Pith. sign in

REVIEW 4 major objections 6 minor 41 references

Communication Efficient Multiparty Private Set Intersection from Multi-Point Sequential OPRF

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A multiparty private set intersection protocol built purely on a ring topology achieves O(N) per-party communication and computation, independent of the number of parties.

desk verdict A genuinely new ring-topology MPSI with impressive benchmarks, but the security proof's key lemma is false as stated and the hybrid argument needs a real repair. read the letter →

arxiv 2506.00566 v1 pith:LOTB7RTC submitted 2025-05-31 cs.CR

Xinyu Feng , Yukun Wang , Cong Li , Wu Xin , Ming Yao , Dian Zhang , Wanwan Wang , Hao He This is my paper
classification cs.CR
keywords multipartyprivatesetintersectionringtopologymulti-pointsequentialOPRFrandomoblivioustransfersemi-honestsecurityHammingcorrelationrobustnesscommunicationcomplexitypseudorandomfunction
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to answer whether an efficient MPSI protocol can be built with a pure ring topology, and it answers yes. It constructs the first such protocol from symmetric-key primitives: random oblivious transfer, a pseudorandom function, and two hash functions, with no public-key operations per element. The protocol gives the leader and every assistant the same O(N) communication and computation cost, where N is the input set size, so per-party load no longer grows with the number of parties. The authors prove semi-honest security under a new t-party d-Hamming correlation robustness assumption and report a 74.8% communication reduction and a 6% to 287% improvement in total running time against the KMPRT and NTY baselines. If these claims hold, the protocol removes the leader bottleneck of star topologies and the multiplying communication of mesh topologies.

What carries the argument

The central object is MP-SOPRF, the multi-point sequential oblivious pseudorandom function. It generalizes two-party multi-point OPRF to n-1 parties arranged in a ring: party P_1 samples a random matrix A, and through a chain of random oblivious transfers each party P_i converts the matrix it receives using its own set-dependent difference matrix D_i, so that the value at the position indexed by an element x survives unchanged if and only if x belongs to every set up to that party. The transitivity of these conditional equalities—A(x)=C_2(y) iff x=y, then C_2(y)=C_3(z) iff y=z, and so on—is what lets the final party compute a hash that the leader can compare with its own hash. Random OT is used so that all parties can run the initial OT setup in parallel and so that the sender can avoid sending one of its two messages, halving communication in the early steps.

What would settle it

Take the protocol's own parameter values, such as d=40 and ell_2=80, instantiate H_2 with a concrete hash, set a_j=0 and let each b_j be a distinct weight-40 vector, then sample many random masks s_i and test whether the resulting outputs can be distinguished from uniform by enumerating the $2^{40}$ possible masked inputs; a non-negligible advantage would falsify the t-party d-Hamming correlation robustness assumption that the proof depends on.

Watch

Extended reading notes

Core claim

The paper claims that MPSI can be built on a pure ring topology without sacrificing efficiency: it presents the first such protocol and proves it semi-honest secure under a new t-party d-Hamming correlation robustness assumption. The protocol's central mechanism is MP-SOPRF, a sequential chain of random oblivious transfers in which each party contributes a set-dependent binary matrix; by transitivity of equality at matrix positions, the final value computed by the last party matches the leader's value if and only if the underlying element lies in every party's set. The leader receives only this matched hash value, and hence learns the intersection but not the non-intersection elements. The paper reports that with 15 parties and set size $2^{20}$, communication drops by 74.8% against NTY and by 97.8% against KMPRT, with total running time improved by 6% to 287%.

Load-bearing premise

The entire security proof depends on a new assumption that a hash function applied to inputs masked by several independent random strings still looks uniformly random to anyone who does not know those strings, and the paper does not reduce this assumption to a more standard one.

