Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

OASIcs : OpenAccess Series in Informatics

Secure Computation with Non-Equivalent Penalties in Constant Rounds

Takeshi Nakai, Kazumasa Shinagawa

Published Jan 1, 2022• 1 citation
Publisher

Abstract

It is known that Bitcoin enables to achieve fairness in secure computation by imposing a monetary penalty on adversarial parties. This functionality is called secure computation with penalties. Bentov and Kumaresan (Crypto 2014) showed that it could be realized with O(n) rounds and O(n) broadcasts for any function, where n is the number of parties. Kumaresan and Bentov (CCS 2014) posed an open question: "Is it possible to design secure computation with penalties that needs only O(1) rounds and O(n) broadcasts?" In this work, we introduce secure computation with non-equivalent penalties, and design a protocol achieving this functionality with O(1) rounds and O(n) broadcasts only. The new functionality is the same as secure computation with penalties except that every honest party receives more than a predetermined amount of compensation while the previous one requires that every honest party receives the same amount of compensation. In particular, both are the same if all parties behave honestly. Thus, our result gives a partial answer to the open problem with a slight and natural modification of functionality.

DOI
10.4230/oasics.tokenomics.2021.5

Related papers

Constant-round linear-broadcast secure computation with penalties

Takeshi Nakai, Kazumasa Shinagawa

It is known that Bitcoin enables achieving fairness in secure computation by imposing monetary penalties on adversarial parties. This functionality is called secure computation with penalties. Bentov and Kumaresan (2014) [9] introduced the claim-or-refund functionality that can be implemented via Bitcoin. They achieved secure computation with penalties with O(n) rounds and O(n) broadcasts for any function, where n is the number of parties. After that, Kumaresan and Bentov (2014) [8] showed a constant-round protocol. Unfortunately, this protocol requires O(n2) broadcasts. As far as we know, no protocol achieves O(1) rounds and O(n) broadcasts based on Bitcoin. This work accomplishes such efficiency in secure computation with penalties. We first show a protocol in a slightly relaxed setting called secure computation with non-equivalent penalties. This setting is the same as secure computation with penalties except that every honest party receives more than a predetermined amount of compensation, while the previous one requires that every honest party receives the same amount of compensation. Namely, our setting allows the compensations for honest parties to be non-equivalent. Moreover, we present a technique to remove the non-equivalence of our protocol without sacrificing efficiency. We then propose a new ideal functionality called claim-refund-or-give that can be implemented via Bitcoin.

arXiv:2206.06010•Theoretical Computer Science•Apr 12, 2023•5 citations

Secure multi-party computation with legally-enforceable fairness

Takeshi Nakai, Kazumasa Shinagawa

Abstract Fairness is a security notion of secure computation and cannot always be achieved if an adversary corrupts a majority of parties in standard settings. Lindell (CT-RSA 2008) showed that imposing a monetary penalty on an adversary can circumvent the impossibility. He formalized such a security notion as “legally enforceable fairness" for the two-party setting based on the ideal trusted bank functionality and showed a protocol achieving the requirements. Based on the same framework, we introduce secure multi-party computation with legally enforceable fairness that is applicable for an arbitrary number of parties. Further, we propose two protocols that realize our introduced functionality. The first one achieves O(n) rounds and $$O(n \alpha )$$ O ( n α ) fees, where n is the number of parties, and $$\alpha $$ α is a parameter for the penalty amount. The fee refers to the balance amount in the bank required at the beginning of the protocol, which evaluates the difficulty of participating in the protocol in a financial sense. The second one achieves O(1) rounds and $$O(n^2 \alpha )$$ O ( n 2 α ) fees.

International Journal of Information Security•Aug 29, 2024•4 citations

A Formalization of Financial Transactions in Secure Computation: How to Handle Coins with Various Colors

Takeshi Nakai

Abstract Secure computation with penalties aims to achieve fairness in secure computation protocols by imposing monetary penalties on adversarial parties. A fundamental problem in constructing protocols that involves monetary entities is how to formalize them in a computational model. Bentov and Kumaresan (CRYPTO 2014) introduced a new computational model with special atomic entities called coins that capture currency and showed a protocol for secure computation with penalties in the model. Their model, secure computation with coins, assumes coins have several properties that are natural in the sense of expressing currency. However, on the other hand, it also requires the unnatural assumption “all coins are indistinguishable from each other" for a technical reason to accomplish the security proof. The motivation of this work is to remove this assumption to make the model a more general. We propose a new model, secure computation with color coins, such that coins have identifiable colors and do not hold the indistinguishability property. Furthermore, our model allows us to set different prices for each color. We show that secure computation with penalties can be realized in our model. To do this, we make some modifications to the ideal functionality of secure computation with penalties to adapt it to our model without losing the essence, i.e., fairness with penalties.

