today , political and commercial entities are increasingly engaging in sophisticated cyber - warfare to damage , disrupt , or censor information content  . in designing anonymous communication services ,there is a need to ensure reliability even against very powerful types of adversaries .such adversaries can monitor large portions of networks and control a certain fraction of the parties to run sophisticated _ active _ attacks such as jamming , corruption , and forging , as well as simple _ passive _ attacks such as eavesdropping and non - participation .  in this paper , we focus on the problem of secure anonymous broadcast , where a set of parties want to anonymously send their messages to all parties .anonymous broadcast is an important tool for achieving privacy in several distributed applications such as anonymous communication  , private information retrieval  , secure auctions  , and multi - party computation ( mpc ) .our goal is to design a decentralized anonymous broadcast protocol that scales well with the number of parties and is robust against an active adversary .one motivating application for this protocol is a decentralized version of twitter that enables provably - anonymous broadcast of messages .one challenging problem with most anonymity - based systems is resistance against _ traffic - analysis_. a global adversary can monitor traffic exchanged between parties to link messages to the their corresponding senders .such a powerful adversary was assumed to be unrealistic in the past but it is believed to be realistic today especially if the service provider is controlled or compromised by a state - level surveillance authority  .unfortunately , well - known anonymous services such as crowds  and tor  are not secure against traffic analysis attacks .two widely - accepted architectures for providing general anonymity against an active adversary are _ mix networks ( mix - nets ) _ and _ dining cryptographers networks ( dc - nets ) _ , both of which were originally proposed by chaum  .mix - nets require semi - trusted infrastructure nodes and are known to be vulnerable to traffic analysis and active attacks  .dc - nets  , on the other hand , provide anonymous broadcast protocols among a group of parties without requiring trusted parties .the core idea of dc - nets is that a protocol for multi - party computation can be used to perform sender and receiver anonymous broadcast .for example , if party wants to broadcast a message anonymously , then all other parties participate in a multi - party sum with input zero , while party participates with input .all parties learn the sum , which is while all inputs remain private .this ensures that no party can trace the output message to its input , keeping anonymous .although dc - nets are provably - secure against traffic analysis , they face several challenges .first , a reservation mechanism is required to schedule which party is broadcasting without compromising the anonymity of the sender .second , dc - nets are susceptible to collisions , which degrade throughput. a jamming adversary may even use collisions to render the channel useless by continuously transmitting in every round .third , typical dc - nets are not scalable given that the bit complexity required to anonymously broadcast a single bit among parties is .state - of - the - art approaches that address some of these challenges include  .the majority of these methods scale poorly with network size , rendering them impractical for large networks .recently , zamani et al . proposed the first anonymous broadcast protocol where each party sends bits to broadcast a bit among parties .their protocol uses multi - party computation to achieve full anonymity and logarithmic - size groups of parties to achieve communication and computation costs .unfortunately , their protocol has polylogarithmic rounds of communication and is not practical due to large logarithmic factors hidden in the complexity notation .  to the best of our knowledge ,every sender and receiver anonymous broadcast protocol that does not rely on a trusted party consists of at least three steps .  1 .* input : * initially , each party holds a message .the party distributes its message or a representation of it among all or a subset of parties .this step requires sending messages .* multi - party shuffling : * all or a subset of parties participate in a multi - party protocol to obliviously generate a random permutation of the sequence of message they hold .output : * all or a subset of parties holding a sequence of messages broadcast them to all parties .this step requires sending messages for delivering shuffled messages .since much can not be done to improve the cost of the output phase , we will mainly focus on the multi - party shuffling step in this paper .multi - party shuffling can be used as a black - box in multi - party computation problems .boyle et al . use oblivious shuffling to randomly choose inputs for a sublinear function evaluation , where a function is evaluated over inputs chosen uniformly at random in the presence of an active adversary .laur et al . and goodrich et al . describe how multi - party shuffling can be used for implementing oblivious database operations and oblivious storage .  our model .: :  in this paper , we consider a network of parties whose  identities are common knowledge .we assume there is a private and  authenticated communication channel between every pair of parties and  the communication is _synchronous_. our protocol does not require the  presence of any trusted third party , and we do not assume the  existence of a reliable broadcast channel .we assume   of the parties are controlled by an  _ active _ adversary , for some positive constant .we assume our adversary is _ computationally unbounded _ and is actively  trying to prevent the protocol from succeeding by attacking the  privacy of the parties , and the integrity of communications , by  attempting to corrupt , forge , or drop messages .we say that the  parties controlled by the adversary are _ dishonest _ and that the  remaining parties are _ honest _ meaning that they strictly follow our  protocol .we finally assume that the adversary is _ static _ meaning  that it must select the set of dishonest parties at the start of the  protocol .   in this paper, we design a decentralized protocol for anonymous communication that is secure against an active adversary . our protocol is efficient and scales well with the number of parties .moreover , our protocol is load - balanced meaning that each party handles a roughly equal amount of communication and computation .we use techniques from multi - party computation , where a set of parties , each having a secret value , compute a known function over their inputs , without revealing the inputs to any party .  