2026-09-26 23:51:06 -06:00
# Bibliography {#bibliography}
Each paper is listed once. An ePrint number anywhere else in the manual
links here. **Used in** points back at the pages that rely on that paper.
ePrint PDFs that IACR posts are cached next to these pages.
Publisher PDFs from Springer, ACM, and USENIX are not.
[Point functions ](@ref bib_sec_point ) ·
[Generation and OT ](@ref bib_sec_ot ) ·
[Comparisons and proofs ](@ref bib_sec_cmp ) ·
[Three parties ](@ref bib_sec_three ) ·
[Grotto ](@ref bib_sec_grotto ) ·
[Protocols ](@ref bib_sec_protocols )
## Point functions and trees {#bib_sec_point}
### Improvements and extensions {#bib_fss2018}
Elette Boyle, Niv Gilboa, and Yuval Ishai.
*Function Secret Sharing: Improvements and Extensions.*
ACM CCS 2016, pp. 1292–
[ePrint 2018/707 ](https://eprint.iacr.org/2018/707 ) ·
< a href = "boyle-gilboa-ishai-fss-improvements-eprint-2018-707.pdf" > PDF< / a >
The point-function key `make_dpf` follows. Remark 3.4 is the early-stop
packing: the last `ν levels are a lane inside the
leaf, not correction words.
**Used in** [First program ](@ref basics ) · [Evaluation ](@ref evaluation ) · [Guided tour ](@ref tour_eval )
### Function Secret Sharing (2015) {#bib_fss2015}
Elette Boyle, Niv Gilboa, and Yuval Ishai.
*Function Secret Sharing.*
EUROCRYPT 2015, LNCS 9057, pp. 337–
< a href = "https://doi.org/10.1007/978-3-662-46803-6_12" > Publisher< / a >
The `4n(λ+1)` -bit key named in the manual, as recorded in the
bibliography of ePrint 2018/707. This library does not generate that key.
**Used in** [First program ](@ref basics ) · [Evaluation ](@ref evaluation )
### Half-Tree {#bib_halftree}
Xiaojie Guo, Kang Yang, Xiao Wang, Wenhao Zhang, Xiang Xie, Jiang Zhang, and Zheli Liu.
*Half-Tree: Halving the Cost of Tree Expansion in COT and DPF.*
[ePrint 2022/1431 ](https://eprint.iacr.org/2022/1431 ) ·
< a href = "guo-yang-wang-zhang-xie-zhang-liu-half-tree-eprint-2022-1431.pdf" > PDF< / a >
`prg::aes128_ccr` selects their dealer point-key expand. Section 5.2 is
a different object: two-party key generation in the COT/OLE hybrid.
**Used in** [First program ](@ref dpf_trees ) · [Evaluation ](@ref evaluation ) · [Guided tour ](@ref tour_trees )
### Information-theoretic DPF {#bib_itdpf}
Elette Boyle, Niv Gilboa, Yuval Ishai, and Victor I. Kolobov.
*Information-Theoretic Distributed Point Functions.*
[ePrint 2023/028 ](https://eprint.iacr.org/2023/028 ) ·
< a href = "boyle-gilboa-ishai-kolobov-it-dpf-eprint-2023-028.pdf" > PDF< / a >
A statistically private 3-server DPF. `make_it_dpf3` is the additive
interface on a `uint8_t` domain, not the 2-party PRG key.
**Used in** [Multiparty ](@ref multiparty ) · [Three-server PIR ](@ref app_pir3 ) · [Evaluation ](@ref it_dpf3 )
### Distributed point functions (2014) {#bib_dpf2014}
Niv Gilboa and Yuval Ishai.
*Distributed Point Functions and Their Applications.*
EUROCRYPT 2014, LNCS 8441, pp. 640–
< a href = "https://doi.org/10.1007/978-3-642-55220-5_36" > Publisher< / a >
Two-server keyword PIR from a point function on the keyword.
**Used in** [Keyword PIR ](@ref app_keyword )
## Generation and oblivious transfer {#bib_sec_ot}
### Scaling ORAM {#bib_ds}
Jack Doerner and abhi shelat.
