Quick viewing(Text Mode)

Verifiable Multi-Secret Sharing Schemes Based on XTR

Verifiable Multi-Secret Sharing Schemes Based on XTR

arXiv:2011.08648v1 [cs.CR] 17 Nov 2020 • • I eu ierrcrin 1]t nraeteefiinyof efficiency respectively. the phase, increase reconstruction to nonhomoge- and construction [14] and the recursions homogeneous DM2 linear and the [12] neous employ (DM1 schemes which VMSS [13]), efficient of types new schem distrib sharing secret to Shamir’s interpolation [8], [1]. to Lagrange similar schemes are use which these still secrets, [11] all [10], However, verifiable [9], efficient. their make more to time first property and the Dehkordi for schemes 2007, [20] VMSS in into public Then, RSA introduced does channel. [11] scheme security Mashhadi this a that need so [10] choose themselves not (ZZZ) participants by al. where shadows own et scheme, their VMSS Zhao [9] new 2006, Cao a In and proposed channel. still Shao private scheme 2005, a this in However, requires scheme, scheme. improved this an on presented Based [8]. al. et and [7] on. blockchain [6], [5], computation [4], multiparty scheme secure commitment [3], cryptography, threshold modern as such of applications many in components aucitrcie pi 9 05 eie uut1,2015 Yang.) 16, Jing August revised author: 2015; 19, April received Manuscript L OF JOURNAL I 1 r infiatt rtc ertky,wihaecritical are which keys, secret protect to significant are T -al [email protected] E-mail: China. Technol LP 300071, Security Tianjin, Data and University, and Mathematics Network of of Institute Laboratory Chern Key Tianjin the with is Fu Fang-Wei LPMC [email protected] and E-mail: Mathematics China. Technol 300071, Security of Tianjin, Data Institute University, and Network Chern of Laboratory the Key Tianjin with is Yang Jing ute,i 08 ekriadMshd rsne two presented Mashhadi and Dehkordi 2008, in Further, Yang by proposed was scheme VMSS efficient an 2004, In Abstract ulckysse,adcnrealize pha can verification and the system, in key check public de validity cannot adding 2008 by in schemes Mashhadi VMSS and Dehkordi by presented schemes simultaneously secrets multiple share which sufficiently, rpsdmn mrvmn cee.Aogalteeschemes these all Among schemes. improvement many proposed a civ h aescrt ee ihsotrparameters shorter with fe level linear security and same RSA the using achieve schemes can VMSS the with Compared prime. yaim hehl changeable. threshold dynamism, ne Terms Index changed. our be implement to to needs efficient threshold is the it Cryptogr that Curve means Elliptic which on changeable, based schemes those than operate NTRODUCTION swl-nw htsce hrn cee 1,[2] [1], schemes sharing secret that well-known is New cee ae nXRpbi e system key public XTR on based schemes A T Sce hrn a rpsdpiaiyi 99t ov h p the solve to 1979 in primarily proposed was sharing —Secret E LS IE,VL 4 O ,AGS 2015 AUGUST 8, NO. 14, VOL. FILES, CLASS X Vrfibemlisce hrn,XRpbi e ytm tr system, key public XTR sharing, multi-secret —Verifiable ( ,l m l, k, GF ( ) p 6 vrfibemlisce sharing multi-secret -verifiable ) euiyb opttosin computations by security igYn n agWiFu Fang-Wei and Yang Jing (Corresponding . g,Nankai ogy, Nankai ogy, n eciemlcosdae swl spriiat.B po By participants. as well as dealer malicious perceive and C and MC, yuigtaefnto.Wa’ oe u cee r uhsi much are schemes our more, What’s function. trace using by and , cee codn oteata iuto hnparticipant when situation actual the to according schemes (C) nadto,orshmsaednmcadthresho and dynamic are schemes our addition, In (ECC). aphy ute et vroeti rwak u e cee r ae nXTR on based are schemes new Our drawback. this overcome to se so In e etsm iiu eair ftedae,w rps w new two propose we dealer, the of behaviors vicious some tect h eial ut-ertsaig(MS cee r stu are schemes (VMSS) sharing multi-secret verifiable the , ✦ daksitrgse LS)pbi e rpoytm,our , key public (LFSR) register shift edback T ulckysse a elz h euiylvlin level security the realize can system fact, GF In key cost. storage public communication the and reduce XTR [22], cost to system function computation trace data, key of of public use XTR full by make which schemes DM2 improve to to LZZ of level. length also security key same but public the dealer, and achieve private the the and of participants one-third LFSR use perceive both using only of not by deception can same schemes the schemes YF DM3 the cryptosystem. on key have based public [16] [21] modified (YF) proposed DM3 have schemes We and [19]. in mentioned [13] cryptosys- as key drawback DM2 public Similarly, RSA by tem. schemes new behaviors hostile presented dealer’s and some detect cannot schemes DM1 key public and private shorter have length. schemes 2015, recursions their in linear make key Then, to public nonhomogeneous data. LFSR new used the and [16] of cryptosystem (DM3) [15] validity Mashhadi (HLC) the and verify al. Dehkordi cryptosystem to key et public [18] Hu LFSR [17], time, and sequence operating LFSR the utilized reduce to order ,w eiwtennooeeu ierrcrin XTR recursion, linear nonhomogeneous the review we 2, be will which proposed properties our good of later. discussed many Therefore, optimization have the . schemes of cryptosystem VMSS case key special system public a key LFSR as public considered XTR be Further, can and ECC. same parameter than the of generation procedure achieve simpler key to has and cryptosystems level, than public security length key LFSR shorter and and needs RSA system cryptosystems key key public public XTR ECC, LFSR RSA, with Compared GF c ucin hre e aaees atkygeneration, key fast parameters, key shorter function, ace olmo e itiuin nrcn eae,researchers decades, recent In distribution. key of roblem nti ok epooetonvlVS schemes VMSS novel two propose we work, this In and ZZZ that found [19] (LZZ) al. et Liu Nevertheless, h eto hsppri raie sflos nSection In follows. as organized is paper this of rest The ( p ( 6 p ) 2 ) ycmuain in computations by ihu xlctcntutosof constructions explicit without GF ( p GF 2 ) where ( nigotta the that out inting p 6 ) where , ,scesor secrets s, pe to mpler p ld schemes died saprime. a is p sa is have 1 JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 2

