Secret Sharing Schemes: A Short Survey

Secret Sharing 2

3742 Secret Sharing

Secret Sharing [Shamir79,Blakley79,ItoSaitoNishizeki87] Participants: P={P 1,…,P n } Access Structure   2 P (collection of sets of parties) A scheme realizes  if: Correctness Correctness: every authorized set B  can recover s Privacy Privacy: every unauthorized set B  cannot learn anything about s 4 P1P1 P2P2 PnPn Dealer s s1s1 r s2s2 snsn

Applications 5 Secure storage; Secure multiparty computation; Threshold cryptography; Byzantine agreement; Access control; Private information retrieval; Attribute-based encryption; General oblivious transfer…

Lecture Plan Introduction and motivation Constructions Secure protocols from secret sharing Lower bounds Conclusions 6

Shamir’s t-out-of-n Secret Sharing Scheme 7 Access structure:  = { A  P : |A|≥t } Scheme: –Input: secret s –Dealer chooses a random polynomial Q(x)=s+r 1 x+r 2 x 2 +…+r t-1 x t-1 –Share of P j : s j = Q(j) s

The Connectivity Access Structure Participants – edges in an undirected graph Minimal Authorized sets: paths from vertex v 1 to vertex v 2 Example: 8 P1P1 P4P4 P3P3 P6P6 P2P2 P5P5 v1v1 v2v2

The Connectivity Access Structure Participants – edges in an undirected graph Minimal Authorized sets: paths from vertex v 1 to vertex v 2 Example: 9 P1P1 P6P6 P5P5 v1v1 v2v2 Scheme: s  { 0,1} r 1 =s and r 2 = 0 choose a random bit r i for vertex v i Share of edge (v i,v j ) is r i  r j sr3sr3 r4r4 r3r4r3r4 v3v3 v4v4

A General Construction [ItoSaitoNishizeki87] Necessary condition: access structure is monotone. Also sufficient! 10 P1P1 P2P2 s P3P3 P4P4 P5P5 r3r3 r4r4 s s r2r2 r1r1 minimal sets {P 2,P 4 } {P 1,P 2 } {P 1,P 3,P 5 } s⊕r3 ⊕r4s⊕r3 ⊕r4 s⊕r2s⊕r2 s⊕r1s⊕r1

General Construction II: Linear Schemes Linear secret sharing schemes – use a linear mapping to share the secret. Equivalent to monotone span programs. linear algebraic model of computation [KarchmerWigderson93]. Nearly all known schemes are linear. 11

P2P2 P2P2 P1P1 P3P3 P4P The program accepts a set B iff the rows labeled by B span the target vector. Monotone Span Programs

P2P2 P2P2 P1P1 P3P3 P4P4 {P 2,P 4 } Monotone Span Programs

P2P2 P2P2 P1P1 P3P3 P4P4 {P 1,P 2 } Monotone Span Programs

s r2r2 r3r3 r4r P2P2 P2P2 P1P1 P3P3 P4P4 s+ r 2 +r 4 r2+r3r2+r3 r2+r3r2+r3 s+r 2 r3+r4r3+r4 = P2P2P1P3P4P2P2P1P3P4 Example s=1,r 2 =r 3 =0, r 4 = P2P2P1P3P4P2P2P1P3P4 Span Programs  Secret Sharing Span program accepts B iff B can reconstruct s

s r2r2 r3r3 r4r P2P2 P2P2 P1P1 P3P3 P4P4 s+r2+r4s+r2+r4 r2+r3r2+r3 r2+r3r2+r3 s+r 2 r3+r4r3+r4 = P2P2P1P3P4P2P2P1P3P4 {P 2,P 4 } 1000 s Span Programs  Secret Sharing

Construction III: Multi-Linear Schemes [BertilssonIngemarsson93,vanDijk97] Multi-linear secret sharing schemes – use a linear mapping to share the secret. Secret – Few field elements Equivalent to multi-target monotone span programs. 17

P1P1 P2P2 P3P3 P1P1 P2P2 P3P Accepts B iff rows labeled by B span the target vector Span Programs 0010 Accepts B iff rows labeled by B span all target vectors Multi-target

P1P1 P2P2 P3P3 P1P1 P2P2 P3P Span Programs  Secret Sharing 0010 Multi-target s1s1 s2s2 r3r3 r4r4 r3r3 s1+r3s1+r3 s 1 +2r 3 s2+r4s2+r4 2s 2 +5r 4 4s 2 +7r 4 = P1P1 P2P2 P3P3 P1P1 P2P2 P3P3

P1P1 P2P2 P3P3 P1P1 P2P Span Programs: Problem 0010 Multi-target s1s1 s2s2 r3r3 r4r4 r3r3 s1+r3s1+r3 s 1 +2r 3 s2+r4s2+r4 2s 2 +5r 4 = P1P1 P2P2 P3P3 P1P1 P2P P1P1 P2P2 P3P3 P1P1 P2P2 P3P3 r3r3 s1+r3s1+r3 s 1 +2r 3 s2+r4s2+r4 2s 2 +5r 4 4s 2 +7r 4 P1P1 P2P2 P3P3 P1P1 P2P2 P3P3

