Improvements on Distributed Key Generation Bachelor Project Kopiga - - PowerPoint PPT Presentation

▶
improvements on distributed key generation
SMART_READER_LITE
LIVE PREVIEW

Improvements on Distributed Key Generation Bachelor Project Kopiga - - PowerPoint PPT Presentation

Sep 01, 2023 337 likes •634 views

Improvements on Distributed Key Generation Bachelor Project Kopiga Rasiah Responsible Supervisor Bryan Ford Nicolas Gailly 1 Improvements on Distributed Key Generation Objective: Bringing improvements in order to enhance the security of

slide-1
SLIDE 1

Improvements on Distributed Key Generation

Kopiga Rasiah

Responsible Bryan Ford Supervisor Nicolas Gailly

Bachelor Project

1

slide-2
SLIDE 2

Improvements on Distributed Key Generation

2

  • Objective: Bringing improvements in order to enhance the security of the protocol
slide-3
SLIDE 3

Outline

  • Background:
  • What is DKG
  • Shamir’s secret
  • Feldman’s VSS
  • How DKG works
  • My work: Proactive secret sharing
  • Implementation
  • Conclusion

3

slide-4
SLIDE 4

Distributed Key Generation

4

  • Set of n participants who collectively generate a shared private/public key
  • Each node have a share of the secret (private key)
  • No single point failure: attacker needs to break into multiple location to have

access to the secret.

  • DKG is mostly used in group digital signature, or decrypt shared ciphertexts.
slide-5
SLIDE 5

Shamir’s secret sharing

dealer

5

slide-6
SLIDE 6

Shamir’s secret sharing

dealer

6

slide-7
SLIDE 7

Shamir’s secret sharing

  • f(x) = s + a1x + a2x2 + … + at-1xt-1, t < n
  • construct n points out of it (shares) and distributes to the nodes

7

  • f(0) = secret
slide-8
SLIDE 8

Shamir’s secret sharing

f(1)

1 2 3 4 5

f(2) f(3) f(4) f(5)

  • t points are sufficient to reconstruct a t-1 degree polynomial function
slide-9
SLIDE 9

Shamir’s secret sharing

1 2 3 4 5

9

slide-10
SLIDE 10

Feldman’s verifiable secret sharing

  • Based on Shamir’s secret sharing
  • nodes can verify if their shares are consistent
  • dealer broadcasts F(•) = f(•) * g
  • F(i) == si * g

10

slide-11
SLIDE 11

Distributed Key Generation

  • Based on Feldman’s VSS
  • System without any trusted party
  • Executes n VSS instances in parallel: every node is a dealer
  • Each node generates fi(x) = zi + a1x + a2x2 +…+ at-1xt-1 , where zi is random

11

slide-12
SLIDE 12

Distributed Key Generation

12

f1(1) 1 4 3 2 f1(2) f1(3) f1(4)

slide-13
SLIDE 13

Distributed Key Generation

13

f1(1) 1 4 3 2 f1(2) f1(3) f1(4) f2(2) f2(3) f2(1) f2(4)

slide-14
SLIDE 14

Distributed Key Generation

1

2 3 4

f1(1) +f2(1) +f3(1) +f4(1) = s1 f1(2) +f2(2) +f3(2) +f4(2) = s2 f1(3) +f2(3) +f3(3) +f4(3) = s3 f1(4) +f2(4) +f3(4) +f4(4) = s4

14

slide-15
SLIDE 15

Distributed Key Generation

1

2 3 4

f1(1) +f2(1) +f3(1) +f4(1) = s1 f1(2) +f2(2) +f3(2) +f4(2) = s2 f1(3) +f2(3) +f3(3) +f4(3) = s3 f1(4) +f2(4) +f3(4) +f4(4) = s4

s = ∑j fj(0) S = ∑j Fj(0) = s * g

15

slide-16
SLIDE 16

Proactive secret sharing

  • Given enough time, an attacker can gradually break into more than t servers
  • Not practical to change the secret
  • Solution: Proactive secret sharing.
  • We only focus on refreshing the shares

16

slide-17
SLIDE 17

Proactive secret sharing

  • Old stolen information become useless
  • Refreshing the shares makes the underlying polynomial change !

17

  • Why refreshing ?
slide-18
SLIDE 18

The idea

  • They execute again the DKG protocol:
  • distributions of the intermediate shares

18

  • Each node generates new intermediate random polynomials gi(x)
  • Let’s assume that the initial DKG round has been done
  • gi(x) = 0 + b1,ix + b2,ix2 +…+ bt-1,ixt-1
slide-19
SLIDE 19

Distributed Key Generation

1

2 3 4

g1(x) g3(x) g2(x) g4(x)

19

g1(1) g1(3) g1(2) g1(4) g2(2) g2(3) g2(1) g2(4)

slide-20
SLIDE 20

Proactive secret sharing

si = ∑j fj(i) for node i si’ = ∑j gj(i)

20

slide-21
SLIDE 21

Proactive secret sharing

si = ∑j fj(i) + si’ = ∑j gj(i) <— 2nd round DKG ri = ∑j hj(i)

21

slide-22
SLIDE 22

Proactive secret sharing

si = ∑j fj(i) + si’ = ∑j gj(i) ri = ∑j hj(i)

22

slide-23
SLIDE 23

Proactive secret sharing

si = ∑j fj(i) + si’ = ∑j gj(i) ri = ∑j hj(i) s = ∑j fj(0) + si’ = ∑j gj(0) s = ∑j hj(0) gi(x) = 0 + b1,ix + b2,ix2 +…+ bt-1,ixt-1

= 0

23

slide-24
SLIDE 24

Distributed Key Generation

1

2 3 4

s1 + ∑j gj(1) = r1 s2 + ∑j gj(2) = r2 s4 + ∑j gj(4) = r4 s3 + ∑j gj(3) = r3

24

slide-25
SLIDE 25

Distributed Key Generation

1

2 3 4

s1 + ∑j gj(1) = r1 s2 + ∑j gj(2) = r2 s4 + ∑j gj(4) = r4 s3 + ∑j gj(3) = r3

25

renewed share

slide-26
SLIDE 26

Proactive secret sharing

  • The attacker’s time is now restricted between the updating process
  • He need to break into servers at the same period

26

slide-27
SLIDE 27

Implementation

  • 2nd round of DKG for updating the shares:
  • Renew function adds 2 shares according to their indices:
  • check if G(0) = 0 ( = 0 * g)
  • check share1.index == share2.index

27

slide-28
SLIDE 28

Conclusion

  • enhances security of the protocol
  • much more interesting if periodicity is implemented

Future work

  • Implement the periodicity
  • Implement the share recovering process

28

Current work

  • Drand (distributed randomness beacon daemon) where
  • nodes collectively produces random values