Rational Secret Sharing with Repeated Games Maleka Shaik, Amjed Shareef and C. Pandu Rangan Theoretical Computer Science Lab Department of Computer Science and Engineering IIT Madras

23rd April 2008

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

1 / 29

Outline

Outline 1

Introduction Secret Sharing Basics of Game Theory Rational Secret Sharing

2

Literature Survey

3

Motivation

4

Rational Secret Sharing with Repeated Games Intuition The Protocol

5

Conclusion

6

References C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

2 / 29

Outline

Outline 1

Introduction Secret Sharing Basics of Game Theory Rational Secret Sharing

2

Literature Survey

3

Motivation

4

Rational Secret Sharing with Repeated Games Intuition The Protocol

5

Conclusion

6

References C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

2 / 29

Outline

Outline 1

Introduction Secret Sharing Basics of Game Theory Rational Secret Sharing

2

Literature Survey

3

Motivation

4

Rational Secret Sharing with Repeated Games Intuition The Protocol

5

Conclusion

6

References C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

2 / 29

Outline

Outline 1

Introduction Secret Sharing Basics of Game Theory Rational Secret Sharing

2

Literature Survey

3

Motivation

4

Rational Secret Sharing with Repeated Games Intuition The Protocol

5

Conclusion

6

References C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

2 / 29

Outline

Outline 1

Introduction Secret Sharing Basics of Game Theory Rational Secret Sharing

2

Literature Survey

3

Motivation

4

Rational Secret Sharing with Repeated Games Intuition The Protocol

5

Conclusion

6

References C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

2 / 29

Outline

Outline 1

Introduction Secret Sharing Basics of Game Theory Rational Secret Sharing

2

Literature Survey

3

Motivation

4

Rational Secret Sharing with Repeated Games Intuition The Protocol

5

Conclusion

6

References C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

2 / 29

Introduction

Secret Sharing

Outline 1

Introduction Secret Sharing Basics of Game Theory Rational Secret Sharing

2

Literature Survey

3

Motivation

4

Rational Secret Sharing with Repeated Games Intuition The Protocol

5

Conclusion

6

References C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

3 / 29

Introduction

Secret Sharing

Introduction Shamir’s Secret-Sharing scheme [1]: Dealer has a secret s (an integer) which he wants to share among other n players in such a way that any m of them can reconstruct it. Dealer chooses a polynomial f of degree (m − 1) with f (0) = s. Dealer sends f (i) to player i, i = 1, 2, . . . n, f (i) is player i’s secret share. Any subset of m players can pool their shares and reconstruct f , and hence the secret, f (0). No subset of size < m can figure out the secret.

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

4 / 29

Introduction

Secret Sharing

Introduction Shamir’s Secret-Sharing scheme [1]: Dealer has a secret s (an integer) which he wants to share among other n players in such a way that any m of them can reconstruct it. Dealer chooses a polynomial f of degree (m − 1) with f (0) = s. Dealer sends f (i) to player i, i = 1, 2, . . . n, f (i) is player i’s secret share. Any subset of m players can pool their shares and reconstruct f , and hence the secret, f (0). No subset of size < m can figure out the secret.

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

4 / 29

Introduction

Secret Sharing

Introduction Two Views of the World: Work on distributed computing and on cryptography has assumed agents are either honest or dishonest honest agents follow the protocol dishonest agents do all they can to subvert it Game theory assumes all agents are rational they try to maximize their utility Both views make sense in different contexts, but their combination is more appropriate to practical situations .... C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

5 / 29

Introduction

Secret Sharing

Introduction Two Views of the World: Work on distributed computing and on cryptography has assumed agents are either honest or dishonest honest agents follow the protocol dishonest agents do all they can to subvert it Game theory assumes all agents are rational they try to maximize their utility Both views make sense in different contexts, but their combination is more appropriate to practical situations .... C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

5 / 29

Introduction

Secret Sharing

Introduction Two Views of the World: Work on distributed computing and on cryptography has assumed agents are either honest or dishonest honest agents follow the protocol dishonest agents do all they can to subvert it Game theory assumes all agents are rational they try to maximize their utility Both views make sense in different contexts, but their combination is more appropriate to practical situations .... C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

