Cross Chain Atomic Swaps in the Absence of Time via

Attribute Verifiable Timed Commitments

Yacov Manevich Adi Akavia

University of Haifa, Israel University of Haifa, Israel
[email protected] [email protected]

Abstract—A Hash Time Lock Contract (HTLC) is a protocol A Hash Time Lock Contract (HTLC) is a technique
that is commonly used to exchange payments across different of payment in which a depositor can pay a recipient
blockchains. Using HTLC as a building block for cross funds by placing them in an escrow state that can be
blockchain atomic swaps has its drawbacks: The notion of claimed by the recipient only if the latter presents a pre-
time is handled differently in each blockchain, be it private image of a cryptographic hash function in a transaction.
or public. Additionally, if the swap ends up aborted, the To prevent the funds from being held in escrow for ever,
funds are locked in escrow until the safety timeout expires. each HTLC has a time limit (a timeout) after which the
In this work we formulate a new cryptographic primi- funds are returned to the depositor. We outline the standard
tive: Attribute Verifiable Timed Commitment which enables to technique of performing a cross chain atomic swap using
prove that a timed commitment commits to a value which HTLC in Section 3.1 in the preliminaries.
possesses certain attributes. Using our cryptographic prim-
itive, we describe a new cross chain atomic swap protocol 1.1.1. Timeouts. An HTLC has a timeout up to which the
that operates without blockchain derived time and unlike funds are locked. This is needed in order to enforce that
the state of the art, all parties can instantly abort the swap a party will not be able to spend the funds it deposited
without waiting for the safety timeouts to expire. in escrow while claiming the funds of the counter-party.
In order to prove in zero knowledge that a secret A downside of using HTLCs as the building block of
committed to using a timed commitment has a claimed hash atomic swaps is that in case the swap ends up aborted
value, we employ the ”MPC in the head” technique by Ishai (for example, the initiator of the swap has a change of
et al. and implement our zero-knowledge proof protocol and heart) then the funds of both parties are stuck in escrow
evaluate its performance. As part of our techniques, we until their corresponding timeouts expire.
develop a novel and efficient procedure for integer Lower-
Than validation in arithmetic circuits which may be of 1.1.2. Blockchain Derived Time. Each blockchain
independent interest. (whether it is permissionless or permissioned) has its own
different time management and some like Hyperledger
Index Terms—Cryptography, Blockchain, Zero-Knowledge
Fabric [12], [34] don’t even have such. This poses as
Proofs, Cross Chain Swaps, Multi-Party Computation
an obstacle for using HTLCs as an effective building
block for cross blockchain swaps. In particular, in some
1. Introduction blockchains it is not possible to make a transaction valid
only during a certain time frame, or to derive the time from
Blockchains are distributed systems that replicate the blockchain height. Therefore, we ask the following
transactions among distrusting and sometimes opposing question:
parties. While it is common practice to exchange assets or Can we build a protocol for cross blockchain atomic
currency among participants of the blockchain, engaging swaps without using the blockchain as a source of time?
in a similar deal across different blockchains is a more We answer the question in the affirmative by intro-
involved matter, in which the exchange needs to take place ducing a new cryptographic primitive which disposes the
in both blockchains, and ideally without utilizing a trusted need to rely on blockchain derived time in cross chain
third party. Such a protocol is called a cross chain atomic atomic swaps.
swap.

1.1. Cross Chain Swaps 1.2. Our Contribution

An atomic swap protocol ensures that if all parties 1.2.1. AVTC. We introduce a new cryptographic primitive
comply with the protocol, a swap takes place and each that we call an Attribute Verifiable Timed Commitment
party exchanges its asset with what the counter-party (AVTC). In layman’s terms, a timed commitment [15] is
offers in return. On the other hand, if some party strays a commitment that can be forcibly opened by the receiver
from the protocol then the swap ends up aborted, and without interaction with the sender (committer) by invest-
the system state is left intact. In blockchains, a common ing a predefined amount of sequential computation. An
solution for atomic swaps is having each party use a Hash AVTC can be thought of an enhanced timed commitment
Time Lock Contract. where the receiver can be convinced by the sender that
the committed secret possesses some attribute, as part of state of affairs regarding Hash Time Lock Contracts, give
the reception of the commitment. an introduction to Boneh and Naor’s timed commitment
Our main contribution is the AVTC cryptographic scheme, and briefly explain the transformation from multi-
primitive. To construct an AVTC, we augment the timed party computation to zero knowledge proofs (“MPC in the
commitment with an interactive zero knowledge proof for head”), in sections 4 and 5 we describe our protocol for
arbitrary properties of the value that is committed to. Our cross chain atomic swap and explain our proposed AVTC
construction prioritizes minimizing computation time for primitive. We conclude our work in Section 6.
both the prover and verifier and leverages the ”MPC in
the head” technique of Ishai et al [30], and entails a novel 2. Related Work
technique for Lower-Than validation in arithmetic circuits
that doesn’t require bit decomposition, which may be of 2.1. Blockchain Based Time Derivation
independent interest. We implement the zero-knowledge
proof of AVTC in C and evaluate its performance under In this section we discuss different approaches for
different security configurations. time that exist in blockchains, as well as time-related
cryptography.
1.2.2. Blockchain time-agnostic swap. Our second con-
2.1.1. Permissionless Blockchains. Time in permission-
tribution is a novel cross chain atomic swap protocol that
less blockchains is often calculated at a very coarse
operates without blockchain time, which is made possible
grained level, a fact that forces the parties to have high
by using AVTC in a black box manner. We show that
timeouts (several hours at best): Bitcoin: The median time
our protocol is not only “blockchain agnostic”, but has an
of the last 11 blocks [4], where a block is created on
additional beneficial property: our protocol allows parties
average once per 10 minutes. Ethereum: In Ethereum, the
to instantly abort the swap if both parties cooperate, while
block timestamp is set by the node that mined the block,
the current state of the art requires parties to wait until the
and the validity rules dictate that the timestamp should
timeouts expire, keeping their funds idly locked in escrow
be monotonously ascending and each block’s timestamp
in the meanwhile. The downside of our protocol is that in
is earlier than 15 minutes into the future from the current
case the parties do not cooperate in the abort procedure,
time.
they need to invest a moderate (several dozens of minutes
to a couple of hours) time period of serial computation, 2.1.2. Permissioned Blockchains. Permissioned
whereas in the standard cross chain swap it is sufficient blockchains block production rate varies according
to wait that same time period. to the transaction load [34], therefore it is impossible
to correlate a number of blocks produced with time.
1.3. Overview of Our Techniques There are no standards of how the notion of time is
defined in permissioned blockchains: Tendermint: In
Our cross chain atomic swap protocol entails replacing Tendermint [10], applications can define a “locktime”
the time based reclamation condition of the HTLC with which is the number of blocks passed after contract
revealing a pre-image of a hash function. More specif- creation. However this compromises the safety in the
ically, each party gives the counter-party an AVTC and event of an system outage in which no blocks are
a hash. The counter-party escrows its funds with the being created. Hyperledger Fabric: Blocks do not carry
reclamation condition of revealing the pre-image of the timestamps [12]. Mitra et al. [34] proposed a mechanism
hash, which it can open only after a predetermined amount to assign timestamps to the blocks by modifications to
of computation steps. The AVTC primitive ensures that the post consensus validation. Sawtooth: In Hyperledger
hash pre-image can indeed be revealed after investing the Sawtooth [8], there is no block timestamp by default,
computation steps, which prevents a malicious party from but the nodes can be configured to artificially inject a
causing the counter party’s funds to be locked in escrow “Blockchain Info” transaction that contains a timestamp,
forever. at the beginning at every block (see [9]).
Our AVTC primitive is realized by the timed com-
mitment technique of Boneh and Naor, coupled with an 2.1.3. Scientific Literature. There have been several
interactive zero knowledge proof between both parties of proposals for cross chain swaps that do not fully de-
the swap. The zero-knowledge proof of the AVTC is based pend on blockchain based time derivation. Deneuville
on the ”MPC in the head” technique of Ishai et al. [30]. In et al. [47] proposed an asymmetric protocol in which
the zero-knowledge proof, we perform efficient modular one blockchain can verify transactions being put on the
exponentiation by employing a novel technique for LSB second blockchain, however, one of the blockchains still
extraction, which straightforwardly leads to an efficient relies on blockchain derived time. Interledger [6] proposed
comparison protocol. The LSB extraction’s salient prop- a protocol based on connector entities that have access
erty is the prover acting as a dealer and distributing among to both blockchains, and is also time reliant for escrow
the parties blinded plaintext shares of all bits but the LSB release.
itself.
2.2. Time Based Cryptography
1.4. Paper Organization The main time-based cryptographic primitive that is
used in our work, is the ”Timed Commitment” of Boneh
The paper is organized as follows: In Section 2 we and Naor [15], and is explained in Section 3.2 . We give
discuss related work in cross chain atomic swaps and an overview on other cryptographic primitives that possess
time based cryptography. In Section 3 we outline the time-related guarantees.
2.2.1. Verifiable Delay Functions. Proofs that verify a committer of the GaTC. In contrast, our AVTC primitive
computation took a certain amount of steps have been only assumes number theoretical assumptions (see Def-
studied in the past in the context of Verifiable Delay inition 5), and protects against malicious committers by
Functions (VDF) [14] [38] [46]. enforcing honest behavior via zero-knowledge proofs.
Replacing AVTC with a VDF is possible, however it We note that the authors of [11] mention this and state
would take away an important advantage of our protocol: that their semi-honest committer assumption can be
interoperability. In our protocol, the computations done in eliminated by using zero-knowledge proofs.
the blockchain are invocations of hash functions, and the • A party that opened a GaTC can prove in zero-
heavy lifting is done in the application layer. In contrast, knowledge that it did so. While our technique doesn’t
using a VDF would require the blockchain software to be focus on such an ability, we note that our technique can
able to validate the VDF proof, which requires introducing be trivially extended to facilitate that. Indeed, a party
new software into the blockchain validation mechanisms, that has forcefully extracted the input for F (as depicted
thus hindering adoption and making it impossible to be in Figure 2) has the required information to play as the
integrated to conservative blockchains. prover of the AVTC.
2.2.5. Homomorphic Time-Lock Puzzles (HTLP).
2.2.2. Timed Fair Exchange of Signatures. Garay et Malavolta et al. [33] constructed variations of time-lock
al. [22] and Boneh at al. [15] both proposed interactive puzzles that each is homomorphic to an operation1 such as
protocols for timed fair exchange of signatures. Those addition in ZN or multiplication in JN (where JN denotes
protocols, however, do not protect the counter-party from elements in Z∗N with Jacobi symbol +1).
a malicious abort that wastes computation time that is As in the timed commitment, the HT LP has a setup
linear in the total protocol runtime. phase that generates public parameters. However, in the
timed commitment the sender proves to the receiver that
2.2.3. Multi-Party Timed Commitment. Doweck and the forced open (denoted as Solve in HTLP) indeed
Eyal [21] constructed a Multi-Party Timed Commitment yields the committed value within the claimed number of
(MPTC) that enables several parties to jointly commit to computation steps. As we’ll see below, it is not the case
a secret to be later opened by a designated party via in HTLP. We elaborate on one of the variations of HTLP,
brute-force computation. The MPTC primitive of [21] Linearly Homomorphic Time Lock Puzzle (LHTLP) as it
does not allow one to prove an attributes the committed is used as a building block for higher level applications
secret, unlike our AVTC primitive. The MPTC commit- which we discuss later in this section. A Linearly Ho-
ment brute-force opening is trivially parallelizable, unlike momorphic Time Lock Puzzle (LHTLP) is a tuple of the
our AVTC primitive which is not (under number-theoretic four algorithms below:
assumptions, see Definition 5). Consequently, we note λ
• pp ← Setup(1 , T ) On input of security parameter λ,
that in our cross-chain atomic swap protocol, our AVTC hardness parameter T outputs public parameters pp.
primitive cannot be substituted with an MPTC because we • Z ← Gen (pp, s): Output a puzzle Z for a solution s.
require that the commitment brute-force opening cannot • s ← Solve (pp, Z): Recovers s from Z .
be done via parallel computation, as it would harm the • Z ← Eval (⊕, pp, Z1 , ..., Zn ): Outputs Z s.t ∀{Zi ←
security of our atomic swap protocol. Pn
Gen (pp, si )}ni=1 : Solve (pp, Z) = i=1 si (mod N )
where N is specified in pp.
2.2.4. Gage Time Capsules. Almashaqbeh, Benhamouda, Setup samples a safe modulus2 N , samples g ∈ JN
et al. [11] constructed a Gage Time Capsule (GaTC) which T
and computes h = g 2 and outputs pp = (T, N, g, h). If h
allows a party to commit to a value that others are able to
was not honestly constructed then Solve will not output
reveal at a designated total computational cost, and that
the s that was used as input to Gen. We elaborate on
computation is expected to be parallelized among different
this in Section A in the Appendix. The authors of [33]
parties which are incentivised to try out different random
do mention that the setup should be executed by a trusted
decommitment values, and claim a monetary reward in
party.
exchange for their work. While their primitive (GaTC)
seems similar to our AVTC primitive, we note the salient 2.2.6. Verifiable Timed Signatures. Thyagarajan et al.
differences: [44] constructed a Verifiable Timed Signature (VTS) prim-
• Brute-forcing a GaTC can be parallelized, and thus, itive for common elliptic curve based signature schemes
parties with access to parallel computing power gain such as ECDSA [31]. It allows a sender to commit to a
significant advantage over others. In contrast, brute- receiver on a signature and later the receiver can forcefully
forcing an AVTC cannot be parallelized (under number- recover the signature without interaction with the sender
theoretic assumptions, see Definition 5), and this prop- by executing serial computation. Unlike our AVTC prim-
erty is crucial to the security of our novel cross-chain itive (Definition 10), the VTS construction is an ad-hoc
atomic swap protocol described in Section 4. protocol suitable only for signatures, and cannot be used
• The GaTC zero-knowledge proof does not prove any for any arbitrary attribute as in our AVTC primitive.
attribute of the secret that is committed to. Rather, it The VTS construction is based on the Linearly Homo-
contains only a proof of opening. In contrast, our AVTC morphic Time-Lock Puzzle (LHTLP) primitive of Mala-
primitive, proves that a committed secret, possesses an volta et al. [33] and its high-level idea is as follows: First,
attribute of the committer’s choice.
1. The work also shows that a fully homomorphic time lock puzzle
• The GaTC committer does not prove to a counter-party
is feasible assuming indistinguishability obfuscation.
that the commitment can be opened within a timely 2. A safe modulus is a product of two primes p = 2p0 +1, q = 2q 0 +1
manner. Rather, it assumes a semi-honest model on the where p0 , q 0 are also prime
the sender ”encrypts” the signature with secret shares gen- constant complexity, by making the prover compute the
erated with t-out-of-n Shamir’s secret-sharing [42]. Then, LSB itself, but having the verifier validate the prover.
it commits to each share with the LHTLP primitive by
locking each share in a LHTLP puzzle. The sender and the 3. Preliminaries
receiver then engage in a cut-and-choose protocol where
the receiver asks to open t − 1 puzzles and invokes Gen
itself to verify the puzzles sent to it were indeed correctly
3.1. Hash Time Lock Contracts
constructed. Additionally there is also a range proof that
proves that the time-lock puzzles contain ”small” values. A Hash Time Lock Contract (HTLC) [39] is a tech-
As noted in our discussion on the Homomorphic Time- nique of payment in which a depositor can pay a recipient
Lock Puzzle (HTLP), without a trusted setup assumption, a part of its funds by placing them in an escrow state that
even when validating the Gen operation via cut-and- can be claimed by the recipient only if it presents a pre-
choose as done in the VTS construction, a malicious image of a cryptographic hash function in a transaction.
sender may fool the receiver into accepting signatures that To prevent the funds from being held in escrow for ever,
can never be opened without interaction with the sender. In each HTLC has a time limit (a timeout) after which the
contrast, our AVTC primitive enjoys a transparent setup. funds are returned to the depositor.
HTLCs are often used as a building block for atomic
2.2.7. Universal Atomic Swaps: Secure Exchange of cross chain swaps, in which Alice can atomically ex-
Coins Across All Blockchains. A parallel work to ours by change her coins in blockchain A with Bob’s coins in
Thyagarajan et al. [43] that appeared online in December blockchain B. In order for a cross chain atomic swap to
2021 deals with performing cross-chain atomic swaps be useful, it needs to possess both safety and liveness
by substituting blockchain derived time with using the properties [29]:
Verifiable Timed Signature (VTS) (Section 2.2.6) also Definition 1 (Safety). For every execution, either both
by Thyagarajan et al. [44]. The high level idea of their parties claim each other’s funds, or no party claims the
scheme is that the escrow account on each blockchain counter-party’s funds.
is initialized with a public key so that its corresponding
private key is secret shared between the two counter- Definition 2 (Liveness). For every execution, no asset of
parties. Then, to swap the funds the parties engage in a some party is locked in escrow forever.
secure two-party computation protocol to produce a sig- Below we give the well known HTLC based cross
nature (done for each blockchain in parallel). To withdraw chain atomic swap protocol of [28]:
from the swap, the parties recover signatures on withdraw 1) Alice randomly selects a secret s ← {0, 1}λ for some
transactions prepared as part of the prepare phase. security parameter λ and publishes a transaction on
We note that unlike our solution which relies on blockchain A with a hash lock of h = H(s) and a
the blockchain being able to verify hash puzzles as part time lock of T + ∆ for some ∆ > 0.
of its transaction validation logic (an ability that some 2) Bob publishes a similar transaction on blockchain B
blockchains like Monero, lack), the technique of Thya- with a hash lock of h (while not knowing s) and a
garajan et al. does not require that, as the time based time lock of T .
cryptography locks a signature and not a hash pre-image. 3) Alice publishes a transaction on blockchain B which
It is not clear how the authors address the issue we raise includes s0 ∈ H−1 (h) and as a result claims Bob’s
in Section 2.2.5 regarding the trusted setup assumption coins to her account.
of the HTLP and VTS primitives that the construction of 4) Bob, having seen a pre-image s0 such that H(s0 ) =
[43] relies on. h , publishes a transaction on Alice’s blockchain that
claims Alice’s coins to his account.
2.3. LSB extraction in Multi-Party Computation We note that Alice sets a time lock T+∆ compared to T
for Bob, because had Alice put her funds in escrow for an
The AVTC primitive we construct uses the ”MPC in equivalent or shorter period of time than Bob - she could
the head” zero-knowledge framework (see Section 3.3). have first claimed Bob’s funds into her account and then
An important part of our computation uses LSB extraction raced Bob on blockchain A and reclaimed her funds back
of a secret-shared value. before Bob had a chance to claim them.
The current state of the art in MPC enables one to While HTLCs are powerful tools that allow atomic
extract the LSB [19], [32], [37] but with polynomial exchange of assets between two or more blockchains, a
complexity in the binary representation length of elements major limitation in the protocol stems from its safety: If
in the underlying field. Such techniques are expensive a party put its funds in escrow for a time period T , even
to be used in the ”MPC in the head” approach that we if both parties agree to abort the swap, they have to wait
employ for our zero-knowledge proof, since they blow up until T time passes.
the proof size when the field in use is thousands bits long.
There are also techniques [18], [40] that allow to extract 3.2. Timed Commitments
the LSB with a constant communication complexity, how-
R
ever only for values known to be significantly small. In Notations and definitions: We denote by ← X a
our protocol, unfortunately, the verifier cannot trust the uniform random selection from a set X and denote λ ∈ N
prover to uphold any such invariant. to be a security parameter. Let  : N → R be a
We devise a novel MPC protocol tailored for zero- negligible function if for every positive polynomial P :
1
knowledge from MPC techniques that extracts an LSB in ∃N ∈ N s.t ∀n > N :  (n) < P (n) .
Definition 3 (Commitment scheme). A protocol between proof sub-protocol of timed commitment in Section C,
a sender S and a receiver R with two steps: which was not provided in [15].
λ
• Commit(x, 1 ): S has input x, and outputs to R a
string C ∈ {0, 1}λ and to S a decommitment string d ∈ Setup(1λ ). Let λ be a security parameter. The committer
{0, 1}λ . We denote by (d, C) ←< S(x, 1λ ), R(1λ ) > (also called the sender) picks P, Q: two λ-bit primes s.t
the experiment in which S and R interact. P ≡ Q ≡ 3 (mod 4), and publishes their product N =
• Open: R has C and is given x, d by S . R accepts or
P · Q to the receiver.
rejects. We denote by R (C, x, d) ∈ {0, 1} its output. Commit(M, T ). The Committer (sender) receives as input
A commitment scheme has two security properties: T = 2k for some k ∈ N that determines the difficulty
• Hiding: For any receiver R which chooses {x0 , x1 } ⊂
of the forced open phase by the receiver, and a message
R M ∈ {0, 1}∗ to commit to.
{0, 1}λ and is given C = Commit (xb ) on xb ← 1) The sender picks h ← Zλ at random
{x0, x1 } and outputs b = 0 or b = 1, it holds that: r n
2) The sender computes g = h(Πi=1 qi ) mod N where
P r R x0 , x1 , 1λ = b − 12 =  (λ) for a negligible .


