New Frontiers in Secret Sharing

New Frontiers in Secret Sharing
- Ashutosh Kumar (UCLA) Based on joint works with Vipul Goyal Raghu Meka Amit Sahai

Agenda Non-Malleable Secret Sharing Leakage-Resilient Secret Sharing

Secret Sharing (SS) [Shamir79,Blakley79]
shares 𝑠 ℎ 1 secret Reconstructed secret 𝑚 ⋮ 𝑆ℎ𝑎𝑟𝑒 𝑚 𝑅𝑒𝑐 Any t shares. 𝑠 ℎ 𝑛 Correctness : any subset with at least t shares can be used to reconstruct the correct secret. Secrecy : any subset with less than t shares has no information about the underlying secret.

Shamir’s 2-out-of-n SS Scheme
Secret = y-intercept of the line Shares = points on the line Correctness : Any two points completely determine the line. Secrecy : One point has no information about other points on the random line. 𝑠 ℎ 3 𝑠 ℎ 2 𝑠 ℎ 1 m 1 2 3 x t = 2 and n = 3

What if a party is corrupted ?
We can detect an error. We can correct an error. 1+𝑠 ℎ 2 Tampering Adversary 1+𝑠 ℎ 3 𝑠 ℎ 4 𝑠 ℎ 3 𝑠 ℎ 3 𝑠 ℎ 2 𝑠 ℎ 2 𝑠 ℎ 1 𝑠 ℎ 1 m m 1 2 3 x 1 2 3 4 x 3 parties 4 parties

What if everyone is corrupted ?
Adversary may overwrite with valid shares of some secret 𝑠 ℎ 4 𝑠 ℎ 3 𝑠 ℎ 2 𝑠 ℎ 1 m We cannot even hope to detect errors 1 2 3 4 x t = 2 and n = 4

Our Question ⋮ ⋮ ~ 𝑠 ℎ 1 𝑠 ℎ 1 Tampering ~ 𝑚 𝑆ℎ𝑎𝑟𝑒 𝑚 𝑅𝑒𝑐 ~
secret Tampering ~ 𝑚 𝑆ℎ𝑎𝑟𝑒 ⋮ ⋮ 𝑚 𝑅𝑒𝑐 ~ Any 𝑡 shares. 𝑠 ℎ 𝑛 𝑠 ℎ 𝑛 Adversary overwrites with valid shares; destroys the entire secret. Adversary does not tamper; preserves the entire secret. Can we ensure that any tampering essentially destroys the secret ? In particular, suppose the adversary can tamper with all the n shares. In such a case, if the adversary simply overwrites 0 for all the shares, the original secret will be destroyed. The adversary may simply overwrite the existing shares with authentic shares of 0. In which case, the reconstruction function will only see valid shares of 0 and there is no hope of detecting the tampering. However, notice that in both these cases, the output of the reconstruction function was completely unrelated to the original secret, as if the original secret was destoryed. Therefore, a natural question to ask is that can we construct schemes that ensure that any tampering essentially destroys the secret?

When is the secret really “destroyed” ?
~ 𝑠 ℎ 1 𝑠 ℎ 1 secret Tampering Tampered secret ~ 𝑚 1 𝑆ℎ𝑎𝑟𝑒 ⋮ ⋮ 𝑅𝑒𝑐 𝑚 ~ Some 𝑡 shares. 𝑠 ℎ 𝑛 𝑠 ℎ 𝑛 Different Statistically close distribution ~ 𝑠 ℎ 1 𝑠 ℎ 1 secret Tampering Tampered secret ~ 𝑚 2 𝑆ℎ𝑎𝑟𝑒 ⋮ ⋮ 𝑅𝑒𝑐 𝑚 ~ Some 𝑡 shares. 𝑠 ℎ 𝑛 𝑠 ℎ 𝑛 In particular, suppose the adversary can tamper with all the n shares. In such a case, if the adversary simply overwrites 0 for all the shares, the original secret will be destroyed. The adversary may simply overwrite the existing shares with authentic shares of 0. In which case, the reconstruction function will only see valid shares of 0 and there is no hope of detecting the tampering. However, notice that in both these cases, the output of the reconstruction function was completely unrelated to the original secret, as if the original secret was destoryed. Therefore, a natural question to ask is that can we construct schemes that ensure that any tampering essentially destroys the secret?

