[Paper Review] Communication Efficient Secret Sharing

Wentao Huang, Michael Langberg+2 more|arXiv (Cornell University)|May 28, 2015

Cryptography and Data Security22 references4 citations

TL;DR

This paper proposes a communication-efficient secret sharing scheme that minimizes decoding bandwidth by enabling a user to reconstruct a secret by downloading only a fraction of each share from multiple parties. The scheme, based on Shamir's secret sharing and Reed-Solomon codes, achieves optimal decoding bandwidth universally for all valid numbers of participating parties $ d $, from $ n-r $ to $ n $, while preserving perfect secrecy and computational efficiency.

ABSTRACT

A secret sharing scheme is a method to store information securely and reliably. Particularly, in a threshold secret sharing scheme, a secret is encoded into $n$ shares, such that any set of at least $t_1$ shares suffice to decode the secret, and any set of at most $t_2 < t_1$ shares reveal no information about the secret. Assuming that each party holds a share and a user wishes to decode the secret by receiving information from a set of parties; the question we study is how to minimize the amount of communication between the user and the parties. We show that the necessary amount of communication, termed "decoding bandwidth", decreases as the number of parties that participate in decoding increases. We prove a tight lower bound on the decoding bandwidth, and construct secret sharing schemes achieving the bound. Particularly, we design a scheme that achieves the optimal decoding bandwidth when $d$ parties participate in decoding, universally for all $t_1 \le d \le n$. The scheme is based on Shamir's secret sharing scheme and preserves its simplicity and efficiency. In addition, we consider secure distributed storage where the proposed communication efficient secret sharing schemes further improve disk access complexity during decoding.

Motivation & Objective

• To minimize the communication cost (decoding bandwidth) during secret reconstruction in threshold secret sharing schemes.
• To design a scheme that achieves optimal decoding bandwidth regardless of how many parties $ d $ participate in decoding, for all $ d $ in the range $ n-r \leq d \leq n $.
• To maintain perfect secrecy and computational efficiency while reducing the amount of data transferred during decoding.
• To improve disk access efficiency in secure distributed storage systems by reducing communication overhead during secret retrieval.

Proposed method

• The scheme extends Shamir's secret sharing by allowing partial downloads from multiple parties, reducing the total communication required for decoding.
• It uses random linear precoding over finite fields to generate shares such that any $ d \geq n-r $ parties can reconstruct the secret with minimal information transfer.
• The construction leverages properties of Reed-Solomon codes and ensures that the decoding bandwidth is minimized by optimizing the amount of data downloaded per party.
• A probabilistic analysis proves that the scheme achieves the information-theoretic lower bound on decoding bandwidth with high probability.
• The scheme is rate-optimal and maintains security by ensuring that any $ z $ or fewer parties gain no information about the secret.
• A variant of the scheme is constructed using Reed-Solomon codewords, which simplifies implementation and maintains optimal decoding bandwidth when all $ n $ parties are available.

Experimental results

Research questions

• RQ1 What is the minimum possible decoding bandwidth required to reconstruct a secret when $ d $ parties participate in decoding, for any $ d \geq n-r $?
• RQ2 Can a single secret sharing scheme achieve optimal decoding bandwidth for all values of $ d $ in the range $ n-r \leq d \leq n $?
• RQ3 How can communication efficiency be improved in secret sharing without sacrificing security or computational efficiency?
• RQ4 Can the decoding bandwidth be reduced below the standard approach of downloading full shares from $ n-r $ parties?
• RQ5 Is it possible to design a scheme that achieves optimal bandwidth universally across all valid numbers of participating parties?

Key findings

• The paper proves a tight information-theoretic lower bound on decoding bandwidth, showing that bandwidth decreases as the number of participating parties $ d $ increases.
• A secret sharing scheme is constructed that achieves this lower bound universally for all $ d \in [n-r, n] $, making it optimal across all participation levels.
• The scheme achieves optimal decoding bandwidth of $ \frac{kz}{|I|-z} $, where $ k = n - r - z $, when $ |I| \geq n - r $ parties participate.
• The scheme maintains perfect secrecy, as any set of $ z $ or fewer parties gains no information about the secret.
• The reliability of the scheme holds with probability at least $ 1 - \frac{2^n}{q-1} $, which approaches 1 for large field size $ q $.
• In distributed storage applications, the scheme reduces disk access complexity by minimizing the amount of data read during secret reconstruction.