Round optimal and efficient verifiable secret sharing
Download
1 / 30

Round-Optimal and Efficient Verifiable Secret Sharing - PowerPoint PPT Presentation


  • 101 Views
  • Uploaded on
  • Presentation posted in: General

Round-Optimal and Efficient Verifiable Secret Sharing. Matthias Fitzi (Aarhus University) Juan Garay (Bell Labs) Shyamnath Gollakota (IIT Madras) C. Pandu Rangan (IIT Madras) Kannan Srinathan (IIIT Hyderabad). Secret Sharing Protocols [Sha79,Bla79]. Two phases Sharing phase

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha

Download Presentation

Round-Optimal and Efficient Verifiable Secret Sharing

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -

Presentation Transcript


Round-Optimal and EfficientVerifiable Secret Sharing

Matthias Fitzi (Aarhus University)

Juan Garay (Bell Labs)

Shyamnath Gollakota (IIT Madras)

C. Pandu Rangan (IIT Madras)

Kannan Srinathan (IIIT Hyderabad)


Secret Sharing Protocols [Sha79,Bla79]

  • Two phases

    • Sharing phase

    • Reconstruction phase

  • Sharing Phase

    • D initially holds s and each player Pi finally holds some private information vi.

  • Reconstruction Phase

    • Each player Pi reveals (some of) his private information v’i on which a reconstruction function is applied to obtain s = Rec(v’1, v’2, …, v’n).

  • Set of players P = {P1 , P2, … ,Pn}, dealer D (e.g., D = P1).

Round-Optimal and Efficient VSS —TCC’06


Sharing

Phase

vn

v1

v3

v2

Reconstruction

Phase

Less than t +1 players have no info’ about the secret

Secret Sharing (cont’d)

Secret s

Dealer

Round-Optimal and Efficient VSS —TCC’06


Sharing

Phase

vn

v1

v3

v2

 t +1 players can reconstruct the secret

Secret s

Secret Sharing (cont’d)

Secret s

Dealer

Reconstruction

Phase

Players are assumed to give their shares honestly

Round-Optimal and Efficient VSS —TCC’06


Verifiable Secret Sharing(VSS)[CGMA85]

  • Extends secret sharing to the case of active corruptions

  • (corrupted players, incl. Dealer, may not follow the protocol)

  • Up to t corrupted players

  • Adaptive adversary

  • Reconstruction Phase

    • Each player Pi reveals (some of) his private information v’i

    • on which a reconstruction function is applied to obtain

    • s’ = Rec(v’1, v’2, …, v’n).

Round-Optimal and Efficient VSS —TCC’06


VSS Requirements

  • Privacy

    • If D is honest, adversary has no Shannon information about s during the Sharing phase.

  • Correctness

    • If D is honest, the reconstructed value s’ = s.

  • Commitment

    • After Sharing phase, s’ is uniquely determined.

Round-Optimal and Efficient VSS —TCC’06


Weak VSS (WSS) [RB89]

  • Privacy

    • If D is honest, adversary has no Shannon information about s during the Sharing phase.

  • Correctness

    • If D is honest, the reconstructed value s’ = s.

  • Weak Commitment

    • After Sharing phase, s’ is uniquely determined such that

    • Rec(v’1, v’2, …, v’n)  {, s’}.

Round-Optimal and Efficient VSS —TCC’06


Communication Model and Round Complexity

  • Synchronous, fully connected network of pair-wisesecure channels + broadcast channel.

  • Round complexity:Number of communication rounds in the Sharing phase.

  • Efficiency:Total computation and communication polynomial in n and size of the secret.

