1. Advanced Protocols

2. Things we don’t know The millionaires problem
Secretly computing the average salary of n users
Online gambling
1-on-1 poker is difficult enough
Even agreeing on a common random bit is not easy
Electronic elections

3. Computing the average Example How do we do t-private?
Honest but curious, 1-private, single user output
Honest but curious, fully private, single user output
How do we do t-private?

4. Secret sharing Motivation “Definition” Access structure Dealer Secret
Shares of secret
Sets that can reconstruct secret
Sets that have no information
Access structure
General structure
Threshold structure

5. Threshold secret sharing
Access structure includes all subsets with at least t+1 participants
Example I
n-1 threshold over a finite group
Impossibility of secret sharing over an infinite domain
Example II
Threshold of 1

6. Polynomial interpolation
F is a finite field and p(x) is a polynomial over F
Theorem: If |F|≥t+1 then any t+1 pairs (xi,p(xi)) uniquely determine a degree t polynomial that passes through these points
Lagrange interpolation
t monomials of the type [(x-x1)*…*(x-xt+1)]/[(xi-x1)*…*(xi-xt+1)]*p(xi)
t+1 points uniquely determine p(0)
t points give no information on p(0)
No information
Pr[secret=s|t shares]=Pr[secret=s]

7. Shamir secret sharing
A threshold secret sharing scheme for a parameter t
Let the secret s be an element in a finite field F, |F|>n.
The i-the participant is associated with a unique element xiF, all participants know x1,…,xn
The dealer chooses a polynomial p(x) of degree t over F such that
P(0)=s (this is also the free coefficient)
The other coefficients of p(x) are random elements in F
The i-th share is p(xi)

8. Shamir secret sharing (cont.)
Reconstruction
Sets of at least t+1 can perform Lagrange interpolation on pairs (xi,p(xi))
Secrecy
A set of at most t parties learns nothing because any secret is still possible
Can the dealer lie?
Yes, but we’re not dealing with it right now (semi-honest assumption)

9. Examples What can be computed locally
Shamir secret sharing of s in F, compute locally secret sharing of a*s for public value aF
Shamir secret sharing of s1, s2 in F, compute locally secret sharing of s1+s2 in F
Example - Computing the average with a threshold of t
Example - Proactive secret sharing
Periodically adding a zero

10. Linear functions on secrets
Model
n parties
The i-th party has secret si in field F, S=(s1,…,sn)
All parties know a fixed nXn matrix A={ai,j}
Compute Y=AS
Required threshold t
Solution
The i-th party is a dealer in a Shamir secret sharing for secret si using polynomial pi(x) (i.e. pi(0)=si )
If Y={yj} then yj=iaji*si, which is the free coefficient of qj(x)= iaji*pi(x)
Each party uses its shares of p1(x),…,pn(x) to locally compute q1(x),…,qn(x)