Secret Sharing Schemes from a Class of Linear Codes over Finite Chain Ring

Transcription

1 Journal of Computational Information Systems 9: 7 (2013) Available at Secret Sharing Schemes from a Class of Linear Codes over Finite Chain Ring Jianzhang CHEN, Yuanyuan HUANG, Bo FU, Jianping LI School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu , China Abstract In general, every linear code can be used to construct a secret sharing scheme. However, determining the access structure of the secret sharing scheme based on a linear code is a very difficult problem. In this paper, we first construct a class of two-weight linear code over finite chain ring F q [u]/ u s. Then, we present an access structure of the secret sharing scheme based on the two-weight linear code. Keywords: Secret Sharing Scheme; Linear Codes; Finite Chain Ring; Access Structure 1 Introduction Secret sharing has been a subject of study for over twenty years. Originally it was motivated by the problem of sharing a secret digital key. Later it was applied to numerous fields, such as power control of nuclear weapons for military, sharing of secret keys in distributed computing, and access control to the values in banking world. In order to keep the secret efficiently and safely, Shamir [1] and Blakley [2] developed the concept of secret sharing scheme in Since secret sharing schemes play an important role in protecting secret information, they have been studied by several authors [3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13]. Messey used the linear codes for secret sharing and pointed out the relationship between the access structure and the minimal codewords of the dual code of the underlying code [3, 4]. However, determining the minimal codewords is extremely hard for general linear codes. This was done only for a small number of classes of special linear codes. Several authors have studied the minimal codewords for certain linear codes and characterized the access structures of secret sharing schemes based on their dual codes [3, 4, 5, 6, 7, 8, 9, 10, 11]. In recent years, after the relationship between binary codes and quaternary (Z 4 ) codes is established in [14] where some binary nonlinear codes are represented as images of linear quaternary codes via Gray map, the study of codes over finite chain rings has been an important issue in Project supported by the National Nature Science Foundation of China (No ), and the Fundamental Research Funds for the Central Universities (Program No. ZYGX2010J070). Corresponding author. address: chenyouqing66@gmail.com (Jianzhang CHEN) / Copyright 2013 Binary Information Press April 1, 2013

2 2778 J. Chen et al. /Journal of Computational Information Systems 9: 7 (2013) coding theory. The authors constructed some classes of two-weight linear codes over finite rings in [15, 16]. In this paper, we study a class of two-weight linear code defined over the chain ring R = F q [u]/ u s, which extends the results of paper [16]. Based on the two-weight linear codes, we present an access structure of the secret sharing scheme. The organization of this paper is as follows: in section 2, we state some definitions and some basic results of secret sharing schemes. In section 3, we study a class of two-weight linear code over finite chain ring R = F q [u]/ u s. In section 4, we study the construction of the access structure. 2 Some Preliminaries In this section, we review some basic results on secret sharing schemes from linear codes. For details we refer the interested reader to [1, 3, 6, 10]. Let F q be a finite field with q = p r elements, where p is a prime and r is a positive integer. The Hamming weight of a vector in F n q is the total number of nonzero coordinates. An [n, k, d] code C is linear subspace of F n q with dimensional k and minimum nonzero Hamming weight d. Let G = (g 0, g 1,, g n 1 ) be a generating matrix of an [n, k, d] code, i.e., the row vectors of G generate the linear subspace C. We always assume that no column vector of any generator matrix is the zero vector. The following secret sharing scheme based on linear codes was introduced in [3]. In the secret sharing scheme constructed from an [n, k, d] code C, the secret is an element of the finite field F q, and n 1 participants P 1,, P n 1 and a dealer P 0 are involved. The dealer is assumed to be a trusted party. To compute the shares with respect to a secret s, the dealer randomly takes an element u = (u 0, u 1,, u k 1 ) Fq k such that s = ug 0. There are altogether q k 1 such vectors u Fq k. Then the dealer treats u as an information vector and computes the corresponding codeword v = ug = (v 0, v 1,, v n 1 ), and the dealer gives the share v i to participant P i as share for each 1 i. Since s = v 0 = ug 0, then a set of shares {v i1,, v im } determines the secret s if and only if the column g 0 of the generating matrix G is a linear combination of the columns {g i1,, g im } of G. Hence we have the following lemma ([3]): Lemma 1 Let C be a [n, k, d]-linear code over the finite field F q and let C be its dual code. In the secret sharing scheme based on C, a subset of shares {v i1,, v im }, 1 i 1 i m n 1, 1 m n 1, determines the secret if and only if there is a codeword in C with c ij 0 for at least one j. (1, 0,, 0, c i1, 0,, c im, 0,, 0) If there is a codeword as in the above Lemma, then g 0 = a 1 g i1 + + a m g im, where a i F q for 1 i m. Hence the secret s can be recovered by computing s = a 1 v i1 + + a m v im. If a group of participants can recover the secret by combining their shares, then any group of participants containing this group can also recover the secret.

