Archivecryptography
Secure Multi-Party Computation Without the Hype
Multiple parties compute a joint function without revealing inputs. The costs are rounds and bandwidth.
- Published
- Reading time
- 1 min read
MPC lets parties compute f(x1, ..., xn) while keeping each xi private. It is used for private set intersection, joint fraud signals, and threshold key management.
The main techniques
- Secret sharing (Shamir/GMW): inputs split into shares; computation on shares; reconstruction at the end. Cheap for addition, more rounds for multiplication.
- Garbled circuits: one party garbles a circuit, another evaluates it obliviously. Good for two-party boolean functions.
- Oblivious transfer: the primitive that lets one party select data without revealing the choice.
The honest costs
- Communication grows with circuit size and parties.
- Malicious security (parties may cheat) costs significantly more than semi-honest.
- Output privacy is not automatic: the result itself may leak inputs.
Takeaway: MPC is viable for narrow, high-value computations with a clear trust model. Design the function and leakage first; protocol choice follows.