Capstok — learn by doing

Why this matters

A protocol is only 'secure' in the threat model it was designed for. Semi-honest (aka honest-but-curious) means parties follow the protocol exactly but try to learn extra from the transcript — this is a weak assumption useful when participants have business incentives not to cheat. Malicious means parties can deviate arbitrarily — send wrong messages, abort mid-round, collude. Covert is a middle ground: a cheater gets caught with probability at least 1/2 but not always. Production MPC almost always targets malicious security today because semi-honest schemes catastrophically fail against a single dishonest input.

Demo

Watch a naive additive-sharing reconstruction collapse against one malicious party. In semi-honest land this code is 'correct' and hilariously wrong under the first lie.

Try it yourself

Run the honest case 10 times. Notice the shares are different every time because of randomness, but the reconstruction is always 42. This is the linearity property additive sharing gives you for free.
Modify the malicious case: instead of party 3 adding 1000, have party 1 subtract 500 AND party 2 add 500. The reconstruction stays at 42 — silent cancellation. Threat models need to account for colluding minorities, not just solo cheaters.
Attempt to detect cheating with just the data available. You can't, without external info. Write one paragraph explaining what extra information (MAC? hash? ZK proof?) would let you catch this.
List three real-world systems where semi-honest security is genuinely fine and three where it would be malpractice. Think about who the participants are and what their incentives are.

Prompt your AI

Use these three in order. Each builds on the one before.

1. Basics & terminology

In plain language, explain the three MPC threat models (semi-honest, malicious, covert). Give one concrete, plausible scenario where each is the right assumption and one where it's reckless.

2. Why it works (the mechanism)

Walk me through how a single malicious party can break a semi-honest additive-sharing reconstruction. What changes in the protocol — specifically, what extra messages or authenticators — do you need to upgrade it to malicious security? Name the cryptographic objects involved, not just 'add MACs'.

3. Advanced — application & what's next

I'm designing an MPC protocol for [describe the deployment — e.g. a consortium of 5 banks running AML checks]. The parties are under contract and subject to audits. Given these non-cryptographic controls, argue for or against picking semi-honest security. What's my blast radius if a single bank goes rogue, and does contract law actually close the gap?

References

# Three parties hold additive shares of a secret x such that s1+s2+s3 = x mod p.
# Semi-honest reconstruction: every party sends their share, sum them up.
P = 2**127 - 1  # large prime

def additive_share(x: int, n: int = 3) -> list[int]:
    import secrets
    shares = [secrets.randbelow(P) for _ in range(n - 1)]
    shares.append((x - sum(shares)) % P)
    return shares

def reconstruct(shares: list[int]) -> int:
    return sum(shares) % P

# Honest case: works perfectly.
true_secret = 42
shares = additive_share(true_secret)
print("honest:", reconstruct(shares))  # -> 42

# MALICIOUS CASE: party 3 lies and sends shares[2] + 1000.
shares[2] = (shares[2] + 1000) % P
print("malicious:", reconstruct(shares))  # -> 1042, a silent, undetected forgery.
# Nobody can tell who lied, and nobody even knows the result is wrong.
# This is why real protocols ship MACs or ZK proofs.

Run: python3 main.py

Threat models: semi-honest, malicious, covert