General Construction Methods ofSecret Sharing Schemes andVisual Secret Sharing Schemes（ 秘密分散法お よ び 視覚 復号型秘密分散法の 一 般的構成法）

岩 本貢

c Mitsugu Iwamoto, 2003.

i

Abstract
A secret sharing (SS) scheme is a method to encrypt a secret S into n pieces called shares, eachof which has no information of the secret, but S can be decrypted from some specified collectionof shares. For example, in (k, n)-threshold SS schemes, any k out of n shares can decrypt S
while k − 1 or less shares do not leak out any information of S. The (k, n) threshold accessstructure can be extended to a general access structure, which is specified by the families ofqualified sets and forbidden sets, such that a qualified set can decrypt the secret, and a forbidden
set does not leak out any information of the secret. SS schemes are one of the most important
techniques for secure data storage, and hence, many researches have been devoted to this subject.
The decoding of ordinary SS schemes is implemented by a computer. But, the decoding ofvisual secret sharing (VSS) schemes is realized based on human eyesight by peering at several
shares stacked up. In this thesis, we propose some new efficient construction methods of SS andVSS schemes, which are treated in Part I and Part II, respectively.
We aim in Part I to construct efficient ordinary SS schemes. First, we derive the lower boundsof coding rates for ramp SS schemes. Ramp SS schemes are extensions of ordinary SS schemes,
which we call perfect SS schemes in order to distinguish them from ramp SS schemes. Hence,
our results include some known results of coding rates for prefect SS schemes as special cases.
In order to derive the lower bounds of coding rates in ramp SS schemes, we classify shares
into three categories called super-additive, additive, and sub-additive. Then, we clarify that thecoding rates for sub-additive shares are less efficient than the other two types of shares. We also
derive the lower bounds of coding rates for super-additive and additive shares.
In previous works for the lower bounds of coding rates for perfect SS schemes, they are often
classified into two categories called ideal or non-ideal SS schemes, and the properties of accessstructures are investigated in each category. In this thesis, we extend the notion of ideal perfect
SS schemes to define well-realized ramp SS schemes. By evaluating the lower bounds of coding
rates for ramp SS schemes, we analyze what kind of access structures cannot be well-realized as
ramp SS schemes. These results are extensions of known ones for non-ideal perfect SS schemes
and ramp SS schemes with general access structures.
Next, we propose a new method to construct SS schemes with general access structures in Part
I. It is well known how to construct efficient (k, n)-threshold SS schemes although no efficientconstruction method is known for arbitrarily given general access structures. The cumulative
map, which is a special case of multiple assignment map, is a known simple construction methodof SS schemes with general access structures. But, it is generally inefficient, especially in thecase that access structures are close to (k, n)-threshold access structures. In this thesis, we design
the optimal multiple assignment maps using integer programming. The coding rate obtained byour method is optimal in the multiple assignment maps, and hence, it is more efficient than the
cumulative map. Furthermore, since the proposed construction is very simple, it can easily beapplied to SS schemes with general ramp and/or incomplete access structures.
In Part II, we propose some construction methods of VSS schemes, which are superior in the
viewpoint of the quality of decrypted images and the generalities of access structures.

ii
In VSS schemes, each pixel of a decrypted image consists of a set of subpixels which isrepresented by a basis matrix. In previous works, it was difficult to derive basis matrices since
they are combinatorially defined. Hence, many known studies on VSS schemes treated only
black-white (BW) binary secret images, and there are few studies of VSS schemes for color secretimages because they must deal with more combinations of colors in basis matrices comparedwith the case of BW binary secret images. Based on such backgrounds, a simple construction
method was proposed to derive VSS schemes with color images called algebraic construction,
which does not use the combinatorial methods. It is known that the algebraic construction canrealize an efficient VSS scheme, but it could not be applied to VSS schemes for BW binary
secret images. In order to improve such defects, a modified algebraic construction was proposed.
However, the performance of the modified method has not been studied. In this thesis, we clarify
that the modified algebraic construction can attain the optimal (n, n)-threshold VSS schemes forgray-scale images, and we also derive the basis matrices for the optimal (n, n)-threshold VSS
schemes for gray-scale images.
We also consider VSS schemes for plural secret images in this thesis. We note that the known
VSS schemes for plural secret images can treat only BW binary secret images. Furthermore,some definitions of such VSS schemes are not accurate in the sense of security. In other words,
decrypted images may leak out some information of the other decrypted images in such VSS
schemes. Hence, we carefully define the security condition of VSS schemes for plural secretimages. We also propose the construction methods of the secure VSS schemes that satisfy suchsecurity conditions. Furthermore, we note that the proposed VSS scheme can treat color secretimages with shades, and hence, our VSS scheme includes most of previous VSS schemes as
special cases.

iii

Acknowledgement
I would like to express my sincere gratefulness to my supervisor, Prof. Hirosuke Yamamotofor his continuous encouragements and suggestions, that led to this thesis, during many years
in his laboratory. He gave me the discipline required to study in the research of information
security. Furthermore, he gave me many opportunities to present our results in conferences ortechnical meetings. This thesis would not have been accomplished without his invaluable dayto-day support.
I would like to acknowledge all my co-authors, Prof. Hiroki Koga in University of Tsukuba,
Dr. Tomohiro Ogawa, Mr. Akira Sasaki in University of Tokyo, and Mr. Hirohisa Ogawa in C4
Technologies Inc., who cooperated with me during this research. Especially, Prof. Hiroki Koga
introduced me visual secret sharing schemes and gave me many suggestions and encouragementson this research. I also thank him for providing me his software program of visual secret sharing
schemes. I had many interesting discussions with Dr. Tomohiro Ogawa, and he taught me manythings in information theory and related mathematics. The results of Chapter 4 in this thesis
came from the studies to solve problems shown by Mr. Hirohisa Ogawa.
I am also indebted to Prof. Hideki Imai, Prof. Satoru Iwata, Prof. Kazuo Murota, and Prof.
Kokichi Sugihara for their careful reading of this manuscript in its original form and giving
me many helpful comments and suggestions. I would like to give my special thanks to Prof.
Satoru Iwata who always gave me his encouragements and many suggestions about algorithms
and methods of mathematical optimizations.
I have been working as a research assistant of the Superrobust Computation Project of the 21stCentury COE Program, “Information Science and Technology Strategic Core,” from October in
2002. I like to thank all the people who related to the project.
Many thanks go to all the members of Mathematical Information Laboratory #3, with whom
I enjoyed seminars, discussions, and my life in university.
Finally, it is my pleasure to thank my parents, sister and brother for supporting me for myeducation.

December, 2003
Mitsugu Iwamoto
Tokyo, Japan

Contents
1 Overview of the Thesis
1.1 What is a Secret Sharing Scheme? . . . . . . . . . . . . . . . . . . . . . . . . .
1.2 Extensions of Threshold Secret Sharing Schemes . . . . . . . . . . . . . . . . .
1.3 Variations of Secret Sharing Schemes . . . . . . . . . . . . . . . . . . . . . . .
1.3.1 Visual Secret Sharing Schemes . . . . . . . . . . . . . . . . . . . . . . .
1.3.2 Other Secret Sharing Schemes . . . . . . . . . . . . . . . . . . . . . . .
1.4 Overview of Backgrounds and Main Results . . . . . . . . . . . . . . . . . . . .
1.4.1 Part I: Secret Sharing Schemes . . . . . . . . . . . . . . . . . . . . . . .
1.4.2 Part II: Visual Secret Sharing Schemes . . . . . . . . . . . . . . . . . .
1.5 Organization of Thesis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.6 Notation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1
1
2
3
4
5
6
6
7
8
8

I Secret Sharing Schemes

11

2 Introduction to Secret Sharing Schemes
2.1 Background and Motivations . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.2 Basic Model of Secret Sharing Schemes . . . . . . . . . . . . . . . . . . . . . .
2.2.1 Access Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.2.2 Definitions of Secret Sharing Schemes . . . . . . . . . . . . . . . . . . .
2.2.3 Examples of Secret Sharing Schemes . . . . . . . . . . . . . . . . . . .

13
13
16
16
17
19

3 Evaluations of Coding Rates in Secret Shairng Schemes
3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.2 Definition of Ramp Secret Sharing Schemes . . . . . . . . . . . . . . . . . . . .
3.3 Lower Bounds of Coding Rates in Secret Sharing Schemes . . . . . . . . . . . .
3.3.1 Well-realized Ramp Secret Sharing Schemes . . . . . . . . . . . . . . .
3.3.2 Ramp Access Structures With No Well-realized Ramp Secret Sharing
Schemes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

23
23
24
25
25

v

30
33

CONTENTS

vi
4

5

Constructions of Secret Sharing Schemes Based on Integer Programming
4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.2 Multiple Assignment Schemes . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.3 Optimal Multiple Assignment Maps . . . . . . . . . . . . . . . . . . . . . . . .
4.4 Multiple Assignment Maps for Incomplete Access Structures . . . . . . . . . . .
4.5 Ramp Secret Sharing schemes with General Access Structures . . . . . . . . . .
4.5.1 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.5.2 Optimal Multiple Assignment Maps for Ramp Secret Sharing
Schemes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.6 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

35
35
36
39
45
47
47
48
51

Conclusions of Part I
53
5.1 Summary of Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
5.2 Future Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

II Visual Secret Sharing Schemes

55

6

Introduction to Visual Secret Sharing Schemes
6.1 Background and Motivations . . . . . . . . . . . . . . . . . . . . . . . . . . . .
6.2 Basic Definitions of Visual Secret Sharing Schemes . . . . . . . . . . . . . . . .
6.2.1 Representations of Colors . . . . . . . . . . . . . . . . . . . . . . . . .
6.2.2 Basis Matrices of Visual Secret Sharing Schemes . . . . . . . . . . . . .
6.3 Algebraic Construction of Visual Secret Sharing Schemes . . . . . . . . . . . . .
6.3.1 Column-Permutation Matrices and Polynomials . . . . . . . . . . . . . .
6.3.2 Polynomial Representations of Basis Matrices . . . . . . . . . . . . . . .
6.3.3 (n, n)-threshold Visual Secret Sharing Schemes . . . . . . . . . . . . . .
6.3.4 (k, n)-threshold Visual Secret Sharing Schemes . . . . . . . . . . . . . .
6.4 Visual Secret Sharing Schemes for General Access Structures . . . . . . . . . . .

57
57
60
60
61
66
66
68
71
75
77

7

Visual Secret Sharing Schemes for Gray-scale Images
7.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.2 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.2.1 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.2.2 Polynomial Representation of VSS-GS Schemes . . . . . . . . . . . . .
7.3 Minimum Pixel Expansion of (n, n)-VSS-GS Schemes . . . . . . . . . . . . . .
7.3.1 Generality of Polynomial Representation in (n, n)-VSS-GS Schemes . .
7.3.2 Minimum Pixel Expansion of (n, n)-VSS-GS Schemes . . . . . . . . . .
7.4 Maximum Contrasts and Minimum Pixel Expansion . . . . . . . . . . . . . . . .
7.4.1 Maximum Average Contrast and Minimum Contrast . . . . . . . . . . .
7.4.2 Minimum Pixel Expansion with Maximum Average Contrast . . . . . . .
7.5 VSS Schemes for Color Images with Shades . . . . . . . . . . . . . . . . . . . .

81
81
82
82
86
88
88
89
91
91
93
94

CONTENTS

7.6

vii

7.5.1 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
7.5.2 Algebraic Construction of VSS-CS Schemes . . . . . . . . . . . . . . . 96
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

8 Visual Secret Sharing Schemes for Plural Secret Images
101
8.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
8.2 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
8.2.1 Access Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
8.2.2 Color Matrix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
8.2.3 Definition of VSS-q-PI Schemes . . . . . . . . . . . . . . . . . . . . . . 104
8.3 Construction Method of VSS-q-PI Scheme . . . . . . . . . . . . . . . . . . . . . 107
8.3.1 Construction Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
8.3.2 Proof of Theorem 8.11 . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
8.4 Construction Method by Duplicating Secret Images . . . . . . . . . . . . . . . . 111
8.5 Comparison with Trivial Schemes . . . . . . . . . . . . . . . . . . . . . . . . . 112
8.6 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
9 Conclusions of Part II
115
9.1 Summary of Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
9.2 Future Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
A Examples of Visual Secret Sharing Schemes
117
A.1 Visual Secret Sharing Schemes for BW-binary Secret Images . . . . . . . . . . . 117
A.2 Visual Secret Sharing Schemes for Color Images . . . . . . . . . . . . . . . . . 120
A.3 Visual Secret Sharing Schemes for Gray-scale Images . . . . . . . . . . . . . . . 131
A.4 Visual Secret Sharing Scheme with Plural Secret Images . . . . . . . . . . . . . 135
List of Publications

157

List of Figures
1.1
1.2

A (k, n)-threshold secret sharing scheme . . . . . . . . . . . . . . . . . . . . . .
An example of a (k, n)-threshold VSS scheme . . . . . . . . . . . . . . . . . . .

2
4

4.1

Relation between ϕΓ (i)’s and X k ’s in the case of n = 3. . . . . . . . . . . . . . 40

6.1
6.2
6.3

Hasse diagram Lcol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Correspondence between pixels on a secret image and a decrypted image in thecase of (2, 2)-threshold access structure with E = {0, 1} and m = 4 . . . . . . . 62
A set of pixels on n shares represented by a matrix T . . . . . . . . . . . . . . . 63

7.1
7.2

Original secret image with 8-depths gray-scale. . . . . . . . . . . . . . . . . . . 82
1Comparison between two decrypted images with β = 0 and β = 16
. . . . . . . . 85

8.1

An example of plural secret images . . . . . . . . . . . . . . . . . . . . . . . . . 103

A.1 The first share of a (2, 2)-threshold VSS scheme for a BW-binary image: V1BW . 118
A.2 The second share of a (2, 2)-threshold VSS scheme for a BW-binary image: V2BW 118
A.3 The decrypted image obtained from V1BW and V2BW . . . . . . . . . . . . . . . . 119
A.4 The first share of a (2, 2)-threshold VSS scheme for a color image: V1C1 . . . . . 121
A.5 The second share of a (2, 2)-threshold VSS scheme for a color image: V2C1 . . . 121
A.6 The decrypted image obtained from V1C1 and V2C1 . . . . . . . . . . . . . . . . . 122
A.7 The first share of a (2, 3)-threshold VSS scheme for a color image: V1C2 . . . . . 123
A.8 The second share of a (2, 3)-threshold VSS scheme for a color image: V2C2 . . . 123
A.9 The third share of a (2, 3)-threshold VSS scheme for a color image: V3C2 . . . . . 124
A.10 The decrypted image obtained from V1C2 and V2C2 . (“UT” is the abbreviation ofUniv. of Tokyo.) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
A.11 The first share of a VSS scheme for a color image with the access structure givenby (6.116) and (6.117): V1C3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
A.12 The second share of a VSS scheme for a color image with the access structure
given by (6.116) and (6.117): V2C3 . . . . . . . . . . . . . . . . . . . . . . . . . 126
A.13 The third share of a VSS scheme for a color image with the access structure givenby (6.116) and (6.117): V3C3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
A.14 The fourth share of a VSS scheme for a color image with the access structure
given by (6.116) and (6.117): V4C3 . . . . . . . . . . . . . . . . . . . . . . . . . 128ix

x

LIST OF FIGURES
A.15 The decrypted image obtained from V1C3 and V2C3 . . . . . . . . . . . . . . . . . 129
A.16 The image obtained from V1C3 and V3C3 which has no information about the secretimage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
A.17 The first share of a (2, 2)-threshold VSS-GS-8 scheme: V1GS . . . . . . . . . . . 132
A.18 The second share of a (2, 2)-threshold VSS-GS-8 scheme: V2GS . . . . . . . . . . 133
A.19 The decrypted image obtained from V1GS and V2GS . . . . . . . . . . . . . . . . 134
A.20 The first share of a (2, 2)-threshold VSS scheme with ID images: V1ID (The first
ID is VASE.) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
A.21 The second share of a (2, 2)-threshold VSS scheme with ID images: V2ID (The
first ID is FACE.) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
A.22 The decrypted image obtained from V1ID and V2ID . . . . . . . . . . . . . . . . . 139
A.23 The first share of a VSS-3-PI scheme: V1P L . . . . . . . . . . . . . . . . . . . . 140
A.24 The second share of a VSS-3-PI scheme: V2P L . . . . . . . . . . . . . . . . . . . 141
A.25 The third share of a VSS-3-PI scheme: V3P L . . . . . . . . . . . . . . . . . . . . 142
A.26 The decrypted image obtained from V1P L and V2P L . . . . . . . . . . . . . . . . 143
A.27 The decrypted image obtained from V2P L and V3P L . . . . . . . . . . . . . . . . 144
A.28 The decrypted image obtained from V1P L and V3P L . . . . . . . . . . . . . . . . 145

Chapter 1
Overview of the Thesis
1.1 What is a Secret Sharing Scheme?
Due to the recent development of computers and computer networks, huge amount of digital
data can easily be transmitted or stored. However, we note that transmitted data in networks orstored data in computers may easily be eavesdropped or substituted by enemies if the data are
not enciphered by some cryptographic tools. Therefore, information security is one of the mostimportant technologies in modern computerized society.
For secure data transmission against eavesdropping or substitution attacks, two important
technologies were invented in 1970’s, and the development of secure computer networks was
accelerated by the methods. They are the public key cryptosystem, which was proposed by
Diffie-Hellman in 1976 [34], and the Data Encryption Standard (DES), which is a secret key
cryptosystem adopted by the National Bureau of Standards in U.S.A. in 1977 [75]. The RSA
cryptosystem, which is the first practical public key cryptosystem proposed by Rivest-ShamirAdleman in 1978 [97], cleared the key distribution problem in secret key cryptosystems. Furthermore, it is shown in [97] that the digital signature scheme can be realized by the public key
cryptosystems. Based on these public key cryptosystems, many useful cryptographic protocols
are designed. The DES was taken over by Rijndael [31] as the Advanced Encryption Standard(AES) adopted by National Institute of Standard and Technology in U.S.A. in 2000. In this way,
information security for data transmission has been extensively studied.
In the case of secure data storage, we have the same problems such as eavesdropping andsubstituting, and such threats can be overcome by the same cryptographic technologies. However, we may have other threats such as troubles of storage devices or attacks of destruction. In
order to prevent such attacks, we must make as many copies of the secret as possible. But, if wehave many copies of the secret, the secret tends to leak out, and hence, the number of the copies
should be as small as possible. This contradictive requirement can be solved by a secret sharing
scheme, which was proposed independently by Shamir [99] and Blakley [8] in 1979.
A secret sharing (SS) scheme is a method to encrypt secret information S into n pieces calledshares V1 , V2 , . . . , Vn , each of which has no information of secret S, but S can be decryptedby collecting several shares. For example, consider a (k, n)-threshold SS scheme illustrated in
1Chapter 1. Overview of the Thesis

2

V1
SecretS

Encryption into

V2

n sharesArbitrarySk shares

No informationof S

Arbitrary k − 1or less shares

Vn
Figure 1.1. A (k, n)-threshold secret sharing scheme
Figure 1.1. In this SS scheme, any k out of n shares can decrypt secret S but any k − 1 or lessshares do not leak out any information of S. Hence, even if n − k shares are destroyed by anenemies, we can recover S from the remaining k shares. Furthermore, even if an enemy steals
k − 1 shares, any information about S does not leak out. This means that the SS scheme is secureagainst both destruction and stealing. We also note that the SS scheme is unconditionally secure
because the SS scheme is not based on any assumption of computational difficulties like thefactorization of integers or the calculation of discrete logarithms. Hence, it is appropriate for along time data storage. Furthermore, the SS schemes are expected to be used in the environmentof ubiquitous networks to share secrets among many entities.

1.2 Extensions of Threshold Secret Sharing Schemes
The original SS scheme by Shamir [99] and Blakley [8] is a (k, n)-threshold SS scheme. But, it
can be extended in two ways, which is shown in Table 1.1 and summarized as follows.
In the case of (k, n)-threshold access structure, we assume that every share is equally important, but there are cases such that we want to make some shares more important than the others.
For example, consider the case that a secret is shared in a company as follows: A president
wants to distribute the shares of a secret S to directors of the company in such a way as S canbe decrypted if and only if two vice-presidents or more than five directors except vise-presidents
cooperate with each other. In such cases, the shares of directors are less important than those ofvice-presidents. Since this decoding aspect cannot be realized by (k, n)-threshold SS schemes,a general access structure must be introduced to attain the desired security. A general access
Table 1.1. Extensions of (k, n)-threshold secret sharing schemes

Perfect SS schemes
Ramp SS schemesThreshold TypeShamir [99], Blakley [8]Blakley-Meadows [9], Yamamoto [118], [119]General Access Structure
Itoh et al. [47]Kurosawa et al. [71]

1.3. Variations of Secret Sharing Schemes

3

structure consists of qualified sets and forbidden sets. A qualified set is the set of shares that can
decrypt the secret while a forbidden set is the set of shares that must not leak out any informationof the secret. In order to realize a secure data storage efficiency, we must make a size of eachshare as small as possible, and hence, efficient coding methods for SS schemes with general access structures must be established. It is known how to construct efficient (k, n)-threshold SS
schemes [99]. However, we have known no method to obtain efficient SS schemes for given
general access structures.
As another extension of (k, n)-threshold SS schemes, ramp SS schemes were proposed independently by Blakley-Meadows [9] and Yamamoto [118], [119] in 1984. A ramp SS scheme is a
SS scheme with intermediate properties between qualified sets and forbidden sets. The first ramp
SS schemes [9], [119] are threshold SS schemes called (k, L, n)-threshold ramp SS schemes. The(k, L, n)-threshold ramp SS schemes are designed such that a secret S can be decrypted from arbitrary k-out-of-n shares but no information of S cannot be obtained from arbitrary k − L or lessshares. Furthermore, from arbitrary k − j shares for j = 1, 2, . . . , L − 1, some information of S
leak out with the amount of Lj in S. In the case of L = 1, (k, L, n)-threshold ramp SS schemes
reduce to (k, n)-threshold SS schemes, and hence, ramp SS schemes can be considered as anextension of (k, n)-threshold SS schemes treated in Section 1.1. Furthermore, by introducing
ramp SS schemes, the coding rates of shares can be reduced compared with ordinal SS schemes,
and hence, ramp SS schemes can attain efficient coding rates at a little sacrifice of security. To
distinguish ordinal SS schemes from ramp SS schemes, ordinal SS schemes are called perfect
SS schemes. Furthermore, ramp SS schemes with general access structures were proposed by
Kurosawa et al. [71].
In the case that the number of shares n is large, it is cumbersome to specify whether eachsubset of shares is a qualified set or a forbidden set in perfect SS schemes since the numberof subset of shares is 2n . Hence, it is desirable to construct a SS scheme even in the case that
we don’t care the properties of some subsets of n shares. We call such an access structure
incomplete. Note that incomplete access structures can be considered for ramp SS schemes in
addition to perfect SS schemes.

1.3 Variations of Secret Sharing Schemes
SS schemes introduced in previous sections, e.g., [8], [99], are based on algebraic calculationsin their realizations. But there are some different realizations from ordinal SS schemes. In suchother realizations, some physical informations are used instead of numbers on finite fields. Table
1.2 shows what kind of secret information is used to realize each SS scheme. In this section, we
introduce such SS schemes.
Since we treat visual secret sharing (VSS) schemes in Part II of this thesis, we first give a
brief introduction to VSS schemes in the Section 1.3.1 and the other SS schemes will be reviewed
in Section 1.3.2.

Chapter 1. Overview of the Thesis

4

V1
Secret image

V2

Decrypted image
Stacking up
arbitraryk sharesArbitraryk − 1 or lesssharesNo information of
the secret image
is obtained

Vn

Figure 1.2. An example of a (k, n)-threshold VSS scheme

1.3.1 Visual Secret Sharing Schemes
A visual secret sharing (VSS) scheme, which originates from the visual cryptography proposed
by Naor-Shamir [81], may be one of the most well known realization of SS schemes.
The VSS scheme is a method to encode a secret image into several shares, each of which
does not reveal any information of the secret image. Each share is printed on a transparency, andis distributed to one of n participants. The secret image can easily be decrypted only by stacking
the shares in an arbitrary order. For instance, an example of a (k, n)-threshold VSS scheme isillustrated in Figure 1.2. Note that VSS schemes can be realized for not only (k, n)-threshold
access structures but also general access structures. Furthermore, VSS schemes for color and/or
gray-scale secret images can be constructed although the example in Figure 1.2 treats black-white(BW) binary secret image.
We note that VSS schemes need no computation in decryption. This fact distinguishes VSS
Table 1.2. Variations of secret sharing schemes
Based onComputers
Human
sense
Quantum
information

Name
Secret information
SS schemes
Numbers in finite fields
Visual cryptography
ImagesCerebral cryptography
3D images
Optical cryptography
LightsAudio cryptography
SoundsTempo-based audio
Rhythms
cryptography
Quantum SS scheme
Numbers
Quantum SS scheme
Quantum states

Proposed first by
Shamir [99], Blakley [8]Naor-Shamir [81]Desmedt et al. [33]Desmedt et al. [32]Desmedt et al. [32]Chiou-Laih [26]Hillery et al. [41]Cleve et al. [28]

1.3. Variations of Secret Sharing Schemes

5

scheme from ordinary SS schemes. Hence, VSS schemes can be used even in the case that any
electrical power or any computers cannot be used, e.g., in the case of disasters. We note that
VSS schemes are unconditionally secure. Therefore, VSS schemes are important and interesting
realizations of SS schemes.
In VSS schemes, we must have importance on the realization of clear decrypted images withhigh contrast and high resolution rather than efficient coding rates.

1.3.2 Other Secret Sharing Schemes
In this section, we summarize several different realizations of SS schemes from ordinal SS andVSS schemes.
The audio cryptography [26], [32], the optical cryptography, [32] and the cerebral cryptography [33] are also SS schemes which use human senses in decryption in the same way as VSS
schemes. In the audio and optical cryptography [32], a secret and shares are sounds or lights
which can be considered as waves, and the interference of waves are used in decryption. In otherwords, the waves of shares corresponding to a qualified set are strengthened each other to listen
to or to see the secret, but the waves of shares for a forbidden set are weakened each other to hide
the secret. The audio cryptography [32] is not unconditionally secure, although the tempo-based
audio cryptography proposed in [26] can guarantee unconditional security. In the tempo-based
audio cryptography, secret bits are encrypted into rhythms, and security assumptions are similar
to VSS schemes. The cerebral cryptography is a SS scheme based on the so-called stereogram.
The stereogram [56] is an illusion of eyesight that can perceive a 3-dimensional image from two
2-dimensional images. However, the security conditions are not clarified in [33].
Recently, quantum cryptography is extensively studied. As is the case with classical cryptography, quantum cryptography is also designed for secure data transmissions or secure data
storage. The first quantum cryptography for data transmission is the so-called BB84 protocol proposed by Bennett-Brassard in 1984 [5], which is a key distribution protocol. On the other hand,for secure data storage, quantum secret sharing schemes are proposed in [28], [39], [41], [57].
Compared with classical cryptography, quantum cryptography has remarkable advantages suchthat it can detect an eavesdropper and a dishonest participant by measurements of quantum states.
QSS schemes also have such advantages.
The first QSS scheme [41] is a three-party protocol based on three entangled particles called
Greenberger-Horne-Zeilinger (GHZ) state. In this QSS scheme, the measurement result for one
share can be determined by combining measurement results for the other two shares. Hence,
this method in [41] can be considered as an extension of a quantum key sharing scheme rather
than a QSS scheme. A (k, n)-threshold QSS scheme is considered in [57] as an extension of themethod in [41]. In QSS schemes treated in [41], [57], secret information is ordinary bits which
are encoded into quantum states. On the other hand, it is proposed in [28], [39] to encrypt a secretquantum state into shares. It is shown in [28] that (k, n)-threshold QSS schemes can be realized
only in the case that n ≤ 2k − 1, which comes from the requirement of the so-called no-cloning
theorem. Furthermore, in the case that a secret quantum state is a pure-state, it must hold that

6

Chapter 1. Overview of the Thesisn = 2k − 1. It is also shown in [39] that QSS schemes for general access structures can beconstructed for any mixed-state secret quantum states if access structures satisfy the no-cloning
theorem. The coding efficiency of QSS schemes is also treated in [39], [87].
SS, VSS, and QSS schemes can guarantee unconditional security, but computationally secure
SS schemes are considered in [23], [69]. In the case of computationally secure SS schemes, thecoding rates of shares are much more efficient than unconditionally secure SS schemes [69].
Furthermore, such SS schemes can treat plural secrets dynamically without redistributing newshares to participants secretly [23].

1.4 Overview of Backgrounds and Main Results
In this thesis, we treat SS and VSS schemes which will be appeared in Part I and II, respectively.
The background and the obtained results in both topics are summarized as follows.

1.4.1 Part I: Secret Sharing Schemes
We aim in Part I to construct efficient ordinary SS schemes. In order to establish efficient coding
methods of SS schemes, we have to derive the optimal coding rates or the lower bounds of coding
rates for SS schemes with a given general access structure.
In previous works for deriving the lower bounds for coding rates of perfect SS schemes, they
are often classified into two categories called ideal or non-ideal SS schemes, and the property ofaccess structures of SS schemes in each category is investigated. However, it is still difficult toderive the lower bounds of coding rates for a SS scheme with a given general access structure
although it is easy to derive it for (k, n)-threshold access structures. Furthermore, there are few
studies of the evaluation of coding rates for ramp SS schemes with general access structures.
Hence, in this thesis, we analyze the coding rates of ramp SS schemes. As we have describedin Section 1.2, ramp SS schemes are extensions of perfect SS schemes, and our results include
some known results of coding rates for prefect SS schemes as special cases.
In order to derive the lower bounds of coding rates in ramp SS schemes, we first classify
shares into three categories called super-additive, additive, and sub-additive. Note that such classification is not needed in perfect SS schemes since all the shares are super-additive in prefect SS
schemes. Then, we clarify that the lower bounds of coding rates for sub-additive shares must be
different from the other two types of shares. Furthermore, we derive the lower bounds of coding
rates for super-additive and additive shares. Based on these results, we define a well-realized
ramp SS scheme as an extension of an ideal prefect SS scheme, and we analyze the access structures that cannot be well-realized as ramp SS schemes by deriving the lower bounds of coding
rates for such ramp SS schemes. These lower bounds are extensions of the lower bounds for nonideal perfect SS schemes derived by Blundo et al. [15]. Furthermore, our result also includes thelower bounds of coding rates for ramp SS schemes with general access structures given in [88]as special cases.

1.4. Overview of Backgrounds and Main Results

7

We also propose a method to construct SS schemes with general access structures in Part I. It
is well known how to construct efficient (k, n)-threshold SS schemes although no efficient construction method is known for arbitrary given general access structures. Actually, the cumulative
map by Itoh et al. [47]–[49] is a known simple construction method of SS schemes with general access structures. But, it is generally inefficient, especially in the case that access structures
are close to (k, n)-threshold access structures. Note that the cumulative map is a realization of
so-called a multiple assignment map due to Itoh et al. [47]–[49]. The multiple assignment map
realizes a SS scheme with a given access structures by distributing shares of a (t, m)-threshold
SS scheme such that t or more shares of the (t, m)-threshold SS scheme are assigned to qualifiedsets but t − 1 or less shares are assigned to forbidden sets.
In this thesis, we design the optimal multiple assignment maps using integer programming.
It is shown that the coding rate obtained by our method is more efficient than the coding rate
obtained by cumulative maps. Furthermore, the proposed construction is very simple, and hence,
it can easily be applied to SS schemes with general ramp and/or incomplete access structures.
Furthermore, this method may be applied to some other realizations of SS schemes with generalaccess structures shown in Section 1.3.2.

1.4.2 Part II: Visual Secret Sharing Schemes
In Part II, we propose some construction methods of VSS schemes, which are superior in the
viewpoint of the quality of decrypted images and the generalities of access structures.
In VSS schemes, each pixel of a decrypted image consists of a set of subpixels which isrepresented by basis matrices. Hence, the construction of VSS schemes is equivalent to thedesign of basis matrices. In previous works, however, it was difficult to derive basis matrices forgeneral VSS schemes since they are combinatorially defined. Therefore, many known studies on
VSS schemes treated only BW binary secret images, and there are few studies of VSS schemes
for color secret images because they must deal with more combinations of colors in basis matrices
compared with the VSS schemes for BW binary secret images. Based on such backgrounds, inorder to derive (k, n)-threshold VSS schemes with color images, a simple construction method,which does not use combinatorial methods, was proposed by Koga [63] and developed in our
joint work [66]. This method is called algebraic construction, which can easily be implemented
compared with the known VSS schemes. However, this method could not be applied to VSS
schemes for BW binary secret images.
To improve such defects, Kuwakado-Tanaka modified the algebraic construction to deal withBW binary images [72]. However, they proposed only the modification, but they did not analyze
the performance of the modified method. Hence, we clarify that the modified algebraic construction can attain the optimal (n, n)-threshold VSS schemes for gray-scale images, and we derive
the basis matrices of the optimal (n, n)-threshold VSS schemes for gray-scale images.
We also consider VSS schemes for plural secret images as extensions of VSS schemes for
single secret images. We note that known VSS schemes for plural secret images can treat only
BW binary secret images. Furthermore, some definitions of such VSS schemes are not accurate.

Chapter 1. Overview of the Thesis

8

In other words, it may occur that decrypted images leak out some information of the other decrypted images. Hence, we carefully define the security condition of VSS schemes for plural
secret images. We also propose the construction methods of the desired VSS schemes and it isproved that the proposed VSS schemes satisfy such security conditions. Furthermore, we notethat the proposed VSS scheme can treat color secret images with shades, and hence, our VSS
scheme includes most of the previous VSS schemes as special cases.

1.5 Organization of Thesis
This thesis is organized into two parts. Part I treats ordinal SS schemes that are implemented
by algebraic computations on finite fields in computers, and Part II is devoted to give the general construction methods of VSS schemes. The backgrounds and the known constructions ofordinary SS and VSS schemes are summarized in Chapters 2 and 6, respectively.
Part I is organized as follows: In Chapter 3, we evaluate the coding rates of ramp SS schemes.
Chapter 4 is devoted to propose an efficient construction method of SS schemes. The proposed
method can be applied to SS schemes with ramp and/or incomplete access structures, which arealso treated in the same chapter.
Part II consists of two topics. In Chapter 7, we apply the algebraic construction given in
Chapter 6 and [66], [72] to VSS schemes for gray-scale images, and it will be shown that thealgebraic construction can attain the optimal VSS schemes for gray-scale images in the caseof (n, n)-threshold access structures. Then, in Chapter 8, we consider VSS schemes for plural
secret images. In this chapter, security conditions are carefully defined for such VSS schemes,
and we show how to construct VSS schemes satisfying the security conditions.
Finally, the summaries of obtained results and future works of Parts I and II will be given in
Chapters 5 and 9, respectively.

1.6 Notation
In this thesis, we use the following notation.
• X: A random variable. Random variables are usually represented by upper-case italic
letters in this thesis.
• FX : A finite field in which random variable X takes a value.
• x: An instance of X, i.e., x ∈ FX
• PX (x): Probability that X takes value x ∈ FX .
• H(X): The Shannon entropy of X, which is defined by
X
def
H(X) = −PX (x) log PX (x).
x∈ X

(1.1)

1.6. Notation

9

The base of logarithm is 2 in this thesis.
• H(X|Y ): The conditional entropy of X given Y , which is defined byX
def
PY (y)H(X|Y = y)
H(X|Y ) =
y∈ Y

=−

X X

PXY (x, y) log PX|Y (x|y).

(1.2)

x∈ X y∈ Y• I(X; Y ): The mutual information between X and Y , which is defined bydef

I(X; Y ) = H(X) − H(X|Y ).

(1.3)• I(X; Y |Z): The conditional mutual information between X and Y given Z, which isdefined bydef

I(X; Y |Z) = H(X|Z) − H(X|Y Z).

