Malicious Adversaries

Carmit Hazay, Kobbi Nissim B

Carmit Hazay, Kobbi Nissim B

Carmit Hazay, Yehuda Lindell

Shogo Ochiai, Keiichi Iwamura

In general, the (k, n) threshold secret sharing scheme (SSS) does not allow unconditionally secure multiparty computation (MPC) for n <; 2k - 1 . Therefore, Iwamura research team has been focusing on conditions under which the secure MPC can be performed securely for n <; 2k - 1, and found that their secure MPC protocol for n <; 2k - 1 is allowed under these three conditions against semi-honest adversaries: (1) the secret information does not contain 0 in the secure multiplication; (2) there is a set of distributed values for 1 using random numbers unknown to the adversaries; (3) the position of the values in the set of distributed values handled by each server is fixed during the sequence of computation. However, their protocol is not secure against malicious adversaries while SPDZ, which is representative secure MPC protocol, is secure against malicious adversaries. Therefore, we propose a secure MPC protocol against malicious adversaries based on the protocol of Iwamura research team.

Carmit Hazay, Yehuda Lindell

In secure computation, a set of parties wish to jointly compute some function of their private inputs while preserving security properties like privacy, correctness and more. The two main adversary models that have been considered are semi-honest adversaries who follow the prescribed protocol but try to glean more information than allowed from the protocol transcript, and malicious adversaries who can run any efficient strategy in order to carry out their attack. As such they can deviate at will from the prescribed protocol. One would naturally expect that any protocol that is secure in the presence of malicious adversaries will automatically be secure in the presence of semi-honest adversaries. However, due to a technicality in the definition, this is not necessarily true. In this brief note, we explain why this is the case, and show that a slight modification to the definition of semi-honest adversaries (specifically, allowing a semi-honest adversary to change its received input) suffices for fixing this anomaly. Our aim in publishing this note is to make this curious fact more known to the wider cryptographic community. 1 Malicious Versus Semi-honest Adversaries

Carmit Hazay, Yehuda Lindell