Staircase Codes for Secret Sharing with Optimal Communication and Read Overheads

Transcription

1 Saircase Codes for Secre Sharing wih Opimal Communicaion and Read Overheads Rawad Biar, Salim El Rouayheb ECE Deparmen, IIT, Chicago Absrac We sudy he communicaion efficien secre sharing (CESS) problem A classical hreshold secre sharing scheme randomly encodes a secre ino n shares given o n paries, such ha any se of a leas, < n, paries can reconsruc he secre, and any se of a mos z, z <, colluding paries canno obain any informaion abou he secre A CESS scheme saisfies he previous properies of hreshold secre sharing In addiion, i has minimum communicaion and read coss when he user conacs d, d, shares The inuiion behind he possible savings on hese coss is ha he user is only ineresed in decoding he secre and does no have o decode he random keys involved in he encoding process In his paper, we inroduce wo explici consrucions of CESS codes called Saircase Codes The firs consrucion achieves opimal communicaion and read coss for a fixed d, d The second consrucion achieves opimal coss universally for all possible values of d, d n Boh consrucions can be designed over a field GF (q), for any prime power q > n I INTRODUCTION Consider he hreshold secre sharing (SS) problem ], 2] in which a dealer randomly encodes a secre ino n shares and disribue hem o n paries, such ha any se of a leas, < n, paries can reconsruc he secre, and any se of a mos z, z <, paries canno obain any informaion abou he secre For insance, le n = 4, = 2 and z = and le s be a secre uniformly disribued over GF (5) Then, he following 4 shares (s+k, s+2k, s+3k, s+4k ) form an SS scheme, wih k being a random symbol, called key, chosen uniformly a random from GF (5) and independenly of s A legiimae user can decode he secre by conacing any = 2 paries, downloading heir shares and invering he linear sysem Secrecy is ensured, in an informaion heoreic sense, because he secre is padded wih he key in each share Threshold secre sharing code consrucions have been exensively sudied in he lieraure, eg, ], 3] 7] The lieraure on secre sharing predominanly sudies non-hreshold secre sharing schemes, wih so-called general access srucures, eg, 8] ] and references wihin In his paper, we focus on he problem of communicaion (and read) efficien secre sharing (CESS) A CESS scheme saisfies he properies of hreshold secre sharing described in he previous paragraph In addiion, i has minimum communicaion and read overheads when he user conacs d, d, shares The communicaion overhead (CO) (respecively read overhead, RO) is defined as he exra amoun of informaion (beyond he secre size) ha Pary Pary 2 Pary 3 Pary 4 s + s 2 + k s + 2s 2 + 4k s + 3s 2 + 4k s + 4s 2 + k k + k 2 k + 2k 2 k + 3k 2 k + 4k 2 TABLE I THE STAIRCASE SECRET SHARING CODE FOR n = 4, = 2, z = AND d = 3 OVER GF (5) needs o be downloaded (respecively read) for a legiimae user conacing d paries o be able o decode he secre The CESS problem was inroduced by Wang and Wong in ] They focused on perfec CESS, where z =, and showed ha when d >, he user can download an amoun of informaion ha is less han shares and sill decode he secre Huang e al 2] sudied he CESS problem for all z < Before going ino more deails, we illusrae in Example how communicaion and read coss can be reduced The CESS code in his example belongs o he new family of Saircase codes which we inroduce in Secion III Example : Consider again he SS problem wih n = 4, = 2, z = We assume now ha he secre s is formed of 2 symbols s, s 2 over GF (5) and use wo keys k, k 2 drawn independenly and uniformly a random from GF (5) To consruc he Saircase code, he secre symbols and keys are arranged in a marix M as shown in () The marix M is muliplied by a 4 3 Vandermonde marix V o obain he marix C = V M The 4 rows of C form he 4 differen shares and give he Saircase code in Table I k 2 4 C = V M = s 2 k k () 4 M V The nomenclaure of Saircase codes