secretsharing&nihars/publications/secret... · 2017. 7. 11. · secretsharing& • a dealer...

Secret Sharing •  A dealer and n participants •  The dealer has a secret s •  Distribute shares (functions of s) to participants such that -  any k can recover s -  any (k-1) get no information about s

1

2

3

4

5

6

dealer

8

1

2

3

4

5

6

dealer

8

1

2

3

4

5

6

dealer

8

1

2

3

4

5

6

dealer

8

1

2

3

4

5

6

dealer

8

1

2

3

4

5

6

dealer

8

1

2

3

4

5

6

dealer

8

n = 6

1

2

3

4

5

6

dealer

8

1

2

3

4

5

6

dealer

8

1

2

3

4

5

6

dealer

8

1

2

3

4

5

6

dealer

8

1

2

3

4

5

6

dealer

8

1

2

3

4

5

6

dealer

8

1

2

3

4

5

6

dealer

8

Example: n = 6, k = 2

•  alphabet is F7 •  r is chosen uniformly at random from the field

Applica9ons

Several cryptographic protocols use Shamir’s secret sharing:

• Secure mul9party func9on computa9on

• Key distribu9on • Archival storage

e.g., Ben-‐Or–Goldwasser–Wigderson (BGW) protocol for secure n-‐party func9on computa9on: 2n secret sharings ini9ally, n more for each mul9plica9on

Most protocols assume dealer can communicate directly with all par9cipants

1

2

3

4

5

6

dealer

8

1

2

3

4

5

6

dealer

8

1

2

3

4

5

6

dealer

8

1

2

3

4

5

6

dealer

8

1

2

3

4

5

6

dealer

8

1

2

3

4

5

6

dealer

8

1

2

3

4

5

6

dealer

8

1

2

3

4

5

6

dealer

s+r

s+2r

1

2

3

4

5

6

dealer

s+r

s+2r

1

2

3

4

5

6

dealers+3r

+r3

r3

s+ 3r + r3

r 3

1

2

3

4

5

6

dealer

s+r

s+2r

1

2

3

4

5

6

dealers+3r

+r3

r3

s+ 3r + r3

r 3

1

2

3

4

5

6

dealer

not allowed: par.cipant 1 can obtain secret

⇒

Secret sharing across networks

Outline

•  Literature

•  New “SNEAK” algorithm

•  Informa9on-‐theore9c lower bounds

•  Summary & open problems

s+r

s+2r

1

2

3

4

5

6

dealer

Literature: Pairwise agreement protocols

D. Dolev, C. Dwork, O. Waarts, and M. Yung, “Perfectly secure message transmission,” Journal of the ACM, vol. 40, no. 1, pp. 17–47, 1993.

s+r

s+2r

1

2

3

4

5

6

dealer


s+3r

+r3

r3

s+ 3r + r3

r 3

1

2

3

4

5

6

dealer


s+4r

+r4

r4

s+ 4r + r4

r4

s+4r+r4

1

2

3

4

5

6

dealer


For every par9cipant i : 1.  Dealer finds k node disjoint paths to i 2.  Computes secret shares of this i’s share

3.  Transmits these new shares on these k paths


•  Communica9on inefficient

•  High amount of randomness

•  Significant coordina9on in the network

Literature: Secure Network Coding

1

2

3

4

5

6

dealer

S S

S

S S

S S

S

S

S S

S

S S

S

•  Every set of k par9cipants has a sink •  Eavesdropping of any (k-‐1) nodes should leak no informa9on

S = Sink

Nodal-‐eavesdropping: Very licle known

Our “SNEAK” algorithm

SNEAK = Secret-‐sharing over a Network with Efficient communica9on And distributed Knowledge-‐of-‐topology

s+r, r

+ra

s+2r,r+2r

a

(s+r)+3(r+ra)(=(s+3r)+(r+3ra))

(s+2r)+3(r+2r a

)

(=(s+3r)+2(r+3r a

))

(s+2r)+4(r+2ra)

