In the examples we gave above, we pointed out that Shamir’s scheme can be seen as a cryptographic variant of Reed-Solomon codes. More generally, notice that error-correcting codes and secret-sharing schemes share the goal of recovering data from a partially incomplete input; we speak of erasure- correction for codes and of (r-) reconstruction for secret-sharing schemes. In fact, there is a rich and fruitful interplay between Secret Sharing and Coding Theory [51, 19, 14, 69]. As a first step to discuss the connection between the two fields, we recall the concept of linear secret-sharing scheme, which also serves as a building block for other primitives such as Secure Multi-Party Computation. For the rest of this section, we focus onrandomized schemes.
Definition 2.6.1. Let F be a finite field and let S0,S1, . . . ,Sn be F-vector spaces. A randomized secret-sharing scheme (s,s) ∈$ S0×(S1× · · · × Sn)
is said to be F-linearif the set C(s,s) :=
(ˆs,ˆs) : p (s,s) = (ˆs,ˆs)
>0 is an F-subspace ofS0×(S1× · · · × Sn).
Thus to every F-linear secret sharing scheme (s,s) is associated an F-linear
codeC(s,s). Massey [51] pointed out that the converse is also true: namely, any
linear code satisfying certain non-degeneracy conditions gives rise to a secret- sharing scheme; recall that we typically identify a randomized scheme (s,s) uniformly distributed over a set C with the setCitself (cf. Definition 2.5.3).
Lemma 2.6.1. LetC be a linear code of lengthn+ 1over a finite fieldF; then
C is a linear, randomized secret-sharing scheme if the following two conditions are met:
(i) π0(C)6={0}.
(ii) If (x0,0, . . . ,0)∈ C, thenx0= 0as well.
Proof. Since the projectionπ0is a linear map intoFand is not identically zero
by condition (i), then it is regular, i.e. every element inFhas the same number
of pre-images under π0; this means thatsis uniformly distributed overF.
The reconstruction algorithm Reconstruct recovers the codeword x ∈ C
that matches the input symbols, and outputs x0; condition (ii) ensures that
Reconstructis well-defined, given thatC is linear. Finally, the secret-sharing scheme obtained in this way is linear by definition.
While this connection may seema posterioristraightforward, it is not straight- forward to see how the parameters of the code translate to parameters of the corresponding secret-sharing scheme. We give here only a brief overview of Massey’s analysis; the reader can refer to [19] for a more accurate and insight- ful discussion.
Let thus C be a linear code of parameters [n+ 1, K, D] over a fieldF. Then
the reconstruction threshold of the secret-sharing scheme obtained from C is upper-bounded by (n+1)−D+1 (this can be easily proved by arguing over the minimum distance of C); on the other hand, computing (or lower-bounding) the privacy threshold of the scheme requires working with the dual codeC⊥,
as showed in the following lemma.
Lemma 2.6.2. Given a linear code C of length n+ 1, let C⊥ be its dual; let
w := min{wH(y) : y∈ C⊥,y0 6= 0}, and assume that w ≥2. We then have
that the secret-sharing scheme induced from C has t= (w−2)-privacy, where this bound is tight. In particular, we have that t≥dmin(C⊥)−2; further, for
any secrets∈F we have that any set ofdmin(C⊥)−2 shares associated tosis
uniformly distributed in Fdmin(C⊥)−2.
Proof. We only give a sketch of the proof. Fix an arbitrary B ⊆ [n] with
|B| = n−w+ 2 and let A := [n]\ B (thus A is an arbitrary subset of [n] of cardinality w−2). We then have that there exists a codeword ˆx ∈ C
with ˆx0 = 1 and ˆxA = 0: this can be proved by observing that the map
ρ:πB(C⊥)→F,yB 7→y0 is well-defined (notice that since|B|=n−w+ 2,
for any y∈ C⊥, ify
B=0theny0= 0 as well), and then constructing ˆyfrom
the coefficients of the linear formρ(extended toFB).
Thus for any A ⊆[n] with|A| =w−2 there exists a codeword ˆx∈ C with ˆ
is surjective: indeed, notice that a preimage of (s,xA) is given byx+(s−x0)·xˆ.
By the linearity of this map, it can then be easily argued that for a random
x∈$C,x0andxAare independently distributed: thus the scheme has (w−2)-
privacy.
To see that the bound is tight, observe that by definition of w there exists ˆ
y∈ C⊥ andB ⊆[n],|B|=w−1 with ˆy
06= 0 and ˆyB¯=0. Now since ˆy∈ C⊥,
we have that xyˆT = 0 for any x ∈ C, which means that x
0 =−(xByˆBT)/yˆ0;
thus the w−1 symbols of xin B uniquely determine x0, so that there is no
(w−1)-privacy.
