Secure Multiparty Computation

Three coworkers suspect they are underpaid and want to know the average salary on their team. The problem: nobody wants to tell anyone what they earn. There is no boss they trust, no neutral accountant. Can they compute the average while each salary stays a perfect secret?

It sounds like a trick question. If you keep all the inputs hidden, what is left to compute with? Yet the answer is a clean yes — this is exactly what secure multiparty computation (MPC) delivers: a group jointly evaluates a function on private inputs and learns only the result, never each other's data.

The key idea is secret sharing: each person chops their number into random-looking pieces, hands one piece to each participant, and the math reassembles into the correct total — while no single piece reveals anything at all.

Below, three parties each have a private salary. Type each value, then press Split into shares. Every salary is broken into three random shares that sum back to it. Each party keeps one share from everybody and adds up the shares it holds.

<p class="hint">{{hint}}</p>
<div class="inputs">
  <label>{{label_a}} <input id="sA" type="number" value="50000"></label>
  <label>{{label_b}} <input id="sB" type="number" value="62000"></label>
  <label>{{label_c}} <input id="sC" type="number" value="44000"></label>
</div>
<div class="btns">
  <button id="split" type="button">{{btn_split}}</button>
  <button id="reset" type="button" class="ghost">{{btn_reset}}</button>
</div>
<div id="out"></div>
<div class="status" id="status">{{status_init}}</div>

* { box-sizing: border-box; }
body { font-family: system-ui, sans-serif; color: #222; margin: 0; }
.hint { font-size: .9rem; color: #444; margin: 0 0 .7rem; line-height: 1.45; }
.inputs { display: flex; flex-direction: column; gap: .4rem; margin-bottom: .6rem; }
label { font-size: .85rem; color: #1d3557; display: flex; justify-content: space-between;
        align-items: center; gap: .6rem; font-weight: 600; }
input { font: 600 14px ui-monospace, monospace; padding: .35rem .5rem; width: 130px;
        border: 1px solid #cdd9e3; border-radius: 6px; }
.btns { display: flex; gap: .5rem; flex-wrap: wrap; margin-bottom: .6rem; }
button { font: 600 14px system-ui, sans-serif; padding: .45rem .9rem; border: 1px solid #1d3557;
         background: #1d3557; color: #fff; border-radius: 8px; cursor: pointer; }
button.ghost { background: #fff; color: #1d3557; }
table { border-collapse: collapse; width: 100%; font: 13px ui-monospace, monospace; margin: .3rem 0; }
th, td { border: 1px solid #cdd9e3; padding: .35rem .4rem; text-align: center; }
th { background: #e8eef3; color: #1d3557; }
td.secret { background: #fff4f4; color: #c92f3c; font-weight: 700; }
td.share { color: #555; }
tr.totals td { background: #eef7f0; color: #0a7d33; font-weight: 700; }
.status { font-size: 1rem; font-weight: 600; margin: .5rem 0; min-height: 1.4em; }
.status.ok { color: #0a7d33; }

// Code not found

Look at the shares: each one is a meaningless random number — knowing a single share tells you nothing about the salary it came from. Yet when the three running totals are added, the random parts cancel exactly and the true sum (and average) appears. No party ever saw another's salary, and no trusted middleman was needed.

How hard is it to compute anything this way? The headline is a solved result, and a remarkable one.

• Additive sharing (the demo) handles addition for free: shares of a sum are just the sums of shares. That alone powers private averages, totals and statistics.
• Any function at all. In 1986 Andrew Yao introduced garbled circuits for two parties, and in 1987 Goldreich, Micali and Wigderson (GMW) extended it: any computable function can be evaluated securely by a group, as long as a majority is honest. Existence is not in question.
• The real cost is communication. Multiplying secret-shared values, unlike adding them, needs rounds of messages between parties. Protocols are measured by how many rounds and how many bits they exchange — that is where the research lives.
• It composes with SAT-style hardness assumptions. Security rests on the same cryptographic foundations as the rest of modern crypto, so breaking it would mean breaking problems believed to be intractable.

So the punchline is the opposite of an impossibility article: privacy-preserving computation is provably possible for every function. The frontier is purely efficiency — shrinking the rounds and bandwidth so MPC runs at the scale of real databases.

"Compute on data we are not allowed to pool" is everywhere once you look, and MPC turns it from impossible into routine:

• Private benchmarking: companies (or coworkers) compare salaries, prices or risk without exposing their own figures — a real Danish sugar-beet auction in 2008 was the first large field use.
• Cross-institution analytics: hospitals jointly study a disease across their patients, and banks flag fraud rings that span their books, without sharing raw records.
• Threshold cryptography: a signing key is split so that no single server ever holds it, yet a quorum can still produce a signature — the backbone of modern wallet custody.
• Privacy-preserving machine learning: models train on combined datasets that none of the owners may legally share.

Each case is the salary puzzle in disguise: many parties, private inputs, one shared answer. Learn the secret-sharing trick and you have met the engine behind discrete-log based cryptography and threshold key systems alike.

Secure multiparty computation answers a question that sounds like a paradox: how can a group compute on numbers it refuses to reveal? The trick is to share secrets, not values — split each input into random pieces that mean nothing alone but recombine into the exact answer.

It is one of the satisfying corners of computer science: not an open mystery and not an impossibility, but a solved capability proven in the 1980s and now racing toward practicality. The next time you are told two parties cannot collaborate without exposing their data, remember the three coworkers and their salaries — the math says they can, and reveal nothing at all.