Abstract. We study the information rate of secret sharing schemes whose access structure is bipartite. In a bipartite access structure there are two classes of participants and all participants in the same class play an equivalent role in the structure. We characterize completely the bipartite access structures that can be realized by an ideal secret sharing scheme. Both upper and lower bounds on the optimal information rate of bipartite access structures are given.

No abstract

No abstract

No abstract

No abstract

No abstract

Abstract. In a multi-secret sharing scheme (MSSS), different secrets are distributed among the players in some set P = {P1, . . . , Pn}, each one according to an access structure. The trivial solution to this problem is to run independent instances of a standard secret sharing scheme, one for each secret. In this solution, the length of the secret share to be stored by each player grows linearly with (when keeping all other parameters fixed). Multi-secret sharing schemes have been studied by the cryptographic community mostly from a theoretical perspective: different models and definitions have been proposed, for both unconditional (information-theoretic) and computational security. In the case of unconditional security, there are two different definitions. It has been proved that, for some particular cases of access structures that include the threshold case, a MSSS with the strongest level of unconditional security must have shares with length linear in . Therefore, the optimal solution in this case is equivalent to the trivial one. In this work we prove that, even for a more relaxed notion of unconditional security, and for some kinds of access structures (in particular, threshold ones), we have the same efficiency problem: the length of each secret share must grow linearly with . Since we want more efficient solutions, we move to the scenario of MSSSs with computational security. We propose a new MSSS, where each secret share has constant length (just one element), and we formally prove its computational security in the random oracle model. To the best of our knowledge, this is the first formal analysis on the computational security of a multi-secret sharing scheme. We show the utility of the new MSSS by using it as a key ingredient in the design of two schemes for two new functionalities: multi-policy signatures and multi-policy decryption. We prove the security of these two new multi-policy cryptosystems in a formal security model. The two new primitives provide similar functionalities as attribute-based cryptosystems, with some advantages and some drawbacks that we discuss at the end of this work.

Abstract. In a self-healing key distribution scheme a group manager enables a large and dynamic group of users to establish a group key over an unreliable network. The group manager broadcasts in every session some packet of information in order to provide a common key to members of the session group. The goal of self-healing key distribution schemes is that, even if the broadcast is lost in a certain session, the group member can recover the key from the broadcast packets received before and after the session. This approach to key distribution is quite suitable for wireless networks, mobile wireless ad-hoc networks and in several Internet-related settings, where high security requirements need to be satisfied.In this work we provide a generalization of previous definitions in two aspects. The first one is to consider general structures instead of threshold ones to provide more flexible performance to the scheme. The second one is to consider the possibility that a coalition of users sponsor a user outside the group for one session: we give the formal definition of selfhealing key distribution schemes with sponsorization, some bounds on the required amount of information. We also give a general construction of a family of self-healing key distribution schemes with sponsorization by means of a linear secret sharing scheme. Our construction differs from previous self-healing key distribution schemes in the fact that the length of the broadcast is almost constant. Finally we analyze the particular case of this general construction when Shamir's secret sharing scheme is used.