Subcubic Coin Tossing in Asynchrony without Setup

2026-03-02

AI Summary

Achieving efficient public coin tossing in a setting without trusted setup, under asynchrony and against an adaptive Byzantine adversary, is highly challenging. This work proposes the first protocol that requires no trusted setup, achieves sub-cubic communication complexity (i.e., o(n³)), and tolerates Θ(n) adaptive Byzantine faults with constant success probability. By introducing a committee election mechanism, the protocol reduces strong coin tossing to low-overhead weak coin tossing. It operates in two security models: under perfect security, it tolerates up to (1/4 − ε)n faults, and under cryptographic security, up to (1/3 − ε)n faults. The respective communication complexities are O(n²·⁵(ε⁻⁸ + log n)) and O(n⁷⁄³ ε⁻⁶ κ log n), with both achieving O(log n) latency.

Technology Category

• Game Theory and Economic Paradigms: Mechanism Design
• Reasoning under Uncertainty: Other Foundations of Reasoning under Uncertainty
• Multiagent Systems: Mechanism Design

Application Category

• Security and Privacy: Applications of cryptography
• Economics, Online Markets and Human Computation: Incentives in network design for Web infrastructures and ecosystems
• Responsible Web: Data and user privacy-enhancing technologies for the Web

Abstract

We consider an asynchronous network of $n$ parties connected to each other via secure channels, up to $t$ of which are byzantine. We study common coin tossing, a task where the parties try to agree on an unpredictable random value, with some chance of failure due to the byzantine parties' influence. Coin tossing is a well known and often studied task due to its use in byzantine agreement. In this work, we present an adaptively secure committee-based method to roughly speaking turn strong but costly common coins into cheaper but lower-quality ones. For all $k > 2$ and $\varepsilon > 0$, we show how to use a strong (very rarely failing) coin that costs $\widetilde{O}(n^k)$ bits of communication to get a cheaper coin that costs $\widetilde{O}(\varepsilon^{-2k}n^{3 - 2/k})$ bits of communication. This latter coin tolerates $\varepsilon n$ fewer byzantine parties than the former, and it fails with an arbitrarily small constant probability. For any $\varepsilon > 0$, our method allows us to get a perfectly secure binary coin that tolerates $t \leq (\frac{1}{4} - \varepsilon)n$ faults with $O(n^{2.5}(\varepsilon^{-8} + \log n))$ messages of size $O(\log n)$, as well as a setup-free cryptographically secure binary coin that tolerates $t \leq (\frac{1}{3} - \varepsilon)n$ faults with $O(n^{7/3}\varepsilon^{-6}κ\log n)$ bits of communication (where $κ= Ω(\log n)$ is a cryptographic security paramater). These coins both have $O(\log n)$ latency. They are to our knowledge the first setup-free coins that cost $o(n^3)$ bits of communication but still succeed with at least constant probability against $t = Θ(n)$ adaptive byzantine faults. As such, they for the first time enable setup-free (and even perfectly secure) asynchronous byzantine agreement with $o(n^3)$ communication against $Θ(n)$ adaptive byzantine faults.

Problem

• asynchronous
• byzantine faults
• common coin tossing
• subcubic communication
• no setup

Innovation

• subcubic communication
• asynchronous common coin
• adaptive Byzantine faults
• setup-free
• committee-based protocol