1. On Fair Exchange, Fair Coins and Fair Sampling Shashank Agrawal, Manoj Prabhakaran University of Illinois at Urbana-Champaign

2. Fairness A secure multi-party protocol has properties like correctness, privacy of inputs. Fairness: An intuitive property desirable of secure protocols. Adversary cannot prevent honest parties from obtaining the output of computation, if he also obtains it. Ideal world: Functionality gives output to all the parties (or none of them). Finite two party functionalities. Input, output size does not depend on the security parameter.

3. Motivation Wide interest in the problem of fairness. Understanding of fundamental primitives lacking. In this work, we study the relationship between Fair Exchange, Fair Coin-flipping, Fair Random-OT. Given access to a fair primitive, can we realize another fair primitive.

4. AB EXCH xy yx With input Functionalities

5. Sampling functionalities A B COIN b b AB R-OT Input-less AB

6. Functionalities with Fair protocols COIN EXCH R-OT Any non-trivial joint distribution Cleve 1986 Zero common information X X X Our Results

7. Related Work Cleve 1986: No efficient protocol for fair coin- flipping. A simple fail-stop attack. Even under computational assumptions. Any functionality of interest likely not realizable. Gordon et al. showed AND, OR, Yao’s millionaire problem have fair protocol [GHKL08] Led to a flurry of results [MNS09, BOO10, GIMOS10, GK10, BLOO11, ALR13] Landscape more complicated than unfair computation E.g. no finite complete function [GIMOS10]

8. Functionalities with Fair protocols COIN EXCH R-OT X X X XOR Cleve 1986 Our Results

9. COIN functionality AB COIN b b Agreement: Alice and Bob output the same bit (if nobody corrupt). Entropy: Honest party outputs a random bit.

10. Alice Bob............

11. XOR from COIN Assume: Alice and Bob choose inputs randomly Invalid input is substituted by a default one. Agreement: Alice and Bob output the same bit. Entropy: Honest party outputs a random bit. AB XOR Theorem: Even with access to COIN, XOR can’t be realized.

12. Alice Bob COIN bb

13. Functionalities with Fair protocols COIN EXCH R-OT X X X Zero common information Our Results

14. Common Information AB XY Q Q

15. Characteristic bipartite graph 0 0 11 COIN 00 01 10 11 R-OT Zero CI1-bit CI

16. COIN from R-OT

17. Graph Products 00 01 10 11 R-OT 1- sample 0…0 R-OT n-samples 0…0...... 1…1 0 0 1 1

18. COIN from R-OT Lower-bounding the second eigenvalue of the Laplacian associated with the graph product. No matter how many samples from R-OT, the weight on edges going across is a constant.

19. Functionalities with Fair protocols COIN EXCH R-OT X X X Conclusion

20. Thank you. Questions?