recently , boyleet al . and dani et al . proposed scalable solutions to general mpc .unfortunately , both of these protocols are not practical due to large logarithmic and constant factors in their communication / computation costs . moreover , the protocol of boyle et al .is not load - balanced making it hard to be used in settings like mobile networks where the parties have limited resources . despite their inefficiency , we are inspired by and to achieve scalability by performing local communications and computations in logarithmic - size groups of parties called _ _quorum__s , where the number of dishonest parties in each quorum is guaranteed not to exceed a certain fraction .using quorums and by simplifying much of their work , we develop an efficient multi - party shuffling protocol for anonymizing user inputs .our protocol is provably - secure as it is based on a formal security framework , which follows from the security of mpc .we show that the anonymity achieved by this method is , in particular , resistant to traffic analysis. we also provide provable anonymity against _ a priori _ knowledge that an adversary might have regarding the potential communicating parties .moreover , unlike the majority of previous work which rely on centralized trusted servers , our protocol is fully - decentralized and does not require any trusted party .our protocol has polylogarithmic communication and computation costs with respect to the number of parties .we prove the following main theorem in section [ sec : security - proofs ] .[ thm : main ] consider parties in a fully connected network with private channels where each party has a message to send to all parties .there exists an unconditionally - secure -party protocol such that if all honest parties follow the protocol , then with high probability , for and sufficiently large . ]:  each honest party sends its message to all parties anonymously .the protocol tolerates up to malicious parties , for some positive constant .each party sends bits and computes operations for shuffling messages notation is used as a variant of the big - o notation that ignores logarithmic factors .thus , means for some . ] .0.69999999999999996  each party sends bits and computes operations for delivering one anonymous bit .the protocol has rounds of communication .protocol overview .: :  in our protocol , parties participate in a mpc to  jointly compute a shuffling function that randomly permutes their  messages .then , the results are broadcast to all participating  parties .more specifically , our protocol builds a set of quorums in a  one - time setup phase and then , uses the quorums in the online phase  for shuffling input messages .we represent the desired shuffling  function by an arithmetic circuit , where the computation of each gate  is assigned to a quorum .then , we evaluate the circuit level - by - level ,  passing the outputs of one level as the inputs to the next level .once  the local computation is finished in each quorum , the result is  forwarded to the next quorum via one - to - one communication with parties  of the next quorum . finally , at the highest level , the shuffled  messages are computed and sent to all parties .one technique for randomly shuffling a set of messages in a multi - party setting is to assign to each message a uniform random value and then , obliviously sort the messages according to the random values .one issue with this technique is that if the randoms are not distinct ( i.e. , there is a _ collision _ ) , then the resulting distribution deviates from the uniform distribution . unfortunately , this gives the adversary some advantage to map the inputs to outputs and thus , break the anonymity .more formally , let be the number of messages and  ] .also , let denote the additive group of integers modulo a prime .in this section , we review the definitions of standard basic tools used throughout the paper .verifiable secret sharing . : :  an _ -secret sharing _scheme , is a protocol in which  a dealer who holds a secret value shares the secret among   parties such that any set of parties  can not gain any information about the secret , but any set of at least   parties can reconstructs it .an  _ -verifiable secret sharing ( vss ) _ scheme is an  _ -secret sharing scheme with the additional  property that after the sharing phase , a dishonest dealer is either  disqualified or the honest parties can reconstruct the secret , even if  shares sent by dishonest parties are spurious . in our protocol , we use  the constant - round vss protocol of katz et al .  that is based  on shamir s secret sharing scheme  .this result is described in  theorem [ thm : katz - vss ] .[ thm : katz - vss]_ _ there exists a synchronous linear _-vss scheme for that is perfectly - secure against a static active adversary .the protocol requires one broadcast and three rounds of communication .  for practical purposes, one can use the cryptographic vss scheme of kate et al . called _ evss _ ( stands for efficient vss ) , which is based on shamir s scheme and the hardness of the discrete logarithm ( dl ) problem . since evss generates commitments over elliptic curve groups , it requires smaller message sizes than other dl - based vss scheme such as  .[ thm : evss]_ _ there exists a synchronous linear _-vss scheme for that is secure against a computationally - bounded static adversary .in worst case , the protocol requires two broadcasts and four rounds of communication .quorum building .: :  a _ good quorum _ is a set of parties that  contains a majority of honest parties .king et al . showed that  a _ byzantine agreement ( ba ) _ protocol can be used to bring all parties  to agreement on a collection of good quorums .+  in this paper , we use the fast ba protocol of  braud - santoni et al . to build good quorums .+  [ thm : quorum - building]_ _ there exists a constant - round  unconditionally - secure protocol that brings all good parties to  agreement on good quorums with high probability . the  protocol has amortized communication and  computation complexity ,  and it can tolerate up to malicious  parties .secure broadcast .: :  in the malicious setting , when parties have only access to secure  pairwise channels , a protocol is required to ensure secure ( reliable )  broadcast .such  a broadcast protocol guarantees all parties receive the same message  even if the broadcaster ( dealer ) is dishonest and sends different  messages to different parties .it is known that a ba protocol can be  used to perform secure broadcasts .+  in our protocol , we use the ba algorithm of braud - santoni et  al . to perform secure broadcasts .  +  _ [ thm : broadcast] _ there exists a constant - round  unconditionally - secure protocol for performing secure broadcasts among   parties .the protocol has   amortized communication and computation complexity , and it can  tolerate up to malicious parties . sorting networks .: :  a _ sorting network _ is a network of _each comparator is  a gate with two input wires and two output wires .when two values  enter a comparator , it outputs the lower value on the top output wire ,  and the higher value on the bottom output wire .ajtai et al .  