numbers without learning about the other inputs. With the BGW ...
1
vote
0answers
52 views

Why is 2PC not used as any other primitive like DH? [closed]

Why is 2PC (2-Party Computation) not used as any other primitive like Diffie-Hellman? I'm not talking about the general secure computing, but some weaker security requirement or special case schemes. ...
1
vote
1answer
94 views

Information Theoretic Oblivious Transfer?

Do we have information theoretic oblivious transfer protocols that are that can not be broken by a computationally unbounded attacker?
1
vote
1answer
65 views

Where was the stand-alone model for simulation-based MPC proposed first?

The stand-alone model and the UC model for simulation-based proofs in multiparty computation differ in the guarantees that they provide: The stand-alone model provides security under sequential ...
3
votes
0answers
99 views

Literature question on secure multiparty computation

Consider $N$ players and assume that a private channel between each pair of players is available. Player $i \in \{ 1, \ldots,N\}$ holds a secret $S_i$, which is a sequence of $B$ random bits. The ...
2
votes
1answer
69 views

half-gates in garble circuit

Recently I've been reading papers about MPC protocol, but when I read the paper by Zahur, S., M. Rosulek, and D. Evans. 2015 Two Halves Make a Whole- Reducing Data Transfer in Garbled Circuits Using ...
0
votes
0answers
29 views

A secure multi-party computation problem

The problem is expressed as follows: User $u_1$ owns $a_1$, user $u_2$ owns $a_2$, $\cdots$, user $u_n$ owns $a_n$, and Alice owns a vector $\vec b = \{b_1,b_2,\cdots,b_n\}$. Then, Alice want to ...
0
votes
0answers
29 views

How to create a generator for a $Q_3$ access structure?

I'm reading about access structures used for multiparty-computation from https://eprint.iacr.org/2004/245 and https://eprint.iacr.org/2000/037. My understand is that to actually use the access ...
1
vote
0answers
63 views

How Multi-party Computation works [closed]

I'm new to MPC. I was reading about it when I found an example that seemed to be trivial about how it works. In the picture below, the way X1 sends its data to X2 is by generating a huge random ...
2
votes
1answer
66 views

Difference between MPC and outsourced computation

I am reading an introductory paper on multi-party computation (MPC), and it makes a distinction between outsourced computation and MPC. In an outsourced computation, one party owns the data and ...
1
vote
1answer
91 views

What does non-collusion assumption mean in server-aided protocol based on secret sharing?

Suppose $m$ clients split their own input into $n$ shares using additive secret sharing scheme (mod something). Then, each of the clients sends each share to each of $n$ external servers. After ...
0
votes
0answers
39 views

Yao's millionaires problem - solution complexity

In his 82 paper, Yao gave two theorems regarding the maximum number of bits transmitted between Alice and Bob in order to privately compute a function $f$ on two private $n$-bit inputs $i$ and $j$. ...
0
votes
1answer
37 views

Order of OTs and commitments in Yao's Protocol for malicious adversaries

I was reading the book Efficient Secure Two-Party Protocols by Y. Lindell and C. Hazay. Page 92 of the book says This check is crucial and thus the order of first running the oblivious transfer and ...
0
votes
1answer
31 views

Constant number of rounds in Yao's Protocol for semi honest adversaries

According to me, every OT takes a constant number of rounds and since we have to do an OT for every input of one party, we'll have to do O(n) OTs which would correspond to O(n) rounds. But I have read ...
2
votes
1answer
124 views

Why BGW Multiplication Gate Works?

I am reading Pragmatic MPC (link) about the BGW protocol. I also cross-reference here (click on lecture link for slides) *The BGW Construction for the Information Theoretic Setting – Benny Pinkas I do ...
3
votes
1answer
129 views

Multiparty millionaire problem where members only know if they are the richest one

I'm looking for a generalisation of Yao's millionaire problem: $N$ parties want to know whether they are the richest one. If they are not, then they just know they are not the richest party - but do ...
7
votes
1answer
125 views

Limitations of boolean and arithmetic circuits

Much of modern cryptography is based around working with boolean or arithmetic circuits. For example in Multi-Party Computation the 'famous' results allow for the secure computation of any function ...
1
vote
1answer
58 views

Securely computing functions over source code

I have been studying multi-party computation and want to start implementing it. I think it would be interesting to do this where one of the inputs (say party 1) is some source code, say a .py file. ...
0
votes
0answers
24 views

Secure Computation with TTP using Ring-LWE Homomorphic Encryption

I was working with secure outsourced computation for multi-party computation in which security is assured by ring-LWE based asymmetric homomorphic encryption in the semi-honest model. Is it feasible ...
1
vote
1answer
68 views

How can one prove correctness of shared secrets in secret sharing schemes?

Assume we are in a centralized secret sharing setting, where one party generates the shares, and distributes them to other parties. How can the distributor who creates the shares prove to the parties ...
0
votes
0answers
28 views

Commitment HIDING ⇒ Real≈Ideal in Multiple Coin Tossing Security

I'm reading /Multiple_Coin_Tossing_Security/P2_Corrupted/ ("Information Security and Cryptography" Theorem 6.7.4 starting from page 325) and after description of Simulator for P2, the author continues ...

1
2 3 4 5
7