Cryptid is a board game in which the goal is to be the firstplayer to locate the cryptid, a legendary creature, on a map. Each playerknows a secret clue as to which cell on the map contains the cryptid.Players take it in turns to ask each other if the cryptid could be on agiven cell according to their clue, until one of them guesses the cryptidcell. This game is great fun, but completely loses its interest if one of theplayers cheats by answering the questions incorrectly. For example, if aplayer answers negatively on the cryptid cell, the game continues for along time until all the cells have been tested, and ends without a winner.We provide cryptographic protocols to prevent cheating in Cryptid. Themain idea is to use encryption to commit the players’ clues, enabling themto show that they are answering correctly in accordance with their clueusing zero-knowledge proofs. We give a security model which capturessoundness (a player cannot cheat) and confidentiality (the protocol doesnot leak more information than the players’ answers about their clues),and prove the security of our protocols in this model. We also analyzethe practical efficiency of our protocols, based on an implementation ofthe main algorithms in Rust. Finally, we extend our protocols to ensurethat the game designer has correctly constructed the cryptid games, i.e.,that the clues are well formed and converge on at least one cell.
Cryptid is a board game in which the goal is to be the firstplayer to locate the cryptid, a legendary creature, on a map. Each playerknows a secret clue as to which cell on the map contains the cryptid.Players take it in turns to ask each other if the cryptid could be on agiven cell according to their clue, until one of them guesses the cryptidcell. This game is great fun, but completely loses its interest if one of theplayers cheats by answering the questions incorrectly. For example, if aplayer answers negatively on the cryptid cell, the game continues for along time until all the cells have been tested, and ends without a winner.We provide cryptographic protocols to prevent cheating in Cryptid. Themain idea is to use encryption to commit the players’ clues, enabling themto show that they are answering correctly in accordance with their clueusing zero-knowledge proofs. We give a security model which capturessoundness (a player cannot cheat) and confidentiality (the protocol doesnot leak more information than the players’ answers about their clues),and prove the security of our protocols in this model. We also analyzethe practical efficiency of our protocols, based on an implementation ofthe main algorithms in Rust. Finally, we extend our protocols to ensurethat the game designer has correctly constructed the cryptid games, i.e.,that the clues are well formed and converge on at least one cell.
Trick-Taking Games (TTGs) are card games in which each player plays one of his cards in turn according to a given rule. The player with the highest card then wins the trick, i.e., he gets all the cards that have been played during the round. For instance, Spades is a famous TTG proposed by online casinos, where each player must play a card that follows the leading suit when it is possible. Otherwise, he can play any of his cards. In such a game, a dishonest user can play a wrong card even if he has cards of the leading suit. Since his other cards are hidden, there is no way to detect the cheat. Hence, the other players realize the problem later, i.e., when the cheater plays a card that he is not supposed to have. In this case, the game is biased and is canceled. Our goal is to design protocols that prevent such a cheat for TTGs. We give a security model for secure Spades protocols, and we design a scheme called SecureSpades. This scheme is secure under the Decisional Diffie-Hellman assumption in the random oracle model. Our model and our scheme can be extended to several other TTGs, such as Belotte, Whist, Bridge, etc.