λ q1 , q2 , .., qr are the first r primes, with a typical setting
• Binding: For any C ∈ {0, 1} there is at most of r being 128.
one x ∈ {0, 1} such that ∀x0 6= x, ∀d0 :
λ
3) The sender sends the receiver h, g and the latter
P r [R(C, x0 , d0 ) = 1] =  (λ) for a negligible . verifies them by computing Q = Πri=1 qiλ and then
Dan Boneh and Moni Naor [15] describe an enhanced g = hQ (mod N )
2k
commitment primitive called a “Timed commitment” that 4) The sender, knowing P, Q computes u = g 2 mod N
k
has a third step: by computing a = 22 mod φ(N ) followed by u =
• Forced Open(C), in which the receiver can invest mod- a
g (mod N ).
erate computation power and time in order to open the 5) The sender hides M ’s bits by XOR-ing them with
commitment C to yield x without any interaction with LSBs of successive roots of u mod N , more formally:
the sender. The number of computation steps required 2k −i

to execute the forced open step is set by the committer Si = Mi ⊕ g 2 mod N where Mi denotes the i-th
as part of the commit step. bit of M . The commitment string is defined as:
We formally define a timed commitment below: C = hS, h, g, ui
Definition 4 (Timed Commitment [15]). A timed com- and is sent to the receiver.
mitment scheme hCommit, Open, F Openi is a triplet of 6) The sender proves that u is constructed properly, mean-
PPT algorithms that satisfy: Given a string x ∈ {0, 1}l , ing that the receiver can indeed open the commitment
a difficulty level k ∈ N, a committer computes a
cryp- in time T by computing repeated squaring modulo N
tographic commitment (C, d) ← Commit x, k, 1λ and 2k
convinces the receiver that C can later be opened without starting from g and until u = g 2 . This is done by
interaction with the committer via m ← F Open (C, k) by constructing the following vector W of length k :
executing 2k serial computation steps 3 , or by having x 
2i 2k

