We determine the worst case information rate for all secret sharing
schemes based on trees. It is the inverse of $2-1/c$, where $c$ is the size of the maximal core in the tree. A {\it core} is a connected subset of the vertices so that every vertex in the core has a neighbor outside the core. The upper bound comes from an application of the entropy method, while the lower bound is achieved by a construction using Stinson\u27s decomposition theorem.

It is shown that $2-1/c$ is also the {\it fractional cover number} of the tree where the edges of the tree are covered by stars, and the vertex cover should be minimized. We also give an $O(n^2)$ algorithm which finds an optimal cover on any tree, and thus a perfect secret sharing scheme with optimal rate

Gabor Tardos

Laszlo Csirmaz

Cryptology ePrint Archive

Secret sharing on trees: problem solvedLászló Csirmaz∗ Gábor Tardos†AbstractWe determine the worst case information rate for all secret sharing schemes based on trees.It is the inverse of 2 − 1/c, where c is the size of the maximal core in the tree. A core is aconnected subset of the vertices so that every vertex in the core has a neighbor outside thecore. The upper bound comes from an application of the entropy method [2, 3], while thelower bound is achieved by a construction using Stinson’s decomposition theorem [7].It is shown that 2 − 1/c is also the fractional cover number of the tree where the edgesof the tree are covered by stars, and the vertex cover should be minimized, cf [5]. We alsogive an O(n2) algorithm which finds an optimal cover on any tree, and thus a perfect secretsharing scheme with optimal rate.Keywords. Secret sharing scheme; information rate; graph; fractional packing and cover;entropy method.1 IntroductionSecret sharing schemes has been investigated in several papers, for an extended bibliography see[8]. Such a scheme is a randomized distribution of a secret among participants so that the secretcan be recovered by any qualified subset of participants, while the total information an unqualifiedsubset receives is (statistically) independent of the secret itself. The scheme is based on the graphG if the participants are the vertices, and a subset of vertices is qualified just in case it containsan edge. Thus the minimal qualified subsets are the edges, the maximal unqualified subsets arethe independent vertex sets (i.e. subgraphs which span the empty graph).The worst case efficiency of a scheme is measured by the amount of information the mostheavily loaded participant must remember for each bit in the secret. For a graph G the informationratio of G, denoted as R(G), is the infimum of the efficiency of all schemes based on G. Theinformation rate, usually denoted as ρ(G), is just the inverse of this value.The information rate has been investigated for graphs with at most six vertices in [4], wherethe authors conclude:An open research problem is to study secret sharing schemes for the 18 connectedgraphs on six vertices for which the optimal worst-case information rate is yet unknown.While we did not advance on these sporadic problems, we determine the optimal rate for animportant infinite family of graphs, namely that of the trees. To state our result we need thenotion of the core of a graph G.Definition 1.1 Let X be a connected subset of vertices in G. X is a core if for each v ∈ X thereis a neighbor of v not in X such that from X it its connected to v only, and these neighbors forman independent set.When G is a tree we only need to require that all v ∈ X have a neighbor outside X. Theseneighbors will automatically satisfy the remaining conditions of the definition.∗Central European University†Rényi Institute of Mathematics1Theorem 1.2 Let G be a (connected) tree, and let c = c(G) be the size of the maximal core inG. The information ratio of G is R(G) = 2− 1/c, i.e. the information rate is ρ(G) = c/(2c− 1).Let n be the number of vertices in G. The number c(G) can be determined in G in O(n2) steps.Furthermore a perfect secret sharing scheme based on G can be constructed in O(n2) steps as wellwhich has optimal worst case ratio.In section 2 we show that 2− 1/c ≤ R(G) using the entropy method, see [2, 3]. The method isbased on the observation that the shares and the secret are random variables, and the ratio canbe expressed