Skip to main content
SpringerLink
Log in

How to Recover a Secret with O(n) Additions

  • Conference paper
  • First Online:
Advances in Cryptology – CRYPTO 2023 (CRYPTO 2023)

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 14081))

Included in the following conference series:

Abstract

Threshold cryptography is typically based on the idea of secret-sharing a private-key \(s\in F\) “in the exponent” of some cryptographic group G, or more generally, encoding s in some linearly homomorphic domain. In each invocation of the threshold system (e.g., for signing or decrypting) an “encoding” of the secret is being recovered and so the complexity, measured as the number of group multiplications over G, is equal to the number of F-additions that are needed to reconstruct the secret. Motivated by this scenario, we initiate the study of n-party secret-sharing schemes whose reconstruction algorithm makes a minimal number of additions. The complexity of existing schemes either scales linearly with \(n\log |F|\) (e.g., Shamir, CACM’79) or, at least, quadratically with n independently of the size of the domain F (e.g., Cramer-Xing, EUROCRYPT ’20). This leaves open the existence of a secret sharing whose recovery algorithm can be computed by performing only O(n) additions.

We resolve the question in the affirmative and present such a near-threshold secret sharing scheme that provides privacy against unauthorized sets of density at most \(\tau _p\), and correctness for authorized sets of density at least \(\tau _c\), for any given arbitrarily close constants \(\tau _p<\tau _c\). Reconstruction can be computed by making at most O(n) additions and, in addition, (1) the share size is constant, (2) the sharing procedure also makes only O(n) additions, and (3) the scheme is a blackbox secret-sharing scheme, i.e., the sharing and reconstruction algorithms work universally for all finite abelian groups F. Prior to our work, no such scheme was known even without features (1)–(3) and even for the ramp setting where \(\tau _p\) and \(\tau _c\) are far apart. As a by-product, we derive the first blackbox near-threshold secret-sharing scheme with linear-time sharing. We also present several concrete instantiations of our approach that seem practically efficient (e.g., for threshold discrete-log-based signatures).

Our constructions are combinatorial in nature. We combine graph-based erasure codes that support “peeling-based” decoding with a new randomness extraction method that is based on inner-product with a small-integer vector. We also introduce a general concatenation-like transform for secret-sharing schemes that allows us to arbitrarily shrink the privacy-correctness gap with a minor overhead. Our techniques enrich the secret-sharing toolbox and, in the context of blackbox secret sharing, provide a new alternative to existing number-theoretic approaches.

B. Applebaum and O. Nir are supported by ISF grant no. 2805/21 and by the European Union (ERC-2022-ADG) under grant agreement no.101097959 NFITSC.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 89.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 119.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    The overhead of computing \(\prod M^{\alpha _i s_i}\) can be reduced by computing a multi-exponentiation, namely computing the final result directly rather than computing each \(M^{\alpha _i s_i}\) separately and multiplying the results. This optimization, e.g. using Pippenger’s algorithm [39], improves performance by a factor of \(O(\log n)\), but when \(\log n\ll |\alpha _i|\) (which is the typical case in the threshold setting) this optimization has a limited effect compared to our improvements.

  2. 2.

    The condition \(Hv=0^{n-k}\) is well defined over any abelian group \(\mathbb {G}\) by interpreting the multiplication of a group element by an integer as iterated addition over \(\mathbb {G}\). See Sect. 2 for details.

  3. 3.

    In fact there are deterministic families of such codes and we employ them as part of the proof of Theorem 1.

  4. 4.

    We do not know whether both relaxations are needed.

  5. 5.

    Here we assume that given a \(\textsf{pp},T\) and the shares of a T-subset, one can efficiently check whether the reconstruction succeeds or fail. This assumption always hold for linear schemes (since detecting a failure boils down to checking whether a system of equation is solvable) which are the main focus of this paper. It can also be enforced for general schemes with a relatively minor cost via standard authentication techniques.

  6. 6.

    One can always reduce the number of subtractions to 1 at the expense of doubling the number of addition by maintaining for each intermediate arithmetic value v a pair of values a, b such that \(v=a-b\) and postpone the actual subtraction to the end. See [43, proof of Thm 2.11] for a similar statement for the case of division/multiplication operations.

  7. 7.

    The hypothesis can be relaxed so that e only upper-bounds the average additive complexity of the rows in M.