Editorial extensions

If this is right

  • MPSI becomes deployable on daisy-chained or bus networks, since each party only needs to communicate with one neighbor.
  • Adding more parties does not change any single party's asymptotic communication or computation; only the input set size matters for the per-party asymptotic cost.
  • The protocol needs only OT extension, hash functions, and a PRF, so it can run without homomorphic encryption or per-element public-key operations.
  • Large-set applications such as vertical federated learning alignment can cut network traffic by about three-quarters relative to NTY and by more than 97% relative to KMPRT at n=15 and N=2^20.
  • Because assistants receive only random OT outputs and the final hash, the protocol offers collusion resistance against up to n-1 corrupted assistants when the leader is not corrupted.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The t-party d-Hamming correlation robustness assumption is the natural target for follow-up work: either reduce it to the standard two-party version by a hybrid over the t-1 masks, or show a separation, since the protocol's security stands or falls on that reduction.
  • The paper's own WAN experiments show runtime rising with party count despite constant per-party complexity, because ring messages are inherently sequential; in very high-latency networks a mesh protocol can still win despite higher bandwidth.
  • The MP-SOPRF abstraction is reusable: the same conditional-equality-through-matrix-positions mechanism could yield ring-topology private membership, intersection cardinality, or threshold intersection protocols.
  • The preprocessing step requires all parties to share the PRF key k, and the paper does not cost this key distribution in its O(N) accounting, so a deployment must add one fixed broadcast or agreement round.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. This paper presents a semi-honest multiparty private set intersection (MPSI) protocol for a ring topology. The protocol uses a new primitive called multi-point sequential OPRF (MP-SOPRF), built from sequential random OTs: each party P_i constructs a binary matrix D^i marking the positions of its set elements, and the parties pass an OT-derived matrix around the ring so that the leader P_1 can match OPRF values and output the intersection. The authors claim O(N) per-party communication and computation under a t-party d-Hamming correlation robustness assumption, and report a 74.8% communication reduction over NTY and a 6% to 287% running-time improvement in LAN/WAN experiments for up to 15 parties and set sizes up to 2^24.

Significance. If the security proof is repaired, the protocol would be a useful contribution: it is one of the few ring-topology MPSI constructions, it achieves per-party complexity independent of the number of parties, and the experimental section is unusually thorough (LAN/WAN, set sizes 2^12–2^24, 4–15 parties). The use of ROT to enable parallel preprocessing is a nice design choice. However, the current proof has a false lemma that invalidates the hybrid arguments as written, and the new t-party correlation robustness assumption is only sketched. These issues are load-bearing for Theorem 1, so the paper needs major revision rather than acceptance in its present form.

major comments (4)
  1. [Section 5, Lemma 1; Proof 2, Hybrid 4; Proof 3, Hybrid 2] Lemma 1 is false as stated. Since D^i is constructed by setting D^i_j[v[j]]=0 for every x in X_i, for any x in X_i the sequence D^i_1[v[1]],...,D^i_w[v[w]] is all zeros, so the number of ones is 0, not at least d. Therefore the abort condition in Hybrid 4 of Proof 2 and Hybrid 2 of Proof 3 fires with probability 1 on valid executions whenever some x in X_n\I also belongs to an earlier X_i (e.g., n=3, X_1={a,c}, X_2={a}, X_3={a,c}). The correct statement must quantify only over parties i for which x is not in X_i; for such parties the vector b^i is all ones (hence weight w >= d) except with negligible collision probability, and the zero-weight terms can be dropped before applying Corollary 1. Lemma 1 and both hybrid arguments must be restated and reproved; as written, Theorem 1 is unsupported.
  2. [Section 5, Proof 2, Hybrid 7 and simulator S_Z] The simulator description does not cover the OT-sender role of a corrupted assistant. When P_i in Z acts as the OT sender to the honest P_{i+1} (Step 8 / Figure 9), its view contains the ROT sender outputs (r^0_j, r^1_j) and the values Delta, Gamma that it sends; the paper only says it 'runs the OT simulator to simulate the view of an OT receiver for P_i'. The sender-side simulation (sampling C^i, D^i, and consistent ROT outputs and messages) must be specified, and the indistinguishability of this part must be argued. Without it, the joint simulation of a corrupted middle party is incomplete.
  3. [Section 3.2.1, Corollary 1 (Proof 1)] The proof of the t-party correlation robustness assumption applies Definition 1 with c_j = a_j XOR [b^1_j.s^1] XOR ... XOR [b^{t-2}_j.s^{t-2}] as though these were fixed constants, but they are random and correlated through s^1,...,s^{t-2}. The conclusion is salvageable by conditioning on the realized values of c_j before sampling s^{t-1}, since s^{t-1} is independent; however, the argument as written is not a valid direct application. Please rewrite the proof with the conditioning step, or explicitly state the t-party version as a new assumption and justify its plausibility separately.
  4. [Section 4.4, Correctness] The correctness argument states that C^i_j[v[j]]=E^i_j[v[j]]=C^{i+1}_j[v[j]] holds if and only if x in X_i intersection X_{i+1}. This is inaccurate: the equality at step i depends only on whether x in X_i (so D^i_j[v[j]]=0), not on membership of x in X_{i+1}; the receiver's choice bits s_{i+1} affect C^{i+1} only through D^i_j[v[j]]. The transitivity conclusion for the full intersection can still be obtained, but the intermediate condition should be corrected and the proof written carefully to avoid the wrong 'iff'.
minor comments (6)
  1. [Section 3.2.1, Definition 1] The symbol n is overloaded (hash input length vs number of parties); use a distinct symbol and clarify that in the protocol H_2's input length is omega.
  2. [Section 5, Proof 3, Hybrid 2 and Section 6.1.1] The threshold parameter is d in Corollary 1 but is written as lambda in 'fewer than lambda 1's' and in the binomial probability expression; use consistent notation.
  3. [Section 4.4, Correctness] 'let v=F_k(H1(x)' is missing a closing parenthesis, and the claimed equivalence 'C^i_j[v[j]]=E^i_j[v[j]]=C^{i+1}_j[v[j]] iff x in X_i intersection X_{i+1}' is inaccurate; the equality at step i depends on membership of x in X_i, not on X_{i+1}.
  4. [Section 3.4.1, Definition 2] The two simulator conditions are swapped or garbled: S_2 is used for a generic P_i but the text says 'for i in [2,n], S_1(...)' for the leader. Rewrite the definition to distinguish the leader-corruption simulator from the assistant-corruption simulator.
  5. [Section 1.2, Contribution] The claim 'for the first time propose the MPSI protocol with the ring topology alone' should be reconciled with the acknowledgment that Kavousi et al. introduced a ring/wheel structure; clarify the distinction between ring-only and star+wheel topologies.
  6. [Tables 2 and 3] Some numeric entries appear as run-together strings (e.g., '1434212', '2754213', '5388214', '10398215', '20559216', '44400217', '88472218', '176370219', '371039220'); check the formatting.

