Cryptographic coin flipping, now in Keybase

I&#x27;d be curious if people on HN would want a zero knowledge survey and voting system inside Keybase, and if so, what would it look like?<p>The background: we talk about it sometimes as a solution to a real problem: in certain teams and workplaces, people can be afraid to give honest feedback (who dares to submit an &quot;anonymous&quot; survey to HR?), but Keybase may be in a unique position to let people in a group give written feedback, vote on something important, or rate an experience. Without any risk of exposing identity, short of writing something identifiable in a text field.<p>I&#x27;d be curious, personally, to see management get a yearly vote of [no] confidence, for example. Is that crazy?<p>Keep in mind we are mostly focused right now on user experience and performance improvements. But we allocate a certain amount of time to cryptographic features that just aren&#x27;t possible in other software, such as this coin flip thing. We&#x27;ve been talking about voting and surveys, too.

Has Keybase lost it&#x27;s way? I thought they were onto something cool and maybe could explore an enterprise play with private chats, filesharing and git for teams or something like that. Basically make money by selling to teams. But Keybase seems to have stagnated, existing apps are still quite buggy, not enough new developments recently. The facepalm moment for me was when they announced they were supported by the Stellar foundation. I lost all hope then and there. I get that you guys are buddies with the Stellar folk, you think Stellar is cool etc but an objective analysis leads to only one answer : don&#x27;t do it you&#x27;ll regret. Maybe add it as a feature (stellar integration) but don&#x27;t go all in. Speaking of Stellar, still no integration after 1 year?? Focus on what you have and start making money. So, what went wrong malgorithms?<p>(Sorry if this sounds harsh or rude, there&#x27;s no point in sugar coating the truth. Hopefully the keybase teams reads this criticism and does a little soul searching.)

I use Keybase daily and really like it, but of course the more I use it the more I fear it&#x27;ll go away. Are they actually making any money off it yet, or will they eventually run out and fail to switch over to paid accounts in time before the company evaporates?

Is this a problem with commitment schemes?<p>I want a heads to come up. I add a couple of hacked members to the group, so there are 3 honest members, and lets say 3 coordinated dishonest members.<p>Everyone shares their commitment hash, and the dishonest members share their actual commitments amongst themselves. Once everyone has the commitment hashes, the 3 honest members broadcast their commitment. The three dishonest members now have everyone&#x27;s commitments, but honest members only have other honest member commitments. Dishonest members compute the ultimate value - if it turns up heads, then they just share their commitments with everyone, and the final answer is heads.<p>If it turns up tails, then the dishonest members compute possible permutations of various dishonest members dropping out and never sending their commitments. So maybe if dishonest member 1 drops out, the resultant value from just the group of 5 would be heads. So dishonest member 2 and 3 share their commitments and dishonest member 1 goes offline.<p>So, this system will work when it is composed of only people you trust, but will not work when it may be composed of people you don&#x27;t trust. And if you trust everyone in it, why go through this process in the first place? And if you decide that when someone drops out and doesn&#x27;t share their commitment, you just have to rerun the algorithm, then you have just given a very easy way to give the dishonest people a way to spike your coin flipper, so that no one can ever get a value out of it, or the dishonest members can just keep dropping out until they encounter a round where the final value is determined to be heads.

&gt;&gt; Who invented commitment schemes?<p>&gt; ~My wife~ Not sure.<p>Seriously? You work professionally in the crypto space and don&#x27;t know where this is from? Or don&#x27;t feel it&#x27;s important to attribute such fundamental ideas to the appropriate people? If you really don&#x27;t know, a quick google would have educated you. But what I fear to be more likely is that you apparently just don&#x27;t give a damn.<p>For anybody remotely interested, look up Manuel Blum&#x27;s work, e.g. &quot;Coin flipping by telephone&quot; presented at CRYPTO 1981. ACM Turing Award.<p>Or Rivest, Shamir, Adleman, &quot;Mental Poker&quot;. Oh, those guys also got the ACM Turing Award.

