Secure secret reconstruction and multi‐secret sharing schemes with unconditional security

Abstract

In Shamir's (t, n) secret sharing (SS) scheme, the secret s is divided into n shares by a dealer and is shared among n shareholders in such a way that any t or more than t shares can reconstruct this secret; but fewer than t shares cannot obtain any information about the secret s. In this paper, we will introduce the security problem that an adversary can obtain the secret when there are more than t participants in Shamir's secret reconstruction. A secure secret reconstruction scheme, which prevents the adversary from obtaining the secret is proposed. In our scheme, Lagrange components, which are linear combination of shares, are used to reconstruct the secret. Lagrange component can protect shares unconditionally. We show that this scheme can be extended to design a multi-secret sharing scheme. All existing multi-secret sharing schemes are based on some cryptographic assumptions, such as a secure one-way function or solving the discrete logarithm problem; but, our proposed multi-secret sharing scheme is unconditionally secure.

Fair secret reconstruction in (t, n) secret sharing

“…Then, in Section 3, we review security of Shamir's threshold secret reconstruction scheme and an asynchronous secret reconstruction against any outside adversary which was published recently (Harn, 2014b). An asynchronous secret reconstruction scheme against both inside and outside adversaries is proposed in Section 4.…”

“…This is because the outside adversary is able to recover the secret from any t valid shares when more than t participants work together in the secret reconstruction. The objective of a recently proposed secret reconstruction scheme (Harn, 2014b) is to ensure that the secret cannot be reconstructed successfully when any outside adversary is participated in the secret reconstruction.…”

(t,n) multi-secret sharing scheme extended from Harn-Hsu’s scheme

“…In order to recover secret s t , these t − 1 shareholders need to obtain one more point on f s (x). However, these t − 1 shareholders can build no more linear equation on the t coefficients of f s (x) at all based on the property of asymmetric bivariate polynomial [5,6]. In other word, with t − 1 recovered secrets s 1 , s 2 , ...., s t − 1 , any t − 1 shareholders will find that each value u ∈ GF(p) could be the last legal secret s t , and they have equal probability such that…”

“…In traditional (t, n) secret sharing scheme, each of the n participants keep a share of secret s in such a way that any t or more participants can reconstruct the secret s; less than t participants cannot get any information on s. Secret sharing scheme is a useful fundamental to other cryptographic protocols [3,4]. Due to the low efficiency in secret reconstruction of traditional (t, n) secret sharing scheme (shares are used to reconstruct only one secret), multiple secret sharing becomes more popular in recent years [5][6][7] which can improve the use efficiency of the shares.…”

A lattice-based changeable threshold multi-secret sharing scheme and its application to threshold cryptography

“…On the other hand, the memory consumption of shares s j , j = 1; ; n, should be taken into account. In Table 1, the memory [45] m (n t) 1 Chang [18] m n 1 Das [19] m t n 1 Harn [46] m 2 (n+1) t m The proposed TMSSS scheme m r r=(t log q) requirements for A i , i = 1; ; m, and s j , j = 1; ; n, per secret size, i.e. log 2 (q), are given.…”