Optimistic Synchronous Multi-Party Contract Signing N. Asokan, Baum-Waidner, M. Schunter, M. Waidner Presented By Uday Nayak Advisor: Chris Lynch

Contract Signing Alice, Bob Contract They’ve agreed on the wording, but neither wishes to sign unless the other signs as well. Face to face, this is easy; Both sign together. Over a distance, they could use an arbitrator

Face-to-face (Simultaneous Contract Signing without an Arbitrator) If Alice and Bob are sitting face-to-face, they could sign the contract this way: Alice signs the 1 st letter of her name and passes the contract to Bob Bob signs the 1 st letter of his name and passes the contract to Alice Alice signs the 2 nd letter of her name and passes the contract to Bob Bob signs the 2 nd letter of his name and passes the contract to Alice This continues until Alice and Bob have signed their entire names (Obvious Problem of this Protocol?)

Contract Signing with an Arbitrator Alice signs a copy of the contract and sends it to Trent Bob signs a copy of the contract and sends it to Trent Trent sends a message to both Alice and Bob indicating that the other has signed the contract. Alice signs two copies of the contract and sends them to Bob Bob signs both copies of the contract, keeps one for himself, and sends the other to Alice Alice and Bob both inform Trent that they each have a copy of the contract signed by both of them. Trent tears up his two copies of the contract with only one signature each.

Introduction to Multi-Party Contract Signing Business transactions often demand secure, verifiable agreement on how to proceed: All parties involved must agree to either abort or to complete the transaction If the transaction is not aborted then the decision to continue must be verifiable by a third party (Parties are not likely to trust each other. Therefore, the second requirement should be satisfied even if (n – 1) dishonest parties conspire against a single honest one) After having negotiated the contract text all signatories (parties) have to agree whether the contract shall become valid (signed) or not (failed) Any signatory must be able to show a signed contract to any third party (verifier)

Model and Notation P 1, P 2, …, P n : Parties T: Third Party V: any Verifier Each party is able to digitally sign messages, and to verify signatures of any other party (PKI) The signature on message m associated with P X is denoted by sign X (m). Protocol is structured in synchronized rounds of communication: Each party knows when a certain round starts and ends. In each round, each party can send a message to each other party, and can process all messages received from all other parties. Messages sent between the parties are reliably delivered within the same round. We consider an adversary who can a priori choose to corrupt a certain subset of all parties. The adversary can read all communication channels; but cannot forge signatures.

Definition: (Multi-Party Contract Signing) Definition 1: A protocol for at least (n + 1) parties P 1,…,P n,V that satisfies the following conditions is called a Multi-Party Contract Signing protocol, or just an MPCS. MPCS: consists of two protocols, sign[P 1,…,P n ] and verify[P i, V]. A Party P i who wishes to start sign[] enters (sign, tid, contr, decs). tid = transaction identifier (unique for all executions of sign[]) contr = contract to be signed decs  {sign, reject} denotes the user’s initial decision On termination, sign[] produces an output (tid, contr, d i ) for P i, with d i  {signed, failed}. We will simply say “P i decides d i ” A Party P i who wishes to start verify[] with a verifier V enters (show, tid, contr). If the verifier V, wishes to start verify[] as well it enters (verify, tid, contr) where tid, contr must be the same values as those used by P i On termination verify[] produces an output (tid, contr, d V ) with d V  {signed, failed} for V. We will simply say “V decides d V on tid.”

Optimistic Protocols Definition 2: (Optimistic Protocol) A protocol for n regular parties parties P 1,…,P n and a third party T is called optimistic if in the all-honest case the protocol terminates without T ever sending or receiving any messages.

Optimistic Synchronous Multi-Party Contract Signing (Protocol 1) Signing: Let c := (tid, contr) 1.a. If P i starts with decs = reject it decides failed and stops b. Otherwise P i sends message m 1,i := sign i (1,c) to all other parties. 2. Each P i compiles M 1 :=(m 1,i,…, m 1,n ) a. If this succeeds and each m 1,j is a valid signature sign j (1,c) then P i sends m 2,i := sign i (2,c) to all other parties. b. Otherwise P i waits for a message from T in Round Each P i compiles M 2 :=(m 1,1,…, m 1,n ) a. If this succeeds and each m 2,j is a valid signature sign j (2,c) then P i decides signed and stops b. Otherwise, and if P i has sent m 2,i, it sends m 3,i := sign i (3,M 1 ) to T.