Non-Malleable Secret Sharing (NMSS)
𝑠 ℎ 1 𝑠 ℎ 1 secret Tampering Tampered secret ~ 𝑚 𝑆ℎ𝑎𝑟𝑒 ⋮ ⋮ 𝑚 𝑅𝑒𝑐 ~ Some 𝑡 shares. 𝑠 ℎ 𝑛 𝑠 ℎ 𝑛 Either the distribution of the tampered secret is independent of the secret, or the secret remains unchanged. Non-Malleable Cryptography : Dolev, Dwork and Naor 91 Therefore, to encompass such situations, we allow our guessing algorithm to output a special symbol same*, which signals our simulator that the adversary left the secret intact. In such a case, our simulator outputs the original secret, otherwise, it outputs the guessed tampered secret. Formally, we say that a t-out-of-n secret sharing scheme is non-malleable w.r.t. a tampering family if for all authorized subsets of parties, for all tampering function in the given family, there exists a guessing algorithm such that for all values of secret, the output of tampered secret in real experiment is statistically close to the output of the simulator. Informally, this corresponds to the natural notion that any tampering either leaves the original secret intact or results in a completely unrelated secret, effectively destroying the original secret.

Individual Tampering Family
~ 𝑠 ℎ 1 𝑓 1 𝑠 ℎ 1 𝑚 ⋮ ⋮ ⋮ ~ 𝑆ℎ𝑎𝑟𝑒 Rec 𝑚 ~ Any 𝑡 shares 𝑠 ℎ 𝑛 𝑓 𝑛 𝑠 ℎ 𝑛 Computationally unbounded Each share is tampered arbitrarily and independently. Let’s look at some natural tampering families. A split-state tampering family contains all possible tuple of n functions which tamper with all the n shares arbitrarily and independently. These functions may be computationally unbounded. We only require that the n shares are tampered independently. Having described the notion, and the split-state tampering family, it is a natural time to highlight the connection and differences to non-malleable codes.

Is Shamir’s scheme non-malleable ?
Related to m Related to m 1+𝑠 ℎ 4 1+𝑠 ℎ 3 p(x) 1+𝑠 ℎ 2 ~ 2𝑠 ℎ 4 𝑠 ℎ 4 m=2m 1+𝑠 ℎ 1 2𝑠 ℎ 1 2𝑠 ℎ 3 ⋮ 1+m 𝑠 ℎ 3 2𝑠 ℎ 2 𝑠 ℎ 2 𝑠 ℎ 1 m m 𝑠 ℎ 4 𝑠 ℎ 1 𝑠 ℎ 3 𝑠 ℎ 2 1 2 3 4 x 1 2 3 4 t = 2 and n = 4 t = 3 and n = 4

All linear SS schemes are malleable.
Most SS schemes are linear [Beimel] 𝑆𝑒𝑐𝑟𝑒𝑡← 𝛼 𝑖 × 𝑠 ℎ 𝑖 𝑖∈𝑇 2×𝑆𝑒𝑐𝑟𝑒𝑡← 𝛼 𝑖 ×(2×𝑠 ℎ 𝑖 ) 𝑖∈𝑇

Non-Malleable Codes [Dziembowski, Pietrzak, Wichs 10]
Tampered states Tampered message message states ~ 𝑙 𝑓 𝑙 ~ 𝑚 2−𝑁𝑀𝐸𝑛𝑐 2−𝑁𝑀𝐷𝑒𝑐 𝑚 ~ 𝑟 𝑔 𝑟 2 split-state non-malleable code is a 2-out-of-2 NMSS [LL12] rely on cryptographic assumptions. [DKO13,RS18] construct for single bit messages. [ADL14] use additive combinatorics for multi-bit messages. [CGL16,Li17,Li18] rely on constructions of non-malleable extractors. Constructions

2-out-of-2 NMSS [Aggarwal, Dodis, Lovett 14]
Tampered vectors Tampered message vectors message ~ 𝑙 𝑓 𝑙 ~ 𝑚 𝐼 𝑃 −1 𝐼𝑃 𝑚 ~ 𝑟 𝑔 𝑟 ~ Overwrite with vectors having inner-product 𝑏, then 𝑚 = 𝑏 Scale one of the vectors by 𝑎, then 𝑚 = 𝑎 ∗ 𝑚 ~ Theorem [ADL14] : Over large characteristic fields, for all 𝑓 and 𝑔, 𝐼𝑃 𝑓 𝑙 ,𝑔 𝑟 is statistically close to 𝑎 ∗𝐼𝑃 𝑙,𝑟 +𝑏 𝑎,𝑏

