Three-party protocol for multiplication with output privacy Suppose this simple protocol with three parties: $X$ (with secret input $x$), $Y$ (with secret input $y$), and $Z$ (no input). Suppose that we are operating with elements from a finite field.

The goal is that after the execution of the protocol, $Z$ knows $x\cdot y$ but not $x$ nor $y$, and $X$ and $Y$ does not learn anything. This can be considered similar to output privacy in secure multiparty computation. It is clear why we need output privacy: if $X$ learns $x\cdot y$, he can compute $y$ (and viceversa). 

An initial approach could be based in using blinding factors. $X$ gives $b\cdot x$ to $Y$ and $b$ to $Z$, for a randomly sampled $b$; next, $Y$ gives $(b\cdot x)\cdot y$ to $Z$; and finally, $Z$ removes $b$ to obtain $x\cdot y$. This solution assumes that all parties are honest.

Any other ideas or references on how to come up with better solutions? I'm sure that similar problems should have been already tackled by the SMC community.
First, I'll assume that parties' inputs come from a multiplicative group. If they're in a ring and you also want multiplication by zero, then things get harder. In that case, the protocol you describe is not secure even in the semi-honest case.

The protocol you describe is already secure in the malicious case.  $X$ gives random $b$ to $Z$ and $bx$ to $Y$. $Y$ gives $(bx)y$ to $Z$, who computes $b^{-1}(bxy)$.


If $X$ is corrupt, he sends some $b$ to $Z$ and $c$ to $Y$. This achieves the same effect on the honest parties as running honestly with input $b^{-1} c$ in the ideal world, so it's simulatable / not an attack.
If $Y$ is corrupt, she gets $c = bx$ from $X$ and gives $d$ to $Z$. The message $c$ from $X$ is distributed uniformly, so this message is simulatable without knowing $X$'s input. Furthermore, $Y$'s behavior achieves the same effect on the honest parties as running honestly with input $d c^{-1}$, so it is simulatable / not an attack.
If $Z$ is corrupt, there's nothing he can do, since all he does is receive messages.
If $Z$ is corrupt and colludes with one of $\{X,Y\}$, then in the ideal world they can deduce the honest party's input in its entirety. So there is nothing to hide.
If $X$ and $Y$ collude, then $X$ sends $b$ to $Z$ and $Y$ sends $d$ to $Z$. This achieves the same effect on the honest party as them running honestly with inputs $1$ and $b^{-1} d$.