OT Extension ⇒ MPC with preprocessing (SPDZ, etc.)

Standard model · KOS16

Statement

The MASCOT protocol generates SPDZ authenticated multiplication triples over a finite field $\mathbb{F}$ from correlated OT extension; with the SPDZ online phase of DPSZ12 this gives MPC with preprocessing for arithmetic circuits over $\mathbb{F}$, secure with abort against a malicious adversary corrupting up to $n-1$ of the $n$ parties — KOS16.

Sketch

Each cross term $a^i{b}^j$ of a secret-shared triple is computed pairwise by correlated OT, with the bits of one party’s share as choice bits and the other party’s share as the correlation (Gilboa’s oblivious product); the SPDZ MACs are the same product with the MAC-key shares as the fixed correlation. Random linear combinations of candidate triples remove the leakage a malicious party can induce by selective failure, a sacrifice step checks correctness, and the online phase consumes one triple per multiplication gate.