2-out-of-2 NMSS ~ 𝑙 𝑓 𝑙 ~ 𝑚 𝐼 𝑃 −1 𝐼𝑃 𝑚 ~ 𝑟 𝑟 𝑔
‘Affine-tamperable’ ~ 𝑙 𝑓 𝑙 ~ 𝑚 𝐼 𝑃 −1 𝐼𝑃 𝑚 ~ 𝑟 𝑟 𝑔 Theorem [ADL14] : Over large characteristic fields, for all 𝑓 and 𝑔, 𝐼𝑃 𝑓 𝑙 ,𝑔 𝑟 is statistically close to 𝑎 ∗𝐼𝑃 𝑙,𝑟 +𝑏 𝑎,𝑏 Theorem [ADL14] : There is an efficient ℎ that detects affine tampering. Non-malleable ~ 𝑙 𝑓 𝑙 ~ 𝑚 𝑚 𝐼 𝑃 −1 ∘ ℎ −1 ℎ∘𝐼𝑃 ~ 𝑟 𝑔 𝑟

Applications of 2-out-of-2 NMSS
Tamper resilient cryptography [DPW10]. Used for non-malleable commitments [GPR16]. Connections found to two-source extractors [CZ16]. Used to construct privacy amplification protocols [CKOS18]. Applications of 2-out-of-2 NMSS ~ 𝑙 𝑓 𝑙 ~ ~ 𝑚 3−𝑁𝑀𝐸𝑛𝑐 𝑟 𝑔 𝑟 3−𝑁𝑀𝐷𝑒𝑐 𝑚 ~ 𝑠 ℎ 𝑠 3 split-state non-malleable code need not be a 3-out-of-3 SS

Our First Result [Goyal and K. 18]
~ Computationally unbounded 𝑠 ℎ 1 𝑓 1 𝑠 ℎ 1 ⋮ ⋮ ⋮ ~ 𝑚 𝑆ℎ𝑎𝑟𝑒 Rec 𝑚 ~ 𝑠 ℎ 𝑛 𝑓 𝑛 𝑠 ℎ 𝑛 Any authorized set Theorem 1. Compiler that converts any SS scheme into a non-malleable one. First t-out-of-n NMSS Even works for computational SS

Problem : 𝑙 and 𝑟 must be independently tampered.
First Attempt 𝑙 𝑙 1 𝑙 2 𝑙 3 ⋯ 𝑟 𝑟 1 𝑟 2 𝑟 3 𝑓 1 𝑓 2 𝑓 3 ⋮ ~ ~ ~ ~ 𝑙 𝑙 1 𝑙 2 𝑙 3 ~ ~ ~ ~ ⋯ 𝑟 𝑟 1 𝑟 2 𝑟 3 Problem : 𝑙 and 𝑟 must be independently tampered.

The power of different schemes.
𝑙 𝑙 1 𝑙 2 𝑙 3 𝑔 1 𝑔 2 ~ 𝑟 1 ~ 𝑟 2 ~ 𝑟 Unrelated to 𝑙 1 2 3 Takeaway : Polynomials of different degrees have some non-malleability.

Idea : Use different schemes for sharing 𝑙 and 𝑟.
Second Attempt Idea : Use different schemes for sharing 𝑙 and 𝑟.

Second Attempt Continued
𝑟 is fixed given only two shares of 𝑟 Can depend on two shares of 𝑙 Two shares hide 𝑙 𝑟 does not depend on 𝑙 𝑙 𝑙 1 𝑙 2 𝑙 3 ~ ~ ⋯ 𝑟 𝑟 1 𝑟 2 𝑟 3 𝑓 1 𝑓 2 𝑓 3 ⋮ ~ ~ ~ ~ 𝑙 1 ~ 𝑙 𝑙 2 𝑙 3 ~ ~ ~ ~ ⋯ 𝑟 𝑟 1 𝑟 2 𝑟 3 Problem : Tampering of 𝑙 can still depend on 𝑟.

