Robust Sharing of Secrets when the Dealer Is Honest or Cheating Tal Rabin 1994 Brian Fry COEN

Introduction •Verifiable Secret Sharing •n>=2t+1 where t are cheaters •k>t required to reconstruct secret •Assumes private communication and group broadcast (for dishonest dealers) •Information checking for authentication  Weak Secret Sharing – may not always complete with dishonest dealers

Example Application •Company checks require secret key authentication •3 of the 20 Vice presidents must approve check •Any 2 can not decipher the key •Can also distribute key to CEO

(k,n) secret sharing scheme •Shamir How to share a secret •q(x)=D+a 1 x+... +a k-1 x k-1 •D=Data to be shared •a=k-1 random numbers •Pick (n>=k) random unique values of x •Distribute x, q(x) to each n •Any k together can interpolate D

Linear Example (k=2)

Quadratic Example (k=3)

Interpolation •k=2, y=mx+b for 2 points •k=3, y=m 1 x 2 +m 2 x+b for 3 points •k equations, k unknowns •Entire polynomial is reconstructed to recreate secret

Motivation  Shamir ’ s algorithm doesn ’ t work with dishonest players  Need to detect cheaters – use digital signatures or information checking •Byzantine Agreements possible •Exponentially small probability of error

Information Checking • Dealer hands information to intermediary, then later delivers to recipient • Must assure reliable, correct, and secure delivery • The dealer D chooses two random numbers b, y and computes c=sb+y. • The dealer hands to INT the values s and y. • The dealer hands to R b, c • INT will transmit s and y to the recipient R. • R will compute sb + y and will accept if it equals c.

Terminology  Players: participants, 2 types Knights – honest, Knaves – dishonest •Dealer: coordinator, could also be a player •Adversary: any knight may become a knave at any time dynamically •All computations done modulus a large prime

Weak Secret Sharing  Use Shamir ’ s secret sharing scheme •Verify all data using Information Checking for all other nodes •Secretly communicate sharing data, but broadcast checking data •Require n>=2t+1 where t are cheaters, pick k required for secret sharing >t

Analysis •Probability of failure < k 2 n/2 k •6 rounds of communication •4n 2 k messages per round •2kn computations per round

Verifiable Secret Sharing •If a player is determined to be a cheater by using Information Checking, then broadcast sharing data from the dealer •Share 2 values and check the sum •Zero knowledge proof •Protocol must complete so check that all players have properly received the share

Analysis •Probability of failure < 7k 2 n 4 /2 k •14 rounds of communication •4n 3 k 2 messages per round •2k 2 n 2 computations per round

Conclusion •Weak Secret Sharing much simpler than Verifiable Secret Sharing •If the dealer is known to be honest, there are less rounds and no need for broadcasting •Information checking can be used in other applications

Questions?