[Paper Review] Universal Construction of Cheater-Identifiable Secret Sharing Against Rushing Cheaters Based on Message Authentication

Masahito Hayashi, Takeshi Koshiba|arXiv (Cornell University)|Jan 16, 2017

Cryptography and Data Security15 references3 citations

TL;DR

This paper presents a universal construction of cheater-identifiable secret sharing (CISS) that resists rushing cheaters and operates without requiring an honest majority, using message authentication. By introducing 'individual identification' and 'agreed identification' models, the protocol enables secure secret reconstruction and accurate cheater detection even when more than half the participants are malicious, with independent security parameter tuning and low computational overhead.

ABSTRACT

For conventional secret sharing, if cheaters can submit possibly forged shares after observing shares of the honest users in the reconstruction phase then they cannot only disturb the protocol but also only they may reconstruct the true secret. To overcome the problem, secret sharing scheme with properties of cheater-identification have been proposed. Existing protocols for cheater-identifiable secret sharing assumed non-rushing cheaters or honest majority. In this paper, we remove both conditions simultaneously, and give its universal construction from any secret sharing scheme. To resolve this end, we propose the concepts of "individual identification" and "agreed identification".

Motivation & Objective

• To address the limitations of existing cheater-identifiable secret sharing (CISS) protocols that assume non-rushing cheaters or require an honest majority.
• To eliminate the need for a trusted server or centralized identification in CISS protocols.
• To provide a universal construction that can be applied to any underlying secret sharing scheme.
• To enable independent selection of the security parameter ℓ from the secret size and finite field size.
• To achieve efficient computational complexity O(ℓ log ℓ) while maintaining strong cheater identification guarantees.

Proposed method

• Introduce two new models: 'individual identification' (private cheater detection per player) and 'agreed identification' (commonly agreed cheater detection across all players).
• Use message authentication codes (MACs) based on Toeplitz matrices to bind shares to their owners and detect tampering.
• Construct a universal CISS protocol by combining any existing secret sharing scheme with a MAC-based integrity check on shares.
• Apply a two-round protocol structure: first, players distribute authenticated shares; second, they reconstruct the secret and validate authenticity using MACs.
• Use majority voting in the reconstruction phase to detect inconsistencies when more than half the players are cheaters.
• Ensure security parameter ℓ is independent of share size and finite field size by using a parameterized MAC scheme with error probability 2⁻ℓ.

Experimental results

Research questions

• RQ1 Can a universal CISS protocol be constructed that resists rushing cheaters without requiring an honest majority?
• RQ2 How can cheater identification be made both private (individual) and publicly verifiable (agreed) in a distributed setting?
• RQ3 What is the computational and communication overhead of such a protocol compared to prior works?
• RQ4 Can the security parameter ℓ be chosen independently of the original secret sharing scheme's parameters?
• RQ5 What are the performance trade-offs between individual and agreed identification models in terms of detection accuracy and resilience?

Key findings

• The proposed CISS protocol for individual identification correctly identifies cheaters even when more than half the participants are malicious, ensuring robustness against rushing adversaries.
• The agreed identification model correctly identifies cheaters only when fewer than half the participants are cheaters, but still provides strong detection guarantees.
• The computational complexity of the protocol is O(ℓ log ℓ) when the success probability of cheater identification is 1−2⁻ℓ, which is efficient for practical deployment.
• The protocol's overhead is 2^(ℓ(2n−1)) when m=1, which is significantly lower than the (n²(n+1))^(4n+1)2^(ℓ(4n+1)) overhead of the protocol in [11], showing a substantial improvement in exponential scaling.
• The method allows independent selection of the security parameter ℓ from the secret size and finite field size, enabling use of small fields like F₂ without compromising security.
• The protocol achieves universal applicability to any secret sharing scheme through a modular construction based on message authentication, without requiring modifications to the original scheme.