Leakage Resilient SS [Goyal and K. 18]
𝑟 𝑟 1 𝑟 2 ⋯ 𝑟 𝑛 Bounded amount of information about each 𝑟 𝑖 is leaked by 𝑔 𝑖 𝑔 1 𝑔 2 ⋮ 𝑔 𝑛 ~ ~ ~ 𝑙 1 𝑙 2 ⋯ 𝑙 𝑛 SS is leakage resilient if the joint distribution of bounded leakages is statistically independent of the secret

Our Construction

Our Construction Continued
Idea : Think of the tampered shares of 𝑙 as leakage from shares of 𝑟 𝑟 is independent of ( 𝑙 1 , 𝑙 2 , 𝑙 3 ) 𝑙 computed using ( 𝑙 1 , 𝑙 2 , 𝑙 3 ) 𝑙 is independent of 𝑟 𝑟 is independent of 𝑙. 𝑙 𝑙 1 𝑙 2 𝑙 3 ~ ~ ~ ⋯ 𝑟 𝑟 1 𝑟 2 𝑟 3 ~ ~ ~ ~ 𝑓 1 𝑓 2 𝑓 3 ⋮ ~ ~ ~ ~ ~ 𝑙 𝑙 1 𝑙 2 𝑙 3 ~ ⋯ ~ ~ ~ ~ 𝑟 𝑟 1 𝑟 2 𝑟 3

Are we done? ~ 𝑙 may depend on the secret 𝑚 ~ 𝑙 cannot depend on 𝑚 ~
We have We need ~ ~ 𝑙 is independent of 𝑟. 𝑟 is independent of 𝑙. 𝑙 only depends on 𝑙. 𝑟 only depends of 𝑟. ~ ~ 𝑚 is independent of 𝑟 ~ 𝑙 𝑙 𝑓 ~ 𝑚 2−𝑁𝑀𝐷𝑒𝑐 𝑚 2−𝑁𝑀𝐸𝑛𝑐 ~ 𝑟 𝑔 𝑟 Secure only if 𝑙 and 𝑟 are tampered independently.

The same construction works with a little bit of technical work.
The Last Subtlety Full information of 𝑚 𝑙 𝑙 1 𝑙 2 𝑙 3 ⋯ 𝑟 𝑟 1 𝑟 2 𝑟 3 𝑙 may depend on 𝑚 ~ 𝑓 1 𝑓 2 𝑓 3 ⋮ 𝑙 is independent of 𝑟 ~ ~ ~ ~ ~ 𝑙 𝑙 1 𝑙 2 𝑙 3 ⋯ ~ ~ ~ ~ 𝑟 𝑟 1 𝑟 2 𝑟 3 The same construction works with a little bit of technical work.

Joint Tampering Family
~ 𝑠 ℎ 1 𝑠 ℎ 1 𝐹 ⋮ ⋮ ~ 𝑠 ℎ 𝑡−1 𝑠 ℎ 𝑡−1 ~ 𝑚 𝑆ℎ𝑎𝑟𝑒 Rec 𝑚 ~ 𝑠 ℎ 𝑡 𝐺 𝑠 ℎ 𝑡 subset 𝑇=[𝑡] 𝑠 ℎ 𝑛 Computationally unbounded Adversary chooses any authorized subset T of size t Partitions T into unequal non-empty A and B Jointly tampers shares in A using F Jointly tampers shares in B using G

Our Main Result [Goyal and K. 18]
~ 𝑠 ℎ 1 𝑠 ℎ 1 𝐹 ⋮ ⋮ ~ 𝑠 ℎ 𝑡−1 𝑠 ℎ 𝑡−1 ~ 𝑚 𝑆ℎ𝑎𝑟𝑒 Rec 𝑚 ~ 𝑠 ℎ 𝑡 𝐺 𝑠 ℎ 𝑡 subset 𝑇=[𝑡] 𝑠 ℎ 𝑛 Computationally unbounded Theorem 2. For any 𝑡≥2, any 𝑛≥𝑡, there is an efficient 𝑡-out-of-𝑛 NMSS.

Leakage-Resilient 2-out-of-2 NMSS [Goyal and K. 18]
𝑙 ~ 𝑙 𝑓 𝑙 𝑚 ~ 𝑁𝑀𝐸𝑛𝑐 𝑙𝑒𝑎𝑘 𝑚 𝑟 𝑁𝑀𝐷𝑒𝑐 ~ 𝑟 𝑟 𝑔 Theorem 3. For any polynomial p, there is an efficient 2-out-of-2 LR NMSS where the adversary leaks 𝑝( 𝑙 ) bits of information about 𝑟. Based on Chattopadhyay, Goyal and Li 16 and Raz 05

Agenda Non-Malleable Secret Sharing Leakage-Resilient Secret Sharing

Leakage Resilient Storage [Davi, Dziembowski, Venturi 10]
𝑚 𝑙 𝑟 Bounded amount of information about each 𝑟 𝑖 is leaked by 𝑔 𝑖 𝑔 1 𝑔 2 𝛼 𝛽 SS is leakage resilient if the joint distribution of bounded leakages is statistically independent of the secret Theorem{DDV10] : Construction based on inner-product ( used as 2-source extractor [Vazirani 85, Chor-Goldeich 88] )

