Adaptively Secure Broadcast

Abstract

Abstract.A broadcast protocol allows a sender to distribute a message through a point-to-point network to a set of parties, such that (i) all parties receive the same message, even if the sender is corrupted, and (ii) this is the sender's message, if he is honest. Broadcast protocols satisfying these properties are known to exist if and only if t < n/3, where n denotes the total number of parties, and t denotes the maximal number of corruptions. When a setup allowing signatures is available to the parties, then such protocols exist even for t < n.Since its invention in [LSP82], broadcast has been used as a primitive in numerous multi-party protocols making it one of the fundamental primitives in the distributed-protocols literature. The security of these protocols is analyzed in a model where a broadcast primitive which behaves in an ideal way is assumed. Clearly, a definition of broadcast should allow for secure composition, namely, it should be secure to replace an assumed broadcast primitive by a protocol satisfying this definition. Following recent cryptographic reasoning, to allow secure composition the ideal behavior of broadcast can be described as an ideal functionality, and a simulation-based definition can be used.In this work, we show that the property-based definition of broadcast does not imply the simulation-based definition for the natural broadcast functionality. In fact, most broadcast protocols in the literature do not securely realize this functionality, which raises a composability issue for these broadcast protocols. In particular, we do not know of any broadcast protocol which could be securely invoked in a multi-party computation protocol in the secure-channels model. The problem is that existing protocols for broadcast do not preserve the secrecy of the message while being broadcasted, and in particular allow the adversary to corrupt the sender (and change the message), depending on the message being broadcasted. For example, when every party should broadcast a random bit, the adversary could corrupt those parties who intend to broadcast 0, and make them broadcast 1.More concretely, we show that simulatable broadcast in a model with secure channels is possible if and only if t < n/3, respectively t ≤ n/2 when a signature setup is available. The positive results are proven by constructing secure broadcast protocols.

Adaptively secure broadcast, revisited

“…We stress that our model is different from that considered by Hirt and Zikas [11], where in each round the honest parties' messages are first delivered to the corrupted parties only and then the adversary is allowed to corrupt additional parties and decide what messages to send on behalf of those parties to other honest players. In contrast, we assume that honest parties' messages are delivered "atomically", which is equivalent to assuming that adversarial corruption cannot occur in the time interval between when a message is sent and when it is received.…”

“…(I.e., our definition does not guarantee secrecy for m; note that this only makes a difference when S corrupts no parties.) Our definition of relaxed broadcast is from [11].…”

“…Figure 1). In [11], the authors construct a broadcast protocol for t < n/2 by having the sender use verifiable secret sharing (VSS) to "commit" to its message before revealing it. (For t = n/2 they use a slight variant of this idea.)…”

“…A more realistic model of synchronous communication (see, e.g., [2]) is one in which messages sent by honest parties within any given round are delivered atomically to all other parties. 2 Importantly, however, the attacks that were demonstrated by Hirt and Zikas [11] on existing broadcast protocols remain valid even if we assume atomic message delivery. Consider, for example, the authenticated broadcast protocol of Dolev and Strong [9] where, at a high level, in the first round the sender digitally signs and sends his message to all the other parties, while in subsequent rounds parties append their signatures and forward the result.…”

“…A recent result by Hirt and Zikas [11] therefore came as quite a surprise. They studied the problem of designing broadcast protocols with security against adaptive adversaries who can choose which parties to corrupt during the course of the protocol (cf.…”