Communication-Optimal Proactive Secret Sharing for Dynamic Groups

Abstract

Proactive secret sharing (PSS) schemes are designed for settings where long-term confidentiality of secrets has to be guaranteed, specifically, when all participating parties may eventually be corrupted. PSS schemes periodically refresh secrets and reset corrupted parties to an uncorrupted state; in PSS the corruption threshold t is replaced with a corruption rate which cannot be violated. In dynamic proactive secret sharing (DPSS) the number of parties can vary during the course of execution. DPSS is ideal when the set of participating parties changes over the lifetime of the secret or where removal of parties is necessary if they become severely corrupted. This paper presents the first DPSS schemes with optimal amortized, O(1), per-secret communication compared to O(n 4) or exp(n) in number of parties, n, required by existing schemes. We present perfectly and statistically secure schemes with near-optimal threshold in each case. We also describe how to construct a communication-efficient dynamic proactively-secure multiparty computation (DPMPC) protocol which achieves the same thresholds.

Secure publicly verifiable and proactive secret sharing schemes with general access structure

“…The second improvement is motivated from this fact that in long-lived secrets, a mobile adversary may still have enough time to gradually corrupt enough participants and gets the secret. In order to defend against such attack, proactive secret sharing schemes are required [1,17] .…”

Efficient Verifiable Secret Sharing with Share Recovery in BFT Protocols

“…While this has low overhead in the sharing phase, this forces every replica to obtain a new share whenever a single replica needs to initiate share recovery. A third technique employed by PSS schemes is batching [4,5], where the cost is still quadratic but O (n) shares can be shared in parallel. Batching was also leveraged by a recent AVSS protocol to have a linear amortized overhead [1].…”

“…Other proactive secret sharing systems [6,18,23,41,42,51] require replicas to reshare their secret shares and a new polynomial is formed through interpolation. Batching [4,5] and parallelization [24] also have been explored in proactive secret sharing schemes, and while batching provides similar asymptotic guarantees to KZG-VSSR, it does so at a large latency cost. PVSS [53] does not make any such assumption and can be used in VSSR, but it suffers from an exponential setup cost in the number of faults it tolerates, making it unusable for tolerating more than a few faults.…”

Churp

“…The second challenge is that during a handoff, an adversary may control t nodes in each of the old and new committees, and thus 2t nodes in total. Compromise of 2t shares in a (t,n)-sharing would leak the secret s. Previous schemes, e.g., [66], address this problem using "blinding" approaches with costly communication, while [12], address it via impractical virtualization techniques. Instead, CHURP uses a low communication-complexity technique called dimensionswitching, that is based on known share resharing techniques.…”