(=(s+4r)+2(r+4ra))

(s+3r)+

4(r+3ra )

(=(s+

3r)+

3(r+3ra ))

(s+3r)+5(r+3ra)

(=(s+5r)+3(r+5ra))

(s+4r)+5(r+4ra)

(=(s+5r)+4(r+5ra))

(s+4r)+6(r+4ra)(=(s+6r)+4(r+6ra))

(s+5r)+

6(r+5ra )

(=(s+

6r)+

5(r+6ra ))

1

2

3

4

5

6

dealer

SNEAK algorithm

s+r, r

+ra

s+2r,r+2r

a

(s+r)+3(r+ra)(=(s+3r)+(r+3ra))

(s+2r)+3(r+2r a

)

(=(s+3r)+2(r+3r a

))

(s+2r)+4(r+2ra)

(=(s+4r)+2(r+4ra))

(s+3r)+

4(r+3ra )

(=(s+

3r)+

3(r+3ra ))

(s+3r)+5(r+3ra)

(=(s+5r)+3(r+5ra))

(s+4r)+5(r+4ra)

(=(s+5r)+4(r+5ra))

(s+4r)+6(r+4ra)(=(s+6r)+4(r+6ra))

(s+5r)+

6(r+5ra )

(=(s+

6r)+

5(r+6ra ))

1

2

3

4

5

6

dealer

s+r r+ra

s+2r r+2ra

SNEAK algorithm

s+r, r

+ra

s+2r,r+2r

a

(s+r)+3(r+ra)(=(s+3r)+(r+3ra))

(s+2r)+3(r+2r a

)

(=(s+3r)+2(r+3r a

))

(s+2r)+4(r+2ra)

(=(s+4r)+2(r+4ra))

(s+3r)+

4(r+3ra )

(=(s+

3r)+

3(r+3ra ))

(s+3r)+5(r+3ra)

(=(s+5r)+3(r+5ra))

(s+4r)+5(r+4ra)

(=(s+5r)+4(r+5ra))

(s+4r)+6(r+4ra)(=(s+6r)+4(r+6ra))

(s+5r)+

6(r+5ra )

(=(s+

6r)+

5(r+6ra ))

1

2

3

4

5

6

dealer

s+r r+ra

s+2r r+2ra

SNEAK algorithm

(s+r)+3(r+ra)

s+r, r

+ra

s+2r,r+2r

a

(s+r)+3(r+ra)(=(s+3r)+(r+3ra))

(s+2r)+3(r+2r a

)

(=(s+3r)+2(r+3r a

))

(s+2r)+4(r+2ra)

(=(s+4r)+2(r+4ra))

(s+3r)+

4(r+3ra )

(=(s+

3r)+

3(r+3ra ))

(s+3r)+5(r+3ra)

(=(s+5r)+3(r+5ra))

(s+4r)+5(r+4ra)

(=(s+5r)+4(r+5ra))

(s+4r)+6(r+4ra)(=(s+6r)+4(r+6ra))

(s+5r)+

6(r+5ra )

(=(s+

6r)+

5(r+6ra ))

1

2

3

4

5

6

dealer

(s+r)+3(r+ra)

(s+2r)+4(r+2ra)

s+r r+ra

s+2r r+2ra

SNEAK algorithm

s+r, r

+ra

s+2r,r+2r

a

(s+r)+3(r+ra)(=(s+3r)+(r+3ra))

(s+2r)+3(r+2r a

)

(=(s+3r)+2(r+3r a

))

(s+2r)+4(r+2ra)

(=(s+4r)+2(r+4ra))

(s+3r)+

4(r+3ra )

(=(s+

3r)+

3(r+3ra ))

(s+3r)+5(r+3ra)

(=(s+5r)+3(r+5ra))

(s+4r)+5(r+4ra)

(=(s+5r)+4(r+5ra))

(s+4r)+6(r+4ra)(=(s+6r)+4(r+6ra))

(s+5r)+

6(r+5ra )