3 J. Chen et al. /Journal of Computational Information Systems 9: 7 (2013) Definition 1 A group of participants is said to be a minimal access set if they can recover the secret with their shares, any of its proper subgroups cannot recover the secret. Here a proper subgroup has fewer members than its group. In view of these facts, we are only interested in the set of all minimal access sets. In order to determine these minimal access sets, we need the concept of minimal codewords. Definition 2 The support of a codeword c = (c 0,, c n 1 ) F n q is defined as follows: supp(c) = {0 i n 1 : c i 0}. Let c 1 and c 2 be two codewords of the code C. We say that c 1 covers c 2 if supp(c 2 ) supp(c 1 ). Definition 3 A non-zero codeword c C is said to be minimal if the only codewords covers its scalar multiples. From Lemma 1 and the above definitions, it is clear that there is one-to-one correspondence between the set of minimal access sets and the set of minimal codewords of the dual code C. 3 A Class of Two-weight Linear Codes over Finite Chain Ring The ring R = F q [u]/ u s is a communicative chain ring of q s elements. The ring R is a commutative chain ring with maximal ideal u. Since u is nilpotent with nilpotent index s, we have R u u 2 u s = 0. Moreover R/ u = F q, and u i = q s i, i = 0, 1, 2,, s. The Hamming weight w of a codeword c is the number of nonzero components of the codeword c and is denoted by w(c). The Hamming distance between the codewords c and v is defined by d(c, v) = w(c v). We can describe the generator matrices of linear codes over finite chain ring R. A linear code C over ring R was a generator matrix that is permutation-equivalent to I k0 A 01 A 02 A 03 A 0,s 1 A 0,s 0 ui k1 ua 12 ua 13 ua 1,s 1 ua 1,s G = 0 0 u 2 I k2 u 2 A 23 u 2 A 2,s 1 u 2 A 2,s u s 1 I ks 1 u s 1 A s 1,s where A ij are matrices over R for i > 0. It contains q sk 0 q (s 1)k1 q k s 1 elments [17]. There are two codes were defined in ref. [18]. For 0 i s 1, T or i (C) = {v Fq n : u i v C}. In general, T or 0 (C) T or 1 (C) T or s 1 (C). Another code was called residue code, i.e., Res(C) = {v Fq n : k Fq n, v + uk C}. Now, we will construct the Macdonald codes over R by using the generator matrix of the simplex codes of type α and β over ring R, and give the Hamming distribution of the torsion of

