Towards Optimal Robust Secret Sharing with Security Against a Rushing Adversary

Abstract

Robust secret sharing enables the reconstruction of a secretshared message in the presence of up to t (out of n) incorrect shares. The most challenging case is when n = 2t + 1, which is the largest t for which the task is still possible, up to a small error probability 2 −κ and with some overhead in the share size. Recently, Bishop, Pastro, Rajaraman and Wichs [3] proposed a scheme with an (almost) optimal overhead of O(κ). This seems to answer the open question posed by Cevallos et al. [6] who proposed a scheme with overhead of O(n + κ) and asked whether the linear dependency on n was necessary or not. However, a subtle issue with Bishop et al.'s solution is that it (implicitly) assumes a non-rushing adversary, and thus it satisfies a weaker notion of security compared to the scheme by Cevallos et al. [6], or to the classical scheme by Rabin and BenOr [13]. In this work, we almost close this gap. We propose a new robust secret sharing scheme that offers full security against a rushing adversary, and that has an overhead of O(κn ε), where ε > 0 is arbitrary but fixed. This n ε-factor is obviously worse than the polylog(n)-factor hidden in the O notation of the scheme of Bishop et al. [3], but it greatly improves on the linear dependency on n of the best known scheme that features security against a rushing adversary (when κ is substantially smaller than n). A small variation of our scheme has the same O(κ) overhead as the scheme of Bishop et al. and achieves security against a rushing adversary, but suffers from a (slightly) superpolynomial reconstruction complexity.

Robust Secret Sharing with Almost Optimal Share Size and Security Against Rushing Adversaries

“…In particular, their scheme was the first robust secret sharing with an overhead that is independent of n (neglecting polylog(n) terms). However, as pointed out by Fehr and Yuan [8], the Bishop et al scheme does not (appear to) offer security in the presence of a rushing adversary that may choose the incorrect shares depending on the shares of the honest parties. This is in contrast to most of the earlier schemes, which do offer security against such rushing attacks (but are less efficient in terms of share size).…”

“…This is in contrast to most of the earlier schemes, which do offer security against such rushing attacks (but are less efficient in terms of share size). 1 Towards recovering security against a rushing adversary, Fehr and Yuan [8] proposed a new robust secret sharing scheme that features security against a rushing adversary and an overhead "almost independent" of n, i.e., O(n ) for an arbitrary > 0. Furthermore, a variation of their scheme offers security against a rushing adversary and an overhead that is truly independent of n (neglecting polylogarithmic terms), but this version of the scheme has a running time that is superpolynomial.…”

“…Our Result. In this work, we close the final gap left open in [8]: we propose and analyze a new robust secret sharing scheme that is secure against a rushing adversary, has an overhead independent of n as in [3] (i.e., independent up to the same poly-logarithmic O(log 4 n + log n log m) term as in [3], where m is the bit size of the secret), and has a polynomial running time.…”

SquirRL: Automating Attack Analysis on Blockchain Incentive Mechanisms with Deep Reinforcement Learning

“…This is consistent with the lack of observed selfish mining in the wild, although it is unclear whether this observation or other externalities are to blame. • We find that the classical notion of a rushing adversary, which is widely used in the cryptographic literature to model a worst-case adversary [20], [43], can give counterintuitive and nonphysical results in multi-strategic-agent settings. This has implications beyond the blockchain domain regarding how security researchers should model multi-agent settings.…”

Outsourcing Hierarchical Threshold Secret Sharing Scheme Based on Reputation

“…Although information about shares is leaked, the adversary still has no access to information about secret. Fehr and Yuan [12] constructed a robust secret sharing scheme with security against a rushing adversary. Benhamouda et al studied leakage resilience of the MPC protocol [13].…”