comes from he posiion of he zero block marices in he general srucure of he marix M (see Table III) A legiimae user conacing any = 2 paries can decode he secre by downloading he wo conaced shares, ie, 4 symbols However, a user conacing d = 3 paries can decode he secre by downloading only 3 symbols, namely he firs symbol (in blue) of each conaced share The key idea here is ha he user is only ineresed in decoding he secre and no necessarily he keys When d = 3, he user decodes he secre and key k, whereas when d = = 2, he user has o decode he secre and boh of he keys This code acually /6/$3 26 IEEE 396

2 achieves he minimum CO and RO equal o symbol for d = 3 (and 2 symbols for d = = 2) given laer in (4) and (5) Secrecy is achieved because each z = pary canno obain any informaion abou s and s 2 Relaed work: Wang and Wong derived in ] a lower bound on CO for perfec CESS, where z = They consruced codes, using polynomial evaluaion over GF (q), where q > n + v and v = LCM{ +,, n}, which achieve minimum CO and RO universally for all d, d n Zhang e al 3] consruced CESS codes for he same parameers over GF (q), where q > n Recenly, Huang e al 2] generalized he lower bound on CO for any z, z < They consruced explici CESS codes for any z, z <, achieving he minimum CO and RO for d = n over GF (q), q > n(n z) Moreover, hey proved he achievabiliy of he lower bound on CO and RO universally for all possible values of d, d n using random linear code consrucions Conribuion: In his paper, we inroduce a new class of deerminisic linear CESS codes, called Saircase Codes, which generalizes he consrucion in Example We describe wo explici consrucions of Saircase codes The firs consrucion achieves minimum CO and RO for any given d The second is a universal consrucion ha achieves minimum CO and RO simulaneously for all possible values of d, d n Saircase codes require a small finie field GF (q) of size q > n, which is he same requiremen for Reed Solomon based SS codes 2 3] Organizaion: The paper is organized as follows In secion II, we formulae he problem and inroduce he noaion In secion III, we describe he Saircase code consrucion for fixed d Moreover, we give an example and prove ha his consrucion achieves minimum CO and RO (Theorem ) In secion IV, we give he consrucion for universal Saircase codes (Theorem 2) We conclude in secion V II SYSTEM MODEL We consider he CESS problem and follow he majoriy of he noaions in 2] A secre s of size k unis is formed of kα symbols ( uni = α symbols) The secre symbols are drawn independenly and uniformly a random from a finie alphabe, ypically a finie field A CESS code is a scheme ha randomly encodes he secre ino n shares w,, w n of uni size each, and disribue hem o n disinc paries A CESS code mus saisfy he following properies: ) Perfec secrecy: Any subse of z or less paries should no be able o obain any informaion abou he secre Le n] = {,, n}, and for any subse B n] denoe by W B he se of shares indexed by B, ie, W B = {w i ; i B} Then, he perfec secrecy condiion can be expressed as H(s W Z ) = H(s), Z n] s Z = z (2) Leas common muliple 2 However, he proposed consrucions require o divide he secre ino a cerain number of symbols α, which may no be necessary for SS codes 2) MDS: A user downloading any shares is able o recover he secre, ie, H(s W A ) =, A n] s A = (3) Equaions (2) and (3) imply ha he secre can be of a mos z unis (see 2, Proposiion ]) We will ake he secre o be of maximum size, ie, k = z unis 3) Minimum CO and RO: a user conacing any d paries, d n, is able o decode he secre by reading and downloading exacly k + CO(d) unis of informaion in oal from all he conaced shares, where CO(d) = kz d z (4) Here, H() denoes he enropy funcion Equaion (4) represens he achievable informaion heoreic lower bound 2, Theorem ] on he communicaion overhead, CO(d), needed o saisfy he consrains in (2) and (3), when he user conacs d shares Since he amoun of informaion read