Abstract

We present an efficient and fair protocol for secure two-party computation in the optimistic model, where a partially trusted third party T is available, but not involved in normal protocol executions. T is needed only if communication is disrupted or if one of the two parties misbehaves. The protocol guarantees that although one party may terminate the protocol at any time, the computation remains fair for the other party. The two parties are linked by an asynchronous communication network only, but the link between each party and T requires minimal synchrony. All our protocols are based on efficient proofs of knowledge and involve no general zero-knowledge tools. As intermediate steps we describe efficient implementations of verifiable oblivious transfer, escrowed oblivious transfer, and verifiable secure function evaluation, which may be useful in other contexts. The security of all protocols is proved under the decisional Diffie-Hellman assumption. 1

Citations