Theory of Computing Systems•May 30, 2026•0 citations

Amortizing Secure Computation with Penalties

Ranjit Kumaresan, Iddo Bentov

Motivated by the impossibility of achieving fairness in secure computation [Cleve, STOC 1986], recent works study a model of fairness in which an adversarial party that aborts on receiving output is forced to pay a mutually predefined monetary penalty to every other party that did not receive the output. These works show how to design protocols for secure computation with penalties that guarantees that either fairness is guaranteed or that each honest party obtains a monetary penalty from the adversary. Protocols for this task are typically designed in an hybrid model where parties have access to a "claim-or-refund" transaction functionality denote FCR*.

ACM SIGSAC Conference on Computer and Communications Security (CCS)•Oct 24, 2016•65 citations

How to Use Bitcoin to Design Fair Protocols

Iddo Bentov, Ranjit Kumaresan

We study a model of fairness in secure computation in which an adversarial party that aborts on receiving output is forced to pay a mutually predefined monetary penalty. We then show how the Bitcoin network can be used to achieve the above notion of fairness in the two-party as well as the multiparty setting (with a dishonest majority). In particular, we propose new ideal functionalities and protocols for fair secure computation and fair lottery in this model. One of our main contributions is the definition of an ideal primitive, which we call F?CR (CR stands for “claim-or-refund”), that formalizes and abstracts the exact properties we require from the Bitcoin network to achieve our goals. Naturally, this abstraction allows us to design fair protocols in a hybrid model in which parties have access to the F?CR functionality, and is otherwise independent of the Bitcoin ecosystem. We also show an efficient realization of F?CR that requires only two Bitcoin transactions to be made on the network. Our constructions also enjoy high efficiency. In a multiparty setting, our protocols only require a constant number of calls to F?CR per party on top of a standard multiparty secure computation protocol. Our fair multiparty lottery protocol improves over previous solutions which required a quadratic number of Bitcoin transactions.

Lecture notes in computer science•Jan 1, 2014•0 citations

Cryptographic and Financial Fairness

Daniele Friolo, Fabio Massacci, Chan Nam Ngo +1 more

A recent trend in multi-party computation is to achieve cryptographic fairness via monetary penalties, i.e. each honest player either obtains the output or receives a compensation in the form of a cryptocurrency. We pioneer another type of fairness, financial fairness, that is closer to the real-world valuation of financial transactions. Intuitively, a penalty protocol is financially fair if the net present cost of participation (the total value of cash inflows less cash outflows, weighted by the relative discount rate) is the same for all honest participants, even when some parties cheat. We formally define the notion, show several impossibility results based on game theory, and analyze the practical effects of (lack of) financial fairness if one was to run the protocols for real on Bitcoin using Bloomberg’s dark pool trading. For example, we show that the ladder protocol (CRYPTO’14), and its variants (CCS’15 and CCS’16), fail to achieve financial fairness both in theory and in practice, while the penalty protocols of Kumaresan and Bentov (CCS’14) and Baum, David and Dowsley (FC’20) are financially fair.