(1.4)• X: A set. Sets are usually denoted by upper-case bold-faced letters.
• F : A finite field in which set X takes values.
• |X|: The cardinality of X.
• X: The complement of X.
def• X − Y : The difference of sets X and Y , i.e., X − Y = X ∩ Y .
• X × Y : The Cartesian product of X and Y , i.e., (X, Y ) ∈ X × Y if X ∈ X and Y ∈ Y .
• X : A family of sets. Families are represented by upper-case script faced letters.
• x: A vector. Vectors are usually represented by lower-case bold-faced letters.
• tx: Transpose of a vector x.
• x: A color. We represent colors by lower-case san-serif faced letters. For example, red,green, blue, yellow, magenta, and cyan are expressed by r, g, b, y, m and c, respectively.
Especially, black and white are expressed by 1 and 0, and a general color is represented byx.
• x t x0 : The mixture of colors x and x0 . As an example, c t y = g, which means that the
mixture of cyan and yellow is green.
• A

B: The concatenation of matrices A and B which have the same number of rows, e.g.,


 
 
0 0 0 1 1
1 1
0 0 0
 0 0 0   1 1  =  0 0 0 1 1 .
(1.5)
0 0 0 1 1
1 1
0 0 0

Part I
Secret Sharing Schemes

11Chapter 2
Introduction to Secret Sharing Schemes
2.1 Background and Motivations
A Secret Sharing (SS) scheme is a method to encrypt secret information S into n pieces calledshares V1 , V2 , . . . , Vn , each of which has no information of secret S, but S can be decryptedby collecting several shares. As we have described in Chapter 1, SS schemes are important
techniques for secure data storages. The SS scheme originated by Shamir [99] and Blakley [8]is a (k, n)-threshold SS scheme, which means that any k out of n shares can decrypt secret S
but any k − 1 or less shares do not leak out any information of S. The (k, n)-threshold accessstructure can be generalized to so-called general access structures which consist of the familiesof qualified sets and forbidden sets. A qualified set is a set of shares that can decrypt secret S, but
a forbidden set is a share set that does not leak out any information of S. In this thesis, we usuallyassume that every set of shares in 2 is specified with a qualified set or a forbidden set. We callsuch an access structure complete. However, in the case that n is large, it is cumbersome to
specify an access structure completely, and hence, SS schemes with incomplete access structures
may be considered in practical uses.
The information theoretic analysis of SS schemes was first studied by Karnin et al. [58].
They evaluate the efficiency of SS schemes by the entropy of each share. Furthermore, it isshown in [58] that H(Vi ) ≥ H(S) must hold for the entropies of secret S and shares Vi , i =1, 2, . . . , n, in the case of (k, n)-threshold SS schemes. This means that the rate of each share,defρi = H(Vi )/H(S), must be ρi ≥ 1. This result is extended to SS schemes with general accessstructures in [24].
In case that some sets of shares are allowed to have intermediate properties between thequalified sets and forbidden sets, it is possible to decrease the entropy of each share H(Vi ) lessthan H(S), i.e., ρi < 1, although the security is a little weakened. SS schemes which have thetrade-off between security and coding efficiency is called ramp SS schemes, which are proposed
independently by Blakley [9] and Yamamoto [118], [119]. To distinguish ordinal SS schemes
from ramp SS schemes, ordinal SS schemes are called perfect SS schemes. Note that perfect SS
schemes can be considered as special cases of ramp SS schemes. Although the ramp SS schemes
proposed in [9], [118], [119] are threshold schemes, ramp SS schemes are also extended to have13

14

Chapter 2. Introduction to Secret Sharing Schemes

general access structures in [71], [86], [88].
The perfect SS scheme attaining H(S) = H(Vi ) for all i is called ideal. There are manystudies of the ideal perfect SS schemes [21], [38], [84], [85], [98], [112], some of which point out
the correspondence between the access structures of ideal SS schemes and matroids. On the other
hand, the access structures of non-ideal SS schemes are investigated in [15], [22], [24], [30], [70],[89], [114], [115]. Some examples of non-ideal SS schemes are first described in [24], and moregeneral examples of non-ideal SS schemes are presented in [15]. But, their examples cannot
include some non-ideal SS schemes, e.g., the case shown in [89] or [114], the former of whichis constructed based on combinatorial methods. In other words, it is not known what kinds ofaccess structures can be or cannot be realized as ideal perfect SS schemes.
In Chapter 3, we consider the coding rates of ramp SS schemes with general access structuresfrom the viewpoint of ideal and non-ideal ramp SS schemes. Ideal ramp SS schemes are definedin [71] as extensions of ideal perfect SS schemes. But, we note from the lower bound of thecoding rate derived in [88] that many ramp access structures cannot be realized as ideal ramp
SS schemes. In other words, if we adopt the definition of ideal ramp SS schemes in [71], theconsiderations of ideal ramp SS schemes tell nothing about the coding rates of most ramp SS
schemes. Hence, we introduce a notion of well-realized ramp SS schemes as other extensions ofideal perfect SS schemes, and we evaluate the coding rates of ramp SS schemes based on thisnew notion of well-realized ramp SS schemes as follows: First, we classify shares into three
categories, super-additive, additive, and sub-additive shares. Depending on this classification,
we show that the coding rates of sub-additive shares are larger than the ones of additive or superadditive shares, and therefore, ramp SS schemes with sub-additive shares cannot be well-realized.
Next, by evaluating the lower bound of coding rate, we derive the condition that ramp accessstructures only with additive and sub-additive shares cannot be well-realized. The lower boundis an extension of the lower bound by Blundo et al. [15] for non-ideal perfect SS schemes.
Furthermore, it is shown that it includes not only the lower bounds of coding rates in [88] as
special cases, but also gives tighter bounds for some access structures. By using them, we candiscriminate the ramp access structures that cannot be well-realized.
(k, n)-threshold SS schemes have been studied by many researchers for perfect SS schemes.
But, there are only a few construction method that can be applied to general access structures.
Most of them are modifications of a monotone circuit construction [4] or a cumulative map [47],which will be introduced in Sections 2.2.3.2 and 4.2, respectively. But, they are much inefficient,
especially in the case that an access structure is close to a (k, n)-threshold access structure withk 6= n. Hence, the monotone circuit construction is extended to the so-called decomposition construction [16], [104], [116], which can be used to derive the optimal SS schemes for some special
access structures. For instance, by the decomposition construction, we can derive the optimal
SS scheme if the number of shares are less than four [105], [106], or if access structures can be
represented by graphs with six vertices [113], [115]. However, the decomposition construction
cannot generate an efficient SS scheme in the case that the decomposed SS schemes cannot berealized efficiently. Hence, this method is applied mainly to the access structures represented bygraphs [16], [104].

2.1. Background and Motivations

15

In the case of ramp SS schemes for general access structures, construction methods are proposed only in [71], [103]. But, the construction method in [71] always gives that H(Vi ) ≥ H(S),i.e., ρi ≥ 1, which does not take advantage of ramp SS schemes to decrease coding rates. On theother hand, a construction method in [103] is much complicated since the construction is basedon monotone span programming.
In Chapter 4, based on these backgrounds, we propose a simple but efficient construction
method of SS schemes based on integer programming and a multiple assignment map, which
is a generalized concept of the cumulative map. Our method can attain the optimal multiple
assignment schemes, and hence, our method can always generate more efficient SS schemes
than the cumulative map. Furthermore, our method can also be applied to incomplete and/or
ramp access structures to derive the optimal multiple assignments. We show some examples that
our method can attain more efficient coding rates than the cumulative map.
We note that there are many researches for SS schemes outside of the scope of this thesis. In
the following, we summarize some of them.
The relations between SS schemes and error correcting codes are pointed out in [58], [76].
Especially it is shown in [58] that the substitution attack cannot be detected in ideal SS schemes.
In the case of Shamir’s threshold scheme [99], the secret leak out to a cheater if the cheater
submits a false share and legitimate participants try to detect the cheater. Hence, in [110], a
method is proposed to detect the cheater with high probability without leaking out the secret tothe cheater. A verifiable SS scheme is a SS scheme that can verify whether every participant witha share in a qualified set decrypts the same secret, which is proposed first by Chor et al. [27] andthere are many researches on these subjects [3], [37], [93]–[95].
SS schemes can be considered as extensions of Shannon’s cipher communication system[100]. Based on such considerations, source coding problems for secret sharing communication
systems are studied by Yamamoto [120], which can also be considered as more general settingsof ramp SS schemes with two or three shares. Furthermore, SS communication systems with two
discrete noisy channels [121] and with two Gaussian wiretap channels [122] are treated.
It is desirable to change a secret dynamically for the sake of security, and hence, a dynamic
SS scheme is proposed by Laih et al. [73]. On the other hand, the SS schemes that can changeshares dynamically without changing a secret is proposed by Herzberg et al. [40]. Furthermore,
Blundo et al. treat the dynamic SS schemes that can change a secret and an access structure [11].
Their results include the SS schemes with disenrollment proposed by Blakley et al. [7], which
can invalidate some shares when a secret is changed. These methods are called pre-positioned
SS schemes since all the changes of secrets and access structures must be previously known andthey must be encoded in pre-distributed shares in advance. In order to change a secret and anaccess structure, a common public message is sent to all the participants. On the other hand, amethod is proposed in [90], [108] that SS schemes can change secrets and access structures even
if they are not known previously. But, it is pointed out that such protocols are insecure [74].
A SS scheme with plural secrets, which is called multi SS scheme, is first proposed by KarninGreene-Hellman [58] and studied by Simmons [101]. This kind of SS schemes are related toramp SS schemes and dynamic SS schemes, which are pointed out in [18] and [55], respectively.

Chapter 2. Introduction to Secret Sharing Schemes

16

Furthermore, the comparisons between SS schemes with plural secrets and with one secret areconsidered in [29], and ideal SS schemes with plural secrets are treated in [54].
A secret function sharing scheme, in which a secret is a function rather than a value, is
proposed by Naor-Pinkas [80] as an extension of Shamir’s threshold schemes. They also proposed an unconditionally secure 1-out-of-2 oblivious transfer based on the secret function sharing schemes. This method is extended to ramp secret function sharing schemes, which can beapplied to a 1-out-of-` oblivious transfer, by Kawamoto-Yamamoto [61].
Finally, we note that the decryption of Shamir’s threshold scheme requires the identification
information of each share. The anonymous SS schemes [20] is the threshold SS scheme that can
decrypt the secret from k shares even if the ID information of shares are not known.

2.2 Basic Model of Secret Sharing Schemes
2.2.1 Access Structures
In the rest of this chapter, we describe basic models of SS schemes, according to [77], [91], [105].
Let V = {V1 , V2 , . . . , Vn } be a set of shares, and denote by 2 the family of all subsets of V .
We represent the family of qualified sets that can decrypt secret information S and the family of
forbidden sets that cannot gain any information of S by A1 and A0 , respectively. Γ = {A1, A0}
is called an access structure. If the access structure satisfies (2.1) and (2.2), then it is called a(k, n)-threshold SS scheme.
A1 = {A ∈ 2 : k ≤ |A| ≤ n},(2.1)

A0 = {A ∈ 2 : 0 ≤ |A| ≤ k − 1}.

(2.2)

In SS schemes, it obviously holds that A1 ∩ A0 = ∅. If it also holds that A1 ∪ A0 = 2 , theaccess structure is called complete. Note that any access structure must satisfy the following
monotonicity.
A ∈ A1 ⇒ A0 ∈ A1 for all A0 ⊇ A
00A ∈ A0 ⇒ A ∈ A0 for all A ⊆ A

(2.3)
(2.4)

Therefore, we can define the family of minimal qualified sets and the family of maximal forbidden sets as follows:A−
1 = {A ∈ A1 : A − {V } 6∈ A1 for any V ∈ A},

(2.5)

A+
0 = {A ∈ A0 : A ∪ {V } 6∈ A0 for any V ∈ V − A}.

(2.6)

Note that the complete access structure can be determined from the minimal qualified set A−
1+or the maximal forbidden set A0 from the monotonicity in (2.3) and (2.4) and the definition ofcompleteness, i.e., A1 ∪ A0 = 2 .

2.2. Basic Model of Secret Sharing Schemes

17

Definition 2.1 For a given access structure Γ = {A1 , A0}, we call V ∈ V a significant share if
there exists a share set A ∈ 2 such that A ∪ {V } ∈ A1 but A ∈ A0 . A non-significant share iscalled a vacuous share.
2
Example 2.2 Consider the following minimal qualified sets A−
1 with four shares V = {V1 , V2 , V3 ,V4 }.
A−
1 = {{V1 , V2 }, {V1 , V3 }, {V1 , V4 }, {V2 , V3 }, {V2 , V4 }}.

(2.7)

From the monotonicity in (2.3), the qualified set A1 becomes
A1 = {{V1 , V2 , V3 , V4 }, {V1 , V2 , V3 }, {V1, V2 , V4 }{V2 , V3 , V4 }, {V2 , V3 , V4 },{V1 , V2 }, {V1 , V3 }, {V1, V4 }, {V2 , V3 }, {V2 , V4 }}.

(2.8)

Since we assume that the access structure is complete, the family of forbidden sets are obtainedby A0 = 2 − A1 as follows.
A0 = {{V3 , V4 }, {V1 }, {V2 }, {V3 }, {V4}, ∅}.

(2.9)

From the monotonicity in (2.4), (2.9) is equivalent toA+
0 = {{V3 , V4 }, {V1 }, {V2 }}.

(2.10)
2+
For simplicity, we define the access structures of SS schemes by A−
1 and/or A0 insteadof Γ = {A1 , A0} in the following sections. Furthermore, we omit the empty set ∅ from theforbidden sets since it is obvious that ∅ ∈ A0.

2.2.2 Definitions of Secret Sharing Schemes
In this section, we define SS schemes for general access structures. We assume that secret S andeach share Vi are random variables, which take values in finite fields FS and FVi , respectively.
def
Then, a set A = {Vi1 , Vi2 , . . . , Viu }(⊆ V ) takes values in F = FVi1 × FVi2 × · · · × FViu .
In the case that A ⊆ V is a qualified set, S is uniquely determined from A. Hence, we have
H(S|A) = 0, where H(S|A) is the conditional entropy defined by (1.2).
On the other hand, in the case that A ⊆ V is a forbidden set, S must be independent from
A. Letting PS be the joint probability distribution of (S, A), it must hold that
PS| (s|a) = PS (s)(2.11)

for any s ∈ FS and a ∈ F . If we represent the independence by the entropy functions, we have
H(S|A) = H(S) where H(S) is the entropy defined by (1.1). Therefore, SS schemes can be
defined as follows.

Chapter 2. Introduction to Secret Sharing Schemes

18

Definition 2.3 Let Γ = {A1 , A0} be a given access structure with V = {V1 , V2 , . . . , Vn }. Then,{Γ, V , S} is called a secret sharing (SS) scheme if it satisfies
for any A ∈ A1 ,(2.12)

H(S|A) = H(S) for any A ∈ A0 .

(2.13)

H(S|A) = 0

2
In the case of (k, n)-threshold SS schemes, (2.12) and (2.13) become
H(S|A) = H(S) for any 0 ≤ |A| ≤ k − 1,
H(S|A) = 0

for any k ≤ |A| ≤ n.

(2.14)(2.15)For any SS scheme, the following theorem holds.
Theorem 2.4 (Karnin et al. [58], Capocelli et al. [24]) Let Γ = {A1, A0} be a given accessstructure with shares V = {V1 , V2 , . . . , Vn }. Then, it holds for every significant share Vi that
H(Vi ) ≥ H(S).

(2.16)
2

Note that Theorem 2.4 is proved for any general access structures [24] in addition to (k, n)
threshold access structures [58]. The proof of Theorem 2.4 is omitted since it will be given in
Chapter 3 as a special case of ramp SS schemes. The SS scheme attaining H(S) = H(Vi ) for alli = 1, 2, . . . , n is called ideal.
Next, we consider what kind of S can be realized as an ideal SS scheme.
Theorem 2.5 (Blundo et al. [19]) Let {Γ, V , S} be a SS scheme with a secret S. Then, for any
other secret S 0 such that FS 0 = FS and PS (s) > 0, PS 0 (s) > 0 for all s ∈ FS , a SS scheme{Γ, V , S 0} can be constructed from the SS scheme {Γ, V , S} without changing the entropy of
every A ∈ A0 .
2
Now, consider the case that S 0 is uniformly distributed on FS . Then, from Theorems 2.4
and 2.5, it must hold for any significant share Vi that H(Vi ) ≥ log |FS | since we have H(Vi ) ≥H(S 0 ) = log |FS 0 | = log |FS |. Hence, the following theorem holds.
Theorem 2.6 (Blundo et al. [19]) Let Γ = {A1, A0 } be a given access structure with shares
V = {V1 , V2 , . . . , Vn }. Then, it must hold for each significant share Vi that
H(Vi ) ≥ log |FS |.

(2.17)
2

2.2. Basic Model of Secret Sharing Schemes

19

Note that any ideal SS scheme must satisfy H(Vi ) = H(S) ≤ log |FS | for all i, where the lastinequality holds with equality if and only if PS is an uniformly distribution. Hence, from (2.17),
an ideal SS scheme can be constructed only when S is uniformly distributed on FS .1
It is also known that in the case of (k, n)-threshold SS schemes, an ideal SS scheme caneasily be constructed for any k and n [99], which will be shown in the next section. Now, letdef
us define the coding rate of a share Vi as ρi = H(Vi )/H(S), for i = 1, 2, . . . , n. Since eachρi may be different in the case of general access structures, it is cumbersome to treat every ρiindependently in the case that n is large. Hence, we consider only the following average coding
rate ρ̃ and worst coding rate ρ∗ in this thesis.
n

1X
ρ̃ =
ρi ,
n i=1
def

def

ρ∗ = max ρi .
1≤i≤n

(2.18)(2.19)

Note that if ρi = 1 for all i, the SS scheme is ideal. Since ρi ≥ 1, i = 1, 2, . . . , n, must holdfor any access structures from Theorem 2.4, ρ̃ = 1 or ρ∗ = 1 are the necessary and sufficientconditions for a SS scheme to be ideal [24], [58].
Remark 2.7 Note that a vacuous share, i.e., a non-significant share, plays no roll in SS schemes,
and hence, ρi = 0 can always be attained for every vacuous share Vi in any access structure
Γ. Furthermore, if there exists a vacuous share Vi with ρi > 0, the average coding rate can be
reduced by letting ρi = 0 without changing the rates of significant shares. Hence, in this thesis,
we assume that every share in SS schemes is significant.
2

2.2.3 Examples of Secret Sharing Schemes
In this section, we introduce two kinds of SS schemes proposed by Shamir [99] and BenalohLeichter [4].
2.2.3.1 Shamir’s Threshold Schemes
Shamir’s threshold scheme is an ideal (k, n)-threshold SS scheme, which is constructed by thefollowing procedures.
Construction 2.8 (Shamir [99]) For a given secret S ∈ FS , let R1 , R2 . . . , Rk−1 be independent
uniform random numbers on FS . Then, the i-th share Vi is constructed by Vi = f (i), where f (x)is the following polynomial of degree k − 1 on FS .
f (x) = S + R1 x1 + R2 x2 + · · · + Rk−1 xk−1 .
In this case, it holds that FV1 = FV2 = · · · = FVn = FS .
1

Note that Theorems 2.4–2.6 also hold in quantum settings, which is proved in [87].

(2.20)
2

Chapter 2. Introduction to Secret Sharing Schemes

20

Next, we check that the share set V obtained by Construction 2.8 satisfies Definition 2.3.
Now, we assume that S is uniformly distributed on FS , i.e., H(S) = log |FS |. Then, for any
share set A = {Vi1 , Vi2 , . . . , Viq }, we have the following relation.




 



1 0 0 ··· 0
S
S
f (0)
1 0 ··· 0  f (i1)   0 i1 i2 · · · ik−1   R1 
11
  R1 
 0


 

  R2  f (i2)   0 i i2 · · · ik−1   R2  def 2
 . (2.21) =  ..

2
2
=




 ..   .. .. .. . .
  .. 
 .
..
..
M
 . 
 .   . . .
.
.  . 
0
2
k−1
Rk−1
Rk−1
f (iq )
0 iq iq · · · iq
In the case of q = k, the matrix M is the so-called Vandermond matrix, which has the determinantY(iv − iu ).
(2.22)
det M =
1≤u<v≤k

Note that det M 6= 0 holds since iu 6= iv for any u 6= v. Hence, S and R1 , R2 , . . . , Rk−1 can be
determined uniquely from f (i1), f (i2 ), . . . , f (ik ) by solving (2.21).
We also note that the solution of (2.21) can be obtained by the polynomial interpolation.
From k coordinates (i1, f (i1 )), (i2, f (i2)), . . . , (ik , f (ik )), f (x) can be constructed as
f (x) =kX

f (iu )

u=1

kY
x − ivv=1
v6=uiu − iv.

(2.23)

Hence, S is obtained by S = f (0), i.e.,S=kXf (iu )

u=1

k
Y

iv
.
i − iuv=1 v(2.24)

v6=u

On the other hand, in the case of q ≤ k − 1, we have the following relation.
H(S|A) = H(SA) − H(A)(a)

= H(SR1 R2 · · · Rk−1 ) − H(A)(b)

= H(S) + H(R1 ) + H(R2 ) + · · · + H(Rk−1 ) − H(A)= k log |FS | − H(A)(c)≥ k log |FS | − (k − 1) log |FS |= log |FS | = H(S),where (a)(b)(c) hold because of the following reasons.
(a): SA and (S, R1 , R2, . . . , Rk−1 ) has one to one correspondence from (2.21).
(b): S, R1 , R2, . . . , Rk−1 are mutually independent.

(2.25)

2.2. Basic Model of Secret Sharing Schemes

21(c): H(A) ≤ log |FS |k−1 .
Since it always holds that H(S) ≥ H(S|A), we have H(S|A) = H(S). Therefore, any share set
V obtained by Construction 2.8 satisfies Definition 2.3. Finally, in the case that S is uniformly
distributed, Shamir’s threshold scheme is an ideal SS scheme since it holds that H(Vi ) = |FVi | =|FS | = H(S) for all i.
Example 2.9 Let us consider a (3, 4)-threshold SS scheme over GF(17) with S = 10. If R1 = 5
and R2 = 7, the polynomial of degree 2 becomesf (x) = 10 + 5x + 7x2 .

(2.26)

Then, we have shares V1 = 5, V2 = 14, V3 = 3, and V4 = 6. From (2.24), it is easy to check thatany three out of four shares can decrypt secret S. As an example, from V1 , V2 , and V4 , we cancalculate secret S as follows.
S=5

2
4
4
2
1
1
+ 14
+6
= 2 + 6 + 2 = 10.
2−14−1
1−24−2
1−42−4(2.27)
2

2.2.3.2 Monotone Circuit Construction
A monotone circuit construction is a construction method of SS schemes for general accessstructures, which uses (t, t)-threshold SS schemes.
Construction 2.10 (Benaloh-Leichter, [4]) Consider a SS scheme for a secret S with a given− def
general access structure Γ = {A1 , An
, . . . , Aq }. For Aj = {Vi1 , Vi2 , . . . ,0 } where A1 = {A1 , A2o

Vi| j | }, j = 1, 2, . . . , q, let W

j

def

=

Wi1 j , Wi2 j , . . . , Wi| j | be the share set of an (|Aj |, |Aj |)jthreshold SS scheme with secret S, and let Zi
Zi

j

j

be defined byo( n
if Vi ∈ Aj
Wi j=∅
if Vi 6∈ Aj .

(2.28)

Then, each share for access structure Γ is given by
Vi =

q
[

Zi j .

(2.29)

j=1

2
It can be checked by the next example that the share set V obtained by Construction 2.10
satisfies Definition 2.3.

22

Chapter 2. Introduction to Secret Sharing Schemes

Example 2.11 Let us consider a SS scheme for a secret S with the access structure given by(2.8) and (2.9) in Example 2.2. From (2.7), we have that A1 = {V1 , V2 }, A2 = {V1 , V3 },A3 = {V1 , V4 }, A4 = {V2 , V3 }, and A5 = {V2 , V4 }. Since it holds that |Ai | = 2 for all i, we
first construct (2, 2)-threshold SS schemes for secret S as follows.
(2.30)
W 1 = W1 1 , W2 1 = {R1 , S − R1 },
2
2
2= {R2 , S − R2 },(2.31)
W = W1 , W3
W 3 = W1 3 , W4 3 = {R3 , S − R3 },(2.32)
(2.33)
W 4 = W2 4 , W3 4 = {R4 , S − R4 },555
W = W2 , W4
= {R5 , S − R5 },(2.34)

where R1 , R2, . . . , R5 are uniform random numbers on FS . From (2.28) and (2.29), the set ofshares are determined as follows.
(2.35)
V1 = W1 1 , W1 2 , W1 3 = {R1, R2 , R3 },
V2 = W2 1 , W2 4 , W2 5 = {S − R1 , R4 , R5 },(2.36)
V3 = W3 2 , W3 4 = {S − R2, S − R4 },(2.37)
(2.38)
V4 = W4 3 , W4 5 = {R3 , S − R5 }.

It can easily be checked that (2.35)–(2.38) satisfy Definition 2.3. This construction method is not
ideal since it holds that ρ1 = ρ2 = 3, ρ3 = ρ4 = 2, i.e., ρ̃ = 52 , and ρ∗ = 3.
2
Remark 2.12 Construction 2.10, which is proposed originally in [4], is called the monotone
circuit construction because this method it is based on monotone boolean circuits as follows.
First, consider a binary representation {v1, v2, . . . , vn } ∈ {0, 1}n for a share set A ⊆ V
defined by
1 if Vi ∈ A
vi =(2.39)
0 if Vi 6∈ A.

Then, let C(v1, v2, . . . , vn ) be a boolean function such that its output does not change from 1
to 0 even if any input vi changes from 0 to 1. Such a boolean circuit is called a monotone
boolean circuit. Note that, from the monotonicity of access structures in (2.3), we can constructa monotone boolean function such that the output is 1 if and only if all the inputs corresponding
to a qualified set are 1.
One realization of such a monotone boolean circuit is given by the following disjunctive
normal boolean formula,"#_^C(v1 , v2, . . . , vn ) =vi ,(2.40)∈A−1

Vi ∈where disjunction ∨ and conjunction ∧ are “and” and “or” gates, respectively. In Construction
W
2.10, Vi ∈ vi corresponds to the decoding of the (|A|, |A|)-threshold SS scheme. See [4] formore details.
2Chapter 3
Evaluations of Coding Rates in Secret
Shairng Schemes
3.1 Introduction
In a SS scheme, as shown in Theorem 2.4, the coding rate ρi must satisfy that ρi ≥ 1 for eachsignificant share Vi , and the SS scheme is called ideal if it holds that ρi = 1 for any i. Note that,in SS schemes introduced in Chapter 2, we assume that every subset A ∈ 2 is either a qualified
set or a forbidden set. But, in the case of ramp access structures such that some subsets of V
are allowed to have intermediate properties between the qualified and forbidden properties, it ispossible to decrease the coding rate ρi less than 1. The SS schemes having ramp access structure
are called ramp SS schemes [9], [119].
For example, in (k, L, n)-ramp SS schemes [9], [119], secret information S can be decrypted
completely from any k out of n shares, while no information of S can be obtained from k − L orless shares. Furthermore, the information of S leaks out from arbitrary k − j (1 ≤ j ≤ L − 1)
out of n shares with the amount of Lj H(S). It is known that arbitrary (k, L, n)-ramp SS schemes
must satisfy that H(Vi ) ≥ H(S)for all i = 1, 2, . . . , n, and how to construct (k, L, n)-ramp SS
L
schemes attaining the equality [119]. Therefore, ramp SS schemes can achieve efficient coding
rate at a little sacrifice of security. Ramp SS schemes for general access structures are discussed
in [71], [86], [88]. In the case of L = 1, ramp SS scheme coincides with ordinal SS schemes,
and hence, ramp SS schemes are extensions of ordinal SS schemes. To distinguish ordinal SS
schemes from ramp SS schemes with L ≥ 2, we call the access structure of ordinal SS schemes
perfect.
In this chapter, we consider the coding rates of ramp SS schemes for general access structures.
First, we point out that there may exist non-significant shares in ramp SS schemes, and weclassify shares into three categories as super-additive, additive, and sub-additive. Then, we showthat the lower bound of coding rate must be different depending on the categories. Based onthese arguments, we define well-realized ramp SS schemes as extensions of ideal perfect SS
schemes, which were defined in [71], and we analyze what kind of ramp SS schemes cannot bewell-realized. In perfect SS schemes, it is known that some access structures cannot become23

24

Chapter 3. Evaluations of Coding Rates in Secret Shairng Schemes

ideal [22], [24], [30]. Especially in [15], general access structures for non-ideal SS schemes are
represented, which includes the results of [22], [24], [30] as special cases. In this chapter, weclarify the general access structures of ramp SS schemes that cannot be well-realized. The result
can be considered as an extension of the result in [15]. We note our result also include theexamples of ramp SS schemes that are not well-realized in [88] as special cases.
This chapter is organized as follows: In the next section, we define ramp SS schemes forgeneral access structures. In Section 3.3.1, we point out that there may exist non-significant
shares in ramp SS schemes and we classify the shares of ramp SS schemes into three categories.
Furthermore, we show that the lower bound of each share depends on the category of shares, andwe define well-realized ramp SS schemes as extensions of deal SS schemes defined in Section
2.2.2. Section 3.3.2 is devoted to give the sufficient condition that ramp SS scheme is not wellrealized, which is an extension of the result in [15]. Furthermore, we show that the ramp accessstructure satisfying such condition includes the examples of non-ideal ramp SS schemes in [88]as special cases. The contents of this chapter are appeared in [51].

3.2 Definition of Ramp Secret Sharing Schemes
In this section, we define ramp SS schemes based on [9], [71], [119] as an extension of SS
schemes presented in Section 2.2.2.
Let V be the set of shares and denote by 2 all the subsets of V . Suppose that L + 1 families
Aj ⊆ 2 , j = 0, 1, 2, . . . , L, satisfy the following.
L−j
H(S), for any A ∈ Aj
(3.1)
L
Equation (3.1) implies that secret S leaks out from any set A ∈ Aj with the amount of Lj H(S).
Especially, S can be decrypted completely from any A ∈ AL, and every A ∈ A0 leaks out
no information of S. Note that, in the case of L = 1, ramp SS scheme reduces to ordinal
SS scheme defined in Section 2.2.2. To distinguish ordinal SS schemes from ramp schemes,
ordinal SS schemes are called perfect SS schemes. We call ΓR = {A0, A1, . . . , AL } the accessstructure of the ramp SS scheme with L + 1 levels. Without loss of generality, we can assume
that Aj ∩ Aj 0 = ∅ for j 6= j 0 . Furthermore, the access structure ΓR is called complete if ΓRSsatisfies that Lj=0 Aj = 2 .
For example, the access structure of a (k, L, n)-threshold ramp SS scheme [9], [119] is defined as follows:
H(S|A) =A0 = {A ∈ 2 : 0 ≤ |A| ≤ k − L},(3.2)

Aj = {A ∈ 2 : |A| = k − L + i} for 1 ≤ j ≤ L − 1,

(3.3)

AL = {A ∈ 2 : k ≤ |A| ≤ n}.

(3.4)

Note that (k, L, n)-threshold ramp SS schemes can easily be constructed by modifying Shamir’s
threshold SS schemes in (2.20) in Construction 2.8 as follows.
f (x) = S0 + S1 x1 + · · · + SL−1 xL−1 + RL xL + RL+1 xL+1 + · · · + Rk−1 xk−1 ,(3.5)

3.3. Lower Bounds of Coding Rates in Secret Sharing Schemes

25

where a secret is an L-tuple {S0 , S1, . . . , SL−1 } and RL , RL+1 , . . . , Rk−1 are independent uniform random numbers. It is known that this construction can attain that ρi = L1 , i = 1, 2, . . . , n,
for any k, L and n.
Now, defining families Ǎj and Âj , j = 0, 1, . . . , L, as
def

Ǎj =

L
[

Ak ,

(3.6)

Ak ,

(3.7)

k=j
def

Âj =

j
[

k=1

the monotonicity of perfect SS schemes in (2.3) and (2.4) are extended as follows:
A ∈ Ǎj ⇒ A0 ∈ Ǎj for all A0 ⊇ A(3.8)

A ∈ Âj ⇒ A0 ∈ Âj for all A0 ⊆ A(3.9)

Therefore, the minimal and the maximal families of an access structure denoted by ΓR− =
−
−
+
+
R+
{A−
= {A+
0 , A1 , . . . , AL } and Γ
0 , A1 , . . . , AL }, respectively, can be defined as
A−
j = {A ∈ Aj : A − {V } 6∈ Ǎj for any V ∈ A},(3.10)

A+
j = {A ∈ Aj : A ∪ {V } 6∈ Âj for any V(3.11)∈ 2 − A}.

The coding rates ρi , i = 1, 2, . . . , n, the average coding rate ρ̃, and the worst coding rate ρ∗ canalso be defined in the same way as perfect SS schemes in (2.18) and (2.19).
From the above considerations, we can define the set function ` : 2 → {0, 1, . . . , L} thatgives the level of A ∈ 2 , i.e., if A ∈ Aj , then `(A) = j. Clearly, it holds that `(∅) = 0 and`(V ) = L. From the monotonicity defined by (3.8), it also holds that`(A) ≤ `(B),
for any share sets A and B satisfying A ⊆ B. Furthermore, we have from (3.1) that`(A)
H(S|A) = 1 −H(S).
L(3.12)(3.13)

3.3 Lower Bounds of Coding Rates in Secret Sharing Schemes
In this section, we consider the lower bound of coding rate ρi in ramp SS schemes. First, we
define a well-realized ramp SS scheme as an extension of an ideal perfect SS scheme. Then, we
discuss what kind of ramp access structures cannot be well-realized.

3.3.1 Well-realized Ramp Secret Sharing Schemes
The following lemma holds for ramp SS schemes.

Chapter 3. Evaluations of Coding Rates in Secret Shairng Schemes

26

Lemma 3.1 Let ΓR be an access structure with L + 1 levels. Then, for share sets A, B, C ⊆ V ,it holds that
I(A; B; S|C) =`(AC) + `(BC) − {`(ABC) + `(C)}
H(S),
L(3.14)

def

where I(A; B; S|C) is defined by I(A; B; S|C) = I(A; B|C) − I(A; B|SC) and the conditional mutual information I(X; Y |Z) is defined by (1.4).1
2
Remark 3.2 The left hand side of (3.14) can be considered as the information commonly contained in random variables A, B and S with given C, intuitively. However, we note that
I(X; Y ; Z|W ) may be negative although the conditional mutual information I(X; Y |Z) is always non-negative [124]. We also note that I(X; Y ; Z|W ) takes the same value for any permutation of X, Y, Z, e.g., I(X; Y ; Z|W ) = I(Z; Y ; X|W ).
2
Proof of Lemma 3.1
I(A; B; S|C) = I(S; A; B|C) = I(S; A|C) − I(S; A|BC)= H(S|C) − H(S|AC) − {H(S|BC) − H(S|ABC)}`(AC) + `(BC) − {`(ABC) + `(C)}
=
H(S),
L
where the last equality follows from (3.13).
From the definition of I(A; B; S|C), (3.14) can be transformed intoI(A; B|C) = I(A; B|CS) +(3.15)
2`(AC) + `(BC) − {`(ABC) + `(C)}
H(S). (3.16)
L

Hence, the following theorem by Dijk can easily be obtained by letting L = 1 in (3.16).
Corollary 3.3 (Dijk [115, Theorem 2.1.5]) Let Γ be an access structure for a perfect SS scheme.
Then, for share sets A, B, C ⊆ V , it holds that
 I(A; B|C) − H(S) if AC, BC ∈ A1 and C ∈ A0 ,I(A; B|C) + H(S) if AC, BC ∈ A0 and ABC ∈ A1 , (3.17)
I(A; B|SC) =
I(A; B|C)
otherwise.
2

Note that the proof of Lemma 3.1 is simpler than Dijk’s proof. Furthermore, the next corollary holds by letting C = ∅ in (3.16).
Corollary 3.4 For any access structure ΓR with L + 1 levels, it holds that
I(A; B) = I(A; B|S) +`(A) + `(B) − `(AB)
H(S)
L(3.18)

for any A, B ⊆ V .
1

2
def

For simplicity of notion, we use AB to represent the union of sets A and B, i.e., AB = A ∪ B.