Round-Optimal and Efficient VSS —TCC’06


Prior (Relevant) Work

  • Perfect VSS possible iff n > 3t [BGW88, DDWY90]

  • Round complexity of VSS [GIKR01]

    • n > 4t: Efficient 2-round protocol

    • n > 3t: No 2-round protocol exists

      Efficient 4-round protocol

      Inefficient3-round protocol

Round-Optimal and Efficient VSS —TCC’06


Our Contributions

  • VSS:Efficient3-round protocol for n > 3t

  • WSS:

    • Efficient 3-round protocol for n > 3t — round optimal

    • Efficient 1-round protocol for n > 4t

  • (1+) amortized-round VSS protocol for n > 3t

Round-Optimal and Efficient VSS —TCC’06


Our Contributions

  • VSS:Efficient3-round protocol for n > 3t

  • WSS:

    • Efficient 3-round protocol for n > 3t — round optimal

    • Efficient 1-round protocol for n > 4t

  • (1+ ) amortized-round VSS protocol for n > 3t

Round-Optimal and Efficient VSS —TCC’06


3-Round (n/3)-WSS

Secret s

Dealer

Sharing

Phase

vn

v1

v3

v2

Reconstruction

Phase

Round-Optimal and Efficient VSS —TCC’06


Secret s’

3-Round (n/3)-WSS

Secret s

vn

v1

v3

v2

Reconstruction

Phase

Round-Optimal and Efficient VSS —TCC’06


F(j,i) + r

3-Round (n/3)-WSS — Sharing Phase

  • Round 1:

    • D selects a random bivariate polynomial F(x,y) of degree t in each variable, s.t. F(0,0) = s; sends F(x,i) = fi(x) and F(i,y) = gi(y) to Pi.

    • Player Pi sends to Pj a random pad rij.

  • Round 2:Pi broadcasts

    • aij = fi(j) + rij

    • bij = gi(j) + rji

Pj broadcasts

  • aiji = fj(i) + rji

  • bji = gj(i) + rij

Round-Optimal and Efficient VSS —TCC’06


3-Round (n/3)-WSS — Sharing Phase

  • Round 1:

    • D selects a random bivariate polynomial F(x,y) of degree t in each variable, s.t. F(0,0) = s; sends F(x,i) = fi(x) and F(i,y) = gi(y) to Pi.

    • Player Pi sends to Pj a random pad rij.

  • Round 2:Pi broadcasts

    • aij = fi(j) + rij

    • bij = gi(j) + rji

  • Round 3:For each aij≠bji

    • Pi broadcasts fi(j)

    • Pj broadcasts gj(i)

    • D broadcasts F(j,i)

  • A player is said to be unhappy if his value does not match D’s value. If no. unhappy players > t, disqualify D.

Pj broadcasts

  • aij = fj(i) + rji

  • bji = gj(i) + rij

Round-Optimal and Efficient VSS —TCC’06


3-Round (n/3)-WSS — Reconstruction Phase

  • Every happy player Pi broadcasts fi(x) and gi(y).

  • Local computation:

    • Every player constructs a consistency graph G over the set of happy players: there exists an edge between Pi,Pj G iff fi(j) = gj(i) and gi(j) =fj(i).

    • Every player constructs a set CORE as follows:

      • Initially all nodes with degree at least n–t in G are in CORE.

      • Players in CORE consistent with less than n–t players in CORE are removed.

      • Repeat until no more players can be removed from CORE.

  • Secret determined by the polynomial defined by any t+1 players from CORE. If |CORE| < n–t, the secret is .

Round-Optimal and Efficient VSS —TCC’06


3-Round (n/3)-WSS — Proof Sketch

  • Privacy: (D is honest)

    • D distributes consistent information any pair of honest players publish same mutual padded values.

    • Randomness of pads leads to indistinguishability of adversary’s view under different secrets.

  • Correctness: (D is honest)

    • All honest players (at least n–t) are happy  no disqualification of D in Sharing Phase.

    • They all end up in CORE, thus the secret reconstructed is s.

Round-Optimal and Efficient VSS —TCC’06


3-Round (n/3)-WSS — Proof Sketch

  • Weak Commitment:

    • |CORE| < n – t: All honest players output .

