Efficient Threshold Function Secret Sharing With Information-Theoretic Security

Abstract

Function secret sharing (FSS) is a cryptographic primitive that is introduced by Boyle et al. (Eurocrypt 2015), motivated by application scenarios involving private access to large distributed data while minimising the overhead of communication, for example, private information retrieval. Informally, an $n$ -party FSS scheme splits a function $f$ into $n$ functions $f_{1},\ldots,f_{n}$ such that $f=f_{1}+\cdots +f_{n}$ and every strict subset of the function shares hide $f$ . Most of the known FSS constructions only have computational hiding, namely, the hiding property holds only against a computationally bounded adversary. We consider information-theoretic hiding in this work while allowing $f$ to be recovered from $t$ function shares and correspondingly, any $(t-1)$ function shares unconditionally hide $f$ . Call it $(t,n)$ -threshold function secret sharing ( $(t,n)$ -TFSS for short). Using information-theoretic tools and through a series of optimizations, we show that our $(t,n)$ -TFSS have better performance than FSS in terms of communication complexity, a criterion that measures the efficiency of such protocols. Specifically, a $(t,n)$ -TFSS scheme with communication complexity $O(l)$ is designed in this paper and it is better than the existing FSS schemes with lowest communication complexity $O(\lambda l)$ , where $\lambda $ is the length of pseudo-random generator’s seeds. In addition, the $(t,n)$ -TFSS have an extra robustness property in the sense that even if up to $(n-t)$ function shares are not available, the protocol still computes the function value at a given point correctly.