3.3. Lower Bounds of Coding Rates in Secret Sharing Schemes

27

Letting B = {Vi } ⊆ V in (3.18), we have`(A{Vi }) − `(A) − `({Vi })H(S) = −I(A; Vi ; S).
L(3.19)The left hand side of (3.19) represents how the security level changes when Vi cooperates with
A. Now, we classify each share according to the sign of the change.
Definition 3.5 In a ramp SS scheme for an access structure ΓR with L + 1 levels, if share Vi ∈ Vsatisfiesmax {`(A{Vi }) − `(A) − `({Vi })} > 0,

(3.20)

max {`(A{Vi }) − `(A) − `({Vi })} = 0,

(3.21)

max {`(A{Vi }) − `(A) − `({Vi })} < 0,(3.22)

⊆
⊆
⊆

−{Vi}

−{Vi}

−{Vi}

then Vi is called super-additive, additive, sub-additive, respectively. If Vi is an additive sharewith `(Vi ) = 0, then it is called a vacuous share.
2
In the case that Vi is a super-additive share, there exists a share set A such that A and Vi
can obtain more information of S if they cooperate with each other than they do not gather
together. In the case of perfect SS schemes, i.e., L = 1, a super-additive share must satisfy
that `(A{Vi }) = 1 and `(A) = 0 for some A ⊆ V . Hence, a super-additive share becomes asignificant share in this case.
If an additive share Vi satisfies that `(Vi ) = 0, Vi plays no roll, and hence, such Vi is calledvacuous. However, in the case of additive share Vi with `(Vi ) > 0, there exists a share set
A ⊆ V − {Vi } that has the supplementary information of Vi for S. For instance, let S ={S h1i , S h2i, . . . , S hLi } and Vi = S hii , i = 1, 2, . . . , L, be a secret and shares, respectively. Then,every share Vi , i = 1, 2, . . . , L, is an additive share with `(Vi ) > 0.
A sub-additive share may also occur in ramp SS schemes. From (3.22), sub-additive shares
may contain the same information of S. As an example, letting S = {S h1i , S h2i , . . . , S hLi } be asecret, and V1 = S h1i , Vi = {S h1i , S hii }, i = 2, 3, . . . , L, be shares, the share V1 is sub-additive.
Note that in perfect SS schemes with no vacuous shares, there is no additive and sub-additive
shares because each share V ∈ V must satisfy that `({V }) = 0. In the case of ramp SS schemes,
we also assume that no vacuous shares exist in the same way as perfect SS schemes, but nonvacuous additive shares and/or sub-additive shares may exist.
The next corollary holds from (3.16).
Corollary 3.6 (Okada-Kurosawa [88]) In any ramp SS scheme for access structure ΓR with
L + 1 levels, it holds for any A, B ⊆ V that(a) `(AB) − `(A)

H(B|A) = I(B; S|A) + H(B|AS) =H(S) + H(B|AS),
L`(AB) − `(A)
H(B) ≥ max H(B|A) ≥ max
H(S).
⊆ −
⊆ −
L

(3.23)(3.24)

28

Chapter 3. Evaluations of Coding Rates in Secret Shairng Schemes

Especially, by letting B = {Vi } ⊆ V in (3.24), we haveρi ≥`(A{Vi }) − `(A).
⊆ −{Vi }L
max(3.25)
2

Note that equality (a) in (3.23) is obtained by replacing A and C with B and A, respectivelyin (3.16). In the case of perfect SS schemes, i.e., L = 1, it holds for any significant share Vi thatmax {`(A{Vi }) − `(A)} = 1. Hence, Theorem 2.4, which gives the lower bound of ρi for⊆ −{Vi }perfect SS schemes, can be derived from Corollary 3.6.
We note that the lower bound of ρi given by (3.25) may not be tight because I(A; B) =H(B) − H(B|A) may be positive for the first inequality in (3.24). Actually, we show that
(3.25) is not tight in the case of sub-additive shares.
Theorem 3.7 In any ramp SS scheme for access structure ΓR with L + 1 levels, if V [ ∈ V is
sub-additive, then the coding rate of V [ , say ρ[ , satisfies thatρ[ ≥`({V [})>
L`(A{V [ }) − `(A).
L
⊆ −{V [ }max

(3.26)
2

Proof of Theorem 3.7 From (3.18) and (3.23), we haveH(V [ )= H(V [ |A) + I(V [; A)`(A) + `({V [ }) − `(A{V [ })`(A{V [ }) − `(A)[
H(S) + H(V |AS) +H(S) + I(A; V [|S)=L
L`(A) + `({V [ }) − `(A{V [})`(A{V [ }) − `(A)
H(S) +
H(S)≥L
L`({V [ })=H(S).
(3.27)
L
Hence, the first inequality in (3.26) holds. Furthermore, in the case of sub-additive shares, itholds from (3.22) that for any A ⊆ V`(A) + `({V [ }) − `(A{V [ })H(S) > 0.
(3.28)
L
This means that the second inequality in (3.26) holds.
2
From Theorem 3.7, sub-additive shares are inefficient. But, their coding rates can be improved by decreasing only the level of V [ , i.e., `({V [}), to max {`(A{V [ }) − `(A)}, which⊆−{V [ }

means that secret S becomes more secure against V [. Note that the new access structure obtainedby this modification still satisfies the monotonicity. This modification means that the sub-additive
share V [ becomes additive, and hence, the lower bound of the modified V [ can be evaluated by(3.25). Hence, from the viewpoint of coding rates and security, we should take this modification, by which all the shares become additive or super-additive and they satisfy (3.25). Based on(3.25), we now extend the notion of ideal perfect SS schemes to ramp SS schemes.

3.3. Lower Bounds of Coding Rates in Secret Sharing Schemes

29

Definition 3.8 A ramp SS scheme is called well-realized if every share Vi ∈ V satisfies
ρi =`(A{Vi }) − `(A).
⊆ −{Vi }L
max(3.29)
2

It is defined in [71] that a ramp SS scheme is ideal if ρi satisfies ρi = L1 for all i since any ρimust satisfy ρi ≥ L1 . Since it holds that
1`(A{Vi }) − `(A)≥ ,⊆ −{Vi}L
L
max(3.30)

an ideal ramp SS scheme is a well-realized ramp SS scheme. Actually, any (k, L, n)-threshold
ramp SS schemes are ideal and well-realized.
But, there exist many ramp access structures that satisfies (3.30) with strict inequality. Hence,from (3.25) in Corollary 3.6, there are many ramp SS schemes that are well-realized but not ideal.
The following is such an example.
Example 3.9 Consider the following ramp access structure ΓR
1 with three levels for three shares
V = {V1 , V2 , V3 }.
A−
2 = {{V1 , V2 }},(3.31)

A1 = {{V2 , V3 }},(3.32)

A+
0 = {{V1 }, {V1 , V3 }}.

(3.33)

Then, a ramp SS scheme for ΓR
1 is realized as follows.
V1 = {R1 , R2},

(3.34)

V2 = {S1 − R1, S2 − R2 },(3.35)

V3 = {R1 },(3.36)

where a secret S is given by S = {S1 , S2} and R1, R2 are independent uniform random numbers.
It is easy to check that ρ1 = ρ2 = 1 and ρ3 = 12 , and hence, the ramp SS scheme for ΓR
1 is wellrealized but not ideal.
2
In the case of ideal perfect SS schemes with L = 1, both sides of (3.30) becomes 1 because
for any significant share Vi ∈ V , there exist a share set A ⊆ V − {Vi } such that `(A{Vi }) = 1
and `(A) = 0. Hence, both of ideal ramp SS schemes and well-realized ramp SS schemes areextensions of ideal perfect SS schemes. But, ideal ramp SS schemes may not be well-realized.
From Theorem 3.7, the following theorem obviously holds.
Theorem 3.10 Any ramp SS schemes with sub-additive shares cannot be well-realized.

2

Note that we need not care Theorem 3.10 in the case of perfect SS schemes since there exists
no sub-additive share. In the next section, we show that there exist ramp access structures thatcannot be well-realized.

Chapter 3. Evaluations of Coding Rates in Secret Shairng Schemes30

3.3.2 Ramp Access Structures With No Well-realized Ramp Secret Sharing Schemes
In this section, we show that even if all the shares Vi , i = 1, 2, . . . , n, are super-additive or
additive shares, there exist an access structures that cannot be well-realized.
Lemma 3.11 For a ramp SS scheme with access structure ΓR with L + 1 levels, let {X i }m
i=1 andSmSmm{Y i }i=1 be partitions of A and B, respectively, i.e., A = k=1 X k , B = k=1 Y k , X k ∩X k0 =Y k ∩Y k0 = ∅ for k 6= k 0. Note that X k and Y k may be empty. Then, I(A; B) can be represented
as
!
m
X
H(S)
ϑj + `(A) − `(AB)
I(A; B) =+ Υ,(3.37)
L
j=1
where ϑj and Υ are defined for B i =defSi

k=1 Y i and B 0 = ∅ byϑj = `(X j B j ) − `(X j B j−1 ),
m
X
def
Υ=
{I(X j ; Y j |B j−1 ) + I(A − X j ; Y j |X j B j−1 S)} ,(3.38)(3.39)

j=1

which are non-negative.

2

Proof of Lemma 3.11
I(A; B)`(A) + `(B) − `(AB)
H(S)
L
m
X
`(A) + `(B) − `(AB)=
I(A; Y j |B j−1 S) +
H(S)
L
j=1

(a)

= I(A; B|S) +=m
X{I(X j ; Y j |B j−1 S) + I(A − X j ; Y j |X j B j−1 S)} +

j=1

m
(b) X

=

j=1

(

`(A) + `(B) − `(AB)
H(S)
L

I(X j ; Y j |B j−1 ) + I(A − X j ; Y j |X j B j−1 S)`(A) + `(B) − `(AB)`(X j B j ) + `(B j−1 ) − `(X j B j−1 ) − `(B j )H(S) +
H(S)
+
L
L
!
m
X
H(S) `(A) + `(B) − `(AB)(c)=ϑj + `(B 0 ) − `(B m )+H(S) + Υ
L
L
j=1
!
m
X
H(S)
+ Υ,
(3.40)=
ϑj + `(A) − `(AB)L
j=1

3.3. Lower Bounds of Coding Rates in Secret Sharing Schemes

31

where equalities (a) and (b) are obtained from (3.18) and (3.16), respectively, and equality (c)holds because B m = B and `(B 0 ) = 0.
2
From (3.23), we have
H(A|B) =`(AB) − `(B)
H(S) + H(A|BS).
L

Hence, adding both sides of (3.37) and (3.41), we obtain
!
m
X
H(S)
H(A) =
ϑj + `(A) − `(B)
+ Υ + H(A|BS).
L
j=1(3.41)(3.42)

Since Υ and H(A|BS) are nonnegative, the next theorem holds.
Theorem 3.12 In any ramp SS scheme for access structure ΓR with L + 1 levels, H(A) isbounded by
!
m
X
H(S)
,
(3.43)
H(A) ≥
ϑj + `(A) − `(B)L
j=1
where ϑj is defined in (3.38). Hence, at least one share Vi ∈ A must satisfy
!
m
X
1
ρi ≥
ϑj + `(A) − `(B) .
max
L|A| ⊆
j=1(3.44)
2

Letting L = 1 in Theorem 3.12, we have the following corollary.
Corollary 3.13 (Blundo et al. [15], Padró-Sáez [92]) In perfect SS schemes, if there exist partitions of A, B ⊆ V such that `(X i B i ) = 1, `(X i B i−1 ) = 0, i = 1, 2, . . . , m, and `(B) = 0, it
holds that(m + 1)H(S) if A ∈ A1
(3.45)
H(A) ≥
mH(S) if A ∈ A0 .
, and hence,
Therefore, in the case of A ∈ A1 , at least one share Vi ∈ A must satisfy ρi ≥ m+1
msuch SS schemes are non-ideal.
2
We can know from Corollary 3.13 that the access structure treated in [24], [30] cannot berealized by ideal perfect SS scheme as shown in the following example.
Example 3.14 (Capocelli et al. [24]) Let us consider the following access structure with fourshares.
A−
1 = {{V1 , V2 }, {V2 , V3 }, {V3 .V4 }}.

(3.46)

32

Chapter 3. Evaluations of Coding Rates in Secret Shairng Schemes

Let A = {V1 , V2 } ∈ A1 and B = {V3 , V4 }, and consider their partitions such that X 1 = {V2 },X 2 = {V1 }, Y 1 = {V3 }, and Y 2 = {V4 }. Then, we can obtain from (3.45) that H(V1 V2 ) ≥3H(S), and hence, it must hold for i = 1 or i = 2 that ρi ≥ 32 . In the same way, we obtain that
H(A) ≥ 3H(S) for any A ∈ A−
1 . Therefore, this access structure cannot be realized as an ideal
SS scheme.
2
Next, based on Theorem 3.12, we consider the ramp SS schemes treated in [88] and we showthat they are not well-realized.
Example 3.15 Consider the following access structure ΓR
2 with 3 levels for share set V ={V1 , V2 , V3 , V4 }.
A−
1 = {{V1 , V4 }, {V2 , V4 }},(3.47)

A−
2 = {{V1 , V2 , V3 }}.

(3.48)

Then, it must hold that H(V1 V4 ) ≥ 2H(S) and H(V2 V4 ) ≥ 2H(S).

2

Note that each share in ΓR
2 is super-additive. We can easily prove that H(V1 V2 ) ≥ 2H(S)from Theorem 3.12 by letting A = {V1 , V4 }, B = {V2 , V3 }, X 1 = {V4 }, X 2 = {V1 }, Y 1 ={V2 } and Y 2 = {V3 }. Similarly, by letting, X 1 = {V4 }, X 2 = {V2 }, Y 1 = {V1 } and Y 2 ={V3 }, we have H(V2 V4 ) ≥ 2H(S).
In order to realize the access structure ΓR
2 as a well-realized SS scheme, it must hold that
H(V1 ) = H(S), H(V2 ) = H(S), and H(V4 ) = 12 H(S) from Definition 3.8. But this contradicts
the result of Example 3.15. Hence, the ramp access structure ΓR
2 cannot be well-realized.
Example 3.16 (Okada-Kurosawa [88]) For the access structure ΓR
2 defined in (3.47)–(3.48), it
must hold that H(V1 V4 ) ≥ 2H(S) and H(V2 V4 ) ≥ 2H(S), and hence, if S is uniformly distributed,
log |FV1 | + log |FV4 | ≥ 2 log |FS |,(3.49)

log |FV2 | + log |FV4 | ≥ 2 log |FS |.

(3.50)The ramp SS scheme attaining the inequalities (3.49) and (3.50) with equalities is realized asfollows.
V1 = {R1 , R3 },(3.51)

V2 = {R2 , R4 },(3.52)

V3 = {R1 + R4 + S1 , R2 + R3 + S2 },(3.53)

V4 = {R1 + S1 , R2 + S1},

(3.54)

where secret S is given by S = {S1 , S2 } and R1 , R2 , . . . , R4 are independent uniform distributed
random numbers.
23.4. Conclusion

33

Example 3.17 Consider the following access structure ΓR
3 with L = 2 for share set V ={V1 , V2 , V3 , V4 , V5 }.
A−
1 = {{V1 }, {V5 }},(3.55)

A−
2 = {{V1 , V5 }, {V2 , V5 }, {V3 , V5 }, {V1 , V2 , V3 , V4 }}.

(3.56)

Then, it must hold that H(V2 V5 ) ≥ 2H(S).

2

Example 3.17 holds from Theorem 3.12 by letting A = {V2 , V5 }, B = {V1 , V2 , V3 , V4 },X 1 = ∅, X 2 = {V5 }, X 3 = {V2 }, X 4 = ∅, Y 1 = {V4 }, Y 2 = {V3 }, Y 3 = {V1 }, andR
Y 4 = {V2 }. It is easy to check that each share in ΓR
3 is super-additive but Γ3 cannot be wellrealized.
Furthermore, since it must hold from (3.25) that H(V1 ) ≥ H(S), we have H(V1 )+H(V2 V5 ) ≥3H(S), we have the following example.
Example 3.18 (Okada-Kurosawa [88]) For the access structure ΓR
3 defined in (3.55) and (3.56),
if S is uniformly distributed, we have thatlog |FV1 | + log |FV2 | + log |FV5 | ≥ 3 log |FS |.

(3.57)The ramp SS scheme attaining the inequality in (3.57) with equality is realized as follows.
V1 = {S1 , R1},

(3.58)

V2 = {R2 },(3.59)

V3 = {R3 },(3.60)

V4 = {R1 + R2 + R3 + S2 },(3.61)

V5 = {S2 , R2 + S1, R3 + S3 },(3.62)

where secret S is given by S = {S1 , S2} and R1, R2 , R3 are independent uniformly distributed
random numbers.
2
Note that Example 3.17 cannot be derived from Example 3.18.
From the above examples, Theorem 3.12 can be used to check whether given access structures, e.g., the ones treated in [15], [88], can be well-realized or not. However, a general coding
method to attain the inequality in (3.43) with equality is not known although the inequalities(3.49), (3.50), and (3.57) can be attained with equality by known methods.

3.4 Conclusion
In this chapter, we defined ramp SS schemes for general access structures and considered theircoding rates. In ramp SS schemes, we classified shares into three categories, and we derived thelower bound of coding rates for each category of shares. Then, we defined well-realized ramp
SS schemes as extensions of perfect ideal SS schemes. Furthermore, we showed that Theorem
3.12 can be used to check whether given access structures can be well-realized or not.

Chapter 4
Constructions of Secret Sharing Schemes
Based on Integer Programming
4.1 Introduction
In this chapter, we consider the construction method of SS schemes for general access structures.
As shown in Section 2.2.2, the efficiency of SS schemes is measured by the entropy of eachshare. It is known that the entropies of secret S and shares Vi , i = 1, 2, . . . , n, must satisfy
H(Vi ) ≥ H(S) for any access structures [24], [30], [58]. On the other hand, in the case of(k, n)-threshold SS schemes, the optimal SS schemes attaining H(Vi ) = H(S) can easily beconstructed [99]. However, it is hard to derive efficient SS schemes for arbitrarily given generalaccess structures although several construction methods have been proposed.
For example, the monotone circuit construction [4] shown in Section 2.2.3.2 is a method torealize a SS scheme by combining several (m, m)-threshold SS schemes. This method is simple
but inefficient, and hence, it is extended to the decomposition construction [104], which uses
several decomposed general SS schemes. Although the decomposition construction can attainthe optimal coding rates for some special access structures, it cannot construct an efficient SS
scheme in the case that decomposed SS schemes cannot be realized efficiently.
On the other hand, for any given general access structure, a SS scheme can be constructedfrom a (t, m)-threshold SS scheme by a multiple assignment map such that t or more shares ofthe (t, m)-threshold SS scheme are assigned to qualified sets but t − 1 or less shares are assigned
to forbidden sets. A cumulative map is a simple realization of the multiple assignment map [47]–[49], and from its simplicity, it is often used in visual secret sharing schemes for general accessstructures [1], [66], which will be treated in Section 6.4. However, it is known that SS schemes
constructed by the cumulative map are generally inefficient, especially in the case that accessstructures are close to (k, n)-threshold SS schemes with k 6= n. Recently, a modified cumulative
map is proposed to overcome this defect [109]. But, the modified cumulative map is not always
more efficient than the original cumulative map.
In this chapter, we propose a new construction method that can derive the optimal multiple
assignment map by integer programming. The proposed construction method is not only very35

36

Chapter 4. Constructions of Secret Sharing Schemes Based on Integer Programming

simple but also optimal in the sense of multiple assignment maps. Furthermore, it can be applied
to incomplete and/or ramp access structures.
This chapter is organized as follows. In Section 4.2, we introduce the multiple assignment
map. We also introduce the construction methods of the cumulative map and the modified cumulative map, and we point out their defects. To overcome such defects, we propose a new
construction method of the optimal multiple assignment map by integer programming in Section
4.3. Finally, Sections 4.4 and 4.5 are devoted to present the applications of the proposed method
to incomplete access structures and general ramp access structures, respectively. The contents ofthis chapter are appeared in [50].

4.2 Multiple Assignment Schemes
Let Γ = {A1, A0} be a given general access structure with family of qualified sets A1, family of
forbidden sets A0 , and share set V = {V1 , V2 , . . . , Vn }. Then, for a share set of a (t, m)-threshold
(t)
(t)
(t)
SS scheme, W (t,m) = {W1 , W2 , . . . , Wm }, we consider a map ϕΓ : {1, 2, . . . , n} → 2 (t,m)
def S
and a map ΦΓ (A) which is defined as ΦΓ (A) = Vi ∈ ϕΓ (i) for share subset A ⊆ V . Then,ϕΓ is called a multiple assignment map for access structure Γ if each share Vi is determined by
Vi = ϕΓ (i) and ΦΓ (A) satisfies the following conditions:if A ∈ A1 ,

(4.1)|ΦΓ (A)| ≤ t − 1 if A ∈ A0,(4.2)

ΦΓ (V ) = W (t,m) .

(4.3)|ΦΓ (A)| ≥ t

(t)

(t)

To distinguish Wj ∈ W (t,m) from the shares Vi of Γ, we call Wj a primitive share.
Since any (t, m)-threshold SS scheme can easily be constructed as an ideal SS scheme [58],(t)(t)[99], we assume in this chapter that the (t, m)-threshold SS scheme with W (t,m) = {W1 , W2 ,(t)
. . . , Wm } is ideal. Then, the average and worst coding rates defined by (2.18) and (2.19) become
n

1X
ρ̃ =
|ϕΓ (i)|,
n i=1

(4.4)
(4.5)

ρ∗ = max |ϕΓ (i)|,1≤i≤nrespectively, since it holds that ρi = |ϕΓ (i)|.
In the case of t = m, it is known that the multiple assignment map ϕΓ satisfying (4.1)–(4.3)
can be realized for any access structures [47]–[49]. Suppose that access structure Γ = {A1, A0}
has
(4.6)

A+
0 = {F 1 , F 2 , . . . , F m }.
Note that m = |A+
0 |. Then, consider a map ψΓ : {1, 2, . . . , n} → 2[ n (m)oψΓ (i) =Wj,
j:Vi 6∈j(m,m)

defined by(4.7)

4.2. Multiple Assignment Schemes

37

n
o
(m)
(m)
(m)
where F j ∈ A+
and
W
=
W
,
W
,
.
.
.
,
W
is the set of primitive shares of an
m
(m,m)
0
1
2
(m, m)-threshold SS scheme. The multiple assignment map ψΓ is called a cumulative map.
Example 4.1 Assume that n = 4 and an access structure Γ1 is defined byA−
1 = {{V1 , V2 , V3 }, {V1 , V4 }, {V2 , V4 }, {V3 , V4 }},

(4.8)

A+
0 = {{V1 , V2 }, {V1 , V3 }, {V2 , V3 }, {V4 }}.

(4.9)

Then, m = |A+
0 | = 4, and the cumulative map ψΓ1 is given from (4.7) as follows.
o
n
(4)
(4)
,
V1 = ψΓ1 (1) = W3 , W4
n
o
(4)
(4)
V2 = ψΓ1 (2) = W2 , W4
,
n
o
(4)
(4)
V3 = ψΓ1 (3) = W1 , W4
,
o
n
(4)
(4)
(4)
.
V4 = ψΓ1 (4) = W1 , W2 , W3
In this example, it holds that ρ̃ = 49 and ρ∗ = 3.

(4.10)(4.11)(4.12)(4.13)
2

It is known that the next theorem holds for the cumulative map ψΓ .
Theorem 4.2 (Simmons et al. [102]) For any multiple assignment map ϕΓ : {1, 2, . . . , n} →+2 (t,m) with t = m, it must hold that |W (m,m)| ≥ |A+
0 |, i.e., m ≥ |A0 |. The equality holds if
and only if ϕΓ (i) is equal to the cumulative map ψΓ(i) defined by (4.7).1
2
Theorem 4.2 means that, in the case of t = m, the cumulative map ψΓ can minimize thenumber of primitive shares m. But, the minimization of m does not mean the realization of an
efficient SS scheme generally because it does not minimize the average coding rate ρ̃ and/or the
worst coding rate ρ∗ .
For instance, consider the case that Γ is a (k, n)-threshold access structure with k 6= n. If
we construct shares Vi by the cumulative map ψ for this Γ, each Vi must consist of the n−1k−1
 n 
nnprimitive shares of an k−1, k−1 -threshold SS scheme because of |A+| = k−1. This means0n∗that ρ̃ = ρ = k−1 . But, if we use the (k, n)-threshold SS scheme itself, we have ρ̃ = ρ∗ = 1
because each Vi consists of one primitive share. Hence, the cumulative map is quite inefficientin the case that Γ is close to a (k, n)-threshold access structure. In order to overcome this defect,a modified cumulative map is proposed in [109] based on (t, m)-threshold SS schemes. The
modified cumulative map ψΓ0 is constructed as follows.
def−Construction 4.3 (Tochikubo [109]) For a given Γ = {A+
0 , A1 } and a positive integer g =min− |A|, let G0 ⊆ A+
0 be the family defined by∈A1

G0 = {G ∈ A+
0 : |G| ≥ g}.
1

We assume that all ψΓ ’s obtained by all permutations of F j ’s in (4.6) are the same.

(4.14)

38

Chapter 4. Constructions of Secret Sharing Schemes Based on Integer Programmingdef
def Pi
When G0 = {G1 , G2 , . . . , Gu }, let pi = |Gi | − g + 1 for i = 1, 2, . . . , u, and qi =j=1 pj .
Then, consider a (g+qu , n+qu)-threshold SS scheme and the set of primitive shares W (g+qu ,n+qu )(g+q )(g+q )(g+q )= {W1 u , W2 u , . . . , Wn+quu }. Furthermore, let U i be the subset of primitive shares defined byno(g+qu )
(g+qu )
(g+qu )
U i = Wn+qi−1 +1 , Wn+qi−1 +2 , . . . , Wn+qi,(4.15)

where q0 = 0. Then, the modified cumulative map ψΓ0 is defined by



n
o  [
(g+qu )0Uj .
ψΓ (i) = Wi∪
j:Vi 6∈(4.16)j2(k)

In the case that Γ is a (k, n)-threshold access structure, it holds that ψΓ0 (i) = {Wi } fori = 1, 2, . . . , n [109]. Hence, the modified cumulative map ψΓ0 is efficient if Γ is close to a(k, n)-threshold access structures. Furthermore, it is shown [109] that if the access structure Γsatisfiesn2|A+,(4.17)
0 | − |G0 | − (qu − |G0 |) ≥
n−g+1
P
P
then it holds that Vi ∈ |ψΓ0 (i)| ≤ Vi ∈ |ψΓ(i)|, which means that the average coding rate ρ̃of ψΓ0 is smaller than ψΓ .
But, as shown in the following example, ψΓ0 is not always more efficient than ψΓ if Γ does
not satisfy (4.17).
Example 4.4 Consider the access structure Γ1 given by (4.8) and (4.9) in Example 4.1, which
does not satisfy (4.17). Since we have that g = 2 from (4.8), G0 becomes G0 = {{V1 , V2 }, {V1, V3 },def{V2 , V3 }} = {G1 , G2 , G3}. Furthermore, since we have that p1 = p2 = p3 = 1 and q3 = 3, U i ’s
(5)
(5)
(5)
(5)
(5)
are determined as U 1 = {W5 }, U 2 = {W6 }, U 3 = {W7 } for W (5,7) = {W1 , W2 , . . . ,(5)W7 }. Finally, we have from (4.16) that
n
o
(5)
(5)
0
V1 = ψΓ1 (1) = W1 , W7,
(4.18)no(5)(5)
V2 = ψΓ0 1 (2) = W2 , W6,
(4.19)no(5)(5)
V3 = ψΓ0 1 (3) = W3 , W5,
(4.20)
n
o
(5)
(5)
(5)
(5)
V4 = ψΓ0 1 (4) = W4 , W5 , W6 , W7.
(4.21)In this example, the coding rates are given by ρ̃ = 25 and ρ∗ = 4, which are larger than the coding
rates of Example 4.1, i.e., ρ̃ = 49 and ρ∗ = 3.
2

Note that (4.17) does not guarantee that the worst coding rate ρ∗ of ψΓ0 is smaller than ψΓ .
Actually, the next example shows the case that ψΓ0 attains smaller average coding rate but gives
larger worst coding rate than ψΓ .

4.3. Optimal Multiple Assignment Maps

39

Example 4.5 Consider the access structure Γ2 given byA−
1 = {{V1 , V2 , V3 , V5 }, {V1 , V2 , V4 }, {V1 , V3 , V4 }, {V1 , V4 , V5 },{V2 , V3 , V4 }, {V2, V4 , V5 }, {V3 , V4 , V5 }}(4.22)

A+
0 = {{V1 , V2 , V3 }, {V1 , V2 , V5 }, {V1 , V3 , V5 }, {V2 , V3 , V5 },{V1 , V4 }, {V2, V4 }, {V3 , V4 }, {V4 , V5 }}.
Then, the cumulative map ψΓ2 is constructed as follows:
o
n
(8)
(8)
(8)
(8)
,
V1 = ψΓ2 (1) = W4 , W6 , W7 , W8
n
o
(8)
(8)
(8)
(8)
V2 = ψΓ2 (2) = W3 , W5 , W7 , W8
,
n
o
(8)
(8)
(8)
(8)
V3 = ψΓ2 (3) = W2 , W5 , W6 , W8
,
o
n
(8)
(8)
(8)
(8)
,
V4 = ψΓ2 (4) = W1 , W2 , W3 , W4
o
n
(8)
(8)
(8)
(8)
,
V5 = ψΓ2 (5) = W1 , W5 , W6 , W7

(4.23)(4.24)(4.25)(4.26)(4.27)(4.28)

which attains that ρ̃ = ρ∗ = 4. On the other hand, the modified cumulative map ψΓ0 2 is given by
o
n
(7)
(7)
,
(4.29)
V1 = ψΓ0 2 (1) = W1 , W9
n
o
(7)
(7)
V2 = ψΓ0 2 (2) = W2 , W8,(4.30)no(7)(7)
V3 = ψΓ0 2 (3) = W3 , W7,
(4.31)
o
n
(7)
(7)
(7)
(7)
(7)
,
(4.32)
V4 = ψΓ0 2 (4) = W4 , W6 , W7 , W8 , W9
n
o
(7)
(7)
V5 = ψΓ0 2 (5) = W5 , W6.
(4.33)

Observe that the rates of ψΓ0 2 are given by ρ̃ = 13
, ρ∗ = 5. Hence, ψΓ0 gives smaller ρ̃ but larger5ρ∗ than ψΓ .
2

As shown in Examples 4.4 and 4.5, the modified cumulative map cannot always overcome thedefects of the original cumulative maps. Hence, in the next section, we propose a construction
method of multiple assignment maps that can attain the optimal average or worst coding rates
based on integer programming.

4.3 Optimal Multiple Assignment Maps
For a multiple assignment map ϕΓ : {1, 2, . . . , n} → 2 (t,m) A ⊆ V , and k ∈ {0, 1, . . . , 2n −1},
let X [k]n2 be a subset of W (t,m) defined by


 
\
\
X [k]n2 = ϕΓ (i) ,(4.34)ϕΓ (i) ∩ 
i:[k]n,i2 =1

i:[k]n,i2 =040

Chapter 4. Constructions of Secret Sharing Schemes Based on Integer Programming

W (t,m)
ϕΓ(1)
X 000

X 001
X 011

X 101
X 111
X 100

X 010
X 110

ϕΓ(2)

ϕΓ(3)

Figure 4.1. Relation between ϕΓ (i)’s and X k ’s in the case of n = 3.
where [k]n2 denotes the binary number of integer k with n bits, and [k]n,i
2 is the i-th least significant
4,3n
bit of [k]2 . For example, in the case of k = 5 and n = 4, it holds that [5]42 = 0101, [5]4,1
2 = [5]2 =1, and (4.34) becomes X 0101 = ϕΓ (4) ∩ ϕΓ (3) ∩ ϕΓ (2) ∩ ϕΓ (1). For simplicity, we abbreviate
X [k]n2 as X k . Figure 4.1 is the Venn diagram which shows the relation between X k ’s and ϕΓ (i)’sin the case of n = 3. Then, it is easy to check that X k ’s satisfy the following equations for an
defarbitrary n, N = 2n − 1, and any A ⊆ V .
(4.35)

X0 = ∅
if k 6= k
X k ∩ X k0 = ∅[ϕΓ (i) =Xk(4.36)

0(4.37)

k:[k]n,i2 =1ΦΓ (A) =[ϕΓ (i) =Vi ∈ΦΓ (V ) =

N
[

[

Xk

(4.38)

n,ik:[k]2 =1
for some Vi ∈(4.39)

Xk

k=1

Tn

Note that (4.35), which means that i=1 ϕΓ (i) = ∅, follows from the fact that primitive shares notcontained in any share are not necessary in Γ. Hence, we consider only X k for k = 1, 2, . . . , N
in the following.
Letting xk = |X k |, the cardinality of ΦΓ (A) is given byX
xk ,(4.40)|ΦΓ (A)| =
k:[k]

n,i
=1
2

for some Vi ∈from (4.36) and (4.38). For a set of shares A = {Vi1 , Vi2 , . . . , Viu }, define an N-dimensional

4.3. Optimal Multiple Assignment Maps

41

def

row vector a(A) = [a(A)1 , a(A)2 , . . . , a(A)N ] ∈ {0, 1}N asa(A)k =

u1
2
0 if [k]n,i= [k]n,i= · · · = [k]n,i=02221 otherwise.

(4.41)
def

Then, the right hand side of (4.40)can be represented by inner product a(A) · x where x =[x1, x2, . . . , xN ]. Furthermore, denoting the Hamming weight of [k]n2 by hk , it holds from (4.37)
that
n
X

|ϕΓ(i)| =

i=1

n
X

X

xk =

i=1 k:[k]n,i =1

NX

hk xk = h · x,

(4.42)

k=1

2

where h = [h1, h2 , . . . , hN ] ∈ ZN . Hence, the average coding rate ρ̃ in (4.4) is given by n1 h · x.
Now, from (4.40)–(4.42), we can formulate the integer programming problem IPρ̃(Γ) thatminimizes the average coding rate ρ̃ under the constraints of (4.1) and (4.2) as follows:IPρ̃(Γ)minimizesubject toh·xa(A) · x ≥ ta(A) · x ≤ t − 1
x≥0

for
for

A ∈ A−1
A ∈ A+0

The optimal multiple assignment map ϕ̃Γ that attains the minimum average coding rate canbe constructed as follows. First, let x̃ = [x̃1, x̃2, . . . , x̃N ] and t̃ be the minimizers of the integerPN
def
programming problem IPρ̃(Γ). Then, for m̃ =
|Φ
(V
)|
=
x̃
,
we
use
a
t̃,
m̃
-threshold
Γ
k
k=1
n
o
(t̃)

(t̃)

(t̃)

SS scheme with primitive shares W (t̃,m̃) = W1 , W2 , . . . , Wm̃ , and for each k we assignx̃k different primitive shares of W (t̃,m̃) to X k under the conditions (4.36) and (4.39). Finally, themultiple assignment map ϕ̃Γ is obtained by (4.37).