revealed to the receiver via m ← Open (C, x, d). W = g 2 , g 4 , g 16 , g 256 , ..., 22 , ..., g 2 (mod N )
The timed commitment primitive, possesses the addi-
tional following two properties: followed by proving in Zero Knowledge for each i ∈
• Soundness: The committer proves to the verifier that [k] that for each adjacent pair (ai , bi ) ∈ W : (g, ai , bi )
2
the forced open step indeed yields the committed value is of the form (g, g x , g x ) for some x. This protocol,
within the claimed number of computation steps. as well as its proof, can be found in Section B.
• Serial computation: No parallel algorithm can ob-
tain information about the committed string in time Open. Denote |M | as the bit length of M . The sender
2k −|M |
significantly less than it takes to compute successive sends the receiver
r
vλ 0 = h2 and the receiver com-
squarings. In particular, it relies on the Generalized BBS putes v = (v 0 )Πi=1 qi which is the 2|M | ’th root of u (taking
assumption. square roots |M | times from hu yields v ). Nowi the receiver
|M |−i
BBS assumptionE[15] For k ∈ N
Definition 5. Generalized D can compute: [M ]i = [S]i ⊕ v 2 mod N by repeated
R 2k
and g ← ZN , let Wg,k = g 2 , g 4 , ..., g 2 . The element modular squaring starting from v .
2k+1 Forced-Open(C ). In case the sender never opens the com-
g2 is computationally indistinguishable from a random
quadratic residue for any parallel random access machine mitment for the receiver, the receiver can compute (with
whose running time much less than 2k . some effort) the committed value M by first computing
2k −|M |
v = g2 (mod N ) by using 2k −|M | squaring modulo
Aside from the Generalized BBS assumption needed N to obtain v and proceed as in the open step.
for the serial computation constraint, the hiding property
relies on the Quadratic residuosity assumption [13].
3.3. Zero Knowledge Proofs From Secure Multi-
3.2.1. The timed commitment protocol. We next elab- party Computation
orate on the timed commitment protocol as it appears in
We assume the reader is familiar with secret-sharing
[15]. We also include a full proof for the zero-knowledge
based multi-party computation schemes such as GMW
3. The value k for k ∈ N is a difficulty parameter chosen by the [26], namely that multiplication a scalar and addition
committer. can be done by every party as a local computation, but
multiplication, secret share reconstruction and distribution of a time based hash puzzle requires only a single hash
requires communication among parties. invocation on the candidate solution. In addition, a hash
Ishai, Kushilevitz, Ostrovsky and Sahai proved in [30] puzzle takes up minimal storage space in the blockchain.
that Zero Knowledge Proofs can be built from semi-honest Our realization of a time based hash puzzle is via our
MPC protocols in the following manner: Let L ∈ N P Attribute Verifiable Timed Commitment (AVTC) primitive
and RL its corresponding witness relation. Given x ∈ L that enables a sender to commit to a value M and to
and a witness w such that (x, w) ∈ RL and an MPC prove to a receiver that the message M committed to is
protocol that computes RL (x, w) ∈ {0, 1}, one can build a hash pre-image of a specified hash. The receiver can
a zero knowledge proof where the prover proves in zero open the commitment without interaction with the sender
knowledge that indeed x ∈ L as follows: by executing a predefined number of computation steps
1) Let P1 , ..., Pn be n parties. The L
prover splits w into n (where the number of steps is set by the sender). We define
random shares wi such that w = i∈[n] wi and assigns the AVTC time based hash puzzle here, and in Section 5
each party i private input wi . we generalize the AVTC primitive to any functionality.
2) The prover simulates the MPC protocol for all n parties
“in the head” and maintains records of views and Definition 6. AVTC Timed Based Hash Puzzle Let λ
message transmissions for all parties. be a security parameter and H be a cryptographic hash
3) The prover commits to the views and message trans- function. An AVTC time based hash puzzle is defined by
missions using a statistically binding commitment and four operations:
sends them to the verifier. 1) P ub, P riv ← Setup(1λ ): The sender obtains private
4) The verifier randomly asks the prover to reveal the parameter P riv , both sender and receiver obtain P ub.
commitments for a subset of the parties. 2) (C, y, π) ← Commit(P riv, T, M ): Given the setup’s
5) The prover complies and reveals the requested infor- private parameters, a difficulty level T and a message
mation. M , the sender produces a commitment C , a string y =
6) The verifier validates the commitments revealed and H (M ) and a proof π that y = H(M ).
checks the consistency of the views and message trans- 3) M ← Open(C, P ub): The sender reveals the message
missions, and accepts or rejects accordingly. M to the receiver.
This result has a strong implication: Given (x, w) ∈ RL , 4) M ← F orceOpen(C, P ub): The receiver reveals the
the construction of a multiparty protocol where w is secret message M without interaction with the receiver, by
shared among the parties and the circuit checks whether investing T computation steps.
(x, w) ∈ RL is a scheme to construct a zero knowledge
proof for membership in L.
Security model and assumptions. We model the world
4. Cross Chain Atomic Swaps in the Absence as an interaction between two mutually distrusting and
of Time potentially malicious parties. Each party has an incentive
to deceive the counter-party and has no repercussion if
We describe a novel protocol for cross chain atomic caught cheating. We further assume that a party cannot
swaps that utilizes our Attribute Verifiable Timed Com- deny the counter-party from transacting on the blockchain
mitment (AVTC) primitive. Unlike the state of the art, our indefinitely, but only for a certain known time period. We
protocol operates without blockchain derived time. make the standard requirement that our cryptographic hash
Our protocol’s main difference from the standard cross function is pre-image resistant [41]. We assume the parties
chain atomic swap described in the literature in Section are probabilistic polynomial time Turing machines.
3.1 is that we have each party give the other party a hash
puzzle that can be opened in a timely manner. Each party,
4.2. The Cross Chain Atomic Swap Protocol
escrows its funds in a way that reclaims the funds back
to the party only if the hash puzzle solution is revealed.
By changing the reclamation condition to a hash veri- We lay out our protocol by describing an interaction
fication, we also give the parties a way to immediately between two parties: Alice and Bob, where Alice pays
reclaim their funds in escrow. While it is possible to Bob a fee sum on blockchain BCA in exchange for Bob
construct a condition with the state of the art’s HTLC paying Alice sum on BCB . The protocol consists of two
based swap, it would require adding a multi-signature phases:
condition to the script which would take more space and 1) Prepare: Puts transactions on the blockchains in
computation overhead, hence will increase the cost of preparation for the swap.
using such a transaction. 2) Either Swap: Transact on both blockchains for each
party to claim its payment, or Withdraw: Cancel the
4.1. AVTC as a Time Based Hash Puzzle swap and have each party reclaim the escrow.
Notations: We next elaborate on each of these steps.
Consider a puzzle encoded as a string y so that to solve Let λ be a security parameter and T = 2d be a difficulty
it, one needs to find a hash pre-image x such that y = level, typically d ∈ [30, 50]. We denote appending transac-
H(x) where H is a cryptographic hash function. A time tion X to blockchain BCA as BCA X . We denote Alice
m
based hash puzzle is a puzzle that has an additional way sending a message m to Bob as A → B and similarly,
m
of finding the pre-image x, and this way requires a certain Bob sending m to Alice as B → A. For succinctness,
number of computation steps. Indeed, a time based hash we omit specifying P ub and P riv produced in the Setup
puzzle would fit our needs perfectly: Verifying a solution phase.
Prepare. In steps 1-2 in the prepare phase (depicted in
Figure 1), Alice produces a timed commitment CA for a Prepare
uniformly random hash pre-image a, and sends the other
R
party (Bob) CA and the hash A = H (a) along with proof 1: Bob: b ← {0, 1}λ , B = H(b),
that A = H (F orceOpen (CA )). The proofs are verified (CB , πB ) = Commit (b, T + ∆) , B
(B,CB ,πB )
→ A
by both parties in step 3, and each party aborts the protocol R
if the proof verification fails. Then, in step 4 Alice initiates 2: Alice: a ← {0, 1}λ , A = H(a),
(A,CA ,πA )
the HTLC by selecting a uniformly random secret x and (CA , πA ) = Commit (a, T ) , A → B
publishing its hash y in step 5 on BCA by publishing a 3: Alice: Verify πB ; Bob: Verify πA
transaction that guarantees: R
4: Alice: x ← {0, 1}λ , y = H(x)
1) If Bob appends a transaction that reveals H−1 (y) 5: Alice: BCA hB, y, sumi
before Alice appends a transaction that reveals b0 ∈ 6: Bob: BCB hA, y, sumi
H−1 (B) then Bob claims sum to itself on BCA .
2) If Bob hadn’t appended a transaction that reveals
H−1 (y) and Alice appended a transaction that revealed Swap
b0 ∈ H−1 (B) then Alice claims back sum on BCA . 1: Alice: BCB hxi
Finally, in step 6, Bob finishes the prepare step by 2: Bob: BCA hxi
appending a transaction on BCB which guarantees:
1) If Alice appends a transaction which reveals H−1 (y)
before Bob appends a transaction which reveals a0 ∈ Withdraw(cooperative)
H−1 (A), then Alice claims sum to herself on BCB . a
2) If Alice did not append a transaction which revealed 1: Alice: A → B
H−1 (y) and Bob appended a transaction which re- 2: Bob: BCB hai
b
vealed a0 ∈ H−1 (A), then Bob claims back sum on 3: Bob: B → A
BCB . 4: Alice: BCA hbi
Swap. Alice appends a transaction to BCB which reveals
x and thus claims sum from Bob, just as done in HTLC. WithdrawAlice (non-cooperative)
Bob, having now seen x s.t x ∈ H −1 (y), appends a
transaction that reveals x to BCA and thus claims sum 1: Alice: b ← F orceOpen (CB )
from Alice. 2: Alice: BCA hbi

Withdraw. As in the standard HTLC based cross chain

swap, since Alice initiated the swap she sampled x (line 4 WithdrawBob (non-cooperative)
in Prepare) and therefore in order to withdraw from the
swap, Alice must not commence the Swap phase. 1: Bob: a ← F orceOpen (CA )
The withdraw procedure can be cooperative where the 2: Bob: BCB hai
parties exchange information, or non-cooperative where
no information exchange takes place.
Figure 1: The phases of our cross chain atomic swap
Cooperative withdraw. If one of the parties decides to (and Bob) put their hash puzzles (lines 5-6 in Prepare)
abort the swap, first Alice reveals a to Bob and then on blockchain A (and B ), Bob cannot race Alice and
Bob reveals b to Alice. Each of the parties can reclaim forcefully open a and withdraw his funds in escrow on
its escrow funds by transacting on its blockchain and blockchain B before Alice’s swap transaction (line 1 in
revealing the pre-image a or b. Swap) is confirmed on blockchain B . Otherwise, once
Alice releases the swap transaction that reveals x in her
Non-cooperative withdraw. If either party wants to attempt to claim Bob’s funds in escrow on blockchain
withdraw the funds in escrow without consent from the B , Bob can claim Alice’s tokens on blockchain A while
counter-party, it needs to recover b (for Alice) or a (for preventing Alice from claiming his funds on blockchain
Bob) by computing sequentially for a time period that is B . Similarly, if ∆ in the difficulty level T +∆ is too small,
T + ∆ for Alice, and T for Bob. if the swap wouldn’t end up taking place and Bob will try
to withdraw his funds in escrow, Alice might forcefully
Realistic parameter selection. The difficulty level T recover b and reclaim her funds in escrow on blockchain A
that Commit is executed with corresponds to some se- and race Bob’s withdraw transaction.To guarantee Bob has
rial execution time. Setting T = 230 amounts to ∼ 20 enough time for his withdraw transaction to be confirmed
minutes on a modern Intel i7 CPU. The execution time on blockchain B , ∆ should be large enough.
of F orceOpen should be carefully picked according to
transaction confirmation time and its correlated probability Safety boundaries in a mutually distrusted setting.
of transaction reversal [23]. If the confirmation time is Whether the swap ends up taking place or not, it is
lower than the time it takes to compute F orceOpen then possible to safely execute our protocol without having to
the safety of our protocol is impaired execute F orceOpen. We show that by setting ∆ > T
The difficulty level T of the time based hash puz- and showing a schedule where none of the parties exe-
zle should be large enough so that after both Alice cute the F orceOpen and argue why the safety property
 (Definition 1) is preserved. with parallel computation. We show in Section F that
0: Bob and Alice execute steps 1-3 in Prepare (nothing having 128 bits of pre-image prefix thwarts even an adver-
is written on chain yet) sary with hashing power equivalent to the entire Bitcoin
∆ ∆
2 If Alice’s steps 4 and 5 in Prepare occur later than 2
: network.
then Bob refuses to proceed to step 6 in Prepare and
Alice never claims his funds.
3T 3T 5. Attribute Verifiable Timed Commitment
4 : If Bob’s step 6 in Prepare occurs later than 4 then
Alice refuses to proceed to Swap and Bob never claims
her funds. Else, Alice proceeds to step 1 in Swap Recall, the timed commitment scheme of Boneh and
and claims Bob’s funds before time T (where he can Naor (Section 3.2) allows Alice to commit to a secret, and
reclaim them). to prove to Bob that the commitment can be opened by
T : If Alice and Bob decide to withdraw, then as per performing a certain amount of computation.
step 1 in Withdraw(cooperative), Alice gives Bob In this section, we show a novel cryptographic primi-
a first. If Alice fails to do so before time T then tive that allows Alice to prove to Bob arbitrary attributes
Bob can start executing Withdraw(non-cooperative) of the secret in zero knowledge. That is, the committer
which ends before T + ∆ (since ∆ > T ), hence if (Alice) plays the role of a prover, and the receiver (Bob)
Alice chooses to perform Swap during that time, she of a verifier. When enhancing the timed commitment
cannot also withdraw her funds in escrow. with our cryptographic primitive, the receiver accepts the
commitment only if the secret committed to possesses
4.3. Cross Chain Atomic Swap Protocol Analysis attributes agreed by both parties. Hereupon we denote
our novel primitive AV T C which stands for Attribute
We prove that our protocol satisfies the safety and Verifiable Timed Commitment.
liveness properties from the preliminaries: In Section 5.1 we formally define what the AVTC
Theorem 7 (Safety). Either both parties claim each oth- primitive entails. Then in Sections 5.2 and 5.3 we dive into
ers’ funds, or no party claims the counter-party’s funds. the construction of the components of the AVTC primi-
Proof. Assume in contradiction that one of the parties tive and analyze its security. In Section 5.4 we discuss
claims the counter-party’s funds, and split to cases: evaluation of our publicly available implementation.
1) Alice claims Bobs’ funds: Claiming Bob’s funds in-
volves in revealing H −1 (y) to Bob. If Bob couldn’t 5.1. Definition of AVTC
claim Alice’s funds on BCA then it is due to Alice
forcefully opening Bob’s timed commitment to obtain In this section we give our definition for the AVTC
b, however she needs twice the time than Bob to open primitive. The Timed Commitment satisfies both the hid-
his commitment to b, hence Bob had sufficient time to ing and binding properties of a cryptographic commitment
open Alice’s commitment to a and reclaim back his scheme (see Section 3.2 in preliminaries), with the excep-
funds, preventing Alice from claiming his funds ⇒ in tion that it holds only for adversaries limited in the number
contradiction to Alice claiming Bob’s funds. of their execution steps to be 2k .
2) Bob claims Alice’s funds: To claim Alice’s funds, Definition 9 (Values that satisfy F ). Let F : {0, 1}∗ →
Bob has to see H −1 (y) which is only revealed by {0, 1} be a predicate. We define the language which
Alice as part of her claiming Bob’s funds. If Alice informally means ”all values which satisfy F ” as LF =
reveals H −1 (y) early enough (before Bob has time {x F (x) = 1}.
to forcefully open Alice’s commitment and extract a) An AVTC for a predicate LF is a timed commitment
then it is too late because Alice already claimed his augmented with a zero knowledge proof that the commit-
funds. ted value satisfies F
Definition 10 (Attribute Verifiable Timed Commitment
Theorem 8 (Liveness). No asset of some party is forever
(AVTC) for F ). Let F : {0, 1}∗ → {0, 1} be a
locked in escrow.
predicate. An AVTC for LF is a triplet of algorithms:
Proof. Either no party aborts, and then the swap com-
hCommit, Open, F Openi that are as in the Timed Com-
pletes, or some party aborts. If some party aborts, then
mitment (Definition 4), but with an enhanced Commit op-
both parties can reclaim their funds in escrow after a
eration that also
guarantees that given a commitment C ←
period of time: If Alice decides to abort after the prepare
Commit x, 1λ accepted by the receiver, it holds that
phase, then she can open her commitment to reveal a to
x ∈ LF . Denote the probability that the receiver R accepts
Bob which makes him reclaim his funds in escrow, after
that C commits to x ∈ LF as P r [hS (x) , R (C)i = 1]. Let
which Bob can reveal b to Alice to make her reclaim her
λ be a security parameter and  be a negligible function,
funds as well. In any case if any of the parties refuses to S
and denote V iewR (C) the view of the receiver with input
reveal the commitment, the counter-party can forcefully
C engaging with the sender. The following properties hold:
open it by investing a moderate computation time and
• Completeness: Let x ∈ LF . Then:
thus reclaim back the funds in escrow.
P r [hS (x) , R (C)i = 1] = 1.
4.3.1. Calculating the Commitment String Length. • Soundness: Let x ∈ / LF . Then:
An important question that comes to mind, is, how long ∃ s.t: P r [hS (x) , R (C)i = 1] < (λ).
should be the hash pre-image prefix committed to by the • Zero Knowledge: For every receiver R: ∃ PPT simula-
S M
AVTC primitive? However, a hash can be brute-forced tor M such that ∀x ∈ LF : V iewR (C) ≡s V iewR (C).
 Algorithm 1: Validating (x, w) ∈ RL
5.2. AVTC Construction Overview √
l+1
Input: Witness w = 2 u
We prove the following theorem: 1: x = {}
// Initial squaring to ensure z ∈ QRN
Theorem 11 (AVTC). For every predicate F : {0, 1}∗ → 2: z = w 2 (mod N )
{0, 1}, there exists an AV T C scheme for LF as defined // Concatenate XOR of LSBs
in Definition 10. 3: for i=0 to l − 1 do
To prove the theorem, we first give a high level 4: x = x|| (z0 ⊕ Si )
overview of the AVTC construction. Then, in the follow- 5: z = z 2 (mod N )
ing sections, we deep dive into its components and analyze 6: end for
them. 7: if F(x) = 1 ∧ z = u then
8: Accept
9: else
5.2.1. AVTC Protocol. Our starting point for AVTC is the
timed commitment primitive of Boneh and Naor (Section 10: Reject
11: end if
3.2). We extend its construction to an AVTC by augment-
ing it with a zero knowledge proof for a predicate F of Algorithm 1: Lines 3-6 in correspond to (a) which opens
the committed value. the commitment C = hS, h, g, ui where line 7 ensures
A timed commitment C of a secret x ∈ {0, 1}l is of that successive squaring results in u. As a by-product of
R
the form C = hS, h, g, ui where: h ← ZN , g is determin- opening the commitment we obtain x and in line 7, F is
k
istically computed 4 from h and u = 22 (mod N ), and applied on x to prove (b)
the string S = S1 , ..., Sl is defined as:
 k 
22 −i
Si = xi ⊕ LSB g (mod N )