(=(s+

6r)+

5(r+6ra ))

1

2

3

4

5

6

dealer

(s+r)+3(r+ra) =(s+3r)+(r+3ra)

(s+2r)+4(r+2ra)

s+r r+ra

s+2r r+2ra

SNEAK algorithm

s+r, r

+ra

s+2r,r+2r

a

(s+r)+3(r+ra)(=(s+3r)+(r+3ra))

(s+2r)+3(r+2r a

)

(=(s+3r)+2(r+3r a

))

(s+2r)+4(r+2ra)

(=(s+4r)+2(r+4ra))

(s+3r)+

4(r+3ra )

(=(s+

3r)+

3(r+3ra ))

(s+3r)+5(r+3ra)

(=(s+5r)+3(r+5ra))

(s+4r)+5(r+4ra)

(=(s+5r)+4(r+5ra))

(s+4r)+6(r+4ra)(=(s+6r)+4(r+6ra))

(s+5r)+

6(r+5ra )

(=(s+

6r)+

5(r+6ra ))

1

2

3

4

5

6

dealer

(s+2r)+4(r+2ra)

s+r r+ra

s+2r r+2ra

SNEAK algorithm

(s+r)+3(r+ra) =(s+3r)+(r+3ra)

s+r, r

+ra

s+2r,r+2r

a

(s+r)+3(r+ra)(=(s+3r)+(r+3ra))

(s+2r)+3(r+2r a

)

(=(s+3r)+2(r+3r a

))

(s+2r)+4(r+2ra)

(=(s+4r)+2(r+4ra))

(s+3r)+

4(r+3ra )

(=(s+

3r)+

3(r+3ra ))

(s+3r)+5(r+3ra)

(=(s+5r)+3(r+5ra))

(s+4r)+5(r+4ra)

(=(s+5r)+4(r+5ra))

(s+4r)+6(r+4ra)(=(s+6r)+4(r+6ra))

(s+5r)+

6(r+5ra )

(=(s+

6r)+

5(r+6ra ))

1

2

3

4

5

6

dealer

(s+2r)+4(r+2ra)

s+3r r+3ra

s+r r+ra

s+2r r+2ra

SNEAK algorithm

(s+r)+3(r+ra) =(s+3r)+(r+3ra)

s+r, r

+ra

s+2r,r+2r

a

(s+r)+3(r+ra)(=(s+3r)+(r+3ra))

(s+2r)+3(r+2r a

)

(=(s+3r)+2(r+3r a

))

(s+2r)+4(r+2ra)

(=(s+4r)+2(r+4ra))

(s+3r)+

4(r+3ra )

(=(s+

3r)+

3(r+3ra ))

(s+3r)+5(r+3ra)

(=(s+5r)+3(r+5ra))

(s+4r)+5(r+4ra)

(=(s+5r)+4(r+5ra))

(s+4r)+6(r+4ra)(=(s+6r)+4(r+6ra))

(s+5r)+

6(r+5ra )

(=(s+

6r)+

5(r+6ra ))

1

2

3

4

5

6

dealer

(s+2r)+4(r+2ra)

(s+3r)+5(r+3ra)

s+3r r+3ra

s+r r+ra

s+2r r+2ra

SNEAK algorithm

s+r, r

+ra

s+2r,r+2r

a

(s+r)+3(r+ra)(=(s+3r)+(r+3ra))

(s+2r)+3(r+2r a

)

(=(s+3r)+2(r+3r a

))

(s+2r)+4(r+2ra)

(=(s+4r)+2(r+4ra))

(s+3r)+

4(r+3ra )

(=(s+

3r)+

3(r+3ra ))

(s+3r)+5(r+3ra)

(=(s+5r)+3(r+5ra))

(s+4r)+5(r+4ra)

(=(s+5r)+4(r+5ra))

(s+4r)+6(r+4ra)(=(s+6r)+4(r+6ra))

(s+5r)+

6(r+5ra )

(=(s+

6r)+

5(r+6ra ))