This may not be the intended use of your application, but I organize a local bdsm group (if unfamiliar, do not Google this at work), and we appreciate the security offered very much.<p>We can even think of a few &quot;fun&quot; uses of this new feature.

There&#x27;s a slight variation on this that I had pondered for designing a distributed election algorithm. I&#x27;m sure the idea is not novel, but it would be nice to know what work has been done on it.<p>The goal is to fairly select some candidate from a set of candidates. Each candidate `Ci` generates a UUID `Ui`. The hash of their UUID `hash(Ui)` is published by each candidate. Once all hashes have been collected, each candidate reveals the verifiable original UUID to all the others.<p>Each candidate then concatenates these UUIDs together (after normalizing the sequence in some way - e.g. sorting), and produce a selector code: `H = hash(U1 ++ U2 ++ ... ++ Uk)`. Finally, the selected candidate is simply the one whose UUID is the closest to `H` under some distance metric.<p>I tinkered a bit with adapting it for situations where the candidate set could shrink during the selection process (i.e. a candidate drops out), but didn&#x27;t really pursue it much.

I like the UI, but I find the blog post example - flip a coin to see who will donate a kidney - a little distasteful.

I don&#x27;t really understand why they use HMAC-SHA256. Why do many schemes decide to do this needlessly when they can use SHA3 or Blake2b?

this is brilliant AND super useful.<p>also love the details like “flip again”

It seems like a VRF might be a more natural choice than a commitment scheme for verifiable randomness, since it doesn&#x27;t require any honesty assumption for participants, and Keybase already manages keys (though maybe it would be a problem if participants could change keys midway through the ceremony).

@malgorithms - Could you consider buying or integrating Cryptpad? [1]<p>It would give you an office suite play very very quickly - I can only see it as a winner.<p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;xwiki-labs&#x2F;cryptpad" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;xwiki-labs&#x2F;cryptpad</a>

I&#x27;ve thought about trustless lotteries quite a bit, and haven&#x27;t really came up with a solution that works without using head-to-head brackets.<p><i>&gt;A bad actor can&#x27;t change the outcome of a flip but could prevent it from resolving.</i><p>The post glosses over this but it can get pretty bad. E.g. 99 actors have revealed their seeds and then the 100th decides whether to reveal or not, based on whether they or their confederates will be the winner after that final reveal.

I see a flaw with that prng scheme. Since AES is reversible, the 128-bit blocks that make up the output cannot repeat. The output is a permutation of distinct 128-bit blocks. Early in the sequence that only matters a tiny bit, but the longer it goes, the more that tells you about possible upcoming values.

@malgorithms, what are the colored bars from each participant? Is it a colored representation of the hashes?

I got lost on the line &quot;If the final answer is odd, the flip is TAILS.&quot; For example: Alice flips 1 for tails. Barb&#x2F;Charlie&#x2F;Danika flip 0. Why is the answer tails when most of the people flipped 0 for heads? Why use XOR instead of just taking the most common answer?

Seems like overkill. Just declare your guesses and use a third party to generate coin flip&#x2F;dice roll. In fact this functionality is built-in in a number of chat clients.

How is this different from provably fair? <a href="https:&#x2F;&#x2F;dicesites.com&#x2F;provably-fair" rel="nofollow">https:&#x2F;&#x2F;dicesites.com&#x2F;provably-fair</a>

&gt; The Keybase app can deal M cards into N labeled hands. I don&#x27;t know what you would do with that, but enjoy.<p>Is he being coy here? I mean - poker, right?

I&#x27;ll add my usual reminder here that keybase is a proprietary walled garden that made up its own crypto standards and protocols on many levels leading to dangerous design flaws like this one: <a href="https:&#x2F;&#x2F;github.com&#x2F;keybase&#x2F;keybase-issues&#x2F;issues&#x2F;1946" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;keybase&#x2F;keybase-issues&#x2F;issues&#x2F;1946</a>

How does this address the last revealer problem?

echo -n