Unconditional
SECURE COMPUTATIONPrimitive

Dealer-assisted MPC

In plain words

If someone trustworthy hands out matching "scratch paper" in advance, a group can later compute together securely and very fast, even if most of them cheat.

The idea: Multiplying secret-shared numbers is the expensive part of secure computation. A dealer can do that work in advance: random numbers a and b and their product c = a × b, handed out as shares. Later, to multiply real secrets x and y, the parties only reveal x - a and y - b, which look random because a and b are random, and a little arithmetic on the shares turns c into shares of x × y. All the heavy lifting happened before anyone had inputs.

Why it matters: This is the trick behind today's fastest secure-computation systems.

The details

On the map: Beaver triples / precomputed OT: secure against ANY number of corruptions. Without a dealer it needs OT (see MPC, dishonest majority)

If a trusted dealer hands out correlated randomness ahead of time, such as Beaver multiplication triples[1] or precomputed random oblivious transfers, the parties can later compute anything with information-theoretic security against any number of corrupted parties, using only cheap operations.

Without a dealer, this preprocessing has to be generated with oblivious transfer or homomorphic encryption, which brings back computational assumptions. Modern MPC systems such as SPDZ[2] use exactly this split into an offline phase and a fast online phase.

Rests on

If any of these breaks, this breaks too.

If it falls

If this breaks, these break with it.

Nothing on the map depends on it: it is an end point, something people use directly.

References

  1. Donald Beaver. Efficient Multiparty Protocols Using Circuit Randomization. Advances in Cryptology — CRYPTO ’91, 1991. doi:10.1007/3-540-46766-1_34
  2. Ivan Damgård, Valerio Pastro, Nigel Smart and Sarah Zakarias. Multiparty Computation from Somewhat Homomorphic Encryption. Advances in Cryptology – CRYPTO 2012. doi:10.1007/978-3-642-32009-5_38