Ballot box with multiple parties. All can read it, or none can read it I am trying to create a decentralized moderation system for the game Diplomacy, a game for seven players. In each round of a face-to-face game, each player writes their moves on paper then puts it in a box; all moves are read at once. The game was popular as play-by-mail: you mail your moves to a magazine publisher, who aggregates all moves and publishes game updates to everyone. In each round of an online game, each player sends their moves to a third-party "moderator", who then aggregates the moves and relays all moves to all players. The players must agree beforehand to a third-party moderator.

I would like to create a decentralized system without the need for a moderator. Each player can run a web-accessible server. Each round, each player will broadcast their moves (encrypted somehow) to all other players. When all players have broadcasted their moves, only then can all players read the other players' moves.



Initially, I thought of using something like the Three-pass Protocol: Player A writes a message, puts it in a box with Padlock A, and sends it to Player B. Player B puts Padlock B on the box and returns it to Player A. Player A removes Padlock A and returns the box to Player B. Player B can now remove Padlock B and read the message.

The players would be arranged in a ring: Player A always passes messages to Player B, Player B always passes messages to Player C, etc. So each message ends up in a box with seven padlocks on it. Only when it has gone around the entire ring can all the players read the messages.

But this doesn't solve the problem of noncooperation: On the sixth pass, Player D can stop sending messages to Player E, read everyone else's moves, and not cooperate further.

Player D and Player F can also choose to cooperate with eachother, and keep Player E out of the loop. That would be bad for Player E.

In a game like Diplomacy, it is not acceptable to allow one player to read any other player's moves without all players reading all moves.



Another thought is for each player to privately send their moves, locked in a box, to each other player (via private-public keys). When a player receives the box, then that player broadcasts to everyone, "hey everyone, player X sent me a box which hashes to abc123!". When everyone finds that everyone else has received all other boxes, then they can swap them back. This allows some player to lie to everyone else, but the downside is "nobody gets anything".



I think I'm on the right track here, but I'm not sure. Is this a correct way of thinking about the problem? Has this already been done (I can't find another solution already)?
See malleability and commitment schemes.

You are apparently looking for a collusion-preserving implementation of simultaneous broadcast.

By letting each processor control at least one player and directing each processor to choose a random bit for each of its players and outputting the xor of all players' random bits, the resulting coin-flipping protocol is as fair as the system. $\:$ Thus, one smacks straight into this paper's impossibility result.

The ways I know of to get around that impossibility result are:

$\;$ time-lock puzzles, with which the amount of work needed for cooperating players

$\;$ to read the messages is "not too much more" than the amount of work needed for

$\;$ adversarial players to read the messages, and in both cases; the relevant work only

$\;$ needs a small amount of memory and is not (known to be feasibly) parallelizable

$\;$ partial fairness, so that when more than 1/3 of the players are cooperating

$\;$ (in particular, when there are only 2 players) and the number of possible messages is small,

$\;$ cooperating players get "not much less" information than adversarial players get

$\;$ having lots of moderators that only need to be contacted if a player stops participating

$\;$ before or during a reveal phase, each of whom is assigned a small positive integer weight

$\;$ (presumably less than the threshold I'll mention later in this text-block, otherwise there's no point

$\;$ in using more than one moderator), so that if [the sum of the weights assigned to adversarial

$\;$ moderators] is less than [the threshold chosen before the reveal phase begins] is less than or

$\;$ equal to [the sum of the weights assigned to the moderators who appear to be cooperating]]

$\;$ then the "All can read it, or none can read it" property holds

.
(A moderator that merely cannot be contacted or has lost its private key

is neither adversarial nor one who appears to be cooperating.)

To emphasize, even if all moderators are adversarial, the only thing they can do is let players

who stop participating violate the desired "All can read it, or none can read it" property.

In particular, each message must still be chosen independently of the other messages.

It may be that there are other ways around that impossibility result; in particular,

I don't see a reason why the 1/3 threshold should be critical for partial fairness.

Even if there aren't, it appears to me that one could combine the "partial fairness" option with the

"lots of moderators" option in a way that is at least as good as the latter but also provides partial fairness when the latter's inequalities are not too far off and the number of possible messages is small.

Note that I have no idea which of the three options I

described are compatible with being collusion-preserving.