Adversary models and real-world applications

An MPC protocol is only secure against a certain type of attacker. Before deploying, you have to specify against whom you are protecting — that is the role of adversary models.

Semi-honest or malicious?

Two main adversary models are distinguished:

• Semi-honest (also called "honest but curious"): the corrupted party follows the protocol to the letter, but tries to spy — to learn as much as possible from the messages it sees pass by. It does not cheat, it observes.
• Malicious (or active): the corrupted party can deviate from the protocol — send fake messages, lie about its inputs, sabotage the computation to deceive the others or falsify the result.

Model	Behaviour	Cost of protection
Semi-honest	follows the protocol, but spies	lower
Malicious	can cheat and actively deviate	higher (proofs, checks)

Protecting against a malicious adversary costs far more: verification mechanisms must be added to detect cheating.

How many honest parties?

Security also depends on a threshold: the number of parties that can be corrupted without breaking the protocol. Many schemes require an honest majority (more than half the parties are trustworthy); others hold as long as a single party remains honest.

The price to pay: communication

MPC has a major practical cost: communication. The parties exchange enormous numbers of messages (shares, keys, protocol rounds), which makes computations far slower than in the clear. This is the main limit to deployment.

Very real uses

MPC is not just a theoretical curiosity. It is deployed:

Application	What MPC protects
Sealed-bid auctions	losing bids remain secret
Salary statistics	each employee's individual salary
Threshold keys	a key split among several custodians
Private key protection	a key never reassembled in one place

The example of Boston is emblematic: the city measured the gender pay gap by aggregating data from many companies, without any of them revealing its pay scale.

A complementary approach

MPC distributes the computation among several parties. Another path exists: homomorphic encryption, which allows computing directly on encrypted data without decrypting it. The two approaches complement each other — sometimes combined — to preserve privacy.

In summary

We distinguish the semi-honest adversary (follows the protocol but spies) from the malicious one (can actively cheat), the latter being more costly to counter; security depends on a threshold of honest parties. Despite a high communication cost, MPC is deployed for auctions, salary statistics, threshold keys and key protection, alongside homomorphic encryption.