2-out-of-n LRSS [Goyal and K. 18]
𝑟 𝑟 1 𝑟 2 ⋯ 𝑟 𝑛 𝑔 1 𝑔 2 ⋮ 𝑔 𝑛 Only 2-out-of-n 𝑙 1 𝑙 2 ⋯ 𝑙 𝑛 Only individual leakage Non-adaptive SS is leakage resilient if the joint distribution of bounded leakages is statistically independent of the secret Theorem : Construction based on 2-out-of-2 LRSS

t-out-of-n LRSS (𝑡 = 𝑛 – 𝑜(log⁡𝑛))[BDIR 18]
𝑟 𝑟 1 𝑟 2 ⋯ 𝑟 𝑛 𝑔 1 𝑔 2 ⋮ 𝑔 𝑛 Only 𝑡 = 𝑛 – 𝑜(log⁡𝑛) 𝑙 1 𝑙 2 ⋯ 𝑙 𝑛 Only individual leakage Non-adaptive Theorem [BDIR18] : Shamir’s t-out-of-n SS is LRSS for 𝑡 = 𝑛 – 𝑜(log⁡𝑛) over fields of large characteristic.

Leakage Resilient SS [K., Meka and Sahai 18]
⋯ 𝑠𝑒𝑐𝑟𝑒𝑡 𝑠ℎ 1 𝑠ℎ 2 𝑠ℎ 3 𝑠ℎ 𝑛 Only two restrictions Jointly leaks from at most 𝑝 parties At most 𝑐 bits of total leakage 𝑙𝑒𝑎𝑘 1 𝑙𝑒𝑎𝑘 2 𝛼 𝛽 ⋮ ⋮ 𝛼 𝛽 Transcript SS is (𝑝,𝑐)-leakage resilient if any such leakage transcript of at most 𝑐 bits is statistically independent of the secret

Our New Result [K., Meka and Sahai 18]
Theorem 4. For any leakage-bound 𝑐, compiler that converts any SS scheme on 𝑛 parties into a (𝑝,𝑐)-leakage-resilient one, where 𝑝=𝑂 log 𝑛 . First 3-out-of-3 LRSS for joint-leakage Even p =1 was open for almost everything. Corollary. For any leakage-bound 𝑐,any 𝑛≥2, any 𝑝=𝑂 log 𝑛 , any 𝑡>𝑝, efficient 𝑡-out-of-𝑛 SS that is (𝑝,𝑐)-leakage-resilient.

Number On The Forehead (NOF) [Chandra, Furst and Lipton 83]

NOF Comm. Complexity [Babai, Nisan and Szegedy 92]
𝑜𝑢𝑡𝑝𝑢𝑡 𝑠ℎ 1 𝑠ℎ 2 𝑠ℎ 3 𝑔 1 𝑔 2 ⋮ At most 𝑐 bits of communication 𝛼 𝛽 ⋮ 𝛼 𝛽 Transcript f has NOF communication complexity at least 𝑐 if any such communication transcript of at most 𝑐 bits is statistically uncorrelated with the output

Upper bounds on total leakage
Our Connection Shares of 3-out-of-3 scheme Number on forehead of each party 𝑠ℎ 1 𝑠ℎ 2 𝑠ℎ 3 𝑠ℎ 1 𝑠ℎ 2 𝑠ℎ 3 Joint leakage NOF communication 𝛼 𝛼 Upper bounds on total leakage Lower Bounds on NOF CC Idea : lower bound on 𝑛 party NOF CC gives us 𝑛-out-of-𝑛 LRSS against joint leakage from 𝑛−1 shares.

Challenges Ahead Upper bounds on total leakage Lower Bounds on NOF CC Idea : lower bound on 𝑛 party NOF CC gives us n-out-of-n LRSS against joint leakage from 𝑝= 𝑛−1 shares. Inefficient : Lower bound drops exponentially with n What if we bound p ? Share size exponential in n

Bounding 𝑝 helps Upper bounds on total leakage Lower Bounds on NOF CC Our idea : n-out-of-n LRSS against joint leakage from 𝑝 shares. t-out-of-n LRSS ? BNS92 Lower bound drops exponentially with 𝑝 Efficient 𝑛-out-of-𝑛 for 𝑝 = 𝑂(log⁡𝑛) Share size exponential in 𝑝.

