Blum’s coin-flipping. The “coin-flipping by telephone” [Blu83] proposed by Blum uses a non-interactive unconditionally-hiding bit-commitment scheme, with trapdoor known by PB.19The asymmetry of the protocol can be characterized by saying that “PBflips coins to PA”, namely because PAlearns the result of the coin-flipping and then candecide whether or not to let PBlearn it as well. In a setup phase of the protocol, PBchooses the commitment scheme parameter (a Blum integer) and convinces PAthat it is correct. This is achieved with PBgiving a (honest-verifier) ZKPoK of the respective trapdoor (the integer factorization of the Blum integer), which PBkeeps hidden from PA. The protocol then proceeds with PAcommitting to her random contribution (a vector of bits) and then PBsending his random contribution (a vector of bits with the same length) to PA. At this
19
In the specific proposal, a commitment of bits is a vector of squares modulo a Blum integer; the respective opening is a vector of square-roots with appropriate Jacobi Symbols. A Blum integer is the product of two prime powers, where each prime is congruent with 3 modulo 4, and each power has an odd exponent. For a fixed Blum integer, the Jacobi Symbol is a completely multiplicative function that maps any group element into 1 or−1.
point, PAcan privately obtain the coin-flipping result as the XOR of the contribution of PAand the contribution of PB. Eventually, “whenever ... [PA] wants to prove to PBwhat sequence of ... random bits was flipped to her”, PAopens her commitments, thus also letting PBcompute the final bit-string.
It might be left to interpretation whether or not the final step (PA opening her contribution to PB) is necessary to consider the execution successful. Actually, in the original proposed protocol, the parties sign and timestamp some exchanged messages, thus allowing a complementary “Judge’s protocol”, where all signed messages can be subpoenaed and then the judge can either assert that the “protocol is declared terminated” or it can “enforce completion of the protocol”. This setting is not considered in this paper, as it goes beyond the two-party case, but it interestingly solves thebiasproblem discussed ahead.
Definition 8 (early-abort). In the context of a coin-flipping protocol (namely one following the traditional template),early-abortdenotes the action of a (malicious) party (Pp) aborting the execution before revealing her own contribution, conditioned to not aborting before the other party (Pp¯) becoming bound to her respective contribution.
Definition 9(unfair-abort). In the context of a coin-flipping protocol,unfair-abort
denotes the action of a (malicious) party (Pp) aborting the execution afterlearning
somethingabout the bit-string outcome (i.e., in the sense of breakingsemantic hiding), but before letting the other party learnsomethingabout it.
Clearly, anunfair-abortis anearly-abort, and in the case of the traditional template only P∗Ais able to perform it (by aborting after (84), but before (85)). PBis also able to do anearly-abortin the traditional template (by aborting after (82) but before (84)). The consideration ofunfair-abortandearly-abort(and respective probabilities) was a main motivation to devise protocol #1 in this paper, in a setting where simulation with rewinding is allowed. In particular, the new protocol is devised in a different template whereearly-abortis still possible by PAbut not in the form of anunfair-abort.
A note onbias. The traditional template, which fits (and is actually suggested by) Blum’s protocol, inherently allows anunfair-abortby a malicious P∗A, i.e., aborting before opening her contribution (step 3) but after seeing the contribution of the honest PB (step 2), consequently allowing the output of PBto bebiased. In fact, this is allowed in the ideal functionality of coin-flipping into a well (Fig. 5, Fig. 6). In the case of flipping a single coin,biasis defined as the absolute value of the distance between one-half and the probability that the honest party outputs a particular bit value.20For example, if P∗
A aborts the coin-flipping execution whenever realizing that the final result is an undesired output, then the output of PBbecomes biased. This happens even if the protocol defines a default output mechanism for PBwhen facing anearly-abortby P∗A. For example, thebiasis one-forth if PBoutputs a default random bit in case ofearly-abort by P∗A, which means P∗Acan induce her desired output with probability three-fourths (ignoring
20
the aborted executions). Thisbiasis not a security violation when considering an ideal functionality that also allowsunfair-abort, as considered in this paper.21
Single coin-flip into a well (with rewinding). The traditional template is a prototype for acoin-flipping into the wellprotocol [Gol04, §7.4.3.1], i.e., allowing two parties to obtain as output the same uniformly random bit except if a malicious party performs
early-abort. In a simulation setting allowing rewinding, and when flipping a single coin, a protocol following the traditional template can be proven secure (i.e., simulatable) regardless of local X or Q properties of the commitment scheme, i.e., it holds for any commitment scheme (hiding and binding). In particular, in the case of a malicious P∗A, the simulatorS(in the role of PBin a simulated execution) can use rewinding to test P∗A with both possible bits in step 2. If P∗Adoesearly-abortin both cases, thenScan safely
emulate an abortin the ideal world; if P∗Adoes notearly-abortin at least one case, then
Scan determine whether or not to abort in the ideal world. More generally, the same type of proof can be used for bit-strings of length logarithmic in the computational security parameter, i.e., whenever the space of possible contributions of PBis of polynomial size. However, when flipping many coins (e.g., linear in the security parameter) in parallel, some extra properties are necessary from the commitment scheme.
C.2 (Non-)simulatability of the traditional template
Definition 10(explicit rewinding). If simulation with rewinding is allowed,explicit rewindingdenotes the action, performed byS, of rewinding the black-box adversary in a simulated execution in a hybrid model where the underlying commitment schemes are replaced by respective ideal functionalities. In other words, these rewindings do not take in consideration possibleimplicitrewindings that might be necessary in a simulation where the ideal commitment functionalities are replaced by real sub-protocols.
