dining metaphysicians problem

Question

Here is a problem vaguely related to the dining philosophers problem. Three metaphysicians go to a restaurant for dinner. When it is time to pay the bill, they decide that they want one of them to pay the entire bill, but without the other two knowing who paid the bill. Ideally, they'd put three tokens in a bag, one white and two black, and secretly draw a token at random. But this is not allowed. They each have a random generator (coin, dice), and they are limited to exchanging information between each other, either publicly or in private between two of them. For example, all three of them may flip a coin, take note of their coin flip (H or T) and inform their left neighbour of the result. Then the metaphysician whose coin flip equals the coin flip of his right neighbour pays, and the other two don't pay (and don't know who paid). This only works, however, for THH, TTH, HTT, HHT, HTH, and THT; but not for HHH and TTT (since in those cases, all three of them would be paying the entire bill).

Here is my attempt at a solution. Let $R$ be a finite event space for the random generator, ${r_1,...,r_n}$, let $S$ be $\{0,1\}$, and $T$ be a suitable set. Let $f$ be a mapping from $R$ to $S$ and $g$ be a mapping from $R$ to $T$. $f$ maps the outcome $r_i$ to heads or tails as in the coin flipping example. $g$ is a function that masks the $r_i$ while providing enough information to decide whether the procedure needs to be repeated (because the $f$ results are of the HHH or TTT type). The metaphysicians reveal their outcome $f(r_i)$ only to their left neighbour and announce $g(r_i)$ publicly. Here is what $f$ and $g$ need to be able to do: (i) knowing all $g$ values determines whether $f(r_1)=f(r_2)=f(r_3)$ or not; in the former case repeat the procedure. In the latter case apply the coin flipping example to determine who pays. (ii) the probability of $f(r_L)=f(r_\mbox{me})$ conditional on knowing $(g(r_L),g(r_{\mbox{me}}),g(r_R))$ and $f(r_\mbox{me})x≠f(r_R)$ is $0.5$ so that I don't know who pays the bill if my coin flip differs from the coin flip of my right neighbour. $r_L$ is my left neighbour's outcome, $r_R$ my right neighbour's outcome. If I had functions $f$ and $g$ fulfilling these constraints, I'd have a solution for my problem, but I don't know what $f$ and $g$ might look like. $g(r_i)$ could be something like an md5sum, not allowing me to infer $f(r_i)$ which determines the payor.

Answer 1

Using secure multi-party computation, there exists a polynomial-time protocol for this problem.

The functionality is

$$F_i(r_1,r_2,r_3)=((r_1 \ne r_2) \lor (r_2 \ne r_3) \lor (r_1 \ne r_3), (r_i = r_{i+1}) \land (r_i \ne r_{i-1})).$$

In other words, in the ideal world, participant $i$ flips a coin to get $r_i \in \{0,1\}$ and sends it to the trusted third party; they receive $F_i(r_1,r_2,r_3)$ back, and the first bit of the result indicates whether to repeat or not and the second bit indicates whether to pay.

It's a powerful theorem from the cryptographic literature that there exists a protocol for any functionality, with computational security and running in polynomial time. Thus, there exists a protocol for this problem, too. It will be secure as long as no more than 1 of the 3 participants are malicious.

See https://en.wikipedia.org/wiki/Secure_multi-party_computation and a good textbook on theoretical cryptography.