P1P1 P2P2 P3P3 P1P1 P2P Span Programs: Problem 0010 Multi-target s1s1 s2s2 r3r3 r4r4 r3r3 s1+r3s1+r3 s 1 +2r 3 s2+r4s2+r4 2s 2 +5r 4 = P1P1 P2P2 P3P3 P1P1 P2P2

P1P1 P2P2 P3P3 P1P1 P2P2 P3P Accepts B iff rows labeled by B span all the target vectors Span Programs: Corrected 0010 Multi-target Rejects B iff rows labeled by B do not span any target vector

P1P1 P2P2 P3P3 P1P1 P2P2 P3P Span Programs: Problem Multi-target s1s1 s2s2 r3r3 r4r4 r3r3 s1+r3s1+r3 s 1 +2r 3 s1+s2+r3s1+s2+r3 2s 2 +5r 4 4s 2 +7r 4 = P1P1 P2P2 P3P3 P1P1 P2P2 P3P3

P1P1 P2P2 P3P3 P1P1 P2P2 P3P Span Programs: Problem Multi-target s1s1 s2s2 r3r3 r4r4 r3r3 s1+r3s1+r3 s 1 +2r 3 s1+s2+r3s1+s2+r3 2s 2 +5r 4 4s 2 +7r 4 = P1P1 P2P2 P3P3 P1P1 P2P2 P3P3

P1P1 P2P2 P3P3 P1P1 P2P2 P3P Accepts B iff rows labeled by B span all the target vectors Span Programs: Corrected! 0010 Multi-target Rejects B iff rows labeled by B do not span any combination of target vectors

Linear vs. Multi-Linear Secret Sharing [SimonisAshikhmin98] ∃ access structure Does not have ideal linear scheme Has ideal multi-linear scheme Secret – 2 field elements [PendavinghvanZwam13] Another example [BeimelBenEfraimPadroTyomkin13] More examples Secret – p field elements (for any prime) 26

Lecture Plan Introduction and motivation Constructions Secure protocols from secret sharing Lower bounds Conclusions 27

Homomorphism of Linear Secret Sharing P4P4 P3P3 P1P1 P2P2 P2P2 r4r4 r3r3 r2r2 s y5y5 y4y4 y3y3 y2y2 y1y1 = P4P4 P3P3 P1P1 P2P2 P2P2 r’ 4 r’ 3 r’ 2 s’ y’ 5 y’ 4 y’ 3 y’ 2 y’ 1 = r 4 +r’ 4 r 3 +r’ 3 r 2 +r’ 2 s+s’ y5+y’5y5+y’5 y4+y’4y4+y’4 y3+y’3y3+y’3 y2+y’2y2+y’2 y1+y’1y1+y’1 =

29 Multiplicative Homomorphism of Linear Secret Sharing P4P4 P3P3 P1P1 P2P2 P2P2 r4r4 r3r3 r2r2 s y5y5 y4y4 y3y3 y2y2 y1y1 = P4P4 P3P3 P1P1 P2P2 P2P2 r’ 4 r’ 3 r’ 2 s’ y’ 5 y’ 4 y’ 3 y’ 2 y’ 1 = * PROTOCOL z1z1 z2z2 z3z3 z4z4 z5z5 Shares for s * s’ Access structure must be Q 2

Application: Computing a Sum 30

Lecture Plan Introduction and motivation Constructions Secure protocols from secret sharing Lower bounds Conclusions 31

Are There Efficient Secret Sharing Schemes? Every monotone access structure can be realized The known schemes for general access structures have shares of size ℓ · 2 O(n) n – number of participants ℓ – size of secrets in bits Best lower bound [Csirmaz94] : ℓ · n/log n Large gap! No significant progress made from 94 32

Are There Efficient Secret Sharing Schemes? 33

Techniques for Proving Lower Bounds Counting arguments Connected to counting the number of representable matroids Combinatorial arguments Cannot help – There are efficient weakly- private schemes Use entropy and information inequalities Proves ℓ · n/log n lower bound Information Inequalities with up to 5 variables cannot help Other Techniques? 34

08/30/2007IBM Crypto Seminar35 Lower Bounds for Linear Secret Sharing Schemes Explicit access structures [BabaiGalWigderson96,Gal98,GalPudlak03]: ℓ · n (log n). Technique: Access structure ⇒ Matrix M Rank(M) high ⇒ Size of MSP big Existential lower bounds: 2 (n). Counting arguments

Lecture Plan Introduction and motivation Constructions Secure protocols from secret sharing Lower Bounds Conclusions 36

37 Conclusions Secret sharing – useful in cryptography General constructions based on linear algebra Constructions are not efficient Large gap between lower & upper bounds Secret Sharing: A Survey, IWCC

38