Round-Efficient Byzantine Agreement and Multi-party Computation with Asynchronous Fallback

Abstract

Protocols for Byzantine agreement (BA) and secure multi-party computation (MPC) can be classified according to the underlying communication model. The two most commonly considered models are the synchronous one and the asynchronous one. Synchronous protocols typically lose their security guarantees as soon as the network violates the synchrony assumptions. Asynchronous protocols remain secure regardless of the network conditions, but achieve weaker security guarantees even when the network is synchronous. Recent works by Blum, Katz and Loss [TCC'19], and Blum, Liu-Zhang and Loss [CRYPTO'20] introduced BA and MPC protocols achieving security guarantees in both settings: security up to ts corruptions in a synchronous network, and up to ta corruptions in an asynchronous network, under the provably optimal threshold trade-offs ta ≤ ts and ta + 2ts < n. However, current solutions incur a high synchronous round complexity when compared to state-of-the-art purely synchronous protocols. When the network is synchronous, the round complexity of BA protocols is linear in the number of parties, and the round complexity of MPC protocols also depends linearly on the depth of the circuit to evaluate. In this work, we provide round-efficient constructions for both primitives with optimal resilience: fixed-round and expected constant-round BA protocols, and an MPC protocol whose round complexity is independent of the circuit depth.

Network-Agnostic Security Comes (Almost) for Free in DKG and MPC

“…In Table 1, we compare the existing stateof-the-art with our proposed DKG which, as we show, satisfies these aims. We stress that this goal cannot be achieved by simply running a generic, network-agnostic MPC protocol [BLL20,DHLZ21], since these protocols require trusted setup in the form of shared keys (which is exactly the goal we are trying to achieve).…”

“…Our contributions are motivated by a series of recent works on network-agnostic protocols for various types of consensus [BKL19,BKL21] and multi-party computation [BLL20,ABKL22a,ACC22a] (MPC). Existing protocols, however, strongly rely on trusted setup, particularly in the form of threshold cryptosystems [BLL20,DHLZ21]. Thus, the import of our work lies within replacing this setup at essentially no cost.…”

Perfectly-Secure Synchronous MPC with Asynchronous Fallback Guarantees

“…Best-of-both-worlds protocols have been studied very recently. [16] and [17,26] show that the condition 2t s + t a < n is necessary and sufficient for best-of-both-worlds cryptographically-secure BA and MPC respectively, tolerating computationally bounded adversaries. Another line of work considers asynchronous networks with some form of partial synchrony and builds protocols for various secure distributed computing tasks [35,38,5,42].…”

“…A common principle used in [16,17,26] to design best-of-both-worlds protocols for a specific task T (BA/MPC) is the following: the parties first run a synchronous protocol for T with threshold t s , which also provides certain security guarantees in an asynchronous environment tolerating t a cor-ruptions. After the known "time-out" of the synchronous protocol, the parties run an asynchronous protocol for T with threshold t a , which also provides certain security guarantees in the presence of t s corruptions.…”

Perfectly-Secure Synchronous MPC with Asynchronous Fallback Guarantees

“…All existing works in the domain of the best-of-both-worlds protocols focus only on threshold adversary model. The works of [9] and [11,17] show that the condition 2t s + t a < n is necessary and sufficient for best-of-both-worlds cryptographically-secure BA and MPC respectively, tolerating computationally bounded adversaries. Using the same condition, [10] presents a best-of-bothworlds cryptographically-secure atomic broadcast protocol.…”