1

2

3

4

5

6

dealer

(s+2r)+4(r+2ra) =(s+4r)+2(r+4ra)

(s+3r)+5(r+3ra)

s+3r r+3ra

s+r r+ra

s+2r r+2ra

SNEAK algorithm

s+r, r

+ra

s+2r,r+2r

a

(s+r)+3(r+ra)(=(s+3r)+(r+3ra))

(s+2r)+3(r+2r a

)

(=(s+3r)+2(r+3r a

))

(s+2r)+4(r+2ra)

(=(s+4r)+2(r+4ra))

(s+3r)+

4(r+3ra )

(=(s+

3r)+

3(r+3ra ))

(s+3r)+5(r+3ra)

(=(s+5r)+3(r+5ra))

(s+4r)+5(r+4ra)

(=(s+5r)+4(r+5ra))

(s+4r)+6(r+4ra)(=(s+6r)+4(r+6ra))

(s+5r)+

6(r+5ra )

(=(s+

6r)+

5(r+6ra ))

1

2

3

4

5

6

dealer

(s+3r)+5(r+3ra)

s+3r r+3ra

s+r r+ra

s+2r r+2ra

(s+2r)+4(r+2ra) =(s+4r)+2(r+4ra) s+4r

r+4ra

SNEAK algorithm

s+r, r

+ra

s+2r,r+2r

a

(s+r)+3(r+ra)(=(s+3r)+(r+3ra))

(s+2r)+3(r+2r a

)

(=(s+3r)+2(r+3r a

))

(s+2r)+4(r+2ra)

(=(s+4r)+2(r+4ra))

(s+3r)+

4(r+3ra )

(=(s+

3r)+

3(r+3ra ))

(s+3r)+5(r+3ra)

(=(s+5r)+3(r+5ra))

(s+4r)+5(r+4ra)

(=(s+5r)+4(r+5ra))

(s+4r)+6(r+4ra)(=(s+6r)+4(r+6ra))

(s+5r)+

6(r+5ra )

(=(s+

6r)+

5(r+6ra ))

1

2

3

4

5

6

dealer

(s+3r)+5(r+3ra) =(s+5r)+3(r+5ra)

s+3r r+3ra

s+r r+ra

s+2r r+2ra

s+4r r+4ra

s+5r r+5ra

(s+4r)+6(r+4ra)

SNEAK algorithm

s+r, r

+ra

s+2r,r+2r

a

(s+r)+3(r+ra)(=(s+3r)+(r+3ra))

(s+2r)+3(r+2r a

)

(=(s+3r)+2(r+3r a

))

(s+2r)+4(r+2ra)

(=(s+4r)+2(r+4ra))

(s+3r)+

4(r+3ra )

(=(s+

3r)+

3(r+3ra ))

(s+3r)+5(r+3ra)

(=(s+5r)+3(r+5ra))

(s+4r)+5(r+4ra)

(=(s+5r)+4(r+5ra))

(s+4r)+6(r+4ra)(=(s+6r)+4(r+6ra))

(s+5r)+

6(r+5ra )

(=(s+

6r)+

5(r+6ra ))

1

2

3

4

5

6

dealer

s+3r r+3ra

s+r r+ra

s+2r r+2ra

s+4r r+4ra

s+5r r+5ra

(s+4r)+6(r+4ra) =(s+6r)+4(r+6ra)

s+6r r+6ra

SNEAK algorithm

s+r, r

+ra

s+2r,r+2r

a

(s+r)+3(r+ra)(=(s+3r)+(r+3ra))

(s+2r)+3(r+2r a

)

(=(s+3r)+2(r+3r a

))

(s+2r)+4(r+2ra)

(=(s+4r)+2(r+4ra))

(s+3r)+

4(r+3ra )

(=(s+

3r)+

3(r+3ra ))

(s+3r)+5(r+3ra)

(=(s+5r)+3(r+5ra))

(s+4r)+5(r+4ra)

(=(s+5r)+4(r+5ra))