For what concerns our last claim, letA0be a subset of{1, . . . , n}of cardinality
dmin(C⊥)−2; thanks to the linearity of π0 and πA0, it suffices to prove that
the projection map πA0 is surjective on{x∈ C : x0=s}for any secrets∈F.
To this end, let A00 := {0} ∪ A0; we show that the projection map π A00 :
C →FA 00
is surjective, which implies the claim. Indeed, letG:= (x(j) : j =
1, . . . ,dim(C)) be a generator matrix of C, and let GA00 be the submatrix of
G with column indexes in A00. Since |A00| = d
min(C⊥)−1, we have that if GA00·yTA00=0, thenyA00=0: indeed, by adding 0 on the coordinates outside
A00 we can completey
A00 toy∈ C⊥ withwH(y) =wH(yA00). This means that
ker(GA00) ={0}; by the rank-nullity theorem, this implies that the rows of
GA00 span the wholeFA 00
, which concludes the proof.
A similar tight bound can be computed for the reconstruction threshold, though discussing it would be beyond the scope of this dissertation. Also notice that in case C is an MDS code of parameters [n+ 1, t+ 1, n−t+ 1], then the corresponding scheme has t-privacy and (t+ 1)-reconstruction: this can be easily proved by working with information sets ofC.
This connection has the following downside: computing the parameter w of Lemma 2.6.2 is often not possible, and the dual distance dmin(C⊥) is used
instead as a lower bound. Thus codes are needed that have at the same time good distance (to control reconstruction) and good dual distance (to control privacy), and this can be problematic. We further discuss this issue in Chapter 3, motivating our search for a new connection between Secret Sharing and Error-Correcting Codes.
Chapter 3
New Constructions of
Secret-Sharing Schemes
from Error-Correcting
Codes
We present in this chapter our contributions to the field of Secret Sharing. We start by establishing a new connection between Secret Sharing and Error- Correcting Codes, that allows for a better control of the privacy and recon- struction thresholds compared to previous work.
We then show two applications of this connection: the first and more direct one is discussed in Section 3.2, and yields a family of secret-sharing schemes with linear-time sharing and reconstruction.
The second application is presented in Section 3.3; we use our new connection as a starting point to construct robust secret-sharing schemes, making use of highly list-decodable codes and AMD codes. We show how in this way we can obtain robust secret-sharing schemes with optimal overhead.
The content of this chapter is based on the article [20], written with Ronald Cramer, Ivan Damg˚ard, Nico D¨ottling and Serge Fehr.
3.1
A New Connection between Secret Sharing
and Error-Correcting Codes
As we have discussed in Chapter 2, Section 2.6, linear secret-sharing schemes and linear error-correcting codes are tightly connected, namely Massey pointed out that there is a natural one-to-one correspondence between them (albeit some degenerate codes have to be excluded).
In the same section, we remarked that the key point of Massey’s analysis is that it allows us to compute (or estimate) fundamental properties of a secret- sharing scheme in terms of the underlying code and of its dual. We now recall how this estimation works, and point out its shortcomings.
A linear code C of length n+ 1 over a field F is a secret-sharing scheme if two non-degeneracy conditions onC are met (we implicitly consider a random variable (s,s)∈Fn+1 uniformly distributed overC). Massey’s analysis allows
us to compute the privacy and reconstruction thresholds in terms of param- eters of C and of its dual codeC⊥; tight values can be obtained in this way,
but bounds (not necessarily tight) are easier to compute: namely, the recon- struction thresholdrsatisfiesr≤n−dmin(C) + 2, while the privacy threshold t satisfies1 t≥dmin(C⊥)−2.
Hence to estimate the privacy and reconstruction parameters in this way, one needs to control both the codeC and its dual, which can sometimes be trou- blesome. For instance, if we want to use Massey’s paradigm to construct a family of secret-sharing schemes with linear-time sharing and reconstruction, we need a family of linear-time encodable and decodable codes; however, cur- rently known codes with these properties have very bad dual codes, so that the bound on the privacy is too low to be useful.
We circumvent this problem by establishing a new connection between linear secret-sharing schemes and linear codes; the key point of this alternative con- nection is that it de-couples the privacy threshold of a scheme from the dual of the underlying code, hence allowing to compute better bounds for the former. Intuitively, our connection differs from Massey’s for the following reason: in Massey’s, both the shares and the secret of a secret-sharing scheme are seen as the symbols of a codeword in a certain code; on the other hand, in our construction the shares are still given by symbols of a codeword, but the secret is given by an arbitrary function acting on the codeword.
We formalize this in the following definition; here, the “decoding algorithm” of a code Cthat we make use of takes as input a word y∈(Fmt {⊥})n, and
1Here, we implicitly assume thatd
outputs a codeword x∈ C withdH(x,y)< dmin(C). If such a codeword does
not exist or is not unique, the algorithm outputs an error message ⊥.