Remark 4.6 In the case of perfect SS schemes, without loss of generality, we can assume thatT
xN = 0, i.e., X N = ni=1 ϕΓ (i) = ∅ because it is not necessary to consider the set of primitive
shares commonly contained in all the shares.
2
In the same way as IPρ̃(Γ), the integer programming problem IPρ∗ (Γ) that minimizes theworst coding rate ρ∗ can be formulated as follows:IPρ̃(Γ)minimizesubject toMa(A) · x ≥ ta(A) · x ≤ t − 1a({V }) · x ≤ M
x≥0

for A ∈ A−
1
for A ∈ A+
0for V ∈ V

Chapter 4. Constructions of Secret Sharing Schemes Based on Integer Programming

42

The multiple assignment map ϕ∗Γ attaining the minimum ρ∗ can also be constructed in thesame way as the construction of ϕ̃Γ .
Example 4.7 For the access structure Γ1 defined by (4.8) and (4.9) in Example 4.1, the integer
programming problem IPρ̃(Γ1 ) can be formulated as follows:IPρ̃(Γ1 )minimizex1 + x2 + 2x3 + x4 + 2x5 + 2x6 + 3x7 + x8 + 2x9 + 2x10
+3x11 + 2x12 + 3x13 + 3x14
subject to x1 + x2 + x3 + x4 + x5 + x6 + x7 + x9+x10 + x11 + x12 + x13 + x14 ≥ t
x1 + x3 + x5 + x7 + x8 + x9 + x10 + x11 + x12 + x13 + x14 ≥ t
x2 + x3 + x6 + x7 + x8 + x9 + x10 + x11 + x12 + x13 + x14 ≥ t
x4 + x5 + x6 + x7 + x8 + x9 + x10 + x11 + x12 + x13 + x14 ≥ t
x1 + x2 + x3 + x5 + x6 + x7 + x9 + x10 + x11 + x13 + x14 ≤ t − 1
x1 + x3 + x4 + x5 + x6 + x7 + x9 + x11 + x12 + x13 + x14 ≤ t − 1
x2 + x3 + x4 + x5 + x6 + x7 + x10 + x11 + x12 + x13 + x14 ≤ t − 1
x8 + x9 + x10 + x11 + x12 + x13 + x14 ≤ t − 1
xk ≥ 0, k = 1, 2, . . . , 14
From Remark 4.6, we assume that x15 = 0. By solving IPρ̃(Γ1 ),2 we obtain that the value of theobjective function is 5 which is attained by the following minimizers:x̃1 = x̃2 = x̃4 = 1, x̃8 = 2, x̃i = 0 for i = 3, 5, 6, 7, 9, 10, . . . , 14, and t̃ = 3.
P
Then, m̃ is given by m̃ = 14
k=1 x̃k = 5, and X k ’s become
n
o
n
o
n
o
n
o
(3)
(3)
(3)
(3)
(3)
X 1 = W1
, X 2 = W2
, X 4 = W3
, X 8 = W4 , W5
,
n
o
(3)
(3)
(3)
where W (3,5) = W1 , W2 , . . . , W5 . Finally, from (4.37), ϕ̃Γ1 is constructed asno(3)V1 = ϕ̃Γ1 (1) = W1
,
n
o
(3)
V2 = ϕ̃Γ1 (2) = W2
,
o
n
(3)
,
V3 = ϕ̃Γ1 (3) = W3
n
o
(3)
(3)
V4 = ϕ̃Γ1 (4) = W4 , W5.

(4.43)(4.44)(4.45)(4.46)(4.47)(4.48)In this case, we have that ρ̃ = 45 and ρ∗ = 2, which are smaller than the coding rates of ψΓ1 andψΓ0 1 . Integer programming problem IPρ∗ (Γ1 ) derives the same solutions as (4.43), and hence, it
2holds that ϕ̃Γ1 = ϕ∗Γ1 in this example.
2

Integer programming problems in this Chapter are solved with the aid of a software program called lp solveby M. Berkelaar available in http://www.cs.sunysb.edu/˜algorith/implement/lpsolve/
implement.shtml.

4.3. Optimal Multiple Assignment Maps

43

Example 4.8 For the access structure Γ2 defined by (4.22) and (4.23) in Example 4.5, we canobtain the following multiple assignment map by solving integer programming problem IPρ̃ (Γ2 ).
no(4)
V1 = ϕ̃Γ2 (1) = W1,
(4.49)on(4),(4.50)
V2 = ϕ̃Γ2 (2) = W2
o
n
(4)
,
(4.51)
V3 = ϕ̃Γ2 (3) = W3
o
n
(4)
(4)
,
(4.52)
V4 = ϕ̃Γ2 (4) = W4 , W5
o
n
(4)
,
(4.53)
V5 = ϕ̃Γ2 (5) = W6
(4)

where Wi ∈ W (4,6) . Then, it holds that ρ̃ = 65 and ρ∗ = 2, which are smaller than the coding
rates obtained by ψΓ2 and ψΓ0 2 . We note that ρ∗ = 2 is optimal because ϕ∗Γ2 (i) derived fromIPρ∗ (Γ2 ) coincides with ϕ̃Γ2 .
2Since any access structure can be realized by the cumulative map (and the modified cumulative map), there exists at least one multiple assignment map for any access structure. Therefore,
the next theorem holds obviously.
Theorem 4.9 For any access structure Γ that satisfies monotonicity (2.3) and (2.4), integer programming problems IPρ̃(Γ) and IPρ∗ (Γ) always have at least one feasible solution, and hence,
there exists the optimal solution.
2
Furthermore, it is also clear that the proposed construction method has the following properties.
Theorem 4.10 If Γ is a (k, n)-threshold access structure, the multiple assignment maps obtained
from integer programming problems IPρ̃ (Γ) and IPρ∗ (Γ) satisfy that |ϕ̃Γ (i)| = |ϕ∗Γ (i)| = 1 for
all i.
2
Next, we clarify what kind of access structure can be realized as an ideal SS scheme by themultiple assignment map.
Theorem 4.11 For an access structure Γ, the SS scheme constructed by the optimal multiple
assignment map is ideal, i.e., ρi = 1 for all i, if and only if A−
1 of Γ can be represented as[A−(4.54){Aj1 × Aj2 × · · · × Ajt } ,1 =∀{j 1 ,j2 ,...,jt }⊆{1,2,...,m}where t is a positive integer and {A1 , A2 , . . . , Am } is a partition of V which satisfiesm[(4.55)

Aj = V ,j=1

Aj 6= ∅

Aj ∩ Aj 0 = ∅for j = 1, 2, . . . , m,

(4.56)

if j 6= j 0 .

(4.57)
2

44

Chapter 4. Constructions of Secret Sharing Schemes Based on Integer Programming

Proof of Theorem 4.11 If there exists such a partition {A1, A2 , . . . , Am } satisfying (4.54)–(4.57) for the access structure Γ, an ideal SS scheme can be obtained by letting(t)ϕΓ (i) = Wj

if Vi ∈ Aj

(4.58)

for each i = 1, 2, . . . , n. Next, we show the necessity of (4.54)–(4.57). Suppose that ρi = 1 holds
for all i. Then, we can consider the inverse map of ΦΓ such that Φ−1
Γ : W (t,m) → 2 satisfies


(t)
Φ−1
= Aj
(4.59)WjΓ

for all j = 1, 2, . . . , m. Hence, Aj satisfies (4.54), (4.55) and (4.56). Furthermore, if there exist
0
Aj and A
n j 0 , j 6= j ,onot satisfying (4.57), there exists a share Vi ∈ Aj ∩ Aj 0 . This means
(t)

(t)

2
ϕΓ (i) ⊇ Wj , Wj 0 , which contradicts ρi = |ϕΓ (i)| = 1.
In the case of t = 2, it is known that an access structure Γ can be realized by an ideal SS
scheme if and only if Γ can be represented by a complete multipartite graph [17]. We note that
this condition coincides with (4.54)–(4.57) in this case. Furthermore, in the case that |Aj | = 1
for j = 1, 2, . . . , m, the access structure coincides with the (t, m)-threshold access structure.
We note that any access structures not satisfying (4.54)–(4.57) must have ρ̃ > 1 and ρ∗ ≥ 2
if the multiple assignment map are used. But, an access structure not satisfying (4.54)–(4.57)
might be realized as an ideal SS scheme if we use another construction method. For example,
refer [104].
We also note that integer programming problems are NP-hard, and hence, the proposed algorithms may take much time in solving for large n (= |V |). But, in the case that n is not large, thesolution is obtained quickly. For instance, integer programming problem IPρ (Γ3 ) for the accessstructure Γ3 with n = 6 in the next example can be solved within 0.1 seconds by a notebook
computer.
Example 4.12 Consider the following access structure Γ3 :A−
1 = {{V1 , V3 , V4 , V5 }, {V1 , V3 , V5 , V6 }, {V1 , V4 , V5 , V6 }, {V3 , V4 , V5 , V6 }, {V1 , V2 , V3 },{V1 , V2 , V5 }, {V1 , V2 , V6 }, {V2 , V3 , V4 }, {V2 , V3 , V5 }, {V2, V3 , V6 }, {V2 , V4 , V5 },{V2 , V4 , V6 }, {V2 , V5 , V6 }},(4.60)

A+
0 = {{V1 , V3 , V4 , V6 }, {V1 , V2 , V4 }, {V1 , V3 , V5 }, {V1 , V4 , V5 }, {V1 , V5 , V6 }, {V3 , V4 , V5 },{V3 , V5 , V6 }, {V4 , V5 , V6 }, {V2 , V3 }, {V2 , V5 }, {V2, V6 }}.
Then, we obtain the following multiple assignment map by solving IPρ̃ (Γ3 ).
n
o
(6)
(6)
V1 = ϕ̃Γ3 (1) = W1 , W2
,
n
o
(6)
(6)
(6)
(6)
V2 = ϕ̃Γ3 (2) = W1 , W3 , W4 , W5
,
n
o
(6)
V3 = ϕ̃Γ3 (3) = W6
,
o
n
(6)
(6)
,
V4 = ϕ̃Γ3 (4) = W2 , W5

(4.61)(4.62)(4.63)(4.64)(4.65)

4.4. Multiple Assignment Maps for Incomplete Access Structures

(6)

o
n
(6)
(6)
,
V5 = ϕ̃Γ3 (5) = W3 , W7
o
n
(6)
,
V6 = ϕ̃Γ3 (6) = W8

45
(4.66)(4.67)

where Wi ∈ W (6,8) . ϕ̃Γ3 attains that ρ̃ = 2 and ρ∗ = 4. On the other hand, the cumulative mapψΓ3 for the access structure Γ3 are given by
n
o
(11)
(11)
(11)
(11)
(11)
(11)
V1 = ψΓ3 (1) = W6 , W7 , W8 , W9 , W10 , W11,(4.68)
o
n
(11)
(11)
(11)
(11)
(11)
(11)
(11)
,
(4.69)
V2 = ψΓ3 (2) = W1 , W3 , W4 , W5 , W6 , W7 , W8
o
n
(11)
(11)
(11)
(11)
(11)
(11)
,
(4.70)
V3 = ψΓ3 (3) = W2 , W4 , W5 , W8 , W10 , W11
o
n
(11)
(11)
(11)
(11)
(11)
(11)
,
(4.71)
V4 = ψΓ3 (4) = W3 , W5 , W7 , W9 , W10 , W11
n
o
(11)
(11)
(11)
(11)
V5 = ψΓ3 (5) = W1 , W2 , W9 , W11,(4.72)
o
n
(11)
(11)
(11)
(11)
(11)
(11)
,
(4.73)
V6 = ψΓ3 (6) = W2 , W3 , W4 , W6 , W9 , W10(11)where Wi
∈ W (11,11) . ψΓ3 has ρ̃ = 35
and ρ∗ = 7. Furthermore, the modified cumulative6and ρ∗ = 9.
2
map for Γ3 , ψΓ0 3 , requires a (12, 15)-threshold SS scheme and has ρ̃ = 31
6
In this thesis, we assume that every share is significant. But, if there exist vacuous shares in anaccess structure Γ, it is cumbersome to check whether each share is significant or vacuous. From
Remark 2.7, the optimal multiple assignment map ϕ̃Γ attaining the minimum average coding rate
must satisfy that |ϕ̃Γ(i)| = 0 for any vacuous share Vi . On the other hand, it clearly holds that|ϕΓ (i)| ≥ 1 for every significant share Vi since ρi ≥ 1 holds for any significant share. Hence, bysolving integer programming problem IPρ̃(Γ), we can know whether each share is significant or
vacuous.

4.4 Multiple Assignment Maps for Incomplete Access Structures
In the previous sections, we considered how to construct a SS scheme for a complete generalaccess structure Γ = {A1 , A0}. But in practice, it may be cumbersome to specify whether eachsubset of V is a qualified set or a forbidden set because the number of subsets is 2n . Hence, amethod is proposed in [49] to construct a SS scheme even for the case that we don’t care theproperties of some subsets of V .
We consider only the minimum average coding rate in this section. But, for the minimum
worst coding rate, integer programming can be formulated in the similar way.
Theorem 4.13 (Itoh et al. [49]) Let Γ] = {A]1, A]0 } be an incomplete access structure, which
has A]1 ∪ A]0 6= 2 . Then, there exists a complete access structure Γ = {A1 , A0} such thatA]1 ⊆ A1,

(4.74)

A]0 ⊆ A0,

(4.75)

46

Chapter 4. Constructions of Secret Sharing Schemes Based on Integer Programming

if and only if it holds that for any A ∈ A]1 and B ∈ A]0,A * B.

(4.76)
2

In the case that (4.76) is satisfied, a SS scheme with the incomplete access structure Γ] ={A]1, A]0 } can be realized by applying the cumulative map to the complete access structure Γ ={A1, A0 }. In fact, for the access structure Γ] = {A]1, A]0}, a SS scheme is constructed in [49] byS(t)letting ψΓ] (i) = j:Vi6∈ j {Wj } for A]+
0 = {F 1 , F 2 , . . . , F m }. This construction corresponds
to the case that]+A+
0 = A0 and A1 = 2 − A0 .

(4.77)

However, ψΓ] is not efficient generally because ψΓ] is based on the cumulative map, whichis inefficient as described in Section 4.2. Furthermore, (4.77) may not be the optimal complete
access structure to use the cumulative map for the given incomplete access structure Γ] .
In our construction based on integer programming, the optimal multiple assignment map for]+the incomplete access structure Γ] = {A]−1 , A0 } can easily be obtained by applying IPρ̃(Γ) orIPρ∗ (Γ) directly to Γ] .
Example 4.14 Let us consider the following access structure Γ]3 = {A]1, A]0}:
A]1 = {{V1 , V4 , V5 , V6 }, {V1, V2 , V5 }, {V1 , V2 , V6 }, {V2 , V3 , V6 }, {V2 , V4 , V6 }},(4.78)

A]0 = {{V1 , V3 , V4 , V6 }, {V1, V3 , V5 }, {V1 , V5 , V6 }, {V3 , V4 , V5 }, {V4 , V5 , V6 }, {V2 , V5 }}, (4.79)]+
Note that A]1 and A]0 satisfy A]1 ⊆ A−
1 and A0 ⊆ A0 for Γ3 = {A1 , A0 }, which is defined by(4.60) and (4.61) in Example 4.12. Then, by solving IPρ̃ (Γ]3 ), we obtain the following multiple
assignment map.
no(4)
V1 = ϕΓ̃] (1) = W1,
(4.80)
3
n
o
(4)
(4)
V2 = ϕΓ̃] (2) = W2 , W3,
(4.81)3no(4)
V3 = ϕΓ̃] (3) = W4,
(4.82)
3no(4),(4.83)
V4 = ϕΓ̃] (4) = W4
3
n
o
(4)
V5 = ϕΓ̃] (5) = W5,
(4.84)3no(4)
V6 = ϕΓ̃] (6) = W6,
(4.85)
3(4)

where Wi ∈ W (4,6) , and it holds that ρ̃ = 67 and ρ∗ = 2. If we apply the cumulative map to Γ]3 ,ψΓ] is constructed from a (6, 6)-threshold scheme, and it has ρ̃ = 3 and ρ∗ = 5. Finally we note3
that ρ̃ = 76 and ρ∗ = 2 are smaller than the rates of Γ3 obtained in Example 4.12.
2
Similarly to the case of complete SS schemes, if there exist vacuous shares Vi in Γ] ={A]1, A]0 }, we can know them from |ϕ̃Γ] (i)| = 0 by solving IPρ̃(Γ] ).

4.5. Ramp Secret Sharing schemes with General Access Structures

47

4.5 Ramp Secret Sharing schemes with General Access Structures
In this section, we treat the construction of ramp SS schemes based on the multiple assignment
maps. We consider only the minimum average coding rate in this section. But, for the minimum
worst coding rate, integer programming can be formulated in the similar way. Furthermore, we
also assume that access structures are complete although the case of incomplete access structures
SL
with j=0 Aj 6= 2 can be treated in the same way as Section 4.4.

4.5.1 Preliminaries

Ramp SS schemes can be constructed if and only if the following conditions are satisfied.
Theorem 4.15 (Kurosawa et al. [71]) A ramp SS scheme with access structure ΓR = {A0, A1,. . . , AL } can be constructed if and only if Ǎj (or Âj ) satisfies the monotonicity (3.8) (or (3.9))
for all j = 1, 2, . . . , L, where Ǎj and Âj are defined in (3.6) and (3.7).
2
In Theorem 4.15, the necessity of the condition is obvious, and the sufficiency is establishedby the next construction.
Construction 4.16 (Kurosawa et al. [71]) Let S = S h1i , S h2i , . . . , S hLi be a secret, and letΓhji = Ǎj , 2 − Ǎj , j = 1, 2, . . . , L, be the perfect access structures obtained from a given
access structure ΓR . Since each Γhji is a perfect access structure satisfying the monotonicity (2.3)
hji
hji
hji
and (2.4), we can construct a SS scheme for secret S hji and Γhji . Letting {W1 , W2 , . . . , Wn }
h1i
h2i
hLi
be shares for S hji and Γhji , the share Vi = {Wi , Wi , . . . , Wi } realizes the access structureΓR . For ΓR , a ramp SS scheme can also be constructed from {2 − Âj , Âj } instead of Γhji =2 − Ǎj , Ǎj .
2
Remark 4.17 Note that in Construction 4.16, we have ρi ≥ 1 for any access structure. For
example, in the case that Construction 4.16 is applied to a (k, L, n)-threshold access structure,
the constructed ramp SS scheme has ρi = 1 although the (k, L, n)-threshold SS scheme can berealized with ρi = L1 . Therefore, Construction 4.16 is not efficient generally.
2
Example 4.18 Consider the following ramp access structure ΓR
4 for V = {V1 , V2 , V3 , V4 }:A3 = {{V1 , V2 , V3 , V4 }},(4.86)

A2 = {{V1 , V2 , V3 }, {V1 , V3 , V4 }},(4.87)

A1 = {{V1 , V2 , V4 }, {V2 , V3 , V4 }},(4.88)

A0 = {A : 0 ≤ |A| ≤ 2}.

(4.89)

(3)

(3)

(4)

(3)

(3)

(4)

By Construction 4.16, we obtain that V1 = {P1 , Q1 , R1 }, V2 = {P2 , Q2 , R2 }, V3 =
(3)
(3)
(4)
(3)
(3)
(4)
(4)
(3)
(3)
{P3 , Q3 , R3 }, V4 = {P4 , Q2 , R4 }, where Ri ∈ W (4,4) , Qi ∈ W (3,3) , Pi ∈ W (3,4) .
Since each share consists of three primitive shares for three secrets S h1i , S h2i , S h3i , the constructed ramp SS scheme has ρ̃ = ρ∗ = 1.
2

48

Chapter 4. Constructions of Secret Sharing Schemes Based on Integer Programming

Remark 4.19 In Construction 4.16, any A ∈ Aj can decode S h1i , S h2i , . . . , S hji . In other words,
A ∈ Aj expose some parts of the secret S = S h1i , S h2i , . . . , S hLi . Since it is insecure in part,such ramp SS schemes are called weak ramp SS schemes [119]. On the other hand, strong ramp
SS schemes are also defined in [119]. The strong ramp SS scheme requires that for any A ∈ Aj
and {`1 , `2 , . . . , `u } ⊆ {1, 2, . . . , L}, 1 ≤ u ≤ L − j, u
H S h`1 i , S h`2 i , . . . , S h`u i A = H(S)L

(4.90)

in addition to (3.2)–(3.4). Note that the ramp SS scheme given by (3.58)–(3.62) in Example 3.18
is an example of weak ramp SS schemes since S1 and S2 exposes to V1 and V2 , respectively. On
the other hand, the (k, L, n)-threshold ramp SS scheme given by (3.5) is an example of strong
ramp SS scheme.
It is easy to convert a weak ramp SS scheme to a strong one by transforming the tuple of thesecret as follows:




S h1i
S 0h1i S h2i 
 S 0h2i (4.91)
 ..  = M  ..  ,
 . 
 . 
S hLi
S 0hLiwhere M is an L × L non-singular matrix defined on a finite field. If we select M adequatelyand encrypt S 0h1i, S 0h2i , . . . , S 0hLi instead of the original secret S = S h1i , S h2i, . . . , S hLi , theobtained ramp SS scheme becomes strong for S.
2
The construction of ramp SS schemes for general access structures are treated in [103]. But,
since the construction in [103] is based on monotone span programming, it is much complicatedcompared with the multiple assignment map.

4.5.2 Optimal Multiple Assignment Maps for Ramp Secret Sharing
Schemes
(t,L)

(t,L)

(t,L)

First, let W (t,L,m) = {W1 , W2 , . . . , Wm } be the set of primitive shares for a (t, L, m)threshold ramp SS scheme with coding rate ρi = L1 . Then, the optimal ramp SS scheme by
the multiple assignment map for a general access structure ΓR can be obtained by solving thefollowing integer programming problem:
IPρ̃ (Γ)
minimizesubject toh·xa(A) · x ≥ ta(A) · x = t − ja(A) · x ≤ t − L
x≥ 0

for
for
for

A ∈ A−L−A ∈ A+j ∪ AjA∈V

for 1 ≤ j ≤ L − 1(?)

4.5. Ramp Secret Sharing schemes with General Access Structures

49

Remark 4.20 From the monotonicity defined in (3.8) and (3.9), it is sufficient to consider only−RRA ∈ A+. Note that in the casej ∪ Aj instead of all A ∈ Aj on the marked line (?) in IPρ̃ Γ
of A0 6= ∅ in ramp SS schemes, the same primitive shares may be distributed to all the shares.
Hence, we may have xN 6= 0 in ramp SS schemes although we can always assume that xN = 0
in perfect SS schemes.
2
From Definition 3.5 and Corollary 3.6, non-vacuous shares Vi must satisfy that |ϕΓ (i)| ≥ 1 forany multiple assignment map ϕΓ . On the other hand, |ϕ̃Γ (i0 )| = 0 must hold for vacuous shares
Vi0 in the optimal multiple assignment map ϕ̃Γ attaining the minimal average coding rate.
Example 4.21 If the access structures ΓR
4 in Example 4.18 is applied to integer programming
RR
problem IPρ̃ Γ4 , the following multiple assignment map is obtained
n
o
(7,3)
(7,3)
V1 = ϕΓR4 (1) = W1 , W2,
(4.92)
n
o
(7,3)
(7,3)
V2 = ϕΓR3 (2) = W3 , W4,(4.93)
o
n
(7,3)
(7,3)
V3 = ϕΓR4 (3) = W5 , W6,
(4.94)
o
n
(7,3)
(7,3)
V4 = ϕΓR4 (4) = W3 , W7,
(4.95)(7,3)

where Wi

2∗
∈ W (7,3,7) . ϕR
Γ4 attains that ρ̃ = ρ = 3 .

2

We note that the coding rates less than 1 cannot be achieved by Construction 4.16. Furthermore, our construction is much simple compared with the method in [103]. But, unfortunately,
the integer programming problem may not have any feasible solutions in the case of ramp SS
schemes.
Example 4.22 The following access structure ΓR
5 cannot be constructed by any multiple assignment map since the corresponding integer programming problem has no feasible solution.
A−
4 = {{V1 , V2 , V3 , V4 }, {V1 , V2 , V4 , V5 }, {V2 , V3 , V4 , V5 }},(4.96)

A3 = {{V1 , V2 , V3 , V5 }, {V1 , V3 , V4 , V5 }, {V1 , V2 , V3 }, {V1 , V2 , V4 }, {V1 , V3 , V4 },{V1 , V3 , V5 }, {V2 , V3 , V4 }},(4.97)

A2 = {{V1 , V2 , V5 }, {V1 , V4 , V5 }, {V2 , V3 , V5 }, {V2 , V4 , V5 }, {V3 , V4 , V5 }, {V1 , V3 }, {V1, V5 }},(4.98)
A1 = {{V1 , V2 }, {V2 , V3 }, {V3 , V4 }},(4.99)

A+
0 = {{V1 , V4 }, {V2 , V5 }, {V3 , V5 }}.

(4.100)2

In this case, we can modify the definition of ramp SS schemes given by (3.1) as follows.
H(S|A) = 0,
for all A ∈ AL,
L−j
H(S|A) ≥H(S), for all A ∈ Aj , 1 ≤ j ≤ L − 1,
L
H(S|A) = H(S),for all A ∈ A0.

(4.101)(4.102)(4.103)

50

Chapter 4. Constructions of Secret Sharing Schemes Based on Integer Programming

In order to implement (4.101)–(4.103) in the integer programming, it suffices to replace theRmarked line (?) in IPR
by a(Aj ) · x ≤ t − j. Letting IPρ̃R2 ΓR be the modified integerρ̃ Γ
programming problem, the next theorem holds.
ΓR always has at least one feasible
Theorem 4.23 The integer programming problem IPR2ρ̃
solution for any ramp access structure ΓR .
2
Proof of Theorem 4.23 Let V be a multiset in 2 , some elements of which may be the same.
Then, for V and A ⊆ V, we define N(V, A) as follows.
N(V, A) = |{A0 ∈ V : A ⊆ A0 }| ,(4.104)

where all A0 ∈ V are treated as different ones even if some of them are the same. Now weconstruct a multiset U from ΓR = {A0 , A1, . . . , AL} by the next construction.
Construction 4.24
(1) Let U := ∅ and j := 1.
(2) For each A ∈ A+
L−j satisfying N(U, A) < j, we add A into U, (j − N(U, A)) times.
(3) Let j := j + 1.
(4) If j < L, go to (2). In case of j = L, go to (5).
(5) Output U.

2

From the monotonicity of Ǎj in (3.8), family U can always be constructed. Then, letting
U = {F 1 , F 2, . . . , F m }, we can define a map ψ̌ : {1, 2, . . . , n} → 2 (m,L,m) by[ n (m,L) oψ̌(i) =
Wj,
(4.105)
j:Vi 6∈j(m,L)

where Wj
∈ W (m,L,m) . Noting that in the case of L = 1, (4.105) coincides with the
cumulative map in (4.7), it is easily shown that share Vi = ψ̌(i) satisfies (4.101)–(4.103). Hence,IPρ̃R2 ΓR always has at least one feasible solution.
2

Note that as shown in the following example, Construction 4.24 does not give the optimal
assignments of primitive shares generally.

Example 4.25 Assume that the access structure ΓR
5 in (4.96)–(4.100) satisfies the conditions(4.101)–(4.103). First, we apply Construction 4.24 to the access structure ΓR
5 . Then, we obtain the following multiset UΓR5 .
UΓR5 = {{V1 , V2 , V3 , V5 }, {V1 , V3 , V4 , V5 }, {V1, V2 , V4 }, {V1 , V2 , V5 }, {V1 , V4 , V5 }, {V2 , V3 , V5 },{V2 , V3 , V4 }, {V2 , V4 , V5 }, {V2, V4 , V5 }, {V3 , V4 , V5 }, {V1 , V4 }}.

(4.106)

4.6. Conclusion

51

Hence, we can obtain Vi = ψ̌(i), i = 1, 2, . . . , 5, as follows:on(11,4)(11,4)(11,4)(11,4)(11,4),
V1 = ψ̌(1) = W6
, W7
, W8
, W9
, W10
n
o
(11,4)(11,4)(11,4)(11,4)
V2 = ψ̌(2) = W2
, W5
, W10 , W11,no(11,4)(11,4)(11,4)(11,4)(11,4)(11,4)
V3 = ψ̌(3) = W3
, W4
, W5
, W8
, W9
, W11
,
o
n
(11,4)(11,4)(11,4),
V4 = ψ̌(4) = W1
, W4
, W6
o
n
(11,4)(11,4)(11,4),
V5 = ψ̌(5) = W3
, W7
, W11

(4.107)(4.108)(4.109)(4.110)(4.111)(11,4)and ρ∗ = 32 since it holds that H(Wi) =where Wi ∈ W (11,4,11) . Then, we have ρ̃ = 21
20
1
H(S) for each i.
4
On the other hand, we can construct the following multiple assignment map ϕ̃Γ5 by solving
integer programming problem IPρ̃R2 (ΓR
5 ).
V1 = ϕ

ΓR
5

(1) =

n

n

(8,4)

(8,4)
(8,4)
W1 , W2
(8,4)

(8,4)

o

(4.112),(8,4)

V2 = ϕΓR5 (2) = W3 , W4 , W5
o
n
(8,4)
(8,4)
,
V3 = ϕΓR5 (3) = W2 , W6
n
o
(8,4)
(8,4)
,
V4 = ϕΓR5 (4) = W7 , W8
n
o
(8,4)
,
V5 = ϕΓR5 (5) = W9o,(4.113)(4.114)(4.115)(4.116)

where Wi
∈ W (8,4,9) , and it holds that ρ̃ = 12 , and ρ∗ = 34 . Note that (4.107)–(4.111) and(4.112)–(4.116) do not satisfy (3.1) but satisfy (4.101)–(4.103). For instance, in (4.112)–(4.116),
it holds for {V1 , V5 } ∈ A2 that H(S|V1 V5 ) = H(S) > 12 H(S).
Finally, consider the case that we apply Construction 4.16 to access structure ΓR
5 . If we usehji
the cumulative map for each perfect SS scheme of access structure Γ5 , j = 1, 2, 3, 4, we obtain2ρ̃ = 95 and ρ∗ = 2, which are very inefficient.

4.6 Conclusion
We proposed a method to construct SS schemes for any given general access structures from(t, m)-threshold SS schemes based on integer programming. The proposed method can attainthe optimal average and/or worst coding rates in the sense of multiple assignment maps. Hence,the proposed method can attain smaller coding rates compared with the cumulative maps andthe modified cumulative maps. Furthermore, the proposed method can be applied to incomplete
and/or ramp access structures.

Chapter 5
Conclusions of Part I
5.1 Summary of Results
In Part I, we discussed SS schemes from the viewpoints of coding rates and construction methods.
In Chapter 3, we evaluated the lower bounds of coding rates for ramp SS schemes. We
pointed out that there may exist non-significant shares in ramp SS schemes although all sharescan be assumed to be significant in perfect SS schemes. Based on such facts, we classified theshares of ramp SS schemes into three categories, i.e., super-additive, additive, and sub-additive,
and we proved that the lower bound of the coding rate for sub-additives share is strictly larger
than that of the other two types of shares. Then, we defined a well-realized ramp SS scheme as anextension of an ideal perfect SS scheme, and we showed that ramp SS schemes cannot be wellrealized if it has sub-additive shares. Finally in Chapter 3, we derived a theorem to discriminate
the access structure that cannot be well-realized even if it consists of additive and super-additive
shares. We also showed from the theorem that some examples of access structures in [15] cannot
be well-realized.
In Chapter 4, we proposed a new efficient construction method of perfect SS schemes forgeneral access structures based on (t, m)-threshold SS schemes and integer programming. Our
method uses the multiple assignment scheme proposed by Ito et al. [47]–[49]. In the multiple
assignment schemes, the shares of (t, m)-threshold SS schemes called primitive shares are assigned to each share of a given general access structure in such a way that t or more primitive
shares are assigned to qualified sets, but t − 1 or less primitive shares are assigned to forbidden
sets. The cumulative map proposed by Ito et al. [47]–[49] is a simple realization of the multiple
assignment scheme, but it is inefficient, especially in the case that access structures are close to(k, n)-threshold access structures. Furthermore, although the modified cumulative map [109] is
proposed to overcome such defects, it is not always efficient. Hence, we designed the multiple
assignment map that can minimize the average or worst coding rates using integer programming,
and we presented some examples of access structures to show that the proposed method can attainmuch lower coding rates than the cumulative map and the modified cumulative map. Our method
can also be applied to incomplete and/or ramp access structures, and efficient SS schemes canalso be obtained in such cases. Note that integer programming problem is known as NP-hard,53

54

Chapter 5. Conclusions of Part I

but the optimal multiple assignment map can be obtained quickly by the proposed method in thecase that the number of shares is not large.

5.2 Future Works
In Chapter 3, we studied the lower bounds of coding rates in ramp SS schemes. But, it is difficult
to determine the exact optimal coding rates, which still remains an important open problem. To
approach this problem, we have to specify what kind of access structures can well-realized ornot. In other words, we must clarify completely what kind of characteristics in access structures
distinguish well-realized and not well-realized ramp SS schemes. The relations between ideal
SS schemes and matroids are studied in [21], [38], [84], [85], [98], [112] for perfect SS schemes,
although such relations have not been studied for ramp SS schemes except [71]. Hence, it is also
an important problem for future works to clarify the relations between well-realized ramp SS
schemes and matroids.
For future works concerning Chapter 4, we have to design faster algorithms than the proposed
method in the case that the number of shares n is large. In order to obtain faster algorithms, it
may be most important to reduce the number of variables in the corresponding integer programming problem, since we use O(2n ) variables in the proposed method. It may possible to design
faster algorithms by using some structures of SS schemes, e.g., the monotonicity of access structures. As for other approaches, fast algorithms may be derived if access structures satisfy someproperties, e.g., in the case that they can be represented by a matroid or a graph. In all examples
treated in the framework of the multiple assignment maps, we note that one of the optimal multiple assignments in the sense of the average coding rates is also optimal in the sense of the worst
coding rates. Hence, we conjecture that there exists at least one optimal solution to minimize
both the average and the worst coding rates at the same time. It is also a future work to prove
this conjecture.

