1. Robust Random Number Generation for Peer-to-Peer Systems Baruch Awerbuch Johns Hopkins University Christian Scheideler Technical University of Munich

2. 2Robust Random Number Generation Holy Grail of Distributed Systems Scalability and Robustness Adversarial behavior increasingly pressing issue!

3. 3Robust Random Number Generation Why is this difficult??? Scalability: minimize resources needed for operations Robustness: maximize resources needed for attack Scalable solutions seem to be easy to attack!

4. 4Robust Random Number Generation Peer-to-Peer Systems Basic problem: maintain a scalable and robust overlay network among the peers Basic operations: Join(p): peer p joins the system Join(p): peer p joins the system Leave(p): peer p leaves the system Leave(p): peer p leaves the system Challenge: implement operations so that problem solved (with high probability)

5. 5Robust Random Number Generation Basic approach Peers assigned to points in [0,1)-interval n honest peers,  n adv. peers,  <1 Adversarial peers join and leave in arbitrary adaptive manner

6. 6Robust Random Number Generation Two Central Conditions Balancing condition: only O(log n) peers in intervals of size (c log n)/n Majority condition: adv. peers in minority in all intervals of size (c log n)/n Balancing condition: scalability Majority condition: robustness via majority decision

7. 7Robust Random Number Generation How to satisfy conditions? Chord: uses cryptographic hash function to map peers to points in [0,1) randomly distributes honest peers does not randomly distribute adversarial peers

8. 8Robust Random Number Generation How to satisfy conditions? CAN: map peers to random points in [0,1)

9. 9Robust Random Number Generation How to satisfy conditions? Group spreading [AS04]: Map peers to random points in [0,1) Limit lifetime of points Too expensive!

10. 10Robust Random Number Generation How to satisfy conditions? Rule that works: k-cuckoo rule [AS06] evict k/n-region n honest  n adversarial   < 1-1/k

11. 11Robust Random Number Generation Are we done? How can we design a robust random number generator in a peer-to-peer environment? Possible solution [AS06]: use VSS Disadvantages: difficult to implement difficult to implement requires private channels requires private channels

12. 12Robust Random Number Generation Central Question Is it possible to design an elementary robust random number generator that even works for public channels and a constant fraction of adversarial peers?

13. 13Robust Random Number Generation Elementary RNG We have a dealer and m players. Simple protocol [AS04]: dealer players generate

14. 14Robust Random Number Generation Elementary RNG We have a dealer and m players. Simple protocol [AS04]: dealer players commit x1x1 x5x5 x2x2 x3x3 x4x4 h(x 1 )

15. 15Robust Random Number Generation Elementary RNG We have a dealer and m players. Simple protocol [AS04]: dealer players reveal(h(x 1 ),…,h(x 5 )) x1x1 x5x5 x2x2 x3x3 x4x4

16. 16Robust Random Number Generation Elementary RNG We have a dealer and m players. Simple protocol [AS04]: dealer players reveal(x i ) x1x1 x5x5 x2x2 x3x3 x4x4

17. 17Robust Random Number Generation Elementary RNG We have a dealer and m players. Simple protocol [AS04]: dealer players reveal(x 1,…,x 5 ) x1x1 x5x5 x2x2 x3x3 x4x4

18. 18Robust Random Number Generation Elementary RNG We have a dealer and m players. Simple protocol [AS04]: dealer players x x x x x x = © i x i

19. 19Robust Random Number Generation Elementary RNG Problems with the simple protocol: If a player is adversarial, it can let the protocol fail (though just in oblivious manner if channels are private). If the dealer is adversarial, it can adaptively let the protocol fail. Solution [AS04]: O(1/log n) fraction of adversarial nodes Quorums of  (log n) nodes Each peer has nodes in  (log n) quorums

20. 20Robust Random Number Generation Better Elementary RNG Idea: create a batch of random numbers Batch protocol: dealer players generate batch

21. 21Robust Random Number Generation Better Elementary RNG Idea: create a batch of random numbers Batch protocol: dealer players forward request P 2 = P-{p 2 }

22. 22Robust Random Number Generation Better Elementary RNG Idea: create a batch of random numbers Batch protocol: dealer players Honest players: clocks have same speed, timely msg delivery

23. 23Robust Random Number Generation Better Elementary RNG Idea: create a batch of random numbers Batch protocol: dealer players Players numbered from 1 to m

24. 24Robust Random Number Generation Better Elementary RNG Idea: create a batch of random numbers Batch protocol: dealer players Round by round, random key is generated

25. 25Robust Random Number Generation Better Elementary RNG Idea: create a batch of random numbers Batch protocol: dealer players Each round: execute elementary RNG with slight difference. h(x 1 )

26. 26Robust Random Number Generation Better Elementary RNG Idea: create a batch of random numbers Batch protocol: dealer players Each round: execute elementary RNG with slight difference. x 2,…,x 5

27. 27Robust Random Number Generation Better Elementary RNG Idea: create a batch of random numbers Batch protocol: dealer players Each round: execute elementary RNG with slight difference. x 1,…,x 5

28. 28Robust Random Number Generation Better Elementary RNG Idea: create a batch of random numbers Batch protocol: dealer players Each round: execute elementary RNG with slight difference. x = © i x i

29. 29Robust Random Number Generation Better Elementary RNG Idea: create a batch of random numbers Batch protocol: dealer players Round fails: send accusation for one player. accuse p i P 2 = P 2 – {p i }

30. 30Robust Random Number Generation Extensions of RNG There can be disagreement of who is in a set of players, as long as honest players know each other. Consecutive indexing (1 to m) is not necessary. Instead, each player may also choose random index out of sufficiently large range.

31. 31Robust Random Number Generation Elementary RNG Theorem: Suppose we have m players with t<m/6 being adversarial. Then the RNG generates random keys y 1,…,y k with m- 2t<=k<=m, s.t. for any subset S ½ {0,1} s, E[|{i | y i 2 S}|] 2 [(m-2t) ,m  ] where  = |S|/2 s. where  = |S|/2 s. So bias of RNG is  = 1+2t/(m-2t).

32. 32Robust Random Number Generation Application to Cuckoo Rule Problem: variable number of random keys evict k/n-region n honest  n adversarial

33. 33Robust Random Number Generation Application to Cuckoo Rule Solution: remap peers in comb-like fashion using just one random anchor evict k/n-region n honest  n adversarial

34. 34Robust Random Number Generation Application to Cuckoo Rule RNG: Batch of random keys. For each key, execute cuckoo rule. evict k/n-region n honest  n adversarial

35. 35Robust Random Number Generation Final Result Theorem: For any constants , k and  with  < 1/  – 1/k, the new cuckoo rule with the round-robin RNG with bias  satisfies the balancing and majority conditions for poly rounds, w.h.p., for any adversarial join- leave strategy.

36. 36Robust Random Number Generation Conclusion We extended the cuckoo rule with a simple, robust RNG that can handle arbitrary adversarial join-leave behavior, w.h.p. Open problems: Low-level DoS attacks ! Subjects-Paradigm Adversary controls join-leave behavior of adversarial and honest nodes ! IPTPS

37. 37Robust Random Number Generation Questions? SPAA 2007: Deadlines 18.12.06 / 08.01.07