4 2780 J. Chen et al. /Journal of Computational Information Systems 9: 7 (2013) MacDonald code. Without loss of generality, we can assume that F q = {0, 1, f 1, f 2,, f q 2 }, then F q [u]/ u s = F q +uf q + +u s 1 F q = {0, 1, f 1,, f q 2, u,, uf q 2,, f q 2 + +u s 1 f q 2 }. The simplex codes over F 2 + uf 2 of type α and β have been constructed in [19]. As similar to [19], a type α simplex code Sk α is a linear code over R constructed inductively by the following generator matrix. Let G α k be a k qsk (k 2) matrix over R = F q [u]/ u s defined inductively by G α k = ( u u fq u s 1 f q 2 f q u s 1 f q 2 G α k 1 G α k 1 G α k 1 G α k 1 ) where, G α 1 = [0, 1, f 1,, f q 2, u,, uf q 2,, f q u s 1 f q 2 ]. A type β simplex code S β k is a linear code over R = F q[u]/ u s constructed by omitting some columns from G α k. Let G β k be the k q(s 1)(k 1) (q k 1) G β 2 = matrix defined inductively by ( uf1 uf q 2 u 2 u(f q u s 1 f q 2 ) G α ) and for k > 2, G β k = ( uf1 uf 1 u(f q u s 1 f q 2 ) u(f q u s 1 f q 2 ) G α k 1 G β k 1 G β k 1 G β k 1 ) where G α k 1 is the generating matrix of Sα k 1 and Gβ k is obtained from Gα k by deleting q(s 1)(k 1) (q s+k 1 qk 1 ) columns. The binary MacDonald code over finite field F 2 and q-ary MacDonald code over the finite field F q were studied in [20, 21]. The q-ary MacDonald code is a linear code with parameter [ qk q t, k, qk 1 q t 1 ] and every nonzero codeword has weight either q k 1 or q k 1 q t 1 [22]. In ref. [16, 23, 24], authors defined the MacDonald codes over rings F 2 + uf 2, F 2 + uf 2 + u 2 F 2 and F q + uf q. Here, we define MacDonald code over finite chain ring R = F q [u]/ u s. We can obtain MacDonald codes over finite chain ring R by the method in ref. [19]. For 1 t k 1, let G α k,t = [Gα k \ 0 ] and G β G α k,t = [Gβ k \ 0 ], where [C\D] denotes the matrix obtained t G β t from the matrix C by deleting the matrix D and 0. It is clear that 0 are (k t) q st and (k t) q(s 1)(t 1) (q t 1) zero matrix respectively. The code C α k,t (Cβ k,t ) was generated by the matrix Gα k,t (Gβ k,t ) is the punctured code of Sα k (Sβ k ) and called a MacDonald code. Then, MacDonald codes are obtained by delating some columns of the generator matrices G α k (Gβ k ) of the simplex codes Sα k (Sβ k ). From the above discussion, we can see that the code C α k,t is a R-code of length n = qsk q st and C β k,t is a R-code of length n = q(s 1)(k 1) (q k 1) q(s 1)(t 1) (q t 1) and C T,β be the torsion code of C α k,t and Cβ k,t, respectively.. Throughout the paper, let C T,α Now, we can give the Hamming weight distribution of torsion codes C T,α and C T,β.

5 J. Chen et al. /Journal of Computational Information Systems 9: 7 (2013) Theorem 1 The torsion code C T,α is a linear code with parameter [q sk q st, k, q sk 1 q st 1 ]. The number of codewords with Hamming weight q sk 1 q st 1 is q k t (q t 1), the number of codewords with Hamming weight q sk 1 is q k t 1 and the number of zero-codeword is 1. Proof. Since the generator matrix of torsion code C T,α is obtained by replacing u s 1 by F q \{0} in the matrix u s 1 G α k,t. As similar to [24], we can prove the theorem by induction with respect to k and t. It is clear that the result holds for k = 2 and t = 1. Suppose the result holds for k 1 and 1 t k 2. Then for k and 1 t k 1 the matrix u s 1 G α k,t takes the form u s 1 G α k,t = [u s 1 G α 0 k \ u s 1 G α t ]. From the above discussion, we know that each nonzero codeword of u s 1 Ck,t α has Hamming weight either q sk 1 or q sk 1 q st 1, and the dimension of the torsion code C T,α is k. Hence, the number of codewords with Hamming weight q sk 1 q st 1 is q k q k t, and the number of codewords with Hamming weight q sk 1 is q k t 1. So the result follows. Theorem 2 The torsion code C T,β is a linear code with parameter [q (s 1)(k 1) (q k 1) q (s 1)(t 1) (q t 1), k, qsk s q st s ]. The number of codewords with Hamming weight q sk s q st s is q k t (q t 1), the number of codewords with Hamming weight q sk s is q k t 1 and the number of zero-codeword is 1. Proof. The proof is similar to Theorem 1 s. Now, we can get the following corollaries in ref. [16]. Corollary 1 The torsion code C T,α is a q-ary two-weight linear code with parameter [q 2k q 2t, k, q 2k 1 q 2t 1 ]. The number of codewords with Hamming weight q 2k 1 is q k t 1, and the number of codewords with Hamming weight q 2k 1 q 2t 1 is q k t (q t 1). Proof. We can get the result from the Theorem 1 directly. Corollary 2 The torsion code C T,β is a q-qry two-weight linear code with parameter [ 1 (qk 1 q t 1 )(q k + q t 1), k, q 2k 2 q 2t 2 ]. The number of codewords with Hamming weight q 2k 2 q 2t 2 is q k t (q t 1), and the number of codewords with Hamming weight q 2k 2 is q k t 1. Proof. We can get the result from the Theorem 2 directly. 4 The Access Structure In this section, we only consider the secret sharing schemes based on the dual codes of the given linear code. By invoking the following result in [9], it is shown that the minimal access sets of the secret sharing scheme based on C.

