Proactive Secret Sharing with a Dishonest Majority Shlomi Dolev*, - - PowerPoint PPT Presentation

▶
proactive secret sharing with a dishonest majority
SMART_READER_LITE
LIVE PREVIEW

Proactive Secret Sharing with a Dishonest Majority Shlomi Dolev*, - - PowerPoint PPT Presentation

Aug 27, 2022 346 likes •571 views

Proactive Secret Sharing with a Dishonest Majority Shlomi Dolev*, Karim ElDefrawy**, Joshua Lampkins**, Rafail Ostrovsky***, Moti Yung**** * Ben-Gurion University ** Hughes Research Labs (HRL) *** University of California Los Angeles (UCLA)

slide-1
SLIDE 1

1

10th Conference on Security and Cryptography for Networks (SCN’16)

Proactive Secret Sharing with a Dishonest Majority

Shlomi Dolev*, Karim ElDefrawy**, Joshua Lampkins**, Rafail Ostrovsky***, Moti Yung****

* Ben-Gurion University ** Hughes Research Labs (HRL) *** University of California Los Angeles (UCLA) **** Snapchat and Columbia University

slide-2
SLIDE 2

2

10th Conference on Security and Cryptography for Networks (SCN’16)

Secret Sharing (1/2)

  • A t out of n secret sharing scheme shares a secret among n parties.
  • Any t + 1 parties can combine their shares to reconstruct the secret.
  • With only t of the n shares one does not learn any information about

the secret.

  • Invented independently by Blakely and Shamir (1979).

Secret Share #1 Secret Share #2 Secret Share #3 Secret Share #4

slide-3
SLIDE 3

3

10th Conference on Security and Cryptography for Networks (SCN’16)

p(x) = 0.5 - 0.7x + 0.1x2

secret1 share of server 2 share of server 1 share of server 3

Secret Sharing (2/2)

  • Shamir’s Technique: store secret in constant

term of degree t polynomial to tolerate up to t leaked shares (called t + 1 out of n)

  • Secret Sharing Involves Two Algorithms:

i.

Share: for secret s, pick random coefficients a1 … at & set a0 = s and p(x) = a0 + a1 x + a2 x2 + … at xt distribute shares as p(1), p(2) … f(n) to the n parties

ii.

Open/Reconstruct: from p(1), p(2) … p(t+1) interpolate p(x) and recover secret as p(0)= a0 = s

slide-4
SLIDE 4

4

10th Conference on Security and Cryptography for Networks (SCN’16)

Mobile Adversaries

Server 1 Server 2 Server 3 Server 4 Server 5 Server 6 Server 7 Server 5 Server 4 Server 3 Server 1 Server 6 Server 7 Server 2

Over time, a mobile adversary compromises more than t servers & recovers the secret!

Shares Collected by Adversary

Share of Server 2 Share of Server 7 Share of Server 4 Share of Server 5 Share of Server 3 Share of Server 1 Share of Server 6

slide-5
SLIDE 5

5

10th Conference on Security and Cryptography for Networks (SCN’16)

Proactive Security

Server 1 Server 2 Server 3 Server 4 Server 5 Server 6 Server 7 Server 5 Server 4 Server 3 Server 1 Server 6 Server 7 Server 2 Server 2 Server 7 Server 4 Server 5 share 1 share 2 share 4 share 5 share 6 share 7 share 3

Shares Collected by Adversary

share 2 – Epoch 1 share 7 – Epoch 1 share 1 share 2 share 3 share 4 share 5 share 6 share 7 share 4 – Epoch 2 share 5 – Epoch 2 share 1 share 2 share 3 share 4 share 5 share 6 share 7 share 3 – Epoch 3 share 1 – Epoch 3 share 6 – Epoch 4 share 1 share 2 share 3 share 4 share 5 share 6 share 7 share 4 share 5 share 6 share 7 share 1 share 2 share 3

A mobile adversary eventually compromises everyone, but not at the same time! Proactively refresh/rerandomize shares on servers, and randomly reboot servers to a pristine state and recover their shares.

