 So the last talk of the session is a complete characterization of game fair, retic, fair, multi-party coin toss by Gilard Asherov, Ilayne Shi, and Ke'eru, and this will be a recorded talk, and Ke'eru will give the talk. Hi, everyone. I'm Ke'eru from Konningi Mellon University. I'll present our work, A Complete Capturization of Game Theoretically Fair Multi-Party Coin Toss. This is a joint work with Gilard Asherov from Bar-Elon University and Ilayne Shi from CMU. My advisor, Ilayne, and I are two co-organizers of the CMU Crypto Seminar, and we need to decide the food for the seminar. I prefer sushi while Ilayne prefer cake. We cannot persuade each other, so we decide to toss a random coin. If the output is zero, then I win, and we will order sushi. Otherwise, Ilayne win, and we will order cake. Since we're in different city this week, we decide to do Blom's Coin Toss protocol on blockchain. We each choose a random bit and post the commitment of the random bit on the blockchain. If you're not familiar with blockchain, you can think of it as a public bulletin board. So after we post the commitments, everyone can see them on the blockchain. After we post the commitments, we each open our random bit and post the opening on blockchain. Let's say Ilayne's random bit is zero, and my random bit is one. The output will be the XOR of these two random bits, which is one. So Ilayne wins, and we will order cake. However, I really want a sushi. After Ilayne posts her bit on blockchain, I know that I'm going to lose the game if I open my bit. So what if I refuse to open my commitments? In this case, Ilayne just automatically wins, and the outcome would be one. So still, we will order cake. This is the famous Blom's Coin Toss protocol back to 1983. It guarantees that a strategic player like me cannot bias the output towards my preference. Formally in the Coin Toss protocol, the goal is to output a random coin that is publicly verifiable. The correctness requires that if everyone is honest, then the output should be uniformly random. The fairness notion considered in traditional literature is called strong fairness or unbiased ability, which requires that a strategic player cannot bias the outputs towards either direction. Unfortunately, this is shown to be impossible by Cleveland in 1986. Indeed, even in Blom's Coin Toss protocol we just saw, I can always bias the output towards one by refusing to open the commitment. The fairness notion achieved by Blom's Coin Toss protocol is actually more of a game theory favor. For game theoretic fairness, it requires that a strategic player cannot benefit herself by deviating from the protocol. Now that we've seen Blom's Coin Toss protocol which achieves game theoretic fairness for two-party coin toss, a natural question to ask is that can we achieve game theoretic fairness for multi-party coin toss? In multi-party coin toss, several players get together to toss a binary coin. Each player has a preference that is publicly available. Let's say, for example, kittens and I prefer sushi and we call them sushi people. While puppies in a lane prefer cake, so we call them cake people. Some of these players will get together to form a coalition. They will coordinate with each other and try to bias the output to increase their utility. The utility we consider is quite natural. If I like the output, I gain utility one. And the utility of a coalition is just the sum of the utility of the players in this coalition. For example, if the output is cake, then this coalition in the figure gains utility three. And if the output is sushi, then this coalition gain utility two. Therefore, the preference of a coalition is actually the preference of majority players in this coalition. Now, for multi-party coin toss, the game theoretic fairness notion we consider is slightly different. Now we care more about the behavior of a coalition rather than a strategic player. For multi-party coin toss, game theoretic fairness requires that a coalition cannot increase its expected utility by deviating from the protocol. So if a coalition holds protocol is game theoretic fair against coalition of size T, then the honest protocol is actually a T-sized coalition-resistant Nash equilibrium because this best strategy for the coalition is just to follow the protocol honestly. So why do we care about this game theoretic fairness? Because we know that strong fairness is impossible against half-sized coalition. However, in many decentralized applications, for example, voting on a blockchain, many pseudonyms may be controlled by the same entity. And these pseudonyms, they will coordinate together and they may deviate from the protocol to gain benefit. It is very likely that these pseudonyms form a majority-sized coalition. So we do need some meaningful fairness notion that is achievable against a majority-sized coalition. Game theoretic fairness is exactly such a notion that is slightly weaker than strong fairness yet still meaningful and suitable for decentralized applications. Unfortunately, game theoretic fairness for multi-party coin toss protocol is shown to be impossible against a minus one-sized coalition due to Chien-Adol's result back to 1918. So a natural question to ask is that can we achieve game theoretic fairness for multi-party coin toss against small-sized coalition? Let's say majority-sized but not necessarily a minus one. And the answer is yes. To convince you, I'll first