I have started reading

I found the abstract of those these two work to be contraddicting.

  • Are we saying that exchange of secrets is possible and fair exchange is not without a trusted third party?
  • What is the difference of exchange of secrets or just fair exchange?
  • $\begingroup$ Does a definition of fair exchange help? $\endgroup$
    – Ella Rose
    Apr 28, 2017 at 21:17
  • $\begingroup$ The issue is with strong fairness, which asks that either both parties get their outputs or neither learns anything. In Rabin's protocol, one of the party (let's say Alice) learns her output first. Nothing forces her to send the next message which will allow for Bob to learn his output. $\endgroup$
    – lamontap
    Jan 10 at 20:22

1 Answer 1


If two parties exchange messages and we would like at the end of exchange either both parties can learn the secret or both parties can not, it is easy to prove this is impossible.

For any such exchange there is a last message, the sending party doesn't learn anything if we drop it and the other party must still be able to learn the secret. If continue we end up with a 0 message protocol and this obviously can't be done.

However the above proof falsely assumes at every step we are in a binary state of either can or can not find the secret. A more realistic model is we can always find the secret with some computational effort.

We can therefor have a protocol where in each round the computational cost is reduced for both sides slightly e.g by revealing part of a key protecting the secret. And providing proof in each round we are indeed compliant.

If one party breaks off the exchange early, they will have a slight advantage over the other party but won't be in a position where they got everything and the other side nothing.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.