    • |CORE|  n – t: All players in CORE are consistent with a polynomial fixed at the end of the Sharing Phase:

      • The n–2thonest happy players define a unique polynomial F’(x,y) (at the end of Sharing Phase).

      • Every dishonest happy player in CORE is consistent with at least n–t players in CORE, of which n–2tt+1 are honest

         every dishonest happy player in CORE is also consistent

        with F’(x,y).

Round-Optimal and Efficient VSS —TCC’06


Recall: 3-Round (n/3)-WSS — Sharing Phase

  • Round 1:

    • D selects a random bivariate polynomial F(x,y) of degree t in each variable, s.t. F(0,0) = s; sends F(x,i) = fi(x) and F(i,y) = gi(y) to Pi.

    • Player Pi sends to Pj a random pad rij.

  • Round 2:Pibroadcasts

    • aij = fi(j) + rij

    • bij = gi(j) + rji

  • Round 3:For each aij≠bji

    • Pi broadcasts fi(j)

    • Pj broadcasts gj(i)

    • D broadcasts F(j,i)

  • A player is said to be unhappy if his value does not match D’s value. If no. unhappy players > t, disqualify D.

Round-Optimal and Efficient VSS —TCC’06


3-Round (n/3)-VSS — Sharing Phase

  • Round 1:

    • D selects a random bivariate polynomial F(x,y) of degree t in each variable, s.t. F(0,0) = s; sends F(x,i) = fi(x) and F(i,y) = gi(y) to Pi.

    • Player Pi selects randomriand starts (n/3)-WSS onriusingFiW(x,y).

Round-Optimal and Efficient VSS —TCC’06


3-Round (n/3)-VSS — Sharing Phase

  • Round 1:

    • D selects a random bivariate polynomial F(x,y) of degree t in each variable, s.t. F(0,0) = s; sends F(x,i) = fi(x) and F(i,y) = gi(y) to Pi.

    • Player Pi selects randomriand starts (n/3)-WSSi onriusingFiW(x,y).

  • Round 2:Pi broadcasts

    • aij = fi(j) + FiW(0,j)

    • bij = gi(j) + FjW(0,i)

  • Concurrently, round 2 of (n/3)- WSSi

  • takes place.

Round-Optimal and Efficient VSS —TCC’06


3-Round (n/3)-VSS — Sharing Phase

  • Round 1:

    • D selects a random bivariate polynomial F(x,y) of degree t in each variable, s.t. F(0,0) = s; sends F(x,i) = fi(x) and F(i,y) = gi(y) to Pi.

    • Player Pi selects randomriand starts (n/3)-WSSi onriusingFiW(x,y).

  • Round 2:Pi broadcasts

    • aij = fi(j) + FiW(0,j)

    • bij = gi(j) + FjW(0,i)

  • Round 3:For each aij≠bji

    • Pi broadcasts fi(j)

    • Pj broadcasts gj(i)

    • D broadcasts F(j,i)

  • Concurrently, round 2 of (n/3)-WSSi

  • takes place.

  • Concurrently, round 3 of (n/3)-WSSi

  • takes place.

Round-Optimal and Efficient VSS —TCC’06


3-Round (n/3)-VSS — Sharing Phase

  • Round 1:

    • D selects a random bivariate polynomial F(x,y) of degree t in each variable, s.t. F(0,0) = s; sends F(x,i) = fi(x) and F(i,y) = gi(y) to Pi.

    • Player Pi selects randomriand starts (n/3)-WSSi onriusingFiW(x,y).

  • Round 2:Pi broadcasts

    • aij = fi(j) + FiW(0,j)

    • bij = gi(j) + FjW(0,i)

  • Round 3:For each aij≠bji

    • Pi broadcasts fi(j)

    • Pj broadcasts gj(i)

    • D broadcasts F(j,i)

  • A player is said to be unhappy if his value does not match D’s value. If no. unhappy players > t, disqualify D.

  • Concurrently, round 2 of (n/3)-WSSi

  • takes place.

  • Concurrently, round 3 of (n/3)-WSSi

  • takes place.

