Secret sharing scheme realizing general access structure

836

675

Suppose we are given a proof of knowledge P in which a prover demonstrates that he knows a solution to a given problem instance. Suppose also that we have a secret sharing scheme S on n participants. Then under certain assumptions on P and S, we show how to transform P into a witness indistinguishable protocol, in which the prover demonstrates knowledge of the solution to a subset of n problem instances corresponding to a qualified set of participants. For example, using a threshold scheme, the prover can show that he knows at least d out of n solutions without revealing which d instances are involved. If the instances are independently generated, this can lead to witness hiding protocols, even if P did not have this property. Our transformation produces a protocol with the same number of rounds as P and communication complexity n times that of P. Our results use no unproven complexity assumptions.

“…, s |A| at random under the condition that s 1 ⊕· · ·⊕s |A| = s, and give one s i to each participant in A. This scheme was first proposed in [9].…”

Section: Propositionmentioning

confidence: 99%

Proofs of Partial Knowledge and Simplified Design of Witness Hiding Protocols

Cramer¹,

Damgård

Schoenmakers³

836

675

“…Ito, Saito, and Nishizeki [3] have shown that for any monotone set of subsets, r, there exists a perfect secret sharing scheme for which is the access structure.…”

Section: This Work Performedmentioning

confidence: 99%

Some Ideal Secret Sharing Schemes

Brickell

293

331

In a secret sharing scheme, a dealer has a secret. The dealer gives each participant in the scheme a share of the secret. There is a set I? of subsets of the participants with the property that any subset of participants that is in I? can determine the secret.En a perfect secret sharing scheme, any subset of participants that is not in I' cannot obtain any information about the secret. We wilI say that a perfect secret sharing scheme is ideal if all of the shares are from the same domain as the secret. Shamir and 13lakley constructed ideal threshold schemes, and Benaloh has constructed other ideal secret sharing schemes. In this paper, we construct ideal secret sharing schemes for more general access structures which include the multilevel and compartmented access structures proposed by Simmons.

“…Replicated secret-sharing [23]. Let Γ ⊆2 [n] be a (monotone) access structure, and let T include all maximal unqualified sets of Γ .…”

Section: Preliminariesmentioning

confidence: 99%

“…A very useful type of "inefficient" secret-sharing scheme is the so-called replicated scheme [23]. 1 The replicated scheme for an access structure Γ proceeds as follows.…”

Section: Introductionmentioning

confidence: 99%

Share Conversion, Pseudorandom Secret-Sharing and Applications to Secure Computation

Cramer

Damgård

Ishai

2005

180

114

Abstract. We present a method for converting shares of a secret into shares of the same secret in a different secret-sharing scheme using only local computation and no communication between players. In particular, shares in a replicated scheme based on a CNF representation of the access structure can be converted into shares from any linear scheme for the same structure. We show how this can be combined with any pseudorandom function to create, from initially distributed randomness, any number of Shamir secret-sharings of (pseudo)random values without communication. We apply this technique to obtain efficient non-interactive protocols for secure computation of low-degree polynomials, which in turn give rise to other applications in secure computation and threshold cryptography. For instance, we can make the Cramer-Shoup threshold cryptosystem by Canetti and Goldwasser fully non-interactive, or construct noninteractive threshold signature schemes secure without random oracles. The latter solutions are practical only for a relatively small number of players. However, in our main applications the number of players is typically small, and furthermore it can be argued that no solution that makes a black-box use of a pseudorandom function can be more efficient.