Part II
Visual Secret Sharing Schemes

55Chapter 6
Introduction to Visual Secret Sharing
Schemes
6.1 Background and Motivations
In Part I, we have discussed ordinary SS schemes in which encryption and decryption are carriedout by algebraic calculations on finite fields. Since such calculations are complicated, they areusually processed by computers. However, what should we do in such a case that no computation
power is available, for example, in the case of earthquake or electric power failure? From theviewpoint of data security, we should be able to decrypt secret information in any time even if
we have no computational power. Visual secret sharing schemes may answer to such problems.
The visual secret sharing (VSS) scheme, which originates from the visual cryptography proposed by Naor-Shamir [81], is a method to encode a secret image into several shares, each ofwhich does not reveal any information of the secret image. Shares are printed on transparencies for example, and distributed to n participants. The secret image can easily be decrypted
only by stacking the shares in an arbitrary order. This property, i.e., the VSS scheme needs nocomputation in decryption, distinguishes the VSS scheme from the ordinary SS schemes.
Naor-Shamir’s VSS scheme is a (k, n)-threshold scheme for black-white binary (BW-binary)images, which we call a (k, n)-VSS-BW scheme. An example of a (2, 2)-threshold VSS scheme
is shown in Appendix A.1. The quality of decrypted images can be evaluated by contrast andpixel expansion that determine the clearness and the resolution of decrypted images, respectively.
The optimization of such parameters is treated in many researches [10], [12], [35], [36], [42],[46], [68], [81], [117].
It is shown in [81] that in any (n, n)-VSS-BW scheme, pixel expansion must be larger
than 2n−1 . Furthermore, in [81], a simple method is proposed to construct an (n, n)-VSS-BW
scheme that attains the optimal 2n−1 pixel expansion. However, it is difficult to extend thisresult to (k, n)-VSS-BW schemes. Actually, although the optimal pixel expansion and/or contrast of (k, n)-VSS-BW schemes are obtained in the case of k = 2 [12] and in the cases ofk = 3, 4, 5, n − 1 under some restrictions [13], their results are too complicated. Hence, theefficient construction methods of (k, n)-VSS-BW schemes are studied in [10], [12], [13], [35],57Chapter 6. Introduction to Visual Secret Sharing Schemes

58[36], [42], [46], [68], [117] for general k and n. Furthermore, for (k, n)-VSS-BW schemes, theasymptotic optimal contrast, as n is increased, is derived for fixed k in [13], [42], [68].
The (k, n) structure of VSS-BW scheme can be extended to general access structures which
are specified by qualified sets and forbidden sets [1]. A qualified set is a subset of n sharesthat can decrypt the secret image while a forbidden set is a subset of shares that can gain no
information of the secret image. In [1], some methods are proposed to construct VSS schemeswith general access structures for BW-binary secret images, and the minimum pixel expansion isderived in the case that the number of shares are less than 4.
VSS schemes with color secret images are also studied in [43], [45], [66], [67], [82], [96],[117], [123] for (k, n)-threshold schemes. The technical difficulty of color VSS schemes comesfrom how to treat a mixture of colors t in basis matrices, which describe the colors of encrypted
pixels on each share. In the case of BW-binary secret images, a mixture of colors can be treatedsimply as the binary “OR” operation, but it is difficult to extend the operation to general colors.
Actually, [96], [117], [123] treats only a special case that a mixture of colors {red, green, blue}
can be regarded as a “generalized OR” operation, and [67] treats the mixture of colors as a join
operation in a bounded upper semilattice of colors, as we will see in Section 6.2.1. However,the construction method of VSS schemes proposed in [67] is not applicable to the case that the
mixture of colors gives another color, e.g., the case that the mixture of cyan and yellow gives
green. In order to overcome this defects, Koga proposed (n, n)-threshold VSS schemes that candeal with any mixture of colors by introducing symmetry into basis matrices, and he pointed outthat such basis matrices can be corresponded to polynomials [63]. Furthermore, it is shown in[63] that (k, n)-threshold VSS schemes can easily be obtained from the basis matrices of (k, k)threshold VSS schemes. However, [63] did not give a systematic construction of (n, n)-threshold
VSS schemes for general n.
A systematic construction of (n, n)-threshold VSS schemes based on symmetric basis matrices is developed in our joint work [66], which is called algebraic construction.1
In this construction, the definition of (n, n)-threshold VSS schemes is rephrased into simultaneous partial differential equations based on the one to one correspondence between basis
matrices and homogeneous polynomials of degree n, which are called basis polynomials. By
introducing these techniques, combinatorial problems in VSS schemes can be transformed toalgebraic problems, which can easily be treated. The algebraic construction of VSS schemes
for color images will be reviewed in Chapter 6. The algebraic construction can realize (k, n)threshold VSS schemes for color images, but it has two problems. One is that the algebraic
construction cannot be extended to VSS schemes with general access structures, and the second
is that VSS schemes for BW-binary images cannot be realized by the algebraic construction.
For the first problem, we review in Chapter 6 how to construct VSS schemes for general access
1

This construction method was originally called analytic construction in [66] since it uses simultaneous partial
differential equations. However, this construction method has also many algebraic aspects. For example, colors are
represented by variables, which satisfy the OR operation or some operation on an upper bounded semilattice. Pixels
are represented by matrices, which are classified by equivalence classes. The equivalence classes are identified withpolynomials. Furthermore, it is pointed out in [64] that the set of polynomials can be identified with a set of lattice
points in some linear space. Hence, this construction method is called algebraic rather than analytic in this thesis.

6.1. Background and Motivations

59

structures from (n, n)-threshold VSS schemes based on the results in [66].
For the second problem, Kuwakado-Tanaka [72] modified basis polynomials for BW-binary
secret images. In [52], based on their results, we extend their method to VSS schemes for grayscale images including BW-binary images as special cases, and we proved that constructed VSS
schemes for gray-scale images are optimal in all the (n, n)-threshold VSS schemes for gray-scale
images. In Chapter 7, such construction of the optimal (n, n)-VSS schemes will be described.
Furthermore, in Chapter 7, a construction method of VSS schemes for color images with shades
is presented based on the algebraic constructions. From these results, efficient VSS schemes of(k, n)-threshold access structures for any kind of secret images can easily be constructed only bysolving simultaneous partial differential equations.
In the above schemes, we assumed that secret is a single image. But, VSS schemes withplural secret images can also be considered [35], [53], [60], [62], [107]. Kato-Imai [60] proposeda method to reproduce different secret images as the number of shares is increased, and Suga et
al. [107] treated VSS schemes for plural secret images with general access structures represented
by graphs. Furthermore, Droste [35], Klein-Wessler [62] proposed methods to decrypt different
secret images for every subset of n shares. However, note that the previous studies [35], [60],[62], [107] treat only BW-binary secret images, and any VSS schemes have not yet been studied
for general cases such that secret images are plural color images with shades and their accessstructures are general. Moreover, as we will see in Section 8.2, the definitions of VSS schemesin [60], [107] are not accurate, i.e., it occurs that decrypted images leak out some informationsof the other secret images, even in the case that the security conditions given in [60], [107] aresatisfied.
As other research directions, VSS schemes with identification (ID) images are studied in[2], [25], [43], [78]. In these researches, it is assumed that each share has an identification image
instead of a random sandstorm-like image. VSS scheme with BW-binary ID images and theiroptimizations of contrast are discussed in [2], while VSS schemes with color ID images areproposed in [43]. Furthermore, in [25], [78], (2, 2)-VSS schemes with ID images are treated
for the case that we attach importance to the quality of decrypted images at the sacrifice ofsecrecy. Note that VSS schemes with n ID images and a single secret image can be considered
as VSS scheme with (n + 1) secret images by treating the ID images as secret images that canbe decrypted from a single share.
Based on such background, in [53], we propose VSS schemes with plural secret images forgeneral access structures under accurate security definitions, which guarantee that decrypted images do not leak out any information of the other secret images. We establish the construction
method of such VSS schemes that can attain the security conditions perfectly without degenerating the quality of decrypted images compared with the methods in [35], [107]. Furthermore,
our VSS schemes proposed in [53] can treat color images with shades. In the sequel, our VSS
schemes for plural secret images can be applied to any type of plural secret images and any kindof access structures. In other words, our method includes almost all previous VSS schemes. In
Chapter 8, we describe the details of these VSS schemes.
Finally, we note that Koga [64] studied the correspondence of a set of basis polynomials andChapter 6. Introduction to Visual Secret Sharing Schemes

60

a linear space, and he also constructed an algorithm to derive the optimal VSS schemes with
BW-binary images for (k, n)-threshold access structures [65]. Furthermore, the results of [64]are extended to color secret images by Ishihara-Koga [44]. Applications of VSS schemes are alsostudied in [6], [60], [72], [79]. Authentication systems can be constructed from VSS schemes asshown in [60], [79], and it is studied in [6], [72] how we can detect cheaters in VSS schemes.
But, these studies of VSS schemes are out of scope of this thesis.
In the remaining of Part II is organized as follows: In Section 6.2, we introduce how totreat colors mathematically and define (k, n)-VSS schemes with color secret images. In Section
6.3, we review the algebraic construction of (n, n) and (k, n)-threshold VSS schemes, and it isshown in Section 6.4 how these results can be extended to general access structures. In Chapter 7,
modified basis polynomials [72] are applied to VSS schemes for gray-scale images. Furthermore,
we clarify the optimality of the proposed method. In Chapter 8, VSS schemes for plural secretimages are treated. Finally in Chapter 9, we summarize our results obtained in Part II and future
works are discussed.
In Appendix, we show some examples of VSS schemes treated in this thesis.

6.2 Basic Definitions of Visual Secret Sharing Schemes
6.2.1 Representations of Colors
In this thesis, colors are expressed by lowercase san-serif fonts. For example, we denote black,
red, green, blue, yellow, magenta, cyan, and white by 1, r, g, b, y, m, c and 0, respectively. A
general color is expressed by x.
Let t represent the subtractive mixture of colors which corresponds to overlapping the colors
printed on transparencies. Then, 1 t g = g t 1 = 1, and c t y = y t c = g hold, for example.
Let E be a set of colors printed on shares. Note that t is commutative for the elements in E.
In the case of E = {1, r, g, b, y, m, c, 0}, it is known that E forms a bounded upper semilatticerepresented by a Hasse diagram Lcol in Figure 6.1 if we consider a mixture of colors t as a join
operation on Lcol [67].2 Furthermore, if we restrict Lcol to two elements 0 and 1, the mixtureof them can also be considered as the binary “OR” operation by regarding 0 and 1 as the binary
numbers 0 and 1, respectively.
In VSS schemes, we note that secret images are not completely reproduced. As is illustrated
in Figure 6.2, each pixel on a decrypted secret image DI, which corresponds to a pixel on a secretimage SI, is constructed by a set of m subpixels, and each subpixel takes a color in E. Hence,the color of each pixel in DI is a little different from the one in SI, but they are similar color.
Parameter m is called pixel expansion, which should be as small as possible from the viewpointof the resolution of decrypted image DI. In this thesis, we treat only the case that when the color
2

A partially orders set L is called an upper semilattice if the least upper bound of x and y denoted by x t ybelongs to L for any x, y ∈ L. In the upper semilattice L, it is known that the idempotent law, the commutative law,and the associative law hold with respect to the join operation.

6.2. Basic Definitions of Visual Secret Sharing Schemes61

1 (Black)

r
(Red)

g
(Green)b(Blue)ycm(Yellow) (Magenta) (Cyan)
0 (White)
Figure 6.1. Hasse diagram Lcolof a pixel is x in SI,3 each subpixel of the corresponding pixel in DI is x or 1. A pixel with color
x is called pixel x. Let D be the set of colors used on DI. Then, we assume that E is adequately
selected for D.
Example 6.1 Let us consider a VSS scheme with a set of decrypted colors D = {c, y, g}. Then,
E = {0, c, y, 1} may be adequate for D since it holds that c = 0 t c, y = 0 t y, g = c t y.
2

6.2.2 Basis Matrices of Visual Secret Sharing Schemes
As we pointed out in the previous section, each pixel on a decrypted secret image DI, which corresponds to a secret image SI, is constructed by a set of m subpixels. Letting V = {V1 , V2 , . . . ,Vn } be a set of shares, we encrypt each color x ∈ D of a pixel into an n × m matrix
t11 t12 · · ·t1m
 t21 t22 · · ·t2m 


(6.1)
T =  .. .. . . ..  ∈ E nm ,
 . . . . 
tn1 tn2· · ·tnm
where tuv ∈ E, 1 ≤ u ≤ n, 1 ≤ v ≤ m, denotes the color of the v-th subpixel of the subpixel on
the u-th share Vu . The correspondence between matrix T and subpixel on shares is depicted in
Figure 6.3.
We introduce an equivalence relation ∼ into matrices in E nm [52]. For two matrices A, B ∈E nm , A ∼ B means that A can be obtained by a column permutation of B. In other words, it
3

Color with shades are treated in Section 7.5.

Chapter 6. Introduction to Visual Secret Sharing Schemes

62

Secret image, SI
Black pixel

White pixel

Share 1, V1

Share 2, V2

Stacking up
Decrypted image, DI

Stacking up

Each pixel consistsof 4 suppixels

Figure 6.2 Correspondence between pixels on a secret image and a decrypted image in the caseof (2, 2)-threshold access structure with E = {0, 1} and m = 4

6.2. Basic Definitions of Visual Secret Sharing Schemes

t11

V1

t12

63

t13

Subpixels of one
pixel on share 1

t1v
t1m



V2



t11 t12 · · · t1m
 t21 t22 · · · t2m T = .. .. . . . .. 
tn1 tn2 · · · tnm

t21

t22

t23

Subpixels of one
pixel on share 2

t2v
t2m

Vn

tn1

tn2

tn3

Subpixels of one
pixel on share n

tnv
tnm

Figure 6.3. A set of pixels on n shares represented by a matrix T

holds that for any permutation σ : {1, 2, . . . , m} → {1, 2, . . . , m},[a1 a2 · · · am ] ∼ [aσ(1) aσ(2) · · · aσ(m) ],(6.2)

where ai ’s are column vectors of a matrix T ∈ E nm . It is easy to check that this relation satisfies
the three conditions of the equivalence relation, i.e., the reflective law, the symmetric law, and thetransitive law. Hence we can consider the quotient set E nm/∼, which consists of the equivalenceclasses. An equivalence class is represented as hRi by a representative R in the class.
For two matrices X ∈ E nm1 and Y ∈ E nm2 , denote by a concatenation operation, i.e., itholds that X Y ∈ E n(m1 +m2 ) . As an example, see (1.5). Furthermore, we can define naturally
defthat hXi hY i = hX Y i.
For m-dimensional row vectors of colors x = [ x1 x2 · · · xm ], y = [ y1 y2 · · · ym ] wheremxi , yi ∈ E, we define an operation t asmx t y = [ x1 t y1 x2 t y2 · · · xm t ym ],(6.3)

which represents the subtractive mixtures of two pixels with m subpixels. For a matrix S =[x1 x2 · · · xn ] ∈ E nm , where t means the transpose of a matrix, and an arbitrary set X ={Vu1 , Vu2 , . . . , Vur } ⊆ V , an |X| × m matrix S[[X]] is defined as S[[X]] = t [xu1 xu2 · · · xur ] ∈E | |m . Then, the colors obtained by stacking the ui -th shares, i = 1, 2, . . . , r, are represented by
the mapping η : E | |m → E m defined by
t

m

m

m

η(S[[X]]) = xu1 t xu2 t · · · t xur .
A (k, n)-threshold VSS scheme is defined as follows:(6.4)

Chapter 6. Introduction to Visual Secret Sharing Schemes

64

Definition 6.2 (Koga-Yamamoto [67]) 4 For D = {d1 , d2, . . . , dJ } and pixel expansion m, ann × m matrix Bdj is called a basis matrix5 of dj for a (k, n) access structure if all Bdj , j =1, 2, . . . , J , satisfy the following conditions:(i) It holds for any A ⊆ V with |A| = k that
η Bdj [[A]] ∼ [ dj dj · · · dj 1 1 · · · 1] ,(6.5)

where the number of dj is constant. In the case of dj = 1, the right hand side of (6.5)
consists of only 1’s.
(ii) For any set A ⊆ V with |A| = k − 1, all Bdj [[A]], j = 1, 2, . . . , J , belong to the sameequivalence class in E | |m /∼.
A VSS scheme is called a (k, n, E, D)-VSS scheme if for each color dj ∈ D, j = 1, 2, . . . , |D|,each pixel dj is determined by a matrix randomly selected from hBdj i ∈ E nm /∼, where Bdj is
the basis matrix of dj .
2Letting Nj be the number of dj in (6.5), Nj represents the brightness of decrypted pixel dj .
Hence, we define the contrast of decrypted images as follows.
Definition 6.3 (Koga et al. [66]) A contrast of a (k, n, E, D)-VSS scheme is defined as follows:α=where m is pixel expansion.

min

Nj

dj ∈D, dj 6=1 m

,

(6.6)
2

Note that, in the case of E = {0, 1}, the contrast in Definition 6.3 coincides with the contrast
defined by Naor-Shamir [81]. We also note that contrast α should be as large as possible.
Example 6.4 (Koga-Yamamoto [67]) Let E = {0, c, y, m, 1} and D = {0, y, m, c, r, g, b, 1}.
Then, for the (2, 2, E, D)-VSS scheme, the basis matrices of D can be realized as follows:
0ymc1 1 11
B0 =
(6.7)
01 1 1ymc1
y0mc 1 111
By =
(6.8)
0y 1 1mc11
m 0 cy1111
Bm =
(6.9)
0 m11cy11

c0ym1 1 11
Bc =(6.10)
0c1 1 ym11
4

The original definition of (k, n, E, D)-VSS schemes in [67] does not use the notion of equivalence relations,which we introduced in [52].
5Basis matrices are firstly defined by Droste [35].

6.2. Basic Definitions of Visual Secret Sharing Schemes
y mc01111
Br =m y 11c011

cym0 1 111
Bg =yc 1 1m011

m c y01111
Bb =c m11y011

ymc01 1 11
B1 =
1 1 11ymc0

65(6.11)(6.12)(6.13)(6.14)

It is easy to check that (6.11)–(6.13) satisfy Definition 6.2-(i) and (ii). For example, the first rowsof (6.11)–(6.13) are equivalent to [ y m c 0 1 1 1 1 ]. Pixel expansion and contrast are given by2
m = 8, α = 18 , respectively.
Example 6.5 For the (2, 3, E, D)-VSS scheme with colors E = {0, c, y, 1} and D = {c, y, g}, thebasis matrices are given as follows.
0c101cy11y11
Bc =  c001c11y11y1
(6.15)
11cc0011y11y

0y101yc11c11(6.16)
By = y001y11c11c1
11yy0011c11c
cy1c1y011011(6.17)
Bg = ycc1y1101101
11yycc110110

Then, it holds that m = 12 and α = 61 .

2

Remark 6.6 Note that in Example 6.5, a secret image can be reproduced from any two shares,
but all pixels become black if we stack all three shares. Hence, in the case that we have more thank shares of a (k, n, E, D)-VSS scheme, we have to use only k shares to stack up in decryption. 2
The next theorem is proved for BW-binary secret images in [1] but the same arguments also
hold for any kind of secret images.
Theorem 6.7 (Ateniese et al. [1]) Suppose that for a (k, n, E, D)-VSS scheme, basis matrices
Bd1 , Bd2 , . . . , BdJ contain the same columns. Then, the matrices B̃dj obtained by deleting thesame columns from Bdj are also basis matrices for the (k, n, E, D)-VSS scheme.
2
We omit the proof since it is clear. Note that we should delete the same columns from basis
matrices in order to reduce pixel expansion m.
Example 6.8 Consider basis matrices for the (2, 2, E, D)-VSS scheme with E = {0, c, y, m, 1}
and D = {r, b}. In this case, from Example 6.4, Br and Bb given by (6.11) and (6.13) can be thebasis matrices of D = {r, b}. But, Br and Bb commonly contain the following columns       
0
1
1
1
,
,
,
.
(6.18)
10
1
1Chapter 6. Introduction to Visual Secret Sharing Schemes

66

Hence, by deleting (6.18) from (6.11) and (6.13), we obtain the following basis matrices.


y mc1
B̃r =
(6.19)
m y 1cm c y1B̃b =(6.20)c m1y
In this case, we obtain that m = 4, α = 41 . Note that B̃r and B̃b attain higher contrast and lower
pixel expansion than Br and Bb in Example 6.4.
2

6.3 Algebraic Construction of Visual Secret Sharing Schemes
In this section, a simple construction of VSS schemes called algebraic construction are describedaccording to [66] with a few modifications. See Remark 6.20 for the differences.

6.3.1 Column-Permutation Matrices and Polynomials
Let v be an n-dimensional row vector, each element of which is a color in E. Then, define an n ×
n! matrix Cn (v) called a column permutation (CP) matrix which consists of all n! permutationsof t v [63]. For example, in the case of v = [ r g b ], we have
rg rbbg(6.21)
C3 (v) = grbrgb .
bbggr rIn the case that all the elements of v are different, there are (n!)! matrices that are equivalent
to Cn (v) in the equivalence relation ∼ introduced in Section 6.2.2 and [52]. However, by thebenefit of equivalence relations ∼, it suffices to consider only one matrix that is a representativein the equivalence class.
Note that in the permutation of t v, all n colors in v are treated different colors even if two or
more elements in v are the same color. Hence, as an example, it holds that
g11g11(6.22)
C3 ([g11]) ∼ 1g11g1 .
11g11gWe now introduce the polynomial representation of basis matrices by identifying each equivalence class of basis matrices with a homogeneous polynomial of degree n as follows.6
Let us identify colors x with variables x. For instance, r, g, b, y, m, c and d are identified withr, g, b, y, m, c and d, respectively. Especially, 1 (black) and 0 (white) are identified with z and a,
respectively.
Then, for a row vector v = [ x1 x2 · · · xn ], we can also identify an equivalence class of CP
Q
matrices hCn (v)i and the concatenation operation defined by (1.5) with a monomial ni=1 xi
6

The polynomial representations were developed in [66] based on [63].

6.3. Algebraic Construction of Visual Secret Sharing Schemes

67

and operation +, respectively. For example, an equivalence class of a concatenation of (6.21)
and (6.22) is identified with a polynomial rgb + gz 2 .
Let Cn0 (v) be an (n − 1) × n! matrix obtained by deleting an arbitrary one row in Cn (v).
Then, note that Cn0 (v) consists of a concatenations of CP matrices with n − 1 rows. For instance,
C30 ([r g b]) can be represented as      
rg rbbgrg
rb
bg0
C3 ([r g b]) ∼∼grbrgbgrbrgb∼ C2([r g])

C2 ([r b])(6.23)

C2 ([b g]).

It is worth noting that the polynomial representation for the equivalence class of the right hand∂side of (6.23) is ab + bc + ca, which is obtained by applying a partial differential operator ∂r+∂∂+ ∂b to rgb, the monomial representation of hC3 ([r g b])i.
∂g
It is easy to generalize the above argument. Let E = {e1, e2, . . . , eI , 1} (ei 6= 1) be a set ofcolors used in encryption and {x1 , x2 , . . . , xn } ⊆ E. Then, the polynomial representation of thematrix that consists of arbitrary n − 1 rows of hCn ([x1 x2 · · · xn ])i is given byn YnXΞ(x1x2 · · · xn ) =xj ,(6.24)
i=1 j=1j6=iwhere the partial differential operator Ξ is defined as
Ξ=

I
X
∂

∂e`
`=1

+

∂
.
∂z

(6.25)Let X be a matrix constructed by a concatenation of CP matrices and X 0 be the matrix obtainedby deleting arbitrary one row of X. Note that when X has n rows, X 0 has n − 1 rows. Then, hXi
can be represented by a homogeneous polynomial F of degree n, and hX 0 i can be represented
by ΞF , which is a homogeneous polynomial of degree n − 1.
Example 6.9 For the set of colors E = {0, c, y, 1}, let X be the following matrix with three rows,
each element of which takes value in E.

cy1yc1 cy0yc0
X = ycy11c ycy00c = C3 ([c y 1]) C3([c y 0]).
(6.26)
11ccyy 00ccyy

Note that X is constructed by a concatenation of CP matrices, and hence, X 0 is also constructedby a CP matrices as follows.

cy 1y c1 cy 0y c00X =yc y1 1c yc y0 0c= C2([c y])

C2 ([1 y])C2([c 1])C2([c y])C2 ([0 y])

C2([c 0])(6.27)The polynomial representation of hXi and hX 0 i can be represented by F = cyz + cya andF 0 = 2cy + ac + ay + az + cy, respectively. It is easy to check that F 0 = ΞF holds where the
∂
∂
∂
∂
+ ∂c
+ ∂y
+ ∂z
.
2
partial differential operator Ξ is given by Ξ = ∂aChapter 6. Introduction to Visual Secret Sharing Schemes

68

6.3.2 Polynomial Representations of Basis Matrices
In this section, we construct basis matrices for an (n, n, E, D)-threshold VSS scheme based on
CP matrices. Now, we assume that D = {d1 , d2, . . . , dJ } and each color dj ∈ D is a mixture ofhii
hdj different colors dj ∈ E as follows.
h1i

hhd i

h2i

(6.28)

dj = dj t dj t · · · t dj j ,hiiwhere each dj is used in ui times, androw vector v dj is given by
h1i

Phdj

i=1 ui = n.

h1i

h2i

Then, the corresponding n-dimensional
hhd i

h2i

hhd i

v dj = [dj · · · dj dj · · · dj · · · dj j · · · dj j ]| {z } | {z } |{z}u1 times

def

=

h

h1i

dj

u2 times

u1 

h2i

dj

u2

uhd

j

times

 hh i uhd idj· · · dj j.

(6.29)For an (n, n, E, D)-VSS scheme, a basis matrix of dj , Bdj , can be constructed by using CP matrix
Cn (v dj ) as follows.
Bdj = Cn (v dj )Xdj ,(6.30)

where Xdj ∈ E nm is a matrix which consists of concatenations of several CP matrices. Then, inorder to satisfy the condition (i) in Definition 6.2, i.e., (6.5) for V , it is sufficient that η(Xdj [[V ]])consists of all 1, because it holds that
η(Bdj [[V ]]) ∼ η(Cn (v dj )[[V ]])η(Xdj [[V ]]) ∼ [ dj dj · · · dj 1 1 · · · 1],(6.31)

where η(·) is defined in (6.4). Then, Xdj must contain at least one 1 in each column7 and thepolynomial representation of (6.30), say Fdj , is given by
h

dj
 ui
Y
hii
dj
+ zfdj ,Fdj =(6.32)

i=1

where fdj is a homogeneous polynomial of degree n − 1. We call Fdj the basis polynomial
corresponding to Bdj . Since Fdj is a homogeneous polynomial of degree n, (6.32) is equivalent
to


hdj
 ui
Y
hii
Fdj −
= 0.
(6.33)
dj
i=1

z=0

Note that (6.33) is the condition required for a basis polynomial, which corresponds to the condition (i) in Definition 6.2.
7

Although it holds that r t b = 1 in the case of Figure 6.1 for instance, it is difficult to realize the complete blackfrom the mixture of colors except black in practice. So, we impose this requirement.

6.3. Algebraic Construction of Visual Secret Sharing Schemes

69

Next, let us consider the second condition (ii) in Definition 6.2. In the case of (n, n)-threshold
access structures, Bd0 j must be required for all dj , i.e., for all j = 1, 2, . . . , J , that
(6.34)

Bd0 j ∼ B 0,

where B 0 ∈ E (n−1)m is a matrix that does not depend on dj . This means in the polynomial
representation that for Ξ defined in (6.25), Fdj must satisfy
ΞFdj = F 0, for all j(6.35)

where F 0 is a homogeneous polynomial of degree n − 1 not depending on j. (6.35) is the second
condition required for basis polynomials, which corresponds to (6.5) in Definition 6.2-(ii).
Furthermore, it is worth noting that pixel expansion m and contrast α can be calculated asfollows:
m = n! · Fdj | ei =1,z=1 ,
1≤i≤I

α=

Fdj | ei =1,z=0
1≤i≤I

Fdj | ei =1,z=1,(6.36)(6.37)

1≤i≤I

Summarizing, in the case that every basis matrix consists of the concatenation of CP matrices,
we can rephrase Definition 6.2 for (n, n)-threshold access structures by using basis polynomials.
Theorem 6.10 (Koga et al. [66]) Let Bdj , j = 1, 2, . . . , J , be basis matrices for an (n, n, E, D)VSS scheme which are constructed by the concatenations of some CP matrices. Then, basis
polynomials Fdj corresponding to Bdj satisfy (6.33) and (6.35). Furthermore, pixel expansion mand contrast α are given by (6.36) and (6.37), respectively.
2
Example 6.11 Let us consider the (2, 2, E, D)-VSS scheme with color sets E = {1, c, y, g, 0}
and D = {c, y, g}. Then, the basis matrices with m = 4 shown in [67] are given by0cy1= C2 ([0 c]) C2 ([y 1]),
(6.38)
Bc =
c01y


0yc1
By =
= C2 ([0 y]) C2([c 1]),
(6.39)
y01c


cy10
Bg =
= C2([c y]) C2 ([1 0]).
(6.40)
yc01
The polynomial representations of Bc , By and Bg become
Fc = ac + yz,(6.41)

Fy = ay + cz,(6.42)

Fg = cy + az,(6.43)∂∂∂∂
respectively. Letting Ξ = ∂a
+ ∂c
+ ∂y
+ ∂z
, it is easy to check that Fc, Fy and Fg satisfy (6.33)
2
and (6.35). These basis matrices attain that m = 4 and α = 21 .

Chapter 6. Introduction to Visual Secret Sharing Schemes

70

Theorem 6.10 implies that the basis polynomials obtained by solutions of the simultaneous partial differential equations (6.33) and (6.35) give the basis matrices of (n, n, E, D)-VSS
schemes.
Example 6.12 For the (3, 3, E, D)-VSS scheme with E = {0, c, y, 1} and D = {c, y, g}, let us
derive basis matrices from basis polynomials. From (6.32), the basis polynomials Fc, Fg and Fy
can be represented as
Fc = a2c + P1 (a, c, y)z + P2 (a, c, y)z 2,(6.44)

Fy = a2y + Q1(a, c, y)z + Q2(a, c, y)z 2,(6.45)

2(6.46)

Fg = acy + R1 (a, c, y)z + R2 (a, c, y)z ,where P1 (a, c, y), P2 (a, c, y), Q1(a, c, y), Q2(a, c, y), R1 (a, c, y), R2 (a, c, y) are homogeneouspolynomials of degree 2 which consist of a, c, y. Then, they satisfy the condition (6.33) as
follows.
Fc − a2c z=0 = 0,Fy − a2 y z=0 = 0,

(6.47)[Fg − acy]z=0 = 0.

(6.49)(6.48)

Furthermore, from (6.35), they must also satisfy(6.50)

ΞFc = ΞFy = ΞFg,∂∂∂∂
where Ξ = ∂a
+ ∂c
+ ∂y
+ ∂z
. Since we have that

(6.51)

ΞFc = (a2 + 2ac + P1 ) + (ΞP1 + 2P2 )z + (ΞP2 )z 2,
ΞFy = (a + 2ay + Q1 ) + (ΞQ1 + 2Q2)z + (ΞQ2)z ,(6.52)

ΞFg = (ac + cy + ya + R1 ) + (ΞR1 + 2R2 )z + (ΞR2 )z 2,(6.53)

2

2

P1 , P2 , Q1, Q2 , R1 and R2 must satisfy thata2 + 2ac + P1 = a2 + 2ay + Q1 = ac + cy + ya + R1 ,(6.54)(6.55)

ΞP1 + 2P2 = ΞQ1 + 2Q2 = ΞR1 + 2R2 ,(6.56)

ΞP2 = ΞQ2 = ΞR2.
Therefore, by solving (6.54)–(6.56), we obtain the following basis polynomials:(6.57)

Fc = a2c + (2ay + cy)z + (a + c)z 2,(6.58)

Fy = a2y + (2ac + cy)z + (a + y)z 2,
22

Fg = acy + (ay + ac + a )z + (c + y)z ,(6.59)

6.3. Algebraic Construction of Visual Secret Sharing Schemes

71

which correspond to the following basis matrices.
Bc = C3 ([00c]) C3 ([0y1]) C3([0y1]) C3 ([cy1]) C3 ([011])

00c00c 0y101y 0y101y cyy11c 011011 c11c11= 0c00c0 y001y1 y001y1 yc1yc1 101101 1c11c1 ,c00c00 11yy00 11yy00 11ccyy 110110 11c11c
By = C3 ([00y]) C3 ([0c1]) C3 ([0c1]) C3 ([cy1]) C3 ([011])

00y00y 0c101c 0c101c ycc11y 011011 y11y11= 0y00y0 c001c1 c001c1 cy1cy1 101101 1y11y1 ,y00y00 11cc00 11cc00 11yycc 110110 11y11y
Bg = C3 ([0cy]) C3([0c1]) C3([0y1]) C3 ([001]) C3([c11])

cyc00y 0c101c 0y101y 100100 c11c11 y11y11= yc0cy0 c001c1 y001y1 010010 1c11c1 1y11y1 .
00yycc 11cc00 11yy00 001001 11c11c 11y11y

C3([c11])(6.60)
C3([y11])(6.61)
C3([y11])(6.62)

These basis matrices attain that m = 36, and α = 16 .

2

6.3.3 (n, n)-threshold Visual Secret Sharing Schemes
In the previous section, we show that if basis matrices consist of CP matrices, they can easily
be derived by solving the simultaneous partial differential equations (6.33) and (6.35). But, it isdifficult to obtain the solutions for (6.33) and (6.35) generally. However, in some special cases,
we can derive the solution as follows:
h1i
h2i
hni
For a set of colors D = {d1 , d2 , . . . , dJ }, assume that dj = dj t dj t · · · t dj where allhii
dj , 1 ≤ i ≤ n, 1 ≤ j ≤ J are distinct. In this case, (6.33) and (6.35) become
"

n
Y
hii
Fdj −
dj
i=1

#

= 0, for 1 ≤ j ≤ J,

(6.63)

z=0(6.64)

ΞFd1 = ΞFd2 = · · · = ΞFdJ ,respectively, where Ξ is given by
Ξ=

n X
J
X
∂

∂
+
.
hii
∂z
∂d
i=1 j=1
j(6.65)In this case, the following theorem holds:
Theorem 6.13 (Koga et al. [66]) The basis polynomials satisfying (6.63)–(6.65) are given by
Fdj =

n−1
X

i=0
i:evenisj,n−i z +

J
n−1 X
X
i=1 `=1
i:odd `6=js`,n−i z i ,(6.66)

Chapter 6. Introduction to Visual Secret Sharing Schemes

72
where sj,` is defined bysj,` =







X

hi i hi i

hi i

dj 1 dj 2 · · · dj ` , if 1 ≤ ` ≤ n,
(6.67){Vi ,Vi ,...,Vi }⊆12`
i1 <i2 <···<i`if ` = 0.

1,

2

P
Q
hii
hii
Proof of Theorem 6.13 Note that sj,1 = ni=1 dj and sj,n = ni=1 dj from (6.67). Hence,
Qn hiisince it holds that [Fdj − sj,n ]z=0 = [Fdj − i=1 dj ]z=0 = 0, Fdj satisfy (6.63) for all j =1, 2, . . . , J . On the other hand, ΞFdj can be calculated as follows:
ΞFdj
n−1
(a) X

=

i=0
i:even

n−1
(b) X

=

n
X
∂
l=1

∂
+
hli
∂z
∂dj

!

i

=

n−1
X

isj,n−i z

i−1+

isj,n−i z

i−1

+

n−1 X
J
X
i=1 `=1

n−1
X

isj,n−i z

isj,n−i z

+



n−1
J X
X

`

!

s`,n−i z ii(i + 1)s`,n−(i+1) z +

i−1

+

n
J X
X

is`,n−iz

n−1
J X
X

is`,n−i z i−1`=1 i=1`6=j i:odd

i−1

i=2
`=1
`6=j i:even

i=2
i:even

i−1

l=1

∂
+
hli
∂z
∂d

`=1 i=1`6=j i:odd

i=2
i:even

i=1
i:odd

=

i=1 `=1
i:odd `6=j(i + 1)sj,n−(i+1) z +i=0i:evennXsj,n−i z i +

n−1 X
n
J
X
X
∂

n(J − 1)z n−1 , if n even,nz n−1 ,if n odd,

+

n−1
J X
X

is`,n−iz i−1`=1 i=1`6=j i:odd(6.68)

where the marked equalities (a) and (b) hold from thathii(a): sj,` does not contain dj 0 , j 6= j 0 .
!
n
X
∂
(b):
sj,n−i = (i + 1)sj,n−(i+1) .
hli
∂d
j
l=1

Therefore, it holds that ΞFd1 = ΞFd2 = · · · = ΞFdJ since ΞFdj does not depend on j for any dj .
2
Remark 6.14 Note that although the simultaneous partial differential equations (6.63)–(6.65) area special case of (6.33) and (6.35), the solutions of (6.33) and (6.35) can always be derived fromthe solutions (6.66) as shown in the following example.
2
Example 6.15 In this example, we derive the basis polynomials satisfying (6.47)–(6.50) basedon Theorem 6.13. In order to apply Theorem 6.13, we represent the conditions (6.47)–(6.49) as[Fc − a1a2c1 ]z=0 = 0,

(6.69)[Fy − a3a4y1 ]z=0 = 0,(6.70)[Fg − a5 c2y2 ]z=0 = 0.

(6.71)

6.3. Algebraic Construction of Visual Secret Sharing Schemes

73

Then, from (6.66) in Theorem 6.13, we obtain that
Fc = a1a2 c1 + (a3 a4 + a4y1 + y1 a3 + a5c2 + c2 y2 + y2 a5)z + (a1 + a2 + c1 )z 2, (6.72)
Fy = a3a4 y1 + (a1 a2 + a2c1 + c1 a1 + a5c2 + c2 y2 + y2a5)z + (a3 + a4 + y1 )z 2, (6.73)
Fg = a5c2 y2 + (a3a4 + a4 y1 + y1 a3 + a1a2 + a2c1 + c1 a1)z + (a5 + c2 + y2 )z 2. (6.74)
By letting a1 = a2 = · · · = a5 = a, c1 = c2 = c, and y1 = y2 = y, we obtain
Fc = a2c + (a2 + 3ay + 2cy)z + (2a + c)z 2 ,(6.75)

Fy = a y + (a + 3ac + 2cy)z + (2a + y)z ,(6.76)

Fg = acy + (2ay + 2ac + 2a2 )z + (a + c + y)z 2.