Round-Optimal and Efficient VSS —TCC’06


3-Round (n/3)-VSS — Sharing Phase

  • Local Computation:

    • H = {happy players} – {players disqualified as WSS dealers}

    • If |H| < n–t, disqualify D and stop.

    • For Pi H, if |H ∩ HiW| < n–t, remove Pi from H.

    • Call the final set COREsh. If |COREsh| < n–t disqualify D and stop.

  • Properties of COREsh:

    • If D is honest, then COREsh contains all honest players 

      D is not disqualified during the Sharing phase.

    • Every player in COREsh is consistent with n–t players in COREsh At least t+1 honest players in COREsh (defining a unique polynomial FH(x,y)).

Round-Optimal and Efficient VSS —TCC’06


3-Round (n/3)-VSS — Reconstruction Phase

  • For each Pi COREsh, run Rec. phase of (n/3)-WSSi, concurrently.

  • Local computation:

    • CORErec := COREsh

    • CORErec := CORErec – {Pi : (n/3)-WSSi }

    • For each Pi COREreccompute

      fi(j) = aij – FiW(0,j),1≤ j ≤ n

      If fi(x) not a t-degree polynomial, remove Pi from CORErec.

    • ObtainF’(x,y) by taking any t+1 polynomials fi(x)from CORErec;

      s’ := F’(0,0).

Round-Optimal and Efficient VSS —TCC’06


3-Round (n/3)-VSS — Reconstruction Phase

  • Properties of CORErec:

    • At least n–2t ( t+1) honest players in COREsh

       unique t-degree polynomial FH(x,y).

    • Dishonest Pi in CORErec:

      WSSi succeeded;

      fi(j) lie on at-degree polynomial f’i(x) ;

      F’iW(x,y)is … consistent with t+1 honest players in CORErec

       f’i(x) is consistent with FH(x,y).

  • Privacy:

    • The only difference with WSS protocol is the pads.

    • Prove that aij = fi(j) + FiW(0,j)does not reveal any info’ about fi(j).

Round-Optimal and Efficient VSS —TCC’06


Amortized VSS Round Complexity

  • Say,m k-round sequential VSS protocols (e.g., MPC)

  • Using “deferred commitment,”m+2 total rounds 

  • 1+ O(1/m) amortized-round VSS protocol

  • Initial phase: Dealer(s) share random values r1, r2,…, rm using the given VSS protocol.

  • Sharing Phaseof jth VSS protocol:

    • Broadcast correction term cj = sj – rj

  • Correction:(two ways)

    • In Reconstruction Phase each player computes sj = cj + rj.

    • At the end of Sharing Phase every player Pi computes

      F*j(x,i) = Fj(x,i) + cj and F*j(i,y) = Fj(i,y) + cj

Round-Optimal and Efficient VSS —TCC’06


Summary

  • VSS:Efficient3-round protocol for n > 3t

  • WSS:

    • Efficient 3-round protocol for n > 3t — round optimal

    • Efficient 1-round protocol for n > 4t

  • (1+) amortized-round VSS

Round-Optimal and Efficient VSS —TCC’06


Round-Optimal and EfficientVerifiable Secret Sharing

Matthias Fitzi (Aarhus University)

Juan Garay (Bell Labs)

Shyamnath Gollakota (IIT Madras)

C. Pandu Rangan (IIT Madras)

Kannan Srinathan (IIIT Hyderabad)


(n/3)-WSS Round Optimality

  • Based on impossibility of 3-round Weak Secure Multicast:

  • P = {P1 , P2, … ,Pn}; D P holds input m; multicast setM P.

    • Privacy: If all players in M are honest, then adversary learns no information about m.

    • Correctness: If D is honest, then all honest players in M output m.

    • Weak Agreement:Even if D is dishonest, all honest players in M output a value in {m’, }.

  • r-round WSS  r-round WSM

Round-Optimal and Efficient VSS —TCC’06


ad
  • Login