The classical results in unconditional multi-party computation among a set of n players state that less than n/2 passive or Iess than n/3 active adversaries can be tolerated; assuming a broadcast channel the threshold for active adversaries is ta/2.Strictly generalizing these results we specify the set of potential y misbehaving players as an arbitrary set of subsets of the player set.We prove the necessary and sufficient conditions for the existence of secure multi-party protocols in terms of the potentially misbehaving player sets.For every function there exists a protocol secure against a set of potential passive collusions if and only if no two of these collusions add up to the full player set.The same condition applies for active adversaries when assuming a broadcast chzmnel.Without broadcast channels, for every function there exists a protocol secure against a set of potential active adverse player sets if and only if no three of these sets add up to the full player set.The complexities of the protocols not using a broadcast channel are polynomial, that of the protocol with broadcast is only slightly higher.
The classical results in unconditional multi-party computation among a set of n players state that less than n/2 passive or Iess than n/3 active adversaries can be tolerated; assuming a broadcast channel the threshold for active adversaries is ta/2.Strictly generalizing these results we specify the set of potential y misbehaving players as an arbitrary set of subsets of the player set.We prove the necessary and sufficient conditions for the existence of secure multi-party protocols in terms of the potentially misbehaving player sets.For every function there exists a protocol secure against a set of potential passive collusions if and only if no two of these collusions add up to the full player set.The same condition applies for active adversaries when assuming a broadcast chzmnel.Without broadcast channels, for every function there exists a protocol secure against a set of potential active adverse player sets if and only if no three of these sets add up to the full player set.The complexities of the protocols not using a broadcast channel are polynomial, that of the protocol with broadcast is only slightly higher.
. This paper improves on the classical results in unconditionally secure multi-party computation among a set of n players, by considering a model with three simultaneously occurring types of player corruption: the adversary can actively corrupt (i.e. take full control over) up to ta players and, additionally, can passively corrupt (i.e. read the entire information of) up to tp players and fail-corrupt (i.e. stop the computation of) up to tf other players. The classical results in multi-party computation are for the special cases of only passive (ta = tf = 0) or only active (tp = tf = 0) corruption. In the passive case, every function can be computed securely if and only if tp ! n=2. In the active case, every function can be computed securely if and only if ta ! n=3; when a broadcast channel is available, then this bound is ta ! n=2. These bounds are tight. Strictly improving these results, one of our results states that, in addition to tolerating ta ! n=3 actively corrupted players, pr...
This paper improves on the classical results in uncondition- ally secure multi-party computation among a set of n players, by consid- ering a model with three simultaneously occurring types of player cor- ruption: the adversary can actively corrupt (i.e. take full control over) up to ta players and, additionally, can passively corrupt (i.e. read the entire information of) up to tp players and fail-corrupt (i.e. stop the compu- tation of) up to tf other players. The classical results in multi-party computation are for the special cases of only passive (ta = tf =0 ) or only active (tp = tf = 0) corruption. In the passive case, every function can be computed securely if and only if tp <n = 2. In the active case, every function can be computed securely if and only if ta <n =3; when a broadcast channel is available, then this bound is ta <n =2. These bounds are tight. Strictly improving these results, one of our results states that, in addi- tion to tolerating ta <n =3 actively corrupted players, privacy can be guaranteed against every minority, thus tolerating additional tp n=6 passively corrupted players. These protocols require no broadcast and have an exponentially small failure probability. We further show that the bound t<n =2 for passive corruption holds even if the adversary is additionally allowed to make the passively corrupted players fail. Moreover, we characterize completely the achievable thresholds ta, tp and tf for four scenarios. Zero failure probability is achievable if and only if 3ta +2 tp + tf <n ; this holds whether or not a broadcast chan- nel is available. Exponentially small failure probability with a broadcast channel is achievable if and only if 2ta +2 tp +tf <n ; without broadcast, the additional condition 3ta + tf <n is necessary and sucient. In this corrected version, an error pointed out by Damg ard (Dam99) is corrected.
Two types of generalizations in secure multi-party computation are described. First, we report on a new general adversary model: while previous protocols were designed to tolerate misbehavior of one of two types (active or passive adversaries) the new protocols tolerate mixed types of adversaries, i.e. an adversary that can corrupt players actively, passively, or can let them crash (i.e. stop execution). We derive the necessary and sufficient conditions under which such a general adversary can be tolerated. Second, we present a generic protocol framework that unifies previous approaches achieving unconditional (or information-theoretic) security and cryptographic security (i.e. security based on a cryptographic intractability assumption). This is achieved by introducing secret sharing schemes with an additional property called the multiplication property and a new type of homomorphic commitment scheme, and by generalizing the concept of commitments.