*Scaling ORAM for Secure Computation.*
ACM CCS 2017, pp. 523–
[ePrint 2017/827 ](https://eprint.iacr.org/2017/827 ) ·
< a href = "doerner-shelat-scaling-oram-eprint-2017-827.pdf" > PDF< / a >
The per-level correction-word opening. `geneval_*` uses that opening on
the public query and does not return their reusable key. Floram's secret
read and write are the same opening.
**Used in** [Dealer-free keygen ](@ref dealer_free ) · [Guided tour ](@ref tour_ds ) · [Floram ](@ref app_floram )
### IKNP OT extension {#bib_iknp}
Yuval Ishai, Joe Kilian, Kobbi Nissim, and Erez Petrank.
*Extending Oblivious Transfers Efficiently.*
CRYPTO 2003, LNCS 2729, pp. 145–
< a href = "https://doi.org/10.1007/978-3-540-45146-4_9" > Publisher< / a >
The semi-honest OT extension `dpf::iknp::sample` follows: κ base OTs,
then a correlation-robust hash of the transposed matrix. IKNP is these
four authors.
**Used in** [Dealer-free keygen ](@ref dealer_free ) · [Guided tour ](@ref tour_iknp )
### Simplest OT {#bib_chou}
Tung Chou and Claudio Orlandi.
*The Simplest Protocol for Oblivious Transfer.*
LATINCRYPT 2015. Full version:
[ePrint 2015/267 ](https://eprint.iacr.org/2015/267 ) ·
< a href = "chou-orlandi-simplest-ot-eprint-2015-267.pdf" > PDF< / a >
The P-256 base OT under `dpf::iknp` (`base_sender` / `base_receiver` ).
**Used in** [Guided tour ](@ref tour_iknp )
### AES S-box circuit {#bib_boyar}
Joan Boyar and René Peralta.
*A depth-16 circuit for the AES S-box.*
[ePrint 2011/332 ](https://eprint.iacr.org/2011/332 ) ·
< a href = "boyar-peralta-aes-sbox-eprint-2011-332.pdf" > PDF< / a >
The 32-AND SubBytes used by `party/oblivious_hash.hpp`
(`aes_bp::and_count = 32` ).
**Used in** [Guided tour ](@ref tour_iknp ) · [Evaluation ](@ref evaluation )
## Comparisons, proofs, and products {#bib_sec_cmp}
### Mixed-mode FSS {#bib_dcf}
Elette Boyle, Nishanth Chandran, Niv Gilboa, Divya Gupta, Yuval Ishai, Nishant Kumar, and Mayank Rathee.
*Function Secret Sharing for Mixed-Mode and Fixed-Point Secure Computation.*
EUROCRYPT 2021, LNCS 12697, pp. 871–
[ePrint 2020/1392 ](https://eprint.iacr.org/2020/1392 ) ·
< a href = "boyle-chandran-gilboa-gupta-ishai-kumar-rathee-mixed-mode-fss-eprint-2020-1392.pdf" > PDF< / a >
The distributed comparison function, and Figure 3's one-DCF public interval.
**Used in** [Comparisons ](@ref comparisons ) · [Evaluation ](@ref evaluation ) · [Guided tour ](@ref tour_dcf )
### Verifiable FSS {#bib_vdpf}
Leo de Castro and Antigoni Polychroniadou.
*Lightweight, Maliciously Secure Verifiable Function Secret Sharing.*
EUROCRYPT 2022, pp. 150–
[ePrint 2021/580 ](https://eprint.iacr.org/2021/580 ) ·
< a href = "de-castro-polychroniadou-verifiable-fss-eprint-2021-580.pdf" > PDF< / a >
The 4λ-bit correction seeds and 2λ-bit proof token, and §4's κ = 3
cuckoo packing. `make_multipoint` follows this GGM multi-point.
S& P 2025 (Boyle, Gilboa, Hamilis, Ishai, and Tu) packs those bucket
keys from a PCG seed. That packing is not a `multipoint_params` tweak
and is not implemented here.
