 Hi, everyone. I'm Koh from Koningi Mellon University. I'll present our work, A Complete Capturization of Game Theoretically Fair Multi-Party Point Us. This is a joint work with Gail Asherov from Bartelon University and Elaine Shih from CMU. My advisor Elaine and I are two co-organizers of the CMU Crypto Seminar, and we need to decide the food for the seminar. I prefer sushi while Elaine prefer cake. We cannot persuade each other so we decide to toss a random coin. If the output is zero, then I win and we will order sushi, otherwise Elaine win and we will order cake. Since we're in different city this week, we decide to do Blom's Coin toss protocol on blockchain. We each choose a random bit and post the commitment of the random bit on the blockchain. If you're not familiar with blockchain, you can think of it as a public bulletin board. So after we post the commitments, everyone can see them on the blockchain. After we post the commitments, we each open our random bit and post the opening on blockchain. Let's say Elaine's random bit is zero and my random bit is one. The output will be the XOR of these two random bits, which is one. So Elaine wins and we will order cake. However, I really want a sushi. After Elaine post her bit on blockchain, I know that I'm going to lose the game if I open my bit. So what if I refuse to open my commitments? In this case, Elaine just automatically wins and the outcome would be one. So still we will order cake. This is the famous Blom's coin toss protocol back to 1983. It guarantees that a strategic player like me cannot bias the output towards my preference. Formerly in the coin toss protocol, the goal is to output a random coin that is publicly verifiable. The correctness requires that if everyone is honest, then the output should be uniformly random. The fairness notion considered in traditional literature is called strong fairness or unbiased ability, which requires that a strategic player cannot bias the outputs towards either direction. Unfortunately, this is shown to be impossible by cleave in 1986. Indeed, even in blom's coin toss protocol we just saw, I can always bias the output towards one by refusing to open the commitment. The fairness notion achieved by blom's coin toss protocol is actually more of a game theory favor. For game theoretic fairness, it requires that a strategic player cannot benefit herself by deviating from the protocol. Now that we've seen blom's coin toss protocol which achieves game theoretic fairness for two party coin toss. A natural question to ask is that can we achieve game theoretic fairness for multi-party coin toss? In multi-party coin toss, several players get together to toss a binary coin. Each player has a preference that is publicly available. Let's say, for example, kittens and I prefer sushi and we call them sushi people, while puppies in a lane prefer cake, so we call them cake people. Some of these players will get together to form a coalition that will coordinate with each other and try to bias the output to increase their utility. The utility we consider is quite natural. If I like the output, I gain utility one. And the utility of a coalition is just the sum of the utility of the players in this coalition. For example, if the output is cake, then this coalition in the figure gains utility three, and if the output is sushi, then this coalition gain utility two. Therefore, the preference of a coalition is actually the preference of majority players in this coalition. Now, for multi-party coin toss, the game theoretic fairness notion we consider is slightly different. Now we care more about the behavior of a coalition rather than a strategic player. For multi-party coin toss, game theoretic fairness requires that a coalition cannot increase its expected utility by deviating from the protocol. So if a coalition holds protocol is game theoretic fair against coalition of size T, then the honest protocol is actually a T-sized coalition-resistant Nash equilibrium because this best strategy for the coalition is just to follow the protocol honestly. So why do we care about this game theoretic fairness? Because we know that strong fairness is impossible against half-sized coalition. However, in many decentralized applications, for example, voting on a blockchain, many pseudonyms may be controlled by the same entity. And these pseudonyms, they will coordinate together and they may deviate from the protocol to gain benefit. It is very likely that these pseudonyms form a majority-sized coalition. So we do need some meaningful fairness notion that is achievable against a majority-sized coalition. Game theoretic fairness is exactly such a notion that is slightly weaker than strong fairness yet still meaningful and suitable for decentralized applications. Unfortunately, game theoretic fairness for multi-party coin toss protocol is shown to be impossible against a minus one-sized coalition due to Chen's result back to 1918. So a natural question to ask is that can we achieve game theoretic fairness for multi-party coin toss against small-sized coalition? Let's say majority-sized but not necessarily a minus one. And the answer is yes. To convince you, I'll first show you a very simple strawman solution for four players. Let's say we have two sushi people and two cake people. In the strawman solution, each group first arbitrarily choose a representative. Let's say it's the kitten and the puppy. Then these two representatives draw with each other using Blum's coin toss protocol. The output of this Blum's protocol will be the coin for four-party coin toss. So this very simple protocol is game theoretically fair against coalition of size two. Note that if the coalition contains one sushi person and one cake person, then this coalition actually has no preference and they can never increase their expected utility. So we don't care what they do to the coin. If the coalition contains two sushi people, then by Blum's coin toss protocol, the sushi representative cannot bias the output with sushi. And so this coalition cannot benefit by deviating from the protocol. The same argument works for the case if the coalition contains two cake people. So we can achieve game theoretic fairness for four-party coin toss against coalition of size two. This is an evidence that it is true that we can achieve game theoretic fairness for some meaningful primary region. Actually, this very simple strawman idea generalizes to any number of players as long as the coalition is of size at most two. So on the achievability side for a coalition of size less than half, we can achieve strong fairness and of course game theoretic fairness through multi-party computation. If the coalition is of size smaller than two, then we can use this strawman solution. On the impossibility side, Chen Edou showed that it is impossible to achieve game theoretic fairness against a minus one-sized coalition. So we ask the question, under what size of coalition is it possible to achieve game theoretic fairness? Exactly where should we draw the line, the boundary between visibility and invisibility? This work answers this question. We explored the broad range of parameters of coalition size between half