References

  1. Applebaum, B., Kachlon, E., Patra, A.: Verifiable relation sharing and multi-verifier zero-knowledge in two rounds: trading nizks with honest majority - (extended abstract). In: Advances in Cryptology - CRYPTO 2022–42nd Annual International Cryptology Conference, CRYPTO 2022, Santa Barbara, CA, USA, August 15–18, 2022, Proceedings, Part IV, pp. 33–56 (2022). https://doi.org/10.1007/978-3-031-15985-5_2

  2. Ball, M., Çakan, A., Malkin, T.: Linear threshold secret-sharing with binary reconstruction. In: Tessaro, S. (ed.) 2nd Conference on Information-Theoretic Cryptography, ITC 2021, 23–26 July 2021, Virtual Conference. LIPIcs, vol. 199, pp. 12:1–12:22. Schloss Dagstuhl - Leibniz-Zentrum für Informatik (2021)

    Google Scholar 

  3. Baron, J., Ishai, Y., Ostrovsky, R.: On linear-size pseudorandom generators and hardcore functions. Theor. Comput. Sci. 554, 50–63 (2014)

    Article  MathSciNet  MATH  Google Scholar 

  4. Beimel, A.: Secure schemes for secret sharing and key distribution. Ph.D. thesis, Technion - Israel Institute of Technology, Israel (1996)

    Google Scholar 

  5. Beimel, A.: Secret-sharing schemes: a survey. In: Chee, Y.M., et al. (eds.) IWCC 2011. LNCS, vol. 6639, pp. 11–46. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-20901-7_2

    Chapter  Google Scholar 

  6. Beimel, A., Chor, B.: Universally ideal secret-sharing schemes. IEEE Trans. Inf. Theory 40(3), 786–794 (1994)

    Article  MathSciNet  MATH  Google Scholar 

  7. Benaloh, J., Leichter, J.: Generalized secret sharing and monotone functions. In: Goldwasser, S. (ed.) CRYPTO 1988. LNCS, vol. 403, pp. 27–35. Springer, New York (1990). https://doi.org/10.1007/0-387-34799-2_3

    Chapter  Google Scholar 

  8. Blakley, G.R.: Safeguarding cryptographic keys. In: 1979 International Workshop on Managing Requirements Knowledge, MARK 1979, New York, NY, USA, 4–7 June 1979, pp. 313–318. IEEE (1979)

    Google Scholar 

  9. Boneh, D., et al.: Threshold cryptosystems from threshold fully homomorphic encryption. In: Shacham, H., Boldyreva, A. (eds.) CRYPTO 2018. LNCS, vol. 10991, pp. 565–596. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-96884-1_19

    Chapter  Google Scholar 

  10. Boneh, D., Lynn, B., Shacham, H.: Short signatures from the weil pairing. J. Cryptol. 17(4), 297–319 (2004)

    Article  MathSciNet  MATH  Google Scholar 

  11. Borodin, A., Moenck, R.: Fast modular transforms. J. Comput. Syst. Sci. 8(3), 366–386 (1974)

    Article  MathSciNet  MATH  Google Scholar 

  12. Bracha, G.: An asynchronous [(n-1)/3]-resilient consensus protocol. In: Proceedings of the Third Annual ACM Symposium on Principles of Distributed Computing (PODC), 1984. pp. 154–162 (1984)

    Google Scholar 

  13. Capalbo, M.R., Reingold, O., Vadhan, S.P., Wigderson, A.: Randomness conductors and constant-degree lossless expanders. In: Reif, J.H. (ed.) Proceedings on 34th Annual ACM Symposium on Theory of Computing, 19–21 May 2002, Montréal, Québec, Canada, pp. 659–668. ACM (2002)

    Google Scholar 

  14. Chen, H., Cramer, R., Goldwasser, S., de Haan, R., Vaikuntanathan, V.: Secure computation from random error correcting codes. In: Naor, M. (ed.) EUROCRYPT 2007. LNCS, vol. 4515, pp. 291–310. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-72540-4_17

    Chapter  Google Scholar 

  15. Chor, B., Kushilevitz, E.: Secret sharing over infinite domains. J. Cryptology 6(2), 87–95 (1993). https://doi.org/10.1007/BF02620136

    Article  MathSciNet  MATH  Google Scholar 

  16. Cramer, R., Damgård, I.B., Döttling, N., Fehr, S., Spini, G.: Linear secret sharing schemes from error correcting codes and universal hash functions. In: Oswald, E., Fischlin, M. (eds.) EUROCRYPT 2015. LNCS, vol. 9057, pp. 313–336. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-46803-6_11

