Multi-party

TurkishModel. Continued and upgraded promotion of the Turkish political and economic model of a secular, multi-party, market democracy. Turkish and US-based NGO s, policy and educational institutes, and multilateral organizations like GUUAM and OSCE can play an important role in adapting the Turkish experience to the particular socio-economic and political conditions in selected countries. The focus of such effort ought to be Azerbaijan, Uzbekistan, and Turkmenistan. 

Both terms are allowed because scheme is the usual word with signature schemes, whereas protocol is usual with the 2-party and multi-party protocols mentioned below. If there is any distinction in the present context, then protocols are smaller than schemes, e.g., there is a verification protocol as a part of an invisible signature scheme. 

A usual alternative in cryptology is to represent them as the initial and final state of the entity. This is possible because in usual 2- and multi-party protocols, entities have only one input and one output that would be interpreted as interface events here. 

In the general framework (Chapter 5), the first alternative is used, because signature schemes are modeled as reactive systems, which can interact with their users many times. In the definitions in the conventional style (Chapter 7), 2-party and multi-party subprotocols are handled in the conventional way. 

Moreover, the connection structure meant by if properly connected is a function of time, in contrast to 2- or multi-party protocols customary in cryptology The same output port of the entity of a signer may be connected to the input port of many different recipients, one after the other. 

A structural property Within a transaction, the entities concerned expect to have fixed connections. (Hence the corresponding parts of the programs could be grouped together into subprotocols that are 2- or multi-party protocols in more or less the usual sense, e.g., a 2-party protocol for the authentication transaction.)... 

External verifiability of the behaviour of participants in a transaction essentially means that there is a variant of this transaction where additional parties can observe the original participants and decide whether they behave correctly. Such a property has not been required explicitiy in any previous definition of signature schemes, but it can easily be fulfilled with some types of schemes and may be needed in some applications. The same property will be needed for other types of schemes in Sections 7.3 and 7.5.2 (zero-knowledge proofs and multi-party function evaluation), and the need for it may become clearer there. 

Tbe following definition generalizes Definition 7.1 to an arbitrary number of risk bearers. It is not quite as rigorous as the previous one, because no formalization of multi-party protocols and, in particular, their execution with attackers has been fixed. 

The obvious advantage of this construction is that the complexity of authentication and disputes is independent of the number of risk bearers. The disadvantage is that a general suitable key-generation protocol is very inefficient however, see the last subsection for more efficient special cases. (Moreover, due to problems with definitions of multi-party function evaluation protocols, I did not even dare to call the security considerations below a proof sketch.)... 

For the transformation of an arbitrary key-generation protocol Gen with one risk bearer into a protocol Gen that generates keys with the same distribution, but in a way that many risk bearers can trust them, a multi-party function evaluation protocol is used. 

As mentioned in Section 4.4.1, Related Work in Cryptology , multi-party protocols have almost exclusively been considered for the evaluation of (probabilistic) functions. The informal definition of a multi-party protocol that securely evaluates a function/on n inputs, jcj,. .., x , which are assumed to be contributed by n different users, is that the protocol has exactly the same effect for all users, honest and dishonest, as an evaluation by a trasted host would have. Such a trusted host would receive each input x,- secretly from the i-th user, apply/, and output y. =f(x, . .., x ) to everybody (or, if/is probabilistic, a value y distributed... 

Most concrete proposals of multi-party function evaluation protocols are not only protocols for one particular function, but general transformation techniques that can be used to derive a suitable protocol for any given function. 

To apply a multi-party function evaluation protocol to key generation, which is an interactive protocol, it is usefiil to regard Gen as one probabilistic function. This has implicitly been done all the time Gen maps values par to tuples acc, idspi h- f, pk, sk temp). Hence a trusted host performing the entire key generation, i.e.. A, B, and res, will be simulated. The correctness of initialization implies that acc and idsout always TRUE and 1), respectively, in this case. Hence one can omit them. The trusted host would tell the signer s entity both sk and pk, and the other entities obtain pk only. 

This global function is now evaluated with a multi-party function evaluation protocol by the entities of the signer and the risk bearers. Recall that the entities of recipients and courts do not send any messages during initialization of a standard fail-stop signature scheme with special risk bearers they are treated in a special subsection below. 

Even when multi-party protocols that simulate interactive functions or reactive systems are defined, this should be more efficient than simulating the interactive algorithm B of the risk bearer or all the individual protocol steps. 

An algorithm res is needed that the entities of recipients and courts can execute, too. They do not take part in the multi-party function evaluation actively, but they observe the complete protocol execution, which is performed on broadcast channels anyway. (The following means that the protocol from [ChDG88] can easily be equipped with external verifiability as defined in Section 5.2.11.)... 

Whenever one of the active entities is to be excluded, the algorithm res checks if this decision is correct. One can easily see from the protocol description in [ChDG88] that this decision only depends on broadcast messages, and not on any internal secrets of the active entities. The global result acc is TRUE if the entities of the signer and at least one risk bearer remain and execute the multi-party function evaluation protocol without disruption, and idsi isk,out consists of the identities of the remaining risk bearers. 

The security for the users of the multi-party function evaluation protocol, except for the one who is protected information-theoretically, relies on the so-called quadratic-residuosity assumption. Hence the security for risk bearers in a fail-stop signature scheme based on this protocol also relies on this assumption. 

If the protocol Gen is particularly simple, the construction with a multi-party function evaluation protocol can be simplified, too. 

Thus only the prekey-generation algorithm geng remains to be simulated by the multi-party fiinction evaluation protocol. Note that the signer s entity still has to take part in this protocol to ensure that the resulting prekey is good. 

Gen, the key-generation protocol, is a multi-party protocol defined by a pair of probabilistic interactive functions, (A, B ) (where is supposed to be executed by the signer s entity and by each entity of a tester), and arbitrary types of channels. (For concreteness, one can assume that in any execution, there is a private point-to-point channel between each pair of entities and a reliable broadcast channel for each one.)... 

CtGT95 Claude Cr peau, Jeroen van de Graaf, Alain Tapp Committed Oblivious Transfer and Private Multi-Party Computation Crypto 95, LNCS 963, Springer-Verlag, Berlin 1995, 110-123. 

Agreement Reached in the Multi-Party Negotiations (Good Friday Agreement), 10 April 1998, Art. 2(1). Full text available at http //www.nio.gov.uk/agreement.pdf, accessed 3 November 2008. 

Multi-Lateral and Multi-Party Initiatives The Story So Far... 

With a number of these reports highlighting the need for coordination between not only jurisdictions, but also other key stakeholders (including industry, members of the research community, and non-governmental organizations), a number of multi-lateral and multi-party activities aimed at ensuring the safety of nanotechnologies have been initiated. The following section provides an overview of a number of activities that have been undertaken to date. 

---