ryan/libdpf
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
libdpf/doc/pages/beaver.md
Ryan Henry 0d22946a0e Checkpoint the party/runtime stack before share-program and malicious-mode work. 
Ship the TLS mesh, composer, Beaver/Yao/leaf MPC, prep/online paths, apps, and docs so the tree is pushable before elevating share_expr, security_mode, and prep resume.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-28 05:59:19 -06:00

2.2 KiB
Raw Blame History

Beaver triples

\htmlonly

ELI5. A product opens as d = x − a and e = y − b, with a and b the preprocessing blinds. The product share is de plus the blinded cross terms, all local once d and e are public. The session keeps blinds that were already opened and only samples monomials it has not seen.
\endhtmlonly

ABY2.0-style sessions open masked wires once (Patra, Schneider, Suresh, and Yalame, USENIX Security 2021 / [ePrint 2020/1225](@ref bib_aby2)). A fresh triple follows Beaver, [CRYPTO 1991](@ref bib_beaver): both masked factors are reconstructed, and the product share is a local correction. Optional MAC tags are the Shark/SPDZ check.

Constant-round word arithmetic is a separate gadget. [Ball, Malkin, and Rosulek, CCS 2016](@ref bib_garble_gadgets) give free addition, free scaling by a public constant, and a unary projection of m − 1 ciphertexts. [arith_garble.hpp](@ref dpf/arith_garble.hpp) is that circuit. A session does not become one: it still opens δ once per wire. A public table on masked bits is [FLUTE](@ref bib_flute) in [flute.hpp](@ref dpf/flute.hpp): the table is a multi-fan-in inner product, and the online exchange is two bits per output bit. eval_trio is the same product on three XOR shares of each mask.

One call that samples a list of formulae opens the new wires in one round. Communication is one masked value per newly opened wire, plus a tag share of the same width when MACs are on. Preprocessing is one blind per wire and one product share per monomial.

schedule_objective::prep (default) peels shared factors for Appendix-E prep savings and may add interactive rounds. schedule_objective::rounds emits the polynomial in one online round (Pika / online Grotto). Composer-owned sessions use rounds.

Compose FSS walks, ABY products, and RSS refreshes on one sink with [protocol composition](@ref protocol_compose).

Go deeper: [a small word](@ref arith_garble_word), [a public table](@ref flute_lut), [beaver.hpp](@ref dpf/beaver.hpp), [compose.hpp](@ref dpf/compose.hpp), [F_Beaver](@ref beaver.hpp), [F_BeaverAuth](@ref beaver.hpp), and the cost notes in the [guided tour](@ref tour_beaver).