Similar to Shamir’s secret sharing scheme, the trusted dealer generates the secret key x ∈ Zp and distributes it among the participants. Let P (z) be a random
polynomial of degree t− 1, such that:
P (z) = a0+ a1z + a2z2+· · · + at−1zt−1
where, a0 = x. The dealer also computes Fi = gPi, for i = 1, 2, . . . t− 1 and
makes these values public. At this point, the trusted authority has distributed the secret key among the participants. The next step is for each participant to verify where the given share is well constructed by following the step below:
1. assuming that the j th participant has been given the share xj, he verifies
that: gxj = t−1 Y l=0 Fjjl
If the share is well constructed, the above equation will hold because: gxj = gP(j)= ga0+a1j+···+at−1jt−1 = t−1 Y l=0 gfljl= t−1 Y l=0 Fjjl
The secret message m can be encrypted using standard El Gamal and sent to the participants as c =hgr, yrmi. To reconstruct the secret key and decrypt the
ciphertext c, any subset of k participants should collude together to compute: m = y rm t Q i=1 grxiLi where t Y i=1 grxiLi = gr( t P i=1 xiLi) = yr and Li = t Y j=1,j6=i j j− 1
2.7
Threshold Public-key Cryptosystems
In threshold public-key cryptosystems, a secret key is distributed among the participants in such a way that each of them holds a share of the secret key. Expressed in a different way, the secret key is not available to a single party and only when a threshold number of participants collude together, will the encrypted ciphertext be successfully decrypted. Compared to a secret sharing scheme, where a central trusted authority is required to generate, split and distribute the key, a
more secure way is to have the participants generate their shares together. Hence, no single party is aware of the complete key. In the next subsection, efficient threshold techniques based on the RSA, El Gamal and Paillier cryptosystems are presented.
2.7.1 Threshold RSA
Due to the algebraic structure of the RSA cryptosystem [RSA78], obtaining threshold properties is more challenging as it requires a product of two prime num- bers to be computed without any of the participants knowing them. Shoup [Sho00], presented a scheme where a trusted dealer is responsible for generating and dis- tributing the RSA modulus as well as the secret key. Using a different approach, Boneh and Franklin [BF97], removed the need for a trusted dealer and described an efficient technique where k parties, k≥ 3 can jointly generate a RSA modulus N. At the end of the protocol, N is publicly known and, the participants are convinced that N is indeed a product of two primes, but none of them knows its factorisation. Additionally, each participant holds a share of the private key exponent, d, that allows threshold decryption. Some steps of the protocol require a third party to interact with the participants, but in the end, they learn nothing about the intermediate steps. At a high level, the protocol for generating the modulus N for k participants P1,P2,. . . ,Pk functions as follows:
1. P1,P2,. . . ,Pk choose large n-bit integers s1, s2, . . . , sk and they keep them
confidential;
2. using a private distributed computation, P1, P2,. . . ,Pk and the helper C,
determine that (s1+ s2+· · · + sk) is not divisible by small primes. If this
step fails, the execution returns to step 1;
3. P1,P2,. . . ,Pkchoose large n-bit integers r1, r2, . . . , rk, they keep them secret
and the trial division phase starts (step 2);
4. using a private distributed computation,P1,P2,. . . ,Pk and C compute:
N = (s1+ s2+· · · + sk)(r1+ r2+· · · + rk)
This step reveals no information about the secret values s1, s2, . . . , sk and
r1, r2, . . . , rk. The value N is publicly known;
5. P1, P2,. . . ,Pk engage in a private distributed computation to test that N
is indeed the product of two primes. If the test fails, then the proto- col is restarted from step 1. The primality test is a mix of the Solovay- Strassen [SS77] and the Rabin-Miller [Rab80] primality tests;
2.7. Threshold Public-key Cryptosystems 29
6. P1,P2,. . . ,Pk engage in a private distributed computation to generate the
public key e and the secret key d exponents. The reader should refer to [BF97] for more details. The intuition behind RSA threshold decryption is similar to El Gamal threshold decryption. The idea is to share the secret exponent, d, and then use Lagrange interpolation to reconstruct t out of k of these.
2.7.2 Threshold El Gamal
A modification of the El Gamal cryptosystem was used by Desmedt and Frankel [DF89] to show that a threshold number of secret key share holders can deci- pher a ciphertext encrypted under the unique public key. A few years later, Pedersen [Ped91b] improved their threshold cryposystem in two ways: first, he removed the need for a trusted party for distributing the key shares and secondly, he showed that each participant can verify that their shares have been distributed correctly.
The generation of the public and secret keys functions as follows: suppose there are n participants (members) S1,S2, . . . ,Sn and all agree upon the El Gamal
parameters, the public key is the tuple hy, g, qi and the corresponding secret key is x = loggy. The generation of the individual keys and their distribution, as described in [Ped91b], is presented here as:
1. each participant Si randomly chooses xi, computes yi = gxi and publishes
yi;
2. the joint public key is then computed as y = Qn
i=1
yi. At the end of this
step, all participants know the public key, but they cannot find the secret key unless all collude together to compute x = Pn
i=1
xi mod q. The next
steps show how a share, xi, is distributed to all other participants, using a
verifiable secret sharing scheme, such that a threshold number t can recover xi:
2.1. Si chooses a random polynomial Pi(z)∈ Zq(z) of degree t− 1. Let
Pi(z) = a(i,0)+ a(i,1)z + a(i,2)z2+· · · + a(i,t−1)zt−1
where a(i,0) = xi;
2.2. Si computes K(i,j) = gPi(j) for j = 0, 1, . . . , k− 1 and broadcasts
(K(i,j))j=1,2,...,k−1. Note that K(i,0) = yi is known beforehand;
2.3. when each participant has sent these k− 1 values, Si signs and sends
2.4. Si verifies that the share s(ji) received from Sj is consistent with the
previously published values by verifying that: gs(ji) = k−1 Y l=0 Kil (j,l)
If this check fails,Sibroadcasts that an error has been found, publishes
the signed s(ji) and then stops;
2.5. finally, Si computes the share of the secret key, x, as the sum of all
shares received in step 2.3. as: si =
n
X
j=0
s(ji) mod q
and signs the public key y. When all participants have signed y, a key authentication centre verifies the signatures, and if they are correct, it makes a certificate showing that y is the public key of the group of participants [Ped91b].