arXiv:2207.10780•IEEE Transactions on Information Forensics and Security•Jan 1, 2022•7 citations
It is known that Bitcoin enables to achieve fairness in secure computation by imposing a monetary penalty on adversarial parties. This functionality is called secure computation with penalties. Bentov and Kumaresan (Crypto 2014) showed that it could be realized with O(n) rounds and O(n) broadcasts for any function, where n is the number of parties. Kumaresan and Bentov (CCS 2014) posed an open question: "Is it possible to design secure computation with penalties that needs only O(1) rounds and O(n) broadcasts?" In this work, we introduce secure computation with non-equivalent penalties, and design a protocol achieving this functionality with O(1) rounds and O(n) broadcasts only. The new functionality is the same as secure computation with penalties except that every honest party receives more than a predetermined amount of compensation while the previous one requires that every honest party receives the same amount of compensation. In particular, both are the same if all parties behave honestly. Thus, our result gives a partial answer to the open problem with a slight and natural modification of functionality.
It is known that Bitcoin enables achieving fairness in secure computation by imposing monetary penalties on adversarial parties. This functionality is called secure computation with penalties. Bentov and Kumaresan (2014) [9] introduced the claim-or-refund functionality that can be implemented via Bitcoin. They achieved secure computation with penalties with O(n) rounds and O(n) broadcasts for any function, where n is the number of parties. After that, Kumaresan and Bentov (2014) [8] showed a constant-round protocol. Unfortunately, this protocol requires O(n2) broadcasts. As far as we know, no protocol achieves O(1) rounds and O(n) broadcasts based on Bitcoin. This work accomplishes such efficiency in secure computation with penalties. We first show a protocol in a slightly relaxed setting called secure computation with non-equivalent penalties. This setting is the same as secure computation with penalties except that every honest party receives more than a predetermined amount of compensation, while the previous one requires that every honest party receives the same amount of compensation. Namely, our setting allows the compensations for honest parties to be non-equivalent. Moreover, we present a technique to remove the non-equivalence of our protocol without sacrificing efficiency. We then propose a new ideal functionality called claim-refund-or-give that can be implemented via Bitcoin.
Abstract Fairness is a security notion of secure computation and cannot always be achieved if an adversary corrupts a majority of parties in standard settings. Lindell (CT-RSA 2008) showed that imposing a monetary penalty on an adversary can circumvent the impossibility. He formalized such a security notion as “legally enforceable fairness" for the two-party setting based on the ideal trusted bank functionality and showed a protocol achieving the requirements. Based on the same framework, we introduce secure multi-party computation with legally enforceable fairness that is applicable for an arbitrary number of parties. Further, we propose two protocols that realize our introduced functionality. The first one achieves O(n) rounds and O(nα)O(n \alpha )O(nα) O ( n α ) fees, where n is the number of parties, and α\alpha α α is a parameter for the penalty amount. The fee refers to the balance amount in the bank required at the beginning of the protocol, which evaluates the difficulty of participating in the protocol in a financial sense. The second one achieves O(1) rounds and O(n2α)O(n^2 \alpha )O(n2α) O ( n 2 α ) fees.
Abstract Secure computation with penalties aims to achieve fairness in secure computation protocols by imposing monetary penalties on adversarial parties. A fundamental problem in constructing protocols that involves monetary entities is how to formalize them in a computational model. Bentov and Kumaresan (CRYPTO 2014) introduced a new computational model with special atomic entities called coins that capture currency and showed a protocol for secure computation with penalties in the model. Their model, secure computation with coins, assumes coins have several properties that are natural in the sense of expressing currency. However, on the other hand, it also requires the unnatural assumption “all coins are indistinguishable from each other" for a technical reason to accomplish the security proof. The motivation of this work is to remove this assumption to make the model a more general. We propose a new model, secure computation with color coins, such that coins have identifiable colors and do not hold the indistinguishability property. Furthermore, our model allows us to set different prices for each color. We show that secure computation with penalties can be realized in our model. To do this, we make some modifications to the ideal functionality of secure computation with penalties to adapt it to our model without losing the essence, i.e., fairness with penalties.
Motivated by the impossibility of achieving fairness in secure computation [Cleve, STOC 1986], recent works study a model of fairness in which an adversarial party that aborts on receiving output is forced to pay a mutually predefined monetary penalty to every other party that did not receive the output. These works show how to design protocols for secure computation with penalties that guarantees that either fairness is guaranteed or that each honest party obtains a monetary penalty from the adversary. Protocols for this task are typically designed in an hybrid model where parties have access to a "claim-or-refund" transaction functionality denote FCR*.
We study a model of fairness in secure computation in which an adversarial party that aborts on receiving output is forced to pay a mutually predefined monetary penalty. We then show how the Bitcoin network can be used to achieve the above notion of fairness in the two-party as well as the multiparty setting (with a dishonest majority). In particular, we propose new ideal functionalities and protocols for fair secure computation and fair lottery in this model. One of our main contributions is the definition of an ideal primitive, which we call F?CR (CR stands for “claim-or-refund”), that formalizes and abstracts the exact properties we require from the Bitcoin network to achieve our goals. Naturally, this abstraction allows us to design fair protocols in a hybrid model in which parties have access to the F?CR functionality, and is otherwise independent of the Bitcoin ecosystem. We also show an efficient realization of F?CR that requires only two Bitcoin transactions to be made on the network. Our constructions also enjoy high efficiency. In a multiparty setting, our protocols only require a constant number of calls to F?CR per party on top of a standard multiparty secure computation protocol. Our fair multiparty lottery protocol improves over previous solutions which required a quadratic number of Bitcoin transactions.
A recent trend in multi-party computation is to achieve cryptographic fairness via monetary penalties, i.e. each honest player either obtains the output or receives a compensation in the form of a cryptocurrency. We pioneer another type of fairness, financial fairness, that is closer to the real-world valuation of financial transactions. Intuitively, a penalty protocol is financially fair if the net present cost of participation (the total value of cash inflows less cash outflows, weighted by the relative discount rate) is the same for all honest participants, even when some parties cheat. We formally define the notion, show several impossibility results based on game theory, and analyze the practical effects of (lack of) financial fairness if one was to run the protocols for real on Bitcoin using Bloomberg’s dark pool trading. For example, we show that the ladder protocol (CRYPTO’14), and its variants (CCS’15 and CCS’16), fail to achieve financial fairness both in theory and in practice, while the penalty protocols of Kumaresan and Bentov (CCS’14) and Baum, David and Dowsley (FC’20) are financially fair.