Recently, two novel schemes have been proposed for hierarchical threshold secret sharing, one based on Birkoff interpolation and another based on bivariate Lagrange interpolation. In this short paper, we propose a much simpler solution for this problem

Ali Aydin Selcuk

Ferruh Ozbudak

Kerem Kaskaloglu

Cryptology ePrint Archive

On Hierarchical Threshold Secret SharingAli Aydın Selçuk1, Kerem Kaşkaloğlu2, and Ferruh Özbudak31 Department of Computer EngineeringBilkent University, 06800, Ankara, Turkeyselcuk@cs.bilkent.edu.tr2 Department of MathematicsAtilim University, 06836, Ankara, Turkeykeremk@atilim.edu.tr3 Department of Mathematics, and Institute of Applied MathematicsMiddle East Technical University, 06531, Ankara, Turkeyozbudak@metu.edu.trAbstract. Recently, two novel schemes have been proposed for hierar-chical threshold secret sharing, one based on Birkoff interpolation andanother based on bivariate Lagrange interpolation. In this short paper,we propose a much simpler solution for this problem.Keywords: Secret sharing, threshold cryptography, hierarchical accessstructures.1 IntroductionA (conjunctive) hierarchical threshold secret sharing (HTSS) problem in an n-member user set U is defined by a partition of the user set into m disjoint subsets(compartments),U = U1 ∪ U2 ∪ . . .Um,where Ui ∩ Uj = ∅ for i 6= j, and a sequence of integers0 < k1 < . . . < kmsuch that the access structure (i.e., the set of authorized subsets) isΓ = {V ⊂ U : |V ∩ (∪ij=1Uj)| ≥ ki ∀i ∈ {1, 2, . . . ,m}}. (1)A detailed discussion of this problem and a comprehensive survey of relatedresults can be found in [6, 7].Tassa [6] and Tassa and Dyn [7] recently proposed two novel and sophisticatedsolutions based on polynomial interpolation for this problem. The former is basedon Birkoff interpolation from an unstructured set of points and derivative values,and the latter is based on bivariate Lagrange interpolation. Both schemes areperfect and ideal.In this short paper, we present a much simpler scheme that achieves the sameresults.2 Proposed HTSS SchemeLet F be a finite field and s ∈ F be the secret to be shared. The dealer generatesa random polynomial P ∈ F[x]of degree km − 1,P (x) =km−1∑j=0ajxj ,such that s = a0 + a1 + . . . akm−1 = P (1). The polynomials Pi, 1 ≤ i ≤ m, arethe truncated versions of P (x) for compartment Ui, defined as,Pi(x) =km−1−ki−1∑j=0ajxj ,where we take k0 = 0 for P1.Each member u is given a different point xu 6= 1 and a secret share Pi(xu),where i denotes his compartment number.For a user u ∈ Ui, his share gives a linear equation for the lowest degreekm−ki−1 coefficients of P but carries no information on the highest degree ki−1coefficients.3 Concluding RemarksIf it is desired to have a0 as the secret, which is more common in Shamir-basedsecret sharing variants [4], the polynomial P can be truncated beginning from thelowest degree coefficients. In this case, the polynomial for the ith compartmentwill bePi(x) =km−1∑j=ki−1ajxj .Each user u will be given a point (xu, Pi(xu)) for some xu 6= 0.Note that, for a moderately large field F, the resulting matrices will be non-singular with an overwhelming probability, and the proposed scheme will be idealand perfect.Furthermore, the proposed scheme can easily be integrated with functionsharing schemes (e.g., [5, 2, 1]) as the secret is reconstructed as the solution of alinear system of equations.4 EpilogueWhen the original manuscript was published on the Cryptology ePrint Archive,we received a number of constructive comments from our colleagues. Most im-portantly, it was pointed out that a scheme very similar to ours was previouslypublished in [3]. It was also stated that the main advantage of the schemes in [6,27] was their efficiency in certain aspects, such as the size of the finite field to beused or the number of determinants to be computed in order to check that aparticular choice of vectors realizes the access structure. We would like to pointout these facts here.AcknowledgmentWe would like to thank Murat Ak for helpful discussions, and to Javier Her-ranz, Svetla Nikova, and an anonymous Journal of Cryptology referee for theirconstructive feedback on an earlier version of this paper.References1. I. N. Bozkurt, K. Kaya, and A. A. Selcuk. Practical threshold signatures with linearsecret sharing schemes. In Proc. of AFRICACRYPT 2009, volume 5580 of LNCS,pages 167–178. Springer-Verlag, 2009.2. J. Herranz, C. Padro, and G. Saez. Distributed RSA signature schemes for generalaccess structures. In Proc. of ISC 2003, volume 2851 of LNCS, pages 122–136.Springer-Verlag, 2003.3. E. Kasper, V. Nikov, and S. Nikova. Strongly multiplicative hierarchical thresholdsecret sharing. In 2nd International Conference on Information Theoretic Security– ICITS 2007, 2007.4. A. Shamir. How to share a secret? Communications of ACM, 22(11):612–613, 1979.5. V. Shoup. Practical threshold signatures. In Proc. of EUROCRYPT 2000, volume1807 of LNCS, pages 207–220. Springer-Verlag, 2000.6. T. Tassa. Hierarchical threshold secret sharing. Journal of Cryptology, 20(2):237–264, 2007.7. T. Tassa and N. Dyn. Multipartite secret sharing by bivariate interpolation. Journalof Cryptology, 22(2):227–258, 2009.3

On Hierarchical Threshold Secret Sharing

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive