Sebery J.Cryptography.An introduction to computer security.1989

they supply their shares of the randomized polynomial to Pr so Pr can recover

s(`) using the Lagrange interpolation formula.

r

The share recovery protocol has to be run for each lost share and involves all participants from the set D. It takes the following steps:

1.Each Pi 2 D selects a random polynomial Æi(x) of degree (t 1) over Zq such that Æi(xr) = 0.

2.Pi broadcasts shares to other participants from D, i.e. sends EKj (Æi(xj )) for

Pj 2 D. (`)

3.Pi ensembles his new share of the lost share, i.e. s0i = si + PPj2D Æi(xj) and broadcasts it to Pr (for instance by cryptogram EKr (s0i)).

4. Pr decrypts the cryptograms and uses the Lagrange interpolation to recon-

the message from a cryptogram only if the active subgroup B consists of t or more participants or B 2 . If the collaborating subgroup is smaller, it learns nothing about the message. The cryptogram is generated by a single sender and is assumed to be public.

10.2.1 ElGamal Threshold Decryption

The group decryption based on the ElGamal system was described by Desmedt and Frankel in [148]. The system is set up by the dealer, Don, who rst chooses a proper Galois eld GF (p) such that (q = p 1) is a Mersenne prime, p = 2` and discrete logarithm instances are intractable. Further, Don selects a primitive element g 2 GF (p) and a nonzero random integer k 2 GF (p). Next, Don computes y = gk and publishes the triple (g, p, y) as the public parameters of the system. The triple is stored in read-only White Pages so any potential sender has the access to the authentic parameters of the given receiver. Here the receiver is a group P of n participants. The dealer then uses the Shamir (t; n)

362 10 GROUP ORIENTED CRYPTOGRAPHY

threshold scheme over GF (p) to distribute the secret k among the participants. The scheme uses f(x) with the public sequence of x1; : : : ; xn. The shares are si = f(xi) for i = 1; : : : n, and the secret k = f (0).

Suppose that a sender Sue wants to send a message m 2 GF (p) to the group P. Sue rst collects the public parameters from White Pages, chooses at random an integer r 2 Zq and computes the cryptogram c = (gr; myr) for the message m.

Assume that B 2 is the authorized subset so it contains at least t participants. Let it be B = fP1; : : : ; Ptg. The rst stage of decryption is executed separately by each participant Pi 2 B. Pi takes the rst part of the cryptogram and computes (gr)si in GF (p). The results are sent to the combiner.

Having t values grsi , Clara \corrects" the values by computing

(grsi )bi ;

Note that shares are never communicated in clear to the combiner. Instead values (gr)si are transmitted via a public channel to Clara. The scheme can be used repeatedly. Assuming that the ElGamal system is secure, the threshold ElGamal is also secure.

(t; n) ElGamal threshold decryption

Initialization: 1. The dealer selects a big enough integer p = 2` so q = p 1 is a Mersenne prime. Next, Don chooses two nonzero integers g; k 2R GF (q), and computes y = gk. Don deposits (p; g; y) in White Pages.

2. Don designs a (t; n) Shamir scheme over GF (p) with a polynomial f (x) of degree at most (t 1). The secret k = f(0). Shares si = f(xi) are communicated to Pi 2 P secretly (xi are public i = 1; : : : ; n).

Encryption: Sue takes the triple of authentic elements from White Pages. For

a message m 2 Zq , she prepares the cryptogram C = (gr; myr) where

r 2R Zq .

2. The combiner rst nds out yr QPi2B(grsi )bi and m myr y r

The above scheme can be modi ed to work in GF (p) where p is a large prime with p 1 = 2q where q is prime.

Let us consider an example. Suppose the modulus is p = 263 with q = 131 and a primitive element is g = 193. Assume further that the secret k = 161 and y = gk 257 mod p. The triple (g; p; y) is public. An instance of (3; 4) Shamir secret sharing is de ned by the polynomial f (x) = 161 + 88x + 211x2 over GF (p). Participants are P = fP1; P2; P3; P4g with public coordinates x1 = 1, x2 = 2, x3 = 3 and x4 = 4. Their shares are s1 = f(1) = 198, s2 = f(2) = 133, s3 = f(3) = 228, s1 = f(1) = 221, and k = f(0) = 161. To send a message

m = 157, Sue selects a random integer r = 95 and forwards the cryptogram c = (gr; myr) = (247; 139) over GF (p).