as a function of the Shannon entropy of these variables.The direction R(G) ≤ 2 − 1/c is dealt with in section 3 and uses two main tools. One isStinson’s decomposition theorem [7] which lets us compose simple schemes into a composite one.The other tool is a new fractional packing result.A star is packed into G if the star’s center goes to a node v of G, and the rays end at differentneighbors of v. Of course, not necessarily all neighbors of v are part of the star. Different packedstars may share the same edge. In a fractional packing the packed stars have positive real weights.The fractional vertex cover is the least upper bound on the weight of the vertices under thecondition that all edges have weight at least 1. For more about fractional packing and coveringsee [6].Theorem 1.3 Let G be a connected tree. The fractional vertex cover number of G, when theedges of G are covered by stars, is 2 − 1/c where c = c(G). Moreover an optimal packing can befound in time O(n2).From the optimal fractional cover a perfect secret sharing scheme with the same ratio can beconstructed using the aforementioned Stinson’s decomposition method [7]. The complexity of thisconstruction is linear in the size of the cover.2 Lower boundIn this section we show that the information ratio of an arbitrary graph is at least 2− 1/c wherec is the size of any core in G. This proves the 2 − 1/c ≤ R(G) part of Theorem 1.2. We remarkthat while this bound is sharp for trees, in general it gives only a proper lower bound. The graphdepicted on figure 1 has ratio 3/2 = 2− 1/2, see [2], while it has only one-element core.• • ••SSSSFigure 1: Graph with ratio 3/2 and maximal core size 1The proof uses the entropy method, see, e.g. [2, 3]. For the sake of the reader we sketch theidea behind it. As shares are random variables, their size is measured by the Shannon entropy.There are well-known inequalities this entropy satisfies, and they are used to get a lower bound onthe entropy – and thus on the size – of the share of some participant. Instead using the entropydirectly, it is customary to scale it down so that the secret has value one, and then the methodsimply boils down to exhibit a participant who is assigned a value ≥ c.Thus we are given a function f which assigns real numbers to the subsets of participants – therelative entropy of that subset. Values assigned to the vertices correspond to the relative size ofthe assigned share. f satisfies the following inequalities derived from the corresponding propertiesof the entropy function:(a) f(A) ≥ 0, f(∅) = 0(b) f(A) ≥ f(B) when A ⊇ B (monotonicity)(c) f(A) + f(B) ≥ f(AB) + f(A ∩B) (submodularity)2(d) f(A) ≥ f(B) + 1 when A ⊇ B, A is qualified while B is not (strict monotonicity)(e) f(A) + f(B) ≥ f(AB) + f(A ∩ B) + 1 when A, B are qualified while A ∩ B is not (strictsubmodularity)Here, as usual, we write AB instead A ∪ B. Then we have to prove that given any f satisfying(a)–(e), there is always a vertex v with f(v) ≥ c.Theorem 2.1 Let X ⊆ G be a core in the graph G, and let f be a real valued function defined onthe subsets of the vertices of G satisfying properties (a)–(e). Then∑v∈Xf(v) ≥ 2|X| − 1,i.e. for some vertex v in X we have f(v) ≥ 2− 1/|X|.Proof First we show that if X is connected, then∑v∈Xf(v) ≥ f(X) + |X| − 2. (1)If the elements of X are v1, . . ., vk, then the assumptions imply the existence of vertices w1, . . .,wk such that {w1, . . . , wk} is independent, and wi is connected to vi only in X. Thusf(X) ≥ |X|+ 1by the lemma in [1, 3] dubbed as the “independent sequence lemma.” Thus we need to proveonly (1). Observe that the elements of X can be enumerated so that all initial segments are alsoconnected. Thus we can use induction on the number of the vertices in X.If X has at most two elements, then (1) simplifies tof(a) + f(b) ≥ f(ab)which holds by the submodularity property of f .Now suppose X is connected, has at least two vertices, a is a vertex not in X connected tob ∈ X (maybe among others). Let Y = X − {b}, then none of ab and X = Y b are independent,thus property (e) givesf(ab) + f(Y b) ≥ f(Y ab) + f(b) + 1.Also, f(a) + f(b) ≥ f(ab), which yieldsf(X) + f(a) ≥ f(Xa) + 1.This with the induction hypothesis proves (1). 