MPC vs. SFE: Perfect Security in a Unified Corruption Model

Abstract

Abstract. Secure function evaluation (SFE) allows a set of players to compute an arbitrary agreed function of their private inputs, even if an adversary may corrupt some of the players. Secure multi-party computation (MPC) is a generalization allowing to perform an arbitrary on-going (also called reactive or stateful) computation during which players can receive outputs and provide new inputs at intermediate stages.At Crypto 2006, Ishai et al. considered mixed threshold adversaries that either passively corrupt some fixed number of players, or, alternatively, actively corrupt some (smaller) fixed number of players, and showed that for certain thresholds, cryptographic SFE is possible, whereas cryptographic MPC is not. However, this separation does not occur when one considers perfect security. Actually, past work suggests that no such separation exists, as all known general protocols for perfectly secure SFE can also be used for MPC. Also, such a separation does not show up with general adversaries, characterized by a collection of corruptible subsets of the players, when considering passive and active corruption. In this paper, we study the most general corruption model where the adversary is characterized by a collection of adversary classes, each specifying the subset of players that can be actively, passively, or fail-corrupted, respectively, and show that in this model, perfectly secure MPC separates from perfectly secure SFE. Furthermore, we derive the exact conditions on the adversary structure for the existence of perfectly secure SFE resp. MPC, and provide efficient protocols for both cases.

Player-Centric Byzantine Agreement

“…This is the most natural way of defining PCBA in the mixed active/passive model and it is consistent with the past literature on secure distributed computation tolerating a mixed adversary, e.g. [14,22,24,5,23], as well as the literature tolerating passive corruption only (semihonest model), e.g., [30,19,7].…”

“…The high-level idea is the following: first, in a distribution phase, the sender p sends his input and his signature on it to every player; in a second phase, all the players run a protocol to establish a consistent view on the sender's value. Although this sounds similar to the standard approach for constructing a Broadcast protocol [8,1] (i.e., first have p multi-send his input and then invoke Consensus), our second phase cannot be realized by a Consensus protocol as the condition C (5) PCBA (P, Z, {p}) is weaker than C c/s PCBA (P, Z, P) which is necessary for Consensus. Nevertheless, to realize the second phase we use an approach which is inspired by the methodology of [8] for achieving Consensus.…”

“…This trick makes sure that, when no player receives a signature from p then every p i sets α i := 1 and hence any value is acceptable as p's signature on any bit. As syntactic sugar we say that some value σ is a (p, p i )-acceptable signature on x if p i ∈ P accepts σ as p's signature on x (i.e, σ is valid or α i = 1); for a player set C we say that σ is a (p, C)-acceptable signature on x if for every p i ∈ C the value σ is a (p, p i )-acceptable signature on x 5 .…”

“…However, these works consider the model without a setup and their impossibility results are only for Consensus. We point out that, in that model, adding passive corruption makes no difference for Consensus [5]. Feasibility of BA with active and passive corruption (and a trusted PKI) was previously studied in [21] for Consensus, and in [20] for Consensus and Broadcast.…”

A Zero-One Law for Secure Multi-party Computation with Ternary Outputs

“…In this paper, we will only consider threshold adversaries. More general adversarial models have also been studied, both in terms of a more general specification of the parties the adversary can corrupt by Hirt and Maurer [10] and considering a mix active and passive adversarial corruptions by Beerliová-Trubíniová et al [2].…”