R-round Protocol Research Articles

Certifying Equality With Limited Interaction

The equality problem is usually one's first encounter with communication complexity and is one of the most fundamental problems in the field. Although its deterministic and randomized communication complexity were settled decades ago, we find several new things to say about the problem by focusing on three subtle aspects. The first is to consider the expected communication cost (at a worst-case input) for a protocol that uses limited interaction--i.e., a bounded number of rounds of communication--and whose error probability is zero or close to it. The second is to treat the false negative error rate separately from the false positive error rate. The third is to consider the information cost of such protocols. We obtain asymptotically optimal rounds-versus-cost tradeoffs for equality: both expected communication complexity and information complexity scale as $$\Theta ({{\mathrm{ilog}}}^{r-1} n)$$ź(ilogr-1n), where r is the number of rounds and $${{\mathrm{ilog}}}^k n = \log \log \cdots \log n$$ilogkn=loglogźlogn, with k logs. These bounds hold even when the false negative rate approaches 1. For the case of zero-error communication cost, we obtain essentially matching bounds, up to a tiny additive constant. We also provide some applications. As an application of our information cost bounds, we obtain new bounded-round randomized lower bounds for the Intersection problem, in which there are two players who hold subsets $$S,T \subseteq [n]$$S,T⊆[n]. In many realistic scenarios, the sizes of S and T are significantly smaller than n, so we impose the constraint that $$|S|, |T| \le k$$|S|,|T|≤k. We study the minimum number of bits the parties need to communicate in order to compute the entire intersection set $$S \cap T$$SźT, using r rounds. We show that any r-round protocol has information cost (and thus communication cost) $$\Omega (k {{\mathrm{ilog}}}^r k)$$Ω(kilogrk) bits. We also give an O(r)-round protocol achieving $$O(k{{\mathrm{ilog}}}^r k)$$O(kilogrk) bits, which for $$r = \log ^* k$$r=logźk gives a protocol with O(k) bits of communication. This is in contrast to other basic problems such as computing the union or symmetric difference, for which $$\Omega (k\log (n/k))$$Ω(klog(n/k)) bits of communication is required for any number of rounds.

An Optimally Fair Coin Toss

We address one of the foundational problems in cryptography: the bias of coin-flipping protocols. Coin-flipping protocols allow mutually distrustful parties to generate a common unbiased random bit, guaranteeing that even if one of the parties is malicious, it cannot significantly bias the output of the honest party. A classical result by Cleve (Proceedings of the 18th annual ACM symposium on theory of computing, pp 364---369, 1986) showed that for any two-party $$r$$r-round coin-flipping protocol there exists an efficient adversary that can bias the output of the honest party by $$\varOmega (1/r)$$Ω(1/r). However, the best previously known protocol only guarantees $$O(1/\sqrt{r})$$O(1/r) bias, and the question of whether Cleve's bound is tight has remained open for more than 20 years. In this paper, we establish the optimal trade-off between the round complexity and the bias of two-party coin-flipping protocols. Under standard assumptions (the existence of oblivious transfer), we show that Cleve's lower bound is tight: We construct an $$r$$r-round protocol with bias $$O(1/r)$$O(1/r).