Shares with different colors are from different time epochs and can NOT be combined.

slide-6
SLIDE 6

6

10th Conference on Security and Cryptography for Networks (SCN’16)

Relevance of Proactive Security Model

  • Proactively secure protocols for various

cryptographic primitives were developed since 90s:

– Proactive secure multi-party computation [OY91, BELO14,

BELO15].

– Proactive encryption/signature schemes [FGMY97a,

FGMY97b, Rab98, CGJ+99, FMY01, Bol03, JS05, JO08, ADN06].

– Proactive secret sharing [WWW02, ZSvR05, CKLS02, Sch07,

HJKY95, DELOY16].

slide-7
SLIDE 7

7

10th Conference on Security and Cryptography for Networks (SCN’16)

Mixed Adversaries Model

  • Threshold of corruptions is defined by (𝑩∗ , 𝑸∗ ):

– Set of Passive Corruptions (𝑸∗ ): semi-honest, follows protocols but

tries to violate privacy

– Set of Active Corruptions (𝑩∗ ): fully malicious, can deviate arbitrarily

from protocols

  • Each active corruption is also a passive corruption (𝑩∗ ⊑ 𝑸∗ )
  • Multi-threshold:

– Correctness (𝑼𝒅 ): threshold for which correctness is ensured – Secrecy (𝑼𝒕): threshold for which secrecy is ensured – Robustness (𝑼𝒔 ): threshold for which robustness is ensured

slide-8
SLIDE 8

8

10th Conference on Security and Cryptography for Networks (SCN’16)

Our Result

[DELOY16] Proactive Secret Sharing (PSS) where t could be > n/2, when k = 0 (i.e., passive corruptions only) t < n – r, r = 1 if nodes will be reset serially.

Paper Network Model Dynamic Groups Security Threshold Communication (amortized)

[WWW02] Synch. No Crypto. t/n < 1/2 exp(n) [ZSvR05] Asynch. No Crypto t/n < 1/3 exp(n) [CKLS02] Asynch. No Crypto t/n < 1/3 O(n4) [Sch07] Asynch. Yes Crypto t/n < 1/3 O(n4) [OY91] Synch. No Statistical t/n < 1/3 O(n3) [HJKY95] Synch. No Crypto t/n < 1/2 O(n2) [BELO14] Synch. No Perfect / Statistical t/n < 1/3-ε / t/n < 1/2-ε O(1) [BELO15] Synch. Yes Perfect / Statistical t/n < 1/3-ε / t/n < 1/2-ε O(1) [DELOY16] Synch. No Crypto (homomorphic commitments) t < n – r (passive only) t < n/2 – r (active) t < n – k – r (mixed adversaries)

t = total corruptions k = active corruptions r = number of nodes reset in parallel

O(n4)

slide-9
SLIDE 9

9

10th Conference on Security and Cryptography for Networks (SCN’16)

Background: Gradual Secret Sharing

  • First introduced in [HML13] for mixed adversaries (a mix of passive

and active corruptions)

  • Secure against a dishonest majority with identifiable aborts
  • Share: A d-gradual secret sharing of a secret s does the following:

– Split s into d random summands, 𝑡 = ∑

𝑡/

/12

– Share each 𝑡/ with a random polynomial of degree i

  • Reconstruct: to recover s shared with a d-gradual secret sharing:

– Reconstruct the d polynomials in decreasing order (from d down to 1) – For polynomial i if less than i+1 parties are honest abort and identify

misbehaving parties

slide-10
SLIDE 10

10

10th Conference on Security and Cryptography for Networks (SCN’16)

Single vs. Gradual Secret Sharing

Linear Sharing [Sha79] Gradual Sharing [HML13]

