Secret Sharing Protocols [Sha79,Bla79]

Slides:



Advertisements
Similar presentations
TWO STEP EQUATIONS 1. SOLVE FOR X 2. DO THE ADDITION STEP FIRST
Advertisements

You have been given a mission and a code. Use the code to complete the mission and you will save the world from obliteration…
Advanced Piloting Cruise Plot.
Chapter 1 The Study of Body Function Image PowerPoint
1 Copyright © 2010, Elsevier Inc. All rights Reserved Fig 2.1 Chapter 2.
By D. Fisher Geometric Transformations. Reflection, Rotation, or Translation 1.
and 6.855J Cycle Canceling Algorithm. 2 A minimum cost flow problem , $4 20, $1 20, $2 25, $2 25, $5 20, $6 30, $
Jeopardy Q 1 Q 6 Q 11 Q 16 Q 21 Q 2 Q 7 Q 12 Q 17 Q 22 Q 3 Q 8 Q 13
Jeopardy Q 1 Q 6 Q 11 Q 16 Q 21 Q 2 Q 7 Q 12 Q 17 Q 22 Q 3 Q 8 Q 13
Title Subtitle.
Exit a Customer Chapter 8. Exit a Customer 8-2 Objectives Perform exit summary process consisting of the following steps: Review service records Close.
My Alphabet Book abcdefghijklm nopqrstuvwxyz.
0 - 0.
DIVIDING INTEGERS 1. IF THE SIGNS ARE THE SAME THE ANSWER IS POSITIVE 2. IF THE SIGNS ARE DIFFERENT THE ANSWER IS NEGATIVE.
MULTIPLYING MONOMIALS TIMES POLYNOMIALS (DISTRIBUTIVE PROPERTY)
FACTORING ax2 + bx + c Think “unfoil” Work down, Show all steps.
Addition Facts
Year 6 mental test 5 second questions
Year 6 mental test 10 second questions
ZMQS ZMQS
Reductions Complexity ©D.Moshkovitz.
Solve Multi-step Equations
REVIEW: Arthropod ID. 1. Name the subphylum. 2. Name the subphylum. 3. Name the order.
Randomized Algorithms Randomized Algorithms CS648 1.
ABC Technology Project
Shadow Prices vs. Vickrey Prices in Multipath Routing Parthasarathy Ramanujam, Zongpeng Li and Lisa Higham University of Calgary Presented by Ajay Gopinathan.
1 Undirected Breadth First Search F A BCG DE H 2 F A BCG DE H Queue: A get Undiscovered Fringe Finished Active 0 distance from A visit(A)
VOORBLAD.
Quadratic Inequalities
1 Breadth First Search s s Undiscovered Discovered Finished Queue: s Top of queue 2 1 Shortest path from s.
Factor P 16 8(8-5ab) 4(d² + 4) 3rs(2r – s) 15cd(1 + 2cd) 8(4a² + 3b²)
Squares and Square Root WALK. Solve each problem REVIEW:
1..
© 2012 National Heart Foundation of Australia. Slide 2.
Lets play bingo!!. Calculate: MEAN Calculate: MEDIAN
Understanding Generalist Practice, 5e, Kirst-Ashman/Hull
Chapter 5 Test Review Sections 5-1 through 5-4.
GG Consulting, LLC I-SUITE. Source: TEA SHARS Frequently asked questions 2.
1 On c-Vertex Ranking of Graphs Yung-Ling Lai & Yi-Ming Chen National Chiayi University Taiwan.
Addition 1’s to 20.
25 seconds left…...
Slippery Slope
Complexity ©D.Moshkovits 1 Where Can We Draw The Line? On the Hardness of Satisfiability Problems.
H to shape fully developed personality to shape fully developed personality for successful application in life for successful.
Januar MDMDFSSMDMDFSSS
Week 1.
We will resume in: 25 Minutes.
©Brooks/Cole, 2001 Chapter 12 Derived Types-- Enumerated, Structure and Union.
Network Operations & administration CS 4592 Lecture 15 Instructor: Ibrahim Tariq.
PSSA Preparation.
VPN AND REMOTE ACCESS Mohammad S. Hasan 1 VPN and Remote Access.
Immunobiology: The Immune System in Health & Disease Sixth Edition
Immunobiology: The Immune System in Health & Disease Sixth Edition
CpSc 3220 Designing a Database
The Small World Phenomenon: An Algorithmic Perspective Speaker: Bradford Greening, Jr. Rutgers University – Camden.
Traktor- og motorlære Kapitel 1 1 Kopiering forbudt.
Interval Graph Test.
1 A Graph-Theoretic Network Security Game M. Mavronicolas , V. Papadopoulou , A. Philippou  and P. Spirakis § University of Cyprus, Cyprus  University.
Secret Sharing, Matroids, and Non-Shannon Information Inequalities.
Improving the Round Complexity of VSS in Point-to-Point Networks Jonathan Katz (University of Maryland) Chiu-Yuen Koo (Google Labs) Ranjit Kumaresan (University.
Secure Multi-party Computations (MPC) A useful tool to cryptographic applications Vassilis Zikas.
Round-Efficient Multi-Party Computation in Point-to-Point Networks Jonathan Katz Chiu-Yuen Koo University of Maryland.
The Round Complexity of Verifiable Secret Sharing
Ranjit Kumaresan (UMD) Arpita Patra C. Pandu Rangan (IITMadras)
On the Power of Hybrid Networks in Multi-Party Computation
Round-Optimal and Efficient Verifiable Secret Sharing
Presentation transcript:

