# Tag Info

Accepted

### Why can't the commitment schemes have both information theoretic hiding and binding properties?

It's impossible. In order to be perfectly hiding, it must be the case that two different messages can produce the same commitment string. But then that commitment can be opened in two ways (by an ...
• 5,843
Accepted

### Constructing Garbled Circuits

In order to answer this, you need to be sure to understand how garbled circuits actually work. I'll try to explain this from top to bottom: The protocol Let Alice and Bob be willing to compute ...
• 7,709
Accepted

### Salary Negotiation Problem

Solutions to Yao's Millionaire's Problem should suffice for this computation. In that setup, there are two parties each with an input. The output reveals whose input is larger, and nothing else. So ...
• 38.7k

### What are the ways to generate Beaver triples for multiplication gate?

Nowadays, the most standard method is to use oblivious transfers. Oblivious transfer involve a sender with two messages $(m_0,m_1)$ and a receiver with a selection bit $b$. At the end of the protocol, ...
• 20.2k

### Why can't the commitment schemes have both information theoretic hiding and binding properties?

To be a little more formal, consider the notation provided by Iftach, where $S$ denotes the commitment sender and $R$ denotes the receiver. Assume a commitment scheme $(S,R)$ is statistically hiding. ...

### Why can't the commitment schemes have both information theoretic hiding and binding properties?

Another way to look at it informally is this; If it is perfectly hiding, then you cannot tell what made the final value. It could equally be any combination. If it is perfectly binding, then there ...
• 1,343
Accepted

### The main differences between Sketch of Proof and Full proof

The answer to this question is not straightforward and has a lot to do with the "conference culture" of computer science. Unlike other fields, the main publication venues for CS are conferences and ...
Accepted

### Why is Shamir Secret Sharing not secure against active adversaries out-of-the-box?

Here is an active attack on the privacy of out-of-the-box SSS. For this attack, we'll assume that the attacker (without a valid share) is allowed to participate (with $T-1$ friends with honest key ...
• 148k
Accepted

### Beavers Triple Vs BGW Multiplication on MPC

Yes, preprocessing Beaver triples in an offline phase leads to a faster online phase. The online phase of an AND gate requires just two openings plus local computations. But there are other ...
• 13.5k
Accepted

• 1,779
Accepted

### Extractability for Simulator in Malicious Model

Let me try. First, one thing needs to be clear: simulation and real execution are two different things. The simulator can learn something does not mean a verifier in real execution can learn the same ...
• 4,188
Accepted

### SPDZ protocol: how expensive is it to generate the multiplicative triples?

The answer to your question can be found in a SPDZ follow up paper; it is described as contribution (2) in the intro (top of page 2). There is a new version of SPDZ called MASCOT that uses OT instead ...
Accepted

### Homomorphic $\bmod p$ operation

Is there any protocol, that given $E(m)$ can compute homomorphic $E(m \bmod p)?$ If there were a way to perform that operation (for any $p>1$ relatively prime to $N$) without the Pallier private ...
• 148k
Accepted

### Is security against semi honest adversary inheritable?

In general, no, you cannot do that. That is why frameworks like universal composability exist. In the UC framework, you prove a protocol, $\pi_1$ is secure according to some adversary model. You do ...
• 38.7k