canno be less han he downloaded amoun, he following lower bound on RO holds, RO(d) CO(d) (5) We will refer o a CESS code described above as an (n, k, z, d) CESS code, where he hreshold is = k+z For insance, he code in Example is an (4,,, 3) CESS code We will also be ineresed in universal (n, k, z) CESS code ha achieves minimum CO(d) and RO(d) simulaneously for all possible values of d Noe ha he MDS consrain is subsumed by he minimum CO and RO consrain since i corresponds o he case of d = and CO() = z However, we will make his disincion for clariy of exposiion III STAIRCASE CODE CONSTRUCTION FOR FIXED d A Code consrucion Theorem : The (n, k, z, d) Saircase CESS code consrucion defined below over GF (q), q > n, saisfies he required MDS and perfec secrecy consrains given in (2) and (3), and achieves opimal communicaion and read overheads CO(d) and RO(d) given in (4) and (5) for any given d, d {k + z,, n} We describe he (n, k, z, d) Saircase code consrucion ha achieves opimal communicaion and read overheads CO(d) and RO(d) for any given d, k+z d n In his consrucion, we ake α = d z Hence, he secre s of size k unis is formed of k(d z) symbols s,, s kα, where s i GF (q) and q > n The symbols s i are arranged in an α k marix S The consrucion uses zα iid random keys drawn uniformly a random from GF (q) and independenly of he secre The keys are pariioned ino wo marices K and of dimensions z k and z (α k), respecively Le D be he ranspose S of he las (α k) rows of he marix K] 3 and le be he all zero square marix of dimensions (α k) (α k) Noe ha α k since d z + k The key ingredien of he 3 If α k z, ie, d 2z + k, hen D consiss of he ranspose of he las α k rows of K 397

3 consrucion is o arrange he secre and he keys in he d α marix M defined in Table II The inspiraion here is from he class of Produc Marix codes ha minimizes he repair bandwidh in disribued sorage sysems 4] D α S M = z K d α k α k k z α k TABLE II THE STRUCTURE OF THE MATRIX M THAT CONTAINS THE SECRET AND KEYS IN THE STAIRCASE CODE CONSTRUCTION FOR FIXED d Encoding: Le V be an n d Vandermonde marix over GF (q) The marix M is muliplied by V o obain he marix C = V M The n rows of C form he n differen shares, ie, w i = v i M, i =,, n, where v i is he i h row of V Decoding: A user conacing any = k + z paries downloads all he conaced shares A user conacing d paries, indexed by I n], downloads he firs k symbols ] from each conaced pary corresponding o v i S K, i I (he superscrip denoes he ranspose of a marix) Theorem guaranies ha he user will be able o decode he secre in boh cases B Example We give he deails of he consrucion of he (n, k, z, d) = (4,,, 3) CESS code of Example We ake α = d z = 2, hus he secre s is formed of kα = 2 symbols s, s 2 over GF (q), q = 5 > n = 4 The consrucion uses zα = 2 iid random keys k, k 2 drawn uniformly a random over GF (5) and independenly of he secre The keys are pariioned ino wo marices K and of dimensions z k = and z (α k) =, respecively The marix D is he ranspose of he las α k = row of K] Hence, we have, K = s D = k, = k 2, and S = The secre and he keys s 2 are arranged in an d α = 4 2 marix M Le V be an n d = 4 3 Vandermonde marix M and V are given again in (6) M = k s 2 k 2 and V = (6) k 4 The shares are he rows of he marix C = V M as given in Table I We wan o check ha his code saisfies he following properies ) Minimum CO and RO for d = 3: We check ha a user conacing d = 3 paries can reconsruc he secre wih minimum CO and RO For insance, if a user conacs he firs 3 paries and downloads he firs symbol of each conaced share, hen he downloaded daa is given by, 2 4 The marix on he lef is a 3 3 square s 2 k 3 4 Vandermonde marix, hence inverible Therefore, he user can decode he secre (and k ) This remains rue irrespecive of which 3 paries are conaced The user reads and downloads 3 symbols of size 3/α = 3/2 unis resuling in minimum overheads, CO(3) = RO(3) = 3/2 k = /2, as given in (4) and (5) 