Rational Secret Sharing & Game Theory

Transcription

1 Rational Secret Sharing & Game Theory Diptarka Chakraborty ( ) Abstract Consider m out of n secret sharing protocol among n players where each player is rational. In 2004, J.Halpern and V.Teague first pointed out problem for any Rational Secret Sharing protocol from completely game theoretic point of view and then proposed a randomized protocol to solve that problem. Later in 2006, S. Dov Gordon and J. Katz extended the idea proposed by J.Halpern and V.Teague and introduced a new randomized protocol for Rational Secret Sharing with unbounded number of rounds. Although their protocol was secure from the game theoretic point of view but main problem in their protocol is unbounded number of rounds. Here I propose a new 2-round protocol for Rational Secret Sharing which is also completely secure from the game theoretic point of view. Introduction As one of the basic blocks in modern cryptography, secret sharing plays an important role in key management, data security, distributed computing and so on. Shamirs secret-sharing scheme allows someone to share a secret s among n other agents, so that any m of them may reconstruct it. In the protocol, the dealer or issuer will split the secret into n shares in the dealing phase, every player will get one share, and players are asked to show their shares at the reconstructing phase. The secret will be reconstructed when players get no less than m shares. However, players may send wrong shares or no share when they are asked to send right shares in reality. Suppose the agents share their part of the secret just by broadcasting a message with their share. Then the problem in Shamir s secret-sharing scheme is that rational agents will simply not broadcast their shares. Suppose that each agent would prefer to learn the secret above all else and otherwise, prefer other agents not learn the secret. Then each agent is sometimes better off not broadcasting, and never worse off. Thus, not sharing his share weakly dominates sending his share. Here first it is discussed that how Rational Secret Sharing can be designed as a Normal Form Game and then the game is analysed and Nash Equilibrium is 1

2 determined. Then a randomized protocol with unbounded number of rounds proposed by S. Dov Gordon and J. Katz is discussed analysed from game theoretic point of view. Lastly a new 2-round protocol is introduced that is secure from the game theoretic point of view. Rational Secret Sharing Secret Sharing can be defined as follows: Suppose there are n parties. A secret s is shared among them. To reconstruct the secret s, atleast m among n parties must be given. Now, when every party is rational, it is assumed that -each party prefers to learn s above all else -otherwise, prefers other parties not learn s Rational Secret Sharing as a Game Players Each agent is assumed to be as a player P i, i 1 n. Dealer can be assumed as P 0. Pay-off Now, there are several natural cryptographic considerations which might weight into the definition of party P i s utility: (1) Correctness: Each P i wishes to compute s correctly. (2) Exclusivity: Each P i prefers others parties P j not to learn the value of s correctly. (3) Privacy: Each P i wishes to leak as little as possible about its share to the other parties. (4) Voyeurism: Each P i wishes to learn as much as possible about the other parties shares. For Rational Secret Sharing it is sufficient to implement only the first two of the above. Let u i (σ) denote the utility of player P i for the strategy σ. For a particular outcome o for a strategy σ of the protocol, let δ i (σ) be the bit denoting whether or not P i learns the secret and let correct i (σ) = j i δ j (σ),i.e., correct i (σ) is simply the number of players other than i who learn the secret. Now utility function should satisfy following two criteria: (i) If δ i (σ) > δ i (σ ), then u i (σ) > u i (σ ) (ii) If δ i (σ) = δ i (σ ) and correct i (σ) < correct i (σ ), then u i (σ) > u i (σ ) 2

3 e.g. one way of constructing such a utility function is: u i (σ) = C correct i (σ), for a constant C, where C > n 1 Now, without loss of generality, utilities of players can be assumed to be as follows: If P i learns the secret then the pay-off will be U +. If all the agents learn the secret then the pay-off will be U. If none of the agents learn the secret then the pay-off will be U. U + > U > U. Analysis Now let s consider ideal situation where every computation is by a Trusted Third Party(TTP). Here every party sends their shares to the TTP and then TTP reconstructs s and then broadcast this. In this case, clearly the Nash Equilibrium is to follow the protocol because if any one of the players will deviate unilaterally from this, he cannot be better off. Now let s consider the protocol where parties broadcast their shares sequentially or concurrently and this is the case that is observed in the real world. There are two cases: (i) When m = n: If all parties follow the protocol and broadcast their shares, then for all the players pay-off will be U. But this is obviously not the Nash Equilibrium as if the player P i will see that others have broadcasted their shares already then he will remain silent because other parties cannot reconstruct the secret, but the player P i can reconstruct the secret by using his own share and shares broadcasted by other parities and thus his pay-off will be U +. So, then it will be better for the player P i not to broadcast his share. So the Nash Equilibrium will be when everyone will remain silent as in this situation everyone will get pay-off equal to U and any single player deviating unilaterally from this point will never worse off. (ii) When m < n: If all parties follow the protocol and broadcast their shares, then for all the players pay-off will be U. This is a Nash Equilibrium as if a single player will deviate unilaterally from this situation then also everyone can reconstruct the share. Another Nash Equilibrium in this case will be when everyone will remain silent as in this situation everyone will get pay-off equal to U and any single player deviating unilaterally from this point will never worse off. Now if less than m players will broadcast their shares, then if any one of them will deviate unilaterally from this then also no one can reconstruct s and thus the player who will deviate will not worse off and if all players will follow the protocol then if any one of them will deviate unilaterally from this then also everyone can reconstruct s and thus the player who will deviate will not worse off and if exactly m players will broadcast their shares then if any one among 3

