A Secret Sharing Method with Perfect Security against Local Leakage

Abstract

The present invention discloses a method for anti-partial leakage secret sharing with perfect security. The distributor selects an AONT and discloses all the inputs and outputs corresponding to the AONT; extracts pairs of inputs and outputs from all the inputs and outputs of the AONT, selects strings of a set bit length from each of them and denotes them as, and uses variables to represent the positions of in ; respectively uses algorithms to calculate the sub-secrets and sub-random numbers for the secret s and the random number r; secretly distributes the pseudo-sub-secrets to the participants through a secure channel; after at least participants contribute their own pseudo-sub-secrets, uses algorithms to gradually reconstruct and calculate the secret s. The solution of the present invention can be applied to a threshold secret sharing scheme with perfect security to generate an LLRSS scheme with perfect security.

Description

Technical Field

[0001] The present invention relates to the technical field of cryptographic secret sharing, and in particular to a method for perfectly secure anti-local leakage secret sharing. Background Art

[0002] Anti-leakage secret sharing has always been a hot issue in the field of cryptography. In order to resist side-channel attacks, a common approach is to add a certain amount of redundant information to the sub-secrets to resist side-channel attacks. The more redundant information added to the sub-secrets, the higher the leakage rate (the size of the allowed leaked bits / the size of the sub-secret bits) of the scheme theoretically, but the lower the information rate (the size of the sub-secret bits / the size of the secret bits) of the scheme. The information rate is an important indicator to measure the efficiency of secret sharing. Therefore, how to design a scheme with a high leakage rate without significantly reducing the information rate of the original scheme is a hot issue. Since classical secret sharing considers that participants in unauthorized sets cannot obtain secret information, in the security model of anti-leakage secret sharing, not only should we consider that the adversary can obtain all the sub-secret information of participants in unauthorized sets, but also the adversary can obtain partial sub-secret information of other participants through side-channel attack means. There are various ways of side-channel attacks, and the adversary may obtain information about participants in multiple ways. A common way is that the adversary has the ability to access the memory of a physical device. The adversary can obtain partial information in the memory, but cannot control the physical device to perform arbitrary calculations. Finally, through such attack means, the adversary obtains partial information of the sub-secrets until obtaining partial information of all sub-secrets. In addition, the adversary is also allowed to collude with participants in unauthorized sets to obtain all their sub-secret information.

[0003] The existing research literature on LLRSS only gives schemes with statistical security, and does not give schemes with perfect security. In some scenarios with higher security requirements, merely a scheme with statistical security is not enough, but a scheme that meets perfect security is required. Summary of the Invention

[0004] The purpose of the present invention is to provide a method for perfectly secure anti-local leakage secret sharing.

[0005] The technical solution adopted by the present invention is:

[0006] A method for perfectly secure anti-local leakage secret sharing, including a parameter selection stage, a distribution stage, and a reconstruction stage; the specific process is as follows:

[0007] Parameter Selection Stage:

[0008] Step 1, the distributor selects an AONT of (m, h, 2) and discloses all the inputs and outputs corresponding to the AONT; m indicates that the function ensures that at least m bits are completely unknown, and h indicates the bit size of the input and output.

[0009] Step 2, take out n pairs of inputs and outputs from all the inputs and outputs of the AONT. Each pair of input and output is of h-bit size. The input is denoted as b i , i = 1,..., n, and the output is denoted as c i , i = 1,..., n;

[0010] Step 3, select a string of i bit length from each b and denote it as b′ i , and use a variable w of h-bit size i to represent the position of the string b′ i in b i ;

[0011] Distribution phase:

[0012] Step 4, the distributor uses the algorithm of (t, n)-threshold secret sharing for the secret s of m-bit size to obtain sub-secrets {s1,..., s n}; and use s i to represent a sub-secret in {s1,..., s n}, i ∈ [n]; t is the threshold value, and participants greater than or equal to t can recover the secret;

[0013] Step 5, obtain a random number r, and use the algorithm of (2, n)-threshold secret sharing for the random number r to obtain {r1, r2,..., r n}; and use r i to represent a sub-random number in {r1, r2,..., r n}, i ∈ [n];

