Towards Breaking the Exponential Barrier for General Secret Sharing - PowerPoint PPT Presentation

Towards Breaking the Exponential Barrier for General Secret Sharing Tianren Liu Vinod Vaikuntanathan Hoeteck Wee MIT MIT CNRS and ENS May 6, 2018

Secret Sharing [Blakley’79,Shamir’79,Ito-Saito-Nishizeki’87] Secret s ∈ { 0 , 1 }

Secret Sharing [Blakley’79,Shamir’79,Ito-Saito-Nishizeki’87] Secret s ∈ { 0 , 1 } share 1 share 5 share 2 share 4 share 3

Secret Sharing [Blakley’79,Shamir’79,Ito-Saito-Nishizeki’87] Secret s ∈ { 0 , 1 } share 1 share 5 share 2 share 4 share 3 share 3 share 2 share 5 Can I reconstruct s ?

Secret Sharing [Blakley’79,Shamir’79,Ito-Saito-Nishizeki’87] Secret s ∈ { 0 , 1 } share 1 share 5 share 2 share 4 share 3 share 3 share 2 share 5 Can I reconstruct s ? Threshold Secret Sharing [Shamir’79] YES if I gets ≥ t shares; NO INFO if I gets < t shares.

Secret Sharing [Blakley’79,Shamir’79,Ito-Saito-Nishizeki’87] Secret s ∈ { 0 , 1 } share 1 share 5 share 2 share 4 share 3 x 1 ∈ { 0 , 1 } x 2 ∈ { 0 , 1 } x 3 ∈ { 0 , 1 } x 4 ∈ { 0 , 1 } x 5 ∈ { 0 , 1 } share 3 share 2 share 5 Can I reconstruct s ? Threshold Secret Sharing [Shamir’79] YES if I gets ≥ t shares; NO INFO if I gets < t shares.

Secret Sharing [Blakley’79,Shamir’79,Ito-Saito-Nishizeki’87] Secret s ∈ { 0 , 1 } share 1 share 5 share 2 share 4 share 3 x 1 ∈ { 0 , 1 } x 2 ∈ { 0 , 1 } x 3 ∈ { 0 , 1 } x 4 ∈ { 0 , 1 } x 5 ∈ { 0 , 1 } 0: not send 1: send 1: send 0: not send 1: send share 3 share 2 share 5 Can I reconstruct s ? Threshold Secret Sharing [Shamir’79] YES if I gets ≥ t shares; NO INFO if I gets < t shares.

Secret Sharing [Blakley’79,Shamir’79,Ito-Saito-Nishizeki’87] Secret s ∈ { 0 , 1 } share 1 share 5 share 2 share 4 share 3 x 1 ∈ { 0 , 1 } x 2 ∈ { 0 , 1 } x 3 ∈ { 0 , 1 } x 4 ∈ { 0 , 1 } x 5 ∈ { 0 , 1 } 0: not send 1: send 1: send 0: not send 1: send share 3 share 2 share 5 Can I reconstruct s ? Threshold Secret Sharing [Shamir’79] YES if threshold t ( x 1 ,..., x n ) = 1; NO INFO if threshold t ( x 1 ,..., x n ) = 0.

Secret Sharing [Blakley’79,Shamir’79,Ito-Saito-Nishizeki’87] Secret s ∈ { 0 , 1 } share 1 share 5 share 2 share 4 share 3 x 1 ∈ { 0 , 1 } x 2 ∈ { 0 , 1 } x 3 ∈ { 0 , 1 } x 4 ∈ { 0 , 1 } x 5 ∈ { 0 , 1 } 0: not send 1: send 1: send 0: not send 1: send share 3 share 2 share 5 Can I reconstruct s ? General Secret Sharing [ISN’89] monotone F : { 0 , 1 } n → { 0 , 1 } YES if F ( x 1 ,..., x n ) = 1; NO INFO if F ( x 1 ,..., x n ) = 0.

