Threshold secret sharing with hidden access structures

Abstract

Cryptographic sharing of a cryptographic secret among multiple parties provides a share of the cryptographic secret is generated for each party. Multiple threshold access structure tokens are generated for each party of the multiple parties. The threshold access structure tokens are generated for a party from one or more random token polynomials selected from a finite field based on the numbers of the multiple parties capable of attempting to reconstruct the cryptographic secret. The share of the cryptographic secret and the multiple threshold access structure tokens generated for each party are distributed to the corresponding party. At least a threshold number of the parties can reconstruct the cryptographic secret using the shares of the cryptographic secret and threshold access structure tokens corresponding to at least a threshold number of the parties attempting to reconstruct the cryptographic secret while less than the threshold number of parties cannot reconstruct the cryptographic secret.

Description

SUMMARY

The described technology provides cryptographic sharing of a cryptographic secret among multiple parties. A share of the cryptographic secret is generated for each party of the multiple parties. Multiple threshold access structure tokens are generated for each party of the multiple parties, the threshold access structure tokens being generated for a party from one or more random token polynomials selected from a finite field based on numbers of the multiple parties capable of attempting to reconstruct the cryptographic secret. The share of the cryptographic secret and the multiple threshold access structure tokens generated for each party are distributed to the corresponding party, wherein at least a threshold number of the parties can reconstruct the cryptographic secret using the shares of the cryptographic secret and threshold access structure tokens corresponding to at least a threshold number of the parties attempting to reconstruct the cryptographic secret and less than the threshold number of the parties cannot reconstruct the cryptographic secret using the shares of the cryptographic secret and the threshold access structure tokens corresponding to the less than the threshold number of the parties.

This summary is provided to introduce a selection of concepts in a simplified form that is further described below in the Detailed Description. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

Other implementations are also described and recited herein.

BRIEF DESCRIPTIONS OF THE DRAWINGS

FIG. 1 illustrates example threshold secret sharing with hidden access structures.

FIG. 2 illustrates example operations for secret sharing process.

FIG. 3 illustrates an example secret sharing system.

FIG. 4 illustrates example operations for secret reconstruction process.

FIG. 5 illustrates an example secret reconstruction system.

FIG. 6 illustrates an example computing device for implementing the features and operations of the described technology.

DETAILED DESCRIPTIONS

Generally, secret sharing refers to cryptographic methods for taking a secret (e.g., a cryptographic key), breaking it up into multiple shares, and distributing the shares among multiple parties, so that only when the parties bring together their respective shares can the secret be reconstructed. More specifically, with threshold secret sharing, the holder of a secret, sometimes referred to as the dealer, creates n shares of a secret and defines a threshold t for the number of shares that are required to reconstruct the secret. The dealer then proceeds to distribute the n shares, so they are controlled by n different parties, and at least t of those parties are required to reconstruct the secret. Threshold secret sharing may be used, for example, to ensure that a required number of authorized parties agree to complete a large money transfer, launch nuclear missiles, or access a top-secret database.

In secure secret sharing schemes, an attacker that gains access to fewer shares of the secret than defined by the threshold t cannot gain information about the secret. Accordingly, a secret sharing scheme allows a dealer to share a secret so that strictly an authorized subset of parties, specified by an access structure, can reconstruct the secret.

In addition to the shares of the secret, the described technology enhances secure secret sharing by having the dealer also distribute threshold access structure tokens to the parties. In this manner, a subset of the n parties that is attempting to reconstruct the secret can successfully reconstruct the secret if the subset numbers at least the threshold t number of parties using their respective shares and their access structure tokens corresponding to the number of parties in the subset. In contrast, a subset of the n parties that is attempting to reconstruct the secret cannot successfully reconstruct the secret if the subset numbers less than the threshold t number of parties using their respective shares and their access structure tokens corresponding to the number of parties in the subset. Furthermore, the threshold t is hidden (e.g., not known by the n parties or other parties), being securely encoded in the threshold access structure tokens. In this manner, a dealer may share a secret among n parties in such a way that an adversary (including potentially one of the n parties) will not know the threshold number of parties that need to be compromised in order to obtain the secret.

FIG. 1 illustrates example threshold secret sharing with hidden access structures. A dealer 100 holds a secret 102, such as a cryptographic key, that the dealer 100 wishes to share amongst multiple parties 104 (e.g., n parties P). For example, the dealer 100 deconstructs the cryptographic key (secret 102) required to approve large money transfers into n shares s_i, for i=1, . . . , n, and distributes the shares s_i, to n corporate officers who are authorized to approve such transactions. Further, only a subset of at least t parties is required to approve such transactions, where 1≤t≤n. As such, in FIG. 1, t=4, so only four parties are required to generate a reconstructed secret 106 (i.e., a reconstruction version of the secret 102) and thus approve the transaction.

Generally, reconstruction involves multiple parties coming together with their respective shares of the secret. In the case of threshold secret sharing, at least a threshold number of the parties are required to decrypt the secret. Parties less than the threshold are not authorized to decrypt the secret, and therefore an attempt to decrypt the secret with fewer than the threshold number of parties fails. An example secret reconstruction process involves selecting a unique polynomial s(X) of degree≤r−1 such that s(i)=s_i for all i∈S and returns s(0) as the reconstructed secret x, where r the number of parties attempting to reconstruct the secret. In an example hidden access structure implementation, the threshold is not known by the parties P but is enforced by an authorization testing operation that evaluates access structure tokens associated with each party and their shares.