The above integers are communicated to Clara who multiplies them, nds yr 155 mod p and retrieves the message m = 157.

10.2.2 RSA Threshold Decryption

Desmedt and Frankel [149] showed how the RSA public key cryptosystem can be combined with the Shamir scheme for group decryption.

(N) = lcm(p 1; q 1) = 2p0q0 is known. Suppose we use a (t; n) Shamir threshold scheme de ned by a polynomial f(x) of the degree at most (t 1). The polynomial can be reconstructed by every subset B of t participants using the Lagrange interpolation formula

364 10 GROUP ORIENTED CRYPTOGRAPHY

Computations modulo (N) can be done by applying the Chinese Remainder Theorem. This involves calculations for the following three moduli: 2, p0, and q0. Multiplicative inverses of (xi xj ) in Equation (10.4) exist only if they are coprime to f2; p0; q0g. It is impossible to satisfy these conditions when the number of participants is greater than two. For example, it is impossible to select three x1; x2; x3 such that all their di erences are odd. The way out is

to set f (xi) (i = 1; : : : ; n) and all di erences (xi; xj) (i 6= j) to even numbers, so that all computations yield integers that can be represented as vectors: a = (0 mod 2; a mod p0; a mod q0). This implies that all xi (i = 1; : : : ; n) have to be

Now we are ready to describe the RSA threshold decryption. The dealer rst designs an RSA system with public elements: the modulus N and the public exponent e. The secret key is d and e d = 1 mod (N). Don next sets up a Shamir (t; n) threshold scheme with polynomial f(x). All public coordinates xi

and broadcast it to the group. On receipt, each participant Pi of a subgroup B = fP1; : : : ; Ptg 2 computes

ci csi mod N

and dispatches the result to a trusted combiner.

366 10 GROUP ORIENTED CRYPTOGRAPHY

Clearly, i does not have its inverse modulo 110 as they are even and divisible by 2. Take 1. It can be represented in the vector form as 1 = (0 mod 2; 2 mod 5; 7 mod 11). We compute 1 = (0 mod 2; 2 1 mod 5; 7 1 mod 11) = (0; 3; 8) = 8 and:

2 = (0 mod 2; 1 mod 5; 9 mod 11) = 863 = (0 mod 2; 4 mod 5; 2 mod 11) = 244 = (0 mod 2; 2 mod 5; 3 mod 11) = 102

Don prepares shares for participants

and sends them to corresponding participants via secret channels.

A sender, Sue, takes her message m = 67 and public elements and computes

The partial cryptograms are sent to the combiner. Clara corrects the cryptograms

10.2.3 RSA Decryption Without Dealer

It may happen that participants fail to agree on who can be a trusted dealer. The way out is to allow the sender to set up the system and to compose the requested group of receivers at the time when there is a need for communication. Also the

sender can exercise her discretion in the selection of the threshold parameter t. The scheme we describe here is taken from [199].

Suppose that all participants have established their own RSA public key cryptosystems and registered their systems with White Pages. The registry provides the authentic public parameters of all registered RSA systems. Now we will show how the sender constructs a group decryption system on the top of single user RSA systems. The sender, Sue, creates the group P = fP1; : : : ; Png and looks up White Pages for their public parameters. Let them be Ni and ei for i = 1; : : : ; n, ordered in the increasing order so Ni < Ni+1. Next, Sue selects at random a polynomial f (x) of degree at most (t 1) over GF (p) where p < N1. She further computes the collection of shares

si = f(xi)

for a public coordinates xi; i = 1; : : : ; n and the secret d = f(0). The shares are hidden using RSA encryption so

ci = seii mod Ni:

The rst part of the cryptogram C1 is the merge of all encrypted shares using the Chinese Remainder Theorem:

C1 = (c1 mod N1; : : : ; cn mod Nn)

C2 = (md1 mod N1; : : : ; mdn mod Nn):

The cryptogram C = (P; p; t; C1; C2) is broadcast.