Round-Optimal and Efficient Verifiable Secret Sharing Matthias Fitzi (Aarhus University) Juan Garay (Bell Labs) Shyamnath Gollakota (IIT Madras) C. Pandu Rangan (IIT Madras) Kannan Srinathan (IIIT Hyderabad)

Secret Sharing Protocols [Sha79,Bla79] Set of players P = {P1 , P2, … , Pn}, dealer D (e.g., D = P1). Two phases Sharing phase Reconstruction phase Sharing Phase D initially holds s and each player Pi finally holds some private information vi. Reconstruction Phase Each player Pi reveals (some of) his private information v’i on which a reconstruction function is applied to obtain s = Rec(v’1, v’2, …, v’n). Round-Optimal and Efficient VSS —TCC’06

Secret Sharing (cont’d) Dealer v1 v2 v3 vn Sharing Phase … Less than t +1 players have no info’ about the secret Reconstruction Phase Round-Optimal and Efficient VSS —TCC’06

Secret Sharing (cont’d) Dealer v1 v2 v3 vn Sharing Phase …  t +1 players can reconstruct the secret Secret s Reconstruction Phase Players are assumed to give their shares honestly Round-Optimal and Efficient VSS —TCC’06

Verifiable Secret Sharing (VSS) [CGMA85] Extends secret sharing to the case of active corruptions (corrupted players, incl. Dealer, may not follow the protocol) Up to t corrupted players Adaptive adversary Reconstruction Phase Each player Pi reveals (some of) his private information v’i on which a reconstruction function is applied to obtain s’ = Rec(v’1, v’2, …, v’n). Round-Optimal and Efficient VSS —TCC’06

Round-Optimal and Efficient VSS —TCC’06 VSS Requirements Privacy If D is honest, adversary has no Shannon information about s during the Sharing phase. Correctness If D is honest, the reconstructed value s’ = s. Commitment After Sharing phase, s’ is uniquely determined. Round-Optimal and Efficient VSS —TCC’06

Round-Optimal and Efficient VSS —TCC’06 Weak VSS (WSS) [RB89] Privacy If D is honest, adversary has no Shannon information about s during the Sharing phase. Correctness If D is honest, the reconstructed value s’ = s. Weak Commitment After Sharing phase, s’ is uniquely determined such that Rec(v’1, v’2, …, v’n)  {, s’}. Round-Optimal and Efficient VSS —TCC’06

