We present a protocol compiler of rational secret-sharing that converts any rational secret-sharing protocol to a protocol with an expected constant-round reconstruction. Our compiler can be applied to protocols for synchronous channels, and preserves a strict Nash equilibrium of the original protocol. Combining with an existing protocol, we obtain the first expected constant-round protocol that achieves a strict Nash equilibrium with the optimal coalition resilience ⌈n2⌉−1, where n is the number of players. Our compiler can be extended to one that preserves the immunity to unexpectedly behaving players. For any constant m≥1, we obtain an expected constant-round protocol that achieves a Nash equilibrium with the optimal coalition resilience ⌈n2⌉−m−1 in the presence of m unexpectedly behaving players. The protocol also achieves a strict Nash equilibrium. As a negative result, we show that if an expected constant-round protocol has immunity m>0, then it cannot achieve a strict Nash equilibrium with the coalition resilience 2. Thus, our protocol with immunity achieves the optimal coalition resilience with respect to both Nash and strict Nash equilibrium.
We present a protocol compiler of rational secret-sharing that converts any rational secret-sharing protocol to a protocol with an expected constant-round reconstruction. Our compiler can be applied to protocols for synchronous channels, and preserves a strict Nash equilibrium of the original protocol. Combining with an existing protocol, we obtain the first expected constant-round protocol that achieves a strict Nash equilibrium with the optimal coalition resilience ⌈n2⌉−1, where n is the number of players. Our compiler can be extended to one that preserves the immunity to unexpectedly behaving players. For any constant m≥1, we obtain an expected constant-round protocol that achieves a Nash equilibrium with the optimal coalition resilience ⌈n2⌉−m−1 in the presence of m unexpectedly behaving players. The protocol also achieves a strict Nash equilibrium. As a negative result, we show that if an expected constant-round protocol has immunity m>0, then it cannot achieve a strict Nash equilibrium with the coalition resilience 2. Thus, our protocol with immunity achieves the optimal coalition resilience with respect to both Nash and strict Nash equilibrium.
We present a general construction of a rational secret-sharing protocol that converts any rational secret-sharing protocol to a protocol with an expected constant-round reconstruction. Our construction can be applied to protocols for synchronous channels, and preserves a strict Nash equilibrium of the original protocol. Combining with an existing protocol, we obtain the first expected constant-round protocol that achieves a strict Nash equilibrium with the optimal coalition resilience ⌈n2 ⌉ − 1, where n is the number of players. Our construction can be extended to a construction that preserves the immunity to unexpectedly behaving players. Then, for any constantm ≥ 1, we obtain an expected constant-round protocol that achieves a Nash equilibrium with the optimal coalition resilience ⌈n2 ⌉ −m − 1 in the presence of m unexpectedly behaving players. The same protocol also achieves a strict Nash equilibrium with coalition resilience 1. We show that our protocol with immunity achieves the optimal coalition resilience among constant-round protocols with immunity with respect to both Nash and strict Nash equilibria.
Most rational secret sharing protocols aim to achieve a more appealing equilibrium or resist adversaries. However, all previous protocols achieve resilience against irrational adversaries at the cost of inducing a weak guarantee of Nash equilibrium surviving iterated deletion, which has been proved weaker than strict Nash equilibrium. Moreover, they achieve equilibrium in a computational way based on the computational limitations of adversaries. In this paper, we design two unconditionally secure rational (t, n) secret sharing protocols. Contrary to prior works, our protocols induce an enhanced notion of strict equilibrium with respect to adversary structure A, and resist the computationally unbounded and adaptive adversary without using cryptographic primitives. Our protocols achieve stronger stability, since rational players have an incentive not to deviate no matter how the adversary behaves, and they are immune to the backward induction. Our protocols are secure against the adversary corrupting less than [n/3] players and the adversary corrupting less than [n/2]-1 players respectively. Both of them achieve utility independence.
We propose cryptographic rational secret sharing protocols over general networks. In a general network, the dealer may not have direct connections to each player, and players may not have direct connections to each of the other players. We present conditions on the network topology for which our proposed protocols are computational strict Nash equilibria and (k−1)-resilient, along with analysis on their round and communication complexity. We also present new notions of equilibria such as Φ-resilient computational Nash equilibria, whereby a protocol is resilient to coalitions that satisfy conditions in Φ, regardless of the coalition’s size. We also propose (n−1)-key leakage-tolerant equilibria applicable to cryptographic protocols involving secret keys, whereby the equilibrium holds even if some players acquire (n−1) tuples of secret keys.
We propose a new methodology for rational secret sharing leading to various instantiations (in both the two-party and multi-party settings) that are simple and efficient in terms of computation, share size, and round complexity. Our protocols do not require physical assumptions or simultaneous channels, and can even be run over asynchronous, point-to-point networks. We also propose new equilibrium notions (namely, computational versions of strict Nash equilibrium and stability with respect to trembles) and prove that our protocols satisfy them. These notions guarantee, roughly speaking, that at each point in the protocol there is a unique legal message a party can send. This, in turn, ensures that protocol messages cannot be used as subliminal channels, something achieved in prior work only by making strong assumptions on the communication network. 1
Rational secret sharing, first introduced by Halpern and Teague, means that whether players send their shares relies on their utilities, whereas in traditional scheme, players are assumed to contribute their shares willingly. This paper puts forward a rational secret-sharing scheme where players run their reconstruction protocol in point-to-point communication networks other than broadcast channels which are often used in previous papers. Kol and Naor propose an efficient t -out-of- n protocol for rational secret sharing without using cryptographic primitives while it has weak robustness to coalition when short player colludes with any long players. The protocol proposed by Fuchsbauer and Katz runs efficiently in asynchronous or point-to-point networks. Although it achieves strict Nash equilibrium and is stable with respect to trembles, it is susceptible to realise fairness among the whole party. This paper proposes a rational secret-sharing scheme in point-to-point communication networks to achieve fairness and robustness to coalition.
In this paper, we give the first construction of a rational secret sharing protocol that is strict Nash (or Nash with respect to trembles) in the computational sense, works in a standard point-to-point network with loose synchronization (i.e. does not rely on the availability of a broadcast channel), and can tolerate players with arbitrary side information about the secret. Since this has been proved impossible in the plain model, our protocol requires us to make assumptions about upper and lower bounds on the computational resources of the participants, and also to assume that they are out of sync with each other by at most a known quantity τ and that their network latency is at most some known quantity ∆. Specifically, we define and realize (in the random-oracle model, and assuming so-called standard architecture) time-delayed encryption, a primitive that allows a sender to create a ciphertext such that, for some parameter h, it will take Ω(2 h) time for the recipient to recover the plaintext, where, following the work on memory-bound functions, time is measured in memory accesses. Rational parties will prefer to follow our protocol for reconstructing the secret even given a lot of side information about this secret. This was not true of any of the previously proposed strict Nash protocols for this task: In fact access to side information gave players in those protocols an incentive to deviate. As a result, for the first time, we have a rational secret reconstruction protocol that can be used in applications