describe an asymptotically - optimal depth  sorting network . however , this network is not practical due to large  constants hidden in the depth complexity .leighton and plaxton   propose a practical _probabilistic sorting circuit _ that sorts with  very high probability meaning that it sorts all but   of the possible input  permutations , where ,  for any constant .for example , for   and , we get . while  this circuit is sufficient for us to prove our main results  ( theorem [ thm : main ] ) , one can instead use the  -depth sorting network of batcher   for sorting all permutations at the expense of   protocol latency .secure comparison .: :  given two linearly secret - shared values ,  nishide and ohta  propose an efficient protocol for computing a  sharing of such that   .their protocol has   rounds and requires invocations of a secure  multiplication protocol , where is the bit - length of  elements to be compared .we refer to this protocol by .we also  describe a fast multiplication protocol to be used along with the  comparison protocol of for implementing fast comparator gates .share renewal .: :  in our protocol , a shuffling circuit is securely evaluated .each gate  of the circuit is assigned a quorum and the parties in   are responsible for comparison of secret - shared  inputs .then , they send the secret - shared result to any quorums  associated with gates that need this result as input .let   be one such quorum . in order to secret - share  the result to without revealing any  information to any individual party ( or to any coalition of dishonest  parties ) , a fresh sharing of the result must be distributed in   . to this end, we use the share renewal  protocol of herzberg et al . . to update a shared value   defined over a degree polynomial   ,the protocol generates a degree   random polynomial such that   .the new polynomial   is then computed from   . since  , the new polynomial   defines a fresh sharing of .combined with the vss scheme of theorem [ thm : katz - vss ] ( or  theorem [ thm : evss ] ) , this protocol is secure against an active  adversary ( with ) , takes constant number of rounds ,  and requires each party to send field elements .we refer to this protocol by throughout this paper .in this section , we describe our protocol for anonymous broadcast .consider parties each having a message , for a prime and all ] .the protocol then uses a shuffling circuit that is based on the sorting network of leighton and plaxton  to sort the set of pairs according to their first elements .we later show that this functionality randomly permutes the set of inputs .  in our protocol , we denote the shuffling circuit by , which has gates .each gate is essentially a comparator gate and is denoted by , for . ] .we want to prove that the probability of being equal to is .in general , for any $ ] , if and only if is the -th smallest element in conditioned on knowing the smallest elements , which happens with probability .thus , the probability that is   in the random generation step of protocol [ pro : main ] , it is possible that two or more input quorums choose the same random elements from . in this situation, we say a _ collision _ happens .collisions reduce the level of anonymity our protocol guarantees because the higher the probability of collisions , the higher the chance the adversary is given in guessing the correct sequence of inputs .on the other hand , we observe that if the field size ( i.e. , ) is sufficiently large , then the probability of collisions becomes overwhelmingly small .lemma [ lem : collision ] gives a lower bound on such that collisions are guaranteed to happen with negligible probability .[ lem : collision ] let be the field of random elements generated in the random generation step of protocol [ pro : main ] .the probability there is a collision between any two parties is negligible if , for some .based on theorem [ thm : quorum - building ] , all input quorums are good . based on the correctness of , all elements generated by the input quorums in the random generation step of protocol [ pro : main]are chosen uniformly at random and independent of all other random elements generated throughout the protocol .let and be two parties and and be the random values assigned to them respectively by their corresponding input quorums .the probability that is .let be the following indicator random variable and be a random variable giving the number of collisions between any two parties , using the linearity of expectations , we want to find an upper bound on the probability of collisions using the chernoff bound defined byto ensure that no collision happens with high probability , we need to have while , for any .choosing and solving the inequalities for we get      since , solving this for gives the bound and .to study the feasibility of our scheme and compare it to previous work , we implemented an experimental simulation of our protocol and three other protocols which can be used for shuffling inputs randomly ( with traffic - analysis resistance ) in the same setting .these protocols are due to dani et al . , boyle et al . , and zamani et al . . to the best of our knowledge ,these protocols have the best scalability with respect to the network size among other works described in the literature for the same setting .since the protocols of and are general mpc algorithms , we use them for running our shuffling technique described in section [ sec : protocol ] .the protocol of is a jamming - resistant version of dc - nets that scales better than other dc - net protocols  .we stress that we are interested in evaluating our protocols for large network sizes and hence , our choice of protocols for this section is based on their scalability for large s .one may find other protocols in the literature that perform better than the protocols of our choice for small s .we run our protocol for inputs chosen from with a 160-bit prime for getting about 80 bits of security .we set the parameters of our protocol in such a way that we ensure the probability of error for the quorum building algorithm of is smaller than . for the sorting circuit , we set to get for all values of in the experiment .clearly , for larger values of , the error becomes superpolynomially smaller , e.g. , for , we get . for all protocols evaluated in this section ,we assume cheating ( by malicious parties ) happens in every round of the protocols .this is essential for evaluating various strategies used by these protocols for tolerating active attacks .figure [ fig : plots ] illustrates the simulation results obtained for various network sizes between and ( i.e. , between 32 and about 1 billion ) . to better compare the protocols , the vertical and horizontal axis of the plotare scaled logarithmically .the -axis presents the number of parties and the -axis presents the number of kilobytes sent by each party for