An Optimally Fair Coin Toss

We address one of the foundational problems in cryptography: the bias of coin-flipping protocols. Coin-flipping protocols allow mutually distrustful parties to generate a common unbiased random bit, guaranteeing that even if one of the parties is malicious, it cannot significantly bias the output of the honest party. A classical result by Cleve [STOC '86] showed that for any twoparty r-round coin-flipping protocol there exists an efficient adversary that can bias the output of the honest party by (1/r). However, the best previously known protocol only guarantees O(1/ r) bias, and the question of whether Cleve's bound is tight has remained open for more than twenty years. In this paper we establish the optimal trade-off between the round complexity and the bias of two-party coin-flipping protocols. Under standard assumptions, we show that Cleve's lower bound is tight: we construct an r-round protocol with bias O(1/r). Department of Computer Science and Applied Mathemat...

• Type: Conference
• Year: 2009
• Where: TCC
• Authors: Tal Moran, Moni Naor, Gil Segev
• Keywords: Cryptography, Honest Party, Kleeman Professorial Chair, TCC 2009, Two-party Coin-flipping Protocols