2026-07-21T18:36:12Z https://drops.dagstuhl.de/oai

oai:drops-oai.dagstuhl.de:14329 2024-03-06T10:53:47Z ddc:004 open_access

Broadcast Secret-Sharing, Bounds and Applications Damgård, Ivan Bjerre Larsen, Kasper Green Yakoubov, Sophia Secret-Sharing Ad-hoc Threshold Encryption Consider a sender 𝒮 and a group of n recipients. 𝒮 holds a secret message 𝗆 of length l bits and the goal is to allow 𝒮 to create a secret sharing of 𝗆 with privacy threshold t among the recipients, by broadcasting a single message 𝖼 to the recipients. Our goal is to do this with information theoretic security in a model with a simple form of correlated randomness. Namely, for each subset 𝒜 of recipients of size q, 𝒮 may share a random key with all recipients in 𝒜. (The keys shared with different subsets 𝒜 must be independent.) We call this Broadcast Secret-Sharing (BSS) with parameters l, n, t and q. Our main question is: how large must 𝖼 be, as a function of the parameters? We show that (n-t)/q l is a lower bound, and we show an upper bound of ((n(t+1)/(q+t)) -t)l, matching the lower bound whenever t = 0, or when q = 1 or n-t. When q = n-t, the size of 𝖼 is exactly l which is clearly minimal. The protocol demonstrating the upper bound in this case requires 𝒮 to share a key with every subset of size n-t. We show that this overhead cannot be avoided when 𝖼 has minimal size. We also show that if access is additionally given to an idealized PRG, the lower bound on ciphertext size becomes (n-t)/q λ + l - negl(λ) (where λ is the length of the input to the PRG). The upper bound becomes ((n(t+1))/(q+t) -t)λ + l. BSS can be applied directly to secret-key threshold encryption. We can also consider a setting where the correlated randomness is generated using computationally secure and non-interactive key exchange, where we assume that each recipient has an (independently generated) public key for this purpose. In this model, any protocol for non-interactive secret sharing becomes an ad hoc threshold encryption (ATE) scheme, which is a threshold encryption scheme with no trusted setup beyond a PKI. Our upper bounds imply new ATE schemes, and our lower bound becomes a lower bound on the ciphertext size in any ATE scheme that uses a key exchange functionality and no other cryptographic primitives. Schloss Dagstuhl – Leibniz-Zentrum für Informatik Ivan Bjerre Damgård and Kasper Green Larsen and Sophia Yakoubov 2021 Is Part Of LIPIcs, Volume 199, 2nd Conference on Information-Theoretic Cryptography (ITC 2021) InProceedings Text doc-type:ResearchArticle publishedVersion application/pdf doi:10.4230/LIPIcs.ITC.2021.10 urn:nbn:de:0030-drops-143299 https://drops.dagstuhl.de/entities/document/10.4230/LIPIcs.ITC.2021.10 eng https://creativecommons.org/licenses/by/4.0/legalcode