The Torsion-Limit for Algebraic Function Fields and Its Application to Arithmetic Secret Sharing

Abstract

Abstract. An (n, t, d, n−t)-arithmetic secret sharing scheme (with uniformity) for F k q over Fq is an Fq-linear secret sharing scheme where the secret is selected from F k q and each of the n shares is an element of Fq. Moreover, there is t-privacy (in addition, any t shares are uniformly random in F t q ) and, if one considers the d-fold "component-wise" product of any d sharings, then the d-fold component-wise product of the d respective secrets is (n − t)-wise uniquely determined by it. Such schemes are a fundamental primitive in information-theoretically secure multi-party computation. Perhaps counter-intuitively, secure multi-party computation is a very powerful primitive for communication-efficient two-party cryptography, as shown recently in a series of surprising results from 2007 on. Moreover, the existence of asymptotically good arithmetic secret sharing schemes plays a crucial role in their communication-efficiency: for each d ≥ 2, if A(q) > 2d, where A(q) is Ihara's constant, then there exists an infinite family of such schemes over Fq such that n is unbounded, k = Ω(n) and t = Ω(n), as follows from a result at CRYPTO'06. Our main contribution is a novel paradigm for constructing asymptotically good arithmetic secret sharing schemes from towers of algebraic function fields. It is based on a new limit that, for a tower with a given Ihara limit and given positive integer , gives information on the cardinality of the -torsion sub-groups of the associated degree-zero divisor class groups and that we believe is of independent interest. As an application of the bounds we obtain, we relax the condition A(q) > 2d from the CRYPTO'06 result substantially in terms of our torsion-limit. As a consequence, this result now holds over nearly all finite fields Fq. For example, if d = 2, it is sufficient that q = 8, 9 or q ≥ 16.

Bounds on the Threshold Gap in Secret Sharing and its Applications

“…Our definition of secret sharing scheme is slightly more restricted than the one considered by Massey (we exact reconstruction by the full set of players) and this suggests the notion of n-code, which appeared in [9]. We define this notion below, after introducing some notation.…”

“…In [9], the notion of arithmetic secret sharing was introduced. This generalizes previous notions, such as the strongly multiplicative secret sharing schemes defined in [12].…”

“…Quite surprisingly, especially those with good asymptotic properties have recently been shown to be of great importance in the design of two-party secure protocols (see the references in [9]). It is known by algebraic geometric arguments [10,8,9] that if q is fixed, then there are infinite families of such schemes with n unbounded and t = t(n) (as well as important variations) such that the quantity 3t n−1 tends asymptotically to a positive constant, which is the salient property. It is a very interesting open problem whether there exists a proof for these facts that avoids the use of advanced results from algebraic geometry, in particular, the existence of certain good infinite towers of algebraic function fields.…”

Constant-Overhead Secure Computation of Boolean Circuits using Preprocessing

“…Using algebraic geometry codes and results on strongly multiplicative secret sharing from [CCX11] we obtain a result that is better than Theorem 1 when the number of players is large. Theorem 2.…”

“…Algebraic Geometry Codes Using the work of Cascudo et al [CCX11], one can do even better: based on Algebraic Geometry, they construct families of codes with properties as we require over constant size fields. In Section 4.2 we cover the complexity of our protocol when using Algebraic Geometry codes.…”