ALBATROSS: publicly attestable batched randomness based on secret sharing

I Cascudo, B David - Advances in Cryptology–ASIACRYPT 2020: 26th …, 2020 - Springer
Advances in Cryptology–ASIACRYPT 2020: 26th International Conference on the …, 2020Springer
In this paper we present ALBATROSS, a family of multiparty randomness generation
protocols with guaranteed output delivery and public verification that allows to trade off
corruption tolerance for a much improved amortized computational complexity. Our basic
stand alone protocol is based on publicly verifiable secret sharing (PVSS) and is secure
under in the random oracle model under the decisional Diffie-Hellman (DDH) hardness
assumption. We also address the important issue of constructing Universally Composable …
Abstract
In this paper we present ALBATROSS, a family of multiparty randomness generation protocols with guaranteed output delivery and public verification that allows to trade off corruption tolerance for a much improved amortized computational complexity. Our basic stand alone protocol is based on publicly verifiable secret sharing (PVSS) and is secure under in the random oracle model under the decisional Diffie-Hellman (DDH) hardness assumption. We also address the important issue of constructing Universally Composable randomness beacons, showing two UC versions of Albatross: one based on simple UC NIZKs and another one based on novel efficient “designated verifier” homomorphic commitments. Interestingly this latter version can be instantiated from a global random oracle under the weaker Computational Diffie-Hellman (CDH) assumption. An execution of ALBATROSS with n parties, out of which up to are corrupt for a constant , generates uniformly random values, requiring in the worst case an amortized cost per party of exponentiations per random value. We significantly improve on the SCRAPE protocol (Cascudo and David, ACNS 17), which required exponentiations per party to generate one uniformly random value. This is mainly achieved via two techniques: first, the use of packed Shamir secret sharing for the PVSS; second, the use of linear t-resilient functions (computed via a Fast Fourier Transform-based algorithm) to improve the randomness extraction.
Springer