delivering one anonymous bit . in this figure , we report results from three different versions of our protocols .the first plot ( marked with circles ) belongs to our unconditionally - secure protocol that uses the perfectly - secure vss scheme of katz et al .the second plot ( marked with stars ) represents our computationally - secure protocol which uses the cryptographic vss of kate et al .the last plot ( marked with diamonds ) shows the cost of the cryptographic protocol with amortized ( averaged ) setup cost . to obtain the amortized plot, we run the setup phase of protocol [ pro : main ] once and then used the setup data to run our online protocol 100 times .the total number of bits sent was then divided by 100 to get the average communication cost . to achieve better results, we also generated a sufficient number of random triples in the setup phase .then , the triples were used by our multiplication subprotocol in the online phase to multiply secret - shared values efficiently .we observe that our protocols ( even the unconditional version ) perform significantly better than the other protocols .for example , for ( about 1 million parties ) , the amortized protocol requires each party to send about 64 kb of data per anonymous bit delivered ( about 8 mb for our crypto version and about 64 mb for our unconditional version ) while the protocols of , , and each send more than one terabytes of data per party and per anonymous bit delivered .we described an anonymous broadcast protocol that is fully decentralized and tolerates up to active faults .moreover , our protocol is load - balanced and can tolerate traffic - analysis attacks .the amount of information sent and the amount of computations performed by each party scales polylogarithmically with the number of parties .the scalability is achieved by performing local communications and computations in groups of logarithmic size and by relaxing the latency requirements .several open problems remain .first , can we decrease the number of rounds of our protocol using a smaller - depth sorting circuit ?for example , since our protocol sorts uniform random numbers , it seems possible to use a smaller depth non - comparison - based sorting circuit like bucket sort .second , can we improve performance even further by detecting and blacklisting parties that exhibit adversarial behavior ?finally , can we adopt our results to the asynchronous model of communication ?we believe that this is possible for a suitably chosen upper bound on the fraction of faulty parties .in this section , we prove the correctness and secrecy of our protocols .   we have already showed the correctness of the and now prove the secrecy of the algorithm .we first define -secrecy , a property required for the proof of secrecy .* [ -secrecy ] * a secret - shared value defined over a polynomial is said to have _-secrecy _ if and only if  1 .-private _ meaning that no set of at most parties can compute , and 2 .-resilient _ meaning that no set of or less parties can prevent the other remaining parties from correctly reconstructing .  [ lem : evssprops ] the shamir s secret sharing scheme has the following properties .  1.  a sharing defined over a polynomial of degree has -secrecy if the adversary has less than of the shares .2 .  let and be independent random polynomials of degree and that correspond to sharings with -secrecy and -secrecy respectively . is a polynomial of degree that corresponds to a sharing with -secrecy .3 .  let and be polynomials of degree that correspond to two sharings both with -secrecy . is a polynomial of degree that corresponds to a sharing with -secrecy .the first property follows from the definition .the second property is correct due to the linearity shamir s scheme . without loss of generality ,let . intuitively ,if we assume that the sharing defined by does not have -secrecy . then , parties compute .thus , they can find ( or similarly prevent others from learning ) .this contradicts with the fact that corresponds to a sharing with -secrecy . for a complete proof ,we refer the reader to claim 3.4 of .the third property is correct because considering an arbitrary holding two shares and on polynomials and respectively , learns nothing from other than what is revealed from and since computes it locally .so , the resulting shared value also has -secrecy .[ lem : multiply - secrecy ] let and be two secret - shared values both with -secrecy and .the sharing has -secrecy .  in the first step of , algorithm creates two shared values and that correspond to degree polynomials .lemma [ lem : evssprops ] proves that and both have -secrecy . for each party based on lemma [ lem : evssprops ], defines a new sharing that is on a polynomial of degree and has -secrecy .moreover , and both are on polynomials of degree and have -secrecy .thus , based on lemma [ lem : evssprops ] , defines a new sharing that is on a polynomial of degree and has -secrecy .[ lem : multiply ] given two secret - shared values and , the protocol _ correctly returns a shared value such that ._  follows from the proof of .   in this section, we prove our main theorem ( theorem [ thm : main ] ) .we prove in the real / ideal world model as described by canetti  .first , we consider the protocol in an ideal model . in this model ,all parties send their input to a trusted party who computes the shuffling circuit .then , it sends the result to all parties .let be the sequence of inputs and be the sequence of sorted inputs according to the random numbers associated with them . recall that we have at least honest parties .based on lemma [ lem : permutation ] and conditioned on the event that no collision happens with high probability ( lemma [ lem : collision ] ) , the elements of that correspond to honest parties can be any permutation of the elements of honest parties in .in other words , the probability that the adversary can successfully map to is less than which guarantees -anonymity ( i.e. , full anonymity ) .protocol [ pro : main ] is the realization of the above ideal model .the real model computes the circuit in a multi - party setting .we prove this realization is correct and secure .: :  the correctness and secrecy follows from the proof of  theorem [ thm : quorum - building ] .input sharing .: :  the correctness and secrecy follows from the proof of the vss scheme  used ( ) . after this step, each input quorum   has a correct sharing of s  input .this is the base case for our proof of circuit computation  step**. * * random generation .: :  the correctness and secrecy follows from the proof of the algorithm . circuit computation . : :  _ correctness . _we prove by induction in the real / ideal model .the  invariant is that if the input shares are correct , then the output of  each gate is equal to the output when the gate is computed by a  trusted party in the ideal model , and the result is shared between  parties of the quorum correctly . for the base case ,note that the  invariant is true for input gates .induction step is based on the  universal composability of and .moreover , based on the correctness of , the output resharing step  generates new shares without changing the output .