Communication Model and Round Complexity Synchronous, fully connected network of pair-wise secure channels + broadcast channel. Round complexity: Number of communication rounds in the Sharing phase. Efficiency: Total computation and communication polynomial in n and size of the secret. Round-Optimal and Efficient VSS —TCC’06

Round-Optimal and Efficient VSS —TCC’06 Prior (Relevant) Work Perfect VSS possible iff n > 3t [BGW88, DDWY90] Round complexity of VSS [GIKR01] n > 4t: Efficient 2-round protocol n > 3t: No 2-round protocol exists Efficient 4-round protocol Inefficient 3-round protocol Round-Optimal and Efficient VSS —TCC’06

Round-Optimal and Efficient VSS —TCC’06 Our Contributions VSS: Efficient 3-round protocol for n > 3t WSS: Efficient 3-round protocol for n > 3t — round optimal Efficient 1-round protocol for n > 4t (1+ ) amortized-round VSS protocol for n > 3t Round-Optimal and Efficient VSS —TCC’06

Round-Optimal and Efficient VSS —TCC’06 Our Contributions VSS: Efficient 3-round protocol for n > 3t WSS: Efficient 3-round protocol for n > 3t — round optimal Efficient 1-round protocol for n > 4t (1+ ) amortized-round VSS protocol for n > 3t Round-Optimal and Efficient VSS —TCC’06

Round-Optimal and Efficient VSS —TCC’06 3-Round (n/3)-WSS Secret s Dealer Sharing Phase … v1 v2 v3 vn Reconstruction Phase Round-Optimal and Efficient VSS —TCC’06

Round-Optimal and Efficient VSS —TCC’06 3-Round (n/3)-WSS Secret s … v1 v2 v3 vn Secret s’ Reconstruction Phase Round-Optimal and Efficient VSS —TCC’06

3-Round (n/3)-WSS — Sharing Phase D selects a random bivariate polynomial F(x,y) of degree t in each variable, s.t. F(0,0) = s; sends F(x,i) = fi(x) and F(i,y) = gi(y) to Pi. Player Pi sends to Pj a random pad rij. Round 2: Pi broadcasts aij = fi(j) + rij bij = gi(j) + rji Pj broadcasts aji = fj(i) + rji bji = gj(i) + rij F(j,i) + r Round-Optimal and Efficient VSS —TCC’06

3-Round (n/3)-WSS — Sharing Phase D selects a random bivariate polynomial F(x,y) of degree t in each variable, s.t. F(0,0) = s; sends F(x,i) = fi(x) and F(i,y) = gi(y) to Pi. Player Pi sends to Pj a random pad rij. Round 2: Pi broadcasts aij = fi(j) + rij bij = gi(j) + rji Round 3: For each aij ≠ bji Pi broadcasts fi(j) Pj broadcasts gj(i) D broadcasts F(j,i) A player is said to be unhappy if his value does not match D’s value. If no. unhappy players > t, disqualify D. Pj broadcasts aji = fj(i) + rji bji = gj(i) + rij Round-Optimal and Efficient VSS —TCC’06

3-Round (n/3)-WSS — Reconstruction Phase Every happy player Pi broadcasts fi(x) and gi(y). Local computation: Every player constructs a consistency graph G over the set of happy players: there exists an edge between Pi, Pj  G iff fi(j) = gj(i) and gi(j) = fj(i). Every player constructs a set CORE as follows: Initially all nodes with degree at least n–t in G are in CORE. Players in CORE consistent with less than n–t players in CORE are removed. Repeat until no more players can be removed from CORE. Secret determined by the polynomial defined by any t+1 players from CORE. If |CORE| < n–t, the secret is . Round-Optimal and Efficient VSS —TCC’06