Broadcast is a primitive which allows a specific party to distribute a message consistently among n parties, even if up to t parties exhibit malicious behaviour. In the classical model with a complete network of bilateral authenticated channels, the seminal result of Pease et al. [Pease et al., 1980] shows that broadcast is achievable if and only if t < n/3. There are two generalizations suggested for the broadcast problem - with respect to the adversarial model and the communication model. Fitzi and Maurer [Fitzi and Maurer, 1998] consider a (non-threshold) general adversary that is characterized by the subsets of parties that could be corrupted, and show that broadcast can be realized from bilateral channels if and only if the union of no three possible corrupted sets equals the entire set of n parties. On the other hand, Considine et al. [Considine et al., 2005] extend the standard model of bilateral channels with the existence of b-minicast channels that allow to locally broadcast among any subset of b parties; the authors show that in this enhanced model of communication, secure broadcast tolerating up to t corrupted parties is possible if and only if t < (b-1)/(b+1)n. These generalizations are unified in the work by Raykov [Raykov P., 2015], where a tight condition on the possible corrupted sets is presented such that broadcast is achievable from a complete set of b-minicasts. This paper investigates the achievability of broadcast in general networks, i.e., networks where only some subsets of minicast channels may be available, thereby addressing open problems posed in [Jaffe et al., 2012; Raykov P., 2015]. To that end, we propose a hierarchy over all possible general adversaries, and identify for each class of general adversaries 1) a set of minicast channels that are necessary to achieve broadcast and 2) a set of minicast channels that are sufficient to achieve broadcast. In particular, this allows us to derive bounds on the amount of b-minicasts that are necessary and that suffice towards constructing broadcast in general b-minicast networks.
Broadcast is a primitive which allows a specific party to distribute a message consistently among n parties, even if up to t parties exhibit malicious behaviour.In the classical model with a complete network of bilateral authenticated channels, the seminal result of [15] shows that broadcast is achievable if and only if t < n/3.There are two generalizations suggested for the broadcast problem -with respect to the adversarial model and the communication model.Fitzi and Maurer [10] consider a (non-threshold) general adversary that is characterized by the subsets of parties that could be corrupted, and show that broadcast can be realized from bilateral channels if and only if the union of no three possible corrupted sets equals the entire set of n parties.On the other hand, [4] extends the standard model of bilateral channels with the existence of b-minicast channels that allow to locally broadcast among any subset of b parties; the authors show that in this enhanced model of communication, secure broadcast tolerating up to t corrupted parties is possible if and only if t < b-1 b+1 n.These generalizations are unified in [14] where Raykov studies the problem of achieving broadcast from a complete set of b-minicast channels that is secure under general adversaries, and gives a tight characterization of the possible corrupted subsets of parties against which broadcast is (im)possible.This thesis initiates the study of achievability of broadcast in scenarios where only some subset of b-minicast channels are available, thereby addressing an open problem posed by [14].Even though the broadcast problem has been studied for the concrete case of incomplete 3minicast networks in [16] and [12], not much work has been done with respect to general b-minicast models.Our major contribution is the identification of types of minicast channels that are essential for broadcast secure against general adversaries.In particular, this allows us to derive a bound on the amount of b-minicasts required for some party to broadcast.Inspired by the result of [14], the thesis also proves some properties for an interesting class of adversaries, named chain adversaries, that are relevant to the problem at hand, and proposes a hierarchy over all possible general adversaries targeting a set of n parties.We conclude the discussion by showing why a prominent method to construct broadcast protocols -used by [16] for 3-minicast models -is not feasible when it comes to incomplete b-minicast models.
Abstract. Secure multi-party computation (MPC) allows a set P of n players to evaluate a function f in presence of an adversary who corrupts a subset of the players. In this paper we consider active, general adversaries, characterized by a so-called adversary structure Z which enumerates all possible subsets of corrupted players. In particular for small sets of players general adversaries better capture real-world requirements than classical threshold adversaries. Protocols for general adversaries are “efficient ” in the sense that they require |Z | O(1) bits of communication. However, as |Z | is usually very large (even exponential in n), the exact exponent is very relevant. In the setting with perfect security, the most efficient protocol known to date communicates O(|Z | 3) bits; we present a protocol for this setting which communicates O(|Z | 2) bits. In the setting with statistical security, O(|Z | 3) bits of communication is needed in general (whereas for a very restricted subclass of adversary structures, a protocol with communication O(|Z | 2) bits is known); we present a protocol for this setting (without limitations) which communicates O(|Z | 1) bits.