Asynchronous MPC with a strict honest majority using non-equivocation

Abstract

Multiparty computation (MPC) among n parties can tolerate up to t < n/2 active corruptions in a synchronous communication setting; however, in an asynchronous communication setting, the resiliency bound decreases to only t < n/3 active corruptions. We improve the resiliency bound for asynchronous MPC (AMPC) to match synchronous MPC using non-equivocation.Non-equivocation is a message authentication mechanism to restrict a corrupted sender from making conflicting statements to different (honest) parties. It can be implemented using an increment-only counter and a digital signature oracle, realizable with trusted hardware modules readily available in commodity computers and smartphone devices. A non-equivocation mechanism can also be transferable and allow a receiver to verifiably transfer the authenticated statement to other parties. In this work, using transferable non-equivocation, we present an AMPC protocol tolerating t < n/2 faults. From a practical point of view, our AMPC protocol requires fewer setup assumptions than the previous AMPC protocol with t < n/2 by Beerliová-Trubíniová, Hirt and Nielsen [PODC 2010]: unlike their AMPC protocol, it does not require any synchronous broadcast round at the beginning of the protocol and avoids the threshold homomorphic encryption setup assumption. Moreover, our AMPC protocol is also efficient and provides a gain of Θ(n) in the communication complexity per multiplication gate, over the AMPC protocol of Beerliová-Trubíniová et al. In the process, using non-equivocation, we also define the first asynchronous verifiable secret sharing (AVSS) scheme with t < n/2, which is of independent interest to threshold cryptography.

Towards a Restrained Use of Non-Equivocation for Achieving Iterative Approximate Byzantine Consensus

“…Some works try to achieve similar goals but consider a different problem. In the case of the exact Byzantine consensus problem, [15], [16], [5], [6], [4] have studied the power of non-equivocation. By using transferable authentication and non-equivocation, [15] succeeds to transform any protocol that works under the crash model into a protocol that tolerates Byzantine failures without increasing the number of nodes.…”

“…By using transferable authentication and non-equivocation, [15] succeeds to transform any protocol that works under the crash model into a protocol that tolerates Byzantine failures without increasing the number of nodes. Based on the same methodology, in [16], the resiliency bound for asynchronous multiparty computation is improved to n ≥ 2f + 1. Recently, uniform hyperedges [5], [6], [4] have been considered to restrict equivocation.…”

Linear Overhead Optimally-Resilient Robust MPC Using Preprocessing

“…Alternatively, one can assume a constant number of synchronous communication rounds after the synchronization point and run constant expected round synchronous agreement protocols [31]. -Non-equivocation Mechanism: In [18,2] it is shown how to design agreement protocols with t < n/2 in an asynchronous setting, provided there is a mechanism to enforce "non-equivocation". On a very high level, such a mechanism prevents a corrupted party to transmit conflicting messages to honest parties; however a corrupted party may send messages to certain number of parties and decide not to communicate to the rest of the parties.…”

“…So such a mechanism is strictly weaker than the broadcast primitive. In [18,2] it is also discussed how such a non-equivocation mechanism can be securely realized assuming a trusted hardware module with each party. One can use such a non-equivocation mechanism to agree about the status of Π PREP .…”

Privacy Preserving Payments in Credit Networks: Enabling trust with privacy in online marketplaces

“…An edge (or link) capacity α ij for a link (i, j) ∈ E is computed as α ij = credit limit ji − balance ij , where balance ij is the balance on the Ripple link and credit limit ji is its capacity. 2 The final step toward obtaining our experiment dataset consisted of carrying out every transaction t ∈ T using the maxflow algorithm to find all possible paths between sender and receiver in G. If t can be successfully carried out, it is added to T . Therefore, our experiment dataset is composed of the graph G and the transaction set T .…”