Shamir's Scheme Research Articles

Admissible tracks in Shamir's scheme

We consider Shamir's secret sharing schemes, with the secret placed as a coefficient a i of the scheme polynomial f ( x ) = a 0 + ⋯ + a k − 1 x k − 1 , determined by a sequence t = ( t 0 , … , t n − 1 ) ∈ F q n pairwise different public identities, called a track. If t defines a k-out-of- n Shamir's scheme then the track t is called ( k , i ) -admissible. If t is not a ( k , i ) -admissible track, we obtain the scheme with some privileged coalitions of less than k shareholders who can reconstruct the secret by themselves. No ( k , i ) -admissible tracks contain privileged coalitions. In Spież et al. [11] it is proved that the coalitions are common zeros of some elementary symmetric polynomials. We obtain some quantitative results on the tracks. Given i ≠ 0 , k − 1 we prove that the number of ( k , i ) -admissible tracks of length n is q n − ( ( n 2 ) + ( n k − 1 ) ) q n − 1 + O ( q n − 2 ) , where the constant in the O-symbol depends on n, k and i. We also estimate the number of tracks being ( k , i ) -admissible for every i. We prove the existence and extendability of all tracks for sufficiently large q, giving algorithms for their constructing and extending. Furthermore, we investigate ( k , i ) -privileged coalitions of length k − 1 , which can reconstruct the secret, placed as a i , by themselves. We prove that the number of such coalitions is q k − 2 + O ( q k − 3 ) , where the constant in the O-symbol depends on k and i.

Elementary symmetric polynomials in Shamir's scheme

The concept of k-admissible tracks in Shamir's secret sharing scheme over a finite field was introduced by Schinzel et al. (2009) [10]. Using some estimates for the elementary symmetric polynomials, we show that the track ( 1 , … , n ) over F p is practically always k-admissible; i.e., the scheme allows to place the secret as an arbitrary coefficient of its generic polynomial even for relatively small p. Here k is the threshold and n the number of shareholders.

Efficient On-line/Off-line Signature Schemes Based on Multiple-Collision Trapdoor Hash Families

The first on-line/off-line signature scheme introduced by Even et al. in 1990 has two problems: (a) impractical signature length and (b) a one-time use of signature generated during the off-line phase. In 2001, Shamir and Tauman significantly shortened the length of the signature by using trapdoor hash families introduced by Krawczyk and Rabin in 2000. However, each trapdoor hash value and its signature in the off-line phase of Shamir and Tauman's signature scheme can be used for signing only one message in the on-line phase. In this paper, we propose multiple-collision trapdoor hash families based on discrete logarithm and factoring assumptions, and provide formal proofs of their security. We also introduce an efficient on-line/off-line signature scheme based on our proposed trapdoor hash families. Our on-line/off-line signature scheme can re-use a trapdoor hash value for signing multiple messages. If a signer includes this trapdoor hash value in the public-key digital certificate, there is no need to have any regular digital signature scheme to sign the trapdoor hash value in the off-line phase.

A New Secret Sharing Scheme Based on the Multi-Dealer

Almost all the existing secret sharing schemes are based on a single dealer. Maybe in some situations, the secret needs to be maintained by multiple dealers. In this paper, we proposed a novel secret sharing scheme based on the multi-dealer by means of Shamir's threshold scheme and T. Okamoto and S. Uchiyama's public-key cryptosystem. Multiple dealers can commonly maintain the secret and the secret can be dynamically renewed by any dealer. Meanwhile, the reusable secret shadows just needs to be distributed only once. In the secret updated phase, the dealer just needs to publish a little public information instead of redistributing the new secret shadows. Its security is based on the security of Shamir's threshold scheme and the intractability of factoring problem and discrete logarithm problem.

A Fast (k,L,n)-Threshold Ramp Secret Sharing Scheme

Shamir's (k, n)-threshold secret sharing scheme (threshold scheme) has two problems: a heavy computational cost is required to make shares and recover the secret, and a large storage capacity is needed to retain all the shares. As a solution to the heavy computational cost problem, several fast threshold schemes have been proposed. On the other hand, threshold ramp secret sharing schemes (ramp scheme) have been proposed in order to reduce each bit-size of shares in Shamir's scheme. However, there is no fast ramp scheme which has both low computational cost and low storage requirements. This paper proposes a new (k, L, n)-threshold ramp secret sharing scheme which uses just EXCLUSIVE-OR(XOR) operations to make shares and recover the secret at a low computational cost. Moreover, by proving that the fast (k, n)-threshold scheme in conjunction with a method to reduce the number of random numbers is an ideal secret sharing scheme, we show that our fast ramp scheme is able to reduce each bit-size of shares by allowing some degradation of security similar to the existing ramp schemes based on Shamir's threshold scheme.