Abstract. In this work we use cryptography to solve a game-theoretic problem which arises naturally in the area of two party strategic games. The standard game-theoretic solution concept for such games is that of an equilibrium, which is a pair of “self-enforcing ” strategies making each player’s strategy an optimal response to the other player’s strategy. It is known that for many games the expected equilibrium payoffs can be much higher when a trusted third party (a “mediator”) assists the players in choosing their moves (correlated equilibria), than when each player has to choose its move on its own (Nash equilibria). It is natural to ask whether there exists a mechanism that eliminates the need for the mediator yet allows the players to maintain the high payoffs offered by mediator-assisted strategies. We answer this question affirmatively provided the players are computationally bounded and can have free communication (so-called “cheap talk”) prior to playing the game. The main building block of our solution is an efficient cryptographic protocol to the following Correlated Element Selection problem, which is of independent interest. Both Alice and Bob know a list of pairs (a1, b1)... (an, bn) (possibly with repetitions), and they want to pick a random index i such that Alice learns only ai and Bob learns only bi. Our solution to this problem has constant number of rounds, negligible error probability, and uses only very simple zero-knowledge proofs. We then show how to incorporate our cryptographic protocol back into a game-theoretic setting, which highlights some interesting parallels between cryptographic protocols and extensive form games. 1
In this work, we investigate the security of interactive computations. The main emphasis is on the mathematical methodology that is needed to formalise and analyse various security properties. Differently from many classical treatments of secure multi-party computations, we always quantify security in exact terms. Although working with concrete time bounds and success probabilities is technically more demanding, it also has several advantages. As all security guarantees are quantitative, we can always compare different protocol designs. Moreover, these security guarantees also have a clear economical interpretation and it is possible to compare cryptographic and non-cryptographic solutions. The latter is extremely important in practice, since cryptographic techniques are just one possibility to achieve practical security. Also, working with exact bounds makes reasoning errors more apparent, as security proofs are less abstract and it is easier to locate false claims. The choice of topics covered in this thesis was guided by two principles. Firstly, we wanted to give a coherent overview of the secure multi-party computation that is based on exact quantification of security guarantees. Secondly, we focused on topics that emerged from the author's own research. In that sense, the thesis generalises many methodological discoveries made by the author. As surprising as it may seem, security definitions and proofs mostly utilise principles of hypothesis testing and analysis of stochastic algorithms. Thus, we start our treatment with hypothesis testing and its generalisations. In particular, we show how to quantify various security properties, using security games as tools. Next, we review basic proof techniques and explain how to structure complex proofs so they become easily verifiable. In a nutshell, we describe how to represent a proof as a game tree, where each edge corresponds to an elementary proof step. As a result, one can first verify the overall structure of a proof by looking at the syntactic changes in the game tree and only then verify all individual proof steps corresponding to the edges. The remaining part of the thesis is dedicated to various aspects of protocol design. Firstly, we discuss how to formalise various security goals, such as input-privacy, output-consistency and complete security, and how to choose a security goal that is appropriate for a specific setting. Secondly, we also explore alternatives to exact security. More precisely, we analyse connections between exact and asymptotic security models and rigorously formalise a notion of subjective security. Thirdly, we study in which conditions protocols preserve their security guarantees and how to safely combine several protocols. Although composability results are common knowledge, we look at them from a slightly different angle. Namely, it is irrational to design universally composable protocols at any cost; instead, we should design computationally efficient protocols with minimal usage restrictions. Thus, we propose a three-stage design procedure that leads to modular security proofs and minimises usage restrictions.
Rational cryptography has recently emerged as a very promising field of research by combining notions and techniques from cryptography and game theory, because it offers an alternative to the rather inexible traditional cryptographic model. In contrast to the classical view of cryptography where protocol participants are considered either honest or arbitrarily malicious, rational cryptography models participants as rational players that try to maximize their benefit and thus deviate from the protocol only if they gain an advantage by doing so. The main research goals for rational cryptography are the design of more ecient protocols when players adhere to a rational model, the design and implementation of automated proofs for rational security notions and the study of the intrinsic connections between game theoretic and cryptographic notions. In this thesis, we address all these issues. First we present the mathematical model and the design for a new rational file sharing protocol which we call RatFish. Next, we develop a general method for automated verification for rational cryptographic protocols and we show how to apply our technique in order to automatically derive the rational security property for RatFish. Finally, we study the intrinsic connections between game theory and cryptography by defining a new game theoretic notion, which we call game universal implementation, and by showing its equivalence with the notion of weak stand-alone security.
AbotractA commilmcnt protocol is a fundamental cryptographic primitive uacd a0 D basic building block throughout modem cryptography.In STOC 1991, Dolov Dwork and Naor showed that in many settings the Implemontotion of this fundamental primitive requires a strong non-malh6ility property in order not to be sueceptible to a certain clmoa of nttacke, In this paper, aeeuming that a common random ntrlng lo available to all playere, we show how to implement nonmalleablo commitment without any interaction and based on any one-way function, In contrast, all previous solutions required eithor logorlthmically many rounds of interaction or strong algebraic aaaumptlono, I lntroductlon COMMITMENT:One of the most fundamental crypt* graphic protocols is the commitment protocol.A commitment protocol involves two probabilistic polynomial-time players: the committer and the receiver.Very informally, it consists of two stages, a commitment stage and a decommitment stage.In the commitment stage, the committcr with a secret input x engages in a protocol with the receiver, In the end of this protocol, receiver still does not know what z is (i.e.z is computationally hidden), and at the same time, the committer can subsequently (i.e., during the de-commitment stage) open only one possible value of 2.Commitment is used as a sub-protocol in a vast variety of cryptographic applications, including, to name a few, contract signing [8], zero-knowledge proofs for all of