Sequential Rationality in Cryptographic Protocols

Abstract

Much of the literature on rational cryptography focuses on analyzing the strategic properties of cryptographic protocols. However, due to the presence of computationallybounded players and the asymptotic nature of cryptographic security, a definition of sequential rationality for this setting has thus far eluded researchers.We propose a new framework for overcoming these obstacles, and provide the first definitions of computational solution concepts that guarantee sequential rationality. We argue that natural computational variants of subgame perfection are too strong for cryptographic protocols. As an alternative, we introduce a weakening called threat-free Nash equilibrium that is more permissive but still eliminates the undesirable "empty threats" of non-sequential solution concepts.To demonstrate the applicability of our framework, we revisit the problem of implementing a mediator for correlated equilibria (Dodis-Halevi-Rabin, Crypto'00), and propose a variant of their protocol that is sequentially rational for a non-trivial class of correlated equilibria. Our treatment provides a better understanding of the conditions under which mediators in a correlated equilibrium can be replaced by a stable protocol.

Limits on the Power of Cryptographic Cheap Talk

“…As shown by Gradwohl et al [9], if one-way functions exist then all non-trivial CE in the convex hull of NE can be implemented via computational (and moreover sequentially rational) cheap talk. Taken together these results fully characterize the assumptions under which all convex hull NE can be implemented.…”

“…We already mentioned the works in [7,9]. Teague [19], and subsequently Atallah et al [1] gave a protocol for the general problem of correlated element selection achieving better efficiency than [7], but preserving the original solution concept of computational NE.…”

“…Gradwohl et al [9] that one-way functions are sufficient to implement any Minicrypt utility profile (see Appendix E).…”

“…We define empty-threat freenes along the lines of [9], specialize their general definition to the setting of CTSM games and generalizing to handle imperfect information. The details are in Appendix A.…”

“…The players need some publicly observable lottery to play according to a CHNE, that can be implemented using the protocol of Gradwohl et al [9]. However, a CE outside the convex hull of NE needs some non-trivially correlated randomness.…”