However, a malicious actor (or adversary, which is potentially one of the parties P) may attempt to compromise the security of the transaction by obtaining the shares of one or more other parties. In such an activity, the adversary has an advantage if he or she knows the threshold t, as it specifies the minimum number of shares that must be obtained in order to reconstruct the secret 102 as the reconstructed secret 106. When the threshold number t is known, an adversary will be able to better plan their attack by identifying t vulnerable parties of the parties P before carrying out the attack. By doing so, the parties will have less time to discover and to respond to the attack. However, when the threshold t is not known, the risk to the adversary increases. If the adversary is only able to attack four of the six parties, for example, it is riskier to carry out the attack because if the threshold is higher than four, then the attack fails and may alert the parties to the attack. On the other hand, it might take a lot more time and effort for the adversary to compromise all six parties (which would guarantee success). As such, when the threshold number is small, hiding t conceals this fact, and thus conceals that it is an “easy” target. Accordingly, hiding the threshold t from malicious actors presents security advantages.

In one implementation, a mechanism of this hiding is effected, at least in part, by generating multiple threshold access structure tokens for each party of the multiple parties and communicating the secret share and multiple threshold access structure tokens to each corresponding party. The described technology will be disclosed herein with both formal notation and proofs, as well as a narrative technical description.

As for the formal notation, the following definitions are presented.

Definition 1 (Access Structure) Let ={P₁, . . . , P_n} be a set of parties. A collection Γ⊆ is monotone if ∈Γ and ∈imply that ∈Γ. An access structure Γ⊆ is a monotone collection of non-empty subsets of . Subsets in Γ are called authorized, and subsets not in Γ are called unauthorized.

Definition 2 (Threshold Access Structure) A threshold access structure Γ is an access structure that contains all subsets of of size≥t for some fixed t, i.e.Γ={⊆:||≥t}.

Definition 3 (Perfect Secret Sharing Scheme with Hidden Access Structures) A perfect secret sharing scheme with hidden access structures with respect to a collection of access structures , a set of n parties ={P₁, . . . , P_n}, and a set of secrets , consists of a pair of polynomial-time algorithms (Share,Recon), where:

• • Share is a randomized algorithm that gets a secret κ∈ and access structure Γ∈ as inputs, and outputs n aggregated shares, {Π₁^(Γ,κ), . . . , Π_n^(Γ,κ)}, of κ,
  • Recon (referring to reconstruction) is a deterministic algorithm that gets as input the aggregated shares of a subset ⊆, denoted by , and outputs an element of ∪{⊥},such that the following four conditions are satisfied:
  • 1. Perfect Authorization Verification: for all secrets κ∈ and every subset ⊆P,Recon,)≠⊥ if ∈Γ,andRecon,)=⊥ if ∉Γ,
  • 2. Perfect Correctness: for all secrets κ∈ and every authorized subset ∈Γ,Recon,)=κ,
  • 3. Perfect Secrecy: for every unauthorized subset ∉Γ and all secrets κ₁, κ₂∈ the distributions and are identical, and
    • 4. Perfect Access Structure Hiding: for every unauthorized subset ∉Γ, every access structure Γ′∈ with ∉Γ′ and all secrets κ∈, the distributions and are identical.

Given an access structure Γ and the parties P, the dealer 100 can generate a set of access structure tokens or each party in P, such that any authorized subset of parties can use their sets of access structure tokens to identify themselves as members of the access structure Γ.

Relying on this notation and the accompanying definitions, the described technology provides a sharing function that allows the dealer 100 to allocate shares (e.g., a set of n shares, {Π₁^(Γ,κ), . . . , Π_n^(Γ,κ)}) of a secret 102 (e.g., a secret κ∈) to the parties 104. (e.g., a set of n parties ={P₁, . . . , P_n}). The dealer 100 also uses an access structure Γ∈ to define the authorized subsets of parties capable of authorized reconstruction of the secret 102. Using an access structure encoding operation (e.g., based on an Access Structure Encoding Scheme or ASES), the dealer 100 can generate a set of access structure tokens ω_i for each party in P. As shown in FIG. 1, the dealer 100 then distributes the secret shares and the sets of access structure tokens to the parties P, and a subset of the parties can then generate the reconstructed secret 106. The number of parties required in this subset (e.g., threshold t) to reconstruct the secret 102, however, is encoded in the access structure tokens and is therefore inaccessible to an outside party or the parties themselves.

An example threshold secret sharing scheme with hidden access structures may be implemented based on the following concepts.

Let ={P₁, P₂ . . . , P_n} be the set of parties, and ={Γ_t: 1≤t≤n} be a collection of access structures, wherein Γ_t={⊆:|A|≥t}, and with = where is prime and is the finite field with ^α elements, and let ⊂ be a proper subfield with >n, and an injection : {1, 2, . . . , n}→\{0}⊂. The injection is used to identify elements of the set {1, 2, . . . , n} with elements of \{0}.

Lemma 1 Let 1≤k≤n and p(X)=p_k−1X^k−1+ . . . +p₀∈[X] be a polynomial of degree k−1. Let S⊂{1, 2, . . . , n} be a subset of size k−1 and q(X)∈[X] be the unique polynomial of degree≤k−2 such that q(i)=p(i) for all i∈S. Then q(0)≠p(0). Furthermore,

• • (i) if p_k−1∈ and p(0)=p₀∈, then q(0)∈;
  • (ii) if p_k−1∈ and p(0)=p₀∉, then q(0)∉;
  • (iii) if p_k−1 ∉ and p(0)=p₀∈, then q(0)∉.

Proof. If q(0)=p(0), then the polynomials p(X) and q(X) agree on the k points in the set S∪{0}. Since both p(X) and q(X) have degree≤k−1, then p(X)=q(X). But p(X) has degree k−1 by assumption, while the degree of q(X) is ≤k−2, a contradiction.

Next, since p(X) and q(X) agree on the k−1 points in S and the polynomial p(X)−q(X) has degree exactly k−1,

$p\left(X\right)-q\left(X\right)=p_{k-1}\prod _{i\in S}\left(X-i\right).$

It follows that

$q\left(0\right)=p\left(0\right)-p_{k-1}\prod _{i\in \sigma }\left(-i\right).$

In case (i), since p(0)∈ and p_k−1∈p_k−1 Π_i∈S (−i)∈, their difference q(0)∈. In case (ii), since p(0)∉ and p_k−1∈p_k−1 Π_i∈S (−i)∈, their difference q(0)∉. Case (iii) is similar since p_k−1∉p_k−1Π_i∈S (−i)∉.