Circularity Check

0 steps flagged · score 0.0 of 10

No input-output circularity: the protocol's derivation reduces to standard assumptions and independent benchmarks, though Theorem 1's proof contains a non-circular correctness gap in Lemma 1.

full rationale

The paper's claimed derivation chain is not circular. MP-SOPRF and the ring-topology MPSI are constructed directly from ROT/OT, hash functions, and input-dependent matrices D^i; the O(N) per-party complexity is read off the construction (Section 6.1.3), and the 74.8% communication reduction and 6% to 287% computation improvements are measured against KMPRT and NTY in Tables 2-4, not fitted to the target claims. The security proof (Proofs 2-3) is a standard simulator/hybrid argument whose only cryptographic assumption is the Hamming correlation robustness notion from [15,16]; the t-party form is explicitly proved as Corollary 1 by induction from Definition 1, so it is not a new assumption smuggled in as a conclusion. Lemma 1 and Lemma 2 are attributed to [16] (Chase-Miao), not to the present authors, so no self-citation chain is load-bearing. One non-circular proof concern should be flagged: Lemma 1 as stated is false, because Step 4 sets D^i_j[v[j]]=0 for every x in X_i, so for any x in X_n\I that also lies in some X_i with i<n, the sequence D^i_1[v[1]],...,D^i_w[v[w]] is all zero and the 'at least d ones' event fails with probability 1; Hybrid 4 of Proof 2 and Hybrid 2 of Proof 3 inherit this gap. This is a correctness/repair issue, not a reduction of the protocol's outputs to its inputs, so it does not constitute circularity.

Assumptions & free parameters 5 free parameters · 6 assumptions · 0 invented entities

The protocol's security rests primarily on the new t-party Hamming correlation robustness assumption and on the standard semi-honest OT/PRF machinery. The parameters m, w, d, ell_1, ell_2 are chosen from security considerations rather than fitted to empirical outputs. No new physical or conceptual entities are introduced beyond the MP-SOPRF protocol primitive itself.