    Chapter  Google Scholar 

  17. Cramer, R., Fehr, S.: Optimal black-box secret sharing over arbitrary abelian groups. In: Yung, M. (ed.) CRYPTO 2002. LNCS, vol. 2442, pp. 272–287. Springer, Heidelberg (2002). https://doi.org/10.1007/3-540-45708-9_18

    Chapter  Google Scholar 

  18. Cramer, R., Fehr, S., Stam, M.: Black-box secret sharing from primitive sets in algebraic number fields. In: Shoup, V. (ed.) CRYPTO 2005. LNCS, vol. 3621, pp. 344–360. Springer, Heidelberg (2005). https://doi.org/10.1007/11535218_21

    Chapter  MATH  Google Scholar 

  19. Cramer, R., Xing, C.: Blackbox secret sharing revisited: a coding-theoretic approach with application to expansionless near-threshold schemes. In: Canteaut, A., Ishai, Y. (eds.) EUROCRYPT 2020. LNCS, vol. 12105, pp. 499–528. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-45721-1_18

    Chapter  Google Scholar 

  20. Damgård, I., Ishai, Y., Krøigaard, M., Nielsen, J.B., Smith, A.: Scalable multiparty computation with nearly optimal work and resilience. In: Wagner, D. (ed.) CRYPTO 2008. LNCS, vol. 5157, pp. 241–261. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-85174-5_14

    Chapter  Google Scholar 

  21. Desmedt, Y.: Threshold cryptography. Eur. Trans. Telecommun. 5(4), 449–458 (1994)

    Article  Google Scholar 

  22. Desmedt, Y., Frankel, Y.: Threshold cryptosystems. In: Brassard, G. (ed.) CRYPTO 1989. LNCS, vol. 435, pp. 307–315. Springer, New York (1990). https://doi.org/10.1007/0-387-34805-0_28

    Chapter  Google Scholar 

  23. Druk, E., Ishai, Y.: Linear-time encodable codes meeting the gilbert-varshamov bound and their cryptographic applications. In: Naor, M. (ed.) Innovations in Theoretical Computer Science, ITCS 2014, Princeton, NJ, USA, 12–14 January 2014, pp. 169–182. ACM (2014)

    Google Scholar 

  24. Fitzi, M., Franklin, M., Garay, J., Vardhan, S.H.: Towards optimal and efficient perfectly secure message transmission. In: Vadhan, S.P. (ed.) TCC 2007. LNCS, vol. 4392, pp. 311–322. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-70936-7_17

    Chapter  Google Scholar 

  25. Gallager, R.G.: Low-density parity-check codes. IRE Trans. Inf. Theory 8(1), 21–28 (1962)

    Article  MathSciNet  MATH  Google Scholar 

  26. Goldreich, O.: A sample of samplers: a computational perspective on sampling. In: Goldreich, O. (ed.) Studies in Complexity and Cryptography. Miscellanea on the Interplay between Randomness and Computation. LNCS, vol. 6650, pp. 302–332. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-22670-0_24

    Chapter  Google Scholar 

  27. Guruswami, V., Indyk, P.: Linear-time encodable/decodable codes with near-optimal rate. IEEE Trans. Inf. Theory 51(10), 3393–3400 (2005)

    Article  MathSciNet  MATH  Google Scholar 

  28. Harnik, D., Ishai, Y., Kushilevitz, E.: How many oblivious transfers are needed for secure multiparty computation? In: Menezes, A. (ed.) CRYPTO 2007. LNCS, vol. 4622, pp. 284–302. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-74143-5_16

    Chapter  Google Scholar 

  29. Ishai, Y., Kushilevitz, E., Ostrovsky, R., Sahai, A.: Zero-knowledge from secure multiparty computation. In: Proceedings of the 39th Annual ACM Symposium on Theory of Computing, San Diego, California, USA, 11–13 June 2007, pp. 21–30 (2007)

    Google Scholar 

  30. Ishai, Y., Kushilevitz, E., Ostrovsky, R., Sahai, A.: Cryptography with constant computational overhead. In: Dwork, C. (ed.) Proceedings of the 40th Annual ACM Symposium on Theory of Computing, Victoria, British Columbia, Canada, 17–20 May 2008, pp. 433–442. ACM (2008)

    Google Scholar 

  31. Ishai, Y., Prabhakaran, M., Sahai, A.: Founding cryptography on oblivious transfer - efficiently. In: Advances in Cryptology - CRYPTO 2008, 28th Annual International Cryptology Conference, Santa Barbara, CA, USA, 17–21 August 2008. Proceedings. pp. 572–591 (2008)