FIG. 2 illustrates example operations 200 for secret sharing process. The secret sharing function is described as Share(Γ_t, κ), wherein Γ_t is a threshold access structure with a threshold of t and κ is the secret. A share generating operation 202 generates a share of the cryptographic secret for each party p_i of n parties P, where i=1, . . . , n. In one implementation, the share generating operation 202 selects a random share polynomial s(X)∈[X] of degree≤t−1 such that s(0)=κ. As such, the share generating operation 202 generates the share s(i) of the secret κ for each party p_i. using a random share polynomial in the finite field .

A token generating operation 204 generates multiple threshold access structure tokens for each party of the n parties P. In one implementation, the number of unique multiple threshold access structure tokens is compressed by generating unique threshold access structure tokens for only for odd values of j, as shown by the operations listed below, where is the finite field and is a subfield the finite field:

• • 1. For each odd integer j<t−1, pick a random token polynomial p(X)=p_jX^j+ . . . +p₀∈[X] such that p_j∈\{0} and p₀∈\. Let

${\omega }_i^{\frac{j+1}{2}}=p\left(i\right)$

• •  for i=1, . . . n.
    • 2. If j=t−1 is odd, pick a random token polynomial p(X)=p_jX^j+ . . . +p₀∈[X] such that p_j∈\ and p₀∈\{0}. Let

${\omega }_i^{\frac{j+1}{2}}=p\left(i\right)$

• •  for i=1, . . . , n.
    • 3. For each odd integer j≥t, pick a random token polynomial p(X)=p_jX^j+ . . . +p₀∈[X] such that p_j∈\{0} and p₀∈. Let

${\omega }_i^{\frac{j+1}{2}}=p\left(i\right)$

• •  for i=1, . . . , n.

Operation 1 pertains to the scenario where fewer than t parties are attempting to reconstruct the secret. In this case, the random token polynomial p(X) of degree j is selected such that p_j∈\{0} represents that p_j is in the subfield , and p₀∈\ represents that p₀ is in the finite field but not in the subfield . As such, if the number of parties coming together to reconstruct the secret is less than the threshold, then, using the access structure tokens for j (less than t) generated from operation 1 for each of the j parties, the constant q₀ (the constant term of the polynomial q(x) reconstructed from these access structure tokens) is not in the subfield, which indicates that the parties are not authorized (because they number less than the threshold). The random token polynomial p(X) is referred to as a token polynomial for each odd integer j<t−1.

Note that the reconstructed polynomial q(x) is equal to p(x) when the number of parties attempting the reconstruction is even, but it will be different from p(x) when the number of parties attempting the reconstruction is odd. This is because q(x) always has degree equal to the (number of parties)−1 (which can have an odd or even degree depending on the number of parties performing the reconstruction), while p(x) is always an odd degree polynomial.

Operation 3 generally pertains to the scenario where t parties or more are attempting to reconstruct the secret. In this case, the random token polynomial p(X) of degree j is selected such that p_j∈\{0} represents that p_j is in the subfield , and p₀∈\ represents that p₀ is in the subfield . As such, if the number of parties coming together to reconstruct the secret is more than the threshold, then, using the access structure tokens for j (greater than t) generated from operation 3 for each of the j parties, the constant q₀ (of the reconstructed polynomial q(x)) is in the subfield, which indicates that the parties are not authorized (because they number more than the threshold).

Operation 2 pertains to an edge scenario resulting from the compression referenced above, where the number of parties attempting to reconstruct the secret is odd, and the threshold is even (i.e., j=t−1 is an odd integer). In this case, the random token polynomial p(X) of degree j is selected such that p_j∈\ represents that p_j is not in the subfield , and p₀∈\{0} represents that p₀ is in the subfield . As such, if the number of parties coming together to reconstruct the secret is an odd integer that is one less than the threshold, then, using the access structure tokens for j=t−1 is an odd integer generated from operation 2 for each of the j parties, the coefficient q_j is not in the subfield, which indicates that the parties are not authorized (because they number fewer than the threshold).

Other implementations of generating unique threshold access structure tokens may be employed, including the non-compressed approach of generating unique threshold access structure tokens for every j. In the uncompressed approach, for example, operation 2 above may be omitted because the edge scenario introduced by compression is absent.

A distributing operation 206 distributes aggregated shares of the cryptographic secret and corresponding threshold access structure tokens to the corresponding parties. “Aggregated share” refers to a combination of the secret share and the access structure tokens distributed to a party. As such, each party receives multiple tokens ω in association with the secret share s(i). Accordingly, for each P_i∈, its aggregated share is Π_i=(s(i), ω_i¹, . . . , ω_i^┌n/2┐), wherein the superscripts correspond to values of j. FIGS. 4 and 5 describe a method and system for reconstructing the secret.

FIG. 3 illustrates an example secret sharing system 300. The secret sharing system 300 is configured to implement a Share(Γ_t, κ) function, wherein Γ_t is a threshold access structure with a threshold of t and κ is the secret. In the illustrated implementation, secret sharing system 300 includes a dealer system 302, which receives or possesses the secret κ and the threshold t. A secret share generator 304 generates a share of the cryptographic secret for each party p_i of n parties P, where i=1, . . . , n, as described with regard to the share generating operation 202 of FIG. 2.

A token generator 306 generates multiple threshold access structure tokens for each p_i of the n parties P. In one implementation, the number of unique multiple threshold access structure tokens is compressed by generating unique threshold access structure tokens for only every other p_i, where is the finite field and is a subfield of the finite field, as discussed with regard to token generating operation 204 in FIG. 2.

A share distributor 308 distributes aggregated shares of the cryptographic secret and corresponding threshold access structure tokens to the corresponding parties through a communications interface 310, such as a network interface, a data bus, etc. “Aggregated share” refers to a combination of the secret share and the access structure tokens distributed to a party. As such, each party receives multiple tokens ω in association with the secret share s(i). Accordingly, for each P_i∈, its aggregated share is Π_g=(s(i), ω_i¹, . . . , ω_i^┌n/2┐), wherein the superscripts correspond to values of j.

