The round complexity of verifiable secret sharing and secure multicast

The <italic>round complexity</italic> of interactive protocols is one of their most important complexity measures. In this work we study the exact round complexity of two basic secure computation tasks: <italic>Verifiable Secret Sharing</italic> (VSS) and <italic>Secure Multicast</italic>. <italic>VSS</italic> allows a dealer to share a secret among several players in a way that would later allow a unique reconstruction of the secret. It is a well-studied primitive, which is used as a building block in virtually every general protocol for secure multi-party computation. <italic>Secure multicast</italic> is perhaps the simplest non-trivial instance of a secure computation. It allows a dealer to securely distribute an <italic>identical</italic> message to all players in a prescribed subset <italic>M</italic>. Both types of protocols are parameterized by the number of players, <italic>n</italic>, and a <italic>security threshold</italic>, <italic>t</italic>, which bounds the total number of malicious players (possibly including the dealer). We focus on a standard setting of <italic>perfect information-theoretic security</italic>, where all players have access to secure point-to-point channels and a common broadcast medium. For both types of primitives we prove, using related techniques, tight tradeoffs between the round complexity and the achievable security threshold. Specifically, for the VSS problem we show: 2-round VSS is possible iff <italic>n</italic>>4<italic>t</italic>, where the ``if'' direction is realized by an <italic>efficient</italic> protocol. 3-round VSS is possible iff <italic>n</italic>>3<italic>t</italic>, where the ``if'' direction is realized by an <italic>inefficient</italic> protocol. 4-round <italic>efficient</italic> VSS is possible if <italic>n</italic>>3<italic>t</italic>. For the secure multicast problem we show: 2-round secure multicast is (efficiently) possible iff