public key system, and give the review and attack on DM2 where c,c0,c1, ··· ,ck−1 are constants in GF (). Therefore, i k+1 schemes. In Sections 3 and 4, we propose our two new VMSS ui = p(i)(−1) , where p(i) = A0 + A1i + ··· + Ak+1i schemes respectively. We the security analysis in and A0, A1, ··· , Ak+1 are in GF (q). Section 5, and in Section 6 we give the performance analysis. Theorem 2. Let GF (q) be a finite field, where q is a Finally, we conclude our schemes in Section 7. prime. Assume that the sequence (ui)i≥0 is defined by the following NLR equations:

2 PRELIMINARIES u0 = c0,u1 = c1, ··· ,uk−1 = ck−1, k 2.1 Nonhomogeneous linear recursion [NLR2] =  k (2) (−1)j u = ci (i ≥ 0), In this subsection, we firstly introduce the linear recurring  j i+k−j  j sequence [14]. X=0    Definition 1. Let k be a positive , and where c,c0,c1, ··· ,ck−1 are constants in GF (q). Therefore, k+1 c,a1,a2, ··· ,ak be given elements of a finite field GF (q) ui = p(i), where p(i) = A0 + A1i + ··· + Ak+1i , and where q is a prime. If {ui}i≥0 satisfies the relation A0, A1, ··· , Ak+1 are in GF (q).