FIG. 4 illustrates example operations 400 for secret reconstruction process. An example secret reconstruction function is described as Recon({Π_i}_i∈S), wherein Π represents an aggregate share received from a dealer by one of the parties P and S is a subset of {1, 2, . . . , n} of size r, parse Π_i is represented as (s_i, ω_i¹, . . . , ω_i^┌n/2┐). This notation indicates that the number of parties coming together to reconstruct the secret is r.

A receiving operation 402 receives r aggregated shares, each of which includes a secret share s(i) and multiple threshold access structures ω_i¹, . . . , ω_i^┌n/2┐. For example, one of the parties or a trusted third party can execute the role of a reconstructor entity. A token processing operation 404 selects a unique token polynomial q(X)∈[X] of degree≤r−1 such that q(i)=ω_i^┌r/2┐ for all i∈S. As such, the selected token polynomial has a degree less than or equal to r−1, and its coefficients are within the finite field . It should be understood that the r/2 notation associated with the threshold access structure token ω_i^┌r/2┐ accommodates the compression aspect discussed above. In other implementations, the accommodation of compression and its odd integer condition for j and the division of r by two may be omitted.

An authorization testing operation 406 determines whether q(0)∈. If so, then the threshold number of parties needed to reconstruct the secret has been satisfied, and a reconstruction operation 408 selects a unique share polynomial s(X)∈[X] of degree≤r−1 such that s(i)=s_i for all i∈S and returns s(0) as the reconstruct secret κ 410. Alternatively, if q(0)∉, a denial operation 412 returns ⊥, known as an up tack or falsum, indicating that the r parties are not authorized to reconstruct the secret κ.

FIG. 5 illustrates an example secret reconstruction system 500. An example secret reconstruction system 500 is configured to implement a Recon({Π_i}_i∈S), wherein Π represent an aggregate share received from a dealer by one of the parties P and S is a subset of {1, 2, . . . , n} of size r, parse Π_i is repressed as (s₁, ω_i¹, . . . , ω_i^┌n/2┐). This notation indicates that the number of parties coming together to reconstruct the secret is r.

A communications interface 502 receives r aggregated shares, each of which includes a secret share s(i) and multiple threshold access structures ω_i¹, . . . , ω_i^┌n/2┐, as described with regard to the receiving operation 402 of FIG. 4. A token processor 504 selects a unique token polynomial q(X)∈[X] of degree≤r−1 such that q(i)=ω_i^┌r/2┐ for all i∈S, as described with regard to the token processing operation 404 of FIG. 4.

An authorization tester 506 determines whether q(0)∈. If so, then the threshold number of parties needed to reconstruct the secret has been satisfied, and a reconstructor 508 selects a unique polynomial s(X)∈[X] degree≤r−1 such that s(i)=s_i for all i∈S and returns s(0) as the reconstructed secret κ. Alternatively, if q(0)∉, the reconstructor 508 returns ⊥, indicating that the r parties are not authorized to reconstruct the secret κ.

The secret reconstruction scheme described above is a perfect secret sharing scheme with hidden access structures for the collection of access structures. Theorem 2, described below, supports the validity of the secret reconstruction.

Theorem 2={Γ_t: 1≤t≤n}, where Γ_t={⊆:|A|≥t}.

The following definitions and lemmas are introduced.

Definition 4 Let S⊆{1, 2, . . . , n}, and C⊆[X]. A sequence of elements (γ_i)_i∈S that are indexed by elements of S is admissible for C if there exists some p(X)∈C such that p(i)=γ_i for all i∈S.

The following classes of polynomials are definedC₁^(j)={p(X)=p_jX^j+ . . . +p₀∈[X]:p_j∈\{0} and p₀∉},C₂^(j)={p(X)=p_jX^j+ . . . +p₀∈[X]:p_j∉ and p₀∈\{0}},C₃^(j)={p(X)=p_jX^j+ . . . +p₀∈[X]:p_j∈\{0} and p₀∈}.

Lemma 3 Let S⊆{1, 2, . . . , n} be of size |S|=k, and let (γ_i)_i∈S be any sequence of elements of .

• • 1. (γ_i)_i∈S is admissible for C₁^(k) if and only if it is admissible for C₂^(k).
  • 2. (γ_i)_i∈S is admissible for C₁^(k′), C₂^(k′) and C₃^(k′) for any k<k′≤n.Proof.

1. Suppose (γ_i)_i∈S is admissible for C₁^(k). This means there is some polynomial p(X)=p_kX^k+ . . . +p₀∈[X] with p_k∈\{0} and p₀∉ such that p(i)=γ_i for all i∈S.

Fix some γ₀∈\{0}. Then, there is some polynomial q(X) of degree≤k such that q(i)=γ_i for all i∈S∪{0}. Now, since the polynomials p(X) and q(X) agree on all i∈S,q(X)−p(X)=δΠ_i∈S(X−i)for some δ∈. Substituting X=0 gives

$q\left(0\right)-p\left(0\right)=\delta {\prod }_{i\in S}\left(-i\right)\delta =\frac{q\left(0\right)-p\left(0\right)}{{\prod }_{\dot{\iota }\in s}\left(-i\right)}\notin {𝔽}_{{\ell }^{\beta }}.$ Therefore, as p_k∈, q_k∉, proving that q(X)∈C₂^(k).

To prove the converse, suppose (γ_i)_i∈S is admissible for C₂^(k), so there exists some polynomial q(X)=q_kX^k+ . . . +q₀∈[X] with q_k∉ and q₀∈\{0} such that q(i)=γ_i for all i∈S.