Key Complexity Measure: Total Share Size Best Known Secret Sharing Schemes Share size ≤ O (monotone formula size) ≤ ˜ O (2 n ). [Benaloh-Leichter’88] Share size ≤ O (monotone span program size) ≤ ˜ O (2 n ). [Karchmer-Wigderson’93]

Key Complexity Measure: Total Share Size Best Known Secret Sharing Schemes Share size ≤ O (monotone formula size) ≤ ˜ O (2 n ). [Benaloh-Leichter’88] Share size ≤ O (monotone span program size) ≤ ˜ O (2 n ). [Karchmer-Wigderson’93] Lower Bounds ∃ F that share size ≥ ˜ O (2 n / 2 ) for linear secret sharing. [KW’93] ∃ F that total share size ≥ ˜ Ω( n 2 ). [Csirmaz’97]

Key Complexity Measure: Total Share Size Best Known Secret Sharing Schemes Share size ≤ O (monotone formula size) ≤ ˜ O (2 n ). [Benaloh-Leichter’88] Share size ≤ O (monotone span program size) ≤ ˜ O (2 n ). [Karchmer-Wigderson’93] Lower Bounds ∃ F that share size ≥ ˜ O (2 n / 2 ) for linear secret sharing. [KW’93] ∃ F that total share size ≥ ˜ Ω( n 2 ). [Csirmaz’97] Empirical Observation: In general secret sharing, share size grows (polynomially) on representation size.

Key Complexity Measure: Total Share Size Best Known Secret Sharing Schemes Share size ≤ O (monotone formula size) ≤ ˜ O (2 n ). [Benaloh-Leichter’88] Share size ≤ O (monotone span program size) ≤ ˜ O (2 n ). [Karchmer-Wigderson’93] Lower Bounds ∃ F that share size ≥ ˜ O (2 n / 2 ) for linear secret sharing. [KW’93] ∃ F that total share size ≥ ˜ Ω( n 2 ). [Csirmaz’97] Empirical Observation: In general secret sharing, share size grows (polynomially) on representation size. Representation Size Barrier? For any collection of 2 2 Ω( n ) monotone access functions, ∃ F in the collection that requires 2 Ω( n ) share size.

Our results Representation Size Barrier? For any collection of 2 2 Ω( n ) monotone access functions, ∃ F in the collection that requires 2 Ω( n ) share size.

Our results Representation Size Barrier? For any collection of 2 2 Ω( n ) monotone access functions, ∃ F in the collection that requires 2 Ω( n ) share size. Our Theorem: Overcoming the Representation Size Barrier There is a collection of 2 2 n / 2 monotone access functions, s.t. O ( √ n ) . ∀ F in the family has a secret sharing scheme with share size 2 ˜

Our results Representation Size Barrier? For any collection of 2 2 Ω( n ) monotone access functions, ∃ F in the collection that requires 2 Ω( n ) share size. Our Theorem: Overcoming the Representation Size Barrier There is a collection of 2 2 n / 2 monotone access functions, s.t. O ( √ n ) . ∀ F in the family has a secret sharing scheme with share size 2 ˜ Main Tool: Multi-party Conditional Disclosure of Secrets (CDS) O ( √ n ) . Multi-party CDS scheme with communication complexity 2 ˜

Multi-party Conditional Disclosure of Secrets [Gertner-Ishai-Kushilevitz-Malkin’00] . . . x 1 ∈ { 0 , 1 } x 2 ∈ { 0 , 1 } x 3 ∈ { 0 , 1 } x n ∈ { 0 , 1 } C x 1 ,..., x n ∈ { 0 , 1 }

Multi-party Conditional Disclosure of Secrets [Gertner-Ishai-Kushilevitz-Malkin’00] bit s randomness r . . . x 1 ∈ { 0 , 1 } x 2 ∈ { 0 , 1 } x 3 ∈ { 0 , 1 } x n ∈ { 0 , 1 } C x 1 ,..., x n ∈ { 0 , 1 }

Multi-party Conditional Disclosure of Secrets [Gertner-Ishai-Kushilevitz-Malkin’00] bit s randomness r . . . x 1 ∈ { 0 , 1 } x 2 ∈ { 0 , 1 } x 3 ∈ { 0 , 1 } x n ∈ { 0 , 1 } C x 1 ,..., x n ∈ { 0 , 1 } gets s if and only if F ( x 1 ,..., x n ) = 1

Multi-party Conditional Disclosure of Secrets [Gertner-Ishai-Kushilevitz-Malkin’00] bit s randomness r . . . x 1 ∈ { 0 , 1 } x 2 ∈ { 0 , 1 } x 3 ∈ { 0 , 1 } x n ∈ { 0 , 1 } m 2 m 3 m 1 m n C x 1 ,..., x n ∈ { 0 , 1 } gets s if and only if F ( x 1 ,..., x n ) = 1

Multi-party Conditional Disclosure of Secrets [Gertner-Ishai-Kushilevitz-Malkin’00] bit s randomness r . . . x 1 ∈ { 0 , 1 } x 2 ∈ { 0 , 1 } x 3 ∈ { 0 , 1 } x n ∈ { 0 , 1 } m 2 m 3 m 1 m n C x 1 ,..., x n ∈ { 0 , 1 } ◮ Correctness: When F ( x 1 ,..., x n ) = 1, Charlie gets s .