  • Secret is stored as a free term in a

polynomial of degree t

  • Confidentiality lost if t+1 parties

compromised, typically t < n/2

  • Robust
  • Confidentiality is not lost as long as at most

d < n parties are compromised

  • Non-robust with active adversaries

shared secret (s) share1 share2 shared summand S2 shared summand S1 share1 for S2 share2 for S2 share1 for S1 share2 for S1

slide-11
SLIDE 11

11

10th Conference on Security and Cryptography for Networks (SCN’16)

PSS Blueprint for Dishonest Majority

  • Use Gradual Secret Sharing with a maximum degree less than

d = n – r where r is the number of parties that can be rebooted in parallel.

  • Proactivizing Gradual Secret Sharing by developing two protocols

with same security guarantees against mixed adversaries and dishonest majority:

  • 1. Refresh: distributed rerandomization of shares
  • 2. Recovery: distributed recovery of shares (for rebooted nodes)
slide-12
SLIDE 12

12

10th Conference on Security and Cryptography for Networks (SCN’16)

Refreshing Shares of a Summand (1/3)

slide-13
SLIDE 13

13

10th Conference on Security and Cryptography for Networks (SCN’16)

Refreshing Shares of a Summand (2/3)

slide-14
SLIDE 14

14

10th Conference on Security and Cryptography for Networks (SCN’16)

Refreshing Shares of a Summand (3/3)

slide-15
SLIDE 15

15

10th Conference on Security and Cryptography for Networks (SCN’16)

Recovering Shares of a Summand (1/3)

slide-16
SLIDE 16

16

10th Conference on Security and Cryptography for Networks (SCN’16)

Recovering Shares of a Summand (2/3)

slide-17
SLIDE 17

17

10th Conference on Security and Cryptography for Networks (SCN’16)

Recovering Shares of a Summand (3/3)

slide-18
SLIDE 18

18

10th Conference on Security and Cryptography for Networks (SCN’16)

Main Theorem

  • For r = 1 (rebooting nodes in series) we get the highest thresholds.

Theorem:

  • Given a gradual secret sharing parameter 𝑒 < 𝑜 − k − 1 there exists a

computationally secure (Ts,Tr,Tc)-secure PSS scheme, utilizing a computationally secure homomorphic commitment scheme, for mixed adversaries characterized by (A∗,P∗) where A∗ ⊆ P∗.

  • The PSS scheme ensures secrecy if |P∗| ≤ d, is robust against |A∗| ≤ k if

d < n−k−1 and |P∗| ≤ d, and is correct with agreement on aborts if |P∗| ≤ d ∧ |P∗|+|A∗| ≤ n−2.

slide-19
SLIDE 19

19

10th Conference on Security and Cryptography for Networks (SCN’16)

Proof Sketches

  • Since this is only a SS, prove correctness and security as

properties of the SS scheme

  • Can be formalized to provide full simulator showing that view in real

world ~ view ideal world

  • Secrecy: straightforward because of degree of polynomial
  • Robustness: given a polynomial with degree less than n – r, have r

redundant points so can reconstruct without them

  • Correctness (with agreement on aborts): prove by contradiction by

breaking correctness

  • f

PSS scheme to security

  • f

underlying commitment scheme

slide-20
SLIDE 20

20

10th Conference on Security and Cryptography for Networks (SCN’16)

Future Work

  • Efficient Communication: can communication be reduced to O(n) or

even O(1)?

  • Other Blueprints: Using a single polynomial with degree n – r – 1 and

ZK proofs (constant size) can probably shave a factor n from communication.

  • Dynamic Groups: extend the new PSS to dynamic groups with

dishonest majority.

  • (In Progress) Extend to Proactive Secure Multiparty Computation:

perform computation with proactive refresh with similar thresholds, i.e., with a dishonest majority. Currently all proactive MPC protocols are for honest majority (t < n/2).

slide-21
SLIDE 21

21

10th Conference on Security and Cryptography for Networks (SCN’16)

Questions?