Questions tagged [multiparty-computation]
Multi-party computation (MPC) allows a set of parties, each with a private input, to securely and jointly perform any computation over their inputs.
564 questions
3
votes
1
answer
145
views
Security in the standalone and simplified UC model
I am learning about simulation based proofs, specifically the tutorial by Lindell and the simplified UC paper by Canetti et al, and I am trying to understand the precise requirements needed for ...
- 33
3
votes
1
answer
70
views
Is Correlated OT from KOS15/SoftSpokenOT maliciously secure?
I am implementing correlated oblivious transfer extension (COTe) based on Fig. 10 of updated KOS15 paper (by skipping last two steps which de-correlates sender's and receiver's output) which states it'...
- 31
1
vote
0
answers
45
views
How to choose the statistical security parameter for MPC protocols
Let's consider linear secret sharing based MPC over a prime field $p$.
While $\kappa=40$ is often cited as a common default value for the statistical security parameter of MPC protocols, my ...
- 3,017
2
votes
0
answers
51
views
Why ABY3 achieves 4k communications in semi-honest setting and 11k communications in malicious setting？
I read the ABY3 paper. First of all, I noticed that the labels for "malicious" and "semi-honest" are swapped Table 2.
Additionally, I don’t understand why ABY3 achieves 4k ...
- 61
5
votes
1
answer
167
views
A lifestyle-based example of simulation-based security
The intuition behind simulation-based security proofs comes from the following idea — if any party participating in a protocol or system can fully simulate the entire interaction process without ...
- 331
0
votes
0
answers
64
views
Clarify whether a Beaver Triple is essentially a form of Functional Secret Sharing (FSS)?
Could you please clarify whether a Beaver Triple is essentially a form of Functional Secret Sharing (FSS)?
I feel that a Beaver Triple might be the key for the share of the multiplication function. If ...
- 331
1
vote
1
answer
96
views
2D variant of packed Shamir secret sharing
Is there any existing work on a 2D variant of a packed Shamir secret shares (see paper here), i.e., the secret shares pack values using a bivariate polynomial (to pack a matrix instead of a vector)?
- 321
2
votes
1
answer
103
views
Black Box vs Non-Black Box
I find it confusing when the papers in MPC say we use the underlying protocol in the black box way or if they say we rely on the protocol in the non-black box manner. How do I myself identify if it is ...
- 769
1
vote
0
answers
44
views
Round Collapsing vs without Round Collapsing
In MPC, I have seen papers stating 2 round MPC without round collapsing. What is the difference between round collapsing compiler and without round collapsing compiler?
- 769
0
votes
0
answers
57
views
How to find secure median and mode of two lists of numbers between 2 parties?
I am looking for a way to find median and mode securely between two parties having list of numbers. I am eager to know if I can find the median using only secure addition and secure multiplication (...
- 1
1
vote
1
answer
166
views
Compiler or tool that takes a high-level description and outputs arithmetic circuits
I’ve implemented a 2-party computation (2PC) engine myself and I don’t want to reimplement a front-end/circuit generator. I’m looking for a compiler or tool that takes a high-level description (or an ...
- 11
1
vote
0
answers
78
views
Post-quantum MPC
Do we need now to think about post-quantum MPC protocols? If I understand correctly, now there are a lot of information theoretically secure schemes, however, they have some limitations. On the other ...
- 11
1
vote
0
answers
49
views
MAC Tag in SPDZ2k - RSS-based Matrix Multiplication
Suppose that we are performing a matrix multiplication $A \times A$ ($\in \mathbb{R}^{m \times n}$) using Replicated Secret Sharing (RSS); how should we define the MAC Tag for this multiplication, ...
- 53
1
vote
1
answer
104
views
MPC in General vs Client-Server setting
MPC in general considers $n$ distrusting parties, each having their respective inputs and they collaboratively compute function $f$ on their inputs preserving privacy of parties input and correctness ...
- 769
0
votes
0
answers
60
views
ADKG-based threshold ECDSA signature recovers different address per transaction—how to compute aggregate `r` and signature parameters?
Background
I’m implementing Asynchronous Distributed Key Generation (ADKG) over secp256k1 so that N nodes collectively hold a threshold private key. After DKG each node has a secret share. To sign an ...
- 101