3

The Random Beacon proposal suggests a scheme where K-of-N signatures are used to sign a random number. It suggests that the only way for a random number to be corrupted if all K signers are corrupt; it takes only one honest signer to make the signature valid.

My question is: why would there be a honest signer? Game theoretically, if the value of the random number is high enough, it makes rational sense that the K signers make a deal to corrupt the random number and split the reward between themselves - i.e., it takes one interested party to bribe all the others, making all signers dishonest. Why should an outsider trust one of the K signers is honest?

MaiaVictor
  • 3,177
  • 2
  • 17
  • 37
  • I would guess the idea is that at least K signers have some sort of incentive outside the system, be it reputation or the promise of future reward. Of course, you have to balance these motivations. – Tjaden Hess Jan 25 '17 at 04:26
  • it's not the case that k colluding users can produce a correctly verifying but maliciously generated number -- publicly verifiable secret sharing algorithms prevent that. also secret sharing generally isn't thought of from a rational setting, but rather an honest/semi-honest/adversarial one. to convert this into a rational algo, you just need to have security deposits that get wiped if any user contributes an incorrect share (which can be checked with a VSS or PVSS) – bekah Aug 06 '17 at 13:09

0 Answers0