Optimistic Synchronous Multi-Party Contract Signing 4. If T receives at least one message m 3,i in round 3 which contains a full and consistent M 1 then T sends m T := sign T (M 1 ) to all parties, and each P i receiving this decides signed. (Otherwise T does not send anything, and is actually not even aware of this protocol run) Each P i waiting for a message from T in Round 4 decides failed if none arrives, or signed in case m T is received, and stops. Verification: Any verifier V accepts a contract if it sees a full and consistent M 2 or an m T containing a full and consistent M 1

Explanation In the all-honest case only two rounds of communication are needed: In the 1 st round, each party who wishes to sign the contract broadcasts a signed “promise to sign” (= message m 1,i ) In the 2 nd round, each party who received all n promises from the 1 st round, actually signs the contract and broadcasts its real signature ( = message m 2,i ) (Obviously, this works if all parties wish to sign. If at least one party does not wish to sign, this party will not send the signed promise, and thus no party will sign in Round 2. Thus, in the all-honest case, the protocol stops after 2 rounds.) If some party cheats some honest parties might not end up with a signed contract in Round 2, while some others do. This inconsistency is solved by adding two more rounds to the protocol where everybody who has n signed promises from round 1 can get them converted into a valid contract, by T. If T issues an affidavit it broadcasts it to all parties, in Round 4. Thus, each party who did not receive all n promises in Round 1 waits until Round 4. If it receives an affidavit from T the decision is signed, otherwise failed.

Theorem 1 : Protocol 1 is an optimistic MPCS for synchronous networks. Proof: Correct execution, verifiability and termination are obviously satisfied. Strong unforgeability is given by the fact that a valid contract contains a signature from each party, i.e., all parties must have agreed to sign. No Surprises with invalid contracts. Assume an honest V accepts c as signed. If this happens because of m T then T has distributed this message to all parties, and all honest parties decide signed. Assume V accepts because of M 2, and consider some honest party P i. As M 2 contains P i ’s signature from Round 2, P i received M 1 in Round 1. If P i received M 2 in Round 2 it decides signed. Otherwise it sends m 3,i to T, which is necessarily answered by m T (as T is honest), and P i decides signed. Thus, we know that if V accepts then any honest party has accepted the contract. Optimistic. Assume all parties are honest. If all parties start with decs = sign and consistent contracts then T will not be involved and everybody decides signed in Round 2. If at least one party P i starts with decs = reject then m 1,i will not be sent, M 1 will be incomplete, no other party can send m 2,j, thus none will contact T, and in Round 4 all parties that started with decs i = sign will decide failed.

Applications Optimistic Multi-Party Certified Mail In two-party certified mail the sender P 1 sends a message m to P 2 in exchange for a receipt that can be shown to any verifier V. P 2 has to give the receipt blindly, i.e., independent of the contents of m. Generalization: (Natural multi-party version of certified mail) One-to-many certified mail: P 1 sends a certified mail m to P 2,…,P n : P 1 sends a certified mail m to P 2,…,P n and requires to get a receipt from each recipient in exchange. Either P 1 receives all receipts, or none of P 2,…,P n gets any information about m. Similarly one can define many-to-one certified mail, where each P i (i  {2,…,n}) sends a certified mail m i to P 1 and requires to get a receipt from P 1 in exchange. Either each sender P i receives a receipt, or P 1 gets no information about any of the m i.

Optimistic One-to-many Certified Mail (Protocol 2) P 1 encrypts (tid,m) under the public key of T, and sends the ciphertext to all parties. Call this ciphertext cipher. Each party receiving cipher and willing to accept it sets decs = sign. Otherwise decs = reject. We run an optimistic contract signing protocol on (tid, contr = cipher, decs). If P i (i  {1,…,n}) decides failed in the contract signing protocol then it decides failed in the certified mail protocol and stops. P 1 sends m to all parties, and proves that (tid,m) was actually the cleartext corresponding to cipher(by sending also all random coins used in computing cipher). P 1 decides accepted in the certified mail protocol. The receipt is the signed contract. If P i, i>1 received a correct pair (tid,m) it accepts m and stops. Otherwise P i shows the contract (tid, cipher, decs) to T. If T receives a signed contract (tid, cipher) from P i then it tries to decrypt cipher. Otherwise, the request is ignored. If decryption succeeds and results in (tid, m) for the given tid then T sets m T := sign T (tid,cipher,m) Otherwise, T sets m T := sign T (tid,cipher,nil) T sends m T to P i

Theorem 2 Protocol 2 is a secure protocol for optimistic one-to-many certified mail. Proof. (Sketch) To prove two properties: No information is leaked on m unless P 1 has a receipt. And P 1 cannot get a receipt without revealing m: The only way to get information about cipher is from P 1 or T P 1 reveals m only if he has a signed contract, i.e., a receipt. T reveals m only if the condition in Step 5a is satisfied. This means the cleartext of cipher and the signed contract agree on tid, i.e., correspond to the same protocol run. Thus, P 1 was indeed the creator of cipher, and agreed to exchange m for a receipt. Thus, T can safely decrypt cipher. Since the MPCS is assumed to be secure, the only way to get a valid receipt is if Phase 2 resulted in a signed contract. Based on this contract each P i will finally get the corresponding message, either from P 1 in Phase 3 or from T in Phase 5.

Conclusion The main application of multi-party contract signing is as a primitive for secure atomic transactions. We showed how to solve several fair exchange problems using multi-party contract signing.