General Short Computational Secret Sharing Schemes

Abstract

Abstract. A secret sharing scheme permits a secret to be shared among participants in such a way that only qualified subsets of participants can recover the secret. If any non qualified subset has absolutely no information about the secret, then the scheme is called perfect. Unfortunately, in this case the size of the shares cannot be less than the size of the secret. Krawczyk [9] showed how to improve this bound in the case of computational threshold schemes by using Rabin's information dispersal algorithms [14], [15]. We show how to extend the information dispersal algorithm for general access structure (we call access structure, the set of all qualified subsets). We give bounds on the amount of information each participant must have. Then we apply this to construct computational schemes for general access structures. The size of shares each participant must have in our schemes is nearly minimal: it is equal to the minimal bound plus a piece of information whose length does not depend on the secret size but just on the security parameter.

Robust computational secret sharing and a unified account of classical secret-sharing goals

“…Robustness is then added-on using a hash-function-based technique that Krawczyk introduced in a separate paper [32]. Follow-on work to Krawczyk's paper has mostly focused on doing CSS for more general access structures [1,14,34,51].…”

“…Commercial product offerings and an open-source development community have also taken root. 1 An issue of Computer magazine explained these ideas [54]. Yet all of this has happened in the absence of even a formal definition for RCSS.…”

Weakly-Private Secret Sharing Schemes

“…However, the best known perfect t-out-of-n schemes for sharing a 1-bit secret (when 2 ≤ t ≤ n − 1) use log n-bit shares (e.g., in Shamir's scheme). 2 Kilian and Nisan [32] proved that this is unavoidable when t ≤ αn for some constant α < 1; they prove that the shares are at least log(n − t + 2)-bit strings.…”

“…In these schemes the privacy and possibly also the correctness are only statistical. Another related notion is computational secret-sharing schemes, considered in [49,34,2,48]. In these schemes, unauthorized sets of parties cannot distinguish in polynomial time between the different secrets.…”

“…Specifically, in the scheme we design: (1) the scheme is anonymous (as defined in Definition 6), (2) in each vector of shares all but at most t − 1 coordinates are equal, and (3) every vector of values in Σ t−1 is possible for every t − 1 parties for every secret (where Σ is the domain of shares of each party).…”