Berkeley CS276 & MIT 6.875 Secret sharing and applications - PowerPoint PPT Presentation

Berkeley CS276 & MIT 6.875 Secret sharing and applications Lecturer: Raluca Ada Popa

Starting to record •

Nuclear launch codes • A judge, president and general receive shares 𝑡 ! , 𝑡 " , 𝑡 # of a secret 𝑡 from a dealer. If the nuke station receives 𝑡 , it launches the nuke If any two come together, their shares together should reveal no info • about about 𝑡 𝑡 ! 𝑡 " 𝑡 Ideas? 𝑡 # 3

Nuclear launch codes: xor secret sharing A trusted dealer chooses 𝑡 ! and 𝑡 " randomly in 0,1 $ , and • computes 𝑡 # = 𝑡 ⊕ 𝑡 ! ⊕ 𝑡 " The parties recover 𝑡 by computing 𝑡 ! ⊕ 𝑡 " ⊕ 𝑡 # • 𝑡 ! 𝑡 " 𝑡 𝑡 # 4

Nuclear launch codes: xor secret sharing A trusted dealer chooses 𝑡 ! and 𝑡 " randomly in 0,1 $ , and • computes 𝑡 # = 𝑡 ⊕ 𝑡 ! ⊕ 𝑡 " The parties recover 𝑡 by computing 𝑡 ! ⊕ 𝑡 " ⊕ 𝑡 # • Claim: nothing is learned about 𝑡 from any one or two shares shares ] = Pr[𝑡] Pr 𝑡 (information theoretic security) 5

Nuclear launch codes: xor secret sharing A trusted dealer chooses 𝑡 ! and 𝑡 " randomly in 0,1 $ , and • computes 𝑡 # = 𝑡 ⊕ 𝑡 ! ⊕ 𝑡 " The parties recover 𝑡 by computing 𝑡 ! ⊕ 𝑡 " ⊕ 𝑡 # • 3-out-of-3 secret sharing How about 𝑜 -out-of- 𝑜 xor secret sharing? Similarly, choose 𝑡 ! , … , 𝑡 "#! ← 0,1 $ , and set 𝑡 " = 𝑡 ⊕ 𝑡 ! ⊕ ⋯ ⊕ 𝑡 "#! . 6

How about 1-out-of-3 xor secret sharing? • Trivial: 𝑡 + = 𝑡 , = 𝑡 - = 𝑡 7

Shamir secret sharing • 𝑢 -out-of- 𝑜 : any 𝑢 shares out of 𝑜 shares can recover the secret • Shamir, Adi (1979), "How to share a secret" 8

Syntax Let 𝐺 be a finite field of size 𝑄 a prime number. Let 0< 𝑢 ≤ 𝑜 < 𝑄. A 𝑢 -out-of- 𝑜 secret sharing scheme for 𝐺 is a pair of PPT algorithms (Share, Recover): Share( 𝑡 ∈ F ) outputs 𝑡 ! , 𝑡 % , … , 𝑡 " • Recover ( 𝑡 & $ , 𝑡 &% , … , 𝑡 & % ) outputs 𝑡 • Correctness: ∀𝑡 ∈ 𝐺, ∀ 𝑡 ! , 𝑡 % , … , 𝑡 " ← Share( 𝑡) , for any subset of 𝑢 distinct indices 𝑗 ! , … , 𝑗 ' of size 𝑢: Recover( 𝑡 & $ , … , 𝑡 & % ) = 𝑡 . 9

Security Given any < 𝑢 shares, absolutely nothing is learned about 𝑡 . Namely, the conditional distribution given the known shares for 𝑡 should be the a priori distribution for 𝑡 : How would you formalize this? ∀𝑤 ∈ 𝐺, ∀ distinct 𝑗 " , … , 𝑗 #$" ∈ 1, 𝑜 Pr[𝑡 = 𝑤 | 𝑡 % ! , … , 𝑡 % "#! ; 𝑡 " , 𝑡 & , … , 𝑡 ' ← Share( 𝑡)] = Pr[𝑡 = 𝑤] 10

Shamir’s intuition • 𝑢 distinct points in 𝐺 determine precisely one polynomial of degree 𝑢 − 1 • 𝑢 − 1 points could belong to an exponential number of polynomials of degree 𝑢 in 𝐺 How would you design it? 11

Shamir’s 𝑢 -out-of- 𝑜 scheme Let 𝛽 " … 𝛽 ' ∈ 𝐺 be distinct non-zero elements known to all parties Share( 𝑡): - sample 𝑏 " , … 𝑏 #$" ← 𝐺 independently and uniformly at random. #$" 𝑏 % 𝑦 % - let 𝑄 ( 𝑦 ) = 𝑡 + ∑ %(" - for each 𝑗, set share 𝑡 % = ( 𝑗 , 𝑄 𝛽 % ) How to recover? 12

Shamir’s 𝑢 -out-of- 𝑜 scheme Let 𝛽 " … 𝛽 ' ∈ 𝐺 be distinct non-zero elements known to all parties Share( 𝑡): 𝑡 % = 𝑄 𝛽 % Recover( 𝑡 % ! , … , 𝑡 % " ): - find a polynomial 𝑟 of degree 𝑢 − 1 such that 𝑟 𝛽 % $ = 𝑡 % $ , ∀𝑘 - output 𝑡 to be 𝑟(0) Why? Theorem: Shamir’s scheme is correct and secure 13

Lagrange interpolation Theorem: ∀𝐺, ∀𝑢 distinct values 𝑦 ! , … , 𝑦 " , and every 𝑢 values 𝑧 ! , … , 𝑧 " , there exists a unique polynomial 𝑅 of degree at most 𝑢 − 1 s.t. 𝑅 𝑦 # = 𝑧 # ∀𝑘 Lagrange interpolation in our case: ' 𝛽 & ' − 𝑦 𝑅 𝑦 = 9 𝑡 & ℓ : 𝛽 & ' − 𝛽 & ℓ !*+*' ℓ)! +,ℓ 14