5 / 29

Introduction

Basics of Game Theory

Outline 1

Introduction Secret Sharing Basics of Game Theory Rational Secret Sharing

2

Literature Survey

3

Motivation

4

Rational Secret Sharing with Repeated Games Intuition The Protocol

5

Conclusion

6

References C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

6 / 29

Introduction

Basics of Game Theory

Introduction

Basics of Game Theory Strategy - A strategy can be defined as a complete algorithm for playing the game, implicitly listing all moves and counter moves for every possible situation throughout the game. Nash Equilibrium - a set of strategies is a Nash equilibrium if no player can do better by unilaterally changing his or her strategy. Equivalently, given the strategies of other players, no player can gain profit by changing his strategy.

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

7 / 29

Introduction

Basics of Game Theory

Introduction

Basics of Game Theory Strategy - A strategy can be defined as a complete algorithm for playing the game, implicitly listing all moves and counter moves for every possible situation throughout the game. Nash Equilibrium - a set of strategies is a Nash equilibrium if no player can do better by unilaterally changing his or her strategy. Equivalently, given the strategies of other players, no player can gain profit by changing his strategy.

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

7 / 29

Introduction

Rational Secret Sharing

Outline 1

Introduction Secret Sharing Basics of Game Theory Rational Secret Sharing

2

Literature Survey

3

Motivation

4

Rational Secret Sharing with Repeated Games Intuition The Protocol

5

Conclusion

6

References C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

8 / 29

Introduction

Rational Secret Sharing

Introduction

Rational Secret Sharing Players are assumed to be rational Each player’s preferences are such that getting the secret is better than not getting it . secondarily, the fewer of the other agents that get it, the better.

But the problem is, no player wants to send his share !

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

9 / 29

Introduction

Rational Secret Sharing

Introduction Preferences and payoffs For any player pi , let w1 , w2 , w3 , w4 be the payoffs obtained in the following scenarios. w1 − pi gets the secret, others do not get the secret w2 − pi gets the secret, others get the secret w3 − pi does not get the secret, others do not get the secret w4 − pi does not get the secret, others get the secret The preferences of pi is specified by w1 > w2 > w3 > w4 .

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

10 / 29

Introduction

Rational Secret Sharing

Introduction Preferences and payoffs For any player pi , let w1 , w2 , w3 , w4 be the payoffs obtained in the following scenarios. w1 − pi gets the secret, others do not get the secret w2 − pi gets the secret, others get the secret w3 − pi does not get the secret, others do not get the secret w4 − pi does not get the secret, others get the secret The preferences of pi is specified by w1 > w2 > w3 > w4 .

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

10 / 29

Introduction

Rational Secret Sharing

Introduction Underlying Assumptions At each step, a player receives all the messages that were sent to him by other players at the previous step. The system is synchronous and message delivery takes fixed delay. Communication is guaranteed. At each step all the players send their shares simultaneously.

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

11 / 29

Literature Survey

Literature Survey STOC ’04 : Impossibility of deterministic mechanism for Rational Secret Sharing, by Halpern and Teague[1]. Proposed a randomized protocol for achieving the Rational Secret Sharing. SCN ’06 : Gordon and Katz[3] improved the randomized protocol (interference of dealer is minimized). PODC ’06 : Abraham et. al[4] analyzed the Rational Secret Sharing in a setting where players form coalitions. CRYPTO ’06 : Lysyanskaya and Traindopolus[5] analyzed the problem in the presence of few malicious players.

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

12 / 29

Literature Survey

Literature Survey Impossibility Result: Theorem 1: There is no deterministic protocol for RSS[1]. Proof: Consider player pi , If other players send him their shares, he can compute the secret; otherwise he cannot. If every player sends his share, then sending his share enables other players to compute the secret. His action (either sending or not sending) has no influence on whether others send him the share or not. Hence, no player sends his share.

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

13 / 29

Literature Survey

Literature Survey Impossibility Result: Theorem 1: There is no deterministic protocol for RSS[1]. Proof: Consider player pi , If other players send him their shares, he can compute the secret; otherwise he cannot. If every player sends his share, then sending his share enables other players to compute the secret. His action (either sending or not sending) has no influence on whether others send him the share or not. Hence, no player sends his share.