For a coin-flipping protocol following the traditional template, if the underlying commitment scheme is X&Q then simulatability is trivially possible withoutexplicit rewinding. The situation is different if either X or Q properties are missing from the commitment scheme, namely in regard to theexpected number of explicit rewindings
(E[#rw]). For a successful simulation, onceSin the ideal world receives the random bit-string fromFMCF,Smust be able to induce in the simulated execution the perspec- tive of the other black-box party obtaining the same final bit-string (the XOR of two contributions), regardless of then it being rejected (e.g., by means of abort) or accepted (and possibly altered when outputted toZ) by the party.
When using an extractable-but-not-equivocable (X&Q) commitment scheme. In case of a malicious P∗A, a one-pass simulator (in the role of PBin the simulated execution) can always succeed, by locally extracting the contribution of P∗A(step 1) and then still be in a position to calculate and send theneeded complementary contributionof PB (step 2). However, the case of a malicious P∗Bis more problematic, even if P∗B never
21
By increasing the number of rounds in the protocol (i.e., necessarily deviating from the tradi- tional template),biascould be reduced at most approximately proportionally to the inverse of the number of rounds [Cle86, MNS09].
aborts. This is because the contribution of P∗B(step 2) may depend on the commitment of the contribution of PA(step 1), e.g., based on some one-way function.22Thus, with overwhelming probability the simulator is not able to induce the intended final bit-string in the simulated execution, except perhaps after an expected number of rewindings that is super-polynomial in the target length.
When using a not-extractable-but-equivocable (X&Q) commitment scheme. The orig- inal protocol of Blum for coin-flipping by telephone [Blu83] fits the traditional template instantiated with a X&Q commitment scheme, namely an unconditionally-hiding com- mitment scheme with trapdoor.
– local equivocationof the contribution of PAis possible by endowing the equivocator- simulator (SQ, in the role of P
Ain the simulated execution) with knowledge of the trapdoor of the bit-commitment scheme. The trapdoor can be extracted in the setup phase, withSQrewinding the state of P
Bin order to get responses to different challenges of the ZKPoK. (This setup phase and respective rewinding are implicit in the traditional template.) Then, in the phase ofopeningthe contribution of PA(step 3),SQuses the trapdoor tolocallyequivocate each bit-commitment of P
Ato any needed bit value (namely such that the combination of contributions of both parties is equal to the one decided byFMCFin the ideal world).23
– local extractionof the contribution of PAis not possible, since the uncondition- ally-hiding commitment does not contain any extractable information. Nonetheless, rewinding allowsnon-local extraction if PA does not doearly-abort. First, the extractor-simulator (SX, in the role of P
B in the simulated execution) proceeds the simulation until the step where PAopensher contribution (step 3). Then,SX rewinds to immediately before the step where PBhas to decide a contribution (step 2). This means that,afterextracting the contribution of PA,SXis still able togo
back in timeand choose a new contribution for PB. At first glance this could seem equivalent tolocal extraction, as ifSXhad extracted the value when P
Acommitted to it (step 1), but there is an essential difference related withunfair-abort.
Even though the rewinding used fornon-localextraction does not affect the con- tribution that PAcanopen(step 3), because by definition a commitment isbinding, it may affect the willingness of a malicious P∗Ato abort withoutopeningher contribution. Specifically, between two executions (the first and the one after rewinding) with different contributions by PB(and thus also with different perspectives of a final bit-string), the probability ofunfair-abortby P∗Amay vary. In particular, an (arbitrary and probabilistic) decision-criterion of P∗Ato dounfair-abortmay be unknown toSXand dependent on
22Or uniformly sampled using
fresh(i.e., non-rewindable) randomness (if so allowed by the computational model) after each rewinding – this is not a standard model in the literature. 23
It is worth noticing that equivocation could be simply based on an equivocable commitment applied to a collision-resistant hash of the contribution of PA. A related idea appears in [Hal95] based on claw-free permutation pairs. Then, theopeningwould simply consist on sending the full contribution of PAand equivocating the opening of the respective (short) hash. This idea is used in protocol #1 directly for the contribution of PB, and in protocol #2 for other large elements that require equivocation.
the value of the contributions of PAand PB. Intuitively, this poses a difficulty to defining a suitableSX, namely (as also pointed out by Lindell [Lin03]) if different execution
paths mix negligible and noticeable probabilities of non-abort, i.e., if the probability of non-abort (when taken across different execution paths) is neither negligible nor notice- able. Furthermore, even for certain restricted classes of malicious behavior for which the author of this paper can find a suitableSX, the simulation found requiresE[#rw]to be
at least of the order of the inverse of theinitial-probability-of-no-early-abort, whereas the new protocol #1 (Fig. 1) has a simulator withE[#rw]being less than two.
It is worth pointing out that Blum’s coin-flipping protocol is adequate for many practical purposes. In particular, it is simulatable with a singleexplicit rewindingif it is assumed thatearly-abortnever occurs. Still, the observed difficulty, combining the process ofearly-abortwith the non-locality of extraction of the contribution of P∗A, was the motivation to devise in this paper a new protocol, bypassing the mentioned difficulty by using a different template.
It is left as open problem proving the non-simulatability of Blum’s protocol (i.e., when using a X&Q commitment scheme within the traditional template). Alternatively, if the protocol is simulatable, then it remains to find a suitable simulator for the case of corrupted P∗Aand calculate the respective (polynomial)E[#rw].