Abstract. Rational secret sharing protocols in both the two-party and multi-party settings are proposed. These protocols are built in standard communication networks and with unconditional security. Namely, the protocols run over standard point-to-point networks without requiring physical assumptions or simultaneous channels, and even a computationally unbounded player cannot gain more than ɛ by deviating from the protocol. More precisely, for the 2-out-of-2 protocol the ɛ is a negligible function in the size of the secret, which is caused by the informationtheoretic MACs used for authentication. The t-out-of-n protocol is (t−1)resilient and the ɛ is exponentially small in the number of participants. Although secret recovery cannot be guaranteed in this setting, a participant can at least reduce the Shannon entropy of the secret to less than 1 after the protocol. When the secret-domain is large, every rational player has great incentive to participate in the protocol.
Abstract. Rational secret sharing protocols in both the two-party and multi-party settings are proposed. These protocols are built in standard communication networks and with unconditional security. Namely, the protocols run over standard point-to-point networks without requiring physical assumptions or simultaneous channels, and even a computationally unbounded player cannot gain more than ɛ by deviating from the protocol. More precisely, for the 2-out-of-2 protocol the ɛ is a negligible function in the size of the secret, which is caused by the informationtheoretic MACs used for authentication. The t-out-of-n protocol is (t−1)resilient and the ɛ is exponentially small in the number of participants. Although secret recovery cannot be guaranteed in this setting, a participant can at least reduce the Shannon entropy of the secret to less than 1 after the protocol. When the secret-domain is large, every rational player has great incentive to participate in the protocol.
We propose a new methodology for rational secret sharing leading to various instantiations (in both the two-party and multi-party settings) that are simple and efficient in terms of computation, share size, and round complexity. Our protocols do not require physical assumptions or simultaneous channels, and can even be run over asynchronous, point-to-point networks. We also propose new equilibrium notions (namely, computational versions of strict Nash equilibrium and stability with respect to trembles) and prove that our protocols satisfy them. These notions guarantee, roughly speaking, that at each point in the protocol there is a unique legal message a party can send. This, in turn, ensures that protocol messages cannot be used as subliminal channels, something achieved in prior work only by making strong assumptions on the communication network. 1
Most rational secret sharing protocols aim to achieve a more appealing equilibrium or resist adversaries. However, all previous protocols achieve resilience against irrational adversaries at the cost of inducing a weak guarantee of Nash equilibrium surviving iterated deletion, which has been proved weaker than strict Nash equilibrium. Moreover, they achieve equilibrium in a computational way based on the computational limitations of adversaries. In this paper, we design two unconditionally secure rational (t, n) secret sharing protocols. Contrary to prior works, our protocols induce an enhanced notion of strict equilibrium with respect to adversary structure A, and resist the computationally unbounded and adaptive adversary without using cryptographic primitives. Our protocols achieve stronger stability, since rational players have an incentive not to deviate no matter how the adversary behaves, and they are immune to the backward induction. Our protocols are secure against the adversary corrupting less than [n/3] players and the adversary corrupting less than [n/2]-1 players respectively. Both of them achieve utility independence.
Rational secret sharing, first introduced by Halpern and Teague, means that whether players send their shares relies on their utilities, whereas in traditional scheme, players are assumed to contribute their shares willingly. This paper puts forward a rational secret-sharing scheme where players run their reconstruction protocol in point-to-point communication networks other than broadcast channels which are often used in previous papers. Kol and Naor propose an efficient t -out-of- n protocol for rational secret sharing without using cryptographic primitives while it has weak robustness to coalition when short player colludes with any long players. The protocol proposed by Fuchsbauer and Katz runs efficiently in asynchronous or point-to-point networks. Although it achieves strict Nash equilibrium and is stable with respect to trembles, it is susceptible to realise fairness among the whole party. This paper proposes a rational secret-sharing scheme in point-to-point communication networks to achieve fairness and robustness to coalition.
Rational secret sharing was first introduced by Halpern and Teague (STOC, 2004). Since then, a series of works have focused on designing rational secret sharing protocols. However, most existing solutions can share only one secret at one secret sharing process. To share multiple secrets such as m secrets, the dealer must redistribute shares for m times. In addition, previous works assume existence of broadcast channel which is not realistic. Motivated by those problems, this paper proposes a rational multi-secret sharing scheme, which combines the secret sharing scheme with game theory. In the protocol, the problem of sharing multiple secrets is addressed, and there are multiple secrets to be shared during one secret sharing process. Furthermore, this work starts off by constructing a protocol in simultaneous broadcast networks, and then we emulate the broadcast channel over point-to-point networks. Based on a computational assumption, we show that rational players have no incentive to deviate from the protocol and every player can obtain multi-secret fairly.
Rational secret sharing, first introduced by Halpern and Teague, means that whether players send their shares relies on their utilities, whereas in traditional scheme, players are assumed to contribute their shares willingly. This paper introduces a new kind of player and puts forward a 2-out-of-2 rational secret sharing scheme where players run their reconstruction protocol in standard communication networks other than broadcast channels which are often used in previous papers. The 2-out-of-2 rational secret sharing scheme in standard communication networks can achieve fairness.
Abstract. The problem of carrying out cryptographic computations when the participating parties are rational in a game-theoretic sense has recently gained much attention. One problem that has been studied considerably is that of rational secret sharing. In this setting, the aim is to construct a mechanism (protocol) so that parties behaving rationally have incentive to cooperate and provide their shares in the reconstruction phase, even if each party prefers to be the only one to learn the secret. Although this question was only recently asked by Halpern and Teague (STOC 2004), a number of works with beautiful ideas have been presented to solve this problem. However, they all have the property that the protocols constructed need to know the actual utility values of the parties (or at least a bound on them). This assumption is very problematic because the utilities of parties are not public knowledge. We ask whether this dependence on the actual utility values is really necessary and prove that in the basic setting, rational secret sharing cannot be achieved without it. On the positive side, we show that by somewhat relaxing the standard assumptions on the utility functions, it is possible to achieve utility independence. In addition to the above, observe that the known protocols for rational secret sharing that do not assume simultaneous channels all suffer from the problem that one of the parties can cause the others to output an incorrect value. (This problem arises when a party gains higher utility by having another output an incorrect value than by learning the secret itself; we argue that such a scenario is not at all unlikely.) We show that this problem is inherent in the non-simultaneous channels model, unless the actual values of the parties ’ utilities from this attack is known, in which case it is possible to prevent this from happening. 1