Skip to content

Back to the catalog

Alg\{Ossa\}: Decentralized Secure Aggregation with Rotating Committees and Eventual Delivery
eprint.iacr.orgpaper

Alg\{Ossa\}: Decentralized Secure Aggregation with Rotating Committees and Eventual Delivery

AlgOssa is a decentralized secure aggregation protocol built on Ossa, a generic committee-aided, single-server construction for one-shot clients (following OPA and Willow, CRYPTO 2025). Ossa realizes secure aggregation with non-selective abort against a malicious server. AlgOssa adds Algorand-style sortition to rotate leaders and committees, bounds the chance of an honest server, and gives eventual delivery. Classical and post-quantum routes are evaluated.

TL;DR Presents a secure aggregation protocol that uses Algorand-style sortition to rotate committees and guarantees eventual delivery despite a possibly malicious server.
Document

What it is

AlgOssa is a preprint (ePrint 2026/2659, received 27 October 2026) by Xiangyu Su, Yuma Tamagawa, Mario Larangeira, Zengpeng Li and Keisuke Tanaka. It places a secure aggregation protocol, Ossa, inside an Algorand-style consensus backbone. Ossa follows the single-server, committee-aided model for one-shot clients used by OPA and Willow (CRYPTO 2025). It gives the standard secure aggregation functionality with non-selective abort against a malicious server, but leaves role selection open and gives no delivery guarantee. AlgOssa fills both gaps.

How it works

Each round, cryptographic sortition picks fresh potential leaders and verifier committees. The decryptor committee is refreshed from finalized chain state at key epochs. The server is chosen from among the potential leaders. The authors prove a lower bound on the probability that the chosen server is honest. From that bound, the chance that a round delivers a non-empty aggregate is at least a positive constant, so delivery is eventual across repeated rounds.

flowchart TD
    A[Round starts] --> B[Sortition: leaders and verifiers]
    B --> C{Server honest?}
    C -->|Yes, bounded below| D[Non-empty aggregate delivered]
    C -->|No| E[Round yields nothing]
    E --> A
    D --> F[Key epoch: refresh decryptors]

Preconditions / Affected

The design assumes an Algorand-style consensus chain as the base. Delivery is irregular, so the authors say it suits delay-tolerant statistical sensing. They say it suits federated learning only in the buffered asynchronous form, with persistent buffering and staleness control. It is not a fit for synchronous rounds with fixed timing.

Caveats

The abstract gives no concrete bound value, committee sizes or timings. It says the authors evaluated complete local classical rounds, and only demonstrated feasibility of the post-quantum route. There is no stated deployment or distributed benchmark. The work is a preprint with no peer review noted.

Organisations named here

  • AlgOssa
  • non-selective abort
  • Ossa
  • Willow

Technologies named here

  • OPA and Willow
  • Algorand
  • OPA

Techniques named here

  • Decentralized secure aggregation with rotating committees