Neat! i can see how this works for a two-player coin flip, but i'm not sure how one might generalize it for
n players.Notice how in Lloyd's coin-flip lottery, one of the
Pick transactions would need to be chosen arbitrarily by Alice. Bob might be able to claim the output of the Pick TX depending on his choice of bit, and depending which Pick transaction Alice chose.The problem with protocols that involve more than 2 agents is that everyone has to assume everyone else is colluding with each other. If you add a third player (Carol) who also receives an oblivious signature from Alice, then how can Bob be sure that Carol isn't colluding with Alice? If the two collude, then Carol can simply tell Alice which
Pick transaction to publish so that Carol wins the 3-way lottery, thus taking Bob's money.For an
n-player lottery to work fairly, it has to be impossible for anybody to predict or dictate the outcome in advance, as long as at least one player is honest.reply
Ok, I am shooting from the hip here quickly (so what follows could very well be wrong), but let's try this:
-
do you see how it is easy to extend a 1 of 2 oblivious transfer (oblivious signing in our case) to a 1 of n?
-
if so, then Alice funds the output with amount
Uand can sell sell a ticket to each Bob for an amount slightly more thanU / n(it is slightly more so that, in expectation she can earn a profit). -
if one of the Bob's wins they will, naturally, move/claim the utxo
-
if more than one Bob wins, they will have a fee fight
I think for large enough
n and slow enough ticket sales, these issues are surmountable, no?
Footnotes