Search Results

The multiplication is indeed correct without adding the randomness, but it is no longer private (i.e., it leaks information). By adding the correlated randomness, it ensures that what any single party …

The answer to your question can be found in a SPDZ follow up paper; it is described as contribution (2) in the intro (top of page 2). There is a new version of SPDZ called MASCOT that uses OT instead …

Take a look at the BGW paper here: http://eprint.iacr.org/2011/136.pdf. In order to compute a multiplication (Section 4.3.1), there is one call to Frand and one call to Fdeg-reduce. For Frand (Sectio …

One way of doing this is to subtract the non-secret value from the secret value (in the secure computation) and to test that the result is 0. There are a number of ways of testing 0; generically, you …

The protocol that you described computes the XOR function $a\oplus b$ in the presence of semi-honest adversaries. However, this function completely reveals the other party's input given your own input …

For log-depth circuits, it is possible to use an information-theoretic version of Yao's garbled circuits. Note that in a garbled gate, each key is used to encrypt twice. Thus, if the keys on the input …

Boolean circuits are Turing complete and so the answer is yes for any computation. Specifically, for this case, the circuit will assume that the loop never exits early (and if it finishes early, then …

The BGW protocol has a semi-honest and a malicious version. For semi-honest, a simple honest majority is enough. In that case, 3 parties can run the protocol, with security against one (semi-honest) c …

You can easily embed a Boolean circuit into the field $GF[2^k]$ for any $k$. Once you have done this embedding, you can then run any perfectly secure protocol. However, note that perfect security requ …

By definition, VSS implies broadcast. As such, with $t\geq n/3$, it is not possible to achieve VSS (by the bounds on Byzantine Agreement).

There is a model, typically called proactive security (and sometimes also called a mobile adversary), that considers the case that parties can be corrupted and later uncorrupted. Time is divided into …

I don't see why it shouldn't work. If you ran the multiplication protocol using the same polynomial for both inputs, doesn't that work? Each party would square its share and then run degree reduction. …

As the previous answer says, they are certainly NOT the same. However, there is certainly a connection between them. Specifically, the covert model just says that there is a deterrent parameter $\epsi …

Secure multiparty computation guarantees the nothing whatsoever is revealed by the process of computation. It does not say anything about the function. As you correctly point out, there are some funct …

Detection of malicious behavior can happen anywhere. However, it is not true that you can run semi-honest protocols and then check later. This is because such protocols can reveal the honest party's i …