**Used in** [Verifiability ](@ref verifiability ) · [Multipoint ](@ref multipoint_keys ) · [Keyword PIR ](@ref app_keyword ) · [PSI ](@ref app_psi )
### ABY2.0 {#bib_aby2}
Arpita Patra, Thomas Schneider, Ajith Suresh, and Hossein Yalame.
*ABY2.0: Improved Mixed-Protocol Secure Two-Party Computation.*
USENIX Security 2021. Full version:
[ePrint 2020/1225 ](https://eprint.iacr.org/2020/1225 ) ·
< a href = "patra-schneider-suresh-yalame-aby2-eprint-2020-1225.pdf" > PDF< / a >
One public reconstruction per newly opened wire.
2026-09-28 05:59:19 -06:00
**Used in** [Beaver triples ](@ref beaver_triples ) · [Arithmetic share runtime ](@ref arith_runtime ) · [Guided tour ](@ref tour_beaver )
### ABY {#bib_aby}
Daniel Demmler, Thomas Schneider, and Michael Zohner.
*ABY — A Framework for Efficient Mixed-Protocol Secure Two-Party Computation.*
NDSS 2015.
[ePrint 2014/386 ](https://eprint.iacr.org/2014/386 )
Arithmetic / boolean / Yao sharing and conversions.
**Used in** [Arithmetic share runtime ](@ref arith_runtime ) · [A boolean function of a leaf ](@ref yao_leaf )
### Half-gates {#bib_halfgates}
Samee Zahur, Mike Rosulek, and David Evans.
*Two Halves Make a Whole: Reducing Data Transfer in Garbled Circuits using Half Gates.*
EUROCRYPT 2015.
[ePrint 2014/756 ](https://eprint.iacr.org/2014/756 )
Free-XOR AND rows. `yao::session` sends two blocks per AND.
**Used in** [A boolean function of a leaf ](@ref yao_leaf ) · [Arithmetic share runtime ](@ref arith_runtime )
### Garbling gadgets {#bib_garble_gadgets}
Marshall Ball, Tal Malkin, and Mike Rosulek.
*Garbling Gadgets for Boolean and Arithmetic Circuits.*
CCS 2016.
[ePrint 2016/969 ](https://eprint.iacr.org/2016/969 )
Free addition and public scaling in `(Z_m)^k` , and a unary projection of
`m − ciphertexts. A fan-in-`b` symmetric gate is a projection of the sum.
`arith_garble.hpp` is this gadget. The session in `beaver.hpp` stays the
interactive one-open product.
**Used in** [Beaver triples ](@ref beaver_triples ) · [Arithmetic share runtime ](@ref arith_runtime )
### Stacked garbling {#bib_stacked}
David Heath and Vladimir Kolesnikov.
*Stacked Garbling: Garbled Circuit Proportional to Longest Execution Path.*
CRYPTO 2020.
[ePrint 2020/973 ](https://eprint.iacr.org/2020/973 )
One XOR-stack of the branch materials. Inactive branches are rebuilt from seeds.
**Used in** [A boolean function of a leaf ](@ref yao_leaf )
### One-hot garbling {#bib_onehot}
David Heath and Vladimir Kolesnikov.
*One Hot Garbling.*
CCS 2021.
The same stack over `k` branches. The demux carries the inactive seeds.
**Used in** [A boolean function of a leaf ](@ref yao_leaf )
### FLUTE {#bib_flute}
Andreas Brüggemann, Robin Hundt, Thomas Schneider, Ajith Suresh, and Hossein Yalame.
*FLUTE: Fast and Secure Lookup Table Evaluations.*
IEEE S& P 2023.
[ePrint 2023/499 ](https://eprint.iacr.org/2023/499 )
A public LUT is a multi-fan-in inner product on ABY2.0 masked bits.
Online cost is two bits per output bit.
**Used in** [Beaver triples ](@ref beaver_triples ) · [Arithmetic share runtime ](@ref arith_runtime )
### ABY3 {#bib_aby3}
Payman Mohassel and Peter Rindal.
*ABY3: A Mixed Protocol Framework for Machine Learning.*
CCS 2018.
[ePrint 2018/403 ](https://eprint.iacr.org/2018/403 )
Honest-majority 3PC, RSS, probabilistic truncation, matrix triples.
