Efficient Threshold Function Secret Sharing With Information-Theoretic Security

IEEE Access

Changlu Lin¹  Jinglong Luo¹  Fuchun Lin²  Liang Feng Zhang³ 

[1] College of Mathematics and Informatics, Fujian Normal University, Fuzhou, China;Division of Mathematical Sciences, SPMS, Nanyang Technological University, Singapore;School of Information Science and Technology, ShanghaiTech University, Shanghai, China;

关键词: Function secret sharing;    point function;    private information retrieval;    information-theoretic security;   

DOI  :  10.1109/ACCESS.2019.2963677

来源: DOAJ

【 摘 要 】

Function secret sharing (FSS) is a cryptographic primitive that is introduced by Boyle et al. (Eurocrypt 2015), motivated by application scenarios involving private access to large distributed data while minimising the overhead of communication, for example, private information retrieval. Informally, an n-party FSS scheme splits a function f into n functions f₁,...,f_n such that f = f₁ +...+ f_n and every strict subset of the function shares hide f . Most of the known FSS constructions only have computational hiding, namely, the hiding property holds only against a computationally bounded adversary. We consider information-theoretic hiding in this work while allowing f to be recovered from t function shares and correspondingly, any (t - 1) function shares unconditionally hide f . Call it (t, n)-threshold function secret sharing ((t, n)-TFSS for short). Using information-theoretic tools and through a series of optimizations, we show that our (t, n)-TFSS have better performance than FSS in terms of communication complexity, a criterion that measures the efficiency of such protocols. Specifically, a (t, n)-TFSS scheme with communication complexity O(l) is designed in this paper and it is better than the existing FSS schemes with lowest communication complexity O(λl), where λ is the length of pseudo-random generator's seeds. In addition, the (t, n)-TFSS have an extra robustness property in the sense that even if up to (n - t) function shares are not available, the protocol still computes the function value at a given point correctly.

【 授权许可】

Unknown