+  _ secrecy ._ we prove by induction .the adversary can not obtain any  information about the inputs and outputs during the computation of  each gate of the circuit .let , and   be two quorums involved in the computation of  a gate , where provides an input to the gate , and   computes the gate .consider a party   .let be the set of all shares   receives during the protocol .we consider two cases .first , if , then elements of   are independent of the shares sends to   .moreover , elements of are  independent of the output of since   also re - shares its output(s ) .hence ,   reveals nothing about the inputs and outputs of the  gate .+  second , if , then the inductive  invariant is that the collection of all shares held by dishonest  parties in and does not give  the adversary any information about the inputs and the outputs . as the  base case , it is clear that the invariant is valid for input gates .the induction step is as follows .the adversary can obtain at most   shares of any shared value during the  computation step ; from dishonest parties in   and from dishonest parties in   . by the secrecy of the vss scheme , at least   shares are required for reconstructing the secret .  by the secrecy of and   ,when at most of the  shares are revealed , the secrecy of the computation step is proved  using universal computability of multi - party protocols .+  the gate computation step of protocol [ pro : main ] obliviously swaps the  pairs and   according to their first , i.e. , if ,  then this step outputs   and  .  otherwise , it outputs    and   .  in both cases ,the adversary remains oblivious of which output is  mapped to the first ( second ) input pair .+  let . based  on the correctness and security of ( see ) ,  if and only if and   , otherwise .also , the adversary does not learn  anything about and .if   , then based on equation [ eq : switching ] , the  linearity of the vss scheme , and the correctness and secrecy of  ( lemmata [ lem : multiply - secrecy ] and [ lem : multiply ] ) ,   , ,   , and   . otherwise ,   , ,   , and .output propagation .: :  the correctness and secrecy follows from the proof of the subprotocol  .we first compute the cost of each step of the protocol separately and then compute the total cost .let and be the communication and computation complexity of the vss subprotocol respectively when it is invoked among parties . as stated in theorem [ thm : katz - vss ] and theorem [ thm : evss ] both vss protocols used in this paper take constant rounds of communication .* _ setup ._ the communication and computation costs are equal to those costs of the quorum building algorithm of theorem [ thm : quorum - building ] , which is for each party .this protocol takes constant rounds of communication . *_ input broadcast ._ the input broadcast step invokes the vss protocol times among parties .so , this step sends bits and performs operations .since the vss scheme is constant - round , this step also takes constant rounds .* _ random generation ._ it is easy to see that the subprotocol sends messages , performs , and has constant rounds .* _ circuit computation ._ the sorting network of leighton and plaxton  has gates .so , the communication cost of this step is equal to the communication and computation cost of running instantiations of and . requires invocation of which sends messages and computes operations .also sends messages and computes operations .hence , the circuit computation phase sends messages computes . since the sorting network has depth , and takes constant rounds , this steps takes rounds of communication . *_ output propagation ._ the costs are equal to the communication and computation costs of running invocations of which costs , plus sending the outputs to all parties , which costs .thus , this step costs .since is a constant - round protocol , this step takes constant rounds . *_ total . _ since , for a constant , and ) .using evss , we get .thus , protocol [ pro : main ] sends messages of size , computes operations for shuffling messages ( excluding the output step ) .this proves lemma [ lem : protocol - costs - evss ] . for lemma [ lem : protocol - costs ] , since , protocol [ pro : main ] sends bits and computes operations for shuffling messages .this proves lemma [ lem : protocol - costs ] . in both cases ,the output propagation step costs field elements .finally , in both cases , the protocol requires rounds of communication .this finishes the proof of theorem [ thm : main ] .beaver  describes a simple technique for generating uniform random secrets by adding shared values chosen uniformly at random by each party .such a random shared value is used in several parts of our protocol .the following subprotocol implements this technique .   in the malicious setting ,it is possible that dishonest parties send spurious shares during secret reconstruction phase . in evss ( used in the cryptographic version of our protocol ) , this is solved by asking all parties to broadcast a proof ( called _ witness _ ) during reconstruction to verify broadcast shares . in our protocol, reconstruction is postponed to after circuit computation .since the witnesses are generated in the sharing phase at the beginning of the computation , and the witnesses do not have necessary homomorphic properties , we can not use them in our reconstruction phase . instead, we correct corruptions using a bch decoding algorithm ( e.g. , the algorithm of berlekamp and welch  ) as in normal secret reconstruction  .this technique is also used in the vss of katz et al . and is implemented in the following subprotocol .

Abstract: in anonymous broadcast , one or more parties want to anonymously send messages to all parties . this problem is increasingly important as a black - box in many privacy - preserving applications such as anonymous communication , distributed auctions , and multi - party computation . in this paper , we design decentralized protocols for anonymous broadcast that require each party to send ( and compute ) a polylogarithmic number of bits ( and operations ) per anonymous bit delivered with rounds of communication . our protocol is provably secure against traffic analysis , does not require any trusted party , and is completely load - balanced . the protocol tolerates up to statically - scheduled byzantine parties that are controlled by a computationally unbounded adversary . our main strategy for achieving scalability is to perform local communications ( and computations ) among a logarithmic number of parties . we provide simulation results to show that our protocol improves significantly over previous work . we finally show that using a common cryptographic tool in our protocol one can achieve practical results for anonymous broadcast .


many complex networks that describe physical and biological systems are _ spatial _ in the sense that the nodes and edges are embedded into real space . a classic example is a transportation network , where stations correspond to nodes and where physical routes , such as roads or railways , correspond to network edges .some biological systems can also be thought of as transportation networks , for example transmitting electrical signals as is the case in collections of neurons or large - scale brain areas .the physical nature and spatial embedding of these systems often imposes costs on network wiring , making spatially long - distance connections improbable , and thereby constraining the network s topology .pressures that compete against wiring minimization include those driving network efficiency and robustness .tradeoffs between these desirable network features can differ across systems , and directly inform the design of optimal spatial distribution networks .biological distribution systems often grow and evolve in particularly interesting environments , and are indeed subject to the competing pressures of maintaining low material costs while achieving high efficiency and robustness .distribution systems can constitute an entire organism such as mycelial fungi in which the physical cords making up the organism can be represented as edges in a network , and in which branching , fusion , or end points among those cords can be represented as nodes in a network .these systems appear to strike an intermediate balance between cost and efficiency , enabling the organism to achieve competing goals .in addition , their network architecture changes and adapts over time in a way that tends to strengthen beneficial qualities . alternatively , distribution systems can form only a small part of an organism as is the case with cortical vasculature in which a pial network on the surface of the brain routes blood to penetrating arterioles , that in turn supply the underlying tissue . the pial surface network from rodent brainscan also be represented as a network , in which edges are vessels , and nodes represent either branching points among those vessels or a branch to a penetrating arteriole .this system forms a robust backbone of loops that can withstand damage and re - rout flow in the presence of occlusions .in both the fungal and vasculature systems , two - dimensional , planar distribution networks must transport fluid and nutrients efficiently in the face of constraints on the total amount of material that they can support .but in spite of these commonalities , the two networks exist and have evolved in inherently different environments , which may directly impact the sorts of evolutionary pressures that the network might experience .for example , the main role of the vasculature network is to transport blood to and from tissue that is part of a larger organism . on the other hand , for fungi, the network is the organism itself and is not necessarily constrained to serve or occupy a set region of space .moreover , brain vasculature resides in a controlled environment within the confines of the skull , whereas fungal networks live in and must adapt to often unprotected and varied environmental conditions .in addition , while directed flow and growth are known to be important in both vasculature and fungi , the mechanisms of long - distance transport of nutrients and maturation are different in the two systems .however , while the different roles , habitats and function of vasculature _ vs. _ mycelial systems should directly affect their network architecture , little is known about what these similarities or differences in structure might be .  to better understand the network configurations of different types of distribution systems , we utilize a set of methodologies to investigate both the _ physical _ and _ topological _ structure of mycelial fungi and rodent brain vasculature networks .we first uncover architectural commonalities in the network organization of both systems in the form of previously unidentified physical and topological scaling relationships that indicate hierarchical structure , and constrained spatial embedding .we also show that a theoretical model for distribution networks based on an optimization of transport efficiency in the face of fluctuations in load is able to reproduce the same design features , and thus provides a mechanism through which the empirically observed spatial and topological network organization might arise . yet despite these shared features of network structure , the two types of networks also display differences in the complexity of their architectures , suggesting that each system may be differently optimized for cost , efficiency , and robustness . by comparison to a set of spatially - informed null models , we explicitly examinethe _ relative _ relationships between these three quantities , and compare and contrast the associated tradeoffs across organisms .this analysis uncovers clear differences in how the two types of distribution networks balance competing goals .taken together , our work uncovers several common organizational principles across distribution systems , but also identifies critical distinctions that we hypothesize may be markers for the network s function and reflect the environment in which that function must be performed .we study the vasculature and fungi by considering both as _ complex networks _ , each represented by an adjacency matrix . in an unweighted network , if there is an edge between nodes and , and zero otherwise .this results in a binary connectivity matrix that captures the topological structure of the system . in spatial networks, there is often additional information due to the embedding of the network in physical space . here, the networks are embedded into two - dimensional space , so a given node has a spatial coordinate , , which allows the euclidean distance between nodes and , , to be computed .we examine the surface vasculature from the neocortex of four rats and five mice , and three different species of mycelial fungi , including _ phallus impudicus ( p.i . )_ , _ phanerochaete velutina ( p.v .1 ) _ ( grown from five inocula ) , _ phanerochaete velutina ( p.v .2 ) _ ( grown from a single inocula ) , and _ resinicium bicolor ( r.b . ) _ .an example of the entire vasculature of the middle cerebral artery from a rat brain is shown in fig .[ f : networks]a and an example mycelial network from _ p.i ._ is shown in fig .[ f : networks]b .more information about the data and network construction can be found in _methods _ and the _ s.i._.   an important question regarding biological transport systems is whether distribution networks of different types or from different organisms exhibit universal characteristics that allow for high functionality , and in particular , whether they achieve low - cost embeddings into physical space while maintaining topologies that support efficiency and robustness . to address these questions, we draw on fundamental insights from computer science developed in the 1960s in the context of very large scale integrated ( vlsi ) circuits . at that time, it was noted that a salient feature of computer chips whose abstract topologies enabled complex information flow and computational functions was _rentian scaling _ , and that this feature allowed for a low - cost embedding of the circuitry into physical space , facilitated by generally short wires .rentian scaling manifests in a power law relationship between the number of logic gates ( or nodes ) in a region of the network and the number of terminals ( or edges ) passing through that region , such that , where is the rent exponent .this principle of physical embedding has been observed in both artificial and natural intelligent systems , and in general , signifies hierarchical network structure .importantly , this scaling notion extends ideas of self - similarity ( such as the fractal dimension ) , which have otherwise been agnostic to spatial constraints .  to determine the presence or absence of such a principle in biological distribution networks , we place square boxes of different sizes over each network( see _ s.i ._ for details ) , and define to be the number of nodes within a box , and to be the number of edges crossing the boundary of a box ( fig [ f : prent]a , b ) . here, is a measure of the amount of flow that can pass into or out of a given region of the network , relative to the number of nodes , or distribution sites , within that region . after laying 5000 boxes over the network , we test for the scaling relationship where is the physical rent exponent .we observe that all networks considered show evidence of physical rentian scaling with ranging from to ( for examples of this relationship in vasculature and a mycelial system , see fig .[ f : prent]c , d , respectively ) .this finding implies that the spatial layout of the distribution networks is hierarchically organized , and suggests an efficient embedding of the network into physical space in terms of short node - to - node distances . while scaling was weakest in the mouse vasculature , for all networks , we found pearson s correlation coefficients of ; -value ( _ s.i . _ ) . to give context to the exponent values, we also report for several idealized network topologies in table [ t : rent_ideal ] , including a triangular lattice , a square lattice , a hexagonal lattice , and a minimum spanning tree ( averaged over several realizations ) .more details on the construction of each of these networks can be found in the _ s.i . _the vasculature networks have exponents greater than that of a minimum spanning tree or square lattice , and fall roughly in the same range of as a hexagonal lattice .many of the fungal networks also have exponent values similar to either a hexagonal or triangular lattice , but some are outside this range and it thus appears that they can not be explained by the physical architecture of the regular lattices ..physical and topological rentian scaling exponents for idealized networks . [ cols="^,^,^,^",options="header " , ]   [ t : trent_corrreduced ]   in order to better frame the scaling exponents of the real fungal and vasculature networks , we compared them to the exponents from a set of idealized topologies : triangular lattice , square lattice , hexagonal lattice , and minimum spanning tree .the values of and for each of these networks are reported in table [ t : rent_ideal ] of the main text .each lattice was constructed in a square region . for a proper comparison among the different types , we fixed the side of each unit ( triangle , square , hexagon ) to be equal to 1 , and fixed the number of nodes to be approximately the same for each lattice and on the same order as the mean number of nodes across all of the real data ( ) .( due to the different symmetries of each lattice , a perfect matching of the number of nodes was not possible while simultaneously ensuring the lattices were contained in a square region with equal side length ) .we thus used for the triangular grid , for the square grid , and for the hexagonal grid , which we found to be the best balance between having a near constant number of nodes across the different lattices while also being close to the mean number of nodes across all of the real networks .as described above , the topological partitioning was run 50 times for each network , and we report average values of the topological scaling exponent .physical and topological scaling was significant in all lattices , with pearson s correlation coefficients for the scaling relationship satisfying in each case .for the minimum spanning tree ( _ mst _ ) , we placed nodes ( the mean number of nodes used for the lattices ) at random in a box of equal side length .the spanning tree was then computed on that set of points using the method described below , in sec .[ s : null_models ] . since different instantiations of the node placements yield different spanning trees , we constructed 50 networks each from different random initialization of the nodes and reported average values of the physical rentian scaling exponent . in each case , the scaling was significant , with .the spanning trees do not exhibit topological scaling .in spatial networks , the nodes and edges exist in real euclidean space , and this physical embedding often has significant consequences for the network topology .for example , both the fungal and vasculature networks are _ planar _ ( or nearly planar ) , meaning that no edges cross . an important constraint for biological systems , in particular , may be the material and energetic costs associated with building and maintaining the physical structure of the network .but in competition is the fact that distribution networks must be able to move resources efficiently and be robust to damage . in order to gain an understanding of how the physical embedding of these networks might affect their architecture , and how distinct types of biological transport systems may differentially balance these pressures , we examined two planar null model networks : the minimum spanning tree ( _ mst _ ) and the greedy triangulation ( _ gt _ ) .the same or similar null models have previously been used in the analysis of fungal systems , , slime mould , ant networks of galleries , and urban street networks .the _ mst _ is a planar graph that connects all of the nodes in a network such that the sum of the total edge weights is minimum . by construction, the _ mst _ also contains the minimum number of edges needed to connect the network ( , where is the number of nodes ) . in the biological distribution networks studied here , the relevant edge weights are their physical lengths .therefore , we preserve the true geographic locations of all nodes in each network , and compute the _ mst _ on the matrix of euclidean distances , , between all node pairs .this network minimizes the total material cost of the network ( defined as the sum of all edge lengths ) :    and thus allows for testing the extent to which biological distributions systems are optimized for minimal wiring .we computed the _ _mst__s for all networks using the algorithm from the matlab boost graph library package .the _ gt _ lies on the opposite end of the spectrum , and is a maximally connected in terms of number of edges planar network .in particular , following , we compute _ _gt__s on the true node locations of all real networks by iteratively connecting pairs of nodes in ascending order of their distance , while maintaining that no edges be allowed to cross . as with the _ mst_ , this null model is also constructed under a geographical constraint , but since it contains many more edges , it represents an effective upper bound on the material cost of a planar network .thus , the _ gt _ can be used to gain an understanding of how the structure and capabilities of the true vasculature and fungi compare and contrast to networks where the total wiring cost is not optimized for .in this study , we investigate similarities and differences between two distinct types of biological distribution networks , in terms of how they are simultaneously optimized for cost , efficiency , and robustness .it is important to note that these measures have previously been used to quantify and compare the structure of fungal networks to low - cost and high - cost null models . here, we build on and extend prior analyses along this line of inquiry by examining the _ relative _ tradeoffs and relationships between this set of quantities , and most importantly , by comparing and contrasting these tradeoffs across organisms .in particular , we utilize a set of metrics that measure how close or far a given real network is from its two extreme null models , allowing for a direct quantification and comparison of the vasculature and fungi .below , we explain these quantities in more detail .we first note that in spatial networks such as those considered here , it is often _ physical _ rather than _ topological _ distances that are important . therefore , rather than the total number of edges , the material cost of a network is defined to be the sum of the lengths of all connections ( eq . [ eq : total_wiring ] ) , which provides an estimate of how expensive " the system is to construct and maintain .  along a similar line of reasoning, the shortest physical path between any two pairs of nodes and is taken to be the path that minimizes the sum of the edge lengths between those nodes .this is in contrast to the shortest topological path between the same nodes , which is that which connects and along the fewest number of edges , and thus neglects geographic information . to illustrate the differences , fig .[ f : wiring_eff_paths]a of the main text shows a toy network that highlights the shortest physical path and topological path between nodes and .knowing the shortest paths between all node pairs allows for the calculation of the average efficiency , , which is one way to quantify the ease of flow and communication between nodes of a network . denoting the length of the shortest physical path between and as , the average efficiency is given by   it is common practice to normalize the efficiency for a given network with nodes by its value for the corresponding fully - connected -node network .this results in the _ global efficiency _ , which we denote simply as .shortest path and efficiency measures have previously been used to study spatial networks such as ant galleries , street patterns in cities , the brain , slime mould , and fungal networks , but to the best of our knowledge , have not yet been used to study vasculature .another desirable feature for both natural and man - made networks is robustness . in other words ,how well - connected does the system remain when subjected to damage ?this is an important consideration in both the vasculature and fungal networks . in fungal networks ,damage can occur either from rough environmental conditions or from predation , and in vasculature , a common source of damage is from the formation of blood clots that block vessels and prevent flow , leading to stroke .previous work on fungal networks has shown that these organisms can achieve high levels of robustness to attack . in the study on rodent vasculature , interconnected loops were found to provide robustness to the backbone of surface vessels under edge deletion , and after occlusion to a surface arteriole , the backbone was able to re - rout blood flow and preserve the surrounding neuronal tissue .  in the main text, we assess differences in how the two different types of transport networks balance material costs with network robustness .in particular , we analyze how the size of the largest connected component evolves under the random removal of edges from the network , and take the robustness , , of the network to be the percentage of edges removed in order for the size of the largest connected component to drop to half of its original value . since we examine random edge removal , there can be some variation in the results when the same procedure is run again on the same network .we thus compute 20 times for each network in order to generate a representative ensemble average .we should also note that in our analysis , we consider the robustness of the entire vasculature network , rather than just the backbone considered in .this allows for a cleaner comparison between the vasculature and fungi , and takes into consideration the many nodes that branch directly off the backbone .the material cost , efficiency , and robustness are all useful quantities to consider in the context of biological networks , but when considered in isolation , it is difficult to understand how they are related to one another and how they compare across similar networks of different size or of completely different type . in order to better understand how the vasculature and fungal systems might be differentially optimized for each of these measures , we used a set of normalized quantities that captured how the wiring cost , efficiency , and robustness of a given network compared to the approximate limiting values for a network of the same size with the same node locations .in particular , following , this is quantified by defining a _ relative _ cost , efficiency , and robustness .the relative cost is given by  +  + where , , and denote the total wiring of the real , _ mst _ , and _ gt _ , respectively . in a similar manner ,the relative global efficiency , , is given by  +  + and the relative robustness is  +  + by definition , the _ mst _ is minimally wired , but since it contains no shortcuts between nodes , we also expect it to have high average shortest path and low efficiency .it is also clear that the removal of any edge will break the _ mst _ into disconnected components . on the other hand ,the _ gt _ is a highly expensive network to build , but this increase in material for the same set of nodes should improve the robustness as well as the efficiency of the network , since it allows for shortcuts between pairs of otherwise more distant nodes .thus , the _ mst _ is an effective lower bound for material cost , efficiency and robustness , and the _ gt _ is a good approximation for a planar network that achieves upper bounds with respect to the same measures .the relative measures are normalized between 0 and 1 for the _ mst _ and _ gt _ , respectively , and this normalization allows for a direct quantification of where the real distribution networks lie in comparison to the limiting values .furthermore , the relative quantities can be used to understand and properly contrast the tradeoffs between wiring , efficiency , and resistance to random damage between the vasculature and fungi .

Abstract: distribution networks from vasculature to urban transportation systems are prevalent in both the natural and consumer worlds . these systems are intrinsically physical in composition and are embedded into real space , properties that lead to constraints on their topological organization . in this study , we compare and contrast two types of biological distribution networks : mycelial fungi and the vasculature system on the surface of rodent brains . both systems are alike in that they must route resources efficiently , but they are also inherently distinct in terms of their growth mechanisms , and in that fungi are not attached to a larger organism and must often function in unregulated and varied environments . we begin by uncovering a common organizational principle  rentian scaling that manifests as hierarchical network layout in both physical and topological space . simulated models of distribution networks optimized for transport in the presence of fluctuations are also shown to exhibit this feature in their embedding , with similar scaling exponents . however , we also find clear differences in how the fungi and vasculature balance tradeoffs in material cost , efficiency , and robustness . while the vasculature appear well optimized for low cost , but relatively high efficiency , the fungi tend to form more expensive but in turn more robust networks . these differences may be driven by the distinct functions that each system must perform , and the different habitats in which they reside . as a whole , this work demonstrates that distribution networks contain a set of common , emergent design features , as well as tailored optimizations .