**Used in** [Arithmetic share runtime ](@ref arith_runtime )
### edaBits / CrypTFlow2 {#bib_edabits}
Daniel Escudero, Satrajit Ghosh, Marcel Keller, Rahul Rachuri, and Peter Scholl.
*Improved Primitives for MPC over Mixed Arithmetic-Binary Circuits.*
CRYPTO 2020.
[ePrint 2020/338 ](https://eprint.iacr.org/2020/338 )
**Used in** [Arithmetic share runtime ](@ref arith_runtime ) · [A boolean function of a leaf ](@ref yao_leaf )
### EzPC {#bib_ezpc}
Nishanth Chandran, Divya Gupta, Aseem Rastogi, Rahul Sharma, and Shardul Tripathi.
*EzPC: Programmable and Efficient Secure Two-Party Computation for Machine Learning.*
EuroS& P 2019.
[ePrint 2017/1109 ](https://eprint.iacr.org/2017/1109 )
**Used in** [Arithmetic share runtime ](@ref arith_runtime )
### Gilboa multiplication {#bib_gilboa}
Niv Gilboa.
*Two Party RSA Key Generation.*
CRYPTO 1999, LNCS 1666, pp. 116–
**Used in** [Arithmetic share runtime ](@ref arith_runtime )
### Sharemind {#bib_sharemind}
Dan Bogdanov, Sven Laur, and Jan Willemson.
*Sharemind: A Framework for Fast Privacy-Preserving Computations.*
ESORICS 2008, LNCS 5283, pp. 192–
**Used in** [Arithmetic share runtime ](@ref arith_runtime )
2026-09-26 23:51:06 -06:00
### Beaver triples {#bib_beaver}
Donald Beaver.
*Efficient Multiparty Protocols Using Circuit Randomization.*
CRYPTO 1991, LNCS 576, pp. 420–
< a href = "https://doi.org/10.1007/3-540-46766-1_34" > Publisher< / a >
The two-opening product triple, not the ABY2.0 session.
**Used in** [Beaver triples ](@ref beaver_triples ) · [Guided tour ](@ref tour_beaver )
### Bit commitment {#bib_naor}
Moni Naor.
*Bit Commitment Using Pseudorandomness.*
Journal of Cryptology 4(2), 1991, pp. 151–
< a href = "https://doi.org/10.1007/BF00196774" > Publisher< / a >
`dpf::ppvc` binds each DPF root with this string commitment:
`G(r) XOR A*rho` , under a public matrix `A` .
**Used in** [Programmable vectors ](@ref ppvc_manual )
## Three evaluators {#bib_sec_three}
### Three-party DPF {#bib_dpf3}
Guy Zyskind, Avishay Yanai, and Alex "Sandy" Pentland.
*High-Throughput Three-Party DPFs with Applications to ORAM and Digital Currencies.*
[ePrint 2024/1658 ](https://eprint.iacr.org/2024/1658 ) ·
< a href = "zyskind-yanai-pentland-three-party-dpf-eprint-2024-1658.pdf" > PDF< / a >
Figure 3: each evaluator key is a pair of (2,2)-VDPF+ keys.
**Used in** [Multiparty ](@ref multiparty ) · [Guided tour ](@ref tour_dpf3 ) · [Three-server PIR ](@ref app_pir3 ) · [(2,3) ledger ](@ref app_ledger23 )
## Grotto {#bib_sec_grotto}
### Grotto {#bib_grotto}
Kyle Storrier, Adithya Vadapalli, Allan Lyons, and Ryan Henry.
*Grotto: Screaming fast (2+1)-PC for Z< sub > 2< sup > n< / sup > < / sub > via (2,2)-DPFs.*
[ePrint 2023/108 ](https://eprint.iacr.org/2023/108 ) ·
< a href = "storrier-vadapalli-lyons-henry-grotto-eprint-2023-108.pdf" > PDF< / a >
Prefix parity along one key, and Appendix D's degree-0 exact tables.
Offset Horner is not that piecewise-polynomial construction.
