Algebraic geometric secret sharing schemes and secure multi-party computations over small fields

  • Authors:
  • Hao Chen;Ronald Cramer

  • Affiliations:
  • Department of Computing and Information Technology, School of Information Science and Engineering, Fudan University, Shanghai, China;CWI, Amsterdam, The Netherlands

  • Venue:
  • CRYPTO'06 Proceedings of the 26th annual international conference on Advances in Cryptology
  • Year:
  • 2006

Quantified Score

Hi-index 0.00

Visualization

Abstract

We introduce algebraic geometric techniques in secret sharing and in secure multi-party computation (MPC) in particular. The main result is a linear secret sharing scheme (LSSS) defined over a finite field ${\mathbb F}_q$, with the following properties. 1. It is ideal. The number of players n can be as large as $\#C({\mathbb F}_q)$, where C is an algebraic curve C of genus g defined over ${\mathbb F}_q$. 2. It is quasi-threshold: it is t-rejecting and t+1+2g-accepting, but not necessarily t+1-accepting. It is thus in particular a ramp scheme. High information rate can be achieved. 3. It has strong multiplication with respect to the t-threshold adversary structure, if $tt-adversary. 4. The finite field ${\mathbb F}_q$ can be dramatically smaller than n. This is by using algebraic curves with many ${\mathbb F}_q$-rational points. For example, for each small enough ε, there is a finite field ${\mathbb F}_q$ such that for infinitely many n there is an LSSS over ${\mathbb F}_q$ with strong multiplication satisfying $(\frac{1}{3}- \epsilon) n\leq t 5. Shamir's scheme, which requires nq and which has strong multiplication for $tg=0. Now consider the classical (“BGW”) scenario of MPC unconditionally secure (with zero error probability) against an active t-adversary with $tn-player network with secure channels. By known results it now follows that there exist MPC protocols in this scenario, achieving the same communication complexities in terms of the number of field elements exchanged in the network compared with known Shamir-based solutions. However, in return for decreasing corruption tolerance by a small ε-fraction, q may be dramatically smaller than n. This tolerance decrease is unavoidable due to properties of MDS codes. The techniques extend to other models of MPC. Results on less specialized LSSS can be obtained from more general coding theory arguments.