paillier integration sort of

whitepaper/Dissertation.tex

@@ -340,17 +340,17 @@ The proof system presented is an interactive proof for a given cyphertext $c$ be
     \node[draw,rectangle] (P) at (0,0) {Prover};
     \node[draw,rectangle] (V) at (6,0) {Verifier};
 
-    \node[draw=blue!50,rectangle,thick] (v) at (0,-2) {$r \in \mathbb{Z}_n^*$ with $c = r^n$ (cyphertext)};
+    \node[draw=blue!50,rectangle,thick,text width=5cm] (v) at (0,-1.5) {$r \in \mathbb{Z}_n^*$ with $c = r^n \mod n^2$};
     \draw [->,very thick] (0,-3)--node [auto] {$c$}++(6,0);
 
     \node[draw=blue!50,rectangle,thick] (r) at (0,-4) {Choose random $r^* \in \mathbb{Z}_n^*$};
-    \draw [->,very thick] (0,-5)--node [auto] {$a = (r^*)^n$}++(6,0);
+    \draw [->,very thick] (0,-5)--node [auto] {$a = (r^*)^n \mod n^2$}++(6,0);
 
     \node[draw=blue!50,rectangle,thick] (e) at (6,-6) {Choose random $e$};
     \draw [<-,very thick] (0,-7)--node [auto] {$e$}++(6,0);
 
-    \draw [->,very thick] (0,-8)--node [auto] {$z = r^*r^e$}++(6,0);
-    \node[draw=blue!50,rectangle,thick,text width=6cm] (verify) at (6,-9) {Verify $z, c, a$ coprime to $n$\\ Verify $r^z \equiv ac^e \mod n^2$};
+    \draw [->,very thick] (0,-8)--node [auto] {$z = r^*r^e \mod n$}++(6,0);
+    \node[draw=blue!50,rectangle,thick,text width=5cm] (verify) at (6,-9) {Verify $z, c, a$ coprime to $n$\\ Verify $z^n \equiv ac^e \mod n^2$};
 
     \node[draw=none] (term) at (0,-9) {};
     \fill (term) circle [radius=2pt];
@@ -364,6 +364,10 @@ Then, a proof for the following homologous problem can be trivially constructed:
 
 % Furthermore, the above protocol can be made non-interactive using the Fiat-Shamir heuristic \citep{fiatshamir}. (this contradicts the lit review)
 
+\subsection{Recovering $r$ given $c$}
+
+The proof requires that the prover can perform new calculations with $r$ given a cyphertext $c = g^mr^n \mod n^2$. For ease of programming, 
+
 \subsection{Application to domain}
 
 Players should prove a number of properties of their game state to each other to ensure fair play. These are as follows. \begin{enumerate}
@@ -382,6 +386,58 @@ Players should prove a number of properties of their game state to each other to
 
 For (1), we propose the following communication sequence. The player submits pairs $(R, c_R)$ for each region they control, where $R$ is the region and $c_R$ is a cyphertext encoding the number of reinforcements to add to the region (which may be 0). Each player computes $c_{R_1} \cdot \ldots \cdot c_{R_n}$.
 
+\subsection{Shared random values}
+
+A large part of Risk involves random behaviour dictated by rolling some number of dice. To achieve this, some fair protocol must be used to generate random values consistently across each peer without any peer being able to manipulate the outcomes.
+
+This is achieved through bit-commitment and properties of $\mathbb{Z}_n$. The protocol for two peers is as follows, and generalises to $n$ peers trivially.
+
+\begin{center}
+	\begin{tikzpicture}[
+		every node/.append style={very thick,rounded corners=0.1mm}
+		]
+		
+		\node[draw,rectangle] (A) at (0,0) {Peer A};
+		
+		\node[draw,rectangle] (B) at (6,0) {Peer B};
+		
+		\node[draw=blue!50,rectangle,thick,text width=4cm] (NoiseA) at (0,-1.5) {Generate random noise $N_A$, random key $k_A$};
+		\node[draw=blue!50,rectangle,thick,text width=4cm] (NoiseB) at (6,-1.5) {Generate random noise $N_B$, random key $k_B$};
+		
+		\draw [->,very thick] (0,-3)--node [auto] {$E_{k_A}(N_A)$}++(6,0);
+		\draw [<-,very thick] (0,-4)--node [auto] {$E_{k_B}(N_B)$}++(6,0);
+		
+		\draw [->,very thick] (0,-5)--node [auto] {$k_A$}++(6,0);
+		\draw [<-,very thick] (0,-6)--node [auto] {$k_B$}++(6,0);
+		
+		\node[draw=blue!50,rectangle,thick] (CA) at (0,-7) {Compute $N_A + N_B$};
+		\node[draw=blue!50,rectangle,thick] (CB) at (6,-7) {Compute $N_A + N_B$};
+		
+		\draw [very thick] (A)-- (NoiseA)-- (CA)-- (0,-7);
+		\draw [very thick] (B)-- (NoiseB)-- (CB)-- (6,-7);
+	\end{tikzpicture}
+\end{center}
+
+Depending on how $N_A + N_B$ is then turned into a random value within a range, this system may be manipulated by an attacker who has some knowledge of how participants are generating their noise. As a basic example, suppose a random value within range is generated by taking $N_A + N_B \mod 3$, and participants are producing 2-bit noises. An attacker could submit a 3-bit noise with the most-significant bit set, in which case the odds of getting a 1 are significantly higher than the odds of a 0 or a 2. To avoid this problem, peers should agree beforehand on the number of bits to transmit, and truncate any values in the final stage that exceed this limit.
+
+The encryption function used must also guarantee the integrity of decrypted cyphertexts to prevent a malicious party creating a cyphertext which decrypts to multiple valid values through using different keys.
+
+\begin{proposition}
+	The scheme shown is not manipulable by a single cheater.
+\end{proposition}
+
+\begin{proof}
+	Suppose $P_1, \dots, P_{n-1}$ are honest participants, and $P_n$ is a cheater with desired outcome $O$.
+	
+	The encryption function $E_k$ holds the confidentiality property: that is, without $k$, $P_i$ cannot retrieve $m$ given $E_k(m)$.
+	
+	Each participant $P_i$ commits $N_i$. Then, the final value is $N_1 + \dots + N_{n-1} + N_n$.
+\end{proof}
+
+\subsection{Avoiding modular bias}
+
+The typical way to avoid modular bias is by resampling. To avoid excessive communication, resampling can be performed within the bit sequence by partitioning into blocks of $n$ bits and taking blocks until one falls within range. This is appropriate in the presented use case as random values need only be up to 6, so the likelihood of consuming over 63 bits of noise when resampling for a value in the range 0 to 5 is $\left(\frac{1}{4}\right)^{21} \approx 2.3 \times 10^{-13}$.
+
 \bibliography{Dissertation}
 
 \end{document}