show you a very simple strawman solution for four players. Let's say we have two sushi people and two cake people. In the strawman solution, each group first arbitrarily choose a representative. Let's say it's the kitten and the puppy. Then these two representatives draw with each other using Blum's coin toss protocol. The output of this Blum's protocol will be the coin for four-party coin toss. So this very simple protocol is game theoretically fair against coalition of size two. Note that if the coalition contains one sushi person and one cake person, then this coalition actually has no preference and they can never increase their expected utility. So we don't care what they do to the coin. If the coalition contains two sushi people, then by Blum's coin toss protocol, the sushi representative cannot bias the output with sushi. And so this coalition cannot benefit by deviating from the protocol. The same argument works for the case if the coalition contains two cake people. So we can achieve game theoretic fairness for four-party coin toss against coalition of size two. This is an evidence that it is true that we can achieve game theoretic fairness for some meaningful parameter region. Actually, this very simple strawman idea generalizes to any number of players as long as the coalition is of size at most two. So on the achievability side for a coalition of size less than half, we can achieve strong fairness and of course game theoretic fairness through multi-party computation. If the coalition is of size smaller than two, then we can use this strawman solution. On the impossibility side, Chen Edou showed that it is impossible to achieve game theoretic fairness against minus one sized coalition. So we ask the question, under what size of coalition is it possible to achieve game theoretic fairness? Exactly where should we draw the line, the boundary between visibility and invisibility? This work answers this question. We explored the broad range of parameters of coalition size between half and minus one. So in this work, we give a complete characterization of game theoretic fairness. We give a construction of a game theoretic fair coin toss protocol against team-sized coalition. And we show that game theoretic fairness as impossible against two plus one sized coalition. I'll give the expression of T2U later. So in the rest of the talk, we will mainly focus on the construction of the protocol. Still to convey the main idea, we will use a simple example of six players, three sushi people and three cake people. The structure is quite simple. We let the sushi people choose a random coin S0, and then we let the cake people choose a random coin S1. The output will just be the XOR of these two random bits. But where do the random coin S0 and S1 come from? So for easier understanding, we assume a secret sharing trusted authority parameterized with K that choose a random coin S for us and satisfy the following properties. First, only K or more players can ask the authority to reveal the value of S. And second, any K or more players can choose to rewrite the value of S before any reveal request. As a heads up, this trusted authority can be implemented by standard crypto and we do not need to assume trusted authority in our final protocol. So this trusted authority is just for better understanding during the talk. With this trusted authority, our protocol works as follows. First, each group has a trusted authority with parameter K set to be two. The sushi authority first choose a random coin S0. And then if the coalition wants to rewrite the value of coin S0, it has to be now. Then the cake authority choose a random coin S1. Still, if the coalition wants to rewrite the value of S1, it has to be at this point. No rewrite is allowed after. Then sushi people sends reveal request to the trusted authority to reveal the value of S0 on blockchain. Then the cake people send reveal request to cake authority to reveal the value of S1 on blockchain. If both coin revealed successfully, the output is the XOR of these two random coins. However, if S0 is not revealed because two or more sushi people refuse to reveal, but coin S1 is successfully revealed on the blockchain, then in this case, the output of the protocol is just the coin S1. On the other hand, if the coin S0 is revealed, but S1 is not revealed, what should we output? Should we output S0? So definitely not. We should output zero instead of S0. This is because by the time when the sushi people decides whether they want to reveal S1, they already see the value of S0 on the blockchain. So even if a collision of only two cake people, they can buy us the output by deciding whether they want to reveal the coin S1 after they saw the value of S0 on the blockchain. This means that if we choose to output S0 if S1 fails to be revealed, then we will only be able to tolerate collision of S1. So instead, we will output zero as a heavier punishment for the cake people if they refuse to reveal the value of S1. So this six player coin toss protocol actually achieves game theoretic fairness against collision of S1 up to four. To see this, if this collision contains two sushi people and two cake people, they actually have no preference and because they can never increase their utility, so we don't care what they do to the coin. If the collision contains three sushi people and a single cake person, then this collision can decide the value of S0 because they