Reaching Consensus for Asynchronous Distributed Key Generation

Abstract

We give a protocol for Asynchronous Distributed Key Generation (A-DKG) that is optimally resilient (can withstand < 3 faulty parties), has a constant expected number of rounds, has˜( 3 ) expected communication complexity, and assumes only the existence of a PKI. Prior to our work, the best A-DKG protocols required Ω( ) expected number of rounds, and Ω( 4 ) expected communication.Our A-DKG protocol relies on several building blocks that are of independent interest. We define and design a Proposal Election (PE) protocol that allows parties to retrospectively agree on a valid proposal after enough proposals have been sent from different parties.With constant probability the elected proposal was proposed by a nonfaulty party. In building our PE protocol, we design a Verifiable Gather protocol which allows parties to communicate which proposals they have and have not seen in a verifiable manner. The final building block to our A-DKG is a Validated Asynchronous Byzantine Agreement (VABA) protocol. We use our PE protocol to construct a VABA protocol that does not require leaders or an asynchronous DKG setup. Our VABA protocol can be used more generally when it is not possible to use threshold signatures. CCS CONCEPTS• Theory of computation → Distributed algorithms; Cryptographic protocols.

Basilic: Resilient Optimal Consensus Protocols With Benign and Deceitful Faults

“…Cryptography We assume a public-key infrastructure (PKI) in which each party has a public key and a private key, and any party's public key is known to all [44]. As with other protocols that use this standard assumption [44,1], we do not require the use of revocation lists (we will remove processes from the committee, but not from their keys from the PKI). We refer to λ as the security parameter, i.e., the number of bits of the keys.…”

Distributed Randomness from Approximate Agreement

“…None of them are completely new, but some of them are modified according to our needs. In particular, we introduce the Random Secret Draw abstraction inspired by the ideas from [10] and [2] (Section 3.3 and appendix D). We also provide a bundled version of the Approximate Agreement [15,1] abstraction (Section 3.5).…”

“…We, therefore, give two possible implementations. The first one is secure against an adaptive adversary and does not rely on PKI, while the second one uses the implementation from [2] that relies of Aggregatable Publicly Verifiable Secret Sharing (described in Appendix D.2.1) instead of AVSS. While saving a linear factor in communication complexity, this solution lacks security against adaptive adversary and requires PKI.…”

“…While saving a linear factor in communication complexity, this solution lacks security against adaptive adversary and requires PKI. Since both [10] and [2] did not considered RSD as a separate abstraction and did not provide separate pseudocode for it, we present both RSD implementations in Appendix D.…”

“…We also introduce the concept of a Monte Carlo common coin which is a probabilistic common coin whose success rate δ can be parameterized as follows: the more rounds of the protocol are executed, the more reliable the outcome is. In our case δ starts at 2 3 in the first round of the protocol and converges to 1 at an exponential rate in the number of rounds. In most probabilistic common coins, δ could be increased by decreasing the resilience level (the allowed fraction of Byzantine processes).…”