# Tag Info

GMW protocol says that A and B can locally compute $c_i = a_i \oplus b_i$ and the result should be same for both. I highlighted the part that is incorrect. They started with secret shares of $a=0$ and secret shares of $b=1$. Now they have secret shares of the XOR $c= a \oplus b =1$. Only if the secret value $c$ is zero will their shares be the same (and ...