Each participant Pi 2 P performs the following operations: First, Pi gets ci C1 mod Ni and mdi C2 mod Ni. Next, using their secret key di recovers the share si cdi i mod Ni. The share si is broadcast to all other participants. After receiving t 1 shares, each participant in the group can reconstruct the secret d 2 GF (p) and compute

mi (mdi )d 1 mod Ni:

Although d is public, only the participant Pi is able to nd the inverse d 1 as Pi knows the factors of Ni and can calculate d d 1 1 mod (Ni). Now if t participants have sent their partial messages mi, the combiner can recreate the message m using the Chinese Remainder Theorem.

368 10 GROUP ORIENTED CRYPTOGRAPHY

The decryption process involves two stages: the recovery of the secret d and the reconstruction of the message. If at least t participants have collaborated at each stage, the message m is reconstructed. If fewer than t 1 participants broadcast their shares si at the rst stage, then the exponent d is unknown and the message cannot be recovered. An interesting case is when, the requested number of t 1 participants have broadcast their shares but fewer than t deposited their partial message to the combiner. More formally, let the combiner know (m1; : : : ; mt 1). Then the recovery of the message m is reduced to a guess of a single partial message, say mt.

(t; n) RSA threshold decryption without dealer

2.After receiving t 1 shares, participant Pi reconstructs d 2 GF (p) and compute their partial messages mi.

3.The combiner recreate the message m having any t partial messages.

10.3Threshold Signatures

Group signatures appeared as so-called multisignatures. The concept of multisignatures was introduced independently by Boyd in [53], and Okamoto [388]. A group of n participants generates a multisignatures if all n members have to contribute to sign documents. Desmedt and Frankel in [148] generalised the

concept of multisignatures to the case when each t out of n participants are able to sign a document { these are threshold signatures. Note that any (t 1) or fewer participants fail to sign a document. The veri cation of signatures can be done by any single person who knows the document and the signature (and perhaps some additional public information). The threshold signature system is initialized by a trusted dealer who creates all necessary secret parameters used by the participants. The signing algorithm is executed independently by the participants. The results are given to not necessarily trusted combiner who generates the signature. The signature is attached to the message. The veri - cation algorithm can be executed by any body.

10.3.1 RSA Threshold Signatures

RSA group signature can be implemented in a similar fashion to the RSA threshold decryption. The group of signers is P = fP1; : : : ; png and the threshold parameter is t. The necessary adjustments are presented below.

(t; n) RSA threshold signature

Initialization: 1. The dealer designs an RSA system with the modulus N, the public key e, and the secret key d. The collection of public elements are stored in White Pages.

2. Don sets up a (t; n) Shamir scheme with a polynomial f (x) of degree

Signing: For a given message m 2 ZN , the group B P of t participants wants to sign the message.

1.Each participant Pi 2 B computes their partial signature ci msi mod N:

2.The combiner, Clara, collects t partial signatures and modi es them

370 10 GROUP ORIENTED CRYPTOGRAPHY

Veri cation: The veri er, Victor, looks up White Pages for the public parameters (N; e) of the RSA system used by the group P. Next Victor takes a pair (m;~ ~) and checks whether

If the congruence is true the signature is accepted otherwise it is rejected.

Note that the signature is anonymous as the currently active subset B of t cosigners cannot be identi ed by the veri er.

Recall the example from Section 10.2.2. We are going to use the setting to illustrate the RSA threshold signature. The primes p = 11 and q = 23,

s3 = 54 and s4 = 30. Shares are held by corresponding participants.

Assume that the active set of participants who want collectively to sign a message m = 67, is B = fP1; P3; P4g. Their partial signatures are:

(mod 253) (mod 253) (mod 253)

The combiner collects the partial signatures modi es them accordingly, i.e.

A veri er, Victor, takes the pair (m;~ ~) = (67; 133) and the public key e = 107 and computes

(~m~ )e = (133 67)107 67 (mod 253):