1

In a threshold cryptosystem, is there any guarantee that all $m$ peers participating in retrieving a plain-text will all retrieve it? If not, is it possible to provide such a guarantee?

For instance if the $m$ peers are hostile to each other, is there a way to either have none of them get the plain text, or all of them?

user2813687
  • 237
  • 1
  • 6

2 Answers2

2

The terminology for what you are describing is called fairness. This comes up often in threshold cryptography. Just knowing the right terminology should help you find many papers on the topic.

In general, fairness is impossible unless there is an honest majority [Cleve1986], though some non-trivial functions can be computed [Gordon2008a, Gordon2008b].

You appear to be most interested in fair threshold decryption of a ciphertext.

The paper Fair threshold decryption with semi-trusted third parties provides a construction that assumes semi-trusted third parties are available to help. Section 1.1 of that paper, provides a good intro to the related work and some of the different assumptions or paradigms that have been used.

mikeazo
  • 38,563
  • 8
  • 112
  • 180
0

A threshold ElGamal decryption is possible, with verifiable correctness and brodcast to all participants. Major point would be gradual release of a secret.

Let me outline a bird-view. Consider ElGamal-enrypted message $(c_1, c_2) = (g^r, m y^r)$, with Shamir $m$-out-of-$n$ shared decryption key $k$, public key $y$ and plaintext $m$. Each participant applies his share of decryption key to $c_1$, commits to each bit of it and sends it to all other participants, one bit a round.

In case anyone is playing unfair, affected participants would stop, preventing anyone else to succeed.

Vadym Fedyukovych
  • 2,267
  • 13
  • 19