3-Round (n/3)-WSS — Proof Sketch Privacy: (D is honest) D distributes consistent information  any pair of honest players publish same mutual padded values. Randomness of pads leads to indistinguishability of adversary’s view under different secrets. Correctness: (D is honest) All honest players (at least n–t) are happy  no disqualification of D in Sharing Phase. They all end up in CORE, thus the secret reconstructed is s. Round-Optimal and Efficient VSS —TCC’06

3-Round (n/3)-WSS — Proof Sketch Weak Commitment: |CORE| < n – t: All honest players output . |CORE|  n – t: All players in CORE are consistent with a polynomial fixed at the end of the Sharing Phase: The n–2t honest happy players define a unique polynomial F’(x,y) (at the end of Sharing Phase). Every dishonest happy player in CORE is consistent with at least n–t players in CORE, of which n–2t  t+1 are honest  every dishonest happy player in CORE is also consistent with F’(x,y). Round-Optimal and Efficient VSS —TCC’06

(n/3)-WSS Round Optimality Based on impossibility of 3-round Weak Secure Multicast: P = {P1 , P2, … , Pn}; D  P holds input m; multicast set M  P. Privacy: If all players in M are honest, then adversary learns no information about m. Correctness: If D is honest, then all honest players in M output m. Weak Agreement: Even if D is dishonest, all honest players in M output a value in {m’, }. r-round WSS  r-round WSM Round-Optimal and Efficient VSS —TCC’06

Recall: 3-Round (n/3)-WSS — Sharing Phase D selects a random bivariate polynomial F(x,y) of degree t in each variable, s.t. F(0,0) = s; sends F(x,i) = fi(x) and F(i,y) = gi(y) to Pi. Player Pi sends to Pj a random pad rij. Round 2: Pi broadcasts aij = fi(j) + rij bij = gi(j) + rji Round 3: For each aij ≠ bji Pi broadcasts fi(j) Pj broadcasts gj(i) D broadcasts F(j,i) A player is said to be unhappy if his value does not match D’s value. If no. unhappy players > t, disqualify D. Round-Optimal and Efficient VSS —TCC’06

3-Round (n/3)-VSS — Sharing Phase D selects a random bivariate polynomial F(x,y) of degree t in each variable, s.t. F(0,0) = s; sends F(x,i) = fi(x) and F(i,y) = gi(y) to Pi. Player Pi selects random ri and starts (n/3)-WSS on ri using FiW(x,y). Round-Optimal and Efficient VSS —TCC’06

3-Round (n/3)-VSS — Sharing Phase D selects a random bivariate polynomial F(x,y) of degree t in each variable, s.t. F(0,0) = s; sends F(x,i) = fi(x) and F(i,y) = gi(y) to Pi. Player Pi selects random ri and starts (n/3)-WSSi on ri using FiW(x,y). Round 2: Pi broadcasts aij = fi(j) + FiW(0,j) bij = gi(j) + FjW(0,i) Concurrently, round 2 of (n/3)- WSSi takes place. Round-Optimal and Efficient VSS —TCC’06

3-Round (n/3)-VSS — Sharing Phase D selects a random bivariate polynomial F(x,y) of degree t in each variable, s.t. F(0,0) = s; sends F(x,i) = fi(x) and F(i,y) = gi(y) to Pi. Player Pi selects random ri and starts (n/3)-WSSi on ri using FiW(x,y). Round 2: Pi broadcasts aij = fi(j) + FiW(0,j) bij = gi(j) + FjW(0,i) Round 3: For each aij ≠ bji Pi broadcasts fi(j) Pj broadcasts gj(i) D broadcasts F(j,i) Concurrently, round 2 of (n/3)-WSSi takes place. Concurrently, round 3 of (n/3)-WSSi takes place. Round-Optimal and Efficient VSS —TCC’06