Our protocol involves three proofs:

1) Proving that N is a product of two Blum primes 5 . In
Section 5.3.1 it is explained why we enforce a special
requirement on the modulus N .
2k
2) Proving that u = g 2 (mod N ), which convinces
the receiver that it can open the commitment without
interaction with the sender within the desired number
of computation steps.
3) Proving that C opens to x s.t F (x) = 1.
In order to prove (1), we employ the scheme of
Goldberg et al [25] which yields a non-interactive zero-
knowledge proof for a Blum integer. It can be done in
a one time setup phase before the AVTC protocol takes
place, and the non-interactive proof can be published on Figure 2: A simple AVTC circuit that verifies an attribute
a public bulletin board or on the blockchain. F on a 3-bit sized message m with a commitment string
Our protocol for (2) follows the technique of Boneh s. Values in blue are secret input, while values in yellow
and Naor as mentioned in Section 3.2 and is found in the are public input.
appendix in Section 4 along with a complete proof.
5.2.2. Proving C Opens To x Such That F (x) = 1. The
In order to prove (3), we prove the following two
starting point for our zero knowledge proof that (a), (b)
statements in zero knowledge: 6
hold is Algorithm 1 that verifies (a), (b) when x is given
(a) ∀i ∈ {1, ..., l} : 
√
2i
 as secret input to the prover, and C is given to both the
2l+1
xi ⊕ Si = LSB u (mod N ) prover and verifier. Afterwards, we translate Algorithm
1 to an MPC-friendly algorithm by identifying how each
(b) F (x1 ||x2 ||...||xl ) = 1
step in Algorithm 1 can be computed efficiently. Lastly,
Our construction for both (a) and (b) is done as a we build a circuit that will be used to produce a zero-
single zero-knowledge proof that is based on the MPC- knowledge proof using the ”MPC in the head” framework.
in-the-head technique of [30].
In the rest of this subsection we give a high level 5.2.3. Circuit Building Blocks and Configuration. We
overview of the construction of the zero-knowledge proof construct a layered circuit (seen in Figure 2) which is
for (a) and (b). Then, in Section 5.3 we elaborate all sub- comprised of three main building blocks:
protocols we employ in a top-down manner. • Squaring modulo N
• LSB extraction
4. We refer the reader to Section3.2 in the
 preliminaries, and specifi-
Π128 q λ • Field converstion and computation of F
cally remind the reader that g = h i=1 i (mod N ) where {qi }ri=1
are the first r primes and λ is a security parameter.
Our circuit executes the open phase of the timed
5. A Blum prime is a prime such that P ≡ 3 (mod 4) commitment by successively squaring (modulo N ) secret
6. We denote || as the concatenation operation, and for X ∈ {0, 1}∗ shares until a public value u is reached (line 7 in Algo-
we denote Xi as the i’th bit of X rithm 1). Each step involves extracting the LSB (while
secret-shared) and feeding it into another black-box circuit F on x. To prevent the prover from equivocating by sup-
which computes the desired attribute F (as seen in Figure plying a different root than of what was used to compute
2). We choose an arithmetic circuit over a prime field the commitment string C , the timed commitment technique
p and require that p > N 2 + n · 2µ for some security of Boneh and Naor entails the sender sending the receiver
2k −|x|
parameter µ (i.e µ = 100) and number of parties n. 7 v 0 = h2 and
r λ
the receiver computing v = (v 0 )Πi=1 qi
In case F is most efficiently computed using a boolean √
|x|
which yields 2 u, which is then successively squared to
circuit, we also perform share conversion from arithmetic obtain the bits of x.
shares to boolean shares. Proving integrity of the exponentiation of v 0 by
Πi=1 qiλ in a cicruit is quite expensive, as the current
r
5.2.4. Squaring Modulo N . We devise Algorithm 2 state of the art [19] utilizes bit decomposition which is
which verifies that two secret shared values [a] and [b] computationally expensive. Therefore, we would like to
are congruent modulo N by verifying that the equality side-step it while retaining binding to the committed value.
[a] = [b] + [t] · N holds, for some t < N . Since the equal- To that end, we seek out a method that allows the sender
ity needs to hold modulo N but the circuit’s arithmetic of the commitment to convince the receiver that there is
operations are modulo p we require that p > N 2 . a single 2|x| root of u without proving integrity of the
expensive exponentiation over v 0 which is done in the
5.2.5. LSB Extraction. Each squaring and modulo re- Open phase in the original paper of Boneh and Naor [15].
duction step in the layered circuit is followed by LSB We leverage the fact that our modulus N is a product
extraction which is then XOR-ed and fed to a component of two Blum primes, 8 and also prove to the verifier using
that computes F . Our novel technique for LSB extraction the scheme of Goldberg et al [25] that it is indeed the
is shown in Section 5.3.5. case. We mention the following theorem which will help
us prove that the committer can only prove F(x) = 1 for
5.2.6. Computation of F . Once we have extracted each the same x that the timed commitment committed to.
bit of the committed message x, we forward it into a
Theorem 12. Let N be the product of two Blum integers,
component which validates that F (x) = 1. However,
and let a ∈ QRN . Then a has exactly one square root in
this component might often be implemented as a circuit
QRN .
in a different field, such as a boolean circuit. To that
end, we shall convert our arithmetic shares of bits into Proof. Theorem 9 in [13].
boolean shares via Algorithm 6 which is based on the √
|x|+1
share conversion technique of [20]. Let w = 2 u (mod N ) be a witness used in our
zero knowledge proof for which we prove that succes-
5.2.7. Construction Overview Summary. The AVTC sively squaring and reduction modulo N starting from
protocol builds on top of Boneh and Naor’s timed com- w yields u. Indeed, the intermediate value in our zero
mitment scheme [15] and its main distinguishing part is a knowledge proof that is obtained √ after taking w and
|x|
zero-knowledge proof that the commitment is opened to squaring it (modulo N ) once is 2 u, which is clearly in
a value that satisfies the predicate. We use the MPC-in- QRN , hence (by Theorem 12) there is a single 2|x| root
the-head technique of Ishai et al. [30] which we bootstrap of u. As we shall see next, the binding
√ property easily
|x|
with an MPC protocol in the semi-honest setting. follows from the uniqueness of 2 u:
√
|x|+1
In the next subsection, we will deep dive into each Corollary 13. Let u ∈ QRN , w = 2 u (mod N ).
of the components of the aforementioned MPC protocol,  2i |x|+1
The series w (mod N ) ∈ QRN i=1 is unique.
discuss our design choices and analyze our scheme.
Proof. By construction, every element in the series is
5.3. AVTC Component Design in QRN , therefore by Theorem 12, for 1 ≤ i ≤ |x|
i
In this section we explain in detail our AVTC con- every such element w2 is a unique square root of another
2i+1
struction, namely its low level building blocks, and give element w also in QRN where for i = |x| + 1 we get
reasoning behind each design choice. We first describe in u itself.
our design choice for efficiently opening the timed
commitment in the arithemtic circuit while retaining the Hence, the√witness to the zero knowledge proof is go-
|x|+1

binding property. Then, we dive into the details of the ing to be 2 u, and the prover will prove that repeated
design of the circuit’s subcomponents and analyze them. squaring modulo N starting from the witness, reaches u
in |x| + 1 iterations.
5.3.1. Opening a Timed Commitment with a Circuit.
5.3.2. Squaring and Modulo Reduction. Reducing a
We recall the timed commitment (Section 3.2) encoding:
2k secret shared number modulo N is an expensive oper-
C = hS, h, g, ui where u = g 2 (mod N ) for a difficulty ation because it either requires bit decomposition [36]
r λ
parameter k , and g = hΠi=1 qi where qi are all primes (decomposing the number to shares of bits), or employing
less than some upper bound r. We wish to prove that the schemes that require random bitwise sharing [35]. Both bit
secret x that we commit to, indeed satisfies F (x) = 1. decomposition and bitwise sharing in a field big enough to
A straightforward way of achieving this, is to execute contain our modulus N means thousands of shares each
the Open phase of timed commitment in our arithmetic thousands bits in size. We sidestep this inefficiency by
circuit, extract the committed value x, and then compute recalling that our circuit only needs to validate the
7. In Section 5.3.5 we show why p > N 2 + n · 2µ is required 8. A Blum prime is a prime such that P ≡ 3 (mod 4)
Algorithm 2: SquareModNExtractLSB Algorithm 3: VerifyLowerThan
Input: [xi ] (from previous hlayer) and pre-computed: Input: [v] , u
x2 −(x2i % N )
i
Output: 1 if v < u, otherwise aborts
 
I1 = x2i % N , I2 = i N
  
 1: a = LessT hanHalf Order ([v])
Output: x2i % N (to next layer), LSB x2i % N to 2: if a 6= 1 then
sub-circuit which computes F . 3: abort
1: [a] = [xi ] · [xi ]   4: end if
2: [b] = I1 // hx2i % N pre-computed 5: [w] = p − [v]
2 2
i
x −(xi % N )
3: [t] = I2 // i N pre-computed 6: [x] = [w] + u
4: [y] = [a] − [b] − [t] · N 7: b = LessT hanHalf Order ([x])
5: y = Reveal([y]) 8: if b 6= 1 then
6: if y 6= 0 then 9: abort
7: abort 10: end if
8: end if 11: return 1
9: z = V erif yLowerT han ([b] , N )

