Other meanings of Secure multi-party computation
Cryptography
Secure multi-party computation (MPC) comprises cryptographic methods enabling joint computation without revealing private inputs. Several parties can obtain an agreed function of their data while learning no more than the output and whatever follows from it. MPC is a privacy technology rather than a single protocol: its design depends on the function, the number and behavior of participants, performance requirements, and the assumed computational or communication environment.
Secure multi-party computation lets mutually distrustful parties evaluate a function over their private inputs while limiting what the protocol reveals. 1 For inputs x1, …, xn, the parties compute f(x1, …, xn) without ordinarily disclosing the inputs themselves. A hospital consortium might calculate statistics across patient records, for example, while retaining record-level confidentiality.
Security has several layers. Privacy hides inputs and intermediate values; correctness ensures that an accepted output is the prescribed function value; and robustness or fairness addresses disruption, aborts, and unequal access to results. Formal definitions commonly distinguish semi-honest participants, who follow the protocol but inspect its messages, from malicious participants, who may deviate arbitrarily. The guarantee is also output-dependent: a result can itself reveal sensitive information.
MPC protocols represent a computation in a form that can be evaluated through cryptographic operations while keeping each party's share hidden. Yao's garbled-circuit construction provided an influential two-party approach in which one party encodes a Boolean circuit and the other evaluates it without seeing the encoded intermediate values. 2 Multi-party protocols also use secret sharing, oblivious transfer, homomorphic encryption, commitments, and zero-knowledge proofs.
Secret sharing divides a value into pieces whose individual shares reveal nothing, while specified groups can reconstruct or operate on the value. Protocols based on arithmetic secret sharing are often efficient for additions and multiplications over finite fields; garbled circuits can be attractive for comparisons and irregular Boolean logic. Frameworks such as ABY combine arithmetic, Boolean, and garbled-circuit techniques so that different parts of a computation use a suitable representation. 3
The security model determines what an MPC result means in practice. A protocol may tolerate a bounded number of corrupt parties, assume an honest majority, or remain secure against a dishonest majority; it may also rely on a trusted setup, public-key assumptions, or authenticated communication. Security can be computational, depending on the difficulty of a problem, or information-theoretic, holding even against computationally unlimited attackers under stronger conditions.
Performance is shaped by circuit size, multiplicative depth, network latency, bandwidth, preprocessing, and the cost of input and output conversion. Modern protocols separate offline preprocessing from online evaluation, allowing cryptographic material to be prepared before the private data arrive. The MASCOT family illustrated a practical preprocessing approach based on oblivious transfer, reducing online work but not eliminating communication and deployment costs. 4 Implementations must also protect endpoints, keys, logs, and outputs; MPC does not secure compromised software or inferentially revealing results.
MPC is useful even when parties are not all equal, but its guarantees change sharply with participation assumptions. Some protocols provide fairness only in restricted settings: a malicious participant may still abort after learning information unless the protocol includes stronger mechanisms or economic and legal remedies. Identifying dishonest behavior can require verifiable secret sharing, consistency checks, or zero-knowledge proofs, each adding cost.
Applications extend beyond the familiar two-party example. Governments and financial institutions have used privacy-preserving computation for cross-organization analytics; private set intersection can reveal common members without exposing nonmatching records; and threshold cryptography distributes control of a signing key so that no single custodian holds it. MPC can also be combined with differential privacy, which limits information in released statistics but addresses a different threat from input confidentiality. 1 A notable edge case is that even a perfectly private protocol cannot prevent leakage from a highly selective query, repeated outputs, or collusion among enough participants.
MPC is a family of protocols and security definitions, so claims about privacy, fairness, collusion tolerance, and efficiency must be read together with a protocol's formal model and implementation assumptions.
Help improve the encyclopedia. Reports go straight to the site manager.