We present a fair and optimistic quantum-contract-signing protocol between two clients that requires no communication with the third trusted party during the exchange phase. We discuss its fairness and show that it is possible to design such a protocol for which the probability of a dishonest client to cheat becomes negligible and scales as ${N}^{\ensuremath{-}1/2}$, where $N$ is the number of messages exchanged between the clients. Our protocol is not based on the exchange of signed messages: Its fairness is based on the laws of quantum mechanics. Thus, it is abuse free, and the clients do not have to generate new keys for each message during the exchange phase. We discuss a real-life scenario when measurement errors and qubit-state corruption due to noisy channels and imperfect quantum memories occur and argue that for a real, good-enough measurement apparatus, transmission channels, and quantum memories, our protocol would still be fair. Apart from stable quantum memories, the other segments of our protocol could be implemented by today's technology, as they require in essence the same type of apparatus as the one needed for the Bennett-Brassard 1984 (BB84) cryptographic protocol. Finally, we briefly discuss two alternative versions of the protocol, one that uses only two states [based on the Bennett 1992 (B92) protocol] and the other that uses entangled pairs, and show that it is possible to generalize our protocol to an arbitrary number of clients.
We present a fair and optimistic quantum-contract-signing protocol between two clients that requires no communication with the third trusted party during the exchange phase. We discuss its fairness and show that it is possible to design such a protocol for which the probability of a dishonest client to cheat becomes negligible and scales as N\ensuremath−1/2, where N is the number of messages exchanged between the clients. Our protocol is not based on the exchange of signed messages: Its fairness is based on the laws of quantum mechanics. Thus, it is abuse free, and the clients do not have to generate new keys for each message during the exchange phase. We discuss a real-life scenario when measurement errors and qubit-state corruption due to noisy channels and imperfect quantum memories occur and argue that for a real, good-enough measurement apparatus, transmission channels, and quantum memories, our protocol would still be fair. Apart from stable quantum memories, the other segments of our protocol could be implemented by today's technology, as they require in essence the same type of apparatus as the one needed for the Bennett-Brassard 1984 (BB84) cryptographic protocol. Finally, we briefly discuss two alternative versions of the protocol, one that uses only two states [based on the Bennett 1992 (B92) protocol] and the other that uses entangled pairs, and show that it is possible to generalize our protocol to an arbitrary number of clients.
We present a quantum scheme for signing contracts between two clients (Alice and Bob) using entangled states and the services of a third trusted party (Trent). The trusted party is only contacted for the initialization of the protocol, and possibly at the end, to verify clients’ honesty and deliver signed certificates. The protocol is fair, i.e., the probability that a client, say Bob, can obtain a signed copy of the contract, while Alice cannot, can be made arbitrarily small, and scales as N − 1 / 2 , where 4 N is the total number of rounds (communications between the two clients) of the protocol. Thus, the protocol is optimistic, as cheating is not successful, and the clients rarely have to contact Trent to confirm their honesty by delivering the actual signed certificates of the contract. Unlike the previous protocol (Paunković et al., Phys. Rev. A 84, 062331 (2011)), in the present proposal, a single client can obtain the signed contract alone, without the need for the other client’s presence. When first contacting Trent, the clients do not have to agree upon a definitive contract. Moreover, even upon terminating the protocol, the clients do not reveal the actual contract to Trent. Finally, the protocol is based on the laws of physics, rather than on mathematical conjectures and the exchange of a large number of signed authenticated messages during the actual contract signing process. Therefore, it is abuse-free, as Alice and Bob cannot prove they are involved in the contract signing process.
A fair contract-signing protocol allows two potentially mistrusted parities to exchange their commitments (i.e., digital signatures) to an agreed contract over the Internet in afairway, so that either each of them obtains the other's signature, or neither party does. Based on the RSA signature scheme, a new digital contract-signing protocol is proposed in this paper. Like the existing RSA-based solutions for the same problem, our protocol is not only fair, but also optimistic, since the trusted third party is involved only in the situations where one party is cheating or the communication channel is interrupted. Furthermore, the proposed protocol satisfies a new property-abuse-freeness. That is, if the protocol is executed unsuccessfully, none of the two parties can show the validity of intermediate results to others. Technical details are provided to analyze the security and performance of the proposed protocol. In summary, we present the first abuse-free fair contract-signing protocol based on the RSA signature, and show that it is both secure and efficient.