10: w = V erif yLowerT han [a] , N 2
11: u = LessT hanHalf Order ([t] · N )
Algorithm 4: LessThanHalfOrder
12: if z · w · u 6= 1 then Input: [v]
13: abort Output: 1 if v < p2 , otherwise aborts
14: end if 1: [w] ← 2 · [v]
15: [b0 ] = ComputeLSB ([b]) 2: [b] ←ComputeLSB ([w])
16: Forward [b] to next level 3: b ← Reveal ([b])
17: Forward [b0 ] towards computation of F 4: if b 6= 0 then
5: abort
6: end if
computation, and the prover is free to pre-compute all
7: return 1
intermediate values of the computation and feed them into
the circuit as secret shared inputs.
Specifically, instead of computing a mod N , the a < N 2 , then a < p as well. Therefore, both sides of
prover pre-computes b (denoted as I1 in Algorithm 2) the equality do not overflow p and (F) holds over N,
and t (denoted as I2 in Algorithm 2) such that it holds meaning that without loss of generality, b > b0 and t0 > t.
that: b = a − t · N , and both b and t are given as input to It follows that t0 − t ≥ 1, thus b − b0 > N ⇒ b > N in
the parties, which verify that the equality [a] = [b]+[t]·N contradiction to the fact that b < N .
holds. 5.3.3. Validating Lower-Than. We give a novel and effi-
At a first glance, validating that [a] = [b] + [t] · N cient construction to a secure Multi-Party protocol which
seems trivial. However, the hardness lies in ensuring that validates that a secretly shared value is lower than a public
a cheating prover doesn’t secret share b, t that satisfy the value. Our protocol doesn’t doesn’t require edaBits like
condition but make the computation secretly overflow the the recent work of [32] and unlike the aforementioned
field p of the circuit. By initializing the secret shared state of the art, has constant rounds. The protocol uses
values b, t with numbers that overflow the finite field p, a Algorithm 4 in a black box manner for validating that
cheating prover may manipulate the LSBs extracted from a secret shared value is less than p2 . The protocol and
each layer in the circuit and make the verifier think that Algorithm 4 both draw on the ideas from [18] and [37].
a committed value has an attribute that it doesn’t posses. The protocol (Algorithm 3) receives as input a secret
Therefore, we additionally make Algorithm 2 ensure that: shared value [v] and a public constant u < p2 and returns
1) b < N 1 if and only if [v] < u, otherwise aborts.We prove its
2) a < N 2 correctness:
3) t · N < p2
Ensuring (1), (2) is done via Algorithm 3 and ensuring Lemma 15. For every u < p2 , Algorithm 3 returns 1 if it
(3) is done via Algorithm 4, where both are comparison is input with [u] < u, otherwise it aborts.
algorithms and are possible to be computed efficiently Proof. Algorithm 3 checks if [v] > p2 . If so, then v > u,
thanks to our novel LSB extraction algorithm. therefore it aborts. Otherwise, both v and u are smaller
Algorithm 2’s correctness immediately follows from than p2 , therefore (F) v > u ⇔ u − v (mod p) > p2 . In
the following lemma: lines 5 − 6 we compute [x] = u − [v] (mod p) and then
Lemma 14. For an equality a = b + t · N where check if it’s less than p2 (line 7). If it is the case, then it
{a, b, t, N } ⊂ Zp for p > 4 and N 2 < p, if b < N , follows from (F) that v < u.
a < N 2 and [t] · N < p2 then there is a single b that
5.3.4. Validating that a value is less than p2 . We show
satisfies the equality.
how to validate that [v] < p2 . The protocol relies on the
Proof. Assume in contradiction there are b, b0 , t, t0 that fact that if v < 12 p then multiplying it by 2 yields a
satisfy the equality, i.e a = b + t · N and a = b0 + t0 · N . number that is less than p, and then there is no wrap-
Then it holds that b + t · N = b0 + t0 · N , thus we
√
get: around p and the LSB of the result becomes 0 for an odd
(F) b−b0 = N ·(t0 − t). Since N 2 < p, so N < p < p2 , p. The protocol is shown in Algorithm 4 and uses the
therefore b < N < p2 and thus b + t · N < p. And since ComputeLSB protocol.
 smaller than the field size. Our protocol immediately leads
to constant round efficient comparison validation protocols
in arithmetic circuits and do not require bit decomposition
or binary share assisted schemes.
Notations: We denote [x] to be a secret sharing
of x among n parties. When referring to an operation
done by  every party, we shall
denote ∀i ∈ [n]. Let
S = 2 · α α ∈ 0, 2|N |+µ−1 : be the set of legal
blinded plaintext shares in our algorithm.
The technique: For simplicity, we first describe the
technique for a semi-honest 1-secure setting (which as-
sumes parties do not collude), as shown in Figure 3. A
modification to a semi-honest k-secure case, where parties
may collude appears later on. In the offline phase, the
prover first represents v as a sum of an even number a
and the LSB of v denoted by b: v = a+b (line 1). Then, it
splits a into n shares a(1) +a(2) +...+a(n) < p and it splits
Figure 3: The prover secret-shares v into plaintext shares b into bits such that: b(1) ⊕b(2) ⊕...⊕b(n) (line 2). Finally,
and then blinds each share with a blinding factor given to it statistically hides each share a(i) with an even uniformly
one of the remaining two parties (1-secure MPC). R
random variable r(i) ← {2 · x x ∈ (0, 2|N |+µ−1 )}
(line 3) where |N | is the number of bits in N , n is the
Algorithm 5: ComputeLSB Algorithm number of parties and µ is a security parameter such that
Input: [v] p > N 2 + n · 2µ . Similarly, it blinds each share b(i) with a
Output: [v0 ], the LSB of v random bit e(i) . The prover sets each party i’s input (line
Offline phase (performed by the prover): 4) to be the following plaintext shares: a(i) + r(i) ; r(i+1) ;
1: Set a = v − v0 and b = v0 b(i) ⊕ e(i) ; e(i+1) .
2: Set a = a(1) + a(2) + ... + a(n) where ∀i : a(i) is even, For a k-secure MPC protocol, each share a(i) is
and set b = b(1) ⊕ b(2) ⊕ ... ⊕ b(n) blinded with k blinding factors, e.g in a 2-secure MPC
3: ∀i ∈ [n] : protocol with 3 parties, the share a(1) is blinded with r(1,2)
R R
r(i) ← {2 · x x ∈ (0, 2|N |+µ−1 )}; e(i) ← {0, 1} which is given to party 2 and with r(1,3) which is given
4: ∀i ∈ [n] :
to party 3.
Give party i :< a(i) + r(i) ; r(i+1) ; b(i) ⊕ e(i) ; e(i+1) > In the online phase, each party verifies that its
plaintext share is in the appropriate range (line 5) and
Online phase (performed by the blinding factor for a(i) is even, and secret shares

the simulated parties): the blinded share and the blinding factor among all
5: ∀i ∈ [n] : If  a(i) + r(i)
, r(i+1) 6⊆ S, abort
6: ∀i ∈ [n] : If b(i) ⊕e(i) , e(i+1) 6⊆ {0, 1} abort
parties
 (i) (lines   7-10),
 after which
  the parties compute
a + r(i) , ri+1 , bi ⊕ e(i) , ei+1 and finally ex-
7: ∀i ∈ [n] : a(i) + r(i) = SecretShare a(i) + r(i)
tract the sharings of the LSB (line 11) after which they
 
jointly validate the plaintext shares given to them in the
8: ∀i ∈ [n] : r(i+1) = SecretShare r(i+1)
offline phase (lines 12-15).
9: ∀i ∈ [n] : b(i) ⊕ e(i) = SecretShare
b(i) ⊕ e(i)
10: ∀i ∈ [n]L: e(i) = SecretShare (i)
 Ln e (i) 
n (i) (i) 5.3.6. LSB extraction security proof. We formally prove
11: [v0 ] = i=1 Pnb ⊕ e ⊕  i=1P e  
n the correctness and privacy of the LSB extraction protocol.
12: [z] = [v] − i=1 a(i) + r(i) + i=1 r(i) − [v0 ] We give three theorems and prove them in Section D. For
13: z = Reconstruct ([z]) simplicity of notation, we set the number of parties to be
14: if z 6= 0 then three.
15: abort
16: end if Definition 16 (ComputeLSB protocol). Let → −
x =
17: return [v0 ] (x0 , x1 , x2 ) be shares distributed by a dealer and define
3 3
the LSB extraction functionality f : (Zp ) → (Zp ) where
→
−
fi ( x ) is the output of party i, and let π to be the LSB
5.3.5. Extracting the LSB of a Secret Shared Value. extracton protocol (Algorithm 5) and V IEWiπ (→ −
x ) the
We describe our novel protocol LSB extraction protocol view of party i during the execution of π .
shown in (Algorithm 5). The protocol extracts the LSB
of a secret shared value v and is suited to the MPC in Theorem 17 (LSB extraction completeness). On input [v]
the head setting where a prover, knowing v , can act as a with an honest dealer, ComputeLSB outputs [v0 ] (secret
dealer and distribute shares in an offline phase before the shares of the LSB of v ) and never aborts.
online phase takes place among the parties. At the end Theorem 18 (LSB extraction privacy). There exists a PPT
of the online phase, parties obtain a secret sharing of the S such that for a single party j ∈ {0, 1, 2}:
LSB of v , [v0 ].  semi-honest
{S (xj , fj (→
−
x ))} ≡s V IEWjπ (→
−
x)
Our contribution: We construct a novel constant-
round protocol for LSB extraction of a secret shared value Theorem 19 (LSB extraction soundness). ComputeLSB
that is claimed (but not known, as in [18], [40]) to be always either aborts or correctly extracts [v0 ].
Algorithm 6: BooleanizeLSB
Prover Verifier
Input: [v0 ]
Round 1
Output: [v0 ]B
R
  