free parameters (5)
  • m = N (set size upper bound)
    Number of rows in the D/A/C matrices; set to N following prior MP-OPRF. It is a protocol sizing choice, not fitted to measured data.
  • w = computed from binomial tail
    Number of OT columns/instances; chosen so that any non-member element yields at least d one-positions in each D^i with all but negligible probability (Section 6.1.1).
  • d = unspecified threshold
    Minimum Hamming weight required by the correlation-robustness assumption. No concrete value is given, and the security proof treats it as an abstract parameter.
  • ell_1 = 2*lambda
    Output length of H1 chosen for collision resistance against birthday attacks (Section 6.1.2).
  • ell_2 = sigma + 2 log N
    Output length of H2 chosen to make false-positive matches negligible (Section 6.1.2).
assumptions (6)
  • standard math F is a pseudorandom function
    Used in Lemma 1 and Theorem 1 to make the positions v=F_k(H1(x)) behave as random for distinct inputs.
  • standard math H1 is collision resistant
    Invoked in Hybrid3/Proof 3 to justify aborting on H1 collisions with negligible probability.
  • ad hoc to paper H2 satisfies t-party d-Hamming correlation robustness
    New assumption introduced in Definition 1/Corollary 1; it is the main security anchor for pseudorandomness of non-intersection OPRF values.
  • standard math OT and ROT are secure in the semi-honest model
    Used throughout the protocol construction and in the simulator arguments in Proof 2 and Proof 3.
  • domain assumption The leader does not collude with any assistant
    Explicitly stated in Section 3.4.1 as a standard condition; the security proof splits into leader-corrupted and assistants-corrupted cases.
  • domain assumption All parties share the PRF key k and know the set-size upper bound N
    Figure 7 Step 2 requires a shared key k, and parties pad sets to equal size N. The paper does not deeply discuss why sharing k preserves OPRF hiding, though the matrices D^i appear to make k non-sensitive.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Communication Efficient Multiparty Private Set Intersection from Multi-Point Sequential OPRF." pith.science (2026). https://pith.science/paper/LOTB7RTC

@misc{pith2026250600566,
  author       = {Pith},
  title        = {Pith review of: Communication Efficient Multiparty Private Set Intersection from Multi-Point Sequential OPRF},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LOTB7RTC}},
  note         = {Machine review of arXiv:2506.00566}
}
read the original abstract

Multiparty private set intersection (MPSI) allows multiple participants to compute the intersection of their locally owned data sets without revealing them. MPSI protocols can be categorized based on the network topology of nodes, with the star, mesh, and ring topologies being the primary types, respectively. Given that star and mesh topologies dominate current implementations, most existing MPSI protocols are based on these two topologies. However, star-topology MPSI protocols suffer from high leader node load, while mesh topology protocols suffer from high communication complexity and overhead. In this paper, we first propose a multi-point sequential oblivious pseudorandom function (MP-SOPRF) in a multi-party setting. Based on MP-SOPRF, we then develop an MPSI protocol with a ring topology, addressing the challenges of communication and computational overhead in existing protocols. We prove that our MPSI protocol is semi-honest secure under the Hamming correlation robustness assumption. Our experiments demonstrate that our MPSI protocol outperforms state-of-the-art protocols, achieving a reduction of 74.8% in communication and a 6% to 287% improvement in computational efficiency.

Figures

Figures reproduced from arXiv: 2506.00566 by the authors.

Figure 1
Figure 1. Network Topologies of MPSI Within existing MPSI protocols, there are primarily three types of topological structures from a communication model perspective, namely, star topology, mesh topology, and ring topology 1 , as depicted in [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Ideal functionality for Oblivious Transfer [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Ideal functionality for Random Oblivious Transfer [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: Ideal functionality for MPSI FMPSI 3.4.1. Adversary model. In the semi-honest security model, the adversary will adhere to all protocol specifications while attempting to maximize its understanding of the informa￾tion it observes. The adversary’s goal is to gather deta…
Figure 5
Figure 5. Figure 5: Ideal functionality for MP-SOPRF FMP-SOPRF long as the data used belongs to the OT sender, the computed results will match the values in M0 at the corresponding positions. Thus, when identifying intersections, the OT sender (who acts as the PSI receiver in PSI protocol…
Figure 6
Figure 6. Figure 6: Overview of our MPSI protocol without revealing any information beyond the common in￾tersection among the parties. We consider P1 as the leader party that gets the intersected set. we describe the flow of our protocol in [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]
Figure 7
Figure 7. Figure 7: Our multiparty private set intersection protocol [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]
Figure 8
Figure 8. Figure 8: The instantiated using random OT in Step 6 [PITH_FULL_IMAGE:figures/full_fig_p007_8.png]
Figure 10
Figure 10. Figure 10: Comparison of MPSI protocols under different data set sizes in LAN setting [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]
Figure 11
Figure 11. Figure 11: Comparison of MPSI protocols under different data set sizes in WAN setting [PITH_FULL_IMAGE:figures/full_fig_p010_11.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

