Tessera

Peter Scholl

@schollster.bsky.social

Sabine Oechsner @proofnerd.bsky.social · 8mo ago

Interested in the security of MPC implementations? Peter Scholl (@schollster.bsky.social) and I are looking for research interns to study the theory/practice gap for MPC. We can host multiple interns in Aarhus for the summer 2026. More information: mpcinthewild.github.io Help us spread the word!

MPC in the Wild is a research project that aims to study the real-world implementation security of MPC protocols, in particular, the gap between assumptions on the theory side and implementation choices made in practice.

mpcinthewild.github.io

Sabine Oechsner @proofnerd.bsky.social · 10mo ago

New paper with Vitor Pereira and Peter Scholl (@schollster.bsky.social)! We found flaws in a supposedly formally verified security proof of LPZK, leading to attacks on soundness and zk. The culprit: a mismatch between definitions in their code and the original LPZK papers. cic.iacr.org/p/2/3/24

Screenshot from CiC website:

Who Verifies the Verifiers? Lessons Learned from Formally Verified Line-Point Zero-Knowledge

Authors Sabine Oechsner, Vitor Pereira, Peter Scholl

Peter Scholl @schollster.bsky.social · last yr.

Excited to do more research on the real-world security of MPC with @proofnerd.bsky.social, thanks to this grant. We plan to hire some interns for this next summer. Congrats to all the other recipients so far, and to Zama for a smooth application process, ~1 month from announcement to notification!

Nigel Smart@smartcryptology.bsky.social · last yr.

4) Nadia Heninger @nadiaheninger.bsky.social and Miro Haller @mirohaller.bsky.social‬ (UC San Diego), 5) Sabine Oechsner @proofnerd.bsky.social‬ (VU Amsterdam) and Peter Scholl @schollster.bsky.social‬ (Aarhus University), 6) Victor Lomné (Ninja Lab)

Peter Scholl @schollster.bsky.social · last yr.

Happy our paper on the real-world security of MPC implementations is finally out! This project goes back to Frederik & Alexander's masters thesis from 2 years ago @csaudk.bsky.social, it's not easy work but hope to see more of this type of research in future.

Sabine Oechsner@proofnerd.bsky.social · last yr.

Our paper on attacking concurrent MPC implementations is finally on eprint 🎉 (And @schollster.bsky.social will present it at S&P 2025!) A summary 🧵

Marcel Keller @mkskeller.bsky.social · last yr.

Shout-out to my colleagues for the responsible disclosure of security issues in MP-SPDZ. They have been fixed in 2023.

ePrint Updates@eprint.ing.bot · last yr.

Rushing at SPDZ: On the Practical Security of Malicious MPC Implementations (Alexander Kyster, Frederik Huss Nielsen, Sabine Oechsner, Peter Scholl) ia.cr/2025/789

Abstract. Secure multi-party computation (MPC) enables parties to compute a function over private inputs while maintaining confidentiality. Although MPC has advanced significantly and attracts a growing industry interest, open-source implementations are still at an early stage, with no production-ready code and a poor understanding of their actual security guarantees. In this work, we study the real-world security of modern MPC implementations, focusing on the SPDZ protocol (Damgård et al., CRYPTO 2012, ESORICS 2013), which provides security against malicious adversaries when all-but-one of the participants may be corrupted. We identify a novel type of MAC key leakage in the MAC check protocol of SPDZ, which can be exploited in concurrent, multi-threaded settings, compromising output integrity and, in some cases, input privacy. In our analysis of three SPDZ implementations (MP-SPDZ, SCALE-MAMBA, and FRESCO), two are vulnerable to this attack, while we also uncover further issues and vulnerabilities with all implementations. We propose mitigation strategies and some recommendations for researchers, developers and users, which we hope can bring more awareness to these issues and avoid them reoccurring in future.