Achieving Adaptive Security and Removing the Leader Election Oracle Sample Clauses

Achieving Adaptive Security and Removing the Leader Election Oracle. The above protocol enables the committee to securely convey its decision to non- committee nodes; unfortunately, the protocol does not defend against adaptive corruptions. Specifically, since the elected committee is small relative to n, an adaptive adversary can simply corrupt all committee members after they are elected. We now present an approach for achieving adaptive security borrowing the “bit-specific committee election” idea that was previously employed in the construction of small-bandwidth honest-majority BA protocols by Xxxxxxx et al. [1] and Xxxx et al. [5]. As a by-product we will have instantiated the leader election oracle that was needed earlier. Our idea is to tie the committee election to each individual bit, i.e., there is a separate committee that are allowed to vote on 0 and 1 respectively (henceforth called the 0-committee and the 1-committee respectively), and the designated sender is in both committees. Specifically, Xxxxxxx et al. [1] and Xxxx et al. [5] describe how to realize bit-specific committee election using a suitable Verifiable Random Function (VRF) with adaptive security. Take b = 0 as an example. For a node i to determine if he is on the 0-committee, he checks the following: let (ρ, π) := VRFski (0), and check if ρ < Dp Here ski is his private key, Dp is an appropriate difficulty parameter that deter- mines the success probability (denoted p) of each election attempt, and π is a proof generated by the VRF which will be used below for verification. Concretely, the probability p is chosen such that the expected number of nodes elected into either the 0-committee or 1-committee is log(1/δ). To convince others that i is indeed an eligible member of the 0-committee, i reveals both ρ and π, and everyone can now verify, using i’s public key, that indeed ρ is the correct outcome of the VRF. We now explain how to use bit-specific committee election to achieve adaptive security. Suppose a 0-committee member i becomes immediately corrupt after signing 0 and multicasting signatures on 0. However, corrupting node i does not necessarily help voting for the bit 1 — in particular, since the two committees are independently selected, node i is only as good as any other node in terms of its likelihood of being elected into the 1-committee. Thus, corrupting node i is only as good as corrupting any other node at this point. In the proof of Lemma 2, we will formalize the above intuition. Putting it altogether. We say that a tuple (b, i, π) i...