Classical results on secure multi-party computation (MPC) imply that fully
secure computation, including fairness (either all parties get output or none)
and robustness (output delivery is guaranteed), is impossible unless a
majority of the parties is honest.
Recently, cryptocurrencies like Bitcoin where utilized to leverage the
fairness loss in MPC against a dishonest majority. The idea is that when the
protocol aborts in an unfair manner (i.e., after the adversary
receives output) then honest parties get compensated by
the adversarially controlled parties.
Our contribution is three-fold.
First, we put forth a new formal model of secure MPC with compensation and we show
how the introduction of suitable ledger and synchronization
functionalities makes it possible to express completely such protocols using standard
interactive Turing machines (ITM) circumventing the need for the use of extra features
that are outside the standard model as in previous works.
Second, our model, is expressed in the universal composition setting with global setup and is equipped
with a composition theorem that enables the design of protocols that compose safely
with each other and within larger environments where other protocols with compensation
take place; a composition theorem for MPC protocols with compensation was not known before.
Third, we introduce the first robust MPC protocol with compensation, i.e., an MPC protocol
where not only fairness is guaranteed (via compensation) but additionally the protocol is
guaranteed to deliver output to the parties that get engaged and therefore the adversary,
after an initial round of deposits, is not even able to mount a denial of service attack without having to suffer a monetary penalty.
Importantly, our robust MPC protocol requires only a {\em constant } number of
(coin-transfer and communication) rounds.
↧