A Practical (Non-interactive) Publicly Verifiable Secret Sharing Scheme

Abstract

Abstract. A publicly verifiable secret sharing (PVSS) scheme, proposed by Stadler in [Sta96], is a VSS scheme in which anyone, not only the shareholders, can verify that the secret shares are correctly distributed. PVSS can play essential roles in the systems using VSS. Achieving simultaneously the following two features for PVSS is a challenging job:-Efficient non-interactive public verification.-Proving security for the public verifiability in the standard model. In this paper we propose a (t, n)-threshold PVSS scheme which satisfies both of these properties. Efficiency of the non-interactive public verification step of the proposed scheme is optimal (in terms of computations of bilinear maps (pairing)) while comparing with the earlier solution by [HV08]. In public verification step of [HV08], one needs to compute 2n many pairings, where n is the number of shareholders, whereas in our scheme the number of pairing computations is 4 only. This count is irrespective of the number of shareholders. We also provide a formal proof for the semantic security (IND) of our scheme based on the hardness of a problem that we call the (n, t)-multi-sequence of exponents Diffie-Hellman problem (MSE-DDH). This problem falls under the general Diffie-Hellman exponent problem framework [BBG05].

Secure publicly verifiable and proactive secret sharing schemes with general access structure

“…In this section, we compare the basic properties, computational cost and number of public values in our new PVSS schemes with other PVSS schemes (with formal security, as well) in the literature [6,8,12,21] . It should be noted that [6,8,12,21] belong to threshold secret sharing schemes, while our schemes are general.…”

“…It should be noted that [6,8,12,21] belong to threshold secret sharing schemes, while our schemes are general. We do not consider other PVSS schemes, because they lack a formal security analysis.…”

“…The previous PVSS schemes [6,8,12,21] are threshold and have the implicit assumption that all participants in the scheme have the same level of power or influence. However, there exists many situations in which all of the participants do not have the same power or the same probability to be dishonest.…”

“…The first improvement is intended to increase the effectiveness and flexibility of the previous threshold PVSS schemes. In most PVSS schemes, such as schemes mention above [6,8,12,19,21] , ( t, n ) threshold access structures are considered. That is, any t or more participants can recover the secret, but t − 1 or fewer participants cannot.…”

“…Based on the DBS problem, we prove that the first proposed PVSS scheme enjoys the IND-secrecy. Compared with the previous PVSS schemes [6,8,12,21] , this scheme has the following advantages:…”