Download presentation
Presentation is loading. Please wait.
Published byΈλλη Δραγούμης Modified over 6 years ago
1
Secret Sharing CPS 290 - Computer Security Nisarg Raval Sep 24, 2014
Material is adapted from CS513 lecture notes (Cornell)
2
Why share a secret?
3
Goal Given a secret s and n parties All n parties together recover s
Less than n parties can not recover s
4
Naive Scheme S=10011 S1 = 100 S2 = 11 High Order Low Order
Concat shares to reveal secret - S = (S1)(S2) = (100)(11) = 10011 What is the problem? - Think of a salary or password
5
Partial Disclosure Given a secret s and n parties
All n parties together recover s Less than n can not recover any information about s
6
Generate Shares using XOR
S1 = Rand S2 = S XOR S1 10100 00111 10011 S = S1 XOR S2
7
General Scheme Given a secret s and n parties
Generate n-1 random strings as first n-1 shares Last share is the bitwise XORing of s with all the other n-1 shares
8
General Scheme Given a secret s and n parties
Generate n-1 random strings as first n-1 shares Last share is the bitwise XORing of s with all the other n-1 shares Security Check Can n parties generate s?
9
General Scheme Given a secret s and n parties
Generate n-1 random strings as first n-1 shares Last share is the bitwise XORing of s with all the other n-1 shares Security Check Can n parties generate s? Can any n-1 parties generate s?
10
Example S=10011 S1 S2 S3 S
11
Problem? S=10011 ? S1 S2 S3 S can be constructed by 2 or more generals
Less than 2 generals can not construct s
12
(n,t) Secret Sharing Given a secret s and n parties
Any t or more parties can recover s Less than t parties have not information about s (3,2) secret sharing S=10011 S1 S2 S3 S
13
(n,2) Secret Sharing y (0,S) x
14
(n,2) Secret Sharing (xn-1,yn-1) (xn,yn) (x1,y1) y (x2,y2) (0,S) x
15
(n,2) Secret Sharing y Shares x (xn-1,yn-1) (xn,yn) (x1,y1) (x2,y2)
16
(n,2) Secret Sharing (xn-1,yn-1) (x1,y1) y (0,S) x
17
(n,2) Secret Sharing Exist a line for every S (x1,y1) y (0,S) x
18
(n,3) Secret Sharing (0,S) (x1,y1) (x2,y2) (xn-1,yn-1) (xn,yn)
19
Shamir’s Secret Sharing
It takes t points to define a polynomial of degree t-1 Create a t-1 degree polynomial with secret as the first coefficient and the remaining coefficient picked at random Find n points on the curve and give one to each of the parties. At least t points are required to fit the polynomial and hence to recover secret y = at-1 * xt-1 + at-2 * xt-2 + … + a1 * x + a0 Shamir, Adi (1979), "How to share a secret", Communications of the ACM
20
Use Case S1 (3,2) Secret Sharing Scheme S2 S3 Private Key
21
Problem? S1 S1 compromised S2 compromised S2 S1 + S2 = Secret S3 Time
22
Refresh Shares S’’1 S’’3 S’’2 S’1 S’3 S’2 S1 S2 S3 Time
Trusted Third Party S’’1 S’’3 S’’2 S’1 S’3 S’2 S1 S2 S3 Time
23
Refresh Shares S’1 S’’1 S1 S’2 S’’2 S2 S’3 S’’3 can not
Trusted Third Party S’1 S’’1 S1 S1 compromised S’2 S’’2 S2 S’2 compromised S’3 S’’3 can not construct secret S3 Time
24
Proactive Secret Sharing
Server 1 Server 2 S1 S2
25
Proactive Secret Sharing
Server 1 Server 2 S1 S2 S11 S12 S21 S22
26
Proactive Secret Sharing
Server 1 Server 2 S1 S2 Exchange Partial Shares S11 S12 S21 S22 S21 S12
27
Proactive Secret Sharing
Server 1 Server 2 S1 S2 Exchange Partial Shares S11 S12 S21 S22 S21 S12 S’2 S’1
28
Proactive Secret Sharing
Server 1 Server 2 S1 S2 Exchange Partial Shares S11 S12 S21 S22 S21 S12 S’2 S’1 Recover S (S11 + S21) + (S12 + S22) S
29
Summary Useful technique to distribute secret Confidentiality
Reliability Each share must be as long as the secret itself Require random bits of length proportional to the number of parties as well as length of the secret
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.