On the (Im-)Possibility of Extending Coin Toss

Dennis Hofheinz1, Jörn Müller-Quade2, and Dominique Unruh2 1 CWI, Cryptology and Information Se urity Group, Prof. Dr. R. Cramer, D n i . o h i z i n e n s H f e n w . l 2 IAKS, Arbeitsgruppe Systemsi herheit, Prof. Dr. Th. Beth, Universität Karlsruhe, { u l e q u r h r . k . e m e l r , n u } i a u a d Abstra t. We onsider the ryptographi two-party proto ol task of extending a given oin toss. The goal is to generate n ommon random oins from a single use of an ideal fun tionality whi h gives m < n ommon random oins to the parties. In the framework of Universal Composability we show the impossibility of se urely extending a oin toss for statisti al and perfe t se urity. On the other hand, for omputational se urity the existen e of a proto ol for oin toss extension depends on the number m of random oins whi h an be obtained for free . For the ase of stand-alone se urity, i.e., a simulation based se urity de nition without an environment, we present a novel proto ol for un onditionally se ure oin toss extension. The new proto ol works for superlogarithmi m, whi h is optimal as we show the impossibility of statisti ally se ure oin toss extension for smaller m. Combining our results with already known results, we obtain a (nearly) omplete hara terization under whi h ir umstan es oin toss extension is possible.