Definition 3.1.1(Secret Sharing from Codes). LetCbe a (folded)F- linear code of lengthnwith decoding algorithmDecode, and letf :C → S0
be a surjective linear map, whereS06={0}is a finite-dimensionalF-vector space. The associated secret-sharing schemeSSS(C,f) is then given by
• Share : S0 →$ C, where Share(s) is uniformly distributed over f−1(s)for anys∈ S
0;
• Reconstruct: (Fmt {⊥})n
→ S0t {⊥} whereReconstruct(y) := f(Decode(y)).
Similarly, the associated randomized secret-sharing schemeRanSSS(C,f) is
given by the space
{(f(x),x) : x∈ C}
where the reconstruction algorithm Reconstructis the same as above.
It is immediately seen that the schemes obtained in this way are F-linear.
Our new connection and Massey’s are related in the following way: ifC0 is the
code of length n+ 1 in Massey’s connection, then the code C of our’s is the
punctured code
C:={x∈Fnq : ∃x∈Fwith (x,x)∈ C
0}.
and the reconstruction map f :C →Fis simply given byx7→x: (x,x)∈ C0. Remark 3.1.1. Let SSS and RanSSS be the secret-sharing schemes obtained from a code C and a function f as in Definition 3.1.1. We then have that sharing a random secret viaSSSyields the same distribution asRanSSS: indeed, notice that since Share(ˆs) is uniformly distributed overf−1(ˆs) for any ˆs, the
claim holds if we show that f(x) and Share(s) are uniformly distributed in
S0 and C, respectively. Now since f is linear and surjective, then it is also
regular, i.e. every element in the codomain of f has a constant number of preimages under f, so that the claim follows. In particular, the privacy and reconstruction thresholds of SSSandRanSSScoincide.
The interesting point of this connection is computing the privacy and recon- struction thresholds of a secret-sharing scheme in terms of the underlying code and surjective function. We discuss privacy and reconstruction sepa- rately; thanks to the above remark, it suffices to compute the thresholds for the randomized scheme.
Proposition 3.1.1(Reconstruction Threshold). Given positive integersn
andr≤n, letC be a (folded) linear code of lengthnoverFand letf :C → S0
be a surjective, F-linear function.
Assume that C can be corrected from n−rerasures; we then have the secret- sharing schemesSSS(C,h) andRanSSS(C,h)obtained as in Definition 3.1.1 have r-reconstruction.
Proof. We prove the statement for RanSSS(C,h). Let x denote the random
variable uniformly distributed over C; fix a subsetB ⊆[n] with|B| ≥r, and let ˜x∈$(Fmt {⊥})n be defined by ˜xB:=xB, ˜xi:=⊥for anyi /∈ B.
Since C can be corrected from n−r erasures, we have that Decode(˜x) =x
with probability 1; hencef(Decode(˜x)) =f(x) with probability 1, so that the claim is proved.
Next, we focus on the privacy threshold, which now no longer depends on the dual of the codeC; the following characterization was first given as Theo- rem 10 of [14], where it was used to prove the existence of ramp schemes with high information rate (i.e., high ratio between secret size and share size). We rephrase it here to match our formulation.
Proposition 3.1.2 (Privacy Threshold). LetC be a (folded) linear code of lengthn overFand letf :C → S0 be a surjective,F-linear function.
Let 0 < t < n be an integer; then the secret-sharing schemes SSS(C,h) and
RanSSS(C,h)obtained from C andf havet-privacy if and only iff(ker(πA)) =
S0 for any A ⊆[n]with|A|=t, whereπA denotes the projection map from C
toFA.
Proof. We prove the statement for SSS(C,h). Fix an arbitrary A ⊆ [n] with
|A|=t; clearly, the claim holds if we prove the following equivalence:
πA(f−1(s)) =πA(f−1(0)) for anys∈ S0
m
Now fix an arbitrarys∈ S0; observe that for anys∈ S0we can writef−1(s) = x0+ kerf wherex0is any fixed element off−1(s); thusπA(f−1(s)) =πA(x0) +
πA(kerf), so that
πA(f−1(s)) =πA(f−1(0))
m
there existsx0 ∈f−1(s) withπA(x0) =0.
The claim follows.
As a concluding remark for this section, notice that a downside of our con- nection is that it provides no obvious way to construct multiplicative secret- sharing schemes, where a secret-sharing scheme is called multiplicative if there exists a vector v such that for any two share vectors s and s0 associated to secrets s, s0 respectively, it holds that ss0 =v(s?s0)T, where ? denotes the
component-wise product. Multiplicativity is an important property because it allows us to use secret-sharing schemes to construct protocols for Multi-Party Computation [18, 14]; it is thus an interesting open problem to modify our construction paradigm so that it yields multiplicative schemes.