Complete fairness in secure two-party computation

Abstract

In the setting of secure two-party computation, two mutually distrusting parties wish to compute some function of their inputs while preserving, to the extent possible, various security properties such as privacy, correctness, and more. One desirable property is fairness, which guarantees that if either party receives its output, then the other party does too. Cleve (STOC 1986) showed that complete fairness cannot be achieved in general in the two-party setting; specifically, he showed (essentially) that it is impossible to compute Boolean XOR with complete fairness. Since his work, the accepted folklore has been that nothing non-trivial can be computed with complete fairness, and the question of complete fairness in secure two-party computation has been treated as closed since the late '80s.In this paper, we demonstrate that this widely held folklore belief is false by showing completely-fair secure protocols for various non-trivial two-party functions including Boolean AND/OR as well as Yao's "millionaires' problem". Surprisingly, we show that it is even possible to construct completely-fair protocols for certain functions containing an "embedded XOR", although in this case we also prove a lower bound showing that a super-logarithmic number of rounds are necessary. Our results demonstrate that the question of completely-fair secure computation without an honest majority is far from closed.

Efficient Rational Secret Sharing in Standard Communication Networks

“…Motivated by recent work on fairness (in the malicious setting) [10,12], we suggest the following, new approach: delay the signal indicating whether a given iteration is real or fake until the following iteration. As before, a party cannot risk aborting until it is sure that the real iteration has occurred; the difference is that now, once a party learns that the real iteration occurred, the real iteration is over and all parties can reconstruct the secret.…”

Partial Fairness in Secure Two-Party Computation

“…Gordon et al [22] recently showed that complete fairness is possible in the two-party setting for certain specific functions. Work continuing that direction is complementary to our work here: while we do not yet have a complete characterization of what can be computed with complete fairness, we know that there certainly do exist some functions that cannot be computed with complete fairness [10] and so some relaxation must be considered (at least for some functions).…”

“…(For simplicity, here we omit the dependence of X, Y , and Z on n, and focus on the case where each party receives the same output.) As in [23,22,27], our protocols will be composed of two stages, where the first stage can be viewed as a "pre-processing" step and the second stage takes place in a sequence of r = r(n) iterations. The stages have the following form:…”

“…, r}. (In [22] a geometric distribution was used. That would work here, but with slightly worse round complexity.)…”

“…That would work here, but with slightly worse round complexity.) When X and Y (the domains of f ) are polynomial size, we follow [22] and set a i = f (x,ŷ) forŷ chosen uniformly from Y , and set b i = f (x, y) forx chosen uniformly (and independently) from X. Note that a i (resp., b i ) is independent of y (resp., x), as desired.…”