a590003

s ′
Net’
r ′ A
r ′ H
s ArA
G A
Net
Graph
rH
s H G H
G H
G A
p H
r A
s A
G A G A
s ′
Sim
p
r ′ A
p A
p H
Player[H]
VSS
Figure 21: Security of the VSS protocol when the dealer is dishonest.
Finally, it is easy to see that p(h) = p h for all h ∈ H. Namely, if there exists C ⊆ [n]
with clique C (G) = ⊤, then r h [h ′ ] = g h ′(h) = ˜f(h, h ′ ) for all h ′ ∈ C ∩ H, and therefore o h =
interpolate C (r h ) = interpolate C∩H (r h ) = f(h, ·), and thus p h = o h (0) = ˜f(h, 0) = p(h).
We therefore conclude that the real system is equivalent to (Sim| VSS) where Sim is the
simulator defined by the following equations:
Sim(s ′ , G A , s A , p A ) = (r
A ′ , r A, G A , p):
r a ′ = s ′ [a] (a ∈ A)
r a [h] = g h (a) (h ∈ H, a ∈ A)
r a [a ′ ] = s a ′[a] (a, a ′ ∈ A)
G[h, h ′ ] = eq(g h ′(h), h h (h ′ )) (h, h ′ ∈ H)
G[h, a] = eq(s a [h], h h (a)) (a ∈ A, h ∈ H)
G[a,
∨
j] = G a [j]
(a ∈ A, j ∈ [n])
˜f = clique C (G) ∧ interpolate2 C (s ′ )
C⊆[n]
|C|≥n−t
p = ˜f(·, 0)
5 Conclusions
Recognizing the inherent hardness of delivering security proofs for complex cryptographic protocols
that are both precise and intuitive within existing security frameworks, we have presented a new
framework to study the security of multi-party computations based on equational descriptions
of interactive processes. Our framework allows a simple and intuitive, yet completely formal,
description of interactive processes via sets of equations, and its foundations rely on tools from
programming-language theory and domain theory. Beyond its simplicity, our framework completely
avoids explicit addressing of non-determinism within cryptographic security proofs, making security
proofs a matter of simple equational manipulations over precise mathematical structures. As a
case study, we have presented simple security analyses of (variants of) two classical asynchronous
protocols within our framework, Bracha’s broadcast protocol [8] and the Ben-Or, Canetti, Goldreich
VSS protocol [5].
We are convinced that our work will open up the avenue to several directions for future work.
First off, while the results in this paper are presented for the special case of perfect security, a natural
next step is to extend the framework to statistical and even computational security. Moreover, while
the expressiveness of our framework (i.e., the monotonicity restrictions on protocols) remains to
be thoroughly investigated, most distributed protocols we examined so far, seemed to admit a
representation within our framework, possibly after minor modifications which often resulted in a
27
12. An Equational Approach to Secure Multi-party Computation