(6.77)

2

2

2

Note that (6.75)–(6.77) contain the common term (a2 + ac + ay)z + az 2. From Theorem 6.7, we
can delete the common terms from (6.75)–(6.77). Hence, we finally obtain
Fc = a2 c + (2ay + cy)z + (a + c)z 2,(6.78)

Fy = a2 y + (2ac + cy)z + (a + y)z 2,(6.79)

Fg = acy + (ay + ac + a2)z + (c + y)z 2,(6.80)

which attains that the pixel expansion m = 36 and contrast α = 16 .

2

In the case that basis polynomials have no common terms, they are called minimal basis
polynomials. We can show in the following theorem that the minimal basis polynomials can be
uniquely determined from the simultaneous partial differential equations.
Theorem 6.16 (Koga et al. [66]) The minimal basis polynomials Fdj , j = 1, 2, . . . , J , which
satisfy (6.33) and (6.35) are uniquely determined.
2
Proof of Theorem 6.16 Suppose there exist another minimal basis polynomials F̃dj that satisfy(6.33) and (6.35), i.e.,ΞF̃d1 = ΞF̃d2 = · · · = ΞF̃dJ ,(6.81)and [F̃dj − dj ]z=0 = 0 for j = 1, 2, . . . , J . Then, consider the difference homogeneous polynomials fdj , j = 1, 2, . . . , J , that is defined by
fdj = Fdj − F̃dj .

(6.82)and the second difference homogeneous polynomial g = fdj − fdj0 for some fixed j and j 0 (6= j).
Since fdj ’s satisfy that
fdj |z=0 = 0, for j = 1, 2, . . . , J(6.83)

Ξfd1 = Ξfd2 = · · · = ΞfdJ ,(6.84)

Chapter 6. Introduction to Visual Secret Sharing Schemes74
g satisfies thatg|z=0 = fdj |z=0 − fdj0 |z=0 = 0,(6.85)

Ξg = Ξfdj − Ξfdj0 = 0.

(6.86)

From (6.86), g can be expressed as(6.87)

g = g1 z + g2 z 2 + · · · + gn−1 z n−1 ,where gi , i = 1, 2, . . . , n− 1, are homogeneous polynomials of degree n− i which do not containz. Then, substituting (6.87) into (6.86), we obtain the following relation.
Ξg = g1 +

n−2 n
o


X
Ξ̃gi + (i + 1)gi+1 z i + Ξ̃gn−1 z n−1 = 0,

(6.88)

i=1

def∂where Ξ̃ = Ξ − ∂z
. Equation (6.88) implies that g1 = g2 = · · · = gn−1 = 0, and hence, we
obtain that g = 0.
Since these arguments hold for any j, j 0 , we havedef

(6.89)

fd1 = fd2 = · · · = fdJ = f.

which does not depend on j. If f 6= 0, Fdj ’s or F̃d0j ’s are not minimal from (6.82). Hence, if both
Fdj ’s and F̃dj ’s are minimal, it holds that f = 0. This means that the minimal basis polynomials
are uniquely determined.
2
The basis polynomials given by (6.57)–(6.59) and (6.78)–(6.80) in Examples 6.12 and 6.15,
respectively, are the same, and they are the minimal basis polynomials. It is clear from Theorem
6.16 that pixel expansion m is also uniquely determined by the simultaneous partial differential
equations. However, since the minimal basis polynomials depends on the condition (6.33), thepixel expansion m also depends on the way how each dj is constructed from the colors in E asshown in the following example.
Example 6.17 Let us consider the (3, 3, E, D)-VSS scheme with color sets D = {y, m, c, r, g, b}.
If we use E = {0, y, m, c, 1} and the conditions[Fy − a2 y]z=0 = 0, [Fm − a2m]z=0 = 0, [Fc − ya2c]z=0 = 0,
(6.90)[Fr − amy]z=0 = 0, [Fg − acy]z=0 = 0, [Fb − acm]z=0 = 0,

which means that we use r = m t y, g = c t y, b = c t m, then we obtain the following basis
1:polynomials with m = 60 and α = 10
(6.91)

Fy = a2 y + (2ac + 2am + cm + cy + my)z + (a + y)z 2,
2(6.92)

Fc = a c + (2am + 2ay + cm + cy + my)z + (a + c)z ,(6.93)Fr = amy + (a2 + 2ac + am + ay + cm + cy)z + (m + y)z 2,(6.94)

Fg = acy + (a2 + ac + 2am + ay + cm + my)z + (c + y)z 2,(6.95)

2

Fm = a m + (2ac + 2ay + cm + cy + my)z + (a + m)z ,
2

2

2

2

Fb = acm + (a + ac + am + 2ay + cy + my)z + (c + m)z .

(6.96)

6.3. Algebraic Construction of Visual Secret Sharing Schemes

75

On the other hand, if we use E = {0, y, m, c, r, g, b, 1} and the conditions[Fy − a2y]z=0 = 0, [Fm − a2m]z=0 = 0, [Fc − a2c]z=0 = 0,
[Fr − a2 r]z=0 = 0, [Fg − a2g]z=0 = 0, [Fb − a2b]z=0 = 0,

(6.97)

Fy = a2y + 2a(m + c + r + g + b)z + yz 2,(6.98)

Fm = a2m + 2a(y + c + r + g + b)z + mz 2,(6.99)

we have22(6.100)2

2

Fr = a r + 2a(y + m + c + g + b)z + rz ,(6.101)

Fg = a2g + 2a(y + m + c + r + b)z + gz 2 ,(6.102)

Fb = a2b + 2a(y + m + c + r + g)z + bz 2,(6.103)

Fc = a c + 2a(y + m + r + g + b)z + cz ,1
. Note that each solution is minimal for each condition. But thewhich attain m = 72 and α = 12
attainable pixel expansions are different.
2

Example 6.17 implies that we must choose the condition (6.33) adequately in order to attainsmaller pixel expansion and higher contrast. However, it is hard to derive the conditions (6.33)
that can attain the smallest m and highest α.

6.3.4 (k, n)-threshold Visual Secret Sharing Schemes
In this subsection, we show a method to derive basis matrices for (k, n, E, D)-VSS schemes
(k)
(k)
(k)
based on CP matrices. First, let Fd1 , Fd2 , . . . , FdJ be basis polynomials for a (k, k, E, D)-VSS
scheme, which can be derived by the method in Section 6.3.3. Then, we have the next theorem:(k)Theorem 6.18 (Koga [63], Koga et al. [66]) Let Fdj , j = 1, 2, . . . , J , be basis polynomials fora (k, k, E, D)-VSS scheme. Then, basis polynomials Fd1 , Fd2 , . . . , FdJ defined by(k)

Fdj = z n−k Fdj ,are the basis polynomials of the (k, n, E, D)-VSS scheme.

(6.104)2

Proof of Theorem 6.18 In the polynomial representation of VSS schemes, the deletion of arbitrary n−` rows from the basis matrices is equivalent to apply the operator Ξ to the corresponding
basis polynomials n − ` times. Therefore, in order to prove this theorem, it is sufficient to show
that
h
i
 n−k

(k)
Ξ Fdj − Cj dj z=0 = Fdj − dj
= 0 for any j = 1, 2, . . . , J,
(6.105)Ξ

n−k+1

Fd1 = Ξn−k+1

Fd2 = · · · = Ξ

z=0
n−k+1

FdJ ,

(6.106)

where Cj is a positive integer. Note that (6.105) and (6.106) correspond to Definition 6.2-(i) and(ii), respectively.

Chapter 6. Introduction to Visual Secret Sharing Schemes

76

i
h
(k)
First, we show (6.105), which is equivalent to Ξn−k Fdj − Cj Fdj

z=0

integer Cj . By calculating Ξn−k Fdj for (6.104), we obtainΞn−k= 0 for some positive


n−k 
X
n − k n−k−i (k) i n−k 
Fdj =Ξ
Fdj Ξ z
i
i=0

n−k 
X
(n − k)!  n−k−i (k) n−k−i
n−k
Ξ
Fdj z
=
.
i
(n
−
k
−
i)!
i=0

(6.107)n−k+1
The last· z n−k = 0. Substituting z = 0 into (6.107), wei since Ξh equality in (6.107) holds(k)have Ξn−k Fdj − (n − k)!Fdj= 0, and hence, it is satisfied by Cj = (n − k)!. Next, we
z=0

prove (6.106). Ξn−k+1 Fdj can be calculated as follows:(k)Ξn−k+1 Fdj = Ξn−k+1 Fdj z n−kn−k+1
X n − k + 1(k)
Ξn−k+1−i Fdj Ξi z n−k
=
i
i=0

n−k 
X
n−k+1
(n − k)!  n−k+1−i (k) n−k−i
=
Ξ
Fdj z
.
i
(n − k − i)!
i=0(6.108)(k)

Furthermore, since Fdj ’s are the basis polynomials of a (k, k, E, D)-VSS scheme, we obtain
(k)

(k)

(k)

Ξ` Fd1 = Ξ` Fd2 = · · · = Ξ` FdJ ,for all ` ≥ 1. By combining (6.108) and (6.109), (6.106) is established.

(6.109)2

Example 6.19 For the (2, 3, E, D)-VSS scheme with E = {0, y, c, g, 0} and D = {c, y, g}, basis
polynomials are given from (6.104) by

(2)

(2)

Fc = z · Fc(2) = acz + yz 2,(6.110)Fy = z · Fy(2) = ayz + cz 2,(6.111)

Fg = z · Fg(2) = cyz + az 2,(6.112)(2)where Fc , Fy , Fg are given by (6.41)–(6.43) in Example 6.11, which are the basis polynomials of the (2, 2, E, D)-VSS scheme.
2
Remark 6.20 The basic idea of CP matrices and their polynomial representations are introduced
by Koga [63], and the algebraic construction of VSS schemes are developed in [66]. In thisthesis, the algebraic construction is described by using the notion of equivalence class, which is
introduced in [52]. Furthermore, it is slightly improved from [66] since the algebraic constructionin [66] cannot be applied to the case of 1 ∈ D as follows.

6.4. Visual Secret Sharing Schemes for General Access Structures77

In [66], the simultaneous partial differential equations for basis polynomials Fdj are given by
h

dj
 ui
Y
hii
,
dj
Fdj |z=0 =(6.113)i=1

ΞFdj = F 0, for all j,(6.114)

which correspond to (6.33) and (6.35), respectively. But, in the case of dj = 1 for some j, there
hii
must exist at least one dj = z in the right hand side of (6.113) although z = 0 is assumed in theleft hand side of (6.113), which is a contradiction. Hence, it is assumed in [66] that 1 6∈ D.
On the contrary, it is easy to see that (6.33) is valid even in the case of 1 ∈ D. Hence, we use(6.33) instead of (6.113).
2

6.4 Visual Secret Sharing Schemes for General Access Structures
In this section, we describe how to construct a VSS scheme for a given general access structure
Γ based on a cumulative map ψΓ defined in Chapter 4. Refer Chapter 2 for general accessstructures.
Let Γ = {AQ , AF} be a given general access structure for a share set V = {V1 , V2 , . . . , Vn }.8Then, (k, n)-threshold VSS schemes in Definition 6.2 can be generalized to VSS schemes forgeneral access structure Γ as follows:
Definition 6.21 (Koga et al. [66]) For D = {d1, d2 , . . . , dJ } and pixel expansion m, an n × m
matrix Bdj is called a basis matrix of dj for access structure Γ if all Bdj , j = 1, 2, . . . , J satisfy
the following conditions:−(i) For the minimal qualified sets A−
Q of Γ, it holds for any Q ∈ AQ that
η Bdj [[Q]] ∼ [ dj dj · · · dj 1 1 · · · 1] ,(6.115)where the number of dj is constant. In the case of dj = 1, the right hand side of (6.115)
consists of only 1’s.
(ii) For any set F ∈ AF , all Bdj [[F ]], j = 1, 2, . . . , J , belong to the same equivalence class in
E | |m /∼.
A VSS scheme for an access structure Γ is called a (Γ, V , E, D)-VSS scheme if for each color
dj ∈ D each pixel dj is determined by a matrix randomly selected from hBdj i ∈ E nm /∼, where
Bdj is the basis matrix of dj .
2
8

In Part II, we treat only perfect VSS schemes. Hence, for simplicity, notation Γ = {AQ , AF } is used for anaccess structure in Part II instead of Γ = {A1 , A0 } defined in Part I, where AQ is the family of qualified sets and
AF is the family of forbidden sets.

Chapter 6. Introduction to Visual Secret Sharing Schemes

78

Note that the contrast can be defined in the same way as Definition 6.3.
Example 6.22 Let Γ1 = {AQ , AF } be an access structure for V = {V1 , V2 , V3 , V4 }, which isdefined as follows:A−
Q = {{V1 , V2 }, {V2 , V3 }, {V3 , V4 }},(6.116)A+
F = {{V1 , V4 }, {V1 , V3 }, {V2 , V4 }}.

(6.117)

Then, the basis matrices of the (Γ1 , V , E, D)-VSS scheme with E = {0, c, y, g, 1} and D ={c, y, g} are given by
c00c0011yy0011yy0011ccyy10101c1c
0cc0ccyy1111yy1111gg111111111111

Bc = 
 c0cc0c111y1y111y1y11g11g11111111 ,0c00c0y001y1y001y1yc1yc10101c1c1

y00y0011cc0011cc0011yycc10101y1y0yy0yycc1111cc1111gg111111111111

By = 
y0yy0y111c1c111c1c11g11g11111111 ,0y00y0c001c1c001c1cy1cy10101y1y1

00yycc11cc0011yy000010011c1c1y1y
ggccyycc1111yy111111011011111111

Bg = 
 cygycg111c1c111y1y10110111111111 .
yc0cy0c001c1y001y1010010c1c1y1y13Then, it holds that m = 32, α = 16.

(6.118)(6.119)(6.120)2

We note that the multiple assignment map [47] treated in Chapter 4 is suitable for VSS
schemes. Let Bdj and B̃dj , j = 1, 2, . . . , J , be the basis matrices of (Γ, V , E, D)-VSS and++(t, t, E, D)-VSS schemes, respectively, wheren t is the cardinality ofo AF , i.e., AF = {F 1 , F 2, . . . ,
(t)

(t)

(t)

F t } for Γ = {AQ , AF }. Letting W (t,t) = W1 , W2 , . . . , Wt

be the set of primitive sharesfor the (t, t, E, D)-VSS scheme, the cumulative map ψΓ : {1, 2, . . . , n} → 2W (t,t) is defined by[ n (t) oWjψΓ (i) =.
(6.121)
j:Vi 6∈jThen, the basis matrices Bdj can be obtained from B̃dj and the cumulative map ψΓ as follows:
Bdj [[{V`}]] = η B̃dj [[ψΓ(`)]] .
(6.122)

It is pointed out (but not proved) in [1] that the basis matrices of VSS schemes with generalaccess structures for BW-binary secret images can be obtained by (6.122). The same arguments
hold for a color secret image as shown in the next theorem.
Theorem 6.23 (Koga et al. [66]) Let Γ = {AQ , AF } be a given general access structure. Then,the basis matrices of the (Γ, V , E, D)-VSS scheme can be obtained from (6.122).
2

6.4. Visual Secret Sharing Schemes for General Access Structures

79

Proof of Theorem 6.23 From Chapter 4, the cumulative map ψΓ (·) satisfies following conditions.
defΨΓ (A) =[ψΓ(i) = W (t,t) , for all A ∈ A−
Q

(6.123)ψΓ(i) ( W (t,t) , for all A ∈ A+
F

(6.124)Vi ∈AdefΨΓ (A) =[Vi ∈A

Hence, for a qualified set Q = {Vi1 , Vi2 , · · · , Vip }, we have

m

m 
m
η(Bdj [[Q]]) = η B̃dj [[ψΓ(i1)]] t η B̃dj [[ψΓ(i2 )]] t · · · t η B̃dj [[ψΓ(ip)]]= η B̃dj [[ΨΓ(Q)]]= η B̃dj [[W (t,t) ]] ,(6.125)which is equivalent to [ dj dj · · · dj 1 1 · · · 1] from the definition of B̃dj .
Next, for a forbidden set F = {Vi1 , Vi2 , . . . , Viq }, it holds thatB̃d1 [[ΨΓ(F )]] ∼ B̃d2 [[ΨΓ(F )]] ∼ · · · ∼ B̃dJ [[ΨΓ(F )]],

(6.126)

since ΨΓ (F ) ( W (t,t) from (6.124). Hence, letting B be a matrix that is equivalent to (6.126),
we obtain η(B̃dj [[ψΓ(i1)]])
η(B[[ψΓ(i1)]]) η(B̃ [[ψ (i )]])   η(B[[ψΓ(i2)]]) 
dj
Γ 2

 

(6.127)
Bdj [[F ]] = 
,
∼
..
..




.
.
η(B[[ψΓ(iq )]])
η(B̃dj [[ψΓ(iq )]])
which does not depend on j. Therefore, Definition 6.21-(ii) holds for all Bdj [[F ]], j = 1, 2, . . . , J .
2
Example 6.24 We derive the basis matrices of the (Γ1 , V , E, D)-VSS scheme with E = {0, c, y,g, 1}, D = {c, y, g}, and Γ1 = {AQ , AF } which is the access structure defined by (6.116) and(6.117) in Example 6.22. The cumulative map is given byno(3)ψΓ (1) = W3
,
n
o
(3)
(3)
ψΓ (2) = W1 , W2
,
n
o
(3)
(3)
ψΓ (3) = W1 , W3
,
o
n
(3)
,
ψΓ (4) = W2

(6.128)(6.129)(6.130)(6.131)

Chapter 6. Introduction to Visual Secret Sharing Schemes

80(3)

where Wi ∈ W (3,3) . By applying (6.122) to the basis matrices of the (3, 3, E, D)-VSS schemein (6.60)–(6.62) in Example 6.12, we obtain
c00c0011yy0011yy0011ccyy11011011c11c
0cc0ccyy1111yy1111gg1111111111111111
(6.132)B̂c =  c0cc0c111y1y111y1y11g11g111111111111 ,0c00c0y001y1y001y1yc1yc11011011c11c1

y00y0011cc0011cc0011yycc11011011y11y0yy0yycc1111cc1111gg1111111111111111
B̂y = (6.133)
y0yy0y111c1c111c1c11g11g111111111111 ,0y00y0c001c1c001c1cy1cy11011011y11y1
00yycc11cc0011yy0000100111c11c11y11y
ggccyycc1111yy1111110110111111111111
(6.134)B̂g =  cygycg111c1c111y1y101101111111111111 .
yc0cy0c001c1y001y10100101c11c11y11y1

For example, the second rows of B̂c , B̂y , B̂g are obtained by stacking the 1st and 2nd rows of(6.60)–(6.62), respectively.
Finally, from Theorem 6.7, we can delete 4 × 4 submatrix which consists of all 1 fromB̂c , B̂y , B̂g , and the basis matrices shown in (6.118)–(6.120) can be obtained.
2

Chapter 7
Visual Secret Sharing Schemes forGray-scale Images
7.1 Introduction
In many studies of VSS schemes, a secret image is usually assumed to be huge letters and/or
simple geometrical shapes, e.g., circles, triangles, etc. But, if we can encrypt gray-scale images,
a picture, for instance shown in Figure 7.1, can be encrypted as a secret image. In [14], VSS
schemes for gray-scale images, for short VSS-GS schemes, are studied, and the necessary andsufficient condition is derived to construct VSS-GS schemes for general access structures. However, concerning VSS-GS scheme, the optimality has not been considered sufficiently, and only
the minimum contrast is treated. In this chapter, we consider average contrast and brightness
offset in addition to the minimum contrast, and we give the optimal construction of VSS-GS
schemes for (n, n)-threshold access structures.
As we showed in Chapter 6, (n, n)-VSS schemes can be constructed algebraically by using
polynomials and simultaneous partial differential equations. This method is first derived forcolor images in [66] and extended to BW-binary images in [72]. In this chapter, we extend thismethod to gray-scale images. Furthermore, we show that the optimal scheme in all the (n, n)VSS-GS schemes can be constructed by the proposed method. In this chapter, we consider
VSS-GS schemes only for (n, n)-threshold access structures because VSS-GS schemes with(k, n)-threshold or general access structures can be constructed from (t, t)-VSS-GS schemes inthe same way as shown in Theorems 6.18 or 6.23, respectively.
This chapter is organized as follows. In Section 7.2, (n, n)-VSS-GS schemes, average andminimum contrasts, and brightness offset are formally defined, and the polynomial representations of (n, n)-VSS-GS schemes are described. Section 7.3 is devoted to show that the optimal(n, n)-VSS-GS scheme, in the viewpoint of resolution, can be constructed by using the polynomial representation. Then, in Section 7.4, we derive tight upper bounds of the average andminimum contrasts. Finally in Section 7.5, we extend gray-scale images to color images withshades.
In Section A.1, we show examples of the VSS-GS-L schemes based on the results obtained81

Chapter 7. Visual Secret Sharing Schemes for Gray-scale Images

82

Figure 7.1. Original secret image with 8-depths gray-scale.

in this chapter.

7.2 Preliminaries
7.2.1 Definitions
A secret image is assumed to be a gray-scale image with L depths, L ≥ 2, which is encrypted ton images called shares. Let V = {V1 , V2 , . . . , Vn } be the set of shares. Each pixel on the secretimage is expanded to m subpixels. Parameter m is called pixel expansion, which should be as
small as possible in the viewpoint of resolution for decrypted images. Each subpixel consistsof white or black, and a gray depth of a pixel is realized by a composition of white and black
subpixels. Hence, we assume that E = {0, 1} and the mixture is expressed by the “OR” operation,
which is defined as 0 t 0 = 0, 1 t 0 = 0 t 1 = 1 t 1 = 1.
In VSS schemes for gray-scale images with L depths, for short VSS-GS-L schemes, a pixel
with the `-th gray depth, ` = 1, 2, . . . , L, is encrypted into an n×m matrix T(`) . The (i, j) elementof T(`) represents the j-th subpixel of the i-th share, and it takes 0 or 1 when the corresponding
subpixel takes white or black, respectively. Then, (AQ , AF )-VSS-GS-L schemes are defined asfollows:
Definition 7.1 A VSS-GS scheme is called an (AQ , AF)-VSS-GS-L scheme if each pixel with the`-th gray depth is determined by matrix T(`) which is randomly selected for each pixel from thefollowing equivalence class hB(`) i.

7.2. Preliminaries

83(i) For any minimal qualified set Q ∈ A−
Q and pixel expansion m, the representatives B(`) ,which are called basis matrices, satisfy thatm − w(η(B(1) [[Q]])) = δ(1) ,w(η(B(`−1) [[Q]])) − w(η(B(`) [[Q]])) = δ(`) , for ` = 2, 3, . . . , L,

(7.1)
(7.2)

where w(v) stands for the Hamming weight of v, and δ(`) is the relative difference ofbrightness between the (` − 1)-th and `-th gray depths. δ(`) is an integer which satisfies
δ(1) ≥ 0 and δ(`) ≥ 1 for ` = 2, 3, . . . , L.
(ii) For any forbidden set F ∈ AF , all B(`) [[F ]], ` = 1, 2, . . . , L, belong to the same equiva
lence class in E | |m ∼.
2

We note from the above definition that basis matrix B(1) corresponds to the darkest pixel
while B(L) expresses the brightest one in the decrypted image. We also note that Definition 7.1
can be considered as the special case of Definition 6.2 such that E = {0, 1} and dj ∈ D is a graywith the j-th depth.
Next we define contrasts and brightness offset which guarantee the clearness and the brightness of decrypted images, respectively.
Definition 7.2 Let B(`) be the basis matrices of an (AQ , AF )-VSS-GS-L scheme. Then, relativeδ(`)
contrasts are defined as α(`) = m
for ` = 2, 3, . . . , L, where m is the pixel expansion. Furthermore, the minimum contrast, the average contrast, and the brightness offset of a decrypted image
are defined as
αmin = min α(`) ,
2≤`≤L
PL
α(`)
,
αave = `=2
L−1
δ(1)
β=
,
m
respectively.1

(7.3)
(7.4)
(7.5)
2

αmin represents the worst clearness in two adjacent gray depths while αave gives the average
clearness of a decrypted image.
In the case of BW-binary images, i.e., L = 2, these contrasts αmin and αave coincide witheach other and they are equal to a contrast
αN S =
1

δ

δ(2)
,
m

(`)
In [14], α(`) = m
is called as “relative differences” rather than “relative contrasts”.

(7.6)

84

Chapter 7. Visual Secret Sharing Schemes for Gray-scale Images

which is defined by Naor-Shamir [81] for BW-binary secret images. Hence, αmin and αave canbe considered as extensions of αN S . Since αN S does not reflect the effect of brightness offset β,Verheul and Van Tilborg [117] proposed another contrast
αV V =δ(2).
m δ(2) + 2δ(1)(7.7)

But it is pointed out in [36] that αV V has a defect such that αV V is always equal to 1/m whenδ(1) = 0. Instead of αV V , Eisen and Stinson [36] proposed a new contrast
αES =

δ(2)
αN S
,
=
m + δ(1)
1+β

(7.8)

where two effects of αN S and β are included in the contrast αES . In [36], [117], it is shown for
the BW-binary case that β effects the clearness, and the larger the value of δ(2) is and the smaller
the value of δ(1) is, the clearer the decrypted image is. In other words, large αN S and small β aredesirable. However, such consequences cannot be applied to the case of gray-scale generally.
In the case of VSS-GS schemes, the brightest pixel on a decrypted image cannot become complete white while complete black can be realized. In addition, the darkest pixel on a decrypted
image is not always complete black. Hence, even if two VSS-GS schemes have the same relative
contrasts α(`) , the brightness offset β may be different. The larger β is, the brighter the decrypted
image is. When β = 0, i.e., δ(1) = 0, then the darkest pixel is complete black. For instance, Fig1
1
ure 7.2-(a) has β = 0 and α(`) = 16
for ` = 2, 3, . . . , 8, which means αmin = αave = 16
. Figure1
7.2-(b) has the same relative differences α(`) as Figure 7.2-(a), but Figure 7.2-(b) has β = 16.
In Figure 7.2, (b) is more natural than (a) because the complete black areas on (a) are much
more conspicuous than other areas. But if pixel expansion m is smaller, Figure 7.2-(a) may lookclearer than (b). These facts mean that it is difficult to determine the optimal value of β because
it depends on the size and/or contents of a secret image, and hence β should be treated separatelyfrom αmin or αave . In this paper, we derive the maximum αmin and αave for a given β.
We note that gray-scale secret images are treated in [14], [67]. But, [67] does not consider thecontrast for gray-scale secret images. Although the relative contrasts and the minimum contrast
are introduced in [14], the average contrast and the brightness offset are not considered.
Example 7.3 The (3, 3)-VSS-GS-3 scheme with δ(1) = 1, δ(2) = 2, and δ(3) = 1 is constructedby the following basis matrices
0001001001111
B(1) = 0010010010111 ,(7.9)
0100100100111

0000011101101
B(2) = 0000101011011 ,(7.10)
0001000110111

0000011011011
B(3) = 0000101101101 ,(7.11)
0000110110110

7.2. Preliminaries

85

1, and β = 0(a) α(2) = α(3) = · · · = α(8) = 16

11
, and β = 16(b) α(2) = α(3) = · · · = α(8) = 16

1.
Figure 7.2. Comparison between two decrypted images with β = 0 and β = 16

86

Chapter 7. Visual Secret Sharing Schemes for Gray-scale Images

which have pixel expansion m = 13. Since w(η(B(1) [[V ]])) = 9, w(η(B(2) [[V ]])) = 10, andw(η(B(3) [[V ]])) = 12 hold, we note from (7.1) and (7.2) that the basis matrices attain relative
differences δ(1) = 1, δ(2) = 2, δ(3) = 1. From Definition 7.2, the contrasts and brightness offset
1
2
1
3
1
become α(2) = 13
, α(3) = 13
, αmin = 13
, αave = 26
, and β = 13
. Since the first and second rowsof B(1) , B(2) , and B(3) satisfy the following equivalence relation
B(1) [[{V1, V2 }]] ∼ B(2) [[{V1, V2 }]] ∼ B(3) [[{V1, V2 }]]
0000010101111∼
0000101010111(7.12)and the similar relation holds for other combinations of two rows, the security condition, i.e.,
Definition 7.1-(ii) is also satisfied.
2

7.2.2 Polynomial Representation of VSS-GS Schemes
In Chapter 6 we showed the algebraic construction of VSS schemes for color images [66]. In
this method, basis matrices are corresponded to polynomials, and it is shown that basis matrices are derived algebraically by solving some simultaneous partial differential equations for thepolynomials. Kuwakado-Tanaka [72] modified the method to apply to VSS-BW schemes. In thissubsection, we extend the method to VSS-GS schemes.
First, for any integer p satisfying p ≤ n, we define the constant-column-weight (CCW) matrixMp,n with weight p as the n × np matrix that has all kinds of column vectors with Hamming
weight p [72]. For instance, M2,4 is given by
001110011001
M2,4 ∼ (7.13)
110010 .
100101
Note that there are np ! matrices that are equivalent to Mp,n . But, by the benefit of the equivalenceclass, it suffices to consider only the representative, which is any one of the matrices.
0
Let Mp,nbe an (n− 1)× np matrix obtained by deleting a row from Mp,n . Then, it can easily00∼ Mp−1,n−1 Mp,n−1 , i.e.,
satisfy Mp,nbe checked that Mp,n and Mp,n0hMp,ni = hMp−1,n−1 ihMp,n−1 i(7.14)

independently from the deleted row. Now we identify an equivalence class hMp,n i with a monozp an−pmial p!(n−p)!
where p and n − p represent the numbers of 1 (black) and 0 (white), respectively, ineach column of Mp,n . We also represent formally concatenation operator with plus operator+. If we use these representations, hMp−1,n−1 i hMp,n−1 i can be identified with homogeneous
zp−1 an−p
zp an−p−1∂∂ zp an−ppolynomial (p−1)!(n−p)!
+ p!(n−p−1)!
, which is equal to ( ∂z+ ∂a) p!(n−p)! . This fact means from∂∂+ ∂arepresents the deletion of an arbitrary row(7.14) that the partial differential operator ∂zfrom representative Mp,n , and hence all matrices in hMp,n i.

7.2. Preliminaries

87
2 2

a
Example 7.4 For M2,4 given by (7.13), the polynomial representation of hM2,4 i is z2!2!
. If any0
one row is deleted from M2,4 , the deleted matrix M2,4 satisfies from (7.13) that     
001110001110
001
110
0







M2,4 ∼ 011001 ∼ 010101 = 010
101 .
110010100011100011

0Hence, by the polynomial representation, hM2,4i can be described as homogeneous polynomial
1
2
2
1
2
2
z a
z a
∂
∂ z a
+ 2!1! , which is equal to ( ∂z + ∂a ) 2!2! .
2
1!2!

In the polynomial representation, there is one-to-one correspondence between all equivalenceclasses in E nm/∼, which are generated from finite concatenations of CCW matrices in E nm , andall homogeneous polynomials with degree n. Now, assume that a basis matrix B(`) is constructedby the concatenation of CCW matrices as follows.
B(`) =

nK[µ(`),p ]Mp,n ,(7.15)

p=0

where µ(`),p are nonnegative integers and M [u] stands for the u-times concatenation of matrix
M, i.e., M
M {z · · · M}. Then the equivalence class of a basis matrix B(`) in (7.15) can be|u times

represented by the corresponding homogeneous polynomial F(`) (z, a) such as
F(`) (z, a) =n
Xµ(`),pp=0z p an−p,p!(n − p)!

(7.16)

which is a basis polynomial.
Hence, in the case of (n, n)-threshold access structures, the properties in Definition 7.1 that
(AQ , AF)-VSS-GS schemes must satisfy can be described by the basis polynomials as follows.
Theorem 7.5 Let F(`)(z, a), ` = 1, 2, . . . , L, be basis polynomials which are identified withbasis matrices B(`) of the (n, n)-VSS-GS-L scheme. Then the construction of the basis matrices
satisfying Definition 7.1 is equivalent to solve the following simultaneous partial differential
equations.
δ(`)
,
n!
ΞF(1)(z, a) = ΞF(2)(z, a) = · · · = ΞF(L)(z, a),(7.17)

F(`)(0, 1) − F(`−1)(0, 1) =(7.18)∂∂+ ∂aand F(0) (0, 1) = 0. Furthermore, pixel expansion m is given by
where Ξ = ∂z

(7.19)

m = n!F(`)(1, 1),
for any `.

2

Proof of Theorem 7.5 In the same way as Theorem 6.10, [66] and [72], it can be checked that
(7.17) and (7.18) correspond to Definition 7.1-(i) and (ii), respectively. Equation (7.19) holds
zp an−p.
2
because the number of columns in the CCW matrix Mp,n is given by n! p!(n−p)!
z=1
a=1

88

Chapter 7. Visual Secret Sharing Schemes for Gray-scale Images

7.3 Minimum Pixel Expansion of (n, n)-VSS-GS Schemes
In this section, based on the polynomial representation, we show how to construct the (n, n)VSS-GS scheme that achieves the minimum pixel expansion for given relative differences. Notethat we can easily extend (n, n)-VSS-GS schemes to (k, n)-VSS-GS schemes and to VSS-GS
schemes with general access structures by using Theorems 6.18 and 6.23, respectively.

7.3.1 Generality of Polynomial Representation in (n, n)-VSS-GS Schemes
If a basis matrix consists of the concatenation of CCW matrices, it can be represented by thecorresponding basis polynomial. But we further show in the next theorem that the basis matrices
of any (n, n)-VSS-GS scheme can be represented by the basis polynomials.
Theorem 7.6 For any (n, n)-VSS-GS-L scheme, basis matrices B(1) , B(2) , . . . , B(L) , can be constructed by the concatenations of CCW matrices in the case that all the basis matrices contain nocommon column vectors except zero column vectors.
2
From Theorem 6.7, we can assume that all the basis matrices contain no column vectors except the column zero vector because such common vectors play no role, and hence such common
vectors can be removed or changed to the zero vectors to make a pixel bright.
Proof of Theorem 7.6 We first prove that for any column vector v in any B(`) , B(`) must also
contain all vectors with the same Hamming weight as v.
In the case that v is the zero column vector, Theorem 7.6 holds obviously. Hence, assume
that v with w(v) ≥ 1 is a nonzero column vector of basis matrix B(`) . Then there is at least one
basis matrix B(l) , l 6= `, that does not contain the vector v. Although B(l) does not contain v,
it is possible that B(`) and B(l) have the same column vectors. In such cases, B(`) and B(l) canbe represented as B(`) ∼ B̂(`) X, B(l) ∼ B̂(l) X, where B̂(`) and B̂(l) contain no common
column vectors. Obviously, v must be contained in B̂(`) . Since it must satisfy from Definition
7.1 (ii) that any n − 1 rows in B̂(`) are equivalent to the corresponding n − 1 rows in B̂(l) , B̂(l)must contain all n column vectors v 1, v 2 , . . . , v n that differ one Hamming distance from v. On
the other hand, for each v i , i = 1, 2, . . . , n, B̂(`) also must have all n column vectors that differ
one Hamming distance from v i . These facts mean that B̂(`) must have all the column vectors thatdiffer even Hamming distances from v.
Since the Hamming distance between any two vectors having the same Hamming weight iseven, all the vectors with Hamming weight w(v) must also be contained in B̂(`) .
We can also show by the similar argument that if B(`) contains the same column vector v
s-times, then each vector with Hamming weight w(v) is also included in B(`) s-times. Hence, inthe case of (n, n)-VSS-GS schemes, any basis matrix can be represented by the concatenation of
CCW matrices, i.e., the basis polynomials.
27.3. Minimum Pixel Expansion of (n, n)-VSS-GS Schemes89

7.3.2 Minimum Pixel Expansion of (n, n)-VSS-GS Schemes
In this subsection, we derive the optimal (n, n)-VSS-GS scheme in the viewpoint of pixel expansion m, in other words resolution, for given relative differences δ(`), ` = 1, 2, . . . , L.
Theorem 7.7 Let m be the pixel expansion of an (n, n)-VSS-GS-L scheme which has relative
differences δ(`) , ` = 1, 2, . . . , L. Then the minimum pixel expansion m∗ is given by(7.20)m∗ = 2n−1 ∆ + δ,
where δ = δ(1) and ∆ =PL`=2 δ(`) . The basis matrices that attain m[δ]B(`) = M0,n





n

 K [∆(`) ] 
Mp,n 

p=0
p:evenwhere ∆(`) =P`

l=2 δ(l) .



n

∗

are given by K [∆−∆(`) ] 
Mp,n
,


(7.21)

p=1
p:odd

2

Proof of Theorem 7.7 From Theorems 7.5 and 7.6, we can use the basis polynomials shown in(7.15) instead of the basis matrices in the construction of (n, n)-VSS-GS schemes. From (7.16)
and (7.17), µ(`),0 must satisfy thatµ(`),0 =X̀δ(l) = δ + ∆(`) ,(7.22)l=1

and

δ = µ(1),0 < µ(2),0 < · · · < µ(L),0 = δ + ∆.

