Lattice-Based Threshold Changeability for Standard Shamir Secret-Sharing Schemes

Abstract

Abstract. We consider the problem of increasing the threshold parameter of a secret-sharing scheme after the setup (share distribution) phase, without further communication between the dealer and the shareholders. Previous solutions to this problem require one to start off with a non-standard scheme designed specifically for this purpose, or to have communication between shareholders. In contrast, we show how to increase the threshold parameter of the standard Shamir secret-sharing scheme without communication between the shareholders. Our technique can thus be applied to existing Shamir schemes even if they were set up without consideration to future threshold increases. Our method is a new positive cryptographic application for lattice reduction algorithms, inspired by recent work on lattice-based list decoding of Reed-Solomon codes with noise bounded in the Lee norm. We use fundamental results from the theory of lattices (Geometry of Numbers) to prove quantitative statements about the information-theoretic security of our construction. These lattice-based security proof techniques may be of independent interest.

Lattice-based threshold-changeability for standard CRT secret-sharing schemes

“…Our results are analogous to those obtained by lattice methods for the polynomial-based Shamir secret-sharing scheme [23], despite the differences in the details of the lattices involved.…”

“…Finally, we remark that in a companion paper [23], we show that lattice-based methods can also be used to change the threshold of the standard Shamir [21] polynomialbased secret-sharing scheme. The general ideas and results obtained for the Shamir scheme are analogous to those obtained here for the CRT scheme, although they differ in the details of the lattices involved.…”

“…we have 2H 2 k−1 and using = 1 − 1+ F t /t , t s t, and the definition of F = t /t k (k) with (k) = log( −1/t c n(kt + CVP )) + 2 CVP + 5 we see after straightforward algebraic manipulation that (35) and also (36) and (23) are all satisfied as long as k satisfies the inequality…”

Dynamic threshold secret reconstruction and its application to the threshold cryptography

“…In 1999, Martin et al [28] proposed the first TCSS. TCSSs can be classified into three types, schemes based on a linear polynomial [29,30], schemes based on the geometry [31], and schemes based on the CRT [32,33]. Since standard Shamir's SS is very simple and is unconditionally secure, most efforts have been devoted to propose TCSSs [29,34] to support standard Shamir's SS.…”

“…Most TCSSs are interactive and need secure channels to refresh new shares. In 2004, Steinfeld et al [29] proposed a Lattice-based TCSS to support standard Shamir's secret generation algorithm. Their scheme does not need any secure channels and is called a TCSS without dealer.…”