There have been some new results, Professor. For FSS, SIGMA requires 1 eval of DPF for G^{out}={0,1},while the improved one in your answer requires 1 eval of DCF for larger output domain. For the second category, CrypTFlow2 uses a GSV07 style tree structure (KKOT for equa & comp in leaves, OT for bit comp in nodes) and requires logl rounds and comm slightly larger than λl. More recent work like this paper generates ROT with silent OT for better comm.

@GeoffreyCouteau So in 2pc setting, we have to use computational assumption to do secure computation. Then, for example, if I want to use a boolean circuit for multiplication, when computing AND gate, I use beaver triples. two situations: 1. 2 computing parties can use HE or OT to generate the triples, is HE and OT here the computational assumption we refer to? 2. We can also use trusted dealers to generate these triples, what's the difference between situation 1/2? If we use trusted dealers pre generate triples and send the shares to 2 parties, the online phase is very efficient I think

I think I get it this time, thanks for your explaination.

Great thanks to you again! Really didn't think about the malicious situation at all.

@GeoffroyCouteau Wow! Really glad to get a reply from you directly. I can't follow from here: SS is information theoretic secure. Can I take this as : SS has stronger security guarantee? If I did't get it wrong here, SS is also very fast for secure comparison (quite a lot recent works on privacy-preserving machine learning use this kind of SS based building blocks instead of HE/GC, and the speed is very good I think), then SS based comparison protocols should have been competitive to those HE/GC/OT based methods right (good performance, better security)? Or did I get something wrong somewhere?

Thanks for your answer. But I still have a question, what's the meaning of this different representation? Even we can represent a computation in a simpler way, when doing those computation in reality, we still have to use those boolean circuits to transform the corresponding operation right? If so, why we can get efficiency improvement?

@j.p. I'm sorry, I did't get what you mean. First, is field of 2^n a high level representation of boolean circuit or considered as an arithmetic circuit? I think AES is usually implemented in boolean circuit right? Second, my question is really about practical representation, so do we still have to represent those arithmetic circuits into real boolean gates for computation in reality? If so, why we can get those efficiency improvement?

@HilderVitorLimaPereira In fact I really don't know and that's why I ask the question here. I read some papers recently and get the conclusion that constructing such a scheme with EC is definitely not easy, someone has to dive into the mathmatical background of EC. I can't grab the key problem and that's why I ask for some help or direction. Thanks for your reply.

@j.p. I understand that point adding is the rule of the elliptic curve group, and we can not multiple points directly cause it seems meaningless. However, that's not the only way, in BGN scheme, multiplication can be done by pairing, but only once. So I think the problem is that we just have not found THE right solution yet.