2) MDS: We check ha a user conacing = k + z = 2 paries can reconsruc he secre Suppose he user conacs paries and 2 and downloads all heir shares given ] by k s k 2 This sysem is equivalen o he k ] wo following sysems s and k ] ] k 2 k 2 The decoder uses he laer sysem o decode k and k 2 This is possible because he marix on he lef is a square Vandermonde marix, hence inverible Then, he decoder subracs he obained value of k from he former ] sysem ] s o obain again he following inverible sysem 2 s 2 The decoder hen decodes s and s 2 Again, his procedure is possible for any 2 conaced paries 3) Perfec secrecy: A a high level, perfec secrecy is achieved here because each symbol in a share is padded wih a leas one disinc key saisically independen of he secre, making he shares of any pary independen of he secre C Proof of Theorem Consider he (n, k, z, d) Saircase code defined above We prove Theorem by esablishing he following properies: ) Minimum CO(d) and RO(d): We prove ha a user conacing any d paries can reconsruc he secre while incurring minimum CO and RO A user conacing any d paries downloads he firs k symbols of each pary Le I n], I = d, be he se of indices of he conaced paries, hen he downloaded daa is given by V I S K ], where VI is a d d square Vandermonde marix formed of he rows of V indexed by I, hence inverible The user can always decode he secre (and he keys in K ) by invering V I The code is opimal on communicaion and read overheads CO(d) and RO(d), because he user only reads and downloads kd symbols of size kd/α = kd/(d z) unis resuling in an overhead of kd/α k = kz/α = kz/(d z) achieving he opimal CO(d) and RO(d) given in (4) and (5) 2) MDS propery: We prove ha a user conacing any = k + z paries and downloading all heir shares can reconsruc he secre Le I n], I =, be he se of indices of he conaced paries The informaion downloaded by he user is V I M and is given by V I S D K Firs, we show ha he user can decode he enries of D and The decoder considers he sysem V I D K2 ] ] = V I D K2 Recall ha he dimensions of he all zero sub-marix in D ] are (α k) (α k) Then, V I is a (k + z) (k + z) square Vandermonde marix formed by he firs (k + z) columns of V I Therefore, he user can always decode he enries of D and because V I is inverible Second, we prove ha he user can always decode he enries of S and hence reconsruc he 398

4 secre Recall ha D is he ranspose of he las α k rows of M ] S K By subracing he previously decoded ] enries of D from V I S K, he user obains V I M, where V I is defined above and M is a (k + z) k marix formed by he firs k + z rows of M Therefore, he user can always decode he enries of M because V I is inverible If k + z α, hen S is direcly obained since i is conained in M Oherwise, M consiss of he firs k + z rows of S The remaining rows of S are conained in D and were previously decoded In boh cases, he user can decode all he secre symbols s,, s kα 3) Perfec secrecy: We prove ha for any subse Z n], Z = z, he collecion of shares W Z indexed by Z does no reveal any informaion abou he secre as given in equaion (2), ie, H(s W z ) = H(s) To ha end, i suffices o prove ha H(K, W Z, s) = 5] Therefore, we need o show ha given he secre s as side informaion, any collecion W Z of z shares can decode all he random keys A collecion of W Z shares can be wrien as V Z S D K, where V Z is a z d marix corresponding o he rows of V indexed by Z This linear sysem can be divided ino wo sysems as follows, V Z S K ], (7) V Z D K2 ] (8) Given he secre as side informaion, ] i can be subraced from (7), which becomes V Z K = V Z K, where V Z is a z z square Vandermonde marix consising of he las z columns of V Z The enries of K can always be decoded because V Z is inverible Now ha K is decoded and we have S as side informaion, we can obain D as he las α k rows of ] S K Then, he enries of D are subraced from he second sysem o obain VZ, where VZ is a z z square Vandermonde marix