SECURE AND PROGRESSIVE IMAGE TRANSMISSION THROUGH SHADOWS GENERATED BY MULTIWAVELET TRANSFORM

In this paper, multiwavelet transform is used in the context of image sharing employing the SPIHT-generated bit stream with the modified Shamir's (r, m) threshold scheme over the Galois field. This provides multiwavelet-based embedded shadow images for progressive transmission and reconstruction. Both integer multiwavelet transform and balanced multiwavelet transform are considered in the method. It is secure and fault-tolerant, and gives small shadow size and excellent rate-distortion performance. Experimental results and sample applications are given to demonstrate the characteristics of this method.

On a Fast (k,n)-Threshold Secret Sharing Scheme

In Shamir's (k, n)-threshold secret sharing scheme (threshold scheme) [1], a heavy computational cost is required to make n shares and recover the secret from k shares. As a solution to this problem, several fast threshold schemes have been proposed. However, there is no fast ideal (k, n)-threshold scheme, where k and n are arbitrary. This paper proposes a new fast (k, n)-threshold scheme which uses just EXCLUSIVE-OR(XOR) operations to make n shares and recover the secret from k shares. We prove that every combination of k or more participants can recover the secret, but every group of less than k participants cannot obtain any information about the secret in the proposed scheme. Moreover, the proposed scheme is an ideal secret sharing scheme similar to Shamir's scheme, in which every bit-size of shares equals that of the secret. We also evaluate the efficiency of the scheme, and show that our scheme realizes operations that are much faster than Shamir's.

Coding Theorems on the Threshold Scheme for a General Source

In this paper, coding theorems on the (t, m) -threshold scheme for a general source are discussed, where m means the number of the shares and t means a threshold. The (t,m) -threshold scheme treated in this paper encrypts n source outputs Xn to m shares at once and is required to satisfy the two conditions that 1) Xn is reproduced from arbitrary t shares, and 2) almost no information of Xn is revealed from any t - 1 shares. It is shown that the (t,m) -threshold scheme must satisfy certain inequalities including the limit inferiors in probability. One of the inequalities is closely related to the minimum length of the fair random bits needed to a dealer for realizing the (t, m) -threshold scheme. In addition, it is shown that a certain variation of Shamir's threshold scheme meets the two conditions. The same approach can be taken to the problems of Shannon's cipher system with the perfect secrecy and fixed-length source coding with vanishing decoding error probability. It is shown that the same kind of inequalities, which indicate the converse coding theorems, hold in both two cases.

The security of the Fiat--Shamir scheme in the presence of transient hardware faults

Implementation cryptanalysis has emerged as a realistic threat for cryptographic systems. It consists of two classes of attacks: fault-injection and side-channel attacks. In this work, we examine the resistance of the Fiat--Shamir scheme to fault-injection attacks, since Fiat--Shamir is a popular scheme for “light” consumer devices, such as smartcards, in a wide range of consumer services. We prove that an existing attack, known as the Bellcore attack, is incomplete. We propose an extension to the protocol that proactively secures Fiat--Shamir systems from the Bellcore attack and we prove its strength. Finally, we introduce a new attack model, which, under stronger assumptions, can derive the secret keys from both the original Fiat--Shamir scheme as well as its proposed extension. Our approach demonstrates that countermeasures for implementation cryptanalysis must be carefully designed and that deployed systems must include appropriate protection mechanisms for all known attacks and be flexible enough to incorporate countermeasures for new ones.

A Fast (3,n)-Threshold Secret Sharing Scheme Using Exclusive-OR Operations

In Shamir's (k, n)-threshold secret sharing scheme [1], a heavy computational cost is required to make n shares and recover the secret from k shares. As a solution to this problem, several fast threshold schemes have been proposed. However, there is no fast ideal (k, n)-threshold scheme, where k≥3 and n is arbitrary. This paper proposes a new fast (3, n)-threshold scheme by using just EXCLUSIVE-OR (XOR) operations to make shares and recover the secret, which is an ideal secret sharing scheme similar to Shamir's scheme. Furthermore, we evaluate the efficiency of the scheme, and show that it is more efficient than Shamir's in terms of computational cost. Moreover, we suggest a fast (k, n)-threshold scheme can be constructed in a similar way by increasing the sets of random numbers constructing pieces of shares.

