Computational two-party correlation: A dichotomy for key-agreement protocols

Iftach Haitner, Kobbi Nissim, Eran Omri, Ronen Shaltiel, Jad Silbak

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review


Let π be an efficient two-party protocol that given security parameter κ, both parties output single bits X κ and Y κ , respectively. We are interested in how (X κ , Y κ ) "appears" to an efficient adversary that only views the transcript T κ . We make the following contributions: • We develop new tools to argue about this loose notion, and show (modulo some caveats) that for every such protocol π, there exists an efficient simulator such that the following holds: on input T κ , the simulator outputs a pair (X κ ' , Y κ ) such that (X κ ' , Y κ ' , T κ ) is (somewhat) computationally indistinguishable from (X κ , Y κ , T κ ). • We use these tools to prove the following dichotomy theorem: every such protocol π is: - either uncorrelated - it is (somewhat) indistin-guishable from an efficient protocol whose parties interact to produce T κ , but then choose their out-puts independently from some product distribution (that is determined in poly-time from T κ ), - or, the protocol implies a key-agreement protocol (for infinitely many κ 's). Uncorrelated protocols are uninteresting from a cryptographic viewpoint, as the correlation between outputs is (computationally) trivial. Our dichotomy shows that every protocol is either completely uninteresting or implies key-agreement. • We use the above dichotomy to make progress on open problems on minimal cryptographic assumptions required for differentially private mechanisms for the XOR function. • A subsequent work of Haitner et al. uses the above dichotomy to makes progress on a long-standing open question regarding the complexity of fair two-party coin-flipping protocols. We highlight the following ideas regarding our technique: • The simulator algorithm is obtained by a carefully designed "competition" between efficient algorithms attempting to forecast (X κ , Y κ )|T κ=t . The winner is used to simulate the outputs of the protocol. • Our key-agreement protocol uses the simulation to reduce to an information theoretic setup, and is in some sense non-black box.

Original languageEnglish
Title of host publicationProceedings - 59th Annual IEEE Symposium on Foundations of Computer Science, FOCS 2018
EditorsMikkel Thorup
PublisherIEEE Computer Society
Number of pages12
ISBN (Electronic)9781538642306
StatePublished - 30 Nov 2018
Event59th Annual IEEE Symposium on Foundations of Computer Science, FOCS 2018 - Paris, France
Duration: 7 Oct 20189 Oct 2018

Publication series

NameProceedings - Annual IEEE Symposium on Foundations of Computer Science, FOCS
ISSN (Print)0272-5428


Conference59th Annual IEEE Symposium on Foundations of Computer Science, FOCS 2018


  • Computational correlation
  • Differential privacy
  • Key agreement


Dive into the research topics of 'Computational two-party correlation: A dichotomy for key-agreement protocols'. Together they form a unique fingerprint.

Cite this