ui+k = akui+k−1 + ··· + a1ui + c (i =0, 1, ··· ) (∗), 2.2 The XTR public key system then {ui}i≥0 is called a kth-order linear recurring sequence in GF (q). In 2000, Lenstra and Verheul proposed the XTR public key system [22], utilizing the third-order LFSR sequence. Remark 1. Note that the terms u0,u1, ··· ,uk−1, which can determine the rest of the sequence uniquely, are referred Actually, XTR public key system belongs to LFSR sequence to as the initial values of the sequence. A relation of the form public key system [17], [18], [22]. (∗) is called a kth-order linear recurrence relation. If c=0, we Firstly, in 1999, Gong and Harn proposed LFSR public call (∗) a homogeneous linear recursion. Otherwise, (∗) is a key cryptosystem [17], [18], i.e., GH public key system, which is based on a third-order LFSR sequence generated nonhomogeneous linear recursion (NLR). 3 2 k by an irreducible polynomial f(x) = x − ax + bx − 1, For a kth-order linear recurring sequence {ui}i≥0, x + k−1 where a,b ∈ GF (p) and p is a prime. a1x + ··· + ak = 0 is called its auxiliary equation, and ∞ i Compared with LFSR public key cryptosystem, XTR U(x)=Σ uix is called its generating function. i=0 public key system requires b = ap where a ∈ GF (p2), anda Lemma 1. Let GF (q) be a finite field, where q is a prime. 6 ∗ 2 m1 m2 m q GF (p ) q|(p − p + 1) Suppose that (x − α ) (x − α ) ··· (x − α ) l =0 is the special with order in where 1 2 l q > auxiliary equation of a kth-order linear recurring sequence and 3. In other words, the irreducible polynomial used in XTR public key system is f(x) = x3 − ax2 + apx − 1, {ui}i≥0 in GF (q), where m1 + m2 + ··· + ml = k. Then the where a ∈ GF (p2). Actually, XTR is the first method which generating function of {ui}i≥0 is utilizes computations on GF (p2) to achieve GF (p6) security R(x) GF (p6) U(x)= , without requiring explicit construction of . m1 m2 m (1 − α1x) (1 − α2x) ··· (1 − αlx) l Then we review some basic knowledge about the XTR public key system, which can be found in [22], [23]. where R(x) is a polynomial of x with deg(R(x)) < k in Definition 2. Let p > 3 and q > 3 be two primes, GF (q)[X]. 2 i i i satisfying p ≡ 2 (mod 3), and q|(p − p + 1). Let g be an Further, ui = p1(i)α1 + p2(i)α2 + ··· + pl(i)αl , where 6 ∗ 6 ∗ 2 mj−1 element with order q in GF (p ) , where GF (p ) is the pj (i)= A + A i + A i + ··· + Am −1 i , j =1, 2, ··· ,l. 0 1 2 j multiplicative group of the finite field GF (p6). Then, we Notice that A , A , ··· , Am −1 are undetermined constants 0 1 j refer to the subgroup as the XTR group. in GF (q) which can be calculated from a ,a , ··· ,ak. 1 2 Definition 3. The conjugates of g ∈ GF (p6)∗ over GF q q 2 4 Corollary 1. Let ( ) be a finite field, where is a 2 p p R(x) GF (p ) are g,g and g . Then the trace function T r(g) 6 ∗ 2 prime. Consider a typical fraction m , where α ∈ of g ∈ GF (p ) over GF (p ) is the sum of the conjugates of (1 − αx) 2 GF (q), and R(x) is a polynomial of x with deg(R(x)) 3. The following steps need to be performed by D: Next, we introduce the definition of the XTR-discrete (1) D chooses a random integer e such that gcd(e,nN )= logarithm (XTR-DL) problem. 1 and calculates d such that ed ≡ de ≡ 1 (mod nN ), where

Definition 5. Given c = T r(g), cn ∈ T r(< g >), nN = lcm(#Ep1 (0, v), #Ep2 (0, v)), and #Ep(0, v) denotes the XTR-DL problem is to find 0 ≤ n < q such that the order (i.e., the number of points) of the n cn = T r(g ). Ep(0, v). The following theorem has been proved in [22], [23]. (2) For i =1, 2, ··· ,m, D calculates R0 = dQ and Bi = Theorem 4. The XTR-DL problem is equivalent to the dRi over EN (0, v). problem in . (3) For i = 1, 2, ··· ,m, D calculates Ii = xBi + yBi ,

The security of XTR public key system is based on where xBi and yBi are the x-coordinate and the y-coordinate constructing a one-way through XTR-DL of the point Bi over EN (0, v) respectively. problem. In order to achieve this goal, when we know the (4) D chooses an integer c (c < q) and considers a NLR values of T r(g) and n, we need to compute the values of defined by the following equations: T r(gn) efficiently, which has been solved by Lenstra and u = I ,u = I , ··· ,u = I , Verheul in [22]. 0 1 1 2 k−1 k k Finally, we give the definition of XTR public key system.  k (3) (−1)ju = ci (mod q) (i ≥ 0). Definition 6. Let p > 3 and q > 3 be two primes such  j i+k−j  j that p ≡ 2 (mod 3) and q|(p2 − p + 1). Let g be an element X=0   6 ∗  in GF (p ) with order q, and {p,q,g,Tr(g)} be public (5) For k ≤ i ≤ m + l +3, D calculates ui. parameters. All the computations here are implemented in (6) D calculates yi = Ii − ui−1 for k