(s+4r)+6(r+4ra)(=(s+6r)+4(r+6ra))

(s+5r)+

6(r+5ra )

(=(s+

6r)+

5(r+6ra ))

1

2

3

4

5

6

dealer

s+3r r+3ra

s+r r+ra

s+2r r+2ra

s+4r r+4ra

s+5r r+5ra

s+6r r+6ra

SNEAK algorithm

SNEAK Pairwise-‐agreement Communica.on 12 24

s+r, r

+ra

s+2r,r+2r

a

(s+r)+3(r+ra)(=(s+3r)+(r+3ra))

(s+2r)+3(r+2r a

)

(=(s+3r)+2(r+3r a

))

(s+2r)+4(r+2ra)

(=(s+4r)+2(r+4ra))

(s+3r)+

4(r+3ra )

(=(s+

3r)+

3(r+3ra ))

(s+3r)+5(r+3ra)

(=(s+5r)+3(r+5ra))

(s+4r)+5(r+4ra)

(=(s+5r)+4(r+5ra))

(s+4r)+6(r+4ra)(=(s+6r)+4(r+6ra))

(s+5r)+

6(r+5ra )

(=(s+

6r)+

5(r+6ra ))

1

2

3

4

5

6

dealer

s+3r r+3ra

s+r r+ra

s+2r r+2ra

s+4r r+4ra

s+5r r+5ra

s+6r r+6ra


Knowledge of topology know only one-‐hop neighbours

node disjoint paths on en9re graph

s+r, r

+ra

s+2r,r+2r

a

(s+r)+3(r+ra)(=(s+3r)+(r+3ra))

(s+2r)+3(r+2r a

)

(=(s+3r)+2(r+3r a

))

(s+2r)+4(r+2ra)

(=(s+4r)+2(r+4ra))

(s+3r)+

4(r+3ra )

(=(s+

3r)+

3(r+3ra ))

(s+3r)+5(r+3ra)

(=(s+5r)+3(r+5ra))

(s+4r)+5(r+4ra)

(=(s+5r)+4(r+5ra))

(s+4r)+6(r+4ra)(=(s+6r)+4(r+6ra))

(s+5r)+

6(r+5ra )

(=(s+

6r)+

5(r+6ra ))

1

2

3

4

5

6

dealer

s+3r r+3ra

s+r r+ra

s+2r r+2ra

s+4r r+4ra

s+5r r+5ra

s+6r r+6ra


Knowledge of topology know only one-‐hop neighbours

node disjoint paths on en9re graph

Randomness 2 5

s+r, r

+ra

s+2r,r+2r

a

(s+r)+3(r+ra)(=(s+3r)+(r+3ra))

(s+2r)+3(r+2r a

)

(=(s+3r)+2(r+3r a

))

(s+2r)+4(r+2ra)

(=(s+4r)+2(r+4ra))

(s+3r)+

4(r+3ra )

(=(s+

3r)+

3(r+3ra ))

(s+3r)+5(r+3ra)

(=(s+5r)+3(r+5ra))

(s+4r)+5(r+4ra)

(=(s+5r)+4(r+5ra))

(s+4r)+6(r+4ra)(=(s+6r)+4(r+6ra))

(s+5r)+

6(r+5ra )

(=(s+

6r)+

5(r+6ra ))

1

2

3

4

5

6

dealer

s+3r r+3ra

s+r r+ra

s+2r r+2ra

s+4r r+4ra

s+5r r+5ra

s+6r r+6ra

General SNEAK algorithm Details in ISIT paper/arXiv

✓ communica9on-‐efficient ✓ randomness-‐efficient ✓ distributed ✓ determinis9c

SNEAK = Secret-‐sharing over a Network with Efficient communica9on And distributed Knowledge-‐of-‐topology

General SNEAK algorithm Details in ISIT paper/arXiv

✓ communica9on-‐efficient ✓ randomness-‐efficient ✓ distributed ✓ determinis9c

Needs graph to sa9sfy a certain condi9on

Condi9ons on the graph •  Necessary for any algorithm: “k-‐connected-‐dealer”