6 2782 J. Chen et al. /Journal of Computational Information Systems 9: 7 (2013) Lemma 2 Let C be an [n, k, d; q] code, and let G = [g 0, g 1,, g n 1 ] be its generator matrix. If each nonzero codeword of C is a minimal vector, then in the secret sharing scheme based on C, there are altogether q k 1 minimal access sets. In addition, we have the following: (1) If g i is a multiple of g 0, 1 i n 1, then participant P i must be in every minimal access set. Such a participant is called a dictatorial participant. (2) If g i is not a multiple of g 0, 1 i n 1, then participant P i must be in (q 1)q k 2 out of q k 1 minimal access sets. By recalling the following result of Ashikhmin and Barg ( [5], see also [6]), it is shown that all nonzero codewords of linear code are minimal. Lemma 3 Let C be a [n, k, d] linear code over the finite field F q. minimum and maximum non-zero weights of C, respectively. If w min > q 1, w max q then all nonzero codewords of C are minimal. Let w min and w max be the Theorem 3 Let C T,α be the torsion code of Ck,t α, then in the secret sharing scheme based on CT,α, there are altogether qk 1 minimal access sets and q sk q st 1 participants. Moreover, each participant P i involved must be (q 1)q k 2 out of q k 1 minimal access sets. Proof. Since the torsion code C T,α is a two-weight linear code with parameter [q sk q st, k, q sk 1 q st 1 ] from Theorem 1. Let w min and w max are the minimum and maximum non-zero weights of the torsion code C T,α. It is clear that w min = qsk 1 q st 1 > q 1 w max q sk 1 q for all 1 t k 1 by Theorem 1. Hence we can obtain that all nonzero codewords of torsion code C T,α are minimal by Lemma 3. Since the MacDonald codes are obtained by deleting some columns of the generator matrices G α k from the definition of MacDonald code, and the torsion code C T,α is the set of codewords obtained by replacing u s 1 by F q \ {0} in the matrix u s 1 G α k,t. Then, it is not difficult to know that there don t exist two columns of the torsion code C T,α are multiple of each other. Hence, we can get the result by Lemma 2. Theorem 4 Let code C T,β be the torsion code of C β k,t, then in the secret sharing scheme based on CT,β, there are altogether qk 1 minimal access sets and q (s 1)(k 1) (q k 1) q (s 1)(t 1) (q t 1) 1 participants. Moreover, each participant P i involved must be (q 1)q k 2 out of q k 1 minimal access sets. Proof. The proof is similar to Theorem 3 s. Here, we can obtain the following results in ref. [16]. Corollary 3 Let code C T,α be the torsion code of C α k,t. In the secret sharing scheme based on C T,α, there are altogether qk 1 minimal access sets and q 2k q 2t 1 participants. Furthermore, each participant P i is involved in exactly (q 1)q k 2 out of q k 1 minimal access sets.

