# Secure Multiparty Computation

MPC is the umbrella for protocols where `n` parties compute `f(x₁, ..., xₙ)` such that each party learns the output and nothing else about the others' inputs. The classical example is Yao's millionaires (who is richer without revealing salaries); modern uses include private auctions, federated analytics, threshold ECDSA signing, and dark-pool trading.

Two main construction styles dominate:

**Garbled circuits (Yao 1986)** evaluate a Boolean circuit gate-by-gate where one party "garbles" each gate's truth table and the other obliviously decrypts. Originally two-party, generalized via BMR/SPDZ-style protocols. Best for shallow circuits; round complexity is constant in circuit depth but communication grows with circuit size.

**Secret-sharing-based (BGW 1988, GMW 1987)** uses [[secret-sharing]] schemes where addition is free and multiplication uses [[beaver-triples]] or BGW degree-reduction. Better for deep arithmetic circuits; round complexity grows with multiplication depth but per-round work is small.

Modern production stacks (SPDZ, MASCOT, MP-SPDZ, Paillier-based threshold libraries) combine an offline triple-generation phase with an online evaluation phase. The offline phase is expensive but input-independent; the online phase is cheap and is what runs at request time. [[stoffel-mpc]] is one of the projects packaging this pattern as a service.

Adversary models matter: **semi-honest** assumes parties follow the protocol but try to learn from what they see; **malicious** assumes parties may deviate arbitrarily. Most academic protocols are semi-honest with optional MAC-based extensions for malicious security (the SPDZ "dishonest majority" model).

Adjacent but distinct:
- **Homomorphic encryption** (FHE) lets one party compute on another's encrypted data; MPC distributes the computation
- **ZKPs** prove statements without revealing witnesses; can be combined with MPC for outputs that are themselves verifiable
- **Differential privacy** adds noise to results; orthogonal to whether the computation itself was private

Cross-references: [[secret-sharing]], [[beaver-triples]], [[mpc-beaver-triples]], [[post-quantum-cryptography]].