Brief Announcement: Asynchronous Secure Distributed Computing with Transferrable Non-equivocation Revisited

Abstract

In this paper, we consider two fundamental problems in secure distributed computing, namely Asynchronous Byzantine Agreement (ABA) and Asynchronous Secure Multi-party Computation (ASMPC). Our focus is on the honest majority setting, involving a set of n mutually distrusting parties, t of which can be under the control of a computationally bounded Byzantine adversary Adv, where t < n/2. It is well known that in the cryptographic setting where the parties have access to a public-key infrastructure (PKI) set-up and are connected by pair-wise channels, both ABA and ASMPC requires t n/3. However, Clement et al. (PODC 2012) and Backes et al. (PODC 2014) showed that it is possible to design computationally-secure ABA and ASMPC protocols respectively, even with t < n/2, provided the parties are available with a transferrable non-equivocation mechanism. Non-equivocation is a message authentication mechanism, which prevents a corrupt sender from sending conflicting messages to different parties. The transferability of the mechanism enables a receiver to verifiably transfer any authenticated statement to other parties, on behalf of the sender. In this paper, we revisit the work of Clement et al. and Backes et al. and show the following: 1. If n łeq 3t, then it is impossible to achieve the traditional notion of validity by any ABA protocol, which demands that if the inputs of all honest parties are same, say x, then all honest parties should output x at the end of the protocol. Moreover, this holds even if the parties are equipped with a transferrable non-equivocation mechanism. 2. The input phase of the ASMPC protocol of Backes et al (and hence the overall ASMPC protocol) may never terminate for the honest parties. The input phase runs an asynchronous primitive called Agreement on a Common Subset (ACS), which allows the honest parties to agree upon a common subset of n - t parties who provide their inputs for the computation. The ACS primitive runs n parallel instances of an ABA protocol, where the ith instance is to decide whether the ith party has provided its input. We show that since the underlying ABA instances does not satisfy the validity condition, the ACS primitive may never terminate for the honest parties; this results in the honest parties waiting indefinitely to identify the set of n - t input providers.