Fair Two-Party Computations via Bitcoin Deposits

Abstract

Abstract. We show how the Bitcoin currency system (with a small modification) can be used to obtain fairness in any two-party secure computation protocol in the following sense: if one party aborts the protocol after learning the output then the other party gets a financial compensation (in bitcoins). One possible application of such protocols is the fair contract signing: each party is forced to complete the protocol, or to pay to the other one a fine. We also show how to link the output of this protocol to the Bitcoin currency. More precisely: we show a method to design secure two-party protocols for functionalities that result in a "forced" financial transfer from one party to the other. Our protocols build upon the ideas of our recent paper "Secure Multiparty Computations on Bitcoin" (Cryptology ePrint Archive, Report 2013/784). Compared to that paper, our results are more general, since our protocols allow to compute any function, while in the previous paper we concentrated only on some specific tasks (commitment schemes and lotteries). On the other hand, as opposed to "Secure Multiparty Computations on Bitcoin", to obtain security we need to modify the Bitcoin specification so that the transactions are "non-malleable" (we discuss this concept in more detail in the paper).

A Denial of Service attack against fair computations using Bitcoin deposits

“…This inclusion of control over the network is consistent with the security definition for ADMM: they assume the adversary has control over the network, which is sufficient to launch a network-level DoS attack against another party. 1 We show how an adversary A that pretends to be honest can turn another honest party B into a dishonest party in the eyes of the protocol by performing a DoS attack on B at the appropriate time.…”

“…Several recent works by Andrychowicz et al [1,2] (Protocol "ADMM") and Bentov and Kumaresan [3] (Protocol "BK") describe multi-party computation schemes in which Bitcoin deposits are used to ensure fairness. The general idea is that parties in the computation make a deposit at the beginning of the computation, which honest parties will get back in the end.…”

How to Use Bitcoin to Design Fair Protocols

“…In summary, in all these works, (1) the honest party has to expend extra effort, and (2) the adversary essentially gets away with cheating. 3 Ideally, rather than asking an honest party to invest additional time and money whenever fairness is (expected to be) breached by the adversary, one would expect "fair" mechanisms to compensate an honest party in such situations. Indeed, this point-of-view was taken by several works [73,69,16].…”

“…Conceptually, our work provides the missing piece that simultaneously allows (1) designing protocols of fair secure computation that rely on Bitcoin (and not a trusted central bank), and (2) designing protocols for fair lottery on Bitcoin that use secure computation (and not a trusted gambling website). Our model of fairness is essentially the same as in [4,73,69,3] in that we wish to monetarily penalize an adversary that aborts the protocol after learning the output. We distinguish ourselves from most prior work by providing a formal treatment, namely specifying formal security models and definitions, and proving security of our constructions.…”

“…Most related to our work are the works of Back and Bentov [11] and Andrychowicz et al [4,3]. Indeed, our work is heavily inspired by [11,4] who, to the best of our knowledge, were the first to propose fair two-party (resp.…”