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

13 / 29

Motivation

Can we make Rational Secret Sharing possible ? Why do we need to do that ? — Applications ?? Secret sharing has applications where there is need for the secret to keep in distributed environment or the owner of the secret does not trust a single person. Rational secret sharing has applications in highly competitive real world scenario, where players are modeled selfish.

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

14 / 29

Motivation

Can we make Rational Secret Sharing possible ? Why do we need to do that ? — Applications ?? Secret sharing has applications where there is need for the secret to keep in distributed environment or the owner of the secret does not trust a single person. Rational secret sharing has applications in highly competitive real world scenario, where players are modeled selfish.

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

14 / 29

Rational Secret Sharing with Repeated Games

Intuition

Outline 1

Introduction Secret Sharing Basics of Game Theory Rational Secret Sharing

2

Literature Survey

3

Motivation

4

Rational Secret Sharing with Repeated Games Intuition The Protocol

5

Conclusion

6

References C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

15 / 29

Rational Secret Sharing with Repeated Games

Intuition

The Intuition The Intuition Suppose the players repeatedly play the game (repeatedly share the secret), If a player does not cooperate by not sending his share in the current game, then the other players do not send him their shares in the further games (Grim Trigger Strategy). Hence, every player because of the fear of not receiving any share from other players in the further games, will cooperate in the current game. This punishment strategy acts as an incentive for a player to cooperate in the current game. C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

16 / 29

Rational Secret Sharing with Repeated Games

Intuition

The Intuition The Intuition Suppose the players repeatedly play the game (repeatedly share the secret), If a player does not cooperate by not sending his share in the current game, then the other players do not send him their shares in the further games (Grim Trigger Strategy). Hence, every player because of the fear of not receiving any share from other players in the further games, will cooperate in the current game. This punishment strategy acts as an incentive for a player to cooperate in the current game. C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

16 / 29

Rational Secret Sharing with Repeated Games

Intuition

The Intuition The Intuition Suppose the players repeatedly play the game (repeatedly share the secret), If a player does not cooperate by not sending his share in the current game, then the other players do not send him their shares in the further games (Grim Trigger Strategy). Hence, every player because of the fear of not receiving any share from other players in the further games, will cooperate in the current game. This punishment strategy acts as an incentive for a player to cooperate in the current game. C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

16 / 29

Rational Secret Sharing with Repeated Games

Intuition

Punishment Strategy

Punishment Strategy : Grim Trigger Strategy 1

choose sending (C) as long as the other players choose C.

2

In any game, if some player chooses not sending (D), then choose D in every subsequent game.

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

17 / 29

Rational Secret Sharing with Repeated Games

The Protocol

Outline 1

Introduction Secret Sharing Basics of Game Theory Rational Secret Sharing

2

Literature Survey

3

Motivation

4

Rational Secret Sharing with Repeated Games Intuition The Protocol

5

Conclusion

6

References C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

18 / 29

Rational Secret Sharing with Repeated Games

The Protocol

Repeated Rational Secret Sharing

Rational Secret Sharing + Repeated Games In Repeated Rational Secret Sharing, players repeatedly share the secret (secret need not be the same). Players have clear incentive to send their share (because of punishment strategy). Hence, every player sends his share to other players.

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

19 / 29

Rational Secret Sharing with Repeated Games

The Protocol

Repeated Rational Secret Sharing

Protocol for a player In the first round, send the share to the other (m − 1) players. From next round onwards, send the share to the other players if and only if their shares corresponding to the last round were received.

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

20 / 29

Rational Secret Sharing with Repeated Games

The Protocol

Infinitely Repeated Rational Secret Sharing

Is RSS always possible with Repeated games ? If game is repeated infinitely, then YES (as incentive is there) If game is repeated finitely ? We have two possibilities If players do not know how many number of times they are going to play. If players know how many number of times they are going to play.