Fix some p_k∈\{0}. Then, there is some polynomial p(X) such that the coefficient of X^k in p(X) equals p_k and such that p(i)=γ_i for all i∈S. Now, since the polynomials p(X) and q(X) agree on all i∈S,p(X)−q(X)=δΠ_i∈S(X−i)for some δ∈. Comparing the coefficients of X^k, p_k−q_k=δ, which gives δ∉. Therefore, p(0)=q(0)+δΠ_i∈S (−i)∉, proving that p(X)∈C₁^(k).

2. Fix any p_k′∈\{0} and any p₀∉. Then there exists a unique polynomial p(X)=p_k′X^k′+ . . . +p₀∈[X] with p_k′−1= . . . =p_k+1=0 such that p(i)=γ_i for all i∈S. Since p(X)∈C₁^(k′), this shows that (γ_i)_i∈S is admissible for C₁^(k′). The proofs for C₂^(k′) and C₃^(k′) are similar.

Lemma 4 Let S⊆{1, 2, . . . , n} be of size |S|=k, and let (γ_i)_i∈S be a sequence of elements of .

1. Suppose (γ_i)_i∈S is admissible for C₁^(k) (respectively C₂^(k)). If p(X) is randomly and uniformly picked from C₁^(k) (respectively C₂^(k)), thenPr[p(i)=γ_i for all i∈S]=(^αk−^αk-a+β)⁻¹.In particular, there are ^αk−^αk−α+β admissible sequences for C₁^(k) (respectively C₂^(k)).

2. Suppose k<k′≤n. Then, for m=1, 2, 3, if p(X) is randomly and uniformly picked from C_m^(k′),Pr[p(i)=γ_i for all i∈S]=(^αk)⁻¹.Proof.

1. Since (γ_i)_i∈S is admissible for C₁^(k), there exists some polynomial q(X)∈C₁^(k) such that q(i)=γ_i for all i∈S.

For each choice of γ∈\{0}, there is exactly one polynomial q^(γ)(X) of degree k such that its leading coefficient is γ and such that q^(γ)(i)=γ_i for all i∈S. Now, since the polynomials q^(γ)(X) and q(X) agree on all i∈S,q^(γ)(X)−q(X)=δΠ_i∈S(X−i)for some δ∈. As the coefficients of X^k for both q(X) and q^(γ)(X) lie in , so does δ. Hence, it follows from q(0)∉ that q^(γ)(0)=q(0)+δΠ_i∈S(−i)∉.

In other words, it is shown that, given any choice of γ∈\{0}, there is exactly one polynomial q^(γ)(X)∈C₁^(k) such that q^(γ)(i)=γ_i for all i∈S. Since |C₁^(k)|=(−1)(^α)^k−1(^α−^β)=^αk−α+β(^α−β−1)(^β−1),

$\begin{array}{c}\mathrm{Pr}\left[p\left(i\right)={\gamma }_i\mathrm{for}\mathrm{all}i\in S\right]\\ =\frac{{\ell }^{\beta }-1}{{\ell }^{\alpha k-\alpha +\beta }\left({\ell }^{\alpha -\beta }-1\right)\left({\ell }^{\beta }-1\right)}\\ ={\left({\ell }^{\alpha k}-{\ell }^{\alpha k-\alpha +\beta }\right)}^{-1},\end{array}$ as desired.

The proof for C₂^(k) is similar.

2. Fix some set T⊆{1, 2, . . . , n}\S of size k′−k−1. Choose some p_k′∈\{0}, p₀∉ and γ_i∈ for i∈T. Then there exists a unique polynomial p(X)=p_k′X^k′+ . . . +p₀∈[X] such that p(i)=γ_i for all i∈S∪T. This shows that

$\begin{array}{c}\mathrm{Pr}\left[p\left(i\right)={\gamma }_i\mathrm{for}\mathrm{all}i\in S\right]\\ =\frac{\mathrm{number}\mathrm{of}\mathrm{choices}\mathrm{for}{p}_{k\prime },p_0\mathrm{and}{\gamma }_i\mathrm{for}i\in T}{❘C_1^{\left(k\prime \right)}❘}\\ =\frac{\left({\ell }^{\beta }-1\right)\left({\ell }^{\alpha }-{\ell }^{\beta }\right){\left({\ell }^{\alpha }\right)}^{k\prime -k-1}}{{\ell }^{\alpha k\prime -\alpha +\beta }\left({\ell }^{\alpha -\beta }-1\right)\left({\ell }^{\beta }-1\right)}={\left({\ell }^{\alpha k}\right)}^{-1}.\end{array}$

The proofs for C₂^(k) and C₃^(k) are similar.

Given this foundation, Theorem 2 can be proved by the following:

Proof of Theorem—Perfect Authorization Verification: Let S be a subset of {1, 2, . . . , n} of size k, and let q(X)∈[X] be the unique polynomial of degree≤k−1 such that q(i)=ω_i^┌k/2┐.

If k is even, then by construction, it is immediate that q(0)∈ or q(0)∉ depending on whether or not k≥t. If k is odd, this follows from parts (i) to (iii) of Lemma 1.

Perfect Correctness: It is proved that any authorized subset can correctly identify itself as being authorized. Thus, perfect correctness follows from perfect correctness of Shamir's secret sharing scheme.

Perfect Secrecy: Since the choices of ω_i^j do not depend on the secret κ, perfect secrecy of our scheme follows essentially from the perfect secrecy property of Shamir's secret sharing scheme.

Perfect Access Structure Hiding: Let 1≤t<t′≤n. Let ω_i^j denote the access structure tokens for the case where the access structure is Γ_t, and ω′_i^j denote the access structure tokens for the case where the access structure is Γ_t′. Suppose |S|=k=t−1. It can be proved that{ω_i^j}_{i∈S,1≤j≤┌n/2┐} and {ω′_i^j}_{i∈S,1≤j≤┌n/2┐}are identically distributed. Since ω_i^j1 is chosen independently of ω_i^j2 for j₁≠j₂, this reduces to the claim that, for fixed j, {ω_i^j}_i∈S and {ω′_i^j}_i∈S are identically distributed.Case 1: j<t/2 or j≥(t′+1)/2.