7 J. Chen et al. /Journal of Computational Information Systems 9: 7 (2013) Proof. We can get the result form Theorem 3 directly. Corollary 4 Let code C T,β be the torsion code of C β k,t. In the secret sharing scheme based on CT,β, there are altogether qk 1 minimal access sets and 1 (qk 1 q t 1 )(q k +q t 1) 1 participants. Furthermore, each participant P i is involved in exactly (q 1)q k 2 out of q k 1 minimal access sets. Proof. We can get the result from the Theorem 4 directly. 5 Conclusions In this paper, we study the construction of access structure from linear codes over finite chain ring F q [u]/ u s. When s = 2, we can obtain the results of paper [16]. The access structure can be constructed for arbitrary integer s, which is more applicable than that constructed in paper [16]. Of course, another direction and interesting research in this topic is the construction of access structure from linear codes over other rings. References [1] A. Shamir, How to share a secret, Commmun. Assoc. Comp. Mach., 1979, 22: [2] G. R. Blakley, Safeguarding ctrpotographic keys, American Federation of Information Processing Societies: National Coputer Conference, 1979: [3] J. L. Massey, Minimal codewords and secret sharing, in Procc. 6th Joint Swedish-Russian Workshop on Information Theory, Mölle, Sweden, Aug., 1993: [4] J. L. Massey, Some applications of coding theory in cryptography, codes and ciphers: Cryptography and Coding IV, Formara Ltd, Esses, Engalnd, 1995: [5] A. Ashikhmin, A. Barg, G. Cohen and L. Huguet, Variations on minimal codewords in linear codes, Proc. AAECC, Springer, Heidelberg, 1995: [6] A. Ashikhmin and A. Barg, Minimal vectors in linear codes, IEEE Trans. Inform. Theory, 1998, 44 (5): [7] C. Ding, D. Kohel and S. Ling, Secret sharing with a class of ternary codes, Theor. Comput. Sci., 20002, 46: [8] C. Ding and A. Salomaa, Secret sharing schemes with nice access structures, Fundamenta Informaticae, 2006, 71: [9] C. Ding and J. Yuan, Covering and secret sharing with linear codes, Discrete Mathematics and Theoretical Computer Science, Lecture Notes in Computer Science, 2003, 2731: [10] J. Yuan and C. Ding, Secret sharing schemes from three classes of linear codes, IEEE Trans. Inform. Theory, 2006, 52 (1): [11] Y. Borissov, N. Nanev and S. Nikova, On the non-minimal codewords in binary Reed-Muller codes, Discrete Math., 2003, 128: [12] Y. Liu, Y. Zhang, and Y. Hu, Efficient (t, n) secret sharing scheme against cheating, Journal of computational information systems, 2012, 8 (9): [13] Z.H.Li,T.Xue, and H.Lai, Secret sharing schemes from binary linear codes, Information Sciences, 2010,180,

8 2784 J. Chen et al. /Journal of Computational Information Systems 9: 7 (2013) [14] A. R. Hammons, Jr., P. V. Kumar, A. R. Calderbank, N. J. A. Sloane, and P. Solé, The Z 4 -linearity of Kerdock, Preparata, Goethals, and related codes, IEEE Trans. Inform. Theory, 1994, 40: [15] H. Tapia-Recillas, A secret sharing scheme from a chain ring linear code, Congr. Numerantium, 2007, 186: [16] J. Qian and W. Ma, Secret Sharing Schemes from Linear Codes over Finite Rings, IEICE Transactions, 2012, 95 (7): [17] G. H. Norton and A. Sălăgean, On the structure of linear and cyclic codes over a finite chain ring, AAECC, 2000, 10: [18] M. Han, Y. Ye, S. Zhu, C. Xu and B. Dou, Cylic coddes over R = F p + uf p + + u k 1 F p with length p s n, Information Sciences, 2011, 181: [19] M. AL-Ashker, Simplex codes over the ring F 2 + uf 2, The Arabian Journal for Science and Engineering, 2005, 30: [20] J. E. MacDonald, Design methods for maximum-distance error-correcting codes, IBM. J. Res. Develop. 1960, 4: [21] A. M. Patel, Maximual q-ary codes with large minimum distance, IEEE Trans. Inform. Theory, 1975, 21: [22] S. Dodunekov and J. Simonis, Codes and projectives multisets, The Electronic Journal of Combinatorics, 1998, 37 (5): [23] M. AL-Ashker, MacDonald codes over the ring F 2 + uf 2, Journal of the Islamic University of Gaza, 2005, 2: [24] M. AL-Ashker, MacDonald codes over ring F 2 + uf 2 + u 2 F 2, Journal of the Islamic University, Series of Natural Studies and Egineering, 2010, 18 (2): 1 9.