Summary Define and construct non-malleable SS.
Define and construct leakage-resilient SS. Can merge the two to get LR NMSS As we share r using a 2-out-of-n scheme, if we allow the adversary to jointly tamper two shares, then it can simply reconstruct r and use it to tamper shares of l. On the other hand, if we share r using a 3-out-of-n scheme, then we can no longer employ our first idea of using different degree polynomials. We continue using our idea of different degree polynomials and allow the tampering of l to depend on r. We view the tampered shares of l as leakage from r and derive leakage-resilience from the underlying non-malleable code. As such leakage-resilient non-malleable codes were not known, we construct such codes.

Open Problems Number-on-forehead tampering NMSS.
Communication lower bounds for 𝑝 =𝜔(log⁡𝑛) Extractors for cylinder sources. Improve rate of our schemes (particularly NMSS) We mention some interesting open problems. While we obtained results for t-out-of-n schemes, a natural research direction is to try to construct non-malleable schemes for general access structures. In an upcoming crypto paper, we have generalized our results to general access structure for split state tampering. However, the case of joint tampering remains open. Another research direction is to handle more sophisticated tampering families. As an example, can we construct non-malleable codes that allow for multiple tampering of the secret ? In this work, we did not focus on improving the rate of our schemes, and it is a great problem to construct non-malleable secret sharing schemes that are as efficient as the malleable ones.

Thank You! Questions ?

Towards Joint Tampering
𝑙 𝑙 1 𝑙 2 𝑙 𝑙 3 𝑙 1 𝑙 2 𝑙 3 𝑔 1 𝑔 2 𝐺 ~ ~ 𝑟 1 ~ 𝑟 1 ~ 𝑟 2 𝑟 2 ~ ~ 𝑟 𝑟 Unrelated to 𝑙 Unrelated to 𝑙 1 2 3 1 2 3 Idea : Polynomials of different degrees still work. As we share r using a 2-out-of-n scheme, if we allow the adversary to jointly tamper two shares, then it can simply reconstruct r and use it to tamper shares of l. On the other hand, if we share r using a 3-out-of-n scheme, then we can no longer employ our first idea of using different degree polynomials. We continue using our idea of different degree polynomials and allow the tampering of l to depend on r. We view the tampered shares of l as leakage from r and derive leakage-resilience from the underlying non-malleable code. As such leakage-resilient non-malleable codes were not known, we construct such codes.

What happens with a different partition?
𝑙 𝑙 𝑙 1 𝑙 2 𝑙 2 𝑙 3 𝑙 1 𝑙 3 𝐺 𝐺 𝐹 ~ 𝑟 2 ~ 𝑟 1 ~ ~ 𝑟 2 𝑟 1 ~ ~ 𝑟 𝑟 Unrelated to 𝑙 Related to 𝑙 1 2 3 1 2 3 Problem : First two shares of 𝑟 may depend on all three shares of 𝑙. As we share r using a 2-out-of-n scheme, if we allow the adversary to jointly tamper two shares, then it can simply reconstruct r and use it to tamper shares of l. On the other hand, if we share r using a 3-out-of-n scheme, then we can no longer employ our first idea of using different degree polynomials. We continue using our idea of different degree polynomials and allow the tampering of l to depend on r. We view the tampered shares of l as leakage from r and derive leakage-resilience from the underlying non-malleable code. As such leakage-resilient non-malleable codes were not known, we construct such codes.

The power of consistency checks.
𝑙 𝑙 1 𝑙 2 𝑙 3 𝐺 𝐹 ~ 𝑟 2 ~ 𝑟 3 ~ 𝑟 1 ~ 𝑟 Unrelated to 𝑙 1 2 3 Idea : Enforcing co-linearity buys us arbitrary partitioning. As we share r using a 2-out-of-n scheme, if we allow the adversary to jointly tamper two shares, then it can simply reconstruct r and use it to tamper shares of l. On the other hand, if we share r using a 3-out-of-n scheme, then we can no longer employ our first idea of using different degree polynomials. We continue using our idea of different degree polynomials and allow the tampering of l to depend on r. We view the tampered shares of l as leakage from r and derive leakage-resilience from the underlying non-malleable code. As such leakage-resilient non-malleable codes were not known, we construct such codes.

New Frontiers in Secret Sharing

Similar presentations

Presentation on theme: "New Frontiers in Secret Sharing"— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

New Frontiers in Secret Sharing

Similar presentations

Presentation on theme: "New Frontiers in Secret Sharing"— Presentation transcript:

Similar presentations

About project

Feedback