p {ij∈[λ] ← {0,1,2}}
1: ∀i ∈ [n] : [ri ] = SecretShare Rand n+1
2: ∀i ∈ [n]L: [bi ]B = SecretShare ([ri % 2]) {C (ij )}j∈[λ]
3: [b]B =
P i∈[n] [bi ]B Round 2
4: [r] = i∈[n] [ri ] {Vj ← F(s)}j∈[λ]
5: [x] = [r] + [v0 ]
6: x = Reconstruct ([x]) {C (v)}v∈Vj , j∈[λ]
7: [v0 ]B = LSB(x) ⊕ [b]B Round 3
{ij }j∈[λ]
Combining the three theorems above yields that an Round 4
honest prover distributes plaintext shares in a fashion that {vi , vi0 ∈ Vj }j∈[λ]
ensures that the verifier always accepts, and the output to Verify:
the next gate in the circuit is indeed the LSB of the secret
shared input value. (*) Commitments
Additionally, the protocol achieves statistical zero (**) views
knowledge, since the view of every single semi-honest
party participating in the protocol is statistically indistin- Figure 4: The MPC in the head interactive protocol
guishable from the simulated view. the OLE oracle O to compute blinded products of each
Lastly, if the dealer is dishonest, the MPC protocol of party’s inputs:
the LSB extraction always aborts. It immediately follows 1) Every party i samples a random value ri,j ∈ Zp for
that the LSB extraction protocol does not degrade the each party j 6= i and sends the share xi and ri,j to O.
soundness of the zero knowledge proof, as the probability 2) party j sends to O the share yj
of a cheating prover to commit to an incorrect protocol 3) The OLE oracle O sends party j si,j = xi · yj + ri,j .
execution does not depent on whether it entails an LSB Afterwards, [z] is defined by having the blinding fac-
extraction or not. Pn sent by party i, subtracted: zi = xi + yi +
tors
j=1,j6=i (sj,i − ri,j ). When simulating O, the prover
commits to the inputs and outputs of O. When verifying
5.3.7. Conversions between different fields. After ex- the multiplication gate, the prover reveals two views to
tracting the LSB of each layer in our circuit, we show the verifier, and the latter verifies they are consistent with
in Algorithm 6 how to convert it from a sharing modulo the commitments. Note, that since we employ a 2-secure
p to the domain of the predicate F . Since our predicate GMW, the prover reveals to the verifier the views of two
of choice in our cross chain swap protocol (Section 4) out of the three parties. Thus, we only need to reveal
is SHA256 comparison, we explain how we convert the the de-commitment of the party which its view is not
arithmetic sharing to a boolean sharing, and denote the revealed, as the verifier can compute the expected de-
shares in the target domain as [·]B . Our technique follows commitments of the rest of the parties. This saves us sig-
[20], and its main idea is to produce masking factors in nificant bandwidth, as our de-commitments are elements
both the arithmetic domain and the boolean domain such in Zp and have thousands of bits each. In each iteration,
that the LSB of both masking factors is identical (lines the verifier opens two out of the three views committed
1-2). Then, the masking factor in the arithmetic domain, by the prover, therefore the probability of the
verifier
masking the secret shared LSB (line 5), is revealed (line λ
6) and the LSB is used to cancel out the mask in the accepting an incorrect proof with λ rounds is 31 . Since
arithmetic domain (line 7). our zero-knowledge protocol is interactive, k doesn’t need
to be large, as in the honest-verifier non-interactive zero-
knowledge, because the prover cannot use computation to
5.3.8. Instantiating the MPC Protocol To Be Used In predict the verifier’s challenge.
The ”MPC In The Head” Framework. We instantiate an
MPC protocol using a semi-honest 2-secure9 GMW [26] 5.3.9. Obtaining Zero-Knowledge From MPC. We de-
where the arithmetic part of our circuit uses an arithmetic scribe an interactive protocol (Figure 4) between the
GMW, and the boolean part of our circuit for computing sender of the commitment, playing as the prover, and the
F uses a boolean GMW. Our conversion from an MPC receiver of the commitment, playing as the verifier. Denote
protocol to a zero-knowledge proof using the ”MPC in vi as the view of party i ∈ {0, 1, 2} in an MPC protocol
the head” framework follows [30] and it is outlined in executed on secret input s.
Section 5.3.9. We elaborate on our salient difference from The view includes private input, random tape, and
the state of the art, the secure multiplication, as secret incoming messages received during the protocol from
sharing and addition are done in the standard manner. foreign parties.S Denote C a commitment operation and
To multiply [z] = [x] · [y], we use an Oblivious Linear define Vj = i∈{0,1,2} {vi } as the union of all views
Evaluation (OLE) oracle O: Every pair of parties i, j use in the j ’th simulation of MPC protocol and let λ be a
security parameter. The zero knowledge proof is a four
9. A 2-secure protocol can withstand collusion of two parties out of round protocol:
the remaining three Round 1: The verifier samples λ indices uniformly at
 Prover Verifier Total Network
random and commits to them using a perfectly hiding #Rounds Security
time time bandwidth Latency
commitment, and sends the commitment to the prover. 26 240 7.8s 4.9s 577 MB 15s
Round 2: The prover simulates the MPC protocol for F 19 230 5.5s 3.2s 421 MB 11s
on secret input s, λ times and commits (using a perfectly 13 220 3.3s 2s 288 MB 8s
binding commitment) to each view (of each party) sep-
TABLE 1: Performance evaluation of AVTC where the
arately, and sends the λ triplets of commitments to the
attribute F is the SHA2 256 function
verifier.
Round 3: The verifier decommits the vector of λ indices the protocol. In contrast, the standard ”MPC in the head”
{ij }j∈[λ] sent in the first round. approach enables the prover to pre-compute the views of
Round 4: The prover checks the decommitments of the the parties and their commitments long before it comes
verifier, and then replies with the views that correspond into interaction with the verifier, and then when the verifier
to other two remaining requested indices {{0, 1, 2} \ asks for opening of the commitments just send the pre-
{ij }}j∈[λ] . The verifier then: (*) verifies that the com- computed de-commitments.
mitments match the received views, (**) simulates the
execution of each party that its view was sent by the 5.5.2. Quantitative comparison to ZK-SNARKs. Gen-
verifier. Specifically, the verifier ensures that the messages eral purpose zero-knowledge proof systems vary from
that the party should send, match the commitments on the simulations of MPC protocols (fast proving time, but high
received messages of the other parties. bandwidth) to non-interactive arguments of knowledge
5.3.10. Zero knowledge Proof For Membership In LF . (slow proving time, low bandwidth). The analysis of [3]
After proving the correctness and privacy of our LSB compared different systems and showed that the Groth16
extraction protocol (Sections 5.3.5, 5.3.6), as well the [27] scheme is the fastest in both prover time and verfier
correctness and privacy of all other algorithms instantiated time, having an order of magnitude difference from the
with the GMW [26] scheme, we can now prove our slowest scheme (Bulletproofs [17]) in their analysis.
main result for this section, Theorem 11. The proofs of To that end, we implement [2] AVTC with the Groth16
completeness, soundness and zero-knowledge are found ZK-SNARK library of Gnark [16] instantiated with the
in Section E. BN-254 curve. In particular, we implement gadgets for
4096 bit number addition and 4096 bit number multi-
5.4. Evaluation plication and then use them in the successive modular
squaring using pre-computed hints similar to Algorithm
We implement the AVTC zero-knowledge proof used 2 in Section 5.3.2. Finally, the LSBs of each layer are
for our cross chain atomic swap protocol from Section 4, fed into a SHA256 gadget we implemented. We bench-
which requires proving in zero knowledge that an AVTC mark the Groth16 implementation on an AWS c5a.8xlarge
commitment string, commits to a SHA256 pre-image. We machine with a 64GB RAM and 32 CPUs. The time it
re-use code from ZKBoo [24] for the SHA256 circuit, takes to run the trusted setup of the 14 million constraints
and implement the AVTC arithmetic circuit and share circuit is 3 minutes and 38 seconds. The prover runs in 54
conversion in 3,500 lines of C code available online [1]. seconds and verifier in 1.4 milliseconds. The large number
We use the GNU MP library [5] for our arithmetic of constraints is due to the need to represent 4096 bit
share addition and multiplication, and OpenMP [7] for numbers as arrays of smaller numbers (we pick 120 bit
parallel processing of soundness amplification. We exper- words), since the order of the BN-254 curve is only 254
iment on an Intel i7 2.6Ghz with 12 cores and 32GB bits long. However, we use hash pre-images of only 96 bits
RAM with different numbers of rounds for soundness in the Groth16 in contrast to 128 bits in the ”MPC-in-the-
amplification, and in each configuration we compute the head” AVTC. The reason is that the more bits in the hash
network bandwidth sent from the prover to the verifier pre-image, the more layers of successive modular squaring
(see Table 1 and Section G) and estimate the latency for we have. Unlike in our ”MPC-in-the-head” construction
a 300 Mbps network. where the number of iterations is the dominating factor,
in the Groth16 ZK-SNARK it is the depth of the circuit.
5.5. Comparison to Other Schemes
6. Conclusions
In this section we discuss alternative options for
our AVTC implementation. We consider other interac- In this work we explored whether cross chain atomic
tive Zero-Knowledge proofs and also non-interactive ones swaps based on Hash Timed Lock Contracts can be con-
such as ZK-SNARKs and discuss trade-offs. structed without reliance on a time source, and answered
the question in the affirmative by providing a protocol
5.5.1. Lowering the network bandwidth. A recent which replaces the well known blockchain based timeouts
promising zero-knowledge proof scheme that has both fast used for safety with timed commitments. We enforced
proving time and low bandwidth is [45]. It is a flavor honest party behavior for our protocol via our novel AVTC
of ”MPC in the head” where the prover and verifier run primitive, which allows to prove arbitrary attributes for
a two-party MPC protocol (with malicious security) and Boneh and Naor’s timed commitment.
unlike the original ”MPC in the head”, they only do a While there is plenty of room for efficiency improve-
single pass over the circuit. However, the protocol assumes ments in our construction, as it requires substantial net-
a designated verifier because a preliminary setup phase work bandwidth, we make up for it in minimal prover
must take place between the prover and verifier prior to time, and in not requiring a trusted setup.
References [24] I. Giacomelli, J. Madsen, and C. Orlandi. Zkboo: Faster zero-
knowledge for boolean circuits. In 25th USENIX Security Sympo-
sium (USENIX Security 16), pages 1069–1083, Austin, TX, 2016.
[1] AVTC MPC in the head implementation. https://github.com/ USENIX Association.
AVTC-paper/AVTC-MPC.
[25] S. Goldberg, L. Reyzin, O. Sagga, and F. Baldimtsi. Efficient
[2] AVTC ZK-SNARK implementation. https://github.com/
Noninteractive Certification of RSA Moduli and Beyond, pages
AVTC-paper/AVTC-SNARK.
700–727. 11 2019.
[3] Benchmarking zero-knowledge proofs with isekai:
[26] O. Goldreich, S. Micali, and A. Wigderson. How to play any
https://sikoba.com/docs/skor isekai benchmarking 201912.pdf.
mental game. In Proceedings of the Nineteenth Annual ACM
[4] Bitcoin time locks: https://github.com/bitcoin/bips/blob/master/bip- Symposium on Theory of Computing, STOC ’87, page 218–229,
0113.mediawiki. New York, NY, USA, 1987. Association for Computing Machinery.
[5] GMP library. https://gmplib.org/. [27] J. Groth. On the size of pairing-based non-interactive arguments.
Cryptology ePrint Archive, Report 2016/260, 2016. https://ia.cr/
[6] Interledger https://interledger.org/interledger.pdf.
2016/260.
[7] OpenMP library. https://www.openmp.org/.
[28] M. Herlihy. Atomic cross-chain swaps. In Proceedings of the 2018
[8] sawtooth: https://sawtooth.hyperledger.org/. ACM Symposium on Principles of Distributed Computing, PODC
’18, pages 245–254, New York, NY, USA, 2018. ACM.
[9] sawtooth: https://sawtooth.hyperledger.org/faq/transaction-
processing/#why-is-there-no-timestamp-in-a-transaction-header-or- [29] M. Herlihy, B. Liskov, and L. Shrira. Cross-chain deals and
block. adversarial commerce. Proc. VLDB Endow., 13(2):100–113, Oct.
[10] Tendermint htlcs: https://github.com/nomic-io/htlc. 2019.

[11] G. Almashaqbeh, F. Benhamouda, S. Han, D. Jaroslawicz, [30] Y. Ishai, E. Kushilevitz, R. Ostrovsky, and A. Sahai. Zero-
T. Malkin, A. Nicita, T. Rabin, A. Shah, and E. Tromer. Gage knowledge from secure multiparty computation. In Proceedings of
mpc: Bypassing residual function leakage for non-interactive mpc. the Thirty-ninth Annual ACM Symposium on Theory of Computing,
Proceedings on Privacy Enhancing Technologies, 2021:528 – 548, STOC ’07, pages 21–30, New York, NY, USA, 2007. ACM.
2021. [31] D. Johnson, A. Menezes, and S. Vanstone. The elliptic curve digital
[12] E. Androulaki, A. Barger, V. Bortnikov, C. Cachin, K. Christidis, signature algorithm (ecdsa). Int. J. Inf. Secur., 1(1):36–63, aug
A. D. Caro, D. Enyeart, C. Ferris, G. Laventman, Y. Manevich, 2001.
S. Muralidharan, C. Murthy, B. Nguyen, M. Sethi, G. Singh, [32] E. Makri, D. Rotaru, F. Vercauteren, and S. Wagh. Rabbit: Efficient
K. Smith, A. Sorniotti, C. Stathakopoulou, M. Vukolic, S. W. comparison for secure multi-party computation. IACR Cryptol.
Cocco, and J. Yellick. Hyperledger fabric: A distributed operating ePrint Arch., 2021:119, 2021.
system for permissioned blockchains. CoRR, abs/1801.10228,
2018. [33] G. Malavolta and S. Thyagarajan. Homomorphic Time-Lock Puz-
zles and Applications, pages 620–649. 08 2019.
[13] L. Blum, M. Blum, and M. Shub. A simple unpredictable pseudo
random number generator. SIAM J. Comput., 15(2):364–383, May [34] A. Mitra, C. Gorenflo, L. Golab, and S. Keshav. Timefabric:
1986. Trusted time for permissioned blockchains. 2021.
[14] D. Boneh, B. Bünz, and B. Fisch. A survey of two verifiable delay [35] C. Ning and Q. Xu. Multiparty computation for modulo re-
functions. IACR Cryptol. ePrint Arch., 2018:712, 2018. duction without bit-decomposition and a generalization to bit-
decomposition. In M. Abe, editor, Advances in Cryptology - ASI-
[15] D. Boneh and M. Naor. Timed commitments. In Advances in
ACRYPT 2010, pages 483–500, Berlin, Heidelberg, 2010. Springer
Cryptology - CRYPTO 2000, 20th Annual International Cryptology
Berlin Heidelberg.
Conference, Santa Barbara, California, USA, August 20-24, 2000,
Proceedings, pages 236–254, 2000. [36] C. Ning and Q. Xu. Constant-rounds, linear multi-party computa-
[16] G. Botrel, T. Piellard, Y. E. Housni, I. Kubjas, and A. Tabaie. tion for exponentiation and modulo reduction with perfect security.
Consensys/gnark: v0.6.4, Feb. 2022. In D. H. Lee and X. Wang, editors, Advances in Cryptology
– ASIACRYPT 2011, pages 572–589, Berlin, Heidelberg, 2011.
[17] B. Bünz, J. Bootle, D. Boneh, A. Poelstra, P. Wuille, and Springer Berlin Heidelberg.
G. Maxwell. Bulletproofs: Short proofs for confidential transac-
tions and more. In 2018 IEEE Symposium on Security and Privacy [37] T. Nishide and K. Ohta. Multiparty computation for interval,
(SP), pages 315–334, 2018. equality, and comparison without bit-decomposition protocol. In
International Workshop on Public Key Cryptography, pages 343–
[18] O. Catrina and S. de Hoogh. Improved primitives for secure 360. Springer, 2007.
multiparty integer computation. In J. A. Garay and R. De Prisco,
editors, Security and Cryptography for Networks, pages 182–199, [38] K. Pietrzak. Simple verifiable delay functions. In 10th innovations
Berlin, Heidelberg, 2010. Springer Berlin Heidelberg. in theoretical computer science conference (itcs 2019). Schloss
Dagstuhl-Leibniz-Zentrum fuer Informatik, 2018.
[19] I. Damgård, M. Fitzi, E. Kiltz, J. B. Nielsen, and T. Toft. Un-
conditionally secure constant-rounds multi-party computation for [39] J. Poon and T. Dryja. The bitcoin lightning network: Scalable
equality, comparison, bits and exponentiation. In Theory of Cryp- off-chain instant payments, 2016.
tography Conference, pages 285–304. Springer, 2006. [40] T. I. Reistad. Multiparty comparison - an improved multiparty
[20] I. Damgård and R. Thorbek. Efficient conversion of secret- protocol for comparison of secret-shared values. In SECRYPT,
shared values between different fields. IACR Cryptol. ePrint Arch., 2009.
2008:221, 2008. [41] P. Rogaway and T. Shrimpton. Cryptographic hash-function basics:
[21] Y. Doweck and I. Eyal. Multi-party timed commitments. ArXiv, Definitions, implications, and separations for preimage resistance,
abs/2005.04883, 2020. second-preimage resistance, and collision resistance. In B. Roy
and W. Meier, editors, Fast Software Encryption, pages 371–388,
[22] J. A. Garay and C. Pomerance. Timed fair exchange of standard Berlin, Heidelberg, 2004. Springer Berlin Heidelberg.
signatures. In R. N. Wright, editor, Financial Cryptography, pages
190–207, Berlin, Heidelberg, 2003. Springer Berlin Heidelberg. [42] A. Shamir. How to share a secret. Commun. ACM, 22(11):612–613,
nov 1979.
[23] A. Gervais, G. O. Karame, K. Wüst, V. Glykantzis, H. Ritzdorf,
and S. Capkun. On the security and performance of proof of work [43] S. A. Thyagarajan, G. Malavolta, and P. Moreno-Sánchez. Univer-
blockchains. In Proceedings of the 2016 ACM SIGSAC Conference sal atomic swaps: Secure exchange of coins across all blockchains.
on Computer and Communications Security, CCS ’16, page 3–16, Cryptology ePrint Archive, Report 2021/1612, 2021. https://ia.cr/
New York, NY, USA, 2016. Association for Computing Machinery. 2021/1612.
[44] S. A. K. Thyagarajan, A. Bhat, G. Malavolta, N. Döttling, A. Kate, Appendix B.
and D. Schröder. Verifiable timed signatures made practical. In 2k
Proceedings of the 2020 ACM SIGSAC Conference on Computer Proving that u = g 2 (mod N )
and Communications Security, CCS ’20, page 1733–1750, New
York, NY, USA, 2020. Association for Computing Machinery. We describe the protocol executed as part of the
[45] C. Weng, K. Yang, J. Katz, and X. Wang. Wolverine: fast, scalable, Commit phase of AVTC which convinces the receiver
and communication-efficient zero-knowledge proofs for boolean that the commitment can be forcefully opened in 2k se-
and arithmetic circuits. In 2021 IEEE Symposium on Security and k

