Presentation on theme: "On Fair Exchange, Fair Coins and Fair Sampling Shashank Agrawal, Manoj Prabhakaran University of Illinois at Urbana-Champaign."— Presentation transcript:
On Fair Exchange, Fair Coins and Fair Sampling Shashank Agrawal, Manoj Prabhakaran University of Illinois at Urbana-Champaign
Fairness A secure multi-party protocol has properties like correctness, privacy of inputs. Fairness: An intuitive property desirable of secure protocols. Adversary cannot prevent honest parties from obtaining the output of computation, if he also obtains it. Ideal world: Functionality gives output to all the parties (or none of them). Finite two party functionalities. Input, output size does not depend on the security parameter.
Motivation Wide interest in the problem of fairness. Understanding of fundamental primitives lacking. In this work, we study the relationship between Fair Exchange, Fair Coin-flipping, Fair Random-OT. Given access to a fair primitive, can we realize another fair primitive.
Sampling functionalities A B COIN b b AB R-OT Input-less AB
Functionalities with Fair protocols COIN EXCH R-OT Any non-trivial joint distribution Cleve 1986 Zero common information X X X Our Results
Related Work Cleve 1986: No efficient protocol for fair coin- flipping. A simple fail-stop attack. Even under computational assumptions. Any functionality of interest likely not realizable. Gordon et al. showed AND, OR, Yao’s millionaire problem have fair protocol [GHKL08] Led to a flurry of results [MNS09, BOO10, GIMOS10, GK10, BLOO11, ALR13] Landscape more complicated than unfair computation E.g. no finite complete function [GIMOS10]
Functionalities with Fair protocols COIN EXCH R-OT X X X XOR Cleve 1986 Our Results
COIN functionality AB COIN b b Agreement: Alice and Bob output the same bit (if nobody corrupt). Entropy: Honest party outputs a random bit.
XOR from COIN Assume: Alice and Bob choose inputs randomly Invalid input is substituted by a default one. Agreement: Alice and Bob output the same bit. Entropy: Honest party outputs a random bit. AB XOR Theorem: Even with access to COIN, XOR can’t be realized.