This is clear as ω_i^j and ω′_i^j are constructed in the same way.

Case 2: j=t/2.

Note that ω_i^j=p(i) where p(X) is randomly and uniformly chosen from C₂^(2j-1), while ω′_i^j=p′(i) where p′(X) is a randomly and uniformly picked from C₁^(2j-1).

Suppose (γ_i)_i∈S is admissible for C₁^(2j-1), then, by Lemma 3(a), (γ_i)_i∈S is also admissible for C₂^(2j-1). Thus, by Lemma 4(a),Pr[p(i)=γ_i for all i∈S]=(^αk−^αk−α+β)⁻¹=Pr[p′(i)=γ_i for all i∈S], as required.Case 3: t/2<j<t′/2.

In this case, ω_i^j=p(i) and ω′_i^j=p′(i), where p(X) and p′(X) are randomly and uniformly chosen from C₃^(2j-1) and C₁^(2j-1) respectively.

Suppose (γ_i)_i∈S is a sequence of elements of . Since |S|=t−1<2j−1, (γ_i)_i∈S is admissible for both C₁^(2j-1) and C₃^(2j-1) by Lemma 3(b). Furthermore, by Lemma 4(b),Pr[p(i)=γ_i for all i∈S]=(^αk)⁻¹=Pr[p′(i)=γ_i for all i∈S]. Case 4: j=t′/2.

The proof of this case is similar to the proof of case 3.

FIG. 6 illustrates an example computing device 600 for implementing the features and operations of the described technology. The computing device 600 may embody a remote control device or a physical controlled device and is an example network-connected and/or network-capable device and may be a client device, such as a laptop, mobile device, desktop, tablet; a server/cloud device; an internet-of-things device; an electronic accessory; or another electronic device. The computing device 600 includes one or more hardware processor(s) 602 and a memory 604. The memory 604 generally includes both volatile memory (e.g., RAM) and nonvolatile memory (e.g., flash memory). An operating system 610 resides in the memory 604 and is executed by the hardware processor(s) 602.

In an example computing device 600, as shown in FIG. 6, one or more modules or segments, such as applications 650, a communications interface, a secret share generator, a token generator, a share distributor, a token processor, an authorization tester, a reconstructor, and other services, workloads, and modules, are loaded into the operating system 610 on the memory 604 and/or storage 620 and executed by hardware processor(s) 602 or other circuitry. The storage 620 may include one or more tangible storage media devices and may store cryptographic security parameters, thresholds, secrets, secret shares, aggregated shares, threshold access structure tokens, and other data and may be local to the computing device 600 or may be remote and communicatively connected to the computing device 600.

The computing device 600 includes a power supply 616, which is powered by one or more batteries or other power sources and which provides power to other components of the computing device 600. The power supply 616 may also be connected to an external power source that overrides or recharges the built-in batteries or other power sources.

The computing device 600 may include one or more communication transceivers 630 that may be connected to one or more antenna(s) 632 to provide network connectivity (e.g., mobile phone network, Wi-Fi®, Bluetooth®) to one or more other servers and/or client devices (e.g., mobile devices, desktop computers, or laptop computers). The computing device 600 may further include a network adapter 636, which is a type of computing device. The computing device 600 may use the adapter and any other types of computing devices for establishing connections over a wide-area network (WAN) or local-area network (LAN). It should be appreciated that the network connections shown are exemplary and that other computing devices and means for establishing a communications link between the computing device 600 and other devices may be used.

The computing device 600 may include one or more input devices 634 such that a user may enter commands and information (e.g., a keyboard or mouse). These and other input devices may be coupled to the server by one or more interfaces 638, such as a serial port interface, parallel port, or universal serial bus (USB). The computing device 600 may further include a display 622, such as a touch screen display.

The computing device 600 may include a variety of tangible processor-readable storage media and intangible processor-readable communication signals. Tangible processor-readable storage can be embodied by any available media that can be accessed by the computing device 600 and includes both volatile and nonvolatile storage media, removable and non-removable storage media. Tangible processor-readable storage media excludes communications signals (e.g., signals per se) and includes volatile and nonvolatile, removable and non-removable storage media implemented in any method or technology for storage of information such as processor-readable instructions, data structures, program modules or other data. Tangible processor-readable storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CDROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other tangible medium which can be used to store the desired information and which can be accessed by the computing device 600. In contrast to tangible processor-readable storage media, intangible processor-readable communication signals may embody processor-readable instructions, data structures, program modules or other data resident in a modulated data signal, such as a carrier wave or other signal transport mechanism. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, intangible communication signals include signals traveling through wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared, and other wireless media.

Various software components described herein are executable by one or more hardware processors, which may include logic machines configured to execute hardware or firmware instructions. For example, the processors may be configured to execute instructions that are part of one or more applications, services, programs, routines, libraries, objects, components, data structures, or other logical constructs. Such instructions may be implemented to perform a task, implement a data type, transform the state of one or more components, achieve a technical effect, or otherwise arrive at a desired result.

Aspects of processors and storage may be integrated together into one or more hardware logic components. Such hardware-logic components may include field-programmable gate arrays (FPGAs), program- and application-specific integrated circuits (PASIC/ASICs), program- and application-specific standard products (PSSP/ASSPs), system-on-a-chip (SOC), and complex programmable logic devices (CPLDs), for example.

The terms “module,” “program,” and “engine” may be used to describe an aspect of a remote control device and/or a physical controlled device 802 implemented to perform a particular function. It will be understood that different modules, programs, and/or engines may be instantiated from the same application, service, code block, object, library, routine, API, function, etc. Likewise, the same module, program, and/or engine may be instantiated by different applications, services, code blocks, objects, routines, APIs, functions, etc. The terms “module,” “program,” and “engine” may encompass individual or groups of executable files, data files, libraries, drivers, scripts, database records, etc.

