> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stoffelmpc.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Protocol papers
> Research foundations for the MPC and distributed-systems protocols used by Stoffel.
Use this map to understand which research constructions underlie Stoffel's protocol families and which part of each construction is relevant to an application. A paper association identifies protocol lineage; it does not mean every theorem in that paper applies unchanged to the complete deployed system.
Read the [security and fault model](./security-model) for deployment assumptions and [protocol costs](./protocol-costs) for phase-specific costs.
## Core Stoffel protocol papers
| Stoffel capability | Research foundation | What it contributes | Scope for advanced users |
| -------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| HoneyBadgerMPC preprocessing and online arithmetic | HoneyBadgerMPC and AsynchroMix \[1] | Random and double sharing, batch reconstruction, triple generation, masked input, multiplication, and robust online computation | Primary reference for the field-arithmetic backend. Its optimistic preprocessing and robust online phases have different liveness properties. The AsynchroMix application is not part of the backend. |
| Fixed-point multiplication, truncation, and public-constant division | Catrina and Saxena \[8] | Secret fixed-point representation, random masks, probabilistic truncation, and arithmetic building blocks | The paper's protocols use a semi-honest model. Use Stoffel's active-fault protections only within the limits described in the security model. |
| AVID-style reliable broadcast | Cachin and Tessaro \[3] | Erasure-coded dispersal, Merkle commitment, and asynchronous reliable delivery | Relevant when Stoffel uses coded reliable broadcast. Erasure coding reduces payload replication but does not make the payload secret. |
| Asynchronous binary agreement and common subset | HoneyBadgerBFT \[4] and Mostefaoui, Moumen, and Raynal \[16] | Randomized binary agreement, threshold-signature common coin, and common-subset composition | These are available distributed building blocks. They are not automatically part of every preprocessing or arithmetic operation. |
| hbACSS | Yurek et al. \[2] | Robust asynchronous sharing of many secrets | Stoffel includes Pedersen commitment support associated with this work, not the complete hbACSS protocol. Do not assume hbACSS throughput or liveness for the AVSS backend. |
## Secret sharing and multiplication foundations
| Stoffel primitive | Research foundation | Security boundary | |
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Degree-`t` polynomial shares | Shamir, *How to Share a Secret* \[9] | Provides information-theoretic privacy against fewer than the reconstruction threshold when coefficients are random. Bare Shamir sharing does not verify a malicious dealer. | |
| Feldman coefficient commitments | Feldman, *A Practical Scheme for Non-interactive Verifiable Secret Sharing* \[10] | Lets parties verify share consistency. Commitments are not hiding and allow guesses of low-entropy secrets to be tested. | |
| Pedersen polynomial commitments | Pedersen, *Non-Interactive and Information-Theoretic Secure Verifiable Secret Sharing* \[11] | Adds hiding with random blindings when generators are correctly set up with an unknown discrete-log relation. Stoffel's primitive is a commitment helper, not a complete network VSS protocol. | |
| Beaver multiplication | Beaver, *Efficient Multiparty Protocols Using Circuit Randomization* \[12] | Converts a fresh correlated triple into an online multiplication by opening masked differences. Security requires a correct triple used once. | |
| Product resharing and degree reduction | Ben-Or, Goldwasser, and Wigderson \[15] | Explains the algebraic pattern of resharing local products and reducing polynomial degree | Algebraic ancestry does not by itself prove that a dealer's claimed product is correct. Active security needs a relation check or an appropriate triple-generation protocol. |
## Reconstruction and coding foundations
| Stoffel primitive | Research foundation | Role | |
| ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Reed–Solomon sharing and error correction | Reed and Solomon, *Polynomial Codes Over Certain Finite Fields*; Gao \[6] | Polynomial evaluations encode shares; decoding recovers a polynomial in the presence of erasures or bounded errors. | |
| Online error correction | Choudhury, Hirt, and Patra \[7] | Provides the asynchronous online-error-correction lineage used by robust reconstruction | Association with the decoder does not imply Stoffel implements that paper's complete MPC protocol. |
| Fast-transform interpolation | Source-cited FNT reference \[5] and Soro–Lacan \[17] | Provides related fast polynomial/coding constructions | The original source URL is unavailable. Soro–Lacan is listed as related work rather than silently substituted. Concrete runtime depends on the decoder actually used. |
## Distributed-systems foundations
| Stoffel primitive | Research foundation | Role and limit |
| ---------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| INIT/ECHO/READY reliable broadcast | Bracha, *Asynchronous Byzantine Agreement Protocols* \[13] | Provides agreement and conditional totality for one dealer's value. It does not guarantee delivery when a malicious dealer never starts. |
| Asynchronous common subset | Ben-Or, Kelmer, and Rabin, *Asynchronous Secure Computations with Optimal Resilience* (PODC 1994), as referenced by HoneyBadgerBFT \[4] | Combines one reliable broadcast and one binary agreement per proposer to agree on an available subset. |
| Threshold-signature common coin | Boldyreva, *Threshold Signatures, Multisignatures and Blind Signatures Based on the Gap-Diffie-Hellman-Group Signature Scheme* (PKC 2003), as referenced by HoneyBadgerBFT \[4] | Supplies the threshold-signature lineage for randomized agreement. A centralized trusted dealer is setup, not distributed key generation. |
| Limits of deterministic asynchronous consensus | Fischer, Lynch, and Paterson \[14] | Explains why asynchronous agreement uses randomized expected termination rather than a deterministic fixed deadline. |
## Protocol coverage
The field backend includes random sharing, random double sharing, Beaver triple generation, robust and batch reconstruction, client input/output, multiplication, random bits, probabilistic truncation, fixed-point multiplication, and division by a public constant. These components map to HoneyBadgerMPC, Shamir, Beaver, the reconstruction papers, and Catrina–Saxena as shown above.
