Multi-party Time-Lock Puzzles: Quorum Controlled Delays Without a Single Point of Failure
摘要
Managing the timing and delays of computing events is central to distributed systems. Timed cryptography, such as time-lock puzzles (introduced almost 30 years ago) and verifiable delay functions, provides central tools for such tasks: A single party (the committer) knows a secret, commits to it publicly, and then the committed secret can be opened via a time-consuming staged computation by any observer; this process is independent of post-commitment actions by or presence of the committer. Implicit in this scenario is the requirement that the committer itself does not attack the system, and, say, prematurely selectively leak or de-commit the value, either maliciously or due to external attacks. To prevent the above attack and to expand timed-delayed cryptography to address more applications, we initiate here the study of how to distributedly hold a timed secret known neither to any individual party nor to any group smaller than a quorum. This primitive is defined in the context of multi-party computation (MPC). In fact, this implements a setting where a group of parties simultaneously learn a secret that has been kept private for a predetermined amount of time, and could have been collectively generated without a single party controlling its generation (as in distributed key generation scenarios). This new paradigm, and the ability to compose such protocols, also extends time-lock functionalities to applications where a firm commitment by a group of parties to future release is executed even without knowing the underlying secrets and even without assuming cooperation or availability of parties in the future. Sample applications requiring such delayed disclosure include accountable future scanning of software for zero-day vulnerabilities and accountable, secure sharing of clinical trial documents. We design the first secure practical protocol for Multi-party Time-lock Puzzles (MTP), a new primitive centered on the inherently needed distributed generation of a time-lock puzzle, and the inability to prematurely reconstruct the committed value unless a quorum of parties is compromised. We then leverage MTP to build Timed Multi-party Computation (TMPC), which we model as MPC with a single time-locked output.