It will be appreciated that a “service,” as used herein, is an application program executable across multiple user sessions. A service may be available to one or more system components, programs, and/or other services. In some implementations, a service may run on one or more server computing devices.

While this specification contains many specific implementation details, these should not be construed as limitations on the scope of any inventions or of what may be claimed, but rather as descriptions of features specific to particular embodiments of particular described technology. Certain features that are described in this specification in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination. Moreover, although features may be described above as acting in certain combinations and even initially claimed as such, one or more features from a claimed combination can in some cases be excised from the combination, and the claimed combination may be directed to a subcombination or variation of a subcombination.

Similarly, while operations are depicted in the drawings in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed, to achieve desirable results. In certain circumstances, multitasking and parallel processing may be advantageous. Moreover, the separation of various system components in the embodiments described above should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

Thus, particular embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In certain implementations, multitasking and parallel processing may be advantageous.

A number of implementations of the described technology have been described. Nevertheless, it will be understood that various modifications can be made without departing from the spirit and scope of the recited claims.

Claims

1. A computing-processor-implemented method of cryptographically sharing a cryptographic secret among multiple parties, the method comprising: generating a share of the cryptographic secret for each party of the multiple parties;generating a set of multiple threshold access structure tokens for each party of the multiple parties, the multiple threshold access structure tokens being generated for a party from one or more random token polynomials selected from a finite field based on a number of the multiple parties capable of attempting to reconstruct the cryptographic secret; anddistributing the shares of the cryptographic secret and the sets of the multiple threshold access structure tokens to the multiple parties, each party receiving a different share of the cryptographic secret and a different set of the multiple threshold access structure tokens, wherein at least a threshold number of the parties can reconstruct the cryptographic secret using the shares of the cryptographic secret and the multiple threshold access structure tokens corresponding to at least a threshold number of the parties attempting to reconstruct the cryptographic secret and less than the threshold number of the parties cannot reconstruct the cryptographic secret using the shares of the cryptographic secret and the multiple threshold access structure tokens corresponding to the less than the threshold number of the parties.

2. The computing-processor-implemented method of claim 1, wherein the operation of generating a share comprises: selecting a random share polynomial in a finite field and having a degree less than the threshold number; andgenerating the share for each of the parties using the random share polynomial.

3. The computing-processor-implemented method of claim 1, wherein the generating of the multiple threshold access structure tokens comprises: selecting, for an integer less than the threshold number, a random token polynomial of the one or more random token polynomials with a coefficient corresponding to a highest degree of the random token polynomial that is a member of a subfield of the finite field and a constant of the random token polynomial is not a member of the subfield of the finite field; andgenerating one or more of the multiple threshold access structure tokens from coefficients of the selected random token polynomial, the one or more of the multiple threshold access structure tokens indicating that the number of the multiple parties attempting to reconstruct the cryptographic secret is unauthorized to reconstruct the cryptographic secret.

4. The computing-processor-implemented method of claim 3, wherein a number of the parties attempting to reconstruct the cryptographic secret that is less than the threshold number and the cryptographic secret is not reconstructable using the shares and the multiple threshold access structure tokens of the attempting parties corresponding to the number of attempting parties.

5. The computing-processor-implemented method of claim 1, wherein the generating of the multiple threshold access structure tokens comprises: selecting, for an integer greater than or equal to the threshold number, a random token polynomial of the one or more random token polynomials with a coefficient corresponding to a highest degree of the random token polynomial that is a member of a subfield of the finite field and a constant of the random token polynomial is also a member of the subfield of the finite field; andgenerating one or more of the multiple threshold access structure tokens from the selected random token polynomial, the one or more of the multiple threshold access structure tokens indicating that the number of the multiple parties attempting to reconstruct the cryptographic secret is authorized to reconstruct the cryptographic secret.

6. The computing-processor-implemented method of claim 3, wherein a number of the parties attempting to reconstruct the cryptographic secret that is greater than or equal to the threshold number and the cryptographic secret is reconstructable using the shares and the multiple threshold access structure tokens of the attempting parties corresponding to the number of attempting parties.

7. The computing-processor-implemented method of claim 1, wherein the generating of the multiple threshold access structure tokens comprises: selecting, for an odd integer that is one less than the threshold number, a random token polynomial of the one or more random token polynomials with a coefficient corresponding to a highest degree of the random token polynomial that is not a member of a subfield of the finite field and a constant of the random token polynomial is a member of the subfield of the finite field; andgenerating one or more of the multiple threshold access structure tokens from the selected random token polynomial, the one or more of the multiple threshold access structure tokens indicating that the number of the multiple parties attempting to reconstruct the cryptographic secret is unauthorized to reconstruct the cryptographic secret.

8. A system for cryptographically sharing a cryptographic secret among multiple parties, the system comprising: one or more hardware processors;a secret share generator executable by the one or more hardware processors and configured to generate a share of the cryptographic secret for each party of the multiple parties;a token generator executable by the one or more hardware processors and configured to generate a set of multiple threshold access structure tokens for each party of the multiple parties, the multiple threshold access structure tokens being generated for a party from one or more random token polynomials selected from a finite field based on a number of the multiple parties capable of attempting to reconstruct the cryptographic secret; anda share distributor executable by the one or more hardware processors and configured to distribute the shares of the cryptographic secret and the sets of multiple threshold access structure tokens to the multiple parties, each party receiving a different share of the cryptographic secret and a different set of the multiple threshold access structure tokens, wherein at least a threshold number of the parties can reconstruct the cryptographic secret using the shares of the cryptographic secret and the multiple threshold access structure tokens corresponding to at least a threshold number of the parties attempting to reconstruct the cryptographic secret and less than the threshold number of the parties cannot reconstruct the cryptographic secret using the shares of the cryptographic secret and the multiple threshold access structure tokens corresponding to the less than the threshold number of the parties.

9. The system of claim 8, wherein the secret share generator is configured to generate a share by selecting a random share polynomial in a finite field and having a degree less than the threshold number, the random share polynomial being selected to generate the share for each of the parties using the random share polynomial.