[0014] Step 6, secretly distribute the pseudo-sub-secrets to the participant P i through a secure channel;

[0015] Reconstruction phase:

[0016] Step 7, each participant P i obtains and owns the corresponding pseudo-sub-secret

[0017] Step 8, after at least t participants contribute their pseudo-sub-secrets, first for {r1, r2,..., rn} Use the (2, n)-threshold secret sharing algorithm to obtain a random number r;

[0018] Step 9, each participant P i respectively calculates to obtain

[0019] Step 10, each participant P i respectively obtains the corresponding b i through the corresponding c i and the publicly available AONT input-output table, and then obtains b' i through the position variable w i ;

[0020] Step 11, calculate to obtain s i , and calculate the secret s through the (t, n)-threshold secret sharing algorithm.

[0021] The present invention adopts the above technical solutions, gives a perfectly secure definition of LLRSS secret sharing, and provides a specific construction scheme based on AONT. The solution of the present invention can be applied to a threshold secret sharing scheme with perfect security to generate an LLRSS scheme with perfect security. Compared with other solutions, the solution of the present invention is more suitable for some scenarios with higher security requirements. Specific Embodiments

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the embodiments of the present application.

[0023] The present invention discloses a method for perfectly secure anti-local leakage secret sharing, including a parameter selection stage, a distribution stage, and a reconstruction stage; the specific process is as follows:

[0024] Parameter Selection Stage:

[0025] Step 1, the distributor selects an AONT of (m, h, 2) and discloses all the input and output of the corresponding AONT;

[0026] Step 2, take out n pairs of input and output from all the input and output of the AONT, each pair of input and output is h bits in size, the input is denoted as b i , i = 1,..., n, and the output is denoted as c i , i = 1,..., n;

[0027] Step 3, select i from each b A string of bit length, denoted as b′ i , where p represents the size of the field in the algebraic system, that is, the secret is selected from this field; and a variable w of h-bit size is used i to represent the string b′ i at the position in b i ;

[0028] Distribution phase:

[0029] Step 4, the distributor uses the (t,n) threshold secret sharing algorithm for the secret s of m-bit size to obtain sub-secrets {s1,...,s n}; and uses s i to represent a sub-secret in {s1,...,s n} where i ∈ [n];

[0030] Step 5, obtain a random number Use the (2,n) threshold secret sharing algorithm for the random number r to obtain {r1,r2,...,r n}; and uses r i to represent a sub-random number in {r1,r2,...,r n} where i ∈ [n];

[0031] Step 6, secretly distribute the pseudo sub-secrets to the participant P i ;

[0032] Reconstruction phase:

[0033] Step 7, each participant P i obtains and owns the corresponding pseudo sub-secret

[0034] Step 8, after at least t participants contribute their pseudo sub-secrets, first use the (2,n) threshold secret sharing n algorithm for {r1,r2,...,r } to obtain the random number r;

[0035] Step 9, each participant P i calculates respectively to obtain

[0036] Step 10, each participant P i obtains the corresponding b i respectively through the corresponding c i and the publicly available AONT input-output table, and then obtains b′ i through the position variable w i;

[0037] Step 11, calculate Get i , and shared through the (t,n) threshold secret The algorithm calculates the secret s.

[0038] The formal proof scheme of the theorem adopted in the present invention has perfect security against local leakage, and the proof is as follows:

[0039] Theorem 1. Even if t-1 participants collude with the adversary, and the adversary obtains partial information of the remaining n-t+1 participants, the adversary cannot obtain any information of the secret. That is, for any secret s 1 ,s 2 , there is τ K,μ (s 1 )≡τ K,μ (s 2 )Here |K|≤t-1.

