Tighter Bounds on Multi-Party Coin Flipping via Augmented Weak Martingales and Differentially Private Sampling

Abstract

In his seminal work, Cleve [STOC '86] has proved that any r-round coin-flipping protocol can be efficiently biased by Θ(1/r). This lower bound was met for the two-party case by Moran, Naor, and Segev [Journal of Cryptology '16], and the three-party case (up to a polylog factor) by Haitner and Tsfadia [SICOMP '17], and was approached for n-party protocols when n < loglog r by Buchbinder, Haitner, Levi, and Tsfadia [SODA '17]. For n > loglog r, however, the best bias for n-party coin-flipping protocols remains O(n/ √ r) achieved by the majority protocol of Awerbuch, Blum, Chor, Goldwasser, and Micali [Manuscript '85].Our main result is a tighter lower bound on the bias of coin-flipping protocols, showing that, for every constant ε > 0, an r ε -party r-round coin-flipping protocol can be efficiently biased by Ω(1/ √ r). As far as we know, this is the first improvement of Cleve's bound, and is only n = r ε (multiplicative) far from the aforementioned upper bound of Awerbuch et al.We prove the above bound using two new results that we believe are of independent interest. The first result is that a sequence of ("augmented") weak martingales have large gap: with constant probability there exists two adjacent variables whose gap is at least the ratio between the gap between the first and last variables and the square root of the number of variables. This generalizes over the result of Cleve and Impagliazzo [Manuscript '93], who showed that the above holds for strong martingales, and allows in some setting to exploit this gap by efficient algorithms. We prove the above using a novel argument that does not follow the more complicated approach of [12]. The second result is a new sampling algorithm that uses a differentially private mechanism to minimize the effect of data divergence.

Estimating Gaps in Martingales and Applications to Coin-Tossing: Constructions and Hardness

“…This bound matches the lower-bound of Ω(1/ √ n) by Cleve and Impagliazzo [15]. It seems that it is necessary to rely on strong computational hardness assumptions or use these primitives in a non-black box manner to beat the 1/ √ n bound [16,23,17,8]. We generalize the result of Cleve and Impagliazzo [15] to all 2-party n-round bias-X 0 cointossing protocols (and improve the constants by two orders of magnitude).…”

“…We emphasize that the round i is a random variable and not a constant. Recently, in an independent work, Beimel et al [8] demonstrate an identical bound for weak martingales (that have some additional properties), which is used to model multi-party coin-tossing protocols.…”

“…In particular, we construct optimal martingales such that any stopping time τ hasOur lower-bound holds for all X0 ∈ [0, 1]; while the previous bound of Cleve and Impagliazzo (1993) exists only for positive constant X0. Conceptually, our approach only employs elementary techniques to analyze these martingales and entirely circumvents the complex probabilistic tools inherent to the approaches of Cleve and Impagliazzo (1993) and Beimel, Haitner, Makriyannis, and Omri (2018). By appropriately restricting the set of possible stopping-times, we present representative applications to constructing distributed coin-tossing/dice-rolling protocols, discrete control processes, fail-stop attacking coin-tossing/dice-rolling protocols, and black-box separations.…”

A Lower Bound for Adaptively-Secure Collective Coin Flipping Protocols

“…Alon and Omri [2] constructed an n-party r-round coin-flipping protocol with biasÕ(2 2 n /r), tolerating up to t corrupted parties, for constant n and t < 3n/4. Very recently, Beimel et al [5] gave an improved lower bound in the multi-party case: For any n-party r-round coin-flipping protocol with n k ≥ r for k ∈ N, there exists an adversary corrupting n − 1 parties and biases the output of the honest party by 1/( √ r log k r).…”

“…This implies Inequality (5), since v i+1 was chosen to minimize the value of β vi+1 − α vi+1 . Inequality (5) implies that, with overwhelming probability,…”