4 these m players will deviate unilaterally from this situation then players who will not broadcast can reconstruct the secret using broadcasted m 1 shares and his own share but others cannot and thus the players who will not broadcast will get pay-off equal to U +. So following the protocol is weakly dominated by remaining silent. Thus Nash Equilibrium that everyone follow the protocol may not be survived from iterated deletion. Randomized Protocol to solve the Problem To solve the above mentioned problem, the first randomized protocol was proposer by J.Halpern and V.Teague[4] in However their proposed protocol solved the above mentioned problem but in their protocol they used a private communication channel in addition with broadcast. In 2006, S. Dov Gordon and J. Katz [GK 06][5] extended J.Halpern and V.Teague s idea and proposed a new randomized protocol. GK 06 Let us assume that the dealer wants to share the secret s, where s S and S is a strict subset of a finite field F. Now define a special symbol abort which is an element of F S. This protocol consists of unbounded number of iterations. At the beginning of the each iteration, with probability α, dealer generates m out of n Shamirs sharing of s and with probability 1 α, dealer generates m out of n Shamirs sharing of a special element abort. Each player begins with a flag all honest = true. During each iteration, each of the players does the following: First, if all honest = true then broadcast the share received from the dealer. Otherwise, do nothing(which is similar to the termination of the protocol). Now if atleast m shares have been broadcasted then reconstruct s and then check whether it is same as abort or not. If not then it must be the actual share s, otherwise move to the next iteration. If atleast one player failed to broadcast his share then every player set the flag all honest = false and move to next iteration. Analysis of GK 06 If parties form coalition and decide not to follow the protocol then coalition of size upto m-1, the parties involved in coalition can not reconstruct s. If coalition is of size greater than or equal to m, then if parties decide not to broadcast then with probability α he learns the secret and with probability 1 αhe does not learn the secret forever. So, in this case, expected utility of each player will be α (U+) + (1 α) (U ). Now if α is chosen such that, U > α (U+) + (1 α) (U ), then it is better 4

5 for any player to follow the protocol. Thus following the protocol is the Nash Equilibrium and it is survived from iterated deletion. Problems with Bounded Round Randomized Protocol The main problem in GK 06 protocol is that it has unbounded round complexity. As in each round probability of share secret s is α, so expected number of round will be 1 α and as α. J.Halpern and V.Teague showed that protocol with fixed number(say r) of round is not useful at all. If a protocol has r rounds, then in the r th round every party remains silent(reason is same as that for 1 round protocol). Thus actually the protocol becomes (r-1) rounded protocol and using the same argument(this is actually known as Backward Induction), it is actually similar to 1-rounded protocol and thus every party remains silent. A New 2-Round Protocol Here a new 2-rounded simple protocol is proposed that is secure from the game theoretic point of view,i.e.,nash Equilibrium is following the protocol. The protocol is as follows: Dealer first choose a random r and then determine s = s r. Then keep r with himself and distribute s following Shamir s m out of n sharing scheme where each share is digitally signed using dealer s private key. In the first round, every party broadcast their shares along with their identity. Each party keeps track of parties who have broadcasted. If less than m parties broadcast, then abort the protocol. Otherwise, each party first check validity of broadcasted shares using public key of the dealer and if all valid then reconstruct the s and broadcast along with their identity, else abort. If any party finds that any party who have not broadcasted their shares broadcast the reconstructed message then abort. Then move to the next round. In the 2 nd ) round, dealer send r to each party who has broadcasted reconstructed message(dealer sends r in the way he sends shares to each party) and then parties will reconstruct s(as s = s r). Analysis Here the Nash Equilibrium is to follow the protocol. If any one deviate from this he cannot reconstruct s and thus he will never better off and sometimes worse off. Thus following the protocol is not dominated by remaining silent. Thus the Nash Equilibrium that is to follow the protocol will be survived from iterated deletion. 5

6 Conclusion I have provided a new approach to rational secret sharing that is completely secure with respect to game theory and also it has bounded(2-round) number of rounds. Also the proposed protocol is very simple. However the problem in this proposed protocol is the computational complexity of the protocol. References [1] A. Shamir. How to Share a Secret. Communications of the ACM, 22:612613, 1979 [2] Cryptography and Game Theory by YevgeniyDodis, NYU and Tal Rabin, IBM [3] Bridging Game Theory and Cryptography: Recent Results and Future Directions by Jonathan Katz [4] J. Halpernand V. Teague. Rational secret sharing and multiparty computation. In Proc. of 36th STOC, pages ACM Press, 2004 [5] S. DovGordon and J. Katz. Rational secret sharing, revisited. In 5thConference on Security and Cryptography for Networks, Updated version available at [6] I. Abraham, D. Dolev, R. Gonen, and J. Halpern. Distributed Computing Meets Game Theory: Robust Mechanisms for Rational Secret Sharing and Multiparty Computation. 25th ACM Symposium on Principles of Distributed Computing (PODC 2006) [7] O. Goldreich. Foundations of Cryptography, vol. 2: Basic Applications, Cambridge University Press, 2004 [8] D. Fudenberg and J. Tirole. Game Theory. MIT Press,