Verifiably Multiplicative Secret Sharing
Verifiably Multiplicative Secret Sharing
复制标题
可验证的乘法秘密共享
DOI：
10.1109/tit.2018.2886262
复制
发表时间：
2019
影响因子：
2.5
通讯作者：
Satoshi Obana
中科院分区：
文献类型：
--
作者：
Maki Yoshida;Satoshi Obana
d-乘法秘密共享（d-MSS）方案允许参与者将d个共享秘密相乘而不需要通过将他们的共享局部地转换成乘积的加法共享来恢复秘密。证明了n个局中人之间的d-MSS是可能的当且仅当没有d个未授权局中人集合覆盖整个局中人集合（Qd型）。虽然这一结果意味着在MPC的上下文中对SS的一些限制，但是d-乘法性质仍然有助于通过直接和非交互地计算d场元素的乘积而无需任何设置来简化MPC的复杂任务。本文的目的是通过增强对恶意对手的安全性来提高d-MSS的有用性。首先，我们介绍了可验证乘法SS的概念，可验证MSS，这主要是形式化检测恶意行为。非正式地，如果SS方案是d-乘法的，则该方案是可验证的d-乘法的，并且进一步使得参与者能够本地生成证明求和值是正确的一部分（即，D个共享秘密的乘积）。其次，我们证明了没有错误的可验证MSS方案的证明的解码器是加性的，并且通过接受可以任意选择的错误概率，存在可验证的d-MSS方案实现给定的访问结构当且仅当访问结构是类型Qd。在所提出的构造中，证明的每个份额仅由两个域元素组成。这一结果意味着我们可以有效地实现标准d-MSS的最佳弹性，即使是针对恶意攻击者。我们注意到，通过允许包括线性解码器的一般类，如果访问结构是类型Qd+1，则存在无差错可验证的d-MSS方案。最后，我们将d-乘法性质推广到d-或更小的版本，其中d' ≤ d的乘法秘密的数量d'是事先未知的。我们表明，一个d-或更少的MSS计划可以从任何d-MSS计划相同的访问结构与恒定的开销，和（可验证）的d-MSS的可行性意味着（可验证）的d-或更少的MSS。
A d-multiplicative secret sharing (d-MSS) scheme allows the players to multiply d shared secrets without recovering the secrets by converting their shares locally into an additive sharing of the product. It has been proved that the d-MSS among n players is possible if and only if no d unauthorized sets of players cover the whole set of players (type Qd). Although this result implies some limitations on SS in the context of MPC, the d-multiplicative property is still useful for simplifying complex tasks of MPC by computing the product of d field elements directly and non-interactively without any setup. This paper aims to improve the usefulness of the d-MSS by enhancing the security against malicious adversaries. First, we introduce the notion of verifiably multiplicative SS, verifiably MSS for short, which is mainly formalized for detecting malicious behaviors. Informally, an SS scheme is verifiably d-multiplicative if the scheme is d-multiplicative and further enables the players to locally generate a share of a proof that the summed value is correct (i.e., the product of d shared secrets). Secondly, we prove that there is no error-free verifiably MSS scheme whose decoder of the proof is additive, and that by accepting an error probability that can be chosen arbitrarily, there exists a verifiably d-MSS scheme realizing a given access structure if and only if the access structure is of type Qd. In the proposed construction, each share of a proof consists of only two field elements. This result means that we can efficiently achieve the optimal resiliency of the standard d-MSS even against malicious adversaries. We note that by allowing a general class of decoders that includes a linear one, there is an error-free verifiably d-MSS scheme if the access structure is of type Qd+1. Finally, we generalize the d-multiplicative property to a d-or-less version where the number d' of multiplied secrets with d' ≤ d is not known in advance. We show that a d-or-less MSS scheme can be constructed from any d-MSS scheme of the same access structure with a constant overhead, and the feasibility of (verifiably) d-MSS implies that of (verifiably) d-or-less MSS.