(7.23)

Since it holds that
ΞF(`)(z, a) =n−1
Xµ(`),p + µ(`),p+1

p=0



z pan−p−1
p!(n − p − 1)!

(7.24)and ΞF(`)(z, a) must satisfy (7.18), µ(`),p + µ(`),p+1 must be independent of `. Hence, for somenonnegative integers µp , µ(`),p must satisfy that for any `µp = µ(`),p + µ(`),p+1 .

(7.25)

Since all µp and µ(`),p are nonnegative integers, we have thatµp ≥ max µ(`),p(7.26)

F 0(z, a) = ΞF(1) (z, a) = ΞF(2) (z, a) = · · · = ΞF(L) (z, a)n−1Xz p an−p−1=µp,p!(n − p − 1)!
p=0(7.27)

1≤`≤L

for any p. Letting F 0(z, a) beChapter 7. Visual Secret Sharing Schemes for Gray-scale Images

90

pixel expansion m is given from (7.19) as follows.
0m = (n − 1)! F (1, 1) =

n−1
X

µp

p=0




n−1
p

(7.28)In order to minimize pixel expansion m, we must minimize all µp . In the following, we showthat such minimization is possible.
Since it holds from (7.23) and (7.26) that µ0 ≥ max µ(`),0 = µ(L),0 = δ + ∆, µ0 can be1≤`≤L

represented as µ0 = ε0 + δ + ∆ for some nonnegative parameter ε0 ≥ 0. Substituting µ0 into
(7.25), we have µ(`),1 = ε0 + δ + ∆ − µ(`),0 . Then µ1 can be represented as µ1 = ε0 + ε1 + ∆for another nonnegative parameter ε1 ≥ 0 because it is obtained from (7.23) and (7.26) thatµ1 ≥ max µ(`),1 = ε0 + δ + ∆ − min µ(`),0 = ε0 + δ + ∆ − µ(1),0 = ε0 + ∆. Next we have from
1≤`≤L

1≤`≤L

(7.25) that µ(`),2 = µ1 − µ(`),1 = ε1 − δ + µ(`),0 . Hence, it is also obtained from (7.22), (7.23)
and (7.26) that µ2 ≥ max µ(`),2 = ε1 − δ + max µ(`),0 = ε1 − δ + µ(L),0 = ε1 + ∆. Repeating
1≤`≤L

1≤`≤L

the similar procedure, we have that µ0 = ε0 + δ + ∆ and for p = 1, 2, . . . , n,µp = εp + εp−1 + ∆,µ(`),0 − δ,if p is even,µ(`),p = εp−1 +∆ + δ − µ(`),0 , if p is odd,

(7.29)(7.30)

where εp ≥ 0 are parameters and µ(`),0 is given by (7.22). Since µp should be as small as possible,
the optimal µp is obtained by letting εp = 0 for all p as follows.
δ + ∆, if p = 0,
(7.31)µp =∆,if p ≥ 1.
This optimal case can be attained from (7.22) and (7.30) by∆(`) ,
if p ≥ 2 is even,µ(`),p =∆ − ∆(`) , if p ≥ 1 is odd,

(7.32)and the minimum pixel expansion m∗ is obtained from (7.28) and (7.31) by


n−1
X
n−1
∗
m = µ0 +
µp
p
p=1

n−1 
X
n−1
= δ+∆+∆pp=1= δ + ∆ + ∆(2n−1 − 1)

= 2n−1 ∆ + δ.

(7.33)

Finally, the optimal basis matrices shown in (7.21) are obtained from (7.15),(7.22) and (7.32). 2
We note from the proof of Theorem 7.7 that in case of m ≥ 2n−1 ∆ + δ, the basis matrices
can be constructed by selecting εp ≥ 0 adequately. Hence we have the following corollary.

7.4. Maximum Contrasts and Minimum Pixel Expansion

91

Corollary 7.8 The (n, n)-VSS-GS-L scheme with relative differences δ(`) and pixel expansion
m can be constructed if and only if it holds thatm ≥ 2n−1 ∆ + δ.

(7.34)
2

Theorem 7.7 gives the minimum pixel expansion m∗ for given relative differences δ(`). But,
when we can select the minimum values of δ(`) , i.e., δ(1) = 0, δ(`) = 1 for ` = 2, 3, . . . , L, wehave that ∆ = L − 1 and δ = 0. This case attains the overall minimum of pixel expansion m∗ inall allowable δ(`) .
Corollary 7.9 (Naor-Shamir [81], Blundo et al. [14]) The minimum pixel expansion m∗ in all
the (n, n)-VSS-GS-L schemes is given by 2n−1 (L − 1).
2This corollary coincides with the results shown in [14] and, in case of L = 2, [81].
Remark 7.10 We note that an (n, n)-VSS-GS scheme can be constructed in a different way.
We first transform a gray-scale secret image into a BW-binary image with L-depth halftones,e.g., by the dither method [83]. Then we encrypt the binary image by the basis matrices of an(n, n)-VSS-BW scheme. If the differences of the (` − 1)-th and `-th halftones are δ(`) which are
determined by a dither matrix, each pixel must be expanded to at least ∆ subpixels in the caseof δ(1) = 0. Since 2n−1 subpixels are required to realize any (n, n)-VSS-BW scheme, the total
pixel expansion becomes 2n−1 ∆, which coincides with (7.20) in the case of δ(1) = 0. Hence,such construction of (n, n)-VSS-GS-L schemes is also optimal.
2

7.4 Maximum Contrasts and Minimum Pixel Expansion
In Section 7.2.1, we pointed out that the optimal brightness offset β may depend on the size orcontents of a secret image. However, for a given β, the contrasts should be maximized. Hence,
for a given β, we derive the maximum αmin and αave in Section 7.4.1 and the minimum pixel
expansion that attains the maximum average contrast αave in Section 7.4.2.

7.4.1 Maximum Average Contrast and Minimum Contrast
Blundo et al. [14] showed that a VSS-GS-L scheme with a given access structure Γ exists if andP
only if it holds that L`=2 α(`) ≤ α∗N S , where α∗N S is the maximum αN S defined in (7.6) for the
VSS-BW schemes with access structure Γ. In the case of (n, n)-VSS-GS schemes, the above
inequality becomesLX`=2α(`) ≤ 2−(n−1)(7.35)

92

Chapter 7. Visual Secret Sharing Schemes for Gray-scale Images

because the maximum contrast α∗N S is given by α∗N S = 2−(n−1) as shown in [81]. This condition
given by (7.35) can also be derived directly from Corollary 7.8 by dividing both sides of (7.34)
by m and letting δ = 0. Furthermore, we can also obtain the condition in the case of δ 6= 0, i.e.,
β 6= 0 from (7.34) as follows.
Corollary 7.11 An (n, n)-VSS-GS-L scheme with relative contrasts α(1) , α(2) , . . . , α(L−1) andbrightness offset β can be constructed if and only if it holds thatL
X

α(`) ≤ 2−(n−1) (1 − β),(7.36)`=2and α(`) and β are rational numbers.

2

Corollary 7.11 can be derived from Corollary 7.8. But we have from Corollary 7.11 only thatm ≥ K 2n−1 ∆ + δ(7.37)

for some integer K ≥ 1. Hence, Corollary 7.8 cannot be derived directly from Corollary 7.11.
In [14], it is described that (7.37) with (K = 1, ∆ = L − 1, δ = 0) is obtained directly from
(7.36) with β = 0 in the (n, n)-threshold case although K = 2n−1 is assumed in their proof of[14, Theorem 3.2]. Therefore, their proof for (n, n)-VSS-GS schemes is not rigorous.
Note that the case of β = 0 does not always give a clear image. Corollary 7.11 gives how thevalue of β effects the relative contrasts.
Next, from Corollary 7.11 and Theorem 7.7, we derive the maximum αave and αmin .
Theorem 7.12 In all the (n, n)-VSS-GS-L schemes, the average and minimum contrasts, αave
and αmin , are bounded by(a)

αave , αmin ≤

(b)
1−β
1
≤ n−1
n−1
2 (L − 1)
2 (L − 1)(7.38)

for L ≥ 2. There always exist the basis matrices that attain the equality of (a), and inequality (b)holds with equality when β = 0.
2
Proof of Theorem 7.12 From Corollary 7.11 and (7.4), it is obvious that inequality (a) holdswith respect to αave . On the other hand, for αmin , inequality (a) follows from that (L − 1)αmin ≤PL−(n−1)(1 − β), where the first inequality holds with equality if and only if`=2 α(`) ≤ 2
δ(2) = δ(3) = · · · = δ(L) .

Finally, inequality (b) holds because of 0 ≤ β < 1.

(7.39)
2

We note from the proof of Theorem 7.12 that both αmin and αave can be maximized at thesame time in any (n, n)-VSS-GS-L schemes by letting δ(`) satisfy (7.39) and δ = 0. The next
example attains the maximum αmin and αave in all the (3, 3)-VSS-GS-4 schemes.

7.4. Maximum Contrasts and Minimum Pixel Expansion

93

Example 7.13 Letting δ(1) = 0 and δ(2) = δ(3) = δ(4) = 1, the basis polynomials of the optimal(3, 3)-VSS-GS scheme with the maximum αmin and αave is given from (7.16), (7.22) and (7.32)
byz 0 a3z 1 a2z 2 a1z 3 a0F(1) (z, a) = 0
+3
+0
+3
,
0!3!
1!2!
2!1!
3!0!
z 0 a3z 1 a2z 2 a1z 3 a0F(2) (z, a) = 1
+2
+1
+2
,
0!3!
1!2!
2!1!
3!0!
z 0 a3z 1 a2z 2 a1z 3 a0F(3) (z, a) = 2
+1
+2
+1
,
0!3!
1!2!
2!1!
3!0!
z 1 a2z 2 a1z 3 a0z 0 a3+0+3+0,F(4) (z, a) = 3
0!3!
1!2!
2!1!
3!0!
1
, β = 0 and m = 12.
which achieve αmin = αave = 12(7.40)(7.41)(7.42)(7.43)
2

7.4.2 Minimum Pixel Expansion with Maximum Average Contrast
In this subsection we consider the minimum pixel expansion that attains the maximum averagecontrast αave for a given brightness offset β. From Corollary 7.11, the relative contrast α(`) andthe brightness offset β must satisfy (7.36), and the equality case in (7.36) maximizes the averagecontrast αave . Therefore, we consider such a case.
Theorem 7.14 In an (n, n)-VSS-GS-L scheme, assume that relative contrasts α(2) , α(3) , . . . ,α(L) and brightness offset β satisfy (7.36) with equality, and each α(`) and β are given by rational
number α(`) = pq`` for ` = 2, 3, . . . , L and β = pq11 , where p` and q` are relatively prime. In case of
β = 0, p1 = 0 and q1 = 1. Then, the minimum pixel expansion m∗ is given by the least common
multiple of q1, q2 , . . . , qL .
2
Proof of Theorem 7.14 Let λ be the least common multiple of q1, q2, . . . , qL. Then, α(`) and βsatisfy that
λ
δ(`)
p`
q`
α(`) =
=
=
,
m
q`
λ
λ
pL
δ(L)
pL
qL
β=
=
=
.
m
qL
λ
p`

(7.44)(7.45)

Since p` and q` are relatively prime, m must be a multiple of q` for every `, and hence, it cannot
become smaller than λ. Since p` qλ` is an integer, we can set δ(`) as δ(`) = p` qλ` . In this case, itholds from (7.20) that
∗

n−1

m =2

L
X

n−1

δ(`) + δ(L) = 2

λ`=2= λ 2n−1

L
X
p`
`=2

L
X
`=2

α(`) + β

!

= λ,

q`

+ pL

λ
qL
(7.46)

Chapter 7. Visual Secret Sharing Schemes for Gray-scale Images

94

where the last equality follows from the equality case of (7.36). Hence, λ is the minimum pixel
expansion.
2
We note from the proof of Theorem 7.12 that the minimum pixel expansion m∗ given in
Theorem 7.14 also attains the maximum αmin if α(`) and β satisfy (7.36) with equality and α(2) =α(3) = · · · = α(L) .
1
Example 7.15 We construct the (3, 3)-VSS-GS-4 scheme with relative contrasts α(2) = 16
,
P
4
1
1
1
3
−(3−1)(1 − 8 ).
α(3) = 32 , α(4) = 16 and brightness offset β = 8 which satisfy `=2 α(`) = 2
Since the least common multiple of denominators of α(`) and β is given by λ = 32, we can attainm∗ = 32. Actually, we can realize this m∗ by letting δ(`) = λα(`) and δ(1) = λβ, i.e., δ(1) = 4,
δ(2) = 2, δ(3) = 3, and δ(4) = 2, which derive the following basis polynomials.

z 0 a3z 1 a2z 2 a1z 3 a0
+7
+0
+7
,
0!3!
1!2!
2!1!
3!0!
z 1 a2z 2 a1z 3 a0z 0 a3+5+2+5,
F(2)(z, a) = 6
0!3!
1!2!
2!1!
3!0!
z 0 a3z 1 a2z 2 a1z 3 a0F(3)(z, a) = 9
+2
+5
+2
,
0!3!
1!2!
2!1!
3!0!
z 0 a3z 1 a2z 2 a1z 3 a0F(4)(z, a) = 11
+0
+7
+0
.
0!3!
1!2!
2!1!
3!0!

F(1)(z, a) = 4(7.47)(7.48)(7.49)(7.50)
2

Finally we consider the minimum pixel expansion m∗ in the case that both αmin and αave are
maximized at the same time for β = 0. From Theorem 7.12, the maximum of αmin and αave can1
be achieved when α(`) = (L−1)2
n−1 for all ` = 2, 3, . . . , L. In this case, the pixel expansion isn−1
given by 2 (L − 1) from Theorem 7.14. We note from Corollary 7.9 that this m∗ is equal tothe minimum pixel expansion in all the (n, n)-VSS-GS-L schemes.

7.5 VSS Schemes for Color Images with Shades
In this section, we give a method to construct the basis matrices of (n, n)-threshold VSS schemes
for color images with shades, VSS-CS schemes for short, based on basis polynomials. But, notethat VSS-CS schemes with general access structures can easily be derived from (n, n)-VSS-CS
schemes by using the cumulative map in the same way as shown in Section 6.4 or [1], [47], [66].

7.5.1 Preliminaries
In this subsection, we extend Definitions 6.21 and 7.1 to the case of VSS-CS schemes withgeneral access structures.
Let E be the set of colors printed on shares. In order to represent colors with shades, we
modify the definition of D for color images with shades as follows:

7.5. VSS Schemes for Color Images with Shades

95

We express the colors of pixels with shades in a decrypted secret image DI by capital sanserif fonts X(`) , ` = 1, 2, . . . , Lx . Each X(`) , which is composed of x and z, stands for the `-thbright color of x (6= z). In the case of x = 0, the color with shades becomes gray and we express
the gray depth by A(`) for ` = 1, 2, . . . , L0 . We assume that X(`1 ) is brighter than X(`2 ) , i.e., X(`1 )contains more x than X(`2 ) if `1 > `2 . In the case that all subpixels in a decrypted pixel are 1, we
represent the pixel color by Z. For the simplicity of notation, we define X(0) = Z for any x ∈ E.
Note that X(1) 6= Z for any x(6= 1) ∈ E, and in the case of x = 0, the set {A(1) , A(2) , . . . , A(L0 ) }represents the gray scale with L0 depths discussed in the previous sections [14], [52].
For a set {X(0) (= Z), X(1) , X(2) , . . . , X(Lx ) }, let δX(`) denote the difference of the numbers ofx between X(`−1) and X(`) . In case of x = 1, define that δZ = 0. Note that δX(`) ≥ 1 for any
x 6= 1 and ` ≥ 1. Then we assume that the color of each pixel on a secret image SI can beapproximated by selecting a color x ∈ E and parameter δX(`) adequately, and hence, there exists
one-to-one correspondence between the set of colors of SI and that of DI.
Let D be the set of all the colors with all kinds of brightness included in a decrypted image
DI. Then, for X(`) and Z ∈ D, we can define a mapping γ : D → E that gives a hue γ(X(`) ) =x ∈ E and γ(Z) = 1.
Remark 7.16 The above definition of decrypted pixel colors includes both the definitions forlattice-based VSS schemes [43], [66], [67] and VSS-GS-L schemes [14], [52]. On the other hand,meanvalue-color mixing (MCM) VSS schemes [45], [117] cannot be treated by the above definition because in the MCM-VSS schemes, each pixel on decrypted images is composed of thethree primary colors (r, g, b) and 1. But, since the MCM-VSS schemes requires large pixel expansion, it seems to be hard to realize a VSS scheme for a general access structure with n ≥ 3.
2
Now, we can define VSS schemes for color images with shades for general access structures{AQ, AF } as follows.
Definition 7.17 A VSS scheme for an access structure Γ is called a (Γ, V , E, D)-VSS-CS scheme
if it has color sets D and E, and for every ` ∈ {1, 2, . . . , Ld } each pixel associated with D(`) ∈ D
is determined by a matrix TD(`) randomly selected from hBD(`) i ∈ E nm/∼, where BD(`) is thebasis matrix of D(`) that must satisfy the following conditions:(i) It holds for any BD(`) and any Q ∈ A−
Q that
 





η BD(`) [[Q]] ∼ γ D(`) γ D(`) · · · γ D(`) 1 1 · · · 1 .

(7.51)P`
In the case that BD(`) [[Q]] represents D(`) for some ` ≥ 1, γ D(`) appears l=1 δD(l) timesin (7.51) where δD(l) , l = 1, 2, . . . , `, are positive integers. In the case of ` = 0, the righthand side of (7.51) consists of only 1’s.
(ii) For any set F ⊆ AF , BD(`) [[F ]] are equivalent for any D(`) ∈ D.

2

Chapter 7. Visual Secret Sharing Schemes for Gray-scale Images

96

7.5.2 Algebraic Construction of VSS-CS Schemes
In Sections 7.2 and 7.3, we have constructed (n, n)-VSS-GS-L schemes based on CCW matrices.
A CCW matrix can be considered as a modified version of CP matrix introduced in Section 6.3.1
for VSS schemes for color images. Hence, the CCW matrices with colors are called different
column permutation matrices, which are defined formally in the following.
Let E be the set of colors used in encryption and D be the set of colors in a decrypted image.
First, recall the CP matrix defined in 6.3.1. As an example, a CP matrix is given as follows.

cyycyyC3 ([cyy]) ∼ ycyycy .
(7.52)
yycyycNow we assume that a color x ∈ E is obtained by

x = |xh1i t ·{z· · t xh1i} t |xh2i t ·{z· · t xh2i} t · · · t |xhhx i t ·{z· · t xhhx}i .
u1 times

u2 times(7.53)

uhx times

P x
where xhii ∈ E appears ui times and hi=1
ui = n. Note that if x 6= 1, then it must hold from thehiidefinition of t that all x 6= 1 for all i = 1, 2, . . . , hx . Let v x be an n-dimensional row vector
given byv x = [|xh1i ·{z· · xh1i} |xh2i ·{z· · xh2i} · · · |xhhx i ·{z· · xhhx}i ]u1 times

def

=

h

u2 times

uhx times i
h1i u1h2i u2hhx i uhx
.
x
x
··· x

(7.54)

Then the number of different column vectors obtained by the permutations of t v x is givendefby N(v x ) = u1 ,u2 n,...,uh . A different column permutation (DP) matrix Dn (v x ) is defined as axmatrix that consists of such N(v x ) different columns. For example, in the case of v g = [cyy],



cyy


D3 (v g ) = D3 c1y2 ∼ ycy .
yyc(7.55)

We note that any CP matrix can be represented by the concatenations of DP matrices. For instance, C3 ([cyy]) and D3 ([c1y2 ]) satisfies from (7.52) and (7.55) that
C3([cyy]) ∼ D3 ([c1y2])D3 ([c1y2 ]).

(7.56)

It is worth noting that any n − 1 rows of DP matrix Dn (v x ), say Dn0 (v x ), is equivalent to theconcatenation of DP matrices with n − 1 rows. As an example, it holds that


cy y
0
1 2
D3 ([c y ]) ∼∼ D2 ([c1y1]) D2 ([c0y2]),(7.57)
yc y7.5. VSS Schemes for Color Images with Shades

97

where [c0y2] = [y2]. Generally, it holds for ui ≥ 1, i = 1, 2, . . . , hx , that
hDn0 (v x )i = Dn0 (xh1i )u1 (xh2i )u2 · · · (xhhx i )uhx
= Dn−1 (xh1i )u1 −1 (xh2i )u2 · · · (xhhx i)uhx
Dn−1 (xh1i )u1 (xh2i )u2 −1 · · · (xhhx i )uhx


.
···
Dn−1 (xh1i )u1 (xh2i )u2 · · · (xhhx i)uhx −1(7.58)

We now describe the polynomial representations of basis matrices which consist of the concatenation of DP matrices. We identify each equivalence class of basis matrices with the corresponding homogeneous polynomial of degree n in the following way.
First, we identify colors xhii and 1 with variables xhii and z, respectively. We also identify theequivalence class of DP matrices hDn (v x )i and the concatenation operation with a monomial
Qhx (xhii )ui
and operation +, respectively.
i=1ui !
Assume that the equivalence classes of basis matrices BX(`) , 0 ≤ ` ≤ Lx , representing colors
X(`) ∈ D are constructed by the concatenation of equivalence classes of DP matrices Dn (v x ) as
follows.
hBX(`) i = hDn (v x )i|`
l=1 δX(l)···{zhDn (v x )i hXi,}

(7.59)N (v x ) times

P
where `l=1 δX(l) is a multiple of N(v x ) and X consists of the concatenation of DP matricesthat contain at least one 1 in every column.2 Then, let FX(`) be a basis polynomials, which is ahomogeneous polynomial of degree n, corresponding to hBX(`) i.
From the assumption (7.59), the basis polynomial FX(`) must satisfy that
"
#
P`
hx
hii ui
Y
δ
(x
)
X
(l)
l=1
FX(`) −
= 0.
(7.60)
N(v x ) i=1 ui !
z=0

On the other hand, the polynomial corresponding to the right hand side of (7.58) is given by


0i u
hx
h
h
x
x
hii
u
−1
hi
0
Y
X  (x ) i Y (x ) i (xhii )ui=
Ξ,
(7.61)(uuui − 1)! i0 =1
i0 !
i!
i=1
i=1
i0 6=iPx ∂where Ξ = hi=1
. Therefore, if any n − 1 rows of BX(`) are equivalent for any x and `, the∂xhiibasis polynomial FX(`) must satisfy that
ΞFX(`) = F,(7.62)

P∂
where Ξ = x∈E ∂x
and F is a homogeneous polynomial of degree n−1 that depends on neither
x nor `.
Summarizing the above, we have the following theorem.
2

In the case of X(0) = Z, hBX(0) i is obtained by lettingP`

l=1 δX(l) = 0.

Chapter 7. Visual Secret Sharing Schemes for Gray-scale Images

98

Theorem 7.18 Suppose that basis matrices BX(`) are obtained by the concatenation of DP matrices as shown in (7.59). Then, the basis polynomials FX(`) corresponding to BX(`) satisfy (7.60)
and (7.62).
2
In the case that Lx = 1 for all x and all the basis matrices consist of CP matrices, the basis
polynomials can be obtained by solving simultaneous partial differential equations (7.60) and(7.62) as shown in Section 6.3.2 or [43], [66]. But in general cases, it is difficult to derive theexplicit solutions of (7.60) and (7.62). Hence, we consider the case that hx = 1 and u1 = n for
all x. In this case, it holds that N(v x ) = 1 for all x, and (7.60) becomes
"
#
X̀
xn
FX(`) −
δX(l)= 0.
(7.63)n!
l=1

z=0

Then, the basis polynomials are given by
FX(`) =X̀◦

δX(l) f (x) +l=1•

δX(l) f (x) +l=`+1where ζ(D) is defined by

and f ◦ and f • are given by

Lx
X

X

f (x) =

δX̃(l) f • (x̃),(7.64)x̃∈ζ(D)−{z,x} l=1ζ(D) = γ D(`) : D(`) ∈ D ,
◦

Lx̃
X

n
X

zt
xn−t ,
t!(n
−
t)!
t=0

(7.65)(7.66)

t:evenf • (x) =

n
X

zt
xn−t.
t!(n
−
t)!
t=1

(7.67)

t:odd

∂
∂
∂
∂
Note that ( ∂x+ ∂z)f ◦ (x) = ( ∂x+ ∂z)f • (x). (7.66) and (7.67) can easily be obtained from theresults shown in [52], [67], [72], and hence we omit the derivation.
Furthermore, it is easy to check that the pixel expansion of BX(`) corresponding to (7.64) is
given by

m=

Lx
X X

δX(l) 2n−1 .

(7.68)x∈ζ(D) l=1

Note that the above construction coincides with the method shown in [67] in the case of (n, n)threshold access structures.
Example 7.19 Let us consider the (3, 3, E, D)-VSS-CS scheme with E = {g, y, 1} and D ={G(1) , G(2), Y(1) }. If we set δG(1) = δY(1) = 1 and δG(2) = 1, (7.63) and (7.62) are given by






g3
g3
y3
FG(1) −
= 0, FG(2) − 2= 0, FY(1) −= 0,(7.69)
3! z=03! z=03! z=0ΞFG(1) = ΞFG(2) = ΞFY(1) ,(7.70)

7.6. Conclusion

99

∂
∂
∂
where Ξ = ∂z
+ ∂g
+ ∂y
. Then, from (7.64), the solutions of (7.69) and (7.70) are given by

FG(1) = f ◦ (g) + f • (g) + f • (y),◦(7.72)•(7.73)

FG(2) = 2f (g) + f (y),◦(7.71)•

FY(1) = f (y) + 2f (g).
Since f ◦ (x) and f • (x) correspond toD3 ([x3])

D3 ([13])xx11
D3 ([x12 ]) = x1x1 ,
x11x


11xx
D3 ([x2 1]) = 1x1x ,1xx1(7.74)(7.75)

respectively, the basis matrices corresponding to FG(1) , FG(2) , FY(1) are given as follows:
gg1111gg11yy
BG(1) = g1g11g1g1y1y ,(7.76)
g11g1gg11yy1
gg11gg1111yy(7.77)
BG(2) = g1g1g1g11y1y ,g11gg11g1yy1
yy1111gg11gg(7.78)
BY(1) = y1y11g1g1g1g .
y11y1gg11gg1
Note that from Theorem 6.7, we can eliminate the column t [111] from (7.76)–(7.78).

2

7.6 Conclusion
In this chapter, we considered the optimal construction of (n, n)-VSS-GS schemes to minimize
the pixel expansion for given relative differences δ(k) , relative contrasts α(k) , or to maximize theminimum and average contrasts αmin and αave for a given brightness offset β.
First we showed that basis polynomials can represent any (n, n)-VSS-GS schemes. Then
we derived algebraically the attainable minimum pixel expansion for given relative differences
δ(k) by using the polynomial representation of VSS-GS schemes. Furthermore, we clarified the
maximum value of contrasts αmin and αave , and we derived the minimum pixel expansion forgiven relative contrasts α(k) and brightness offset β. Finally, we defined the VSS-SH schemesfor (n, n) access structures and constructed the basis matrices for such VSS-SH schemes.
Note that (n, n)-VSS-GS schemes can easily be extended to (k, n)-VSS-GS schemes or VSSGS schemes with general access structures in the same way as shown in Section 6.4 [1], [66]. But
it is difficult to derive the optimal (k, n)-VSS-GS scheme in the case of k < n. We note that
Theorem 7.7 does not hold for the (k, n)-threshold case. For instance, the optimal constructionof the (2, n)-VSS-BW scheme shown in [12] cannot be represented by any basis polynomials.

Chapter 8
Visual Secret Sharing Schemes for Plural
Secret Images
8.1 Introduction
In Chapters 6 and 7, we assumed that a single secret image is encrypted in a VSS scheme, but
VSS schemes with two or more secret images are studied in [35], [53], [60], [62], [107]. KatoImai [60] proposed a method to reproduce different secret images as the number of shares isincreased, and Suga et al.[107] treated VSS schemes for plural secret images and some accessstructures which can be represented by a graph. Furthermore, Droste [35] showed a method todecrypt different secret images for every subset of n shares, which is improved by Klein-Wessler[62] to attain smaller pixel expansion than Droste’s method. However, note that [35], [60], [62],[107] treat only BW-binary secret images, and VSS schemes have not yet been studied for generalcases such that secret images are plural color images and their access structures are general.
In this chapter, we propose a method to construct a VSS scheme for q plural images, a VSSq-PI scheme for short, which can treat color images with shades. In the framework of VSS-q-PI
schemes, we assume that each participant holds one share, and usual VSS schemes for one secretimage can be treated as VSS-1-PI schemes. Furthermore, VSS schemes with n identification(ID) images [2] can be considered as VSS-(n + 1)-PI schemes by treating the n ID images as
secret images that can be decrypted from a single share.
Note that it is difficult to realize VSS-q-PI schemes, compared with VSS-1-PI schemes, because each pixel of plural secret images must be encoded under the condition that any decrypted
images must not leak out any information of the other secret images. In fact, as we will showin Section 8.2.3, the decrypted images of VSS-q-PI schemes treated in [60], [107] leak out some
information of the other secret images. But, by defining the correct security conditions of VSSq-PI schemes, we can establish the construction method of VSS-q-PI schemes that can attainperfectly the security conditions without degenerating the quality of decrypted images comparedwith the methods in [35], [107].
This chapter is organized as follows. In Section 8.2, the access structures of VSS-q-PI
schemes are formally defined, and a color matrix is introduced to describe the colors of plural
101

Chapter 8. Visual Secret Sharing Schemes for Plural Secret Images

102

secret images. Section 8.3 is devoted to show how to construct VSS-q-PI schemes. Furthermore,in Section 8.4, we discuss an extended construction method by duplicating secret images, which
can extend the range of VSS-q-PI schemes that our method can be applied to. Finally, in Section
8.5, we clarify what advantages VSS-q-PI schemes have, compared with q individual VSS-1-PI
schemes. The contents of this chapter are published in [53].
Furthermore, some examples of images in VSS schemes with plural secret images are shownin Appendix A.4.

8.2 Definitions
8.2.1 Access Structures
Let V = {V1 , V2 , . . . , Vn } and 2 be the set of n shares and the family of all the subsets of V ,respectively. We suppose that all secret images are encrypted at once into n shares. Each secrethhiii
image is denoted by SI hhiii, i = 1, 2, . . . , q, which has the same size. Let AQ , i = 1, 2, . . . , q, be
the family of qualified sets for the i-th secret image, and let AF be the family of forbidden sets.
hhiii
hhiii
whileoany set in AF cannot gain
Then, any set in AQ can decrypt the i-th secret image
n SI
hhiii

any information of any secret image. We call Γ = {AQ }qi=1 , AF
secret images.
hhiiiNote that each AQ and AF satisfy the following monotonicity.
hhiii

an access structure for qhhiii

A ∈ AQ ⇒ A0 ∈ AQ for any A0 ⊇ A(8.1)

for any A ⊆ A

(8.2)

0

A ∈ AF ⇒ A ∈ AF

0

hhiii

hhiii−

Therefore, for each AQ and AF , the minimal qualified sets of the i-th secret image AQ
the maximal forbidden sets A+
F can be defined as follows.
hhiii−

AQ

hhiii

hhiii

= {A ∈ AQ : A0 6∈ AQ for any A0 ( A}00A+
F = {A ∈ AF : A 6∈ AF for any A ) A}
hhiii−

AQ

and

(8.3)
(8.4)

and AF are naturally required to satisfy
(q
[

hhiii
AQ

∪ AF = 2 ,(8.5)

AQ ∩ AF = ∅,(8.6)

hhi0ii−

(8.7)

i=1

hhiii−

AQ

)

hhiii

∩ AQ

= ∅ for i 6= i0.

The requirement (8.7) comes from the assumption that all the secret images are different. It is
hh1ii
worth noting that a VSS-1-PI scheme with an access structure {AQ , AF } coincides with a usual
VSS scheme with the same access structure for one secret image, which is treated in Chapters
6–7, [1], [10], [14], [66].

8.2. Definitions

103

Y(1)

G(2)

c2
c3

R(1)

G(1)

c4
(a) SI hh1ii(c) Location of shapes in (a) and (b)(b) SI hh2ii

Figure 8.1. An example of plural secret images
We also define V hhiii, the set of significant shares for the i-th secret image, as follows.
[V hhiii =A.
(8.8)
hhiii−∈AQ

Example 8.1 Let V = {V1 , V2 , V3 , V4 } be the set of shares. Suppose that any two out of threeshares {V1 , V2 , V3 } can decrypt the secret image SI hh1ii shown in Figure 8.1 (a), and set {V3 , V4 }can decrypt the secret image SI hh2ii shown in Figure 8.1 (b). But, sets {V1 , V4 }, {V2 , V4 } or any
one share must not leak out any information of both secret images. This access structure can be
represented as follows.
hh1ii

AQ

= {{V1 , V2 }, {V1 , V3 }, {V2 , V3 }, {V1 , V2 , V3 },{V1 , V2 , V4 }, {V1 , V3 , V4 }, {V2 , V3 , V4 }, {V1 , V2 , V3 , V4 }}

hh2ii

AQ

= {{V3 , V4 }, {V1 , V3 , V4 }, {V2 , V3 , V4 }, {V1 , V2 , V3 , V4 }}(8.10)(8.11)

AF = {{V1 }, {V2 }, {V3 }, {V4 }, {V1, V4 }, {V2 , V4 }}hh1ii−(8.9)

hh2ii−In this case, it holds that AQ= {{V1 , V2 }, {V1, V3 }, {V2 , V3 }}, AQ= {{V3 , V4 }}, A+
F =
hh1ii
hh2ii
{{V3 }, {V1, V4 }, {V2 , V4 }}, V= {V1 , V2 , V3 }, V
= {V3 , V4 }. Note that because of
hh2ii{V1 , V2 , V3 } 6∈ AQ , set {V1 , V2 , V3 } must not leak out any information of SI hh2ii although it
can decrypt SI hh1ii.
2

8.2.2 Color Matrix
Let E be the set of colors used in encryption, and denote by Dhhiii the set of colors with shades on
decrypted image DI hhiii, i = 1, 2, . . . , q. We assume that each {E, Dhhiii } coincides with {E, D}hhiii
defined in Section 7.5. D(`) ∈ Dhhiii , ` = 1, 2, . . . , Ldhhiii , stands for a color with hue dhhiii andthe `-th depth of shades. Hence, we can define a map γ : Dhhiii → E, which gives the huehhiii
γ(D(`) ) = d for D(`) ∈ Dhhiii and γ(Z) = 1 similarly to Section 7.5. Furthermore, let δD(`) be the104

Chapter 8. Visual Secret Sharing Schemes for Plural Secret Images

relative difference of shades, which is defined as the difference of numbers of d between D(`−1)
and D(`) in Dhhiii .
def

Now we define a color matrix. Let D3 be D3 = Dhh1ii × Dhh2ii × · · · × Dhhqii. Then, in a VSSq-PI scheme, all the combinations of colors appeared in decrypted images can be represented bya color matrix D, which is defined as follows.

