[Paper Review] Trust enhancement by multiple random beacons

Charles H. Bennett, John A. Smolin|ArXiv.org|Jan 6, 2002

Cryptography and Data Security2 references3 citations

TL;DR

This paper proposes a trust-enhancement protocol using multiple random beacons to produce a more unpredictable and secure random stream by XORing their outputs, ensuring unpredictability if at least one beacon is honest. The method significantly reduces the risk of sabotage, especially when beacons are spacelike-separated, and outperforms hash-based alternatives that can be biased by computationally powerful adversaries.

ABSTRACT

Random beacons-information sources that broadcast a stream of random digits unknown by anyone beforehand-are useful for various cryptographic purposes. But such beacons can be easily and undetectably sabotaged, so that their output is known beforehand by a dishonest party, who can use this information to defeat the cryptographic protocols supposedly protected by the beacon. We explore a strategy to reduce this hazard by combining the outputs from several noninteracting (eg spacelike-separated) beacons by XORing them together to produce a single digit stream which is more trustworthy than any individual beacon, being random and unpredictable if at least one of the contributing beacons is honest. If the contributing beacons are not spacelike separated, so that a dishonest beacon can overhear and adapt to earlier outputs of other beacons, the beacons' trustworthiness can still be enhanced to a lesser extent by a time sharing strategy. We point out some disadvantages of alternative trust amplification methods based on one-way hash functions.

Motivation & Objective

• To address the vulnerability of single random beacons to pre-computation sabotage by dishonest operators or hardware backdoors.
• To design a protocol that amplifies trust in random beacon outputs by combining multiple noninteracting beacons, even when some are compromised.
• To demonstrate that XOR-based fusion of spacelike-separated beacons produces a resultant stream that remains unpredictable if at least one beacon is honest.
• To show that hash-based fusion methods are vulnerable to biasing attacks by computationally powerful adversaries, especially in timelike or sequential beacon configurations.
• To compare the security properties of XOR, time-sharing, and hash-based fusion protocols under varying assumptions about adversary capabilities and beacon synchronization.

Proposed method

• Combines outputs from n noninteracting (e.g., spacelike-separated) random beacons using bitwise XOR to produce a resultant random stream R_XOR.
• Uses a time-sharing protocol (R_TS) for beacons that are not spacelike-separated, where each beacon is used in a rotating schedule to reduce predictability.
• Analyzes the min-entropy per character of R_XOR and R_TS, showing that both achieve (n−k)/n log ℓ, where k is the number of dishonest beacons.
• Demonstrates that a computationally powerful adversary (Eve) can bias the output of a hash-based fusion R_h by selecting specific inputs to force desired bits in the output.
• Shows that in timelike configurations, Eve can force up to several dozen bits of R_h to match a target string by brute-forcing over inputs after observing the honest beacon’s output.
• Contrasts the predictability patterns: R_h allows an adversary to control specific bits of choice, while R_TS forces unpredictability over half the bits without control over position.

Experimental results

Research questions

• RQ1 Can combining multiple random beacons via XOR produce a resultant stream that remains unpredictable even if some beacons are dishonest?
• RQ2 How does the trustworthiness of the combined stream scale with the number of honest beacons when using XOR versus time-sharing protocols?
• RQ3 Why are hash-based fusion methods, such as R_h, less secure than XOR or time-sharing when the adversary has significant computational power?
• RQ4 What is the impact of beacon synchronization (spacelike vs. timelike separation) on the security of combined random streams?
• RQ5 In what scenarios is partial predictability of the output (e.g., control over specific bits) more or less damaging to cryptographic applications?

Key findings

• The XOR-based fusion of spacelike-separated beacons produces a resultant stream R_XOR that is perfectly random and unpredictable if at least one beacon is honest, achieving optimal min-entropy of (n−k)/n log ℓ per character.
• The time-sharing protocol R_TS achieves the same min-entropy as R_XOR, (n−k)/n log ℓ, and ensures unpredictability even when all beacons are not spacelike-separated.
• A computationally powerful adversary can bias the output of hash-based fusion R_h by forcing specific bits (e.g., first bit to be 0) through strategic input selection, especially when beacons are timelike-separated.
• In timelike configurations, a powerful Eve can force up to several dozen bits of R_h to match a target string by observing the honest beacon’s output and searching over inputs, with success probability ~1/e for exact matches.
• Hash-based fusion R_h is less secure than XOR or time-sharing because it allows an adversary to control specific bits of the output, whereas time-sharing only makes half the bits unpredictable without positional control.
• For time-bracketed video authentication, R_TS is preferable to R_h because a few uncontrollable challenges are harder to simulate than many partially controllable ones.