15 votes

Representing a function as FHE circuit

The circuit term in the evaluation of functions with FHE is a coming from Electronics. In the notion of FHE circuit, we have almost the same problem; build a circuit of a function $f$ with available ...
kelalaka's user avatar
  • 48.5k
7 votes

SPDZ for the 2-party case

Your understanding is correct. The SPDZ protocol can be used for any number of two or more parties. In fact, this is one of the strengths of the SPDZ protocol. Namely, many recent secure computation ...
Guut Boy's user avatar
  • 2,877
7 votes

SHA-3 Sub-Function Reversibility Clarification

Hash functions are generally designed by splitting the problem into two parts: A fixed size core function. This is called the compression function in most hashes, but in Keccak it's called the ...
Luis Casillas's user avatar
6 votes

Can big numbers multiplication be a valid form of encryption?

Given a vector $[S_0 S_1 x_1, S_0 S_1 x_2, ...]$, it is quite easy to recover $S_0 S_1$ (by computing the GCD of the various elements). With that information, the attacker can then recover the values ...
poncho's user avatar
  • 147k
5 votes

SPDZ for the 2-party case

my understanding I could use it to do 2-party computation You are correct, SPDZ can give secure MPC for any number of parties. It is just a matter of generating enough multiplication triples. ...
Mikero's user avatar
  • 13.2k
3 votes

Looking for a formula for "Given $x_1$, $\ldots$, $x_{n-1}$, the output $F(x_1,\ldots,x_n)$ is dependent of $x_n$ and is of $l$-bits security"

To be well defined as a function, you need to specify lengths of the $x_i$, which is not the same thing as their entropy. Also, the $H(h_i)$ in your equation should probably be $H(x_i).$ Let's assume ...
kodlu's user avatar
  • 22.5k
3 votes

Earliest citation for truth density

The truth density $p$ is arguably the same concept as the bulge to 0 $b$ of a Boolean function as $b=1-2p\iff p=(1-b)/2$. The bulge leads to cleaner formulae in many cases though. The language of ...
Daniel S's user avatar
  • 23.8k
2 votes

Difference between function $f$ in eval and dec of homomorphic authenticated encryption

The key-word "authenticated" mean that Dec is has not just a decrypting functionality. It should also check the validity of the computation made. that's why it takes as input the function $f$. Read ...
Ievgeni's user avatar
  • 2,595
2 votes

How can Garbled Circuits be utilized to reduce the round complexity of GMW?

First question: at the end of GMW, the parties can reconstruct the outputs by broadcasting their shares to everyone. Second question: a garbled circuit cannot be evaluated on plain inputs, we need to ...
Geoffroy Couteau's user avatar
1 vote

What security does the BMR protocol offer against corruption?

First of all, the BMR was initially proposed in Rogaway's thesis in [1], whose extended abstract you mention [2]. There, the protocol was proven secure under active adaptive adversaries corrupting and ...
tur11ng's user avatar
  • 962
1 vote

SHA-3 Sub-Function Reversibility Clarification

Let's suppose our algorithm is irreversible. Can we - in that case - guarantee that states will not narrow down into some subdomain? Can we prove the security level provided by digest size or capacity?...
NB_1907's user avatar
  • 640

Only top scored, non community-wiki answers of a minimum length are eligible