D = c1 c2 · · · cK r hh1ii
Dhh1ii,1 Dhh1ii,2 · · · Dhh1ii,K Dhh2ii,1 Dhh2ii,2 · · · Dhh2ii,K   r hh2ii  (8.12)= =  ..  ,
..
..
..
.
.
  . .
.
.
.
Dhhqii,1 Dhhqii,2 · · · Dhhqii,Kr hhqii

Qq
hhiii
where K =|, cj ∈ D3 and r hhiii are a q-dimensional column vector and a Ki=1 |Ddimensional row vector, respectively, and Dhhiii,j is a color included in Dhhiii .
We assume that D is public. In usual VSS schemes, i.e., VSS-1-PI schemes, D becomes arow vector with elements Dhh1ii,j ∈ Dhh1ii. Although one color Dhh1ii,j is encrypted for each pixelin VSS-1-PI schemes, color vector cj with q colors must be encrypted for each pixel in VSS-q-PI
schemes.
Example 8.2 In the case of Example 8.1 with two secret images SI hh1ii and SI hh2ii shown in
Figure 8.1 (a) and (b), Dhh1ii and Dhh2ii are given by Dhh1ii = {G(1), G(2) } and Dhh2ii = {Y(1) , R(1) },respectively, and hence the color matrix becomes  hh1ii  1 2 3 4
G(1) G(2) G(1)G(2)r
D= c c c c =.
(8.13)=
r hh2ii
Y(1) Y(1) R(1) R(1)Note that Dhh1ii consists of green pixels with two levels of shades while Dhh2ii consists of yellow
and red pixels.
2

Remark 8.3 Consider the case that the shapes in Figure 8.1 (a) and (b) are located as shown in
Figure 8.1 (c). There are three regions in Figure 8.1 (c), which correspond to the column vectors
c2, c3 and c4 in D. But the color matrix D should be composed of four column vectors c1 , c2 , c3 ,and c4 because of K = 4. Note that if the public D consists of c2 , c3 and c4 , we can know fromDI hh2ii that the color of the region c2 in Figure 8.1 (c) is G(2) on DI hh1ii because Y(1) on DI hh2ii
corresponds only to G(2) on DI hh1ii. Therefore, all vectors in D must be included in D even if
some vectors are not appeared in the secret images.
2

8.2.3 Definition of VSS-q-PI Schemes
Let m be pixel expansion which should be as small as possible in the viewpoint of the resolutionof decrypted images. We encrypt each cj into an n × m matrix T j = [tjuv ] ∈ E nm where tjuv ∈ E,
1 ≤ u ≤ n, 1 ≤ v ≤ m, denotes the color of the v-th subpixel on the u-th share in a pixel
represented by a vector cj .

8.2. Definitions

105
hhiii

If a given set A ⊆ V is included in two or more AQ , then two or more secret images canbe decrypted from A. Let I(A) be the set of indices of the secret images that can be decryptedfrom A, i.e.,
n
o
hhiii
I(A) = i : A ∈ AQ , 1 ≤ i ≤ q .
(8.14)For instance, I(V ) = {1, 2, . . . , q}, and I(A) = ∅ for any A ∈ AF .
Now we define a VSS-q-PI scheme for a general access structure Γ.

Definition 8.4 For a color matrix D = [c1 c2 · · · cJ ], an n × m matrix B j is called a basis matrix
of a vector cj = [Dhh1ii,j Dhh2ii,j · · · Dhhqii,j ] if B j satisfies the following conditions:
hhiii(i) For every i, j and any A ∈ AQ , it holds that


 


η B j [[A]] ∼ γ Dhhiii,j γ Dhhiii,j · · · γ Dhhiii,j 1 1 · · · 1 .

(8.15)In the case that B j [[A]] represents a color X(`) with some ` ≥ 1, we have that Dhhiii,j = X(`) ,

P
hhiii
γ(Dhhiii,j ) = x, and γ Dhhiii,j appears `l=1 δX(l) times in (8.15). Note that the positivehhiii

integer δX(`) may depend on DI hhiii and X(`) , but not on j. In the case of ` = 0, the righthand side of (8.15) consists of only 1’s.
0(ii) For any set A ⊆ V , it holds that B j [[A]] ∼ B j [[A]] for any j and j 0 satisfying cj [[I(A)]] =0cj [[I(A)]]. 1
A VSS-q-PI scheme for an access structure Γ is called a (Γ, V , E, D)-VSS-q-PI scheme if it hascolor matrix D for color set E, and for every j ∈ {1, 2, . . . , K} each pixel associated with cj isdetermined by a matrix T j randomly selected from hB j i ∈ E nm/∼, where B j is the basis matrixof cj .
2
Example 8.5 In the VSS-2-PI scheme treated in Examples 8.1 and 8.2, basis matrices B 1 , B 2, B 3
and B 4 are given by








1gg111
1gg111
1gg111
1gg111
g1g111






 , B 2 = 1gg111 , B 3 = g1g111 , B 4 = 1gg111 .
B1 = 
(8.16)
gg1yr11ggyr1gg1ry11ggry1
111y1r111y1r
111r1y111r1yIt is easy to check that (8.16) satisfies the conditions (i) and (ii) in Definition 8.4. For example,
hh1ii−
it holds for {V1 , V2 } ∈ AQ
that η (B 3 [[{V1, V2 }]]) ∼ [g11111], η (B 4 [[{V1, V2 }]]) ∼ [gg1111],
hh1ii
hh1ii
δG(1) = 1, and δG(2) = 1. These relations mean that B 3 and B 4 represent G(1) and G(2) on
hh2ii−DI hh1ii, respectively. Furthermore, it holds for {V3 , V4 } ∈ AQ
that η (B 2[[{V3, V4 }]]) ∼
hh2ii
hh2ii
[y11111], η (B 4[[{V3, V4 }]]) ∼ [r11111], δY(1) = δR(1) = 1, which mean that B 2 and B 4 represent Y(1) and R(1) on DI hh2ii, respectively.
1 j

0c [[I(A)]] = t [Dhhi1 ii,j Dhhi2 ii,j · · · Dhhir ii,j ] if I(A) = {i1 , i2 , . . . , ir }. cj [[∅]] = cj [[∅]] for any j and j 0 .

106Chapter 8. Visual Secret Sharing Schemes for Plural Secret Images

It holds that for A123 = {V1 , V2 , V3 }, B 1[[A123 ]] ∼ B 3[[A123 ]] and B 2[[A123 ]] ∼ B 4 [[A123 ]],i.e., A123 does not leak out the colors of pixels on DI hh2ii. Hence, the basis matrices given by
hh1ii
hh2ii
(8.16) attain that both A123 ∈ AQ and A123 6∈ AQ . Furthermore, it can easily be checked that
B 1[[A]] ∼ B 2[[A]] ∼ B 3[[A]] ∼ B 4[[A]] for any A ∈ AF .
2
hhiii−

Remark 8.6 The condition (i) in Definition 8.4 means that any A− ∈ AQ
can decrypt the
hhiii
hhiii
secret image SI . But, SI
cannot always be decrypted by stacking all the shares included
hhiii
in A ∈ AQ . For instance, in Example 8.5, η(B j [[V ]]) ∼ [111111] for all j, which does not
hh1ii
hh2ii
satisfy the condition (i) in Definition 8.4, although V ∈ AQ and V ∈ AQ . We must select ahhiii−
set A− ∈ AQ included in A to decrypt SI hhiii.
2Note that A ∈ AF satisfies the following condition from I(A) = ∅ and (8.6).
(ii)0 For any A ∈ AF , all B j [[A]], j = 1, 2, . . . , K, are included in the same equivalence classin E nm/∼.
hh1ii

In the case of VSS-1-PI schemes, any A(⊆ V ) satisfies either A ∈ AQ or A ∈ AF since
hh1ii
the access structures have only two categories AQ and AF . Hence, in this case, it suffices toconsider only the conditions (i) and (ii)0, which coincide with Definition 7.17 (i) and (ii). Basedon this consideration, VSS-q-PI schemes are defined by (i) and (ii)0 in [60], [107]. However, theconditions (i) and (ii)0 are not sufficient for q ≥ 2 because as shown in the following example,hhiii
the condition (ii)0 does not guarantee that any A 6∈ AQ does not leak out any information of0
hhi0iisecret image SI hhiii even when A ∈ AQ for some other secret image SI hhi ii .
Example 8.7 Consider the access structure given by (8.9)–(8.11) in Example 8.1 again. Then,matrices B̃ 1, B̃ 2 , B̃ 3, and B̃ 4 defined by (8.17) satisfy conditions (i) and (ii)0.








gg11111
11gg111
11gg111
11gg111
g1g1111






 , B̃ 2 = 11gg111 , B̃ 3 = 1g1g111 , B̃ 4 = 11gg111 . (8.17)
B̃ 1 = 1gg1yr1
11ggyr1
g11gry1
11ggry1
1111y1r
1111y1r
1111r1y1111r1yNote that A12 = {V1 , V2 }, A13 = {V1 , V3 }, A23 = {V2 , V3 }, A123 = {V1 , V2 , V3 } are not
hh2ii
included in AQ . The above matrices satisfy thatB̃ 1[[A12 ]] ∼ B̃ 3[[A12 ]], B̃ 2[[A12 ]] ∼ B̃ 4 [[A12 ]],B̃ 1[[A13 ]] ∼ B̃ 3[[A13 ]], B̃ 2[[A13 ]] ∼ B̃ 4 [[A13 ]],B̃ 1[[A23 ]] ∼ B̃ 3[[A23 ]], B̃ 2[[A23 ]] ∼ B̃ 4 [[A23 ]].

(8.18)

Hence, any one of A12 , A13 , A23 does not leak out any information about DI hh2ii. But, it holds
that B̃ 1[[A123 ]] 6∼ B̃ 3[[A123 ]], η(B̃ 1[[A123 ]]) ∼ [111111] and η(B̃ 3 [[A123 ]]) ∼ [g11111]. Thismeans that from pixels with G(1) on DI hh1ii, we can distinguish yellow pixels from red pixels on
DI hh2ii, which correspond to B̃ 1 and B̃ 3, respectively, by investigating the shares of A123 . Hence,
the matrices given by (8.17) are inadequate as the basis matrices of this access structure. On thecontrary, the basis matrices B 1, B 2, B 3 and B 4 given by (8.16) satisfy B 1[[A123 ]] ∼ B 3[[A123 ]]and B 2 [[A123 ]] ∼ B 4 [[A123 ]].
2

8.3. Construction Method of VSS-q -PI Scheme

107

8.3 Construction Method of VSS-q-PI Scheme
8.3.1 Construction Method
In this subsection, we describe a method to construct (Γ, V , E, D)-VSS-q-PI schemes.
hhiii
hhiii
First, for a given access structure Γ, define ÃQ and ÃF as follows.
hhiii

hhiii

(8.19)ÃQ = {A ∈ AQ : A ⊆ V hhiii },
hhiii

ÃF
hhiii

hhiii

(8.20)= {A ⊂ V hhiii : A 6∈ AQ }.

hhiii

hhiii

hhiii

hhiii

hhiii

hhiii

It is easy to check that ÃQ ∩ ÃF = ∅, ÃQ ∪ ÃF = 2, ÃQ and ÃF have the monohhiii
hii
hhiii
tonicity in the same way as AQ and AF , respectively. Therefore, Γhhiii = {ÃQ , ÃF } can beconsidered as the access structure of the VSS-1-PI scheme with secret image SI hhiii for share set
V hhiii. Then, letting E hhiii be the set of colors necessary to encrypt SI hhiii, the basis matrices ofthe (Γhhiii, V hhiii, E hhiii , rhhiii )-VSS-1-PI scheme can be constructed by the method in Section 7.5.
Therefore, letting |V hhiii| × mhhiii matrices Ghhiii,j , for j = 1, 2, . . . , K, be the basis matrices ofthe (Γhhiii , V hhiii , E hhiii, r hhiii)-VSS-1-PI scheme, where mhhiii is the pixel expansion for secret im0
age SI hhiii, then Ghhiii,j represents a color Dhhiii,j and satisfies that Ghhiii,j = Ghhiii,j if Dhhiii,j and0Dhhiii,j are the same color. Furthermore, basis matrix Ghhiii,j satisfies conditions (i) and (ii)0, i.e.,
P
def
hhiii
the number of γ(Dhhiii,j ) included in η(Ghhiii,j [[A]]), `l=0 δX(l) where x = γ(Dhhiii,j ), is constanthhiii−

for any A ∈ AQ , and it holds that Ghhiii,1 [[A]] ∼ Ghhiii,2 [[A]] ∼ · · · ∼ Ghhiii,K [[A]] for anyhhiii
A ∈ AF .
Next, we construct an n × mhhiii matrix H hhiii,j defined byhhii
H hhiii,j V hhiii = Ghhiii,j ,(8.21)
ii
hh(8.22)
H hhiii,j V hhiii = J,

where matrix J consists of only 1’s and V hhiii means the complement set of V hhiii on V . Then
we construct n × m basis matrices B j , j = 1, 2, . . . , K, by
j

B =

q
K

(8.23)

H hhiii,j ,

i=1

Pq

where m = i=1 mhhiii.
We now consider two categories Θ1 and Θ2 for the access structures of VSS-q-PI schemes.
Definition 8.80(i) An access structure Γ is in Θ1 if it satisfies A ∩ V hhi ii 6= ∅ for any i and i0 such thathhiii−A ∈ AQ and i0 ∈ I(A) − {i}.
0(ii) An access structure Γ is in Θ2 if it satisfies that A ∩ V hhi ii 6= ∅ for any i and i0 (6= i) suchhhiii−
that A ∈ AQ .
2

Chapter 8. Visual Secret Sharing Schemes for Plural Secret Images

108

Remark 8.9 It is obvious from the above definition that Θ2 ⊂ Θ1, and it holds generally that2Θ2 ( Θ1 . Furthermore, there exist access structures that are not included in Θ1 .
Example 8.10 Assume that an access structure ΓID is defined by
AF = {{V2 }},hh1ii−AQ= {{V1 }},hh2ii−AQ= {{V1 , V2 }}.

(8.24)(8.25)(8.26)

Then, ΓID does not belong to Θ1 , and hence, nor Θ2 . From (8.25), secret image SI hh1ii can beobtained only from V1 . Hence, SI hh1ii can be considered as the identification (ID) image of share
1 although SI hh2ii is a secret image. The above access structure ΓID is a modified version of the(2, 2)-VSS scheme with two ID images [2], [43], and note that VSS-q-PI schemes include such
VSS schemes with ID images as special cases.
Next, consider the access structure Γg treated in [107], which is given by
AF = {{V1 }, {V2 }, {V3 }, {V4}, {V5 }},hh1ii−AQ= {{V1 , V2 }, {V1 , V5 }, {V2 , V3 }, {V3, V4 }, {V4 , V5 }},hh2ii−= {{V1 , V3 }, {V1 , V4 }, {V2 , V4 }, {V2, V5 }, {V3 , V5 }}.
AQ
Then, Γg is included in Θ1 but not in Θ2.

(8.27)(8.28)(8.29)
2

Theorem 8.11 B j , j = 1, 2, . . . , K, given by (8.23) are the basis matrices of the (Γ, V , E, D)VSS-q-PI scheme, if |E| = 2 and Γ ∈ Θ1 , or if |E| ≥ 3 and Γ ∈ Θ2 .
2
Example 8.12 We show how the basis matrices given by (8.16) can be derived from Theorem
8.11 for the access structures Γ given by (8.9)–(8.11) in Example 8.1 and the color matrix D
given by (8.13) in Example 8.2. Note that the access structure Γ belongs to Θ2 . From (8.19) and
hh1ii
hh2ii
(8.20), we have ÃF = {{V1 }, {V2}, {V3 }} and ÃF = {{V3 }, {V4 }}. Then the basis matrices
Ghhiii,j of the (Γhh1ii , V hh1ii, E hh1ii, r hh1ii)-VSS-1-PI scheme and the (Γhh2ii , V hh2ii, E hh2ii, r hh2ii)-VSS1-PI scheme are given by




1bb
1bb
Ghh1ii,1 = Ghh1ii,3 = b1b , Ghh1ii,2 = Ghh1ii,4 = 1bb ,
bb1
1bb
and

hh2ii,1G

hh2ii,2

=G

 
 
y1r
ry1
hh2ii,3hh2ii,4
=
, G
=G
=
,
yr1
r1y

respectively. Hence we obtain from (8.21) and (8.22) that




1bb
1bb
1bb


 , H hh1ii,2 = H hh1ii,4 = b1b ,H hh1ii,1 = H hh1ii,3 = 
1bb
bb1
111
111

(8.30)

8.3. Construction Method of VSS-q -PI Scheme

109

 
 
111
111




111
hh2ii,3hh2ii,4
111 .
,
H=H=
H hh2ii,1 = H hh2ii,2 = y1r 
 ry1
yr1
r1y(8.31)

Finally, basis matrices B 1, B 2, B 3 and B 4 are given from (8.23) as follows.
B 1 = H hh1ii,1H hh2ii,1, B 2 = H hh1ii,2H hh2ii,2,

B 3 = H hh1ii,3H hh2ii,3, B 4 = H hh1ii,4H hh2ii,4,

which are equivalent to (8.16).

(8.32)
2

Remark 8.13 In [107], it is shown that the access structure Γg given by (8.27)–(8.29) in Example
8.10 can be represented by a graph. In the case of |E| = 2, as treated in [107], (8.23) gives thebasis matrices. But in the case of |E| ≥ 3, (8.23) does not give the basis matrices for Γg generally
because Γg does not satisfy the condition of Theorem 8.11, i.e., Γg 6∈ Θ2.
2

8.3.2 Proof of Theorem 8.11
In this subsection, we prove Theorem 8.11. We first show that matrices H hhiii,j given by (8.21)
and (8.22) satisfy the next lemma.
Lemma 8.14 For any i 6∈ I(A), it holds that
H hhiii,1 [[A]] ∼ H hhiii,2 [[A]] ∼ · · · ∼ H hhiii,K [[A]].

(8.33)
2

hhiii

Proof of Lemma 8.14 From (8.14), we note that A ∈ ÃF if i 6∈ I(A). Hence, from the
hhiii
hhiii
monotonicity of ÃF , it holds that A ∩ V hhiii ∈ ÃF for i 6∈ I(A).
H hhiii,j [[A]] can be represented as
hh
 
ii
H hhiii,j [[A]] = H hhiii,j A ∩ V hhiii ∪ A ∩ V hhiii .
(8.34)In (8.34), it holds for i 6∈ I(A) that H hhiii,1 [[A∩V hhiii]] ∼ H hhiii,2 [[A∩V hhiii]] ∼ · · · ∼ H hhiii,K [[A∩hhiii
V hhiii]] since H hhiii,j [[V hhiii]] satisfies (8.21) and A ∩ V hhiii ∈ ÃF . On the other hand, from (8.22),
all the elements of H hhiii,j [[A ∩ V hhiii]] are 1 for every j. Therefore, (8.33) holds for any i 6∈ I(A).
2jProof of Theorem 8.11 First, we show that B given by (8.23) satisfies the condition (i) in
hhiii−
Definition 8.4. Substituting (8.23) into η(B j [[A]]) for A ∈ AQ , we have
!
q
K

0
H hhi ii,j [[A]]η B j [[A]] = η
i0 =1∼ η(H hhiii,j [[A]])qK hhi0 ii,jηH[[A]]
i0 =1
i0 6=i∼ η(Ghhiii,j [[A]])η(X hhiii,j )η(Y hhiii,j ),(8.35)

Chapter 8. Visual Secret Sharing Schemes for Plural Secret Images

110

where X hhiii,j and Y hhiii,j are defined asK

X hhiii,j =0

H hhi ii,j [[Ahhiii− ]],(8.36)

0(8.37)i0 ∈ ( )−{i}Y hhiii,j =

K

i0 6∈

H hhi ii,j [[A]].

( )Note that since Ghhiii,j is the basis matrix of the (Γhhiii, V hhiii, E hhiii , rhhiii)-VSS-1-PI scheme,it satisfies the condition (i) in Definition 8.4 for the (Γhhiii , V hhiii , E hhiii, r hhiii)-VSS-1-PI scheme.
First consider the case of |E| = 2 with E = {1, e}. In this case, η(Ghhiii,j ), η(X hhiii,j ), andη(Y hhiii,j ) are vectors with two colors, e and 1. Hence, if for each i, η(X hhiii,j ) η(Y hhiii,j ) areequivalent with respect to ∼ for any j, (8.15) is satisfied for η(B j [[A]]). From Lemma 8.14, wehave that000(8.38)

H hhi ii,1 [[A]] ∼ H hhi ii,2 [[A]] ∼ · · · ∼ H hhi ii,K [[A]]for any i0 6∈ I(A). Hence, for each i, η(Y hhiii,j ) are equivalent for any j. Furthermore, for any0i0 ∈ I(A) − {i}, η(H hhi ii,j [[A]]) can be represented as

hh
 
ii
0
0
0
0
η(H hhi ii,j [[A]]) = η H hhi ii,jA ∩ V hhi ii ∪ A ∩ V hhi ii.
(8.39)
0

Since (8.22) holds and we have that A ∩ V hhi ii 6= ∅ for such i0 from the assumption Γ ∈ Θ1 in
0Theorem 8.11, η(H hhi ii,j [[A]]) consists of only 1’s. Hence, all η(X hhiii,j ) are also equivalent for
any j.
In the case of |E| ≥ 3, η(X hhiii,j ) and η(Y hhiii,j ) may have three or more colors, and hence(8.15) may not be satisfied even if η(X hhiii,j ) η(Y hhiii,j ) are equivalent for any j. But, because0
for any i0 6= i, A ∩ V hhi ii 6= ∅ in (8.39) holds from the assumption Γ ∈ Θ2 in Theorem 8.11, allelements in η(X hhiii,j ) η(Y hhiii,j ) are 1 from (8.22). Hence, (8.15) holds for η(B j [[A]]).
Next, let us check that B j ’s satisfy the condition (ii) in Definition 8.4. For A ∈ AF , B j [[A]]can be represented asj

B [[A]] =qK

H hhiii,j [[A]]

i=1

K
∼
H hhiii,j [[A]]
i∈ ( )



K

i6∈ ( )

H hhiii,j [[A]] .
0(8.40)

Suppose for the set A ⊆ V that j and j 0 (6= j) satisfy cj [[I(A)]] = cj [[I(A)]], which means that00Dhhiii,j = Dhhiii,j for any i ∈ I(A). Then, it holds that Ghhiii,j = Ghhiii,j from the definition of0
Ghhiii,j , and hence H hhiii,j = H hhiii,j from (8.21) and (8.22). Furthermore, for any i 6∈ I(A), it
holds from Lemma 8.14 that H hhiii,1 [[A]] ∼ H hhiii,2[[A]] ∼ · · · ∼ H hhiii,K [[A]]. Therefore, it holds
0that B j [[A]] ∼ B j [[A]].
28.4. Construction Method by Duplicating Secret Images

111

8.4 Construction Method by Duplicating Secret Images
In the previous sections, we have shown how to construct VSS-q-PI schemes for the case that anaccess structure Γ is included in Θ1 or Θ2 for |E| = 2 or |E| ≥ 3, respectively. In this section,
we treat the case that Γ is not included in Θ1 nor Θ2.
In the previous sections, we assumed that all secret images are different. But we note thateven if some secret images are the same, we can encrypt the plural secret images including thesame images in the same way as the case nof all different secretimages.
ohhiii qSuppose that an access structure Γ = {AQ }i=1 , AF is given, which may not be included
hhiii−

in Θ1 nor Θ2 . For this Γ, we consider the union of all AQ
elements Ai , i = 1, 2, . . . , q̂, i.e.,q[hhiii−

AQ. Let us assume that the union has q̂

= {A1, A2, . . . , Aq̂ } .

(8.41)= {Ai } for 1 ≤ i ≤ q̂.

(8.42)

i=1
hhiii−

Then, for each Ai , we define ÂQ

byhhiii−

ÂQ

o
n
oq̂
n
hhiii
hhiii−, we can define a new access structure Γ̂ = {ÂQ }q̂i=1 , AF for the set of
For such ÂQ
i=1

ˆ hhiii, i = 1, 2, . . . , q̂, some of which may be the same image. Furthermore, we
secret images, SIhhiii
ˆ hhiii like (8.8), the set of colors D̂hhiii , and the color
define the set of significant shares V̂
for SI
matrix D̂.
hhiii
Note that the forbidden sets of Γ̂ are the same as Γ, and it holds that Ai = V̂for all i.
Hence, we havenohhiii−ÂQ = V hhiii for 1 ≤ i ≤ q̂.
(8.43)

Remark 8.15 In the case of AF = {∅}, Γ̂ coincides with the access structure proposed in [35]for BW-binary plural secret images. Furthermore, applying (8.41) and (8.42) to the access structure of a VSS-1-PI scheme for a BW-binary secret image, the basis matrix obtained by (8.23)
coincides with the basis matrix given in [10].
2Lemma 8.16 For the access structure Γ̂, the following two statements hold.
1. For any i0 ∈ I(V̂hhiii

) − {i}, it holds that V̂

hhiii

∩ V̂

hhi0ii

6= ∅.

2. If

then it holds that V̂

hhi0 ii

 hhiii
I V̂
= {i},∩ V̂hhiii

6= ∅ for any i0 (6= i).

(8.44)
2

Chapter 8. Visual Secret Sharing Schemes for Plural Secret Images

112

Proof of Lemma 8.16 Note from the definition of V̂
1. For any i0 ∈ I(V̂∅.
2. Suppose that V̂hhiii

hhi0 ii) − {i}, it holds that V̂∩ V̂implies that i ∈ I(V̂
0

hhiii

hhiii

hhiii

hhiii

that V̂) V̂

hhi0 ii

hhiii

6= V̂

hhi0 ii

for any i 6= i0.

, which means that V̂= ∅ for some i0(6= i). Then we have that V̂) − {i} and violates (8.44).

hhi0 ii

hhiii

( V̂

∩ V̂
hhiii

hhi0 ii

6=, which2

From Lemma 8.16, Theorem 8.11 and (8.43), the next theorem holds for the access structure Γ̂.
Theorem 8.17 Suppose that the access structure Γ̂ is constructed by (8.41) and (8.42) from Γ.
Then, in the case of |E| = 2, or in the case that |E| ≥ 3 and Γ̂ satisfies (8.44) for all i, the basis
matrices of (Γ̂, V , E, D̂)-VSS- q̂-PI scheme can be obtained by (8.23).
2
Theorem 8.17 implies that the basis matrices of the VSS-q-PI scheme with the access structure Γ̂ can always be constructed by (8.23) if |E| = 2. However, in the case of |E| ≥ 3, if anaccess structure requires ID images, we cannot obtain the basis matrices of the access structurehhiiifrom (8.23) because V̂must reproduce the ID image and a secret image, and hence, (8.44)
does not hold. The VSS scheme with color ID images is proposed for |E| ≥ 3 in [43], where thebasis matrices not satisfying (8.15) are used.
Finally, we note that for the construction shown in the above, pixel expansion m is given
from (7.68) by
m=

q̂
X
i=1

m

hhiii

=

q̂
X

X

Lx
X
ˆ hhiii |−1hhiii,
δX(l) 2|(8.45)

i=1 x∈ζ(D hhiii ) l=1

where ζ(·) is defined by (7.65), if we construct the basis matrices H hhiii,j in (8.23) based on theconstruction given in Section 7.5.2.
For example, the pixel expansion of the VSS-2-PI scheme with the access structure given by(8.27)–(8.29) for black-white secret images is 12 if the method shown in Section 8.3 is used withthe star graph decomposition [107]. But, if we use (8.41) and (8.42), we have q̂ = 10, and the
pixel expansion becomes 20 from (8.45). In general, the pixel expansion attained by the method
shown in this section is larger than the method in Section 8.3. However, it is reported that a VSS
scheme with 144 (= 12 × 12) subpixels can be used [45], and hence, it is not hard to use the
VSS-2-PI with 20 subpixels in practice.

8.5 Comparison with Trivial Schemes
In the framework of VSS-q-PI schemes, we assume that each participant has one share. But, insome cases each participant may be allowed to have two or more shares. In such cases, VSS
schemes for q plural secret images can easily be constructed by using q individual usual VSS
hhiii
hhiii
schemes, i.e., VSS-1-PI schemes, with access structure Γhhiii = {ÃQ , ÃF } for each secret8.5. Comparison with Trivial Schemes

113
hhiii

hhiii

hhiii

image SI hhiii. In such trivial VSS schemes, shares V1 V2 , . . . , Vn are constructed for the
hh1ii
hh2ii
hhqii
i-th secret image, and the `-th participant has share set {V` , V` , . . . , V` }. In this section
we compare the VSS-q-PI schemes with such trivial schemes.
The trivial schemes can realize any access structures although the VSS-q-PI schemes cannot
realize them if they don’t satisfy the conditions described in Theorems 8.11 or 8.17. Furthermore,
the pixel expansion of the trivial scheme is less than the VSS-q-PI scheme for the same accessstructure. This means that the trivial schemes attain higher resolution than the VSS-q-PI schemesin decrypted images. However, in the trivial schemes, each participant must hold securely q plural
shares. On the contrary, each participant must hold securely only one share in the VSS-q-PI
scheme.
Furthermore, the VSS-q-PI schemes have the following advantages compared with the trivial
schemes.
1. The VSS scheme with ID images [2], [43], which is considered as a special case of the
VSS-q-PI scheme, cannot be realized by the trivial scheme.2
2. Consider the case that a lot with win and lose is made by a VSS scheme, where secretimages SI (W ) and SI (L) represent win and lose, respectively.
(W )
(W )
(L)
(L)
In the case of the trivial scheme, letting V (W ) = {V1 , V2 } and V (L) = {V1 , V2 }be the share sets of the (2, 2)-threshold VSS-1-PI scheme for secret images SI (W ) and(W )(L)
SI (L), respectively, the lot can be realized if a dealer holds {V1 , V1 } and distributes
(W )
(L)
V2
or V2 to people participating in the lot. In this case, two times decryption, i.e.,
stacking shares, is required to know the result of the lot.
On the contrary, in the case of the VSS-q-PI scheme, we can use the access structure
(W )−
(L)−
(W,L)
Γ
with AQ= {{V1 , V2 }}, AQ= {{V1 , V3 }} and A+
F = {{V2 , V3 }}. Letting{V1 , V2 , V3 } be the share set, a dealer holds V1 and distributes V2 or V3 to the people. In
this case, by only once decryption, we can know the result of the lot.3
This advantage of speedy decryption becomes larger as the number of results in the lot
becomes larger, and the advantage may be essential in commercial uses.
3. Next, consider the case that a VSS scheme is used as a tally. We have groups X, Y, Z,
and Alice, Bob and Carol belong to X and Y , X and Z, Y , respectively. Each of themwants to prove to Peggy which groups he/she belongs to. In the case of the trivial schemes,
(X)
(X)
(Y )
(Y )
the tally can be realized by letting V (X) = {V1 , V2 }, V (Y ) = {V1 , V2 }, and(Z)(Z)
V (Z) = {V1 , V2 } be the sets of shares of the (2, 2)-threshold VSS-1-PI schemes
(X)
(Y )
(Z)
for secret images SI (X), SI (Y ) , SI (Z), respectively, and distributing {V1 , V1 , V1 },
(X)
(Y )
(X)
(Z)
(Y )
{V2 , V2 }, {V2 , V2 }, and V2 , to Peggy, Alice, Bob, and Carol, respectively.
In the case of the VSS-q-PI scheme, the tally can be realized by letting {V1 , V2 , . . . , V6 }(X)−
be the share set of the VSS-q-PI scheme for the access structure given by AQ=
2

The VSS schemes with color ID images are treated in [43]. However, the VSS schemes with color ID images
cannot be constructed by our method. See the next paragraph of Theorem 8.17.
3This kind of lot is now commercialized by TOPPAN PRINTING co., ltd.

Chapter 8. Visual Secret Sharing Schemes for Plural Secret Images

114

(Y )−

(Z)−

{{V1 , V4 }, {V1 , V5 }}, AQ= {{V2 , V4 }, {V2 , V6 }}, and AQ= {{V3 , V5 }}, and distributing {V1 , V2 , V3 }, V4 , V5 , V6 to Peggy, Alice, Bob, and Carol, respectively.
In either case, by showing his/her shares to Peggy, each person can prove the groups
that he/she belongs to. However, note that, for instance, the following attacks are possible
in the case of the trivial scheme although the same attacks cannot succeed in the case of
VSS-q-PI scheme.
(X)
(Y )
(Z)
(a) If Alice conspires with Bob, Alice can deceive Peggy by showing {V2 , V2 , V2 }(Z)
to prove that Alice belongs to all of X, Y, Z. (b) Bob can hide by showing only V2 that
he belongs to X. (c) Assume that an adversary wants to impersonate Alice. Such imper(X)(Y )sonation attack can be achieved by stealing V2 from Bob and V2 from Carol besides(X)(Y )by stealing {V2 , V2 } from Alice.
As shown above, the VSS-q-PI schemes have advantages than the trivial schemes in many cases.

8.6 Conclusion
In this chapter, we considered methods to construct visual secret sharing schemes for q plural
secret images (VSS-q-PI scheme) with general access structures. In the proposed VSS-q-PI
schemes, each qualified set of shares can decrypt their own secret images, but it does not leakout any information of the other secret images. Furthermore, the proposed scheme can encode
color and/or gray-scale secret images in addition to black-white images. Finally in Section 8.5,
we discussed the merits of the VSS-q-PI schemes compared with the trivial schemes.

Chapter 9
Conclusions of Part II
9.1 Summary of Results
In Part II, we proposed new construction methods of VSS schemes for general access structures,
which can be applied to any type of plural secret images.
In Chapter 7, the algebraic constructions of VSS schemes for gray-scale images were considered. First, we discussed the contrast of VSS-GS schemes as an extension of BW-binary imagesin [36], [81], [117]. Then, we gave the modified polynomial representations of VSS-GS schemes[72]. The extended algebraic constructions can attain the optimal (n, n)-VSS-GS schemes inthe sense of the minimum pixel expansions for given contrasts. We also constructed the basis
polynomials of VSS schemes for color images with shades.
From Chapters 6 and 7, (k, n)-VSS schemes for any kind of secret images can easily beconstructed based on the algebraic constructions. Furthermore, as it is shown in Section 6.4,
VSS schemes can also be constructed for any general access structures.
Finally in Chapter 8, we proposed VSS schemes with general access structures that can encode plural color secret images with shades. The proposed VSS schemes include most of previous VSS schemes as special cases. Furthermore, the security conditions were defined in the exact
way as decrypted images must not leak out any information of the other secret images, which
is not satisfied in [35], [107]. We also proposed the construction method of VSS schemes thatattain the security condition without degenerating the quality of decrypted images. We showedin Section 8.5, how the proposed VSS schemes have advantages compared with trivial schemes,
which consists of several VSS schemes for individual secret images.

9.2 Future Works
In this thesis, we considered the general construction methods of VSS schemes. By the proposed
methods, (k, n)-VSS schemes can be constructed systematically, although they may not be theoptimal (k, n)-VSS schemes. But, in the construction of VSS schemes, we consider only theoriginal cumulative maps, which is not efficient as shown in Chapter 4. Hence, by using the
optimal multiple assignment maps in Chapter 4, it may be possible to construct more efficient
115

116

Chapter 9. Conclusions of Part II

VSS schemes for general access structures. In such cases, the objective functions of integer
programming problems may be different from the objective function appeared in Section 4.
In Part II, we only treat perfect VSS schemes. But, in order to attain higher quality of decrypted images, ramp VSS schemes must be studied, which can be defined similarly to the ramp
SS schemes treated in Chapters 3 and 4. In the ramp VSS schemes, there exists a trade-off
between the quality of decrypted images and