[Paper Review] Rational Threshold Cryptosystems

David Yakira, Ido Grayevsky+1 more|arXiv (Cornell University)|Jan 4, 2019

Blockchain Technology Applications and Security28 references4 citations

TL;DR

This paper proposes a rational threshold cryptosystem framework for permissionless, decentralized environments where participants are self-interested and profit-maximizing. It uses an Ethereum-based escrow service to enforce cooperation through deposit slashing and incentives, framing collusion as a prisoner’s dilemma where participants are economically disincentivized from colluding, ensuring both secrecy and robustness.

ABSTRACT

We propose a framework for threshold cryptosystems under a permissionless-economic model in which the participants are rational profit-maximizing entities. To date, threshold cryptosystems have been considered under permissioned settings with a limited adversary. Our framework relies on an escrow service that slashes and redistributes deposits to incentivize participants to adhere desired behaviors. Today, more than ever, sophisticated escrow services can be implemented over public blockchains like Ethereum, without additional trust assumptions. The key threat to rational threshold cryptosystems is collusion---by cooperating `illegally', a subset of participants can reveal the cryptosystem's secret, which, in turn is translated to unfair profit. Our countermeasure to collusion is framing. If the escrow is notified of collusion, it rewards the framer and slashes the deposits of all other participants. We show that colluding parties find themselves in the prisoner's dilemma, where the dominant strategy is framing.

Motivation & Objective

• To address the inherent conflict in threshold cryptosystems where cooperation undermines security when not timed properly.
• To model participants as rational, profit-maximizing agents in a permissionless, decentralized environment.
• To design an economic mechanism that ensures both collusion resistance and protocol robustness through deposit slashing and framing incentives.
• To enable system designers and users to assess the credibility and economic security of threshold cryptosystems via quantifiable parameters.
• To demonstrate applicability in real-world use cases such as identity revelation and randomness beacons using smart contracts.

Proposed method

• Introduces an escrow service implemented as a smart contract on Ethereum to manage deposits and enforce behavioral rules.
• Uses deposit slashing and redistribution as penalties for non-compliance or collusion, creating economic disincentives.
• Employs a framing mechanism where a participant reporting collusion is rewarded and others are penalized, turning collusion into a prisoner’s dilemma.
• Applies the framework to threshold cryptosystems like Ped-DKG and Shamir secret sharing, integrating it with existing protocols.
• Models the economic costs of breaking secrecy and robustness as functions of system parameters (t, n, R, Δ, α).
• Uses game-theoretic analysis to show that framing is the dominant strategy under collusion, making collusion unstable.

Experimental results

Research questions

• RQ1 How can threshold cryptosystems be secured against rational participants who seek to collude for private gain in a permissionless setting?
• RQ2 What economic mechanisms can enforce timely cooperation and prevent premature secret disclosure?
• RQ3 How can an escrow service be designed to scale with large numbers of participants while maintaining security and efficiency?
• RQ4 What are the quantitative economic costs of compromising secrecy and robustness in threshold cryptosystems?
• RQ5 Can framing incentives be used to transform collusion into a dominant strategy that undermines itself?

Key findings

• Collusion is economically unviable because participants face a dominant strategy to frame others, making mutual betrayal more profitable than cooperation.
• The framework ensures that participants only reveal secrets at designated times, such as after a death event or after a trapdoor expires, by aligning incentives with system design.
• In the Satoshi identity revelation example, framing rewards are set to tΔ/2, reducing the incentive to collude early and allowing smaller deposits than previously required.
• The escrow mechanism can be implemented on Ethereum using smart contracts, enabling trustless enforcement without additional trust assumptions.
• The economic cost of disrupting robustness is quantified as Δ, the total deposit slashed, which must exceed the gain from premature cooperation (R/n), ensuring security.
• The framework enables both permissioned and permissionless deployments, with the latter requiring scalable DKG protocols to support large n and t.