412
R. Gradwohl
no leader election protocol can be resilient to more than half the players). Thus,
with probability at least 1 e, there are at most c1 + c2 + k t(n/4) players in
Ci1 who choose a coalition member in Ci . The maximal probability that one
of
428
G. Fuchsbauer, J. Katz, and D. Naccache
i , while with probability it follows an arbitrary ppt strategy i . (In this case,
we refer to i as the residual strategy of i .) The notion of -closeness is meant
to model a situation in which Pi plays i most o
430
G. Fuchsbauer, J. Katz, and D. Naccache
each iteration. (If one were willing to assume simultaneous channels then the
protocol could be simplified by having P2 send Evalsk2 (i + 1) at the same time
as Evalsk2 (i), and similarly for P1 .)
We give some
Ecient Rational Secret Sharing in Standard Communication Networks
433
and H(0). When H(0) = 0 parties know the protocol is over, and output the
G(0) value reconstructed in the previous iteration. See Figure 2 for details.
Theorem 2. If > 0 and U > U + + (
Rationality in the Full-Information Model
407
there is no synchrony within rounds of a selection protocol, we may view the
possibility of rushing as a strategy for players. That is, a player may choose to
wait until others have played, and only then submi
434
G. Fuchsbauer, J. Katz, and D. Naccache
References
1. Abraham, I., Dolev, D., Gonen, R., Halpern, J.: Distributed computing meets game
theory: robust mechanisms for rational secret sharing and multiparty computation. In: 25th ACM Symposium Annual on P
432
G. Fuchsbauer, J. Katz, and D. Naccache
Sharing Phase
To share a secret s cfw_0, 1 , the dealer does the following:
Choose r N according to a geometric distribution with parameter .
Generatea VRF keys (pk1 , sk1 ), . . . , (pkn , skn ) Gen(1k ) foll
Rationality in the Full-Information Model
1.1
403
Our Results and Organization
Definitions (Section 2). The initial diculty encountered when considering preferences in the full-information model is to precisely formulate a notion of equilibrium. The first
422
G. Fuchsbauer, J. Katz, and D. Naccache
In the real iteration, everyone learns the secret (assuming everyone follows
the protocol).
In a fake iteration, no information about the secret is revealed.
No party can tell, in advance, whether the next it
Sample Complexity for Private Learning and Private Data Release
441
a release that protects the privacy of the individual contributors while oering
utility to the analyst using the database. The setting is non-interactive if once
the sanitization is relea
Ecient Rational Secret Sharing in Standard Communication Networks
431
so are known, the protocol can be modified to rule out this behavior (in a gametheoretic sense) using the same techniques as in [4, Section 5.2]. Specifically, the
dealer can for each p
Ecient Rational Secret Sharing in Standard
Communication Networks
Georg Fuchsbauer1, , Jonathan Katz2, , and David Naccache1
1
Ecole
Normale Superieure, LIENS - CNRS - INRIA, Paris, France
cfw_georg.fuchsbauer,david.naccache@ens.fr
2
University of Marylan
Rationality in the Full-Information Model
417
References
1. Abraham, I., Dolev, D., Gonen, R., Halpern, J.: Distributed computing meets game
theory: Robust mechanisms for rational secret sharing and multiparty computation.
In: Proceedings of 25th Annual A
456
A. Lewko and B. Waters
the cost of a strong assumption (the BDHE-Set assumption) and ciphertext size
growing linearly in the depth of the hierarchy. Waters [5] obtained full security
with his new dual system encryption methodology from the well-establ
Ecient Rational Secret Sharing in Standard Communication Networks
423
Our protocol assumes parties have no auxiliary information about the secret s.
(If simultaneous channels are assumed, then our protocol does tolerate auxiliary
information about s.) We
424
G. Fuchsbauer, J. Katz, and D. Naccache
2.1
Secret Sharing and Players Utilities
A t-out-of-n secret-sharing scheme for domain S (with |S| > 1) is a two-phase
protocol carried out by a dealer D and a set of n parties P1 , . . . , Pn . In the first
pha
416
R. Gradwohl
It can be verified that when d n/66 and n 66, we get that Pr [B wins] <
+ 1/n. Now, if player i were to bid truthfully, then the probability that B wins
would be + 1/n (since is vote adds to Bs chance of winning). Thus, it is an
optimal s
440
A. Beimel, S.P. Kasiviswanathan, and K. Nissim
sample complexity that is approximately the VC-dimension (or even a function
of the VC-dimension) of the concept class1 .
A natural way to improve on the sample complexity is to use the Private Occams Raz
404
R. Gradwohl
Resilience to rational coalitions (Section 4.4). A dierent form of resilience
against adversarial play is when there is no controlling adversary, but instead
players may form rational coalitions to benefit all members. In Section 4.4 we
gi
Rationality in the Full-Information Model
405
the references therein). Many works in this literature study rational behavior in
a cryptographic setting, for which the full-information model is a special case.
However, due to computational issues, the defi
406
R. Gradwohl
Players may not legally base their messages in round j on the messages of other
players in round j. However, since we can not guarantee simultaneity within a
round, we allow the dishonest players to rush: they may base their messages on
th
Bounds on the Sample Complexity for Private
Learning and Private Data Release
Amos Beimel1, , Shiva Prasad Kasiviswanathan2, and Kobbi Nissim1,3,
1
Dept. of Computer Science, Ben-Gurion University
2
CCS-3, Los Alamos National Laboratory
3
Microsoft Audien
Rationality in the Full-Information Model
413
probability that some member of his coalition gets elected (the standard assumption for leader election) that is, we consider Definition 9, where uA is the
probability that a member of the coalition gets elect
Rationality in the Full-Information Model
Ronen Gradwohl
Kellogg School of Management, Northwestern University, Evanston, IL 60208
r-gradwohl@kellogg.northwestern.edu
Abstract. We study rationality in protocol design for the fullinformation model, a model
414
4.4
R. Gradwohl
Resilience to Rational Coalitions
In Sections 4.2 and 4.3 the adversary corrupts some set of v players, and coordinates their actions. Here we let players form a rational coalition to benefit all
members namely, we consider the definit
Ecient Rational Secret Sharing in Standard Communication Networks
429
share1 := Evalsk2 (i ) s and share2 := Evalsk1 (i ) s;
signal1 := Evalsk2 (i + 1) and signal2 := Evalsk1 (i + 1).
Finally, the dealer gives to P1 the values (sk1 , sk1 , pk2 , pk2 , s
Ecient Rational Secret Sharing in Standard Communication Networks
421
the domain from which the secret is chosen; this approach cannot (eciently)
handle secrets of super-logarithmic length. Subsequent work by Kol and Naor [19]
(see also [4]) shows how to
442
A. Beimel, S.P. Kasiviswanathan, and K. Nissim
private learning. Blum, Ligett, and Roth [4] have recently extended this result
to the setting of private data release. They show that for all concept classes
C, every non-interactive sanitization mechani
Sample Complexity for Private Learning and Private Data Release
451
Theorem 4. There exists an ecient improper private PAC learner for
POINT d that uses O, (1) labeled examples, where , , and are parameters of the private learner.
3.3
Separation between E
Rationality in the Full-Information Model
409
Definition 8 (v-tolerant NE with (strictly) self-interested adversary).
A v-tolerant NE with self-interested adversary in an extensive-form game is a
mixed strategy Sj for every player j for every node that he