Nearly optimal robust secret sharing
Mahdi Cheraghchi · Designs Codes and Cryptography · 2018
We prove that a known general approach to improve Shamir’s celebrated secret sharing scheme; i.e., adding an information-theoretic authentication tag to the secret, can make it robust for n parties against any collusion of size $$\delta n$$ , for any constant $$\delta \in (0, 1/2)$$ . Shamir’s original scheme is robust for all $$\delta \in (0,1/3)$$ . Beyond that, we employ the best known list decoding algorithms for Reed-Solomon codes and show that, with high probability, only the correct secret maintains the correct information-theoretic tag if an algebraic manipulation detection (AMD) code is used to tag secrets. This result holds in the so-called “non-rushing” model in which the n shares are submitted simultaneously for reconstruction. We thus obtain a fully explicit and robust secret sharing scheme in this model that is essentially optimal in all parameters including the share size which is $$k(1+o(1)) + O(\kappa )$$ , where k is the secret length and $$\kappa $$ is the security parameter. Like Shamir’s scheme, in this modified scheme any set of more than $$\delta n$$ honest parties can efficiently recover the secret. Using algebraic geometry codes instead of Reed-Solomon codes, the share length can be decreased to a constant (only depending on $$\delta $$ ) while the number of shares n can grow independently. In this case, when n is large enough, the scheme satisfies the “threshold” requirement in an approximate sense; i.e., any set of $$\delta n(1+\rho )$$ honest parties, for arbitrarily small $$\rho > 0$$ , can efficiently reconstruct the secret. From a practical perspective, the main importance of our result is in showing that existing systems employing Shamir-type secret sharing schemes can be made much more robust than previously thought with minimal change, essentially only involving the addition of a short and simple checksum to the original data.