    Google Scholar 

  32. Karchmer, M., Wigderson, A.: On span programs. In: Proceedings of the Eigth Annual Structure in Complexity Theory Conference, San Diego, CA, USA, 18–21 May 1993. pp. 102–111. IEEE Computer Society (1993)

    Google Scholar 

  33. Karp, R., Pippenger, N., Sipser, M.: A time-randomness tradeoff. In: AMS Conference on Probabilistic Computational Complexity, vol. 111 (1985)

    Google Scholar 

  34. Krawczyk, H.: Distributed fingerprints and secure information dispersal. In: Anderson, J., Toueg, S. (eds.) Proceedings of the Twelth Annual ACM Symposium on Principles of Distributed Computing, Ithaca, New York, USA, 15–18 August 1993, pp. 207–218. ACM (1993)

    Google Scholar 

  35. Luby, M., Mitzenmacher, M., Shokrollahi, M.A., Spielman, D.A.: Efficient erasure correcting codes. IEEE Trans. Inf. Theory 47(2), 569–584 (2001)

    Article  MathSciNet  MATH  Google Scholar 

  36. Luby, M., Mitzenmacher, M., Shokrollahi, M.A., Spielman, D.A., Stemann, V.: Practical loss-resilient codes. In: Leighton, F.T., Shor, P.W. (eds.) Proceedings of the Twenty-Ninth Annual ACM Symposium on the Theory of Computing, El Paso, Texas, USA, 4–6 May 1997, pp. 150–159. ACM (1997)

    Google Scholar 

  37. Massey, J.L.: Some applications of source coding in cryptography. Eur. Trans. Telecommun. 5(4), 421–430 (1994)

    Article  Google Scholar 

  38. Oswald, P., Shokrollahi, A.: Capacity-achieving sequences for the erasure channel. IEEE Trans. Inf. Theory 48(12), 3017–3028 (2002)

    Article  MathSciNet  MATH  Google Scholar 

  39. Pippenger, N.: On the evaluation of powers and monomials. SIAM J. Comput. 9(2), 230–250 (1980)

    Article  MathSciNet  MATH  Google Scholar 

  40. Richardson, T.J., Urbanke, R.L.: Modern Coding Theory. Cambridge University Press, Cambridge (2008)

    Google Scholar 

  41. Shamir, A.: How to share a secret. Commun. ACM 22(11), 612–613 (1979)

    Article  MathSciNet  MATH  Google Scholar 

  42. Shoup, V.: Practical threshold signatures. In: Preneel, B. (ed.) EUROCRYPT 2000. LNCS, vol. 1807, pp. 207–220. Springer, Heidelberg (2000). https://doi.org/10.1007/3-540-45539-6_15

    Chapter  Google Scholar 

  43. Shpilka, A., Yehudayoff, A.: Arithmetic circuits: a survey of recent results and open questions. Found. Trends Theor. Comput. Sci. 5(3–4), 207–388 (2010)

    MathSciNet  MATH  Google Scholar 

  44. Tomescu, A., et al.: Towards scalable threshold cryptosystems. In: 2020 IEEE Symposium on Security and Privacy, SP 2020, San Francisco, CA, USA, 18–21 May 2020, pp. 877–893. IEEE (2020)

    Google Scholar 

Download references

Acknowledgements

We thank Amos Beimel for helpful discussions.

Author information

Authors and Affiliations

  1. Tel Aviv University, Tel Aviv, Israel

    Benny Applebaum & Oded Nir

  2. Aptos Labs and Bar Ilan University, Ramat Gan, Israel

    Benny Pinkas

Authors
  1. Benny Applebaum
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Oded Nir
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Benny Pinkas
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Benny Applebaum .

Editor information

Editors and Affiliations

  1. Rambus Inc., San Jose, CA, USA

    Helena Handschuh

  2. Brown University, Providence, RI, USA

    Anna Lysyanskaya

Rights and permissions

Reprints and permissions

Copyright information

© 2023 International Association for Cryptologic Research

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Applebaum, B., Nir, O., Pinkas, B. (2023). How to Recover a Secret with O(n) Additions. In: Handschuh, H., Lysyanskaya, A. (eds) Advances in Cryptology – CRYPTO 2023. CRYPTO 2023. Lecture Notes in Computer Science, vol 14081. Springer, Cham. https://doi.org/10.1007/978-3-031-38557-5_8

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-38557-5_8

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-38556-8

  • Online ISBN: 978-3-031-38557-5

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Societies and partnerships

Search

Navigation