41 extracted references · 37 canonical work pages

  1. [1]

    Multi-party private set intersection in vertical fed- erated learning,

    L. Lu and N. Ding, “Multi-party private set intersection in vertical fed- erated learning,” in2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom). IEEE, 2020, pp. 707–714

    work page 2020

  2. [2]

    Privacy-preserving integration of medical data: a practical multiparty private set intersection,

    A. Miyaji, K. Nakasho, and S. Nishida, “Privacy-preserving integration of medical data: a practical multiparty private set intersection,”Journal of medical systems, vol. 41, pp. 1–10, 2017

    work page 2017

  3. [3]

    Practical multi-party private set intersection from symmetric-key tech- niques,

    V . Kolesnikov, N. Matania, B. Pinkas, M. Rosulek, and N. Trieu, “Practical multi-party private set intersection from symmetric-key tech- niques,” inProceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, 2017, pp. 1257–1272

    work page 2017

  4. [4]

    Efficient scalable multiparty private set-intersection via garbled bloom filters,

    R. Inbar, E. Omri, and B. Pinkas, “Efficient scalable multiparty private set-intersection via garbled bloom filters,” inInternational conference on security and cryptography for networks. Springer, 2018, pp. 235– 252

    work page 2018

  5. [5]

    Sok: Collusion-resistant multi-party private set intersections in the semi-honest model,

    J. V os, M. Conti, and Z. Erkin, “Sok: Collusion-resistant multi-party private set intersections in the semi-honest model,”Cryptology ePrint Archive, 2023, unpublished

    work page 2023

  6. [6]

    Multi-party private set inter- section protocols for practical applications,

    A. Bay, Z. Erkin, M. Alishahi, and J. V os, “Multi-party private set inter- section protocols for practical applications,” in18th International Con- ference on Security and Cryptography, SECRYPT 2021. SciTePress, 2021, pp. 515–522

    work page 2021

  7. [7]

    Practical multi-party private set intersection protocols,

    A. Bay, Z. Erkin, J.-H. Hoepman, S. Samardjiska, and J. V os, “Practical multi-party private set intersection protocols,”IEEE Transactions on Information Forensics and Security, vol. 17, pp. 1–15, 2021

    work page 2021

  8. [8]

    Fast multi-party private set operations in the star topology from secure ands and ors,

    J. V os, M. Conti, and Z. Erkin, “Fast multi-party private set operations in the star topology from secure ands and ors,”Cryptology ePrint Archive, 2022, unpublished

    work page 2022

Show all 41 references
  1. [9]

    Efficient linear multiparty psi and extensions to cir- cuit/quorum psi,

    N. Chandran, N. Dasgupta, D. Gupta, S. L. B. Obbattu, S. Sekar, and A. Shah, “Efficient linear multiparty psi and extensions to cir- cuit/quorum psi,” inProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021, pp. 1182–1204

    2021

  2. [10]

    Obliv- ious key-value stores and amplification for private set intersection,

    G. Garimella, B. Pinkas, M. Rosulek, N. Trieu, and A. Yanai, “Obliv- ious key-value stores and amplification for private set intersection,” inAdvances in Cryptology–CRYPTO 2021: 41st Annual International Cryptology Conference, CRYPTO 2021, Virtual Event, August 16–20, 2021, Pr...

