TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Ask HN: How do I finish this lottery scheme?

1 点作者 logicallee3 个月前
This is a cryptography problem I haven&#x27;t solved yet.[1] Maybe there is some background research in distributed computing that I don&#x27;t know about yet.<p>The State of Utopia is a distributed, AI-run, Utopian state, and has certain scarce resources such as citizenships and money that in the interest of fairness must sometimes be granted by lottery, since there is no such thing as half a citizenship for example, or it might have a Universal Basic Income level that it sets in an experiment and only has money to give to a certain number of people, and it doesn&#x27;t scale to trying to run the experiment on everyone at once.<p>However, absent trust, there is a problem with attackers who want to compromise the entire system to choose their own lottery winner - for example so they can set up a corrupt black market where they choose the lottery winners and require payment for their choice. Or they can just choose themselves as winners.<p>How could the population of Utopia trust the random number which represents the lottery winner (for example that the winner is entrant number 562,354? For example, if you are a citizen of Utopia and there are 1 million entrants for something valuable that is given by distributed lottery, how can you be assured you have an equal chance of winning it as the other 999,999 people?<p>One scheme could be to pick the closing stock prices (to the penny) of some leading stocks on a given day that hasn&#x27;t occurred yet, such as next Wednesday&#x27;s closing penny prices on ten different stocks. However, this form of &quot;entropy&quot; is still not totally distributed because perhaps someone could influence that specific ledger, adjusting the final pennies to their satisfaction? Perhaps state actors could infiltrate and corrupt any specific source of entropy? They could infiltrate and corrupt the stock market. It&#x27;s not really zero-trust. Cryptographically speaking, it&#x27;s something that could theoretically be controlled.<p>Hence we began to propose a DISTRIBUTED ONE TIME PAD that operates on the following basis:<p>1. Everyone chooses a one time pad of the required number of bits to account for the amount of entropy required. For example if there are 8 billion possible people, then 33 bits are required to choose one at random.<p>2. Everyone encrypts their chosen OTP with AES-256-GCM, for example using this application[1]. They choose the password of their choice. They disclose the encrypted version and retain their private key secretly.<p>3. Once these are ALL published a public ledger is published with everyone&#x27;s encrypted text.<p>4. Once the ledger is published, everyone must reveal their private key for the published OTP.<p>5. With all the passwords now revealed, they are all decrypted all at once.<p>The 33 bits of the plaintext OTP&#x27;s are then applied via xor operations to arrive at the final random solution.<p>Since xor is commutative, if any of the OTP&#x27;s are random it can be considered that it is applied at the last step, and &quot;fully&quot; determines the final chosen number. In other words, if any - even a single one - of the OTP&#x27;s was random then the whole scheme is random, since it can be considered that that was the last one to be applied to the rest of the batch. (you can reorder xor operations with the same result). That means as an individual citizen, you &quot;fully determine&quot;, the final winner, and the same is true for every other citizen on an equal basis. It is guaranteed to be really as random as any of the OTP&#x27;s.<p>I got that far but then I got stuck.<p>Where this fails: if any of the passwords are not revealed then those can be withheld in order to influence the final result.<p>continued in a comment.

1 comment

logicallee3 个月前
Continued from submission... For example, imagine there are exactly 33 holdouts, the OTP&#x27;s<p><pre><code> 0000000000000000000000000000001 0000000000000000000000000000010 0000000000000000000000000000100</code></pre> and so forth. All of the holdouts could conveniently &quot;forget&quot; to reveal their passwords after commitment but, until all other passwords have been shared except the holdouts, and then selectively the specific holdouts can be revealed that result in the random result that is chosen by the attacker.<p>This would be possible if the attacker can control when the revealed passwords arrive and time it so that their revealed passwords are the last 33 passwords to be revealed. The attacker might have God-like visibility into network through which the passwords are revealed.<p>Any alternative, such as asking everyone to encrypt their passwords with the same public key, for which a central authority holds the private key and will reveal it all at once, breaks down because the central authority could leak it to coordinated attackers, so that the attackers know everyone&#x27;s private keys before they are revealed.<p>How can we get around the issue of holdouts, and solve this distributed random number scheme?<p>We want to be able to resist $10 trillion of network-level attacks including full control of the Internet that is used to submit commitments and reveals, including full control of the order of delivery of packets by a compromised Internet.<p>Proposed Solution:<p>------------------<p>Lotteries could require 100% participation, any holdout (someone failing to reveal their key at step 4) could result in the entire lottery being null and void, and the holdout being removed from the rerun of the lottery. However this could suffer from a coordinated attack, for example with a billion people entering the lottery, if there are a million holdouts they could cause a million lotteries to fail in a row, and that is too many lotteries to run.<p>What other way is there for a distributed Utopia to run a fair lottery where everyone has an equal chance of winning? Is there any truly distributed random cryptographic protocol that is not susceptible to control by holdouts?<p>[1] Neither has chatgpt: <a href="https:&#x2F;&#x2F;chatgpt.com&#x2F;share&#x2F;67bf5a3d-4710-800b-a4e2-456fb48d962b" rel="nofollow">https:&#x2F;&#x2F;chatgpt.com&#x2F;share&#x2F;67bf5a3d-4710-800b-a4e2-456fb48d96...</a> this is only a partial, and nonsense, solution. (hashes don&#x27;t make sense since they&#x27;re trivial to bruteforce, the entire hash-based answer is totally nonsensical, and beacons can be manipulated). a network-level overlord could just bruteforce everyone else&#x27;s hashes when they make them, and choose their OTP to be the one that gets to their chosen plaintext, and be last out the gate after everyone else has submitted theirs.<p>[2] <a href="https:&#x2F;&#x2F;claude.site&#x2F;artifacts&#x2F;cb0ac898-e5ad-42cf-a961-3c4bf8b527fb" rel="nofollow">https:&#x2F;&#x2F;claude.site&#x2F;artifacts&#x2F;cb0ac898-e5ad-42cf-a961-3c4bf8...</a>