To convey how an adversary can bias the coin, most often a simple commitment-based two party coin-tossing protocol is given, as in :
- Alice sends Bob the commitment $c = commit(x)$
- Bob sends Alice the bit $y$.
- Alice sends Bob $decommit(x)$, Bob verifies Alice actually chose $x$.
- Both compute result $r = x \oplus y$
It is said that Alice can place a bias of $1/4$ towards her choice after she receives Bob's bit $y$; if the result is what she wants, she plays along, if not, she aborts, forcing Bob to flip a coin on his own, which has $1/2$ chance of her choice coming up.
I understand the protocol and how a bias can be exerted. What eludes me is why such protocols are of interest:
Why is either party allowed to abort at will? The only point abortion makes sense is when Bob fails to verify, but they can abort whenever they want. If only such an abortion is allowed, the bias-by-abort scheme fails since Alice cannot abort upon seeing the result after the second step.
After Alice aborts, why does Bob flips a coin on his own? If the coin was flipped in case of a dispute, Bob can choose the way it suits him. If Bob could've just generated a random bit without having to prove anyone it is not biased, he would not have bothered with the protocol in the first place.
: https://eprint.iacr.org/2012/643.pdf - Section 1, Example 1.1