[Paper Review] Fair coin flipping: tighter analysis and the many-party case

Niv Buchbinder, Iftach Haitner+2 more|arXiv (Cornell University)|Jan 16, 2017

Cryptography and Data Security10 citations

TL;DR

This paper presents a new t-party, m-round coin-flipping protocol with bias O(1/m^{1/2 + Θ(1)}) for constant t, improving upon the prior O(1/m^{1/2}) bias of [9] and the O(log³m/m) bias of [32] for three parties. It introduces a novel linear programming duality framework to analyze adversarial strategies, enabling tighter bounds on bias in multi-party fair coin-flipping under dishonest majority.

ABSTRACT

In a multi-party fair coin-flipping protocol, the parties output a common (close to) unbiased bit, even when some corrupted parties try to bias the output. In this work we focus on the case of dishonest majority, ie at least half of the parties can be corrupted. [19] [STOC 1986] has shown that in any m-round coin-flipping protocol the corrupted parties can bias the honest parties' common output bit by Θ(1/m). For more than two decades the best known coin-flipping against majority was the protocol of [9] [Manuscript 1985], who presented a t-party, m-round protocol with bias [EQUATION]. This was changed by the breakthrough result of [42] [TCC 2009], who constructed an m-round, two-party coin-flipping protocol with optimal bias Θ(1/m). Recently, [32] [STOC 14] constructed an m-round, three-party coin-flipping protocol with bias O(log3m/m). Still for the case of more than three parties, against arbitrary number of corruptions, the best known protocol remained the [EQUATION]-bias protocol of [9].We make a step towards eliminating the above gap, presenting a t-party, m-round coin-flipping protocol, with bias [EQUATION]. This improves upon the [EQUATION]-bias protocol of [9] for any t ≤ 1/2 · log log m, and in particular for t ∈ O(1), this yields an 1/m1/2+Θ(1)-bias protocol. For the three-party case, this yields an [EQUATION]-bias protocol, improving over the the O(log3m/m)-bias protocol of [32]. Our protocol generalizes that of [32], by presenting an appropriate protocols for the remaining parties to interact in, in the case that some parties abort or caught cheating ([32] only presented a two-party defense protocol, which limits their final protocol to handle three parties).We analyze our new by presenting a new paradigm for analyzing fairness of coin-flipping protocols. We map the set of adversarial strategies that try to bias the honest parties outcome in the protocol to the set of the feasible solutions of a linear program. The gain each strategy achieves is the value of the corresponding solution. We then bound the the optimal value of the linear program by constructing a feasible solution to its dual.

Motivation & Objective

• To close the gap in bias bounds for multi-party fair coin-flipping under dishonest majority, especially for t > 3 parties.
• To improve upon the long-standing O(1/m^{1/2}) bias protocol of [9] for t ≤ 1/2 · log log m.
• To extend the three-party protocol of [32] to handle more than three parties by generalizing the defense mechanism against cheating or aborting parties.
• To develop a new analytical paradigm for fairness in coin-flipping protocols using linear programming duality.

Proposed method

• Map adversarial strategies that bias the output to feasible solutions of a linear program, where the strategy's gain corresponds to the solution's objective value.
• Construct a dual linear program and bound the optimal value of the primal by exhibiting a feasible solution to the dual.
• Generalize the two-party defense protocol of [32] to support t-party interactions, enabling resilience against aborts or cheating in larger groups.
• Use the duality gap between primal and dual solutions to derive tight upper bounds on the maximum achievable bias.
• Apply the framework to analyze protocols with arbitrary numbers of corrupted parties, focusing on the m-round setting.
• Leverage the structure of adversarial behavior to model strategy spaces as convex sets, enabling optimization-based analysis.

Experimental results

Research questions

• RQ1 Can the bias in multi-party coin-flipping be reduced below O(1/m^{1/2}) for t > 3 parties under dishonest majority?
• RQ2 How can the two-party defense mechanism of [32] be extended to support t-party protocols with more than three participants?
• RQ3 Can a unified analytical framework be developed to bound the maximum bias in coin-flipping protocols using linear programming duality?
• RQ4 What is the tightest possible bias achievable in m-round, t-party coin-flipping when t grows with m?
• RQ5 Does the dual linear program approach yield tighter bounds than previous analytical techniques for adversarial strategy evaluation?

Key findings

• The proposed protocol achieves a bias of O(1/m^{1/2 + Θ(1)}) for any constant t, improving upon the O(1/m^{1/2}) bias of [9] for t ≤ 1/2 · log log m.
• For the three-party case, the protocol achieves bias O(1/m^{1/2 + Θ(1)}), improving over the O(log³m/m) bias of [32].
• The new linear programming duality framework provides a tighter upper bound on adversarial bias than previous methods.
• The dual solution construction effectively bounds the optimal value of the primal strategy space, enabling precise bias analysis.
• The generalized defense mechanism allows the protocol to handle cheating or aborting parties in t-party settings beyond three parties.
• The framework is extensible to arbitrary t and m, offering a scalable method for analyzing fairness in multi-party coin-flipping.