TY - GEN

T1 - On the complexity of fair coin flipping

AU - Haitner, Iftach

AU - Makriyannis, Nikolaos

AU - Omri, Eran

N1 - Publisher Copyright:
© International Association for Cryptologic Research 2018.

PY - 2018

Y1 - 2018

N2 - A two-party coin-flipping protocol is ε -fair if no efficient adversary can bias the output of the honest party (who always outputs a bit, even if the other party aborts) by more than ε. Cleve [STOC ’86] showed that r-round o(1 / r)-fair coin-flipping protocols do not exist. Awerbuch et al. [Manuscript ’85] constructed a Θ(1/r) -fair coin-flipping protocol, assuming the existence of one-way functions. Moran et al. [Journal of Cryptology ’16] constructed an r-round coin-flipping protocol that is Θ(1 / r) -fair (thus matching the aforementioned lower bound of Cleve [STOC ’86]), assuming the existence of oblivious transfer. The above gives rise to the intriguing question of whether oblivious transfer, or more generally “public-key primitives”, is required for an o(1/r) -fair coin flipping. This question was partially answered by Dachman-Soled et al. [TCC ’11] and Dachman-Soled et al. [TCC ’14], who showed that restricted types of fully black-box reductions cannot establish o(1/r) -fair coin-flipping protocols from one-way functions. In particular, for constant-round coin-flipping protocols, [10] yields that black-box techniques from one-way functions can only guarantee fairness of order 1/r. We make progress towards answering the above question by showing that, for any constant, the existence of an 1/(c·r) -fair, r-round coin-flipping protocol implies the existence of an infinitely-often key-agreement protocol, where c denotes some universal constant (independent of r). Our reduction is non black-box and makes a novel use of the recent dichotomy for two-party protocols of Haitner et al. [FOCS ’18] to facilitate a two-party variant of the attack of Beimel et al. [FOCS ’18] on multi-party coin-flipping protocols.

AB - A two-party coin-flipping protocol is ε -fair if no efficient adversary can bias the output of the honest party (who always outputs a bit, even if the other party aborts) by more than ε. Cleve [STOC ’86] showed that r-round o(1 / r)-fair coin-flipping protocols do not exist. Awerbuch et al. [Manuscript ’85] constructed a Θ(1/r) -fair coin-flipping protocol, assuming the existence of one-way functions. Moran et al. [Journal of Cryptology ’16] constructed an r-round coin-flipping protocol that is Θ(1 / r) -fair (thus matching the aforementioned lower bound of Cleve [STOC ’86]), assuming the existence of oblivious transfer. The above gives rise to the intriguing question of whether oblivious transfer, or more generally “public-key primitives”, is required for an o(1/r) -fair coin flipping. This question was partially answered by Dachman-Soled et al. [TCC ’11] and Dachman-Soled et al. [TCC ’14], who showed that restricted types of fully black-box reductions cannot establish o(1/r) -fair coin-flipping protocols from one-way functions. In particular, for constant-round coin-flipping protocols, [10] yields that black-box techniques from one-way functions can only guarantee fairness of order 1/r. We make progress towards answering the above question by showing that, for any constant, the existence of an 1/(c·r) -fair, r-round coin-flipping protocol implies the existence of an infinitely-often key-agreement protocol, where c denotes some universal constant (independent of r). Our reduction is non black-box and makes a novel use of the recent dichotomy for two-party protocols of Haitner et al. [FOCS ’18] to facilitate a two-party variant of the attack of Beimel et al. [FOCS ’18] on multi-party coin-flipping protocols.

KW - Coin-flipping

KW - Fairness

KW - Key-agreement

UR - http://www.scopus.com/inward/record.url?scp=85057097298&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-03807-6_20

DO - 10.1007/978-3-030-03807-6_20

M3 - ???researchoutput.researchoutputtypes.contributiontobookanthology.conference???

AN - SCOPUS:85057097298

SN - 9783030038069

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 539

EP - 562

BT - Theory of Cryptography - 16th International Conference, TCC 2018, Proceedings

A2 - Beimel, Amos

A2 - Dziembowski, Stefan

T2 - 16th Theory of Cryptography Conference, TCC 2018

Y2 - 11 November 2018 through 14 November 2018

ER -