Multi-party Conditional Disclosure of Secrets [Gertner-Ishai-Kushilevitz-Malkin’00] bit s randomness r . . . x 1 ∈ { 0 , 1 } x 2 ∈ { 0 , 1 } x 3 ∈ { 0 , 1 } x n ∈ { 0 , 1 } m 2 m 3 m 1 m n C x 1 ,..., x n ∈ { 0 , 1 } ◮ Correctness: When F ( x 1 ,..., x n ) = 1, Charlie gets s . ◮ IT Privacy: When F ( x 1 ,..., x n ) = 0, Charlie learns nothing about s .

Multi-party Conditional Disclosure of Secrets [GIKM’00] Multi-party CDS bit s randomness r . . . x 1 x 2 x 3 x n m 2 m 3 m 1 m k C x 1 ,..., x k gets s iff F ( x 1 ,..., x n ) = 1 for some public F

Multi-party Conditional Disclosure of Secrets [GIKM’00] Multi-party CDS “Promise” secret sharing bit s randomness r A 0 B 0 C 0 D 0 E 0 . . . A 1 B 1 C 1 D 1 E 1 x 1 x 2 x 3 x n n / 2 buckets m 2 m 3 m 1 m k C x 1 ,..., x k gets s iff F ( x 1 ,..., x n ) = 1 for some public F

Multi-party Conditional Disclosure of Secrets [GIKM’00] Multi-party CDS “Promise” secret sharing bit s randomness r A 0 B 0 C 0 D 0 E 0 . . . A 1 B 1 C 1 D 1 E 1 x 1 x 2 x 3 x n n / 2 buckets m 2 m 3 ◮ Promise: Exactly one m 1 m k participant from each bucket C x 1 ,..., x k gets s iff F ( x 1 ,..., x n ) = 1 for some public F

Multi-party Conditional Disclosure of Secrets [GIKM’00] Multi-party CDS “Promise” secret sharing bit s randomness r A 0 B 0 C 0 D 0 E 0 . . . A 1 B 1 C 1 D 1 E 1 x 1 x 2 x 3 x n n / 2 buckets m 2 m 3 ◮ Promise: Exactly one m 1 m k participant from each bucket ◮ A x 1 , B x 2 ,..., E x 5 recover s if C x 1 ,..., x k F ( x 1 ,..., x 5 ) = 1 gets s iff F ( x 1 ,..., x n ) = 1 for some public F

Multi-party Conditional Disclosure of Secrets [GIKM’00] Multi-party CDS “Promise” secret sharing bit s randomness r A 0 B 0 C 0 D 0 E 0 . . . A 1 B 1 C 1 D 1 E 1 x 1 x 2 x 3 x n n / 2 buckets m 2 m 3 ◮ Promise: Exactly one m 1 m k participant from each bucket ◮ A x 1 , B x 2 ,..., E x 5 recover s if C x 1 ,..., x k F ( x 1 ,..., x 5 ) = 1 gets s iff F ( x 1 ,..., x n ) = 1 ◮ # access functions = 2 2 n / 2 for some public F

Multi-party Conditional Disclosure of Secrets [GIKM’00] Multi-party CDS “Promise” secret sharing bit s randomness r A 0 B 0 C 0 D 0 E 0 . . . A 1 B 1 C 1 D 1 E 1 x 1 x 2 x 3 x n n / 2 buckets m 2 m 3 ◮ Promise: Exactly one m 1 m k participant from each bucket ◮ A x 1 , B x 2 ,..., E x 5 recover s if C x 1 ,..., x k F ( x 1 ,..., x 5 ) = 1 gets s iff F ( x 1 ,..., x n ) = 1 ◮ # access functions = 2 2 n / 2 for some public F ◮ A 0 ’s share = m 1 (0 , s , r ), A 1 ’s share = m 1 (1 , s , r ), etc

Multi-party Conditional Disclosure of Secrets [GIKM’00] bit s randomness r . . . x 1 x 2 x 3 x n m 2 m 3 m 1 m n Public F : { 0 , 1 } n → { 0 , 1 } C x 1 ,..., x n ∈ { 0 , 1 } ◮ Correctness: When F ( x 1 ,..., x n ) = 1, Charlie gets s . ◮ IT Privacy: When F ( x 1 ,..., x n ) = 0, Charlie learns nothing about s .