Computational Verifiable Secret Sharing Revisited

Abstract

Verifiable secret sharing (VSS) is an important primitive in distributed cryptography that allows a dealer to share a secret among n parties in the presence of an adversary controlling at most t of them. In the computational setting, the feasibility of VSS schemes based on commitments was established over two decades ago. Interestingly, all known computational VSS schemes rely on the homomorphic nature of these commitments or achieve weaker guarantees. As homomorphism is not inherent to commitments or to the computational setting in general, a closer look at its utility to VSS is called for. In this paper, we demonstrate that homomorphism of commitments is not a necessity for computational VSS in the synchronous or in the asynchronous communication setting. We present new VSS schemes based only on the definitional properties of commitments that are almost as good as existing VSS schemes based homomorphic commitments. Furthermore, they have significantly lower communication complexities than their (statistical or perfect) unconditional counterparts. Considering the feasibility of commitments from any claw-free permutation, one-way function or collision-resistant hash function, our schemes can be an excellent alternative to unconditional VSS in the future.Further, in the synchronous communication model, we observe that a crucial interactive complexity measure of round complexity has never been formally studied for computational VSS. Interestingly, for the optimal resiliency conditions, the least possible round complexity in the known computational VSS schemes is identical to that in the (statistical or perfect) unconditional setting: three rounds. Considering the strength of the computational setting, this equivalence is certainly surprising. In this paper, we show that three rounds are actually not mandatory for computational VSS. We present the first two-round VSS scheme for n ≥ 2t + 1 and lower-bound the result tightly by proving the impossibility of one-round computational VSS for t ≥ 2 or n ≤ 3t. For the remaining condition of t = 1 and n ≥ 4, we present a one-round VSS scheme. We also include a new two-round VSS scheme using homomorphic commitments that has the same communication complexity as the well-known three-round Feldman and Pedersen VSS schemes.

Asynchronous MPC with a strict honest majority using non-equivocation

“…Our Sup-Sh protocol is almost equivalent to the AVSS primitive [CKAS02,Can96,BKP11]: it allows a dealer D to "verifiably" share a secret s, thus generating [s], and ensures that at least one honest party is privileged to obtain all the n shares encrypted for the respective share holders. The existing computational AVSS protocols (e.g., [CKAS02,BKP11]) are designed with n = 3t + 1 and are based on sharing a secret using a bivariate polynomial of degree t in each variable and (homomorphic) commitments. In this paradigm, it is ensured that D has distributed "consistent" shares to n − t = 2t + 1 parties such that (at least) t + 1 honest parties among them can "enable" the remaining parties to get their shares.…”

“…Now using the homomorphic property of commitments every party can compute the remaining committed shares and Com s , thus possessing all the necessary information of [s]. Given [s] generated using Sh, protocol Rec is based on the standard reconstruction protocol used in the existing computationally secure AVSS [BKP11,CKAS02], which allows the parties to robustly reconstruct s. In the protocol, each party sends its share-pair to all the parties, which are verified with the corresponding commitment, available with the parties (as part of [s]). Once t + 1 "correct" share pairs are received, the sharing polynomial, and hence s, is reconstructed.…”

Verifiable Computation in Multiparty Protocols with Honest Majority

“…This allows us to have more meaningful comparisons with other VSS protocols. We will compare our solution to the 4-round statistical VSS of [27], the 3-round VSS of [32], and the 2-round VSS of [3] (see Table 1). These protocols have different security models and different optimization goals, therefore also selecting different methods for securing communication between parties.…”

“…The 2-round VSS of [3] This protocol also uses commitments that do not have to be homomorphic. This is still different from F tr and ICP : commitments can ensure that the same message has been transmitted to distinct parties.…”

Scalable and Secure Polling in Dynamic Distributed Networks

“…Next, in the reconstruction phase, the shares are combined by the nodes to either (1) recover the same secret s or (2) tag the dealer as cheater. In this work, we use the (n − 1)/2-tolerant probabilistic VSS protocol of [38]. Accordingly, the RNG protocol in a set S of nodes proceeds as follows: (1) each node i in S chooses a random number r i ∈ F. (2) Each node i acts as a dealer and shares r i using the VSS protocol.…”