Sebery J.Cryptography.An introduction to computer security.1989

6.The Brickell vector space construction allows to design ideal secret sharing schemes. Let

P = fA; B; C; Dg. Use the Brickell method to design ideal schemes for the following access structures:

{ 0 = ffA; B; Cg; fA; B; Dgg. Hint: Apply a function : P ! GF 3(103). (A) and(B) must assign two linear independent vectors while (C) and (D) must assign two linear dependent vectors (try (C) = (D)). Check whether the vector (1; 0; 0) can be expressed by linear combination of the vectors assigned to participants from the access structure while the vector (1; 0; 0) is not a linear combination of vectors assigned to participants from unauthorized subsets.

{ 0 = ffA; B; Dg; fA; C; Dg; fB; Cgg. Hint: Consider the following vectors (0; 0; 1); (0; 1; 0); (1; 1; 0); (1; 2; 1). Can you nd an assignment that satis es the necessary conditions?

What are shares for a = (45; 3; 56) over GF(57)?

7.Take the access structure = cl(ffP1; P2g; fP2; P3g; fP3; P4g; fP2; P4gg) whose information rate is no better that 2/3.

{Find a cumulative array for .

{Combine variants of the cumulative array and compute information rates for resulting secret sharing scheme.

8.Consider a (3; 6) Shamir threshold scheme over GF(47). A dishonest participant P1 can cheat the rest of cooperating participants by providing a modi ed share s~1. Assume that the participant holds his share s1 = 24 and modi es it in such way that (0) = 13,(2) = 0; : : : (6) = 0. What is the modi ed share s~1?

9.Elaborate how a dishonest participant can cheat in the Karnin-Greene-Hellman scheme.

10.Given a (t; n) modular threshold scheme. Derive appropriate equations that can be used by a dishonest participant to cheat. How can cheating be prevented in the modular scheme?

10 GROUP ORIENTED CRYPTOGRAPHY

It may be required that the power to execute some operations is to be shared among members of a group. The recognition of such needs came when NIST tried to introduce the controversial Clipper Chip [369] with key escrowing to achieve legal wiretapping. The proposed escrowed encryption algorithm used two parties (called Key Escrow Agencies) to deposit the valid cryptographic key. Only if the two parties pooled their partial keys together, could ciphertext be decrypted.

This Chapter is devoted to the group oriented (also called society oriented) cryptography. The security of the presented solutions is conditional as it depends on the assumption of intractability of underlying numerical problems. The group oriented cryptography emerged as a natural consequence of embedding secret sharing schemes into a single user cryptography. Unlike in secret sharing, the secret shares held by participants should never be given to the combiner { shares are used to produce partial results. The combiner collects partial results and merges them into the nal result.

Readers who want to study the subject, are referred to a review by Desmedt [147].

10.1 Conditionally Secure Shamir Scheme

The Shamir scheme described previously is one time. Once shares have been pooled, the secret is recovered and used. The scheme dies. Also if a participant loses his share, the whole scheme needs to be regenerated and new shares redistributed. This can be avoided if the Shamir scheme is combined with exponentiation in GF (q) in which discrete logarithm instances are intractable.

354 10 GROUP ORIENTED CRYPTOGRAPHY

10.1.1 Description of the Scheme

The conditionally secure Shamir scheme is de ned by two algorithms: dealer and combiner. The dealer, Don, selects at random a polynomial f(x) = a0 + a1x + : : : + at 1xt 1 of degree at most (t 1) and distributes permanent shares si = f(xi) to participants Pi (i = 1; : : : ; n) via a secure channel. The values xi 2 GF (q) are public. Don also chooses at random a primitive element g 2 GF (q), a generator of the cyclic group of the eld, and broadcasts it to all participants via a public channel. We also require that q = 2` so that q 1 = p is a prime, i.e., p is a Mersenne prime. Note that if p is prime then all nonzero elements of GF (q) have their multiplicative inverses. The secret is

k = gf(0)

and each participant Pi can easily calculate their transient share ci = gsi = gf(i):

The transient shares ci in our scheme are like the public communications in the DiÆe-Hellman [152] protocol. The scheme is based on the function

The following theorem asserts that the system of equations (10.1) has a unique solution.

Theorem 44. [85] The system of equations (10.1) has a unique solution for the variables gi in Galois elds GF (q) for q = 2`, such that q 1 = p is a prime and p > 3. The secret

Equation (10.2) is equivalent to the Lagrange interpolation formula for polynomials.

Note that the permanent shares are never revealed to the combiner by their owners. They are used to generate transient shares by participants. The combiner never sees the polynomial f(x). Instead she works with the function F (x) in order to recalculate the secret k. This is certainly true only if the corresponding instances of discrete logarithm are intractable.