3-Round (n/3)-VSS — Sharing Phase D selects a random bivariate polynomial F(x,y) of degree t in each variable, s.t. F(0,0) = s; sends F(x,i) = fi(x) and F(i,y) = gi(y) to Pi. Player Pi selects random ri and starts (n/3)-WSSi on ri using FiW(x,y). Round 2: Pi broadcasts aij = fi(j) + FiW(0,j) bij = gi(j) + FjW(0,i) Round 3: For each aij ≠ bji Pi broadcasts fi(j) Pj broadcasts gj(i) D broadcasts F(j,i) A player is said to be unhappy if his value does not match D’s value. If no. unhappy players > t, disqualify D. Concurrently, round 2 of (n/3)-WSSi takes place. Concurrently, round 3 of (n/3)-WSSi takes place. Round-Optimal and Efficient VSS —TCC’06

3-Round (n/3)-VSS — Sharing Phase Local Computation: H = {happy players} – {players disqualified as WSS dealers} If |H| < n–t, disqualify D and stop. For Pi  H, if |H ∩ HiW| < n–t, remove Pi from H. Call the final set COREsh. If |COREsh| < n–t disqualify D and stop. Properties of COREsh: If D is honest, then COREsh contains all honest players  D is not disqualified during the Sharing phase. Every player in COREsh is consistent with n–t players in COREsh  At least t+1 honest players in COREsh (defining a unique polynomial FH(x,y)). Round-Optimal and Efficient VSS —TCC’06

3-Round (n/3)-VSS — Reconstruction Phase For each Pi  COREsh, run Rec. phase of (n/3)-WSSi, concurrently. Local computation: CORErec := COREsh CORErec := CORErec – {Pi :   (n/3)-WSSi } For each Pi  CORErec compute fi(j) = aij – FiW(0,j), 1≤ j ≤ n If fi(x) not a t-degree polynomial, remove Pi from CORErec. Obtain F’(x,y) by taking any t+1 polynomials fi(x) from CORErec; s’ := F’(0,0). Round-Optimal and Efficient VSS —TCC’06

3-Round (n/3)-VSS — Reconstruction Phase Properties of CORErec: At least n–2t ( t+1) honest players in COREsh  unique t-degree polynomial FH(x,y). Dishonest Pi in CORErec: WSSi succeeded; fi(j) lie on a t-degree polynomial f’i(x) ; F’iW(x,y) is … consistent with  t+1 honest players in CORErec  f’i(x) is consistent with FH(x,y). Privacy: The only difference with WSS protocol is the pads. Prove that aij = fi(j) + FiW(0,j) does not reveal any info’ about fi(j). Round-Optimal and Efficient VSS —TCC’06

Amortized VSS Round Complexity Say, m k-round sequential VSS protocols (e.g., MPC) Using “deferred commitment,” m+2 total rounds  1+ O(1/m) amortized-round VSS protocol Initial phase: Dealer(s) share random values r1, r2,…, rm using the given VSS protocol. Sharing Phase of jth VSS protocol: Broadcast correction term cj = sj – rj Correction: (two ways) In Reconstruction Phase each player computes sj = cj + rj. At the end of Sharing Phase every player Pi computes F*j(x,i) = Fj(x,i) + cj and F*j(i,y) = Fj(i,y) + cj Round-Optimal and Efficient VSS —TCC’06

Round-Optimal and Efficient VSS —TCC’06 Summary VSS: Efficient 3-round protocol for n > 3t WSS: Efficient 3-round protocol for n > 3t — round optimal Efficient 1-round protocol for n > 4t (1+ ) amortized-round VSS Round-Optimal and Efficient VSS —TCC’06

Round-Optimal and Efficient Verifiable Secret Sharing Matthias Fitzi (Aarhus University) Juan Garay (Bell Labs) Shyamnath Gollakota (IIT Madras) C. Pandu Rangan (IIT Madras) Kannan Srinathan (IIIT Hyderabad)