Homomorphism of shares Share( 𝑡): 𝑡 . = 𝑄 𝛽 . homomorphic? Additively homomorphic, 𝑡 $ + 𝑡′ $ is the 𝑗 -th share for 𝑡 + 𝑡′ because the Lagrange interpolation of the sum of the shares is the sum of 𝑄(𝑦) + 𝑄’(𝑦) which evaluates to 𝑡 + 𝑡’ for 𝑦 = 0 ' 𝛽 & ' − 𝑦 - ) : 𝑄 𝑦 + 𝑄′(𝑦) = 9 (𝑡 & ℓ +𝑡 & ℓ 𝛽 & ' − 𝛽 & ℓ !*+*' ℓ)! 15 +,ℓ

How about xor secret sharing? Shares of 𝑡 are 𝑡 + , … , 𝑡 / s.t. 𝑡 + ⊕ ⋯ ⊕ 𝑡 / = 𝑡 Homomorphic for XOR: 0 for 𝑗 ∈ 1, 𝑜 are shares of 𝑡 ⊕ 𝑡’ 𝑡 . ⊕ 𝑡 . 16

What are some problems with using Shamir secret sharing with malicious parties? • If a participants cheats during recover, the wrong secret is recovered. The other participants cannot even tell this is the case. • There is total trust in the dealer of the shares. • The scheme is one time. • The scheme only allows revealing the secret and not computing on it without revealing. 17

Verifiable Secret Sharing (VSS) • The players can verify that their shares are consistent to some committed value • Concept first introduced in 1985 by Benny Chor, Shafi Goldwasser, and Silvio Micali • We will look at Feldman scheme based on Pedersen commitments 18

Setup • Dealer publishes a commitment to 𝑡 and to the polynomial used for the shares 𝑄(𝑦) • The dealer signs all messages it sends to the parties • Each party receiving a share 𝑡 $ can check their share against the commitment 19

Construction Recall Pedersen commitments: 𝑑𝑝𝑛𝑛 𝑦 = 𝑕 % ℎ & ∈ 𝐻 for 𝑠 random, 𝑕, ℎ public Dealer publishes a commitment to 𝑡 and to the polynomial used for the shares 𝑄(𝑦) = 𝑡 + a ! x + ⋯ + 𝑏 "%! 𝑦 "%! = 𝑕 & ℎ ' . , 𝑑𝑝𝑛𝑛 𝑏 ! , … , 𝑑𝑝𝑛𝑛 𝑏 "%! , signed by 𝑑𝑝𝑛𝑛 𝑡 the dealer Let 𝑆(𝑦) be the polynomial with the randomness from these commitments " 𝑦 + ⋯ + 𝑠 #$" x *$" 𝑆 𝑦 = 𝑠 ) + 𝑠 20

Construction The dealer gives to each party 𝑗 : its share 𝑡 . = 𝑄 𝛽 . and 𝑆 𝛽 . . Party 𝑗 checks that "#$ 𝑑𝑝𝑛𝑛 𝑡 ∗ 𝑑𝑝𝑛𝑛 𝑏 + : ! ∗ ⋯ ∗ comm a ;<+ : ! equals 𝑕 = : ! ℎ > : ! 21

Security properties • What malicious behavior of a dealer would this prevent? • What malicious behavior of the parties would this prevent? • What malicious behavior would it not prevent? 22

Security properties (informally) • Parties know their shares are consistent (different subsets of 𝑢 shares will reveal the same value 𝑡 ), or prove misbehavior of the dealer. • Party 𝑗 can check that it indeed received share 𝑗 • Upon reveal, a party can check the share of another party, so a malicious party cannot affect a reveal • Dealer can still commit to 𝑡 of its choice • Still assumes trusted setup of public parameters? 23

Why do the security properties hold? (informally) • Parties know their shares are consistent (different subsets of 𝑢 shares will reveal the same value 𝑡 ), or prove misbehavior of the dealer – Because the commitment is binding • Upon reveal, a party can check the share of another party – Because the commitment is binding Secrecy of the secret What is the hiding property used for? sharing scheme 24

Applications What applications come to mind? 25

Applications • Key recovery for end-to-end encryption • Custody of secrets for cryptocurrencies 26

End-to-end encryption Server Hello K&4!f K&4!f Hello The server cannot decrypt user data The server is not a central point of attack, does not have the decryption key

End-to-end encryption Server Hello K&4!f K&4!f Hello The server cannot decrypt user data

Key recovery is challenging key recovery end-to- usability end security

Key recovery challenge client server backup: Secret Usability issue: If Alice loses her key, she loses access to her data (e.g., PGP) Security issue: Existing solutions prefer to compromise on security: save key at the server! Ideas?

Secret sharing keys Each user chooses a set of trusted users who can reconstruct her lost key • None of the users in the group can reconstruct the key by itself • Alice Alice’s approval group: 2 out of 3 must agree admin 2 Alice’s boss admin 1

Richer policies for organizations OR How would you implement this? AND AND 2/2 3/4 Alice’s Boss Admin1 Bob Chris Dan Matt

Cryptocurrency application • We saw that secret keys control assets in Bitcoin, Zcash, etc. • Need to back these secret keys to prevent asset loss • Ideas? – Some crypto custodians offer secret sharing 33

Cryptocurrency application Even storing the secret on the user device that performs payments is worrisome, so newer technologies store the secret key secret shared and sign transactions using it by recovering the secret from shares “under encryption” – we will learn how to do this in secure-multi party computation Another huge application of secret sharing 34