HW 5

HW 5

daniel (guest) 27 Jun 2019 11:23

Hi, can you please give us an answer sketch for HW 5 Q2 section b, and for Q3 section a?
I asked around and I don't think anyone got full points for this.

Re: HW 5

nbitansky 28 Jun 2019 00:37

2.b. In an expected number of 10 rounds the attacker will be the leader. At this point, it can adaptively resample the seed S to guarantee that it is also the leader in the next round. This way the attacker will always be the leader and propose all the blocks (it can also gain control of the committee, and create forks etc, but that wasn't necessary for a satisfying answer).

3.a When generating an anonymous coin, generate also OTS keys $pk,sk$, then commit to both the serial number $S$ and to $pk$ (we don't publish in the clear either one). When paying a coin to some node $i$ publish both $S$ and a signature on $i$ with $sk$ and provide a ZK proof that there exists a commitment among all the anonymous coins to $S$ and a verification key $pk$ that such that the signature on $i$ is valid with respect to that key.