Secure Multiparty Computation
- title
- Secure Multiparty Computation
- type
- concept
- summary
- Cryptographic protocols where n parties jointly compute f(x₁,...,xₙ) without revealing their inputs; the output is the only thing learned
- tags
- cryptography, mpc
- sources
- stoffel-beaver-triples
- created
- 2026-05-10
- updated
- 2026-05-10
MPC is the umbrella for protocols where n parties compute f(x₁, ..., xₙ) such that each party learns the output and nothing else about the others' inputs. The classical example is Yao's millionaires (who is richer without revealing salaries); modern uses include private auctions, federated analytics, threshold ECDSA signing, and dark-pool trading.
Two main construction styles dominate:
Garbled circuits (Yao 1986) evaluate a Boolean circuit gate-by-gate where one party "garbles" each gate's truth table and the other obliviously decrypts. Originally two-party, generalized via BMR/SPDZ-style protocols. Best for shallow circuits; round complexity is constant in circuit depth but communication grows with circuit size.
Secret-sharing-based (BGW 1988, GMW 1987) uses secret-sharing schemes where addition is free and multiplication uses beaver-triples or BGW degree-reduction. Better for deep arithmetic circuits; round complexity grows with multiplication depth but per-round work is small.
Modern production stacks (SPDZ, MASCOT, MP-SPDZ, Paillier-based threshold libraries) combine an offline triple-generation phase with an online evaluation phase. The offline phase is expensive but input-independent; the online phase is cheap and is what runs at request time. stoffel-mpc is one of the projects packaging this pattern as a service.
Adversary models matter: semi-honest assumes parties follow the protocol but try to learn from what they see; malicious assumes parties may deviate arbitrarily. Most academic protocols are semi-honest with optional MAC-based extensions for malicious security (the SPDZ "dishonest majority" model).
Adjacent but distinct:
- Homomorphic encryption (FHE) lets one party compute on another's encrypted data; MPC distributes the computation
- ZKPs prove statements without revealing witnesses; can be combined with MPC for outputs that are themselves verifiable
- Differential privacy adds noise to results; orthogonal to whether the computation itself was private
Cross-references: secret-sharing, beaver-triples, mpc-beaver-triples, post-quantum-cryptography.