Privacy (SP), pages 1074–1091. IEEE, 2021.

quential steps. Recall, the prover can compute u = g 2 by
k
computing the exponent e = 22 (mod φ (N )) and then
[46] B. Wesolowski. Efficient verifiable delay functions. In Annual
International Conference on the Theory and Applications of Cryp- u = g e (mod N ). In contrast, the receiver, not knowing
tographic Techniques, pages 379–407. Springer, 2019. the factorization of N , has to resolve to 2k successive
[47] J.-Y. Zie, J.-C. Deneuville, J. Briffaut, and B. Nguyen. Extending squaring and modulo reductions.
atomic cross-chain swaps. In Data Privacy Management, Cryp- The prover is going to send the verifier a vector W of
tocurrencies and Blockchain Technology, pages 219–229. Springer, the form
2019. k
2i 2k 2i
  
W = g 2 ,g 4 ,g 16 ,g 256 ...,g 2 ,...,g 2 (mod N )= g 2 (mod N )
i=1
Appendix A. along with a zero knowledge proof that for every two
LHTLP construction consecutive elements a, b in W it holds that: ∃x a =
We elaborate on our observation from Section 2.2.5 on g x (mod N ) ∧ b = ax (mod N ), or alternatively: ∃x a =
2
the trusted setup requirement of the Homomorphic Time- g x (mod N ) ∧ b = g x (mod N ).
Lock Puzzles (HTLP) by going into details on the Linear The proof convinces the verifier that the last element in
2k
Homomorphic Time-Lock Puzzle (LHTLP) construction W is indeed the desired u = g 2 mod N , and is computed
and showing that a setup phase that is executed dishonestly from g by repeated squaring followed by modulo reduc-
2k−1
leads to incorrect recovery of the puzzle. The construction tions of N . Note that the receiver learns g 2 , however
of the LHTLP is as follows:  2k−1 22 k−1
2k−1 2k−1 2k
·2
λ


• Setup 1 , T : Sample two safe primes p, q and set
g2 = g2 = g2 ≡(mod N ) u.
R Therefore, given the vector W , the receiver still needs
N = p · q , and sample ḡ ← Z∗N and set g =
T to perform an exponential (2k−1 ) number of squarings
−ḡ 2 (mod N ). Compute h = g 2 and output pp = followed by modulo reduction by N .
(T, N, g, h). Let λ be a security parameter and denote [λ] =
R 2 ∗
• Gen (pp, s): Let r ← {1, ..., N } and compute u = {0, 1, .., λ} and q the order of g ∈ ZN . Observe the in-
s

g (mod N ), v = h ·(1 + N ) mod N 2 and output
r r·N
teractive zero knowledge protocol of Boneh and Naor for
Z = (u, v). inclusion in L = {(ai , bi ) ∃x s.t ai = g x (mod N ) ∧ bi =
T 2
• Solve(pp, Z = (u, v)): Let
w =
u2 (mod N ). Output g x (mod N )}:
v · w−N mod N 2 − 1 · N −1


s=
n
• Eval (⊕, pp, {Zi = (ui , vi )}i=1 ): Let ū
=
Qn
u (mod N ) v̄ =
Qn 2 Prover Verifier
i=1 i , i=1 vi mod N and
output Z = (ū, v̄). R
ci ← [λ]
At a first glance, the Homomorphic Time Lock Puzzle
(HTLP) construction seems similar to the Timed Commit- Ci = Commit (ci ) (Step 1)
ment primitive devised by Boneh and Naor (see Definition R
4). We note however, an important difference: In the timed αi ← Zq
commitment, the sender proves to the receiver that the
forced open (called Solve in HTLP) indeed yields the (Step 2) zi = g αi , wi = aα
i
i

committed value within the claimed number of compu-

tation steps. It is not the case in LHTLP (or any of the ci = DeCommit (Ci ) (Step 3)
other variations of HTLP). Moreover, even if Gen was i−1
computed honestly by the sender, or that the receiver (Step 4) yi = ci · 22 + αi (mod q)
verifies the correct computation of Gen via an interactive ?
proof, there is no guarantee that the Setup phase was g yi · a−c
i
i
= zi (∗)
constructed correctly. Indeed, in the LHTLP construction, ayi i · b−ci ?
= wi (∗∗)
T T i
the Solve operation computes w = u2 = g r·2 via
successive modular squaring and then if h was constructed
T
Figure 5: Proof that ∃x ai = g x (mod N ) ∧ bi =
honestly in the Setup phase, then h = g 2 and then 2
g x (mod N )
T s
v = g r·2 ·N · (1 + N ) which fits the aforementioned
w. However, if h was not honestly constructed in Setup Each step of the protocol depicted in Figure 5 is
then Solve will not output the s that was used as input executed in parallel for all i ∈ [k]:
to Gen. The authors of [33] do mention that the Setup Step 1:The verifier samples {ci }i∈[k] ∈ [λ] uniformly at
should be executed by a trusted party. We note that unlike random, and sends a commitment to each ci using an
the HTLP where the Setup phase outputs T, N, g, h, the perfectly hiding commitment scheme to the prover.
Setup phase of the the timed commitment outputs only Step 2:The prover, in turn, samples {αi }i∈[k] and sends
the modulus N . zi , wi for all i ∈ [k].
Step 3:The verifier decommits to all {ci }i∈[k] and the From (1) and (3) we get
prover aborts if one of the decommitments turn out to be 0 −c0i 0 c −c0i
false. g yi · a−c
i
i
= g yi · ai ⇒ g yi −yi = ai i . (5)
Step 4:Finally, the prover sends yi , and the verifier checks
and from (2) and (4) we get:
that conditions (*) and (**) hold. A formal proof of the
protocol, which wasn’t included in the original paper of y0 −c0i y −yi0 c −c0i
ayi i · b−c
i
i
= ai i · bi ⇒ ai i = bi i (6)
Boneh and Naor, can be found in the next subsection.
Denote γ = yi − y 0 and δ = ci − c0i , thus from (5)
Appendix C. we get g γ = aδi and from (6) we get aγi = bδi . Thus,
−1 −1

Proof for the Boneh-Naor Zero Knowledge g γ = aδi ⇒ g γ·δ = ai and aγi = bδi ⇒ aγ·δ i = bi .
Protocol Denote β = γ · δ −1 (mod q). Hence  g β
= ai and aβi =
2
bi , so (g, ai , bi ) = g, g β , g β , thus (ai , bi ) ∈ L in
C.1. Completeness contradiction to the assumption.

Observe the interaction between an honest prover C.3. Zero Knowledge

and a verifier for an arbitrary i ∈ [1, k]: First the
prover sends zi = g αi and wi = aα i
i and finally sends We show that the protocol in Figure 5 satisfies the
2i−1
y i = ci · 2 + αi (mod q). The verifier computes: zero-knowledge property. For this purpose we construct a
i−1 i−1 ci
yi −ci
g · ai = g ci ·22 +αi −ci
· ai = g 22
· g · a−c
αi i
= simulator S that upon receiving input (ai , bi ) ∈ L pro-
i
2i−1
duces a view that is indistinguishable from the verifier’s
c
(ai ) i ·g αi ·a−c
i
i
= zi , and ayi i ·b−c
i
i
= aici ·2 +αi −ci
·bi = view in a run with an honest prover, or more formally:

 2i−1 22i−1 ·ci +αi  2i ci  2i−1 αi V iewVP ∗ (ai , bi ) x∈L ≡s {S (ai , bi )}.
g2 ·b−ci
i
= g2 · g2 ·b−c
i
i
= 1) The simulator sets the random tape T̂ of V ∗ by
−ci
bci i ·aα
i ·bi
i
= wi as required, therefore it always accepts randomly sampling from {0, 1}τ where τ denotes an
the proof. upper bound on the running time of V ∗
2) The simulator waits for the commitments given in step
C.2. Soundness 1 by the verifier
R
3) The simulator samples αi ← ZN and sends zˆi =
αi αi
Let (ai , bi ) for some i ∈ [1, k] such that @x ai = g , ŵi = ai .
2
g (mod N )∧bi = g x (mod N ) and assume in contradic-
x 4) The simulator waits for the decommitments from the
tion that ∀i ∈ [1, k] a cheating prover P ∗ can send (zi , wi ), verifier
get a challenge ci and then send yi and convince the 5) The simulator rewinds the verifier to right after its first
verifier that (ai , bi ) ∈ L with non negligible probability. step
Define the following set C : 6) The simulator samples yˆi ∈ ZN uniformly at random
n o and computes
−c y −c
C= ci |∃yi s.t g yi ·ai i =zi ∧ai i ·bi i =wi ∧(ai ,bi )∈L
/
zˆi = g yˆi · a−c
i
i
, ŵi = ayiˆi · b−c
i
i

The set C , informally, is the set of all challenges from an

honest verifier ci such that there exists a response from 7) The simulator sends zˆi , ŵi , waits for the decommit-
the prover yi such that the verifier accepts a tuple (a, b) ment to ci from the verifier
not in L. 8) The simulator sends  yˆi
Let’s split into cases in accordance to C ’s cardinality: We next show that V iewVP ∗ (ai , bi ) x∈L ≡s {S (ai , bi )}.
• |C| = 0: By definition, we get complete soundness. The view of the verifier V ∗ consists of the public input
• |C| = 1: To cheat, the prover will guess ci , pick yi (a, bi ), its random tape T, and the messages received M,
and send zi = g yi · a−c i
i
and wi = ayi i · b−c
i
i
and the or more formally: V iewVP ∗ = h(ai , bi ) , T, Mi.
verifier would accept. In that case, the probability of The messages M sent by the real prover in Figure 5 are
the prover to convince the verifier of (ai , bi ) ∈/ L is 1q , zi , wi in step (2) and yi in step (4), while M̂ consists of
because it needs to guess the challenge ci which has q zˆi , ŵi sent in steps (3),(7) and of yˆi sent in step (8).
∗
(the order of g ∈ ZN ) different possibilities despite the First, observe that the only message sent in the pro-
verifier picking ci ∈ [λ], and every challenge is selected tocol that is related to the public input (ai , bi ) is the first
uniformly at random. message containing wi = ai αi . The simulator sends this
0
• |C| > 1: There are at least 2 such challenges: ci 6= ci . message twice (before and after rewinding) in steps (3)
We’ll see that if that is the case, then ∀i ∈ [1, k] : and (6). We will show that the first time the simulator
(ai , bi ) ∈ L in contradiction to the assumption. sends the message (zˆi , ŵi ) in step (3), its joint distribution
The following equations hold: with the public input distributes statistically close to the
joint distribution of the corresponding first message and
(1) g yi · a−c
i
i
= zi public input in the real protocol. The last message sent in
(2) ayi i · b−c i
= wi the protocol (both by the real prover and the simulator)
i
is independent of the public input. We will show that
0 −c0i
(3) g yi · ai = zi the last message (step 8) the simulator sends distributes
statistically close to the corresponding message sent by the
yi0 −c0i
(4) ai · bi = wi real prover. For the second message sent by the simulator,
and corresponds to the first message sent in the real As we’ve shown that h(ai , bi ) , T, Mi ≡s
protocol, we will show that the exponents are statistically h(ai , bi ) , T̂, M̂i, we conclude that:
close, and conclude that the messages are also statistically
V iewVP ∗ (ai , bi ) x∈L ≡s {S (ai , bi )}

