Utility Dependence in Correct and Fair Rational Secret Sharing
Utility Dependence in Correct and Fair Rational Secret Sharing
复制标题
DOI：
10.1007/s00145-010-9064-z
复制
发表时间：
2009-08
影响因子：
3
通讯作者：
Gilad Asharov;Yehuda Lindell
中科院分区：
文献类型：
--
作者：
Gilad Asharov;Yehuda Lindell
在博弈论意义上，当参与方是国际的情况下进行加密计算的问题最近受到了广泛的关注。合理的秘密共享是目前研究较多的一个问题。在这种情况下，目标是构建一种机制（协议），使行为理性的各方有动力在重建阶段进行合作并提供自己的股份，即使每一方都希望自己是唯一知道秘密的一方。虽然这个问题最近才被Halpern和Teague （STOC 2004）提出，但已经提出了许多具有美丽想法的作品来解决这个问题。然而，它们都具有这样的属性，即构建的协议需要知道各方的实际效用值（或至少对它们有一个界限）。这个假设是很有问题的，因为当事人的效用不是公共知识。我们质疑这种对实际效用价值的依赖是否真的有必要，并证明在双方的情况下，没有它就无法实现合理的秘密共享。从积极的方面来看，我们表明，在多方情况下，有可能构建一个适用于所有（多项式）效用函数的单一机制。我们的协议具有固定的预期轮数，并且对联盟具有最佳弹性。除此之外，我们观察到，不假设同时通道的理性秘密共享的已知协议都存在其中一方可能导致其他方输出错误值的问题。（当一方通过让另一个输出值不正确而不是通过学习秘密本身获得更高的效用时，就会出现这个问题；我们认为需要考虑这种情况。）我们表明，这个问题在非同步通道模型中是固有的，除非各方从这种攻击中获得的实用程序的实际值是已知的，在这种情况下，有可能防止这种情况发生。
The problem of carrying out cryptographic computations when the participating parties arerationalin a game-theoretic sense has recently gained much attention. One problem that has been studied considerably is that of rational secret sharing. In this setting, the aim is to construct a mechanism (protocol) so that parties behaving rationally have incentive to cooperate and provide their shares in the reconstruction phase, even if each party prefers to be the only one to learn the secret.Although this question was only recently asked by Halpern and Teague (STOC 2004), a number of works with beautiful ideas have been presented to solve this problem. However, they all have the property that the protocols constructed need to know the actual utility values of the parties (or at least a bound on them). This assumption is very problematic because the utilities of parties are not public knowledge. We ask whether thisdependence on the actual utility valuesis really necessary and prove that in the case of two parties, rational secret sharing cannot be achieved without it. On the positive side, we show that in the multiparty case it is possible to construct a single mechanism that works for all (polynomial) utility functions. Our protocol has an expected number of rounds that is constant, and is optimally resilient to coalitions.In addition to the above, we observe that the known protocols for rational secret sharing that do not assume simultaneous channels all suffer from the problem that one of the parties can cause the others to output an incorrect value. (This problem arises when a party gains higher utility by having another output an incorrect value than by learning the secret itself; we argue that such a scenario needs to be considered.) We show that this problem is inherent in the non-simultaneous channels model, unless the actual values of the parties’ utilities from this attack are known, in which case it is possible to prevent this from happening.