    2021

  3. [11]

    Simple, fast malicious multiparty private set intersection,

    O. Nevo, N. Trieu, and A. Yanai, “Simple, fast malicious multiparty private set intersection,” inProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021, pp. 1151–1165

    2021

  4. [12]

    Efficient scalable multi-party private set intersection using oblivious prf,

    A. Kavousi, J. Mohajeri, and M. Salmasizadeh, “Efficient scalable multi-party private set intersection using oblivious prf,” inSecurity and Trust Management: 17th International Workshop, STM 2021, Darmstadt, Germany, October 8, 2021, Proceedings 17. Springer, 2021, pp. 81–99

    2021

  5. [13]

    Efficient batched oblivious prf with applications to private set intersection,

    V . Kolesnikov, R. Kumaresan, M. Rosulek, and N. Trieu, “Efficient batched oblivious prf with applications to private set intersection,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 2016, pp. 818–829

    2016

  6. [14]

    A more efficient cryptographic matchmaking protocol for use in the absence of a continuously available third party,

    C. Meadows, “A more efficient cryptographic matchmaking protocol for use in the absence of a continuously available third party,” in1986 IEEE Symposium on Security and Privacy. IEEE, 1986, pp. 134–134

    1986

  7. [15]

    Spot-light: lightweight private set intersection from sparse ot extension,

    B. Pinkas, M. Rosulek, N. Trieu, and A. Yanai, “Spot-light: lightweight private set intersection from sparse ot extension,” in Advances in Cryptology–CRYPTO 2019: 39th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 18–22, 2019, Proceedings, Part III...

    2019

  8. [16]

    Private set intersection in the internet setting from lightweight oblivious prf,

    M. Chase and P. Miao, “Private set intersection in the internet setting from lightweight oblivious prf,” inAdvances in Cryptology–CRYPTO 2020: 40th Annual International Cryptology Conference, CRYPTO 2020, Santa Barbara, CA, USA, August 17–21, 2020, Proceedings, Part III 40. Sp...

    2020

  9. [17]

    V ole-psi: fast oprf and circuit-psi from vector-ole,

    P. Rindal and P. Schoppmann, “V ole-psi: fast oprf and circuit-psi from vector-ole,” inAnnual International Conference on the Theory and Applications of Cryptographic Techniques. Springer, 2021, pp. 901–930

    2021

  10. [18]

    Blazing fast psi from improved okvs and subfield vole,

    S. Raghuraman and P. Rindal, “Blazing fast psi from improved okvs and subfield vole,” inProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, 2022, pp. 2505–2517

    2022

  11. [19]

    Private set intersection from pseudorandom correlation generators

    D. Bui and G. Couteau, “Private set intersection from pseudorandom correlation generators.”IACR Cryptol. ePrint Arch., vol. 2022, p. 334, 2022, unpublished

    2022

  12. [20]

    Keyword search and oblivious pseudorandom functions,

    M. J. Freedman, Y . Ishai, B. Pinkas, and O. Reingold, “Keyword search and oblivious pseudorandom functions,” inTheory of Cryptog- raphy: Second Theory of Cryptography Conference, TCC 2005, Cam- bridge, MA, USA, February 10-12, 2005. Proceedings 2. Springer, 2005, pp. 303–324

    2005

  13. [21]

    Privacy-preserving set operations,

    L. Kissner and D. Song, “Privacy-preserving set operations,” in Annual International Cryptology Conference. Springer, 2005, pp. 241–257

    2005

  14. [22]

    An unconditionally secure protocol for multi-party set intersection,

    R. Li and C. Wu, “An unconditionally secure protocol for multi-party set intersection,” inInternational Conference on Applied Cryptography and Network Security. Springer, 2007, pp. 226–236

    2007

  15. [23]

    Information theoretically secure multi party set intersection re-visited,

    A. Patra, A. Choudhary, and C. P. Rangan, “Information theoretically secure multi party set intersection re-visited,” inInternational Work- shop on Selected Areas in Cryptography. Springer, 2009, pp. 71–91

    2009

  16. [24]

    Round efficient unconditionally secure mpc and multiparty set intersection with optimal resilience,

    ——, “Round efficient unconditionally secure mpc and multiparty set intersection with optimal resilience,” inInternational Conference on Cryptology in India. Springer, 2009, pp. 398–417

    2009

  17. [25]

    New approach to set representation and practical private set-intersection protocols,

    O. Ruan, Z. Wang, J. Mi, and M. Zhang, “New approach to set representation and practical private set-intersection protocols,”IEEE Access, vol. 7, pp. 64 897–64 906, 2019

    2019

  18. [26]

    When private set intersection meets big data: an efficient and scalable protocol,

    C. Dong, L. Chen, and Z. Wen, “When private set intersection meets big data: an efficient and scalable protocol,” inProceedings of the 2013 ACM SIGSAC conference on Computer & communications security, 2013, pp. 789–800

    2013

  19. [27]

