1. Lecture 8: Coin Flipping by Telephone Wayne Patterson SYCS 654 Spring 2010

2. Coin Flipping by Telephone Originally presented by Manuel Blum, then at UC Berkeley (now at Carnegie-Mellon): M. Blum. Coin flipping by telephone. In Proceedings of IEEE Spring Computer Conference, pages 133--137. IEEE, 1982. Blum was Rene Peraltas thesis advisor Rene is a colleague who is now responsible for security in electronic voting at NIST

3. As Rene Posed the Problem Alice and Bob have decided to divorce. They are in different cities, want to decide who gets the (house, car, dog, …) They decide to flip a coin Naturally they dont trust each other …

4. Alice and Bob Agree on a Secure One-Way Function For example, the function could be a x (mod p), for an agreed- upon large prime number p and an agreed-upon primitive root a.

5. Alice Will Flip the Coin The act of flipping is the choice of a secret x, 1 < x < p-1. x is either odd or even (i.e. heads or tails) Alice chooses x (the flip) and announces to Bob the computation y = a x mod p.

6. What Does Bob Do? Bob receives y, and guesses that x is odd or even (heads or tails). Bob sends his guess to Alice. Alice verifies the result, whether Bob guessed right or wrong, and proves her decision by sending x to Bob. Bob can verify that Alice did not lie by performing the same computation y = a x mod p. If Alice lied about the value of x, Bob can prove the lie by the fact that the y he computes will not be the same y he had received.