3 Upper boundTheorem 3.1 Let G be a tree, and suppose each core of G has size at most c. Then we can packstars into G so that (i) all edges are covered exactly c times, and (ii) all vertices are covered atmost 2c− 1 times.Proof We start with assigning positive integers – weights – to each vertex. The weight of a subsetis the sum of the weights of the vertices in that subset. We consider a weighting in which eachvertex has the largest possible weight with the restriction that every core has weight ≤ c. Such aweighting exists: as each vertex is an element of a core, its weight cannot be larger than c. Onthe other hand if all vertices have weight 1, then by the assumption all cores have weight ≤ c. Aswe have finitely many possibilities, we can pick a maximal one.3Replace each edge of G by c directed lines. A covering star will have center at some vertexand its rays will be among the outgoing lines Considering all of these stars, each edge of G willbe covered by exactly c of them. The number of stars with center at v is the maximal number ofoutgoing lines along the edges starting at v; furthermore v is at the end of a ray of a covering starfor each incoming line along the edges at v. Thus the cover number for v is the total number ofall incoming lines, plus the maximal number of outgoing lines along an edge. As there are exactlyc lines along each edge, this cover number is c plus the total number of incoming lines except thesmallest number of incoming lines along any edge.Thus it suffices to show that we can direct the lines so that this latter sum is at most c− 1.•• • A B C D E F G• • • •• • • •@@@@        • • ••• •1 1 1 1 2 1 1 11 1 1 11Figure 2: A tree with weights and maximal core size c = 7Now let v1v2 be an edge. If either v1 of v2 is a leaf, then direct all lines between them towardthe leaf. (If both v1 and v2 are leaves, then G is a single edge, and there is nothing to prove.)If neither v1 nor v2 is a leaf, then removing the edge v1v2 splits the tree into two disjointsubtrees, G1 and G2 where Gi contains vi. Let Ci be a core of maximal weight in Gi whichcontains vi; let this maximal weight be ci. As C1 ∪ C2 is a core of weight c1 + c2, consequentlyc1 + c2 ≤ c. Among the c lines between v1 and v2 direct c1 from v1 towards v2, and c2 from v2towards v1. If c1 + c2 < c then direct the rest of the lines arbitrarily.The tree depicted on figure 2 has maximal core size c = 7, and the numbers show a maximalweighting. Each edge is replaced by seven directed ones, and the numbers the above proceduregives areA→ B A← B B → C B ← C C → D C ← D3 4 6 1 1 2D → E D ← E E → F E ← F F → G F ← G2 5 4 3 6 1For example, when the edge CD is deleted, D is contained in a core which consists of itself only,thus it has weight 2. This gives the value 2 to C ← D.We claim that construction satisfies the above requirement. Indeed, if w is a leaf, then it hasexactly c incoming lines and no outgoing line. Otherwise let w be a non-leaf vertex, and C be acore of maximal weight containing w. By the maximality of weighting, C has weight c (otherwisethe weight of w could be increased). Let v1, v2, . . ., vs be all neighbors of w in C, and let Ci bethe connected part of C containing vi and not containing w. Thenc = weight(C) = weight(w) + weight(C1) + . . .+ weight(Cs).Both Ci and C −Ci are cores. Thus, by the construction, among the c lines between vi and w atleast weight(Ci) goes from vi to w, and at least weight(C − Ci) = c− weight(Ci) goes from w tovi. As their sum is exactly c, these are the exact values. Thus the total number of incoming linesinto w from vertices in C isweight(C1) + . . .+ weight(Cs) = k − weight(w) ≤ c− 1.We have two cases: either w has a leaf neighbor, or it has none. In the first case all non-leafneighbors of w are in C, as C was chosen to be maximal. There are no incoming lines from leaves,thus in this case we are done.4In the other case no neighbor of w is a leaf. Then all but one of them must be in C, let v∗ bethe exceptional neighbor. Now C−Ci is a core in the graph G−{wv∗} which contains w but doesnot contain v∗, thus at least weight(C − Ci) = k − weight(Ci) lines are directed from w towardv∗. It means that that the number of incoming lines from v∗ cannot be more than weight(Ci), i.e.the number of incoming lines from vi. It shows that the smallest number of incoming lines comesfrom v∗, and the total number of incoming lines from the other neighbors is at most c− 1, whichwas to be shown. 