consising of he (k + ) h o he (k +z) h columns of V Z Hence, he enries of can always be decoded because VZ is inverible Therefore, H(K, W Z, s) =, Z, Z n], Z = z and perfec secrecy is achieved IV UNIVERSAL STAIRCASE CODE CONSTRUCTION A Universal Code consrucion Theorem 2: The (n, k, z) Saircase CESS code consrucion defined below over GF (q), q > n, saisfies he required MDS and perfec secrecy consrains given in (2) and (3), and achieves opimal communicaion and read overheads CO(d) and RO(d) given in (4) and (5) simulaneously for all d, k + z d n The proof of Theorem 2 is omied and can be found in 5] We describe he (n, k, z) Saircase code consrucion menioned in Theorem 2, which achieves opimal communicaion and read overheads CO(d) and RO(d) simulaneously for all possible values of d, ie, k + z d n Le d = n, d 2 = n,, d h = k + z, wih h = n k z +, and α i = d i z, i =,, h Choose α = LCM(α, α 2,, α h ), ha is he leas common muliple of all he α i s excep for he las α h = k The secre s consiss of kα symbols s,, s kα over GF (q), q > n, arranged in an α kα/α marix S The consrucion uses zα iid random keys, drawn uniformly a random from GF (q) and independenly of he secre The keys are pariioned ino h marices K i, i =,, h, of respecive dimensions z kα/α i α i (ake α = ) The marix ] K K i consiss of he overhead of keys decoded by a user conacing d i paries We form h marices M i, i =,, h, as follows, M = S and M i = D α α i i n n K i z i, (9) z K n d i kα/α kα/α i α i where, D j is ] formed of he (n j + ) h row of M M 2 M j wrapped around o make a marix of dimensions α j+ kα/α j α j+ for j =,, h The s are he all zero marices used o complee he M i s o n rows The secre and he keys are arranged in he marix M = ] M M defined in Table III D D h 2 D K h M = S K 3 n α K saircase 2 K srucure M M 2 M 3 M h TABLE III THE STRUCTURE OF THE MATRIX M THAT CONTAINS THE SECRET AND KEYS IN THE UNIVERSAL STAIRCASE CODE CONSTRUCTION The marix M is characerized by a special srucure resuling from carefully choosing he enries of he D j s and placing he all zero sub-blocks in a saircase shape, giving hese codes heir name This saircase shape allows o achieve opimal communicaion and read overheads CO and RO for all possible d Encoding: The encoding is similar o he firs Saircase code consrucion The marix M is muliplied by an n n Vandermonde marix over GF (q) o obain he marix C = V M The n rows of C form he n differen shares Decoding: To reconsruc he secre, a user conacing any d j paries indexed by I n] downloads he firs kα/α j symbols from each conaced pary corresponding o v i M M j ], for all i I B Example of Universal Saircase code We describe here he consrucion of an (n, k, z) = (4,, ) universal Saircase code over GF (q), q = 5 > n = 4, by following he consrucion in Secion IV This example is explained in more deails in 5] We have d = 4, d 2 = 3, d 3 = 2 and α = 3, α 2 = 2, α 3 = and α = LCM(α, α 2 ) = LCM(3, 2) = 6 The secre s is formed of kα = 6 symbols over GF (5) The consrucion uses zα = 6 iid random keys drawn uniformly a random from GF (5) and independenly of he secre The secre symbols 399

5 and he random keys are arranged in he following marices, S = s 4 s 2 s 5, K = ] k k 2, K2 = ] k 3, and K3 = s 3 s ] 6 k4 k 5 k 6 To build he marix M which will be used for ] s s encoding he secre, we sar wih M = 2 s 3 k s 4 s 5 s 6 k 2 Then, D is he α 2 kα/α α 2 = 2 marix ha conains he symbols of he n h row of M, ie, D = ] k k 2 Therefore, M 2 = D ] = k k 2 k 3 ] Similarly, s 3 s 6 k 3 we have D 2 = ] s 3 s 6 k 3 and M3 = k 4 k 5 k 6 We obain M by concaenaing M, M 2 and M 3, M = s s 4 k s 3 s 6 k 3 s 2 s 5 k 2 k 4 k 5 k 6 s 3 s 6 k 3 k k 2 M M 2 M 3 () Here, V is he n n = 4 4 Vandermonde marix over GF (5) given in () The shares are given by he rows of he marix C = V M and shown in Table IV V = () 4 4 Pary Pary 2 s + s 2 + s 3 + k s + 2s 2 + 4s 3 + 3k s 4 + s 5 + s 6 + k 2 s 4 + 2s 5 + 4s 6 + 3k 2 k + k 2 + k 3 k + 2k 2 + 4k 3 s 3 + k 4 s 3 + 2k 4 s 6 + k 5 s 6 + 2k 5 k 3 + k 6 k 3 + 2k 6 Pary 3 Pary 4 s + 3s 2 + 4s 3 + 2k s + 4s 2 + s 3 + 4k s 4 + 3s 5 + 4s 6 + 2k 2 s 4 + 4s 5 + s 6 + 4k 2 k + 3k 2 + 4k 3 k + 4k 2 + k 3 s 3 + 3k 4 s 3 + 4k 4 s 6 + 3k 5 s 6 + 4k 5 k 3 + 3k 6 k 3 + 4k 6 TABLE IV AN EXAMPLE OF A UNIVERSAL STAIRCASE CODE FOR (n, k, z) = (4,, ) OVER GF (5) The decoding rules for each d follow he general rules described in he previous secion We check ha his code achieves minimum CO and RO simulaneously for d 2 = 3 and d = 4 Suppose a user conacs d 2 = 3 paries indexed by I n] The user reads and downloads he firs kα/α 2 = 3 symbols ] of each conaced share corresponding o V I M M 2 (in black and red), where VI is he marix formed by he rows of V indexed by I The user will be able o reconsruc he secre The resuling CO and RO are equal o 3/2 k = /2 unis achieving he opimal CO(d 2 ) and RO(d 2 ) given in (4) and (5) In he case when a user conacs d = 4 paries, he user reads and downloads he firs kα/α = 2 symbols of each conaced share corresponding o V I M (in black) The user can always decode he secre because V I here is a 4 4 square Vandermonde marix, hence inverible The resuling CO and RO are equal o /3 achieving he opimal CO(d ) and RO(d ) given in (4) and (5) V CONCLUSION We considered he communicaion efficien secre sharing (CESS) problem The goal is o minimize he communicaion and read overheads for a user ineresed in decoding he secre To ha end, we inroduced a new class of deerminisic linear CESS codes, called Saircase Codes We described wo explici consrucions of Saircase codes The firs consrucion achieves minimum overheads for any given number d of paries conaced by he user The second is a universal consrucion ha achieves minimum overheads simulaneously for all possible values of d The inroduced codes require a small finie field GF (q) of size q > n, which is he same requiremen for Reed Solomon based SS codes REFERENCES ] A Shamir, How o share a secre, Communicaions of he ACM, vol 22, no, pp 62 63, 979 2] G R Blakley, Safeguarding crypographic keys, in Proceedings of he Naional Compuer Conference, vol 48, pp 33 37, 979 3] R J McEliece and D V Sarwae, On sharing secres and Reed- Solomon codes, Communicaions of he ACM, vol 24, no 9, pp , 98 4] H-Y Chien, J Jinn-Ke, and Y-M Tseng, A pracical (, n) muli-secre sharing scheme, IEICE Transacions on Fundamenals of Elecronics, Communicaions and Compuer Sciences, vol 83, no 2, pp , 2 5] E D Karnin, J W Greene, and M E Hellman, On secre sharing sysems, IEEE Transacions on Informaion Theory, vol 29, no, pp 35 4, 983 6] C-P Lai and C Ding, Several generalizaions of Shamir s secre sharing scheme, Inernaional Journal of Foundaions of Compuer Science, vol 5, no 2, pp , 24 7] C-C Yang, T-Y Chang, and M-S Hwang, A (,n) muli-secre sharing scheme, Applied Mahemaics and Compuaion, vol 5, no 2, pp , 24 8] C Padró, Lecure noes in secre sharing, IACR Crypology eprin Archive, vol 22, p 674, 22 9] E F Brickell, Some ideal secre sharing schemes, in Advances in Crypology EUROCRYPT 89, pp , 99 ] R Cramer, I B Damgård, and J B Nielsen, Secure Mulipary Compuaion and Secre Sharing Cambridge, England: Cambridge Universiy Press, 25 ] H Wang and D S Wong, On secre reconsrucion in secre sharing schemes, IEEE Transacions on Informaion Theory, vol 54, pp , Jan 28 2] W Huang, M Langberg, J Kliewer, and J Bruck, Communicaion efficien secre sharing, arxiv preprin arxiv:55755, 25 3] Z Zhang, Y M Chee, S Ling, M Liu, and H Wang, Threshold changeable secre sharing schemes revisied, Theoreical Compuer Science, vol 48, pp 6 5, 22 4] K V Rashmi, N B Shah, and P V Kumar, Opimal exac-regeneraing codes for disribued sorage a he MSR and MBR poins via a producmarix consrucion, IEEE Transacions on Informaion Theory, vol 57, no 8, pp , 2 5] R Biar and S El Rouayheb, Saircase codes for secre sharing wih opimal communicaion and read overheads, arxiv preprin arxiv:52299, 25 4