The AVSS backend includes Feldman shares, encrypted dealing, random-share mixing, product resharing, Beaver-style online multiplication, and client input/output. These map to Shamir, Feldman, Beaver, BGW-style degree reduction, and the reliable-broadcast papers. Complete hbACSS, distributed key generation, threshold signing, and secret-divisor fixed-point division are not part of this documented backend surface.
## Sources
\[1] Lu, Yurek, Kulshreshtha, Govind, Mahadev, Kate and Miller. HoneyBadgerMPC and AsynchroMix: Practical Asynchronous MPC and its Application to Anonymous Communication (2019). [https://eprint.iacr.org/2019/883.pdf](https://eprint.iacr.org/2019/883.pdf)
\[2] Yurek, Luo, Fairoze, Kate and Miller. hbACSS: How to Robustly Share Many Secrets (2021). [https://eprint.iacr.org/2021/159.pdf](https://eprint.iacr.org/2021/159.pdf)
\[3] Cachin and Tessaro. Asynchronous Verifiable Information Dispersal (2004). [https://homes.cs.washington.edu/\~tessaro/papers/dds.pdf](https://homes.cs.washington.edu/~tessaro/papers/dds.pdf)
\[4] Miller, Xia, Croman, Shi and Song. The Honey Badger of BFT Protocols (2016). [https://eprint.iacr.org/2016/199.pdf](https://eprint.iacr.org/2016/199.pdf)
\[5] Source-cited FNT interpolation reference; original URL retained, title and authors unresolved. [https://pagespro.isae-supaero.fr/IMG/pdf/FNT\_submitted.pdf](https://pagespro.isae-supaero.fr/IMG/pdf/FNT_submitted.pdf)
\[6] Gao. A New Algorithm for Decoding Reed-Solomon Codes (2003); DOI 10.1007/978-1-4757-3789-9\_5. [https://www.math.clemson.edu/\~sgao/papers/RS.pdf](https://www.math.clemson.edu/~sgao/papers/RS.pdf)
\[7] Choudhury, Hirt and Patra. Unconditionally Secure Asynchronous Multiparty Computation with Linear Communication Complexity (ePrint 2012/517). [https://eprint.iacr.org/2012/517.pdf](https://eprint.iacr.org/2012/517.pdf)
\[8] Catrina and Saxena. Secure Computation With Fixed-Point Numbers (2010). [https://ifca.ai/pub/fc10/31\_47.pdf](https://ifca.ai/pub/fc10/31_47.pdf)
\[9] Shamir. How to Share a Secret (1979). [https://www.cs.tau.ac.il/\~bchor/Shamir.html](https://www.cs.tau.ac.il/~bchor/Shamir.html)
\[10] Feldman. A Practical Scheme for Non-interactive Verifiable Secret Sharing (1987). [https://www.cs.umd.edu/\~gasarch/TOPICS/secretsharing/feldmanVSS.pdf](https://www.cs.umd.edu/~gasarch/TOPICS/secretsharing/feldmanVSS.pdf)
\[11] Pedersen. Non-Interactive and Information-Theoretic Secure Verifiable Secret Sharing (CRYPTO 1991). [https://www.cs.cornell.edu/courses/cs754/2001fa/129.PDF](https://www.cs.cornell.edu/courses/cs754/2001fa/129.PDF)
\[12] Beaver. Efficient Multiparty Protocols Using Circuit Randomization (CRYPTO 1991). [https://doi.org/10.1007/3-540-46766-1\_34](https://doi.org/10.1007/3-540-46766-1_34)
\[13] Bracha. Asynchronous Byzantine Agreement Protocols (1987). [https://doi.org/10.1016/0890-5401(87)90054-X](https://doi.org/10.1016/0890-5401\(87\)90054-X)
\[14] Fischer, Lynch and Paterson. Impossibility of Distributed Consensus with One Faulty Process (1985). [https://groups.csail.mit.edu/tds/papers/Lynch/jacm85.pdf](https://groups.csail.mit.edu/tds/papers/Lynch/jacm85.pdf)
\[15] Ben-Or, Goldwasser and Wigderson. Completeness Theorems for Non-Cryptographic Fault-Tolerant Distributed Computation (1988). [https://www.math.ias.edu/\~avi/PUBLICATIONS/MYPAPERS/GBW88/GBW88.pdf](https://www.math.ias.edu/~avi/PUBLICATIONS/MYPAPERS/GBW88/GBW88.pdf)
\[16] Mostefaoui, Moumen and Raynal. Signature-Free Asynchronous Binary Byzantine Consensus with t \< n/3, O(n^2) Messages, and O(1) Expected Time (2015). [https://doi.org/10.1145/2785953](https://doi.org/10.1145/2785953)
\[17] Soro and Lacan. FNT-based Reed-Solomon Erasure Codes (2009 preprint; CCNC 2010). [https://arxiv.org/pdf/0907.1788](https://arxiv.org/pdf/0907.1788)