and minus one. So in this work, we give a complete characterization of game theoretic fairness. We give a construction of a game theoretic fair coin toss protocol against team-sized coalition. And we show that game theoretic fairness is impossible against two plus one-sized coalition. We will give the expression of T2U later. So in the rest of the talk, we will mainly focus on the construction of the protocol. Still to convey the main idea, we will use a simple example of six players, three sushi people and three cake people. The structure is quite simple. We let the sushi people choose a random coin S0. And then we let the cake people choose a random coin S1. The output will just be the XOR of these two random bits. But where do the random coin S0 and S1 come from? So for easier understanding, we assume a secret sharing trusted authority parameterized with K that choose a random coin S for us and satisfy the following properties. First, only K or more players can ask the authority to reveal the value of S. And second, any K or more players can choose to rewrite the value of S before any reveal request. As a heads up, this trusted authority can be implemented by standard crypto, and we do not need to assume trusted authority in our final protocol. So this trusted authority is just for a better understanding during the talk. With this trusted authority, our protocol works as follows. First, each group has a trusted authority with parameter K set to be two. The sushi authority first choose a random coin S0. And then if the collision wants to rewrite the value of coin S0, it has to be now. And then the K authority choose a random coin S1. Still, if the collision wants to rewrite the value of S1, it has to be at this point. No rewrite is allowed after. Then sushi people sends reveal request to the trusted authority to reveal the value of S0 on blockchain. Then the K people send reveal request to K authority to reveal the value of S1 on blockchain. If both coin revealed successfully, the output is the XOR of these two random coins. However, if S0 is not revealed because two or more sushi people refuse to reveal, but coin S1 is successfully revealed on the blockchain, then in this case, the output of the protocol is just the coin S1. On the other hand, if the coin S0 is revealed, but S1 is not revealed, what should we output? Should we output S0? So definitely not. We should output 0 instead of S0. This is because by the time when the sushi people decides whether they want to reveal S1, they already see the value of S0 on the blockchain. So even if a collision of only two K people, they can bias the output by deciding whether they want to reveal the coin S1 after they saw the value of S0 on the blockchain. This means that if we choose to output S0, if S1 fails to be revealed, then we will only be able to tolerate collision of size one. So instead, we will output 0 as a heavier punishment for the cake people if they refuse to reveal the value of S1. So this six player coin toss protocol actually achieves game theoretic fairness against collision of size up to four. To see this, if this coalition contains two sushi people and two cake people, they actually have no preference, and they can never, because they can never increase their utility, so we don't care what they do to the coin. If the coalition contains three sushi people and a single cake person, then this coalition can decide the value of S0 because they can rewrite the coin. However, as we mentioned, when they rewrite the coin S0, they know nothing about S1. So the coin S1 is still an independent uniformly random coin chosen by the cake authority that is guaranteed to be revealed due to the two honest cake people. So if the coalition choose to reveal coin S0, then the output should be S0 XOR with S1. If they choose not to reveal S0 at the time when they decide whether they want to choose reveal S0, they know nothing about coin S1. So the output is an independent uniformly random coin S1 chosen by the cake authority. On the other hand, if the coalition contains three cake people and a single sushi person by a similar argument, they can control the value of coin S1 at the time when they know nothing about S0. So if they choose to reveal S1, the output would be S0 XOR with S1, which is uniformly random. If they choose not to reveal S1, then the output will directly be zero. I believe smart as they are, they will never do this because this brings them no benefit. So this protocol is game theoretically fair against coalition of size four. Can we generalize it? And the answer is positive. This idea actually generalizes to arbitrary number of players. And this table gives the maximum size of the coalition we can tolerate with this protocol. In this table, N1 is the number of cake people and N0 is the number of sushi people. For simplicity, I ignore the running here and we've got loss of generality. We assume N1 is at least N0. And this is the landscape of the achievability and inch of ability of game theoretic fairness. It turns out that the landscape of game theoretic fairness is darkly different from the de facto strong fairness. In this plot, the X axis denotes the number of sushi people and the Y axis denotes the number of cake people. The Z axis here is the size of the coalition. This red plane is the boundary between visibility and invisibility of game theoretic fairness. For any region below this red plane, we can achieve game theoretic fairness. And for any region above, we cannot. As a comparison, this blue plane is the boundary of invisibility and visibility for strong fairness, which is exactly half of the number of players. From this figure, we can see that there is indeed a meaningful region for which we can achieve game theoretic fairness, but not strong fairness. And moreover, we can see that the achievability of game theoretic fairness is not only related to the size of the coalition, but also the relationship between the number of sushi people and the number of cake people. To wrap up in this work, we give a game theoretically fair coin toss protocol against T sized coalition, and we show that game theoretic fairness is impossible against any T plus one sized coalition. And T is summarizing the table below. Here in one is the number of cake people in and zero is the number of sushi people. When in one is much larger than N zero, then we can tolerate coalition of size up to in one minus half and zero. Moreover, if one equal to n zero and they're equal to odd, then we can tolerate and zero plus one sized coalition, as in the six clear example we just saw. Otherwise, we can tolerate a coalition of size up to two thirds and one plus one third and zero. In the work, we also give other results, we give a complete characterization of another fairness notion, which requires that no coalition can harm any honest individual. We also give complete characterization of these two fairness notion on their other natural utility functions. And this is the reference for the paper mentioning the talk. And thank you. If you're interested in more details of the paper, you can read our paper, which is posted on it brain or write me email. That's my talk. Thank you so much.