10.1.2 Renewal of the Scheme

Suppose that some of transient shares have been compromised so there is a possibility that they could be used by unauthorized persons. We also assume that the permanent shares remain secret and unknown to the other participants throughout the life time of the scheme. If a transient share cj is invalidated, the owner, the participant Pj, noti es the combiner. The combiner invalidates all the shares of the participants, and distributes to the participants a new primitive element g^ via a public channel. This channel has the property that any one can read it, but the transmitted messages cannot be modi ed without detection of such modi cations. After authentication of the new primitive element, the participants use g^ to regenerate their transient shares using

c^i = g^si for i = 1; : : : ; n:

Renewal algorithm { regenerates lost transient shares.

R1. Participant Pi noti es the combiner that their share ci has been compromised. At this stage the combiner ignores requests from other participants to reconstruct the secret key.

356 10 GROUP ORIENTED CRYPTOGRAPHY

R2. The combiner generates at random a R (1 < R < q 1) such that g^ = gR is another primitive element. The element g^ is distributed via a public channel to all participants, and the pair (R; R 1) is kept by the combiner for a further reference. The combiner now accepts requests from participants who would like to reconstruct the secret key.

R3. The participants who would like to reconstruct the secret, calculate their new transient shares

c^i = g^si = gRsi ;

and send these to the combiner.

Only the combiner knows the pair (R; R 1), hence only the combiner can recreate the secret.

Assuming that solving an instance of the discrete logarithm problem is intractable, the above algorithm will regenerate the shares securely provided that R is chosen randomly by the combiner.

The combiner can recreate the secret only if she knows t transient shares (t is the threshold value of the scheme). On the other hand, an opponent who knows only r shares (r < t), cannot solve the suitable system of equations and

is unable to recreate the secret.

Once the scheme is created by the dealer, the secret k = gf(0) remains the same for the lifetime of the scheme. New primitive elements are generated from the initial primitive element by combiner at the time when there is a group of participants who are willing to cooperate to recreate the secret.

10.1.3 Noninteractive Veri cation of Shares

We now describe a veri cation protocol that allows all participants to check whether the secret sharing scheme parameters are consistent, i.e., the shares si are consistent with the polynomial f(x). The veri cation protocol due to Pedersen [400] is based on the commitment function

E(s; u) = gshs+u

where g is a randomly chosen primitive element in GF (q), and h is a randomly selected integer such that logg h is unknown.

De nition 32. A secret sharing with veri cation protocol has to satisfy the following two conditions

1.If all parties: the dealer and participants, follow the protocol, then each participant Pi accepts his share si with probability 1 (i = 1; : : : ; n).

2.Any subset Ai 2 of t or more di erent participants who have accepted their shares using the veri cation protocol recovers the secret k = f (0).

Veri cation protocol { checks consistency of shares.

V1. The dealer rst designs a (t; n) Shamir scheme with a polynomial f(x) = a0 + +a1x + : : : + at 1xt 1 of degree at most (t 1) with shares si = f(xi) assigned to participants Pi (i = 1; : : : ; n). The secret k = f(0). Shares are communicated to corresponding participants secretly. The dealer publishes two random integers g; h 2 GF (q) where g is a primitive element and logg h is not known.

Equation (10.3) is true for each index i = 1; : : : ; n as the left side of the equation can be derived from the right one as:

gkhk+u ga1xi h(a1+b1)xi : : : gat 1xti 1 h(at 1+bt 1)xti 1

k+a1xi+:::+at 1xt 1 k+a1xi+:::+at 1xt 1+u+b1xi+:::+bt 1xt 1

g i h i i

35810 GROUP ORIENTED CRYPTOGRAPHY

gf(xi)hf(xi)+B(xi)

gsi hsi+ui

E(si; ui) mod q

The above transformations prove that the rst condition of De nition 32 is satis ed. The proof of the second condition is left as an exercise.

10.1.4 Proactive Secret Sharing

Herzberg, Jarecki, Krawczyk, and Yung came up with a concept of proactive secret sharing [239]. It is expected that throughout the lifetime of the system, shares may be either compromised, lost or corrupted. Clearly, disclosure of a share causes that the e ective threshold parameter in a (t; n) threshold scheme drops by one. If more than (n t) shares are lost, then the secret cannot be recovered. If we assume that shares are being compromised (revealed or lost) gradually, then it is possible to divide the lifetime of the system into relatively short periods of time. At the beginning of each consecutive period, a share renewal protocol is run. The protocol is always successful if the deterioration of shares does not exceed the bounds for revealed and lost shares. As the result all compromised (lost or revealed) shares are regenerated while the secret stays the same. An important characteristic of proactive secret sharing is that the share renewal protocol does not change the value of the secret.

De nition 33. A proactive secret sharing is a collection of two algorithms: dealer and combiner with a share renewal protocol that keeps the secret unchanged throughout the lifetime of the scheme.

Consider an implementation of proactive secret sharing using Shamir (t; n)

threshold scheme. The scheme is initialized by the dealer. Shares are s(0)i = f(0)(xi) for i = 1; : : : ; n and the secret is k = f(0) (0) for some polyno-

mial f(0)(x). The share renewal protocol run at the beginning of `th period, switches the scheme from the polynomial f(` 1)(x) to f(`)(x). New shares are s(i`) = f(`)(xi), but secret stays the same k = f(`)(0). The switch between two

polynomials is done by using a polynomial Æ(x) such that Æ(0) = 0. In other words, f(`)(x) = f(` 1)(x) + Æ(x) for ` = 1; 2; .

