A Strengthened Security Notion for Password-Protected Secret Sharing Schemes

A Rigorous Security Proof for the Enhanced Version of Password-Protected Secret Sharing Scheme

“…We state another PPSS security notion called pparam-secure [7]. A pparam-attack game for a PPSS scheme P between an adversary A and a challenger C is as follows:…”

“…(1) A is allowed to enter Attack phase at most q A times, and (2) the running time of A is at most T. It should be noted that the pparam-security is independent of the PPSS-security in a sense that the pparam-security does not imply the PPSS-security in general and vice versa. Indeed, the protocol PPSS 2 proposed in [4] is PPSS-secure [4], but not pparam-secure [7]. On the other hand, one can easily construct a protocol which is pparam-secure but not PPSS-secure.…”

“…We depict a protocol ePPSS 2 , in Protocol 1: the proof systems ðPðL pub S1 Þ; VðL pub S1 ÞÞ and ðPðL pub U Þ; VðL pub U ÞÞ are given in [4], and ðPðL pub S2 Þ; VðL pub S2 ÞÞ is given in [7]. In [4], they stated that, for any given q S P and q S H , these systems are ðT S ; q S P ; q S H ; " ZK ; " SS Þ-SS-NIZK, where " ZK ¼ q S P q S H =q, " SS ¼ q S H =q and T S is the same as the running time of the corresponding prover.…”

“…In contrast, Hasegawa et al [7] focused on the process of generating a public parameter, and proposed another security notion for PPSS schemes named the pparam-security (Definition 2.4). Intuitively, the pparam-security means that any public parameter does not include any clue to the stored document in a way that an adversary could recognize.…”

“…The pparam-security means that the adversary could learn nothing from the sample pairs. In [7], they showed that the protocol PPSS 2 is not pparam-secure. Then they proposed an enhanced protocol ePPSS 2 (a.k.a.…”