Some questions about Silver about libote

[ladnir]

1. silver is indeed not secure https://eprint.iacr.org/2023/882

However, this was a recent development and the warning was there from the when silver was first released. This was because it was a very aggressive design which we were not sure of. The Silver paper also suggestion caution when using it.

There is a new construction, expand convolute codes, detailed in the link above as well. This new code was pushed to the repo today. The code have provable minimum distance (the thing that silver was conjectured to have but does not). Thats is to say, the security of silent OT/VOLE with expand convolute has strong security gurarrantees. Quasi cyclic, expand accumulate codes also have provable minimum distance.

2. getPartitions was the approach described by the original silentOT paper, https://eprint.iacr.org/2019/1159.pdf. Im not sure how wel it was detailed but should be implied if not explicitly stated.

getRegNoiseWeight is a more fine grained approach that takes as input the minimum distance of the code that is being used (eg. quasi cyclic, expand accumulate, expand convolute) and returns the required weight of the noise vector to provable prevent linear attacks (i.e. essentially all attacks that are known). This formula was first stated by the expand accumulate paper, https://eprint.iacr.org/2022/1014.

3. at this point you probably can answer this question:

slv5, slv11 => silver
QuasiCyclic => the original silentOT paper which suggestions using quasi cyclic codes https://eprint.iacr.org/2019/1159.pdf.
ExAcc5,7,... => expand accumulate codes with expantion weight 5,7,..., https://eprint.iacr.org/2022/1014. Using ExAcc no longer makes sense given expand convolute.
ExConv => expand convolute codes. The best option for performance and security.

[addingIce]

Thank you for your detailed explanation.