On Fair Exchange, Fair Coins and Fair Sampling Shashank Agrawal, Manoj Prabhakaran University of Illinois at Urbana-Champaign

Fairness A secure multi-party protocol has properties like correctness, privacy of inputs. Fairness: An intuitive property desirable of secure protocols. Adversary cannot prevent honest parties from obtaining the output of computation, if he also obtains it. Ideal world: Functionality gives output to all the parties (or none of them). Finite two party functionalities. Input, output size does not depend on the security parameter.

Motivation Wide interest in the problem of fairness. Understanding of fundamental primitives lacking. In this work, we study the relationship between Fair Exchange, Fair Coin-flipping, Fair Random-OT. Given access to a fair primitive, can we realize another fair primitive.

AB EXCH xy yx With input Functionalities

Sampling functionalities A B COIN b b AB R-OT Input-less AB

Functionalities with Fair protocols COIN EXCH R-OT Any non-trivial joint distribution Cleve 1986 Zero common information X X X Our Results

Related Work Cleve 1986: No efficient protocol for fair coin- flipping. A simple fail-stop attack. Even under computational assumptions. Any functionality of interest likely not realizable. Gordon et al. showed AND, OR, Yao’s millionaire problem have fair protocol [GHKL08] Led to a flurry of results [MNS09, BOO10, GIMOS10, GK10, BLOO11, ALR13] Landscape more complicated than unfair computation E.g. no finite complete function [GIMOS10]

Functionalities with Fair protocols COIN EXCH R-OT X X X XOR Cleve 1986 Our Results

COIN functionality AB COIN b b Agreement: Alice and Bob output the same bit (if nobody corrupt). Entropy: Honest party outputs a random bit.

Alice Bob

XOR from COIN Assume: Alice and Bob choose inputs randomly Invalid input is substituted by a default one. Agreement: Alice and Bob output the same bit. Entropy: Honest party outputs a random bit. AB XOR Theorem: Even with access to COIN, XOR can’t be realized.

Alice Bob COIN bb

Functionalities with Fair protocols COIN EXCH R-OT X X X Zero common information Our Results

Common Information AB XY Q Q

Characteristic bipartite graph COIN R-OT Zero CI1-bit CI

COIN from R-OT

Graph Products R-OT 1- sample 0…0 R-OT n-samples 0… …

COIN from R-OT Lower-bounding the second eigenvalue of the Laplacian associated with the graph product. No matter how many samples from R-OT, the weight on edges going across is a constant.

Functionalities with Fair protocols COIN EXCH R-OT X X X Conclusion

Thank you. Questions?