4 Main resultsWe turn to the proof of theorems announced in section 1. Let G be a connected tree. The sizeof the maximal core in G can be found as follows. For each node v in G let C(v) be the sizeof the maximal core containing v. We will determine all C(v), and then take the maximum ofthese values. Let v1, . . ., vs be all neighbors of v. Delete v and all edges vvi from the graph, anddetermine for each vi the size of the maximal core containing vi in the component of vi. If v hasa leaf neighbor, then C(v) is one more than the sum of the values C ′(vi) for non-leaf neighbors ofv. If v has no leaf neighbor, then from the values C ′(vi) discard the minimal one, add up all theothers and add one to get C(v).For each node this algorithm uses O(n) steps, thus determining C(G) requires O(n2) steps,proving the statement in Theorem 1.2.The construction in the proof of Theorem 3.1 needs a maximal weighting of the vertices of G.We claim that this weighting can also be found in O(n2) steps. Indeed, enumerate all vertices ofG as v1, . . ., vn, and assign weight 1 to each vertex initially. At the i-th step only the weight ofvi may increase. Following the procedure outlined before and using the present vertex weights,determine the maximal weight core containing vi. If this weight is c then do nothing; if the weightis smaller than c, increase the weight of vi so that it becomes c. By this step no core weight canexceed c, and the weight of vi will be maximal. Handling each vertex requires O(n) steps, thusO(n2) steps are enough to find a maximal weighting.From a maximal weighting covering stars can be generated by going through each edge andfinding a maximal weight core on both sides of the edge. As G is a tree, it has n − 1 edges, andfor each edge the values can be found in O(n) steps, which totals to O(n2) steps again.In the packing guaranteed by Theorem 3.1 we weight each star by 1/c. This fractional packingwill cover each edge, and the weight of each node is at most (2c − 1)/c which proves the secondpart of Theorem 1.3.On the other hand, finding the fraction cover number r of a graph G when the edges arecovered by stars is an LP problem, thus it has an optimal solution where all weights are rationalnumbers. Multiplying everything by the lcm of the denominators of these rationals, we see that,for some integer p, stars can be packed into G so that each edge is covered at least p times, andevery vertex is covered at most r · p times. As each star admits a perfect secret sharing schemewith rate (and ratio) 1, Using Stinson’s decomposition method from [7], we can create a perfectsecret sharing scheme on G which hides p bits of secret, and assigns at most r · p bits of share toeach node. In other words, there is a perfect secret sharing scheme on G with ratio r · p/p = r.Theorem 2.1 shows that r is at least 2−1/c when G has a core of size c, thus the cover numberfor a tree is at least 2− 1/c with c = c(G). This proves Theorem 1.3, and the construction yieldsTheorem 1.2 as well.References[1] C. Blundo, A. G. Gaggia, D. R. Stinson: On the Dealer’s Randomness Required in SecretSharing Schemes Designs, Codes and Cryptography, Vol 11(3), pp.235–260 (1997)5[2] R. M. Capocelli, A. De Santis, L. Gargano, U. Vaccaro: On the size of shares of secret sharingschemes, Journal of Cryptology, vol 6(1993), pp. 157–168[3] Secret sharing schemes on graphs, Studia Mathematica, vol 44(3), pp 297–306, 2007[4] M. van Dijk, T. Kevenaar, G. Schrijen, P. Tuyls: Improved constructions of secret sharingschemes by applying (λ,ω)-decompositions, Inf. Process. Lett. vol 99(4), 2006, pp.154–157[5] Serge A. Plotkin, David B. Shmoys, Eva Tardos: Fast Approximation Algorithms for FractionalPacking and Covering Problems Math. Oper. Res., Vol 20, pp 257–301, 1995[6] Edward R. Scheinerman, Daniel H. Ullman: Fractional Graph Theory: A Rational Approachto the Theory of Graphs Wiley-Interscience, (1997)[7] D. R. Stinson: Decomposition constructions for secret sharing schemes, IEEE Trans. Inform.Theory IT-40 (1994) pp 118–125.[8] D. R. Stinson, R. Wei: Bibliography on Secret Sharing Schemes, available at http://www.cacr.math.uwaterloo.ca/~dstinson/ssbib.html6

Secret sharing on trees: problem solved

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive