L1 - An Intermediate Language for Mixed-Protocol Secure Computation

Secure Multi-Party Computation: Theory, practice and applications

Secure multi-party computation (SMC) is a cryptographic protocol that allows participants to compute the desired output without revealing their inputs. A variety of results related to increasing the efficiency of SMC protocol have been reported, and thus, SMC can be used in various applications. With the SMC protocol in smart grids, it becomes possible to obtain information for load balancing and various statistics, without revealing sensitive user information. To prevent malicious users from tampering with input values, SMC requires cheater detection. Several studies have been conducted on SMC with cheater detection, but none of these has been able to guarantee the fairness of the protocol. In such cases, only a malicious user can obtain a correct output prior to detection. This can be a critical problem if the result of the computation is real-time information of considerable economic value. In this paper, we propose a fair and secure multi-party computation protocol, which detects malicious parties participating in the protocol before computing the final output and prevents them from obtaining it. The security of our protocol is proven in the universal composability framework. Furthermore, we develop an enhanced version of the protocol that is more efficient when computing an average after detecting cheaters. We apply the proposed protocols to a smart grid as an application and analyze their efficiency in terms of computational cost.

Secure multi-party computations for privacy-preserving machine learning

In the specific value computation scenario of blockchain cross-chain data exchange, participants can organize raw data in the form of data pairs, making the computed specific values become key information for cross-chain collaboration. The main challenges faced in this scenario include: the lack of appropriate privacy protection mechanisms leading to easy leakage of sensitive data; the vulnerability of unencrypted or unvalidated data to tampering or malicious attacks; a crisis of trust among users. To address the above problems, this paper introduces secure multi-party computation (MPC) into the cross-chain data exchange process to ensure the fairness of the computation process and protect data privacy. To address the problem of computing the maximum and minimum values of the sums of keyword-corresponding values in cross-chain interactions, it is transformed into the secure computation scheme of computing the maximum and minimum values of the sums of corresponding elements in the intersection of sets (MMSI). A secure computation scheme for maximum and minimum values based on the fully homomorphic NTRU (FH-NTRU) encryption algorithm is proposed. First, a secure computation protocol for MMSI without a universal set under the semi-honest model is proposed. Then, to address potential malicious behaviors in the protocol, a secure computation protocol for MMSI under the malicious model is proposed, using the cut-and-choose method. The protocol under the malicious model is analyzed for correctness and the security of the protocol is proved using the real/ideal model paradigm. Finally, the efficiency analysis and experimental simulations show that the protocol is efficient and reliable, it can resist malicious adversary attacks and ensure the correctness of the computation results while effectively improving the security during cross-chain interactions.Supplementary InformationThe online version contains supplementary material available at 10.1038/s41598-025-14629-1.

Secure multi-party computation (MPC) allows two or more distrusting parties to jointly evaluate a function over private inputs. For a long time considered to be a purely theoretical concept, MPC transitioned into a practical and powerful tool to build privacy-enhancing technologies. However, the practicality of MPC is hindered by the difficulty to implement applications on top of the underlying cryptographic protocols. This is because the manual construction of efficient applications, which need to be represented as Boolean or arithmetic circuits, is a complex, error-prone, and time-consuming task. To facilitate the development of further privacy-enhancing technology, multiple compilers have been proposed that create circuits for MPC. Yet, almost all presented compilers only support domain specific languages or provide very limited optimization methods. In this work (this is an extended and revised version of the paper ‘Secure Two-party Computations in ANSI C’ (Holzer et al., in: ACM CCS, 2012) that reflects the progress in secure computation and describes the current optimization tool chain of CBMC-GC) we describe our compiler CBMC-GC that implements a complete tool chain from ANSI C to circuit. Moreover, we give a comprehensive overview of circuit minimization techniques, which we have identified and adapted for the creation of efficient circuits for MPC. With the help of these techniques, our compilation approach allows for a high level of abstraction from the cryptographic primitives used in MPC protocols, as well as the complex design of digital circuits. By using the model checker CBMC as a compiler frontend, we illustrate the link between MPC, formal methods, and digital logic design. Our experimental results illustrate the effectiveness of the implemented optimizations techniques for various example applications. In particular, compared with other state-of-the-art compilers, we show that CBMC-GC compiles circuits from the same source code that are up to four times smaller.

Secure computation (SC) are cryptographic protocols that enable multiple parties to perform a joint computation while retaining the privacy of their inputs. It is current practice to evaluate the performance of SC protocols using complexity approximations of computation and communication. Due to the disparate complexity measures and constants this approach fails at reliably predicting the performance. We contribute a performance model (PM) for forecasting run-times of secure two-party computations. We show the correctness of our PM by an empirical study on the problem of secure division which is relevant for many real world SCs, e.g., k-means clustering or supply chain optimization. We show that our PM can be used to make an optimal selection of an algorithm and cryptographic protocol combination, as well as to determine the implicit security tradeoffs. The predictions of our PM can be used to design or select more efficient or more secure protocols.

In this paper, we introduce secure groups as a cryptographic scheme representing finite groups together with a range of operations, including the group operation, inversion, random sampling, and encoding/decoding maps. We construct secure groups from oblivious group representations combined with cryptographic protocols, implementing the operations securely. We present both generic and specific constructions, in the latter case specifically for number-theoretic groups commonly used in cryptography. These include Schnorr groups (with quadratic residues as a special case), Weierstrass and Edwards elliptic curve groups, and class groups of imaginary quadratic number fields. For concreteness, we develop our protocols in the setting of secure multiparty computation based on Shamir secret sharing over a finite field, abstracted away by formulating our solutions in terms of an arithmetic black box for secure finite field arithmetic or for secure integer arithmetic. Secure finite field arithmetic suffices for many groups, including Schnorr groups and elliptic curve groups. For class groups, we need secure integer arithmetic to implement Shanks’ classical algorithms for the composition of binary quadratic forms, which we will combine with our adaptation of a particular form reduction algorithm due to Agarwal and Frandsen. As a main result of independent interest, we also present an efficient protocol for the secure computation of the extended greatest common divisor. The protocol is based on Bernstein and Yang’s constant-time 2-adic algorithm, which we adapt to work purely over the integers. This yields a much better approach for multiparty computation but raises a new concern about the growth of the Bézout coefficients. By a careful analysis, we are able to prove that the Bézout coefficients in our protocol will never exceed 3max(a,b) in absolute value for inputs a and b. We have integrated secure groups in the Python package MPyC and have implemented threshold ElGamal and threshold DSA in terms of secure groups. We also mention how our results support verifiable multiparty computation, allowing parties to jointly create a publicly verifiable proof of correctness for the results accompanying the results of a secure computation.

O objetivo do estudo foi avaliar a qualidade de vida (QV) de pacientes pós-transplante renal por meio de protocolo genérico e específico. A avaliação da QV foi realizada por meio de protocolo genérico (Medical Outcomes Study 36-Item Short-Form Health Survey - SF-36) e específico (Kidney Disease Quality of Life Short Form - KDQOL-SF). Foram avaliados 24 pacientes. Escores mais baixos foram obtidos nos domínios situação de trabalho (45,6±36,6), papel físico (63,5±42,3), dor (67,0±26,3), composição física (46,8±8,7) e composição mental (48,9±10,8) no protocolo KDQOL; e na saúde mental (53,3±8,2), dor (63,5±26,8), aspecto físico (63,5±42,3) e capacidade funcional (64,4±22,2) no protocolo SF-36. A QV em geral é boa nos pacientes transplantados renais com prejuízo nos domínios referentes às questões físicas, mentais e relacionadas à dor. O protocolo genérico obteve uma pontuação mais baixa que o protocolo específico. Houve correlação entre o questionário de QV específico e o genérico nos domínios correspondentes.

Secure multiparty computation is a basic concept of growing interest in modern cryptography. It allows a set of mutually distrusting parties to perform a computation on their private information in such a way that as little as possible is revealed about each private input. The early results of multiparty computation have only theoretical signi??cance since they are not able to solve computationally complex functions in a reasonable amount of time. Nowadays, e??ciency of secure multiparty computation is an important topic of cryptographic research. As a case study we apply multiparty computation to solve the problem of secure linear programming. The results enable, for example in the context of the EU-FP7 project SecureSCM, collaborative supply chain management. Collaborative supply chain management is about the optimization of the supply and demand con??guration of a supply chain. In order to optimize the total bene??t of the entire chain, parties should collaborate by pooling their sensitive data. With the focus on e??ciency we design protocols that securely solve any linear program using the simplex algorithm. The simplex algorithm is well studied and there are many variants of the simplex algorithm providing a simple and e??cient solution to solving linear programs in practice. However, the cryptographic layer on top of any variant of the simplex algorithm imposes restrictions and new complexity measures. For example, hiding the number of iterations of the simplex algorithm has the consequence that the secure implementations have a worst case number of iterations. Then, since the simplex algorithm has exponentially many iterations in the worst case, the secure implementations have exponentially many iterations in all cases. To give a basis for understanding the restrictions, we review the basic theory behind the simplex algorithm and we provide a set of cryptographic building blocks used to implement secure protocols evaluating basic variants of the simplex algorithm. We show how to balance between privacy and e??ciency; some protocols reveal data about the internal state of the simplex algorithm, such as the number of iterations, in order to improve the expected running times. For the sake of simplicity and e??ciency, the protocols are based on Shamir's secret sharing scheme. We combine and use the results from the literature on secure random number generation, secure circuit evaluation, secure comparison, and secret indexing to construct e??cient building blocks for secure simplex. The solutions for secure linear programming in this thesis can be split into two categories. On the one hand, some protocols evaluate the classical variants of the simplex algorithm in which numbers are truncated, while the other protocols evaluate the variants of the simplex algorithms in which truncation is avoided. On the other hand, the protocols can be separated by the size of the tableaus. Theoretically there is no clear winner that has both the best security properties and the best performance.

Background/Objectives: Rapid DNA systems accelerate STR profiling but often require the consumption of the entire swab, limiting confirmation testing or downstream analyses. We previously validated a simple subsampling protocol for blood swabs on the RapidHITTM ID, using a rigid subungual mini-swab (Copan Italia S.p.A). A new version of this instrument has recently been released, featuring redesigned software and consumables. The RapidINTELTM Plus sample cartridge now enables two distinct lysis/extraction protocols, expanding analytical possibilities for rich biological traces. We evaluated subsampling performance using the subungual mini-swab and microFLOQ® swabs (Copan Italia S.p.A), and assessed feasibility for both blood and buccal reference swabs. Methods: Whole blood from four donors was deposited onto regular Copan swabs (10 µL) or microFLOQ® swabs (1 µL). A comparison was performed between the direct analysis of blood swabs using a RapidHITTM ID V1 (RapidINTELTM cartridge) and a RapidHITTM ID V2 (RapidINTELTM Plus cartridge, GENERAL protocol). Subsequently, both the GENERAL and SPECIALIZED protocols were tested after subsampling from primary blood or buccal swabs dried for 24 h using either a subungual mini-swab or a microFLOQ®. Results: Blood-swab subsampling on the V2 produced usable STR profiles with both the subungual mini-swab and the microFLOQ®. The subungual mini-swab was compatible with both the GENERAL and SPECIALIZED protocols. For blood applications, microFLOQ® fiber treatment showed no inhibitory effects. Reference buccal swabs were successfully analyzed with the RapidINTELTM Plus cartridge, either directly (regular swab) or via subungual subsampling under both protocols. In contrast, in this feasibility dataset (single analysis per donor per condition), subsampling a reference swab with microFLOQ® did not yield suitable profiles for RapidINTELTM Plus analysis under the tested conditions. Conclusions: This feasibility study indicates that the subsampling strategy can be applied on the RapidHITTM ID V2, particularly using subungual mini-swabs, to retain the primary swab for potential downstream testing while maintaining usable STR profile quality for blood and buccal reference workflows under the tested conditions.

The integration of Internet of Things (IoT) technologies within autonomous vehicles (AVs) is revolutionizing modern transportation by enabling intelligent, connected, and self-operating mobility systems. However, this digital interconnectivity significantly expands the attack surface, exposing vehicular networks to sophisticated cybersecurity threats that could compromise safety, data privacy, and operational integrity. This chapter presents a comprehensive examination of cybersecurity architectures tailored for IoT-enabled autonomous vehicles, with a focus on identifying prevalent attack vectors, including denial-of-service (DoS/DDoS), spoofing, and data injection threats. The discourse extends to secure microcontroller and SoC designs, cryptographic protocols, authentication mechanisms, and privacy-preserving techniques such as homomorphic encryption and secure multiparty computation. Additionally, the chapter explores the role of intrusion detection and prevention systems (IDPS) and collaborative threat intelligence frameworks in fortifying AV ecosystems. Emerging challenges in secure key management, system scalability, and real-time performance are critically analyzed. The chapter concludes with strategic future directions and architectural recommendations to foster resilient, privacy-aware, and sustainable AV cybersecurity infrastructures. This work contributes to advancing secure intelligent mobility within the broader paradigm of smart urban transportation.

We apply multiparty computation (MPC) techniques to show, given a database that is secret-shared among multiple mutually distrustful parties, how the parties may obliviously construct a decision tree based on the secret data. We consider data with continuous attributes (i.e., coming from a large domain), and develop a secure version of a learning algorithm similar to the C4.5 or CART algorithms. Previous MPC-based work only focused on decision tree learning with discrete attributes (De Hoogh et al. 2014). Our starting point is to apply an existing generic MPC protocol to a standard decision tree learning algorithm, which we then optimize in several ways. We exploit the fact that even if we allow the data to have continuous values, which a priori might require fixed or floating point representations, the output of the tree learning algorithm only depends on the relative ordering of the data. By obliviously sorting the data we reduce the number of comparisons needed per node to O(N log2 N) from the naive O(N 2), where N is the number of training records in the dataset, thus making the algorithm feasible for larger datasets. This does however introduce a problem when duplicate values occur in the dataset, but we manage to overcome this problem with a relatively cheap subprotocol. We show a procedure to convert a sorting network into a permutation network of smaller complexity, resulting in a round complexity of O(log N) per layer in the tree. We implement our algorithm in the MP-SPDZ framework and benchmark our implementation for both passive and active three-party computation using arithmetic modulo 264. We apply our implementation to a large scale medical dataset of ≈ 290 000 rows using random forests, and thus demonstrate practical feasibility of using MPC for privacy-preserving machine learning based on decision trees for large datasets.

We devise multi-party computation protocols for general secure function evaluation with the property that each party is only required to communicate with a small number of dynamically chosen parties. More explicitly, starting with n parties connected via a complete and synchronous network, our protocol requires each party to send messages to (and process messages from) at most polylog(n) other parties using polylog(n) rounds. It achieves secure computation of any polynomial-time computable randomized function f under cryptographic assumptions, and tolerates up to $({1\over 3} - \epsilon) \cdot n$ statically scheduled Byzantine faults. We then focus on the particularly interesting setting in which the function to be computed is a sublinear algorithm: An evaluation of f depends on the inputs of at most q=o(n) of the parties, where the identity of these parties can be chosen randomly and possibly adaptively. Typically, q=polylog(n). While the sublinear query complexity of f makes it possible in principle to dramatically reduce the communication complexity of our general protocol, the challenge is to achieve this while maintaining security: in particular, while keeping the identities of the selected inputs completely hidden. We solve this challenge, and we provide a protocol for securely computing such sublinear f that runs in polylog(n)+O(q) rounds, has each party communicating with at most q ·polylog(n) other parties, and supports message sizespolylog(n) ·(l+n), where l is the parties' input size. Our optimized protocols rely on a multi-signature scheme, fully homomorphic encryption (FHE), and simulation-sound adaptive NIZK arguments. However, we remark that multi-signatures and FHE are used to obtain our bounds on message size and round complexity. Assuming only standard digital signatures and public-key encryption, one can still obtain the property that each party only communicates with polylog(n) other parties. We emphasize that the scheduling of faults can depend on the initial PKI setup of digital signatures and the NIZK parameters.

Computing a function of some private inputs while maintaining the confidentiality of those inputs is an important problem, to which Differential Privacy and Secure Multi-party Computation can offer solutions under specific assumptions. Research in randomised algorithms aims at improving the privacy of such inputs by randomising the output of a computation while ensuring that large distortions of outputs occur with low probability. But use cases such as e-voting or auctions will not tolerate large distortions at all. Thus, we develop a framework for randomising the output of a privacypreserving computation, while guaranteeing that output distortions stay within a specified bound. We analyse the privacy gains of our approach and characterise them more precisely for our notion of sparse functions. We build randomisation algorithms, running in linearithmic time in the number of possible input values, for this class of functions and we prove that the computed randomisations maximise the inputs’ privacy. Experimental work demonstrates significant privacy gains when compared with existing approaches that guarantee distortion bounds, also for non-sparse functions.

Secure multi-party computation (MPC) is a fundamental problem in secure distributed computing. An MPC protocol allows a set of $n$ mutually distrusting parties to carry out any joint computation of their private inputs, without disclosing any additional information about their inputs. MPC with information-theoretic security provides the strongest security guarantees and remains secure even against computationally unbounded adversaries. Perfectly-secure MPC protocols is a class of information-theoretically secure MPC protocols, which provides all the security guarantees in an error-free fashion. The focus of this work is perfectly-secure MPC. Known protocols are designed assuming either a synchronous or asynchronous communication network. It is well known that perfectly-secure synchronous MPC protocol is possible as long as adversary can corrupt any $t_s < n/3$ parties. On the other hand, perfectly-secure asynchronous MPC protocol can tolerate up to $t_a < n/4$ corrupt parties. A natural question is does there exist a single MPC protocol for the setting where the parties are not aware of the exact network type and which can tolerate up to $t_s < n/3$ corruptions in a synchronous network and up to $t_a < n/4$ corruptions in an asynchronous network. We design such a best-of-both-worlds perfectly-secure MPC protocol, provided $3t_s + t_a < n$ holds. For designing our protocol, we design two important building blocks, which are of independent interest. The first building block is a best-of-both-worlds Byzantine agreement (BA) protocol tolerating $t < n/3$ corruptions and which remains secure, both in a synchronous as well as asynchronous network. The second building block is a polynomial-based best-of-both-worlds verifiable secret-sharing (VSS) protocol, which can tolerate up to $t_s$ and $t_a$ corruptions in a synchronous and in an asynchronous network respectively.