    Psimple: Practical multiparty maliciously-secure private set inter- section,

    A. Ben-Efraim, O. Nissenbaum, E. Omri, and A. Paskin-Cherniavsky, “Psimple: Practical multiparty maliciously-secure private set inter- section,” inProceedings of the 2022 ACM on Asia Conference on Computer and Communications Security, 2022, pp. 1098–1112

    2022

  20. [28]

    Efficient private matching and set intersection,

    M. J. Freedman, K. Nissim, and B. Pinkas, “Efficient private matching and set intersection,” inInternational conference on the theory and applications of cryptographic techniques. Springer, 2004, pp. 1–19

    2004

  21. [29]

    The communication complexity of thresh- old private set intersection,

    S. Ghosh and M. Simkin, “The communication complexity of thresh- old private set intersection,” inAnnual International Cryptology Con- ference. Springer, 2019, pp. 3–29

    2019

  22. [30]

    Multi- party threshold private set intersection with sublinear communica- tion,

    S. Badrinarayanan, P. Miao, S. Raghuraman, and P. Rindal, “Multi- party threshold private set intersection with sublinear communica- tion,” inIACR International Conference on Public-Key Cryptography. Springer, 2021, pp. 349–379

    2021

  23. [31]

    Efficient multiparty probabilistic threshold private set intersection,

    F.-H. Liu, E. Zhang, and L. Qin, “Efficient multiparty probabilistic threshold private set intersection,” inProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 2023, pp. 2188–2201

    2023

  24. [32]

    Fast database joins and psi for secret shared data,

    P. Mohassel, P. Rindal, and M. Rosulek, “Fast database joins and psi for secret shared data,” inProceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, 2020, pp. 1271–1287

    2020

  25. [33]

    Secure and efficient multiparty private set intersection cardinality

    S. K. Debnath, P. St ˇanicˇa, N. Kundu, and T. Choudhury, “Secure and efficient multiparty private set intersection cardinality.”Advances in Mathematics of Communications, vol. 15, no. 2, 2021

    2021

  26. [34]

    Accountable private set cardinality for distributed measurement,

    E. Fenske, A. Mani, A. Johnson, and M. Sherr, “Accountable private set cardinality for distributed measurement,”ACM Transactions on Privacy and Security, vol. 25, no. 4, pp. 1–35, 2022

    2022

  27. [35]

    Multiparty private set intersection cardinality and its applications

    N. Trieu, A. Yanai, and J. Gao, “Multiparty private set intersection cardinality and its applications.”IACR Cryptol. ePrint Arch., vol. 2022, p. 735, 2022

    2022

  28. [36]

    Empsi: Efficient multiparty private set intersection (with cardinality),

    Y . Yang, X. Dong, Z. Cao, J. Shen, R. Li, Y . Yang, and S. Dou, “Empsi: Efficient multiparty private set intersection (with cardinality),” Frontiers of Computer Science, vol. 18, no. 1, p. 181804, 2024

    2024

  29. [37]

    How to exchange secrets with oblivious transfer,

    M. O. Rabin, “How to exchange secrets with oblivious transfer,” Cryptology ePrint Archive, 2005, unpublished

    2005

  30. [38]

    Efficient oblivious transfer protocols

    M. Naor and B. Pinkas, “Efficient oblivious transfer protocols.” in SODA, vol. 1, 2001, pp. 448–457

    2001

  31. [39]

    Efficient multiparty protocols using circuit random- ization,

    D. Beaver, “Efficient multiparty protocols using circuit random- ization,” inAdvances in Cryptology—CRYPTO’91: Proceedings 11. Springer, 1992, pp. 420–432

    1992

  32. [40]

    Efficient multi-party private set intersection against malicious adversaries,

    E. Zhang, F.-H. Liu, Q. Lai, G. Jin, and Y . Li, “Efficient multi-party private set intersection against malicious adversaries,” inProceedings of the 2019 ACM SIGSAC conference on cloud computing security workshop, 2019, pp. 93–104

    2019

  33. [41]

    Efficient delegated pri- vate set intersection on outsourced private datasets,

    A. Abadi, S. Terzis, R. Metere, and C. Dong, “Efficient delegated pri- vate set intersection on outsourced private datasets,”IEEE Transactions on Dependable and Secure Computing, vol. 16, no. 4, pp. 608–624, 2017

    2017

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.