
Alg\{Ossa\}: Decentralized Secure Aggregation with Rotating Committees and Eventual Delivery
AlgOssa is a decentralized secure aggregation protocol built on Ossa, a generic committee-aided, single-server construction for one-shot clients (following OPA and Willow, CRYPTO 2025). Ossa realizes secure aggregation with non-selective abort against a malicious server. AlgOssa adds Algorand-style sortition to rotate leaders and committees, bounds the chance of an honest server, and gives eventual delivery. Classical and post-quantum routes are evaluated.
What it is
AlgOssa is a preprint (ePrint 2026/2659, received 27 October 2026) by Xiangyu Su, Yuma Tamagawa, Mario Larangeira, Zengpeng Li and Keisuke Tanaka. It places a secure aggregation protocol, Ossa, inside an Algorand-style consensus backbone. Ossa follows the single-server, committee-aided model for one-shot clients used by OPA and Willow (CRYPTO 2025). It gives the standard secure aggregation functionality with non-selective abort against a malicious server, but leaves role selection open and gives no delivery guarantee. AlgOssa fills both gaps.
How it works
Each round, cryptographic sortition picks fresh potential leaders and verifier committees. The decryptor committee is refreshed from finalized chain state at key epochs. The server is chosen from among the potential leaders. The authors prove a lower bound on the probability that the chosen server is honest. From that bound, the chance that a round delivers a non-empty aggregate is at least a positive constant, so delivery is eventual across repeated rounds.
flowchart TD
A[Round starts] --> B[Sortition: leaders and verifiers]
B --> C{Server honest?}
C -->|Yes, bounded below| D[Non-empty aggregate delivered]
C -->|No| E[Round yields nothing]
E --> A
D --> F[Key epoch: refresh decryptors]Preconditions / Affected
The design assumes an Algorand-style consensus chain as the base. Delivery is irregular, so the authors say it suits delay-tolerant statistical sensing. They say it suits federated learning only in the buffered asynchronous form, with persistent buffering and staleness control. It is not a fit for synchronous rounds with fixed timing.
Caveats
The abstract gives no concrete bound value, committee sizes or timings. It says the authors evaluated complete local classical rounds, and only demonstrated feasibility of the post-quantum route. There is no stated deployment or distributed benchmark. The work is a preprint with no peer review noted.
Organisations named here
- AlgOssa
- non-selective abort
- Ossa
- Willow
Technologies named here
- OPA and Willow
- Algorand
- OPA
Techniques named here
- Decentralized secure aggregation with rotating committees
Related in other

Rerandomizable Garbling for Arithmetic Circuits