**Used in** [Grotto ](@ref jet_and_ring ) · [Guided tour ](@ref tour_grotto )
2026-09-28 05:59:19 -06:00
### Wave Hello {#bib_wave}
José Reis, Mehmet Ugurbil, Sameer Wagh, Ryan Henry, and Miguel de Vega.
*Wave Hello to Privacy: Efficient Mixed-Mode MPC using Wavelet Transforms.*
PoPETs 2025(2), pp. 697–
< a href = "https://doi.org/10.56553/popets-2025-0083" > Publisher< / a > ·
[ePrint 2025/013 ](https://eprint.iacr.org/2025/013 ) ·
< a href = "reis-ugurbil-wagh-henry-de-vega-wave-hello-eprint-2025-013.pdf" > PDF< / a >
Equations (7) and (8) are the cleartext Haar and bior(5,3) lookup.
`make_haar_dwt_lut` and `make_bior53_dwt_lut` evaluate those tables.
The online phase pairs Haar with a deterministic Pika truncation and
bior(5,3) with segment parity.
**Used in** [Wavelet lookup tables ](@ref dwt_luts ) · [Guided tour ](@ref tour_grotto )
2026-09-26 23:51:06 -06:00
## Protocols {#bib_sec_protocols}
### Duoram {#bib_duoram}
Adithya Vadapalli, Ryan Henry, and Ian Goldberg.
*Duoram: A Bandwidth-Efficient Distributed ORAM for 2- and 3-Party Computation.*
USENIX Security 2023.
< a href = "https://www.usenix.org/conference/usenixsecurity23/presentation/vadapalli" > USENIX< / a >
The 3-party read and update: unit DPFs at a random index, a cyclic
shift by the opened offset, and a dot product with the memory.
**Used in** [3-party Duoram ](@ref app_duoram )
### BitMore {#bib_bitmore}
Syed Mahbub Hafiz and Ryan Henry.
*A Bit More Than a Bit Is More Than a Bit Better.*
PoPETs 2019(4), pp. 112–
< a href = "https://doi.org/10.2478/popets-2019-0061" > Publisher< / a >
Section 5.2 is the `2^L` -server query: `L` independent 1-bit DPFs,
one key per label bit.
**Used in** [BitMore ](@ref app_bitmore )
### Prio {#bib_prio}
Henry Corrigan-Gibbs and Dan Boneh.
*Prio: Private, Robust, and Scalable Computation of Aggregate Statistics.*
NSDI 2017, pp. 259–
< a href = "https://www.usenix.org/conference/nsdi17/technical-sessions/presentation/corrigan-gibbs" > USENIX< / a >
The frequency count is a one-hot encoding. `dpf::field64` is this
paper's Field64, via libprio.
**Used in** [Prio ](@ref app_prio )
### Poplar {#bib_poplar}
Dan Boneh, Elette Boyle, Henry Corrigan-Gibbs, Niv Gilboa, and Yuval Ishai.
*Lightweight Techniques for Private Heavy Hitters.*
[ePrint 2021/017 ](https://eprint.iacr.org/2021/017 )
The incremental DPF on prefixes of one secret string. EvaluateUntil is
`eval_until` . Mastic is this prefix walk with a weight payload.
**Used in** [Prio ](@ref app_prio ) · [I-DPF max and k-th ](@ref app_idpf_agg ) · [Mastic ](@ref app_mastic ) · [Guided tour ](@ref tour_eval )
### Incremental aggregation {#bib_idpfagg}
Nan Cheng, Aikaterini Mitrokotsa, Feng Zhang, and Frank Hartmann.
*Efficient Two-Party Secure Aggregation via Incremental Distributed Point Function.*
[ePrint 2024/1190 ](https://eprint.iacr.org/2024/1190 )
Communication tracks the bit length of the domain. The max and k-th
walks are `idpf_agg_max` and `idpf_agg_kth` .
**Used in** [I-DPF max and k-th ](@ref app_idpf_agg )
### LLAMA {#bib_llama}
Kanav Gupta, Deepak Kumaraswamy, Nishanth Chandran, and Divya Gupta.
*LLAMA: A Low Latency Math Library for Secure Inference.*
[ePrint 2022/793 ](https://eprint.iacr.org/2022/793 )
Offset comparison and spline gates.