[0040] Proof: Without loss of generality, assume that the first t-1 participants collude with the adversary. Select a random number U m Replace the leakage function τ i Input Finally, we will rely on the properties of AONT, making the results before and after each replacement completely indistinguishable. Once all s are replaced i , then according to the security of secret sharing, we can conclude that this scheme has perfect security against leakage. First, we will use the modified sub-secret distributor to define the hybrid The modified sub-secret distributor is defined as follows:

[0041] Run on secret s The algorithm obtains the sub-secret (s1,...,s n );

[0042] Pick a random number and ANOT's n pairs of input and output b i and c i ;

[0043] For each j∈[n], perform the following operations:

[0044] – Randomly select h bits of w j ;

[0045] – If j∈[n]\K and j<i, then randomly select an m-bit pseudo-secret s′ i ; otherwise according to w j and b i Determine b′ i ,make

[0046] · Run the (2, n)-threshold algorithm on the random number r to obtain (r1,..., r n );

[0047] · Output

[0048] In this way, the output of hyb i is τ(share1,..., share n ). It can be seen therefrom that the solution of the present invention satisfies the perfect security against local leakage.

[0049] The present invention adopts the above technical solutions, gives the definition of perfectly secure LLRSS secret sharing, and gives a specific construction solution based on AONT. The solution of the present invention can be applied to threshold secret sharing schemes with perfect security to generate LLRSS schemes with perfect security. Compared with other solutions, the solution of the present invention is more suitable for some scenarios with higher security requirements.

[0050] Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Without conflict, the embodiments and features in the embodiments of the present application can be combined with each other. Generally, the components of the embodiments of the present application shown here can be arranged and designed in various different configurations. Therefore, the detailed description of the embodiments of the present application is not intended to limit the scope of the present application claimed, but merely represents the selected embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application without creative efforts fall within the scope of protection of the present application.

Claims

1. An anti-local leakage secret sharing method with perfect security, characterized in that: It includes a parameter selection stage, a distribution stage, and a reconstruction stage; the specific process is as follows: Parameter selection stage: Step 1, the distributor selects an AONT and discloses all the inputs and outputs corresponding to the AONT. Step 2: Take out n pairs of inputs and outputs from all the inputs and outputs of the AONT, where the input is denoted as b i , and the output is denoted as c i , i = 1,..., n; Step 3, select a string with a set bit length from each b i and denote it as b i ′ , and use the position variable w i to represent the position of the string b i ′ in b i ; Distribution stage: Step 4, the distributor uses the (t, n)-threshold secret sharing of the secret s to obtain sub-secrets {s1,..., s n}; and uses s i to represent one of the sub-secrets in {s1,..., s n}, where is the t-threshold value and i ∈ [n]; Step 5, obtain a random number Use the (2, n) threshold secret sharing for the random number r to obtain {r1, r2,..., r n}; and use r i to represent a sub-random number in {r1, r2,..., r n}; Step 6, secretly distribute the pseudo-sub-secrets through a secure channel based on the selected parameters to each participant P i ; Reconstruction stage: Step 7, each participant P i obtains and owns the corresponding pseudo sub-secret Step 8, after at least t participants contribute their pseudo-sub-secrets, use the n steps of (2, n) threshold secret sharing for {r1, r2,..., r } to obtain the random number r; Step 9, each participant P i calculates separately to obtain Step 10, each participant P i respectively obtains the corresponding b i through the corresponding c i and the publicly available AONT input-output table, and then obtains b i through the position variable w i ′ ; Step 11, calculate to obtain s i , and obtain the secret s through the calculation of the step of (t, n)-threshold secret sharing.

2. The anti-partial leakage secret sharing method with perfect security according to claim 1, wherein: In Step 1, an AONT of (m, h, 2) is selected, where m represents the number of bits that the function guarantees are completely unknown, and h represents the bit size of the input and output.

3. The method for sharing secrets against local leakage with perfect security according to claim 1, characterized in that: Each pair of input and output in step 2 is of size h bits, and the position variable w in step 3 i is of size h bits.

4. The method for anti-partial leakage secret sharing with perfect security according to claim 1, characterized in that: Set the bit length in Step 3 p represents the size of the field in the algebraic system.

5. The method for sharing secrets against local leakage with perfect security according to claim 2, characterized in that: In Step 4, the size of the secret s is m bits.

Images