In order to decrypt a ciphertext of a plaintext message m, without revealing the secret key, a set of t participants can work together to compute:
m = my r t Q i=1 grsiLi where Li = t Y j=1,j6=i j j− 1 2.7.3 Threshold Paillier
Paillier and RSA cryptosystems use a quite similar number theory but their decryption process is not quite the same. For simplicity, it is assumed that there is a technique in which a number of participants can jointly generate Paillier’s key pairs, as described in [Sho00] and [BF97]. In this subsection the focus is on the decryption part of the threshold Paillier, as it was first introduced by Fourque et al. in [FPS00]. The description of the original paper is followed and any unnecessary symbols are dropped where appropriate.
Key generation. ∆ = n! is defined, where n is the total number of the partic- ipants S1,S2, . . . ,Sn. The key generation phase consists of the following steps:
1. let N be the product of two strong prime numbers p and q, such that p = 2p0+ 1, q = 2q0+ 1 and gcd(N, φ(N )) = 1;
2.7. Threshold Public-key Cryptosystems 31
2. set k = p0q0 and let β be a random number in Z∗N;
3. g is an integer of order of multiple of N mod N2; 4. (a, b) are randomly chosen from Z∗N × Z
∗
N and set g = (1 + a)N × bN
mod N2;
5. the secret key is λ = βk and is distributed among n participants using Shamir’s secret sharing technique [Sha79], as described in Section 2.6.1:
5.1. P (x) is a random polynomial of degree t− 1, such that a0 = βk and
P (x) = a0+ a1x + a2x2+· · · + at−1xt−1
5.2. the share si of the ith participant Si is P (i);
5.3. the public key is the tuplehN, g, L(gλ)i = hN, g, (aλ mod N)i;
5.4. the verification key for the P (i) share is vi = v∆si mod N2, where v
is a square that generates the cyclic group of squares in Z∗N2. Encryption. To encrypt a message m, r is randomly chosen from Z∗
N and the
ciphertext c = gmrN mod N2 is computed.
Before proceeding to a rigorous analysis, an informal description of the threshold decryption operation is given. A threshold decryption scheme is a multi-party public-key cryptosystem that allows any sufficiently large subset of participants to cooperate and decrypt a ciphertext, but disallows the decryption otherwise. In such schemes, the secret key is typically split into shares using a threshold secret sharing scheme (see Section 2.6). When a sufficiently large subset of participants wants to decrypt the ciphertext, each of them computes a partially decrypted value using its secret key share. Anyone who collects sufficiently many partially decrypted values can decrypt the ciphertext.
Threshold decryption. The threshold decryption functions as follows: 1. using its own share, si, of the secret key, the Si participant computes the
partial decryption of the ciphertext, c, as ci = c2∆si mod N2;
2. Si proves, in zero-knowledge, correct decryption, which assures that c4∆
mod N2 and v∆ mod N2 have been raised to the same power s
i in order
to obtain c2i and vi;
4. t of the shares should collude together to retrieve the plaintext message m as: m = L( t Y i=1 c2µi i mod N 2)× 1 4∆2aλ mod N where µi = ∆Li = ∆ t Y j=1,j6=i j j− 1
Correctness of threshold decryption. The threshold decryption works pro- vided the following equations hold:
∆λ = ∆P (0) = t X i=1 ∆LiP (i) = t X i=1 µisi mod kN so c4∆2λ = t Y i=1 c4∆µisi = t Y i c2µi i mod N 2
The ciphertext c can be decrypted to the plaintext m because: c4∆2λ = g4∆2λm= (1 + N )4a∆2λm= 1 + 4a∆2λmN therefore L( t Y i=1 c2µi i mod N2)× 1 4∆2aλ = 4a∆ 2λm× 1 4a∆2λ = m mod N.
2.8
Zero-Knowledge Proofs
An important component in constructing verifiable Mix Nets and trustworthy electronic voting schemes is the notion of Zero-Knowledge Proof (ZKP), which is an interactive (see Subsection 2.8.1) or non-interactive protocol (see Subsec- tion 2.8.2) between a prover, P, and a verifier, V. In such protocols, the prover interacts with the verifier and should convince the latter of having knowledge of a secret without revealing any information about it. If the prover is honest, the verifier should accept the proof. Otherwise, the verifier should reject the proof with overwhelming probability. In any case, the verifier learns nothing more than the truth of the statement that the prover knows. Zero-Knowledge Proofs were discovered by Goldwasser, Micali and Rackoff [GMR85] in 1985 and have been ex- tensively used in cryptographic applications like multiparty computation, where the communicating parties should prove that they follow a protocol without de- viating from it. A very nice example of how to explain ZK protocols to someone who knows nothing about them can be found at [QQQ+89].