We provide a simple protocol for secret reconstruction in any threshold secret sharing scheme, and prove that it is
fair when executed with many
rational parties together with a small minority of
honest parties. That is, all parties will learn the secret with high probability when the honest parties follow the protocol and
the rational parties act in their own self-interest (as captured by a set-Nash analogue of trembling hand perfect equilibrium).
The protocol only requires a
standard (synchronous) broadcast channel, tolerates both early stopping and incorrectly computed messages, and only requires 2 rounds
of communication.
Previous protocols for this problem in the cryptographic or economic models have either required an honest majority, used
strong communication channels that enable simultaneous exchange of information, or settled for approximate notions of security/equilibria.
They all also required a nonconstant number of rounds of communication.
Keywords game theory - fairness - secret sharing
Earlier versions of this paper are [34,35].