–  Exist k node-‐disjoint paths from dealer to every par9cipant

s+r, r

+ra

s+2r,r+2r

a

(s+r)+3(r+ra)(=(s+3r)+(r+3ra))

(s+2r)+3(r+2r a

)

(=(s+3r)+2(r+3r a

))

(s+2r)+4(r+2ra)

(=(s+4r)+2(r+4ra))

(s+3r)+

4(r+3ra )

(=(s+

3r)+

3(r+3ra ))

(s+3r)+5(r+3ra)

(=(s+5r)+3(r+5ra))

(s+4r)+5(r+4ra)

(=(s+5r)+4(r+5ra))

(s+4r)+6(r+4ra)(=(s+6r)+4(r+6ra))

(s+5r)+

6(r+5ra )

(=(s+

6r)+

5(r+6ra ))

1

2

3

4

5

6

dealer

k=2

Condi9ons on the graph •  Required for our algorithm: “k-‐propaga8ng-‐dealer”

– ∃ordering of par9cipants such that each par9cipant has edges coming in from either (a) the dealer or (b) from k par9cipants preceding it in the ordering

1

2

3

4

5

6

dealer

ordering = 1,2,3,4,5,6

k = 2

Condi9ons on the graph

ordering = layers next to dealer, rest increasing distance from dealer

Layered networks k=3

D

ordering = increasing distance from dealer

1-‐D geometric networks k-‐connected-‐dealer ⇒ k-‐propaga9ng-‐dealer

1

2

3

4

5

6

dealer

ordering = 1,2,3,4,5,6

k=2

backbone networks

Any DAG: k-‐connected-‐dealer ⇒ k-‐propaga9ng-‐dealer

•  Many graphs sa9sfying k-‐propaga8ng-‐dealer

SNEAK algorithm is oblivious to ordering

•  Need not know anything about the network

•  Nodes only know one hop neighbours

What if ‘k-‐propaga9ng-‐dealer’ not sa9sfied ?

•  No leak of informa9on

– No (k-‐1) nodes get any informa9on about s

•  Extensions of SNEAK (heuris9c) in paper

Informa9on-‐theore9c Lower Bounds

Informa9on-‐theore9c Lower Bounds Theorem: Lower Bound


1

2

3

4

5

6

dealer

1


1

2

3

4

5

6

dealer

1 deg < k

not possible


1

2

3

4

5

6

dealer

1 deg < k deg ≥ k

. deg . deg – k + 1

not possible


1

2

3

4

5

6

dealer

1 deg < k deg ≥ k

. deg . deg – k + 1

Corollary: communica9on ≥ n

not possible

Suppose graph sa9sfies “d-‐propaga9ng-‐dealer” for some d ≥ k

Communica9on Complexity


•  any algorithm ≥ n




•  SNEAK = (linear in n)


n dd − k +1



•  SNEAK = (linear in n)

•  pairwise-‐agreement: ‘typically’ super-‐linear, worst case


n dd − k +1

≈ n2

e.g.:

1

2

3

4

5

6

dealer

(sa9sfies 2-‐propaga9ng-‐dealer condi9on)

Further, in the paper

•  Analysis of randomness requirements

•  Addi9onal analysis of communica9on complexity

Summary & Future Work

•  SNEAK algorithm – efficient, distributed

•  Informa9on-‐theore9c lower bounds – download for any node – 9ght for the case when knowledge of only one-‐hop neighbours is available




Heuris9c extension when k-‐propaga9ng-‐dealer condi9on is not met. Guarantees ?





Other classes of graphs sa9sfying k-‐propaga9ng-‐dealer condi9on?






Tighter bounds for secret sharing in a network





Tighter bounds for secret sharing in a network

What carries over to general secure network coding ?


Thanks! Ques9ons?

secretsharing&nihars/publications/secret... · 2017. 7. 11. · secretsharing& • a dealer...

Documents