Coin flipping is a cryptographic primitive in which two spatially separated players, who do not trust each other, wish to establish a common random bit. If we limit ourselves to classical communication, this task requires either assumptions on the computational power of the players or it requires them to send messages to each other with sufficient simultaneity to force their complete independence. Without such assumptions, all classical protocols are so that one dishonest player has complete control over the outcome. If we use quantum communication, on the other hand, protocols have been introduced that limit the maximal bias that dishonest players can produce. However, those protocols would be very difficult to implement in practice because they are susceptible to realistic losses on the quantum channel between the players or in their quantum memory and measurement apparatus. In this paper, we introduce a quantum protocol and we prove that it is completely impervious to loss. The protocol is fair in the sense that either player has the same probability of success in cheating attempts at biasing the outcome of the coin flip. We also give explicit and optimal cheating strategies for both players.
Consider a scenario in which one party A consisting of a number of manufactories would like to sign a contract with another party B who is a selling company so that they can unify prices to avoid over competition. This may be done via Internet to reduce travelling cost. To cater for such applications, we propose the concept of optimistic fair exchange of distributed signatures (OFEDS) which allows an authorized set of signers to fairly exchange signatures with a verifier, and a trusted arbitrator will intervene in the protocol only when there are disputes between two parties. We consider the security requirements for OFEDS, in which besides the standard security requirements for existing optimistic fair exchange protocols, robustness is introduced to ensure that OFEDS can be successfully performed even when there exist some dishonest signers. We instantiate a non-interactive construction of OFEDS based on the Computational Diffie-Hellman (CDH) assumption in the random oracle model. Our work shows that for any general monotone access structure, there exists a CDH-based OFEDS protocol if all the involved signers are honest.
Two parties, A and B, want to sign a contract C over a communication network. To do so, they must simultaneously exchange their commitments to C. Since simultaneous exchange is usually impossible in practice, protocols are needed to approximate simultaneity by exchanging partial commitments in piece-by-piece manner. During such a protocol, one party or another may have a slight advantage; a fair protocol keeps this advantage within acceptable limits. A new protocol is proposed. It is fair in the sense that, at any stage in its execution, the conditional probability that one party cannot commit both parties to the contract given that the other party can, is close to zero. This is true even if A and B have vastly different computing powers and is proved under very weak cryptographic assumptions.>
Abstract. Protocol for fair exchange of digital signatures is essential in many applications including contract signing, electronic commerce, or even peer-to-peer file sharing. In such a protocol, two parties, Alice and Bob, would like to exchange digital signatures on some messages in a fair way. It is known that a trusted arbitrator is necessary in the realization of such a protocol. We identify that in some scenarios, it is required that prior to the completion of the protocol, no observer should be able to tell whether Alice and Bob are conducting such an exchange. Consider the following scenario in which Apple engages Intel in an exchange protocol to sign a contract that terminates their OEM agreement. The information would be of value to a third party (such as the stock broker, or other OEM companies). If the protocol transcript can serve as an evidence that such a communication is in progress, any observer of this communication, including the employees of both companies, would be tempted to capture the transcript and sell it to outsiders. We introduce a new notion called perfect ambiguous optimistic fair exchange (PAOFE), which is particularly suitable to the above scenario. PAOFE fulfils all traditional requirements of cryptographic fair exchange of digital signatures and, in addition, guarantees that the communication transcript cannot be used as a proof to convince others that the protocol is in progress. Specifically, we formalize the notion of PAOFE and present a rigorous security model in the multi-user setting under the chosen-key attack. We also present a generic construction of PAOFE from existing cryptographic primitives and prove that our proposal is secure with respect to our definition in the standard model. 1