Estimating Gaps in Martingales and Applications to Coin-Tossing: Constructions and Hardness

Abstract

Consider the representative task of designing a distributed coin-tossing protocol for n processors such that the probability of heads is X0 ∈ [0, 1], and an adversary can reset one processor to change the distribution of the final outcome. For X0 = 1/2, in the non-cryptographic setting, no adversary can deviate the probability of the outcome of the well-known Blum's "majority protocol" by more than 1 √ 2πn , i.e., it is 1 √ 2πn insecure. For computationally bounded adversaries and any X0 ∈ [0, 1], the protocol of Moran, Naor, and Segev (2009) is only O 1 n insecure. In this paper, we study discrete-time martingales (X0, X1, . . . , Xn) such that Xi ∈ [0, 1], for all i ∈ {0, . . . , n}, and Xn ∈ {0, 1}. These martingales are commonplace in modeling stochastic processes like coin-tossing protocols in the non-cryptographic setting mentioned above. In particular, for any X0 ∈ [0, 1], we construct martingales that yield 1 2 X 0 (1−X 0 ) n insecure coin-tossing protocols with n-bit communication; irrespective of the number of bits required to represent the output distribution. Note that for sufficiently small X0, we achieve higher security than Moran et al.'s protocol even against computationally unbounded adversaries. For X0 = 1/2, our protocol requires only 40% of the processors to achieve the same security as the majority protocol.The technical heart of our paper is a new inductive technique that uses geometric transformations to precisely account for the large gaps in these martingales. For any X0 ∈ [0, 1], we show that there exists a stopping time τ such thatThe inductive technique simultaneously constructs martingales that demonstrate the optimality of our bound, i.e., a martingale where the gap corresponding to any stopping time is small. In particular, we construct optimal martingales such that any stopping time τ hasOur lower-bound holds for all X0 ∈ [0, 1]; while the previous bound of Cleve and Impagliazzo (1993) exists only for positive constant X0. Conceptually, our approach only employs elementary techniques to analyze these martingales and entirely circumvents the complex probabilistic tools inherent to the approaches of Cleve and Impagliazzo (1993) and Beimel, Haitner, Makriyannis, and Omri (2018). By appropriately restricting the set of possible stopping-times, we present representative applications to constructing distributed coin-tossing/dice-rolling protocols, discrete control processes, fail-stop attacking coin-tossing/dice-rolling protocols, and black-box separations. ACM Subject ClassificationMathematics of computing → Markov processes; Security and privacy → Information-theoretic techniques; Security and privacy → Mathematical foundations of cryptography 2 Estimating Gaps in Martingales and Applications to Coin-Tossing: Constructions & Hardness

Computational Hardness of Collective Coin-Tossing Protocols

“…The insecurity of this protocol is . Figure 8, as a consequence of the recent works [ 14 , 38 ], presents a protocol that has higher security than this majority protocol.…”

“…This section introduces the original combinatorial technique of Khorasgani, Maji, and Mukherjee [ 14 ] for characterizing the “most secure” coin-tossing protocol.…”

“…These hardness of computation results for the coin-tossing functionality extend to other general functionalities as well. Furthermore, the research outcomes for this functionality has direct consequences on diverse topics in mathematics and computer science—for example, extremal graph theory [ 3 , 4 , 5 ], extracting randomness from imperfect sources [ 6 , 7 , 8 , 9 ], cryptography [ 10 , 11 , 12 , 13 , 14 , 15 , 16 ], game theory [ 17 , 18 ], circuit representation [ 19 , 20 , 21 ], distributed protocols [ 22 , 23 , 24 ], and poisoning and evasion attacks on learning algorithms [ 25 , 26 , 27 , 28 ].…”

“…This survey summarizes the current state-of-the-art of coin-tossing protocols in the full information model and recent advances in this field, settling several long-standing open problems. In particular, it elaborates on a new proof technique introduced in [ 14 ] to simultaneously characterize the optimal coin-tossing protocols and prove lower bounds to the insecurity of any coin-tossing protocol. The geometric (or combinatorial) interpretation of this proof technique is inherently constructive; that is, the proof technique identifies the optimal coin-tossing protocols, which have applications in new isoperimetric inequalities in the product spaces over large alphabets [ 29 ].…”

“…Any stopping time in this coin-tossing martingale translates into adversarial attacks on the coin-tossing protocol. Khorasgani, Maji, and Mukherjee [ 14 ] introduced an inductive approach that characterizes a lower bound on the insecurity of any such coin-tossing protocol. Furthermore, their approach is constructive, i.e., it constructs a coin-tossing protocol such that its insecurity is, at most, .…”