can rewrite the coin. However, as we mentioned, when they rewrite the coin S0, they know nothing about S1. So the coin S1 is still an independent uniformly random coin chosen by the cake authority. That is guaranteed to be revealed due to the two honest cake people. So if the collision choose to reveal coin S0, then the output should be S0 XOR with S1. If they choose not to reveal S0, at the time when they decide whether they want to choose reveal S0, they know nothing about coin S1. So the output is an independent uniformly random coin S1 chosen by the cake authority. On the other hand, if the collision contains three cake people and a single sushi person, by a similar argument, they can control the value of coin S1 at the time when they know nothing about S0. So if they choose to reveal S1, the output would be S0 XOR with S1, which is uniformly random. If they choose not to reveal S1, then the output will directly be zero. I believe smart as they are, they will never do this because this brings them no benefit. So this protocol is empirically fair against coalition of size four. Can we generalize it? And the answer is positive. This idea actually generalizes to arbitrary number of players. And this table gives the maximum size of the coalition we can tolerate with this protocol. In this table, N1 is the number of cake people and N0 is the number of sushi people. For simplicity, I ignore the Ronnie here and without loss of generality, we assume N1 is at least N0. And this is the landscape of the attribability and intribubility of game theoretic fairness. It turns out that the landscape of game theoretic fairness is starkly different from the de facto strong fairness. In this plot, the X axis denotes the number of sushi people and the Y axis denotes the number of cake people. The Z axis here is the size of the coalition. This red plane is the boundary between visibility and invisibility of game theoretic fairness. For any region below this red plane, we can achieve game theoretic fairness and for any region above, we cannot. As a comparison, this blue plane is the boundary of invisibility and visibility for strong fairness, which is exactly half of the number of players. From this figure, we can see that there is indeed a meaningful region for which we can achieve game theoretic fairness, but not strong fairness. And moreover, we can see that the attribability of game theoretic fairness is not only related to the size of the coalition, but also the relationship between the number of sushi people and the number of cake people. To wrap up in this work, we give a game theoretically fair coin toss protocol against T-sized coalition, and we show that game theoretic fairness is impossible against any T plus one sized coalition. And T is summarizing the table flow. Here, N1 is the number of cake people and N0 is the number of sushi people. When N1 is much larger than N0, then we can tolerate coalition of size up to N1 minus half N0. Moreover, if N1 equal to N0 and they're equal to odd, then we can tolerate N0 plus one sized coalition, as in the sixth clear example we just saw. Otherwise, we can tolerate a coalition of size up to two thirds N1 plus one third N0. In the work, we also give other results. We give a complete characterization of another fairness notion, which requires that no coalition can harm any honest individual. We also give complete characterization of these two fairness notion under other natural utility functions. And this is the reference for the paper mentioning the talk. And thank you. If you're interested in more details of the paper, you can read our paper, which is posted on E-Prain or write me an email. That's my talk. Thank you so much. I believe that Gilad should be available for questions and questions. Yes, I'm here, if you have any questions. Gilad, can you say when the game phoretic scenario is reasonable when people have to declare in advance what the preference is? So we give a few examples where this is made be reasonable. I agree that it's also interesting to discuss the case where you don't know the preferences in advance. One example that we gave is like, let's say we do some voting or like we need to toss a coin where we do know the preferences of each other. Let's say we need to decide what is how to, let's say we wanna do, we have two possible candidates and we want that the candidate that is closer to my geographically, that's closer to me geographically will be the winner. Then because you know where I'm located, you know who I prefer. Or if you have like, you want to find two candidates and you know we have like a public forum where you can actually can estimate what is the preference of each one of the participants. But in that case, it is a question like will you actually toss a coin or just run majority vote? But yeah, this is a natural question, I think. Any other questions? Hello, I wanna ask if this easily generalizes to like dice rolling or like more than dice rolling, not only two outputs, but like more, I don't know. Oh, we did think about it in the beginning, we had some initial results. It is quite similar to the normal, to the regular like a generalization from a coin to like more than just two results. But I think the characterization will be completely different. So it is a good question to explore. Okay, thank you. If there are no other questions, so let's take the speaker again and the speaker of the session. Thank you.