Threshold Coin-Tossing Scheme Sample Clauses

Threshold Coin-Tossing Scheme. ∈ { } In this section, we define the notion of an (n, k, t) dual-threshold coin-tossing scheme. The basic idea is that there are n parties, up to t of which may be corrupted. The parties hold shares of an unpredictable function F mapping the name C (which is an arbitrary bit string) of a coin to its value F (C) 0, 1 . The parties may generate shares of a coin—k coin shares are both necessary and sufficient to construct the value of the particular coin. The only requirement on k is that t < k ≤ n − t, analogous to threshold signatures. The generation and verification of coin shares are completely non-interactive; we work in the basic system model of §2. { } The Action. The dealer generates secret key shares SK1, . . . , SKn, and verification keys VK, VK1, . . . , VKn. The initial state information for party Pi consists of the secret key SKi along with all the verification keys. The secret keys implicitly define a function F mapping names to 0, 1 . After the dealing phase, the adversary submits reveal requests to the honest parties for coins of his choice. Upon such a request, party Pi outputs a coin share for the given coin, which it computes using SKi.

Threshold Coin-Tossing Scheme. ∈ { } In this section, we define the notion of an (n, k, t) dual-threshold coin-tossing scheme. The basic idea is that there are n parties, up to t of which may be corrupted. The parties hold shares of an unpredictable function F mapping the name C (which is an arbitrary bit string) of a coin to its value F (C) 0, 1 . The parties may generate shares of a coin—k coin shares are both necessary and sufficient to construct the value of the particular coin. The only requirement on k is that t < k ≤ n − t, analogous to threshold signatures. The generation and verification of coin shares are completely non-interactive; we work in the basic system model of §2. { }