close.
Statistically close messages: We show that the messages
sent by the simulator in steps (3) and (8) are statistically
close to their corresponding messages in the real protocol: Appendix D.
R
• Step (3) (zˆi , ŵi ) ∈ ZN × ZN since αi ← ZN and zˆi = Proofs for AVTC sub-protocols
α
g αi , ŵi = ai i , while the real prover sends (zi , wi ) ∈
Z∗N × Z∗N . The messages are therefore picked in the Proof of Theorem 17 ((LSB extraction completeness)).
same manner in both the simulated protocol and the real An honest dealer distributes only even plaintext shares
protocol, except from the distributions the exponents are and even blinding factors in lines 1-4, therefore the
sampled from. Therefore we will show that: ZN ≡s Z∗N . parties do not abort in lines 5,6. Furthermore, an honest
i
y −c
• Step (7): Notice that zˆi = g i · ai i , ŵi = (zˆi )
22
while dealer distributes plaintext shares and blinding factors
αi 22
i such that for each blinding factor, there exist a plaintext
zi = g and wi = (zi ) . Therefore, the pairs zi , wi share that was built using that blinding factor (line 4). It
2i
and zˆi , ŵi distribute like zi and zˆi . Since ai = g 2 , follows that in line 13, [z] opens to zero, and the protocol
2i
zˆi = g yi −ci ·2 . If we showthat ∆ (UN , UN ∗
) is negli- does not abort. Finally, from construction of the plaintext
2i
 shares of the LSB and its blinding factors, the parties
gible, it will follow that ∆ zi = g , zˆi = g yi −ci ·2
αi
actually compute a secret sharing of the LSB in line 11,
is also negligible. To see why, assume in contradiction and the protocol outputs it in line 17 since it does not
there exists a distinguisher D othat distinguishes between abort.
2i
n
{g αi }αi ∈U ∗ and g yi −ci ·2 ∗
. We can use D to
N yi ∈UN
build a distinguisher D0 that distinguishes UN from UN ∗
: Proof of Theorem 18 (LSB extraction privacy). The sim-
Upon input x, the distinguisher D0 returns D (g x ). ulator S evaluates the circuit of Algorithm 5 backwards,
• Step (8): The simulator sends yˆi ∈ ZN picked uni- starting from the shares of [v0 ] of parties i and j . Note
formly at random while the real prover sends a yi ∈ Z∗N that the only place where secret shares are reconstructed,
also picked uniformly at random. Note that yi , yˆi are is when z is revealed to be zero. Therefore, in line 13, the
independent of the public input, and the correlation be- simulator S samples three random shares z1 , z2 , z3 and
tween yˆi and zˆi and ŵi sent after rewinding is identical has each party broadcast the its share. Then, to simulate
to the correlation of yi with zi , wi in the corresponding line 12 :
real protocol. Therefore, as in step (3), it will suffice to n h
X i X n h i
show ZN ≡s Z∗N . [z] = [v] − a(i) + r(i) + r(i) − [v0 ]
We denote a random variable that is sampled from ZN i=1 i=1
∗
as UN , similarly UN is sampled from Z∗N . We now next the simulator first samples v and then samples blinded
∗
the indistinguishably of the random variables UN and UN . plaintext shares and blinding values such that:
∗
We are interested in measuring ∆ (UN , UN ) (the statistical n  n
distance between ZN and Z∗N ). X  X
0=v− a(i) + r(i) + r(i) − v0
N −1
∗ 1 X i=1 i=1
∆ (UN , UN )= P r [a ∈ ZN ] − P r [a ∈ Z∗N ] ≤ (i) (i)


2 a=0 where a + r is a single value.
 1
=N 0 Afterwards, the simulator S secret-shares the blinded
1 X z }| { z }| { plaintext shares and blinding values, and adds to the
≤ P r [a ∈ ZN ] − P r [a ∈ Z∗N ] + incoming messages of parties i and j the secret shares
2

a∈ZN \Z∗
N accordingly.
1

1
=N = φ(N )
X z }| { z }| {
+ P r [a ∈ ZN ] − P r [a ∈ Z∗N ] 
 = (F)
Proof of Theorem 19 (LSB extraction soundness).
a∈Z∗
N
Assume in contradiction that the protocol does not abort
in spite of a dishonest dealer. It follows from lines 5,6
Notice that: that for every party, a(i) + r(i) is even, and b(i) + e(i)
is a bit. Since each blinding factor r(i+1) is even and
|Z∗N | = φ (N ) = (P − 1)·(Q − 1) = P ·Q−(P + Q)+1 e(i+1) is a bit, it follows that a(i) is even and e(i) is a
while |ZN | = P ·Q, therefore, ∗ bit. Furthermore it follows from line 5 that there is no
 ZN \ Z Q − 1.
N = P +  overflow in the additions in line 12 since p > N 2 + n · 2µ .
1 P +Q−1 1 1
Thus: (F) = 2 · N  + φ (N ) · φ(N ) − N = Since we assumed the protocol didn’t abort, [z] was

1 P +Q−1 φ(N ) reconstructed to reveal zero in line 13 and there was no
2 · N +1− N = ().
overflow (otherwise zero cannot be revealed). However,
Notice that φ(N
N
)
= P ·Q−(PN+Q)+1 = 1 − P +Q−1N , hence in line 12 the parties added and subtracted even values
φ(N ) P +Q−1 P +Q−1
1− N = N ⇒ () = N . which did not change the LSB of the result, therefore
Recall that both P and Q are λ bits of size. Hence, the LSB of [v] had to be [v0 ] which is returned, in
P +Q−1
N ≈ 2−λ , thus ∆ (UN , UN
∗
) is negligible, and there- contradiction to how a dishonest dealer should have
∗
fore ZN ≡s ZN as claimed. operated.
 n
Appendix E. (F) zi = xi + yi +
X
(sj,i − ri,j )
AVTC scheme for every predicate j=1,j6=i

Proof of Theorem 11 (Completeness). If the sender and For a party j ∈ {i − 1, j + 1} and w.l.o.g j = i + 1,
receiver are honest, then indeed x, the secret input that upon having a share zj that is a result of a multiplication
F is evaluated on, has the required attribute, and every gate, we sample its inputs xj , yj ∈ Zp , sample the random
simulation of the MPC protocol of F on x will always tape entry rj,i−1 to be sent to party i − 1 and then do the
yield F(x) = 1. Furthermore, all commitments open same for party i − 1. Then, we compute the OLE outputs
correctly by both the sender and the receiver, and views to parties j, i − 1 and sample random values for the OLE
are consistent with the messages sent due to the prover with party i (its view is not revealed) such that (F) holds.
honestly emulating all executions of F , therefore the Secret sharing: Let sj be a share that is in possession of
receiver accepts. party j ∈ {i − 1, i + 1} at some point in the backward
evaluation. By definition, the share was sent by a party
Proof of Theorem 11 (Soundness). Since x ∈ / LF , the in {j + 1, j − 1}. We split into two cases: (i) The share
sender cannot simulate the MPC protocol of F honestly, was sent by party i which its view isn’t revealed. In that
and thus it has to cheat at at least a single party simulation case, we add sj to the incoming messages of j . (ii) The
among the n simulations. Observe that the sender commits share was sent by the remaining party, one that is not
to views in round 2, and reveals views selected by the i and also not j and its view is revealed. In that case,
verifier in round 4. The probability that a cheating sender we sample a random value s0 according to its domain
will cheat in one of the three party simulations which the (it might be a plaintext share, or a regular share in Zp )
and then split s0 into three parts: {s01 , s02 , sj } such that

λgoing to ask to reveal in round 4 for all λ
receiver is not
s01 + s02 + sj = s0 (mod p), and then we set the output
indices is 13 , which is negligible for a large enough λ. of the gate whose output is used as input to the secret
sharing operation, and recursively call F .
Proof of Theorem 11 (Zero Knowledge). We describe a LSB extraction: The LSB extraction involves additions
S(x) M
simulator M and show that: V iewR ≡s V iewR . The (local operations), secret sharing, multiplications and
simulator M uses an auxiliary function F to construct the share reconstructions, which were all defined previously
views and outgoing messages for each party i: for F.
1) M receives a vector of commitments for indices from
the verifier, sent in round 1.
2) M sends a commitment to zeroes in round 2. Appendix F.
3) Verifier decommits to indices {ij }j∈[λ] it sent. Hash Pre-Image Prefix Length
4) M rewinds the verifier back to right after round 1.
5) ∀j ∈ [λ], M sends to R in round 2: A malicious party in our cross-chain atomic swap
{C (F ((ij − 1)mod 3)) , C (F ((ij + 1)(mod 3))) , C (0)} protocol is incentivised to find a pre-image for of a
cryptographic hash H with the secret prefix of length d,
6) M Receives indices sent in round 3, and decommits as it can then claim its funds in escrow faster than the
to views and outgoing messages forged by F. specified timeout, and then claim both the counter party’s
The construction of F is defined for the other two parties funds and not lose its own funds in escrow.
that are not i, meaning parties i − 1 and i + 1 that Security model and assumptions: We assume a
their view and outgoing messages are forged. Their output model where malicious parties are computationally bound.
depends on the action performed by the party (gate type, Specifically, we assume that any malicious party that
or operation), the input to that action (gate input, private participates in the cross-chain atomic swap protocol, has
input) as well as the random tape. We define each action’s hashing power less or equal to the entire hashing power
output by emulating the protocol backwards gate by gate: of the Bitcoin network. We also put an upper bound to
Share reconstruction: The public output F(x) for which the delay used for any of the two parties in our protocol,
the verifier accepts, is split into three uniformly random which will be a single day.
shares si−1 mod 3 , si , si−1 mod 3 and let the parties of the We are only interested in protecting honest parties that
views i − 1, i + 1 send their shares to each other. This follow the protocol, therefore we assume that they sample
is possible thanks to the fact that F emulates the MPC their pre-image prefix uniformly at random from {0, 1}d
protocol backwards, so the gates that define the shares of as dictated by our protocol (see Section 4). We assume the
the output reconstruction have not yet been defined at this standard cryptographic assumption on the hash function
stage. [41] we use, in particular that it is pre-image resistant,
Multiplication: We recall the definition of the OLE based and let its input be 256 bits.
multiplication gate: To multiply [z] = [x] · [y], we use an Analysis: Denote the daily hashing rate of a malicious
Oblivious Linear Evaluation (OLE) oracle O: Every pair party to be r. For simplicity, we model the computation
of parties i, j use the OLE oracle O to compute blinded by giving the malicious party oracle access to R:
products of each party’s inputs: R : N → {(x, H0 (x)) x ∈ {0, 1}d }
1) Every party i samples a random value ri,j ∈ Zp for
256−d
each party j 6= i and sends the share xi and ri,j to O. z}|{
0
2) party j sends to O the share yj where H (x) = H(x|| 0..0 ), a function that pads the in-
3) The OLE oracle O sends party j : si,j = xi · yj + ri,j . put with zeroes and then applies H. Informally, R receives
Afterwards, [z] is defined by: a number r ∈ N and then outputs r zero-padded pairs of
pre-image prefixes and hashes, where each padding is of 600
length 256 − d.
We need to ensure that d will be large enough so

Network bandwidth (MB)

that with high probability, none of the unique pre-image
prefixes guessed by a malicious party during an upper
bound time limit of a day, is the one sampled by the party 500
that produced the AVTC commitment. We note that even
though we require a suffix of 256 − d zeroes, we do not
make it easier for an adversary to attack our scheme, as
any adversary that can find a pre-image with a hash with 400
a specific suffix of zeroes, finds a pre-image in the general
case. The malicious party sends its daily hashing rate r to
R and receives back r distinct pairs: {(xi , H0 (xi ))}ri=1 .
The probability that one of the pairs matches the hash that Proof size
revealing its pre-image releases the escrow, is 2rd . 300
Bitcoin average hash rate is 140 exa-hashes per sec- 14 16 18 20 22 24 26
ond. If we upper bound the timeouts to a day, it sums up
Number of rounds
to 140 ∗ 1018 · 60 · 60 · 24 = 283 double hash operations
per day, or 284 hash operations per day. Hence, if we take Figure 7: Network bandwidth of SHA256-AVTC
d = 128 then the probability of a malicious party that has
access to a hashing rate that is equal to the entire Bitcoin
84
network, is: 22128 = 2−44 . We show further measurements of our ”MPC in the
head” implementation of the SHA256 AVTC. We measure
Appendix G. the performance (proving time and verification time) in
Figure 6. The bandwidth sent from the prover to the
Extended experiments verifier (in the de-commitment phase) as a function of
with the number of rounds is shown in Figure 7. The
correlation is linear since for every round, the prover de-
commits all secret shares and OLE inputs/outputs in two
7 of three views.4

6
time (seconds)

2 Prover
Verifier

12 13 14 15 16 17 18 19 20 21 22 23 24 25 26
Number of rounds
Figure 6: Performance measurement of SHA256-AVTC