10. The system of claim 8, wherein the token generator is configured to generate the multiple threshold access structure tokens by selecting, for an integer less than the threshold number, a random token polynomial of the one or more random token polynomials with a coefficient corresponding to a highest degree of the random token polynomial that is a member of a subfield of the finite field and a constant of the random token polynomial is not a member of the subfield of the finite field, and to generate one or more of the multiple threshold access structure tokens from the selected random token polynomial, the one or more of the multiple threshold access structure tokens indicating that the number of the multiple parties attempting to reconstruct the cryptographic secret is unauthorized to reconstruct the cryptographic secret.

11. The system of claim 10, wherein a number of the parties attempting to reconstruct the cryptographic secret that is less than the threshold number and the cryptographic secret is not reconstructable using the shares and the multiple threshold access structure tokens of the attempting parties corresponding to the number of attempting parties.

12. The system of claim 8, wherein the token generator is configured to generate the multiple threshold access structure tokens by selecting, for an integer greater than or equal to the threshold number, a random token polynomial of the one or more random token polynomials with a coefficient corresponding to a highest degree of the random token polynomial that is a member of a subfield of the finite field and a constant of the random token polynomial is also a member of the subfield of the finite field, andgenerating one or more of the multiple threshold access structure tokens from the selected random token polynomial, the one or more of the multiple threshold access structure tokens indicating that the number of the multiple parties attempting to reconstruct the cryptographic secret is authorized to reconstruct the cryptographic secret.

13. The system of claim 12, wherein a number of the parties attempting to reconstruct the cryptographic secret that is greater than or equal to the threshold number and the cryptographic secret is reconstructable using the shares and the multiple threshold access structure tokens of the attempting parties corresponding to the number of attempting parties.

14. The system of claim 8, wherein the token generator is configured to generate the multiple threshold access structure tokens by selecting, for an odd integer that is one less than the threshold number, a random token polynomial of the one or more random token polynomials with a coefficient corresponding to a highest degree of the random token polynomial that is not a member of a subfield of the finite field and a constant of the random token polynomial is a member of the subfield of the finite field, andgenerating one or more of the multiple threshold access structure tokens from the selected random token polynomial, the one or more of the multiple threshold access structure tokens indicating that the number of the multiple parties attempting to reconstruct the cryptographic secret is unauthorized to reconstruct the cryptographic secret.

15. One or more tangible processor-readable storage media embodied with instructions for executing on one or more processors and circuits of a computing device a process cryptographically sharing a cryptographic secret among multiple parties, the process comprising: generating a share of the cryptographic secret for each party of the multiple parties;generating a set of multiple threshold access structure tokens for each party of the multiple parties, the multiple threshold access structure tokens being generated for a party from one or more random token polynomials selected from a finite field based on a number of the multiple parties capable of attempting to reconstruct the cryptographic secret; anddistributing the shares of the cryptographic secret and the sets of multiple threshold access structure tokens to the multiple parties, each party receiving a different share of the cryptographic secret and a different set of the multiple threshold access structure tokens, wherein at least a threshold number of the parties can reconstruct the cryptographic secret using the shares of the cryptographic secret and the multiple threshold access structure tokens corresponding to at least a threshold number of the parties attempting to reconstruct the cryptographic secret and less than the threshold number of the parties cannot reconstruct the cryptographic secret using the shares of the cryptographic secret and the multiple threshold access structure tokens corresponding to the less than the threshold number of the parties.

16. The one or more tangible processor-readable storage media of claim 15, wherein the generating of the multiple threshold access structure tokens comprises: selecting, for an integer less than the threshold number, a random token polynomial of the one or more random token polynomials with a coefficient corresponding to a highest degree of the random token polynomial that is a member of a subfield of the finite field and a constant of the random token polynomial is not a member of the subfield of the finite field; andgenerating one or more of the multiple threshold access structure tokens from the selected random token polynomial, the one or more of the multiple threshold access structure tokens indicating that the number of the multiple parties attempting to reconstruct the cryptographic secret is unauthorized to reconstruct the cryptographic secret.

17. The one or more tangible processor-readable storage media of claim 16, wherein a number of the parties attempting to reconstruct the cryptographic secret that is less than the threshold number and the cryptographic secret is not reconstructable using the shares and the multiple threshold access structure tokens of the attempting parties corresponding to the number of attempting parties.

18. The one or more tangible processor-readable storage media of claim 15, wherein the generating of the multiple threshold access structure tokens comprises: selecting, for an integer greater than or equal to the threshold number, a random token polynomial of the one or more random token polynomials with a coefficient corresponding to a highest degree of the random token polynomial that is a member of a subfield of the finite field and a constant of the random token polynomial is also a member of the subfield of the finite field; andgenerating one or more of the multiple threshold access structure tokens from the selected random token polynomial, the one or more of the multiple threshold access structure tokens indicating that the number of the multiple parties attempting to reconstruct the cryptographic secret is authorized to reconstruct the cryptographic secret.

19. The one or more tangible processor-readable storage media of claim 18, wherein a number of the parties attempting to reconstruct the cryptographic secret that is greater than or equal to the threshold number and the cryptographic secret is reconstructable using the shares and the multiple threshold access structure tokens of the attempting parties corresponding to the number of attempting parties.

20. The one or more tangible processor-readable storage media of claim 15, wherein the generating of the multiple threshold access structure tokens comprises: selecting, for an odd integer that is one less than the threshold number, a random token polynomial of the one or more random token polynomials with a coefficient corresponding to a highest degree of the random token polynomial that is not a member of a subfield of the finite field and a constant of the random token polynomial is a member of the subfield of the finite field; andgenerating one or more of the multiple threshold access structure tokens from the selected random token polynomial, the one or more of the multiple threshold access structure tokens indicating that the number of the multiple parties attempting to reconstruct the cryptographic secret is unauthorized to reconstruct the cryptographic secret.