We now assume that all participants are honest or, in other words, they follow the protocol and opponents are passive. The share renewal protocol is

run concurrently by all participants Pi; i = 1; : : : ; n at the beginning of each time period `. Each participant Pi executes the following steps:

1.Pi chooses at random a polynomial Æi(x) = di;1x + : : : + di;t 1xt 1 in Zq[x] (di;j 2R Zq for j = 1; : : : ; t 1). Note that Æi(0) = 0.

2.Pi communicates to each Pj (j 6= i) a correction cij = Æi(xj). Communication is done via secure channels (providing secrecy).

3.Pi collects all corrections Æj (xi) for j = 1; : : : ; n and computes his new share

Let us illustrate the protocol on a simple example. Given (3; 4) threshold

scheme with the polynomial f(0)(x) = 3 + 5x + 12x2 over GF(13). After the initialization, the collection of shares is s01 = f(0)(1) = 7, s02 = f(0)(2) = 9, s03 = f(0)(3) = 9, s04 = f(0)(4) = 7. The participants P1; P2; P3 and P4 generate their random polynomials Æ1(x) = 2x+6x2, Æ2 (x) = x, Æ3(x) = 5x+7x2, Æ4(x) = 9x2, respectively. Next they compute values cij. In particular, P1 calculates

c11 = Æ1(1) = 8, c12 = Æ1(2) = 2, c13 = Æ1(3) = 8, c14 = Æ1(4) = 0, P2 computes c21 = Æ2(1) = 1, c22 = Æ2(2) = 2, c23 = Æ2(3) = 3, c24 = Æ2(4) = 4, P3 obtains c31 = Æ3(1) = 12, c32 = Æ3(2) = 12, c33 = Æ3(3) = 0, c34 = Æ3(4) = 2, and P4 nds out c41 = Æ4(1) = 9, c42 = Æ4(2) = 10, c43 = Æ4(3) = 3, c44 = Æ4(4) = 1. The participant Pi forwards the corrections cij to the corresponding

participants Pj via secure channels. The value cii stays with Pi. New shares

are s11 = s01 + c11 + c21 + c31 + c41 = 11, s12 = s02 + c12 + c22 + c32 + c42 = 9, s13 = s03 + c13 + c23 + c33 + c43 = 10, s14 = s04 + c14 + c24 + c34 + c44 = 1. It is

easy to check that the secret stays the same.

The share renewal protocol needs to be modi ed if potential opponents are assumed to be active. After the exchange of shares, all participants engage themselves in a noninteractive veri cation of shares described in Section (10.1.3). The initialization of secret sharing includes also calculation and announcement of public parameters necessary for veri cation of shares. The commitment function used is E(s; u) = gshs+u where g is a primitive element and h is a random integer whose logg h is unknown (g; h 2 GF (p)). Public elements are: the function E() and integers g, h, p. The protocol runs at the beginning of `th time period and consists of the following steps:

1.Pi chooses at random a polynomial Æi(x) = di;1x + : : : + di;t 1xt 1 in Zq[x] (di;j 2R Zq for j = 1; : : : ; t 1). Note that Æi(0) = 0. Next the participant generates a collection of parameters for veri cation of the corrections cij =

360 10 GROUP ORIENTED CRYPTOGRAPHY

Æi(xj). They are Ei;j = E(di; bi;j) where Bi(x) = bi;0 +bi;1x+: : :+ bi;t 1xt 1

1.

2.Pi calculates the corrections cij = Æi(xj); j = 1; : : : ; n (j 6= i), and a proper share of the polynomial Bi(x) that is ui;j = Bi(xj). The pair (cij; ui;j) is encrypted using public-key cryptosystems of the corresponding participants

Pj , i.e. vij = EKj (cij; ui;j) where Kj is the authentic public key of Pj.

the contents of the message.

4. After all participants nished broadcasting, Pi decrypts the cryptograms

where Ej;0 = E(0; bi;0). Note that Pi has to verify n 1 shares (corrections) generated by other participants. If all checks are OK, Pi broadcasts a signed acceptance message. If Pi discovers that some checks have failed, Pi sends a signed accusation in which he speci es misbehaving participants.

see [239]). As all messages are broadcast, it is reasonable to assume that all honest participants will come up with the same list of misbehaving participants. Honest participant update their shares ignoring corrections from misbehaving participants.

The above protocol has no provision for dealing with lost shares. We have assumed that in any point of time there must be a large enough set D of participants whose shares are valid (jDj t). The rest of participants P n D either lost their shares or hold invalid ones. To determine the set D, participants employ a noninteractive veri cation of shares (Section 10.1.3). As the veri cation may be triggered by any participant at any time, the veri cation parameters must be generated at the initialization stage and updated after each renewal of shares. The next protocol allows us to recover shares, and it is run concurrently by all participants Pi 2 D. Before we describe the protocol, rst note