Robust Sharing of Secrets when the Dealer Is Honest or Cheating Tal Rabin 1994

1
Robust Sharing of Secrets when the Dealer Is
Honest or CheatingTal Rabin1994
Brian Fry COEN 317 12-03-2003
2
Introduction

• Verifiable Secret Sharing
• ngt2t1 where t are cheaters
• kgtt required to reconstruct secret
• Assumes private communication and group broadcast
  (for dishonest dealers)
• Information checking for authentication
• Weak Secret Sharing ? may not always complete
  with dishonest dealers

3
Example Application

• Company checks require secret key authentication
• 3 of the 20 Vice presidents must approve check
• Any 2 can not decipher the key
• Can also distribute key to CEO

4
(k,n) secret sharing scheme

• Shamir. 1979. How to share a secret
• q(x)Da1x . . . ak-1xk-1
• DData to be shared
• ak-1 random numbers
• Pick (ngtk) random unique values of x
• Distribute x, q(x) to each n
• Any k together can interpolate D

5
Linear Example (k2)
6
Quadratic Example (k3)
7
Interpolation

• k2, ymxb for 2 points
• k3, ym1x2m2xb for 3 points
• k equations, k unknowns
• Entire polynomial is reconstructed to recreate
  secret

8
Motivation

• Shamir?s algorithm doesn?t work with dishonest
  players
• Need to detect cheaters ? use digital signatures
  or information checking
• Byzantine Agreements possible
• Exponentially small probability of error

9
Information Checking

• Dealer hands information to intermediary, then
  later delivers to recipient
• Must assure reliable, correct, and secure
  delivery
• The dealer D chooses two random numbers b, y and
  computes csby.
• The dealer hands to INT the values s and y.
• The dealer hands to R b, c
• INT will transmit s and y to the recipient R.
• R will compute sb y and will accept if it
  equals c.

10
Terminology

• Players participants, 2 types Knights?honest,
  Knaves?dishonest
• Dealer coordinator, could also be a player
• Adversary any knight may become a knave at any
  time dynamically
• All computations done modulus a large prime

11
Weak Secret Sharing

• Use Shamir?s secret sharing scheme
• Verify all data using Information Checking for
  all other nodes
• Secretly communicate sharing data, but broadcast
  checking data
• Require ngt2t1 where t are cheaters, pick k
  required for secret sharing gtt

12
Analysis

• Probability of failure lt k2n/2k
• 6 rounds of communication
• 4n2k messages per round
• 2kn computations per round

13
Verifiable Secret Sharing

• If a player is determined to be a cheater by
  using Information Checking, then broadcast
  sharing data from the dealer
• Share 2 values and check the sum
• Zero knowledge proof
• Protocol must complete so check that all players
  have properly received the share

14
Analysis

• Probability of failure lt 7k2n4/2k
• 14 rounds of communication
• 4n3k2 messages per round
• 2k2n2 computations per round

15
Conclusion

• Weak Secret Sharing much simpler than Verifiable
  Secret Sharing
• If the dealer is known to be honest, there are
  less rounds and no need for broadcasting
• Information checking can be used in other
  applications

16
Questions?