Hierarchical Threshold Secret Sharing

We consider the problem of threshold secret sharing in groups with hierarchical structure. In such settings, the secret is shared among a group of participants that is partitioned into levels. The access structure is then determined by a sequence of threshold requirements: a subset of participants is authorized if it has at least k0 0 members from the highest level, as well as at least k1 > k0 members from the two highest levels and so forth. Such problems may occur in settings where the participants differ in their authority or level of confidence and the presence of higher level participants is imperative to allow the recovery of the common secret. Even though secret sharing in hierarchical groups has been studied extensively in the past, none of the existing solutions addresses the simple setting where, say, a bank transfer should be signed by three employees, at least one of whom must be a department manager. We present a perfect secret sharing scheme for this problem that, unlike most secret sharing schemes that are suitable for hierarchical structures, is ideal. As in Shamir's scheme, the secret is represented as the free coefficient of some polynomial. The novelty of our scheme is the usage of polynomial derivatives in order to generate lesser shares for participants of lower levels. Consequently, our scheme uses Birkhoff interpolation, i.e., the construction of a polynomial according to an unstructured set of point and derivative values. A substantial part of our discussion is dedicated to the question of how to assign identities to the participants from the underlying finite field so that the resulting Birkhoff interpolation problem will be well posed. In addition, we devise an ideal and efficient secret sharing scheme for the closely related hierarchical threshold access structures that were studied by Simmons and Brickell.

A secure and efficient (t, n) multi-secret sharing scheme

Based on Shamir's secret sharing, a (t, n) multi-secret sharing scheme is proposed in this paper.p secrets can be shared amongn participants, andt or more participants can co-operate to reconstruct these secrets at the same time, butt−1 or fewer participants can derive nothing about these secrets. Each participant's secret shadow is as short as each secret. Compared with the existing schemes, the proposed scheme is characterized by the lower complexity of the secret reconstruction and less public information. The security of this scheme is the same as that of Shamir's threshold scheme. Analyses show that this scheme is an efficient, computationally secure scheme.

RSA speedup with chinese remainder theorem immune against hardware fault cryptanalysis

This article considers the problem of how to prevent RSA signature and decryption computation with a residue number system (CRT-based approach) speedup from a hardware fault cryptanalysis in a highly reliable and efficient approach. CRT-based speedup for an RSA signature has been widely adopted as an implementation standard ranging from large servers to very tiny smart IC cards. However, given a single erroneous computation result, hardware fault cryptanalysis can totally break the RSA system by factoring the public modulus. Countermeasures using a simple verification function (e.g., raising a signature to the power of a public key) or fault detection (e.g., an expanded modulus approach) have been reported in the literature; however, it is pointed out that very few of these existing solutions are both sound and efficient. Unreasonably, in these methods, they assume that a comparison instruction will always be fault-free when developing countermeasures against hardware fault cryptanalysis. Research shows that the expanded modulus approach proposed by Shamir (1997, 1999) is superior to the approach using a simple verification function when another physical cryptanalysis (e.g., timing cryptanalysis) is considered. So, we intend to improve Shamir's method. In this paper, the new concepts of fault infective CRT computation and fault infective CRT recombination are proposed. Based on the new concepts, two novel protocols are developed with a rigorous proof of security. Two possible parameter settings are provided for the protocols. One setting selects a small public key and the proposed protocols can have comparable performance to Shamir's scheme. The other setting has better performance than Shamir's scheme (i.e., having comparable performance to conventional CRT speedup), but with a large public key. Most importantly, we wish to emphasize the importance of developing and proving the security of physically secure protocols without relying on unreliable or unreasonable assumptions, e.g., always fault-free instructions. In this paper, related protocols are also considered and carefully examined to point out possible weaknesses.

Weakness in Quaternion Signatures

This note continues a sequence of attempts to define efficient digital signature schemes based on low-degree polynomials, or to break such schemes. We consider a scheme proposed by Satoh and Araki [5], which generalizes the Ong--Schnorr--Shamir scheme to the noncommutative ring of quaternions. We give two different ways to break the scheme.

The breadth of Shamir's secret-sharing scheme

In 1979 Shamir and Blakley introduced the concept of secret sharing through threshold schemes. Their models were based on polynomials and finite geometries. Since 1979 many researchers have taken the basic concept of a threshold scheme and used other mathematical structures to adapt threshold schemes to meet the needs of many practical situations. In this paper the authors take Shamir's construction and show how it can be used to realize the adapted models. In particular, the authors give new constructions for multipart, multilevel, democratic and prepositioned schemes. It will also be demonstrated how known methods for detecting cheaters and disenrolling participants can be incorporated into Shamir's scheme.

Efficient Zero-Knowledge Identification Schemes for Smart Cards

Secure identification is an important security issue to avoid computer fraud due to masquerading. This can be achieved with zero-knowledge based smart cards. We present very efficient new zero-knowledge schemes in a general algebraic setting. Particular cases of our scheme improve the performance of the Guillou–Quisquater and the Chaum–Evertse–van de Graaf schemes. Our scheme is formally proven and, overall, is more efficient than currently available schemes including the Fiat–Shamir scheme. As an application we discuss how our scheme can be used for identification, in particular as an electronic passport scheme.

On sharing secrets and Reed-Solomon codes

Shamir's scheme for sharing secrets is closely related to Reed-Solomon coding schemes. Decoding algorithms for Reed-Solomon codes provide extensions and generalizations of Shamir's method.