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

21 / 29

Rational Secret Sharing with Repeated Games

The Protocol

Infinitely Repeated Rational Secret Sharing

Is RSS always possible with Repeated games ? If game is repeated infinitely, then YES (as incentive is there) If game is repeated finitely ? We have two possibilities If players do not know how many number of times they are going to play. If players know how many number of times they are going to play.

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

21 / 29

Rational Secret Sharing with Repeated Games

The Protocol

Infinitely Repeated Rational Secret Sharing

Is RSS always possible with Repeated games ? If game is repeated infinitely, then YES (as incentive is there) If game is repeated finitely ? We have two possibilities If players do not know how many number of times they are going to play. If players know how many number of times they are going to play.

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

21 / 29

Rational Secret Sharing with Repeated Games

The Protocol

Finitely Repeated Rational Secret Sharing

What if players play finite number of times ? If players do not know how many number of times they are going to play. Then the same incentive will be there. Hence, every player sends his share.

If players know how many number of times they are going to play, Then there is no incentive. Hence, no solution (Reasoning is similar to Surprise Test Problem).

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

22 / 29

Rational Secret Sharing with Repeated Games

The Protocol

Finitely Repeated Rational Secret Sharing

What if players play finite number of times ? If players do not know how many number of times they are going to play. Then the same incentive will be there. Hence, every player sends his share.

If players know how many number of times they are going to play, Then there is no incentive. Hence, no solution (Reasoning is similar to Surprise Test Problem).

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

22 / 29

Conclusion

Conclusion Modeled the secret sharing as a repeated game (the game is played for some r number of times). Analyzed the repeated secret sharing game when r is both finite and infinite. Proposed a deterministic protocol for the infinite repeated game (r → ∞) and the finite repeated game (r is a finite number and the players do not know the value of r) in both synchronous and asynchronous models. Proved the impossibility for the finite repeated game when players know the value of r. Extension to the mixed model (at most t players can be malicious), for the synchronous model. C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

23 / 29

Conclusion

Conclusion

By combining ideas from game theory and cryptography areas we can gain new insights. Better understanding of role of cryptography in games. Repeated games can be used to create a mutually beneficial environment rather than opting for the instantaneous benefit. Repeated games can be introduced in other distributed environment problems (where the players are rational) and the scope for problem solving strategies can be enhanced.

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

24 / 29

References

References 1 J. Halpern and V. Teague, Rational secret sharing and multiparty computation: extended abstract, in 36t ACM Symposium on Theory of Computing(STOC), 2004, pp. 623-632.

2 A. Shamir, How to share a secret, in Communications of the ACM, 22:, 1979, pp. 612-613.

3 S.D. Gordon and J Katz,Rational secret sharing, revisited, in SCN, 2006, pp. 229-241.

4 D. Dolev, R. Gonen, and J. Halpern, Distributed computing meets game theory: Robust mechanisms for rational secret sharing and multiparty computation, in 25th ACM PODC, 2006, pp. 53-62.

5 A. Lysyanskaya and N. Triandopoulos,Rationality and adversarial behavior in multi-party computation (ex- tended abstract), in CRYPTO, 2006, pp. 180-197. C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

25 / 29

References

References 6 M.J. Osborne, An Introduction to Game Theory, Oxford University Press., 2004.

7 Dodis, Y., Halevi, S., Rabin, T.: A cryptographic solution to a game theoretic problem, CRYPTO 00: Proceedings of the 20th Annual International Cryptology Conference on Advances in Cryptology, London, UK, Springer-Verlag (2000), pp. 112-130

8 Franklin, M., Yung, M., Communication complexity of secure computation, In 24th ACM Symposium on Theory of Computing (STOC) (1992) pp. 699-710

9 Friedman, J.W., A non-cooperative equilibrium for supergames. Review of Economic Studies, 38(113) (1971) pp. 1-12

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

26 / 29

References

QUESTIONS ??

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

27 / 29

References

Acknowledgment

Work supported by Microsoft Project No. CSE0506075MICOCPAN on Foundation Research in Cryptology.

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

28 / 29

References

THANK YOU !!

C. Pandu Rangan ( ISPEC 08 )

Repeated Rational Secret Sharing

23rd April 2008

29 / 29