Optimal secure message transmission by public discussion

Abstract

Secure message transmission assumes n channels between a sender and a receiver such that up to t channels are under the control of a computationally unlimited adversary. In secure message transmission by public discussion protocol, sender and receiver have access to a public authenticated channel. In this paper we show that if n ≥ t + 1, a secure protocol requires at least 3 rounds of communication and 2 rounds invocation of the public channel. This gives a complete answer to a question raised by Garay and Ostrovsky in Eurocrypt 2008. We also describe a round optimal protocol that has constant transmission rate over the public channel. I. INTRODUCTION Dolev, Dwork, Waarts and Yung [1] introduced SecureMessage Transmission (SMT) systems to address the problem of delivering a message chosen by a sender S to a receiver R in a network guaranteeing reliability and privacy. In the SMT model S is connected to R by n node disjoint paths, referred to as wires, of them at most t is controlled by the adversary with unlimited computational power. One of the main motivations for this model is to reduce connectivity requirement in secure multiparty protocols. Traditionally these protocols require a secure and reliable channel between every two nodes. This assumption cannot be satisfied in many scenarios and so it is natural to study implementation of secure and reliable point-topoint communication in these networks under reasonable assumptions. A perfectly secure message transmission or PSMT for short, guarantees that R always receive the sent message but the adversary does not learn anything about it.The original definition of perfect security and privacy was relaxed by Franklin and Wright [4] who considered SMT protocols with probabilistic security, referred to as almost SMT protocols in this paper. Almost SMT protocols have two parameters ε and δ, where ε upper bounds the advantage of the adversary in breaking privacy, and δ upper bounds the probability that R fails to recover the sent message. The special case with ε = δ = 0 is a PSMT protocol.Connectivity requirements of PSMT protocols for different number of rounds and constructions of optimal protocols have been widely studied [1], [3], [7]. In particular it was shown that PSMT is possible if and only if n ≥ 2t + 1. Franklin and Wright [4] considered a model where an additional reliable broadcast channel is available to S and R. A broadcast channel guarantees that all nodes of the network receive the same message. We refer to the model as Broadcast Model (BM). It was shown that PSMT in BM requires n ≥ 2t + 1 but

Secure Message Transmission with Small Public Discussion

“…In addition, our protocol incurs a private communication complexity of O( mn n−t ), which, as we also show, is optimal, thus providing an affirmative answer to the question posed in [SJST09] of whether their O(mn) private communication could be improved. Furthermore, our protocol has an optimal round complexity of (3, 2), meaning 3 rounds, 2 of which must invoke the public channel [SJST09].…”

“…At a high level, the protocol has the same structure as previous 3-round SMT-PD protocols, with the following important differences: (1) our use of randomness extractors allows us to reduce the amount of transmitted randomness, which is reflected in the gain in private communication, and (2) typically in previous protocols the message is transmitted in the last round over the public channel, blinded by the private randomness thought not to have been tampered with; our improvement to public communication comes from the transmission of the (blinded) message on the private wires, provided that the sender authenticates the transmission making use of the public channel, which in turn requires smaller communication. Additionally, we achieve these improved communication bounds even for messages of smaller required size than Shi et al [SJST09]. 4 Finally, the protocol achieves perfect privacy.…”

“…The lower bound n ≥ 2t+1 holds even in this general setting (at least for non-trivial protocols, such as those satisfying + δ < 1/2); hence the most interesting case for SMT-PD is the case when the public channel is required: t < n ≤ 2t. As noted above, this requires round complexity (3,2) [SJST09]. Franklin and Wright [FW98] show that perfectly reliable (δ = 0) SMT-PD protocols are impossible when n ≤ 2t.…”

“…We first present an SMT-PD protocol with a logarithmic (in m, the message size) communication complexity on the public channel; the best known bound, due to Shi, Jiang, Safavi-Naini, and Tuhin [SJST09], was linear (see related work below). In addition, our protocol incurs a private communication complexity of O( mn n−t ), which, as we also show, is optimal, thus providing an affirmative answer to the question posed in [SJST09] of whether their O(mn) private communication could be improved. Furthermore, our protocol has an optimal round complexity of (3, 2), meaning 3 rounds, 2 of which must invoke the public channel [SJST09].…”

“…The protocol has linear transmission rate (in terms of message size) on the public and private channels. Shi et al [SJST09] give the first protocol with constant transmission rate on the public channel (for messages of sufficient, modest size) with linear transmission rate on the private channels as well; however, the communication complexity of their protocol is linear.…”