Forgetting r sampling in multiplication of public number and BShare?

[n0b0dyCN]

According to the paper, the multiplication of a public number and a BShared value should first sample a random number r, but I cannot find this step in the implication. Is that step forgotten?

https://github.com/ladnir/aby3/blob/master/aby3/sh3/Sh3Evaluator.cpp#L292

[ladnir]

I believe the zeroShare works as r in the implementation https://github.com/ladnir/aby3/blob/master/aby3/sh3/Sh3Evaluator.cpp#L312

But I could be wrong. Generally, aby3 was written somewhat quickly and probably contains security bugs.

[n0b0dyCN]

According to the paper, the party plays the sender should sample a random number r to avoid the receiver revealing a[b] directly.

The purpose of zero sharing is to prevent the helper party from revealing a[b] fro m a 2-out-of-3 sharing.

without zero sharing, helper could get:
a[b] = r + a[b] -r

with zero sharing, helper could only get:
r + s1 + a[b] - r + s2

As a result, I think it is a security bug.

[ladnir]

I see, OK, I'll fix it when I get time or you can do a PR. Thanks for pointing this out.