**Used in** [LLAMA ](@ref app_llama )
### Pika {#bib_pika}
Sameer Wagh.
*Pika: Secure Computation using Function Secret Sharing over Rings.*
PoPETs 2022(4), pp. 351–
< a href = "https://doi.org/10.56553/popets-2022-0113" > Publisher< / a >
Figure 1 is the unit-DPF table lookup.
**Used in** [Pika ](@ref app_pika )
### Express {#bib_express}
Saba Eskandarian, Henry Corrigan-Gibbs, Matei Zaharia, and Dan Boneh.
*Express: Lowering the Cost of Metadata-hiding Communication with Cryptographic Privacy.*
USENIX Security 2021, pp. 1775–
< a href = "https://www.usenix.org/conference/usenixsecurity21/presentation/eskandarian" > USENIX< / a >
Section 3.1 is the DPF mailbox write.
**Used in** [Express ](@ref app_express ) · [Sabre ](@ref app_sabre )
### PRAC {#bib_prac}
Sajin Sasy, Adithya Vadapalli, and Ian Goldberg.
*PRAC: Round-Efficient 3-Party MPC for Dynamic Data Structures.*
[ePrint 2023/1897 ](https://eprint.iacr.org/2023/1897 )
One incremental DPF replaces the `lg n` point keys of a binary search.
A wide leaf updates a heap node and both children.
**Used in** [PRAC ](@ref app_prac )
### Splinter {#bib_splinter}
Frank Wang, Catherine Yun, Shafi Goldwasser, Vinod Vaikuntanathan, and Matei Zaharia.
*Splinter: Practical Private Queries on Public Data.*
NSDI 2017.
< a href = "https://www.usenix.org/conference/nsdi17/technical-sessions/presentation/wang-frank" > USENIX< / a >
A unit DPF selects one public group. The server dots that selector with
a pre-aggregated column.
**Used in** [Splinter ](@ref app_splinter )
### Waldo {#bib_waldo}
Emma Dauterman, Mayank Rathee, Raluca Ada Popa, and Ion Stoica.
*Waldo: A Private Time-Series Database from Function Secret Sharing.*
IEEE S& P 2022.
[ePrint 2021/1661 ](https://eprint.iacr.org/2021/1661 )
Append-only unit DPFs, and a comparison inner product for a secret threshold.
**Used in** [Waldo ](@ref app_waldo )
### Sabre {#bib_sabre}
Adithya Vadapalli, Kyle Storrier, and Ryan Henry.
*Sabre: Sender-Anonymous Messaging with Fast Audits.*
IEEE S& P 2022.
The write is Express's full-domain add. The audit is a verifiable DPF
proof instead of Express's `fp61` sketch.
**Used in** [Sabre ](@ref app_sabre )
### Batched OPRF / PSI {#bib_kkrt}
Vladimir Kolesnikov, Ranjit Kumaresan, Mike Rosulek, and Ni Trieu.
*Efficient Batched Oblivious PRF with Applications to Private Set Intersection.*
ACM CCS 2016.
[ePrint 2016/799 ](https://eprint.iacr.org/2016/799 )
Membership as an oblivious PRF. On this domain the PRF table is public
and each receiver element is a unit DPF.
**Used in** [Private set intersection ](@ref app_psi )
### Private SUBLEQ {#bib_subleq}
Jiang and Henry.
MSc thesis, University of Calgary.
A subtract-and-branch instruction for private function evaluation.
The DPF work is a prepaid wildcard unit vector, rotated once the
address is opened.
**Used in** [MPC SUBLEQ ](@ref app_subleq )
2026-09-28 05:59:19 -06:00
\htmlonly
< div class = "tldr" > < b > TL;DR.< / b > The point key is ePrint 2018/707, not the longer EUROCRYPT 2015 key. Proofs and cuckoo multipoint are 2021/580. Comparisons are 2020/1392. The dealer-free opening is 2017/827, and the pads are IKNP plus the 2015/267 base OT. Three-party spines are 2024/1658. The information-theoretic table is 2023/028. Grotto is 2023/108.< / div >
\endhtmlonly
