Efficiently Making Secure Two-Party Computation Fair

Abstract

Abstract. Secure two-party computation cannot be fair against malicious adversaries, unless a trusted third party (TTP) or a gradual-release type super-constant round protocol is employed. Existing optimistic fair two-party computation protocols with constant rounds are either too costly to arbitrate (e.g., the TTP may need to re-do almost the whole computation), or require the use of electronic payments. Furthermore, most of the existing solutions were proven secure and fair via a partial simulation, which, we show, may lead to insecurity overall. We propose a new framework for fair and secure two-party computation that can be applied on top of any secure two party computation protocol based on Yao's garbled circuits and zero-knowledge proofs. We show that our fairness overhead is minimal, compared to all known existing work. Furthermore, our protocol is fair even in terms of the work performed by Alice and Bob. We also prove our protocol is fair and secure simultaneously, through one simulator, which guarantees that our fairness extensions do not leak any private information. Lastly, we ensure that the TTP never learns the inputs or outputs of the computation. Therefore, even if the TTP becomes malicious and causes unfairness by colluding with one party, the security of the underlying protocol is still preserved.

Fairness in an Unfair World

“…Starting from the early work of [15], optimistic models for fair exchange have been studied in a long sequence of works [11,12,30,33,54,57]. An optimistic model for fair two-party computation using a semi-trusted third party was studied in [20,51].…”

Fast Optimistically Fair Cut-and-Choose 2PC

“…Simulation-based Proof with Fairness. One important difference between our proof and those of standard 2PC is that in our case the ideal trusted party must only be contacted by the simulator once it is certain that both parties can obtain the output, as first observed by Kılınç and Küpçü [35] for indistinguishability of the ideal and real world outputs. Therefore, to overcome this difficulty, Alice also commits to Bob's output translation tables as c B i using a trapdoor commitment, and opens them for the opened circuits.…”

“…2 (i) Gradual release-based approaches let Alice and Bob reveal each other's output piece by piece, using superconstant rounds [60,36,64,63]. (ii) Arbiter-based approaches achieve constant round complexity by assuming that a trusted third party is available when needed [18,47,35,34]. Optimistic approaches employ the Arbiter only if there is a dispute among the parties [5].…”

“…The most relevant work to ours is that of Cachin and Camenisch [18], and the follow up work of [35], in the same optimistic Arbiter-based setting. Both constructions utilize zero-knowledge proofs that require public-key operations, and hence have a high computational cost compared to the state-of-the-art cut-and-choose 2PC.…”

“…See Table 1 for a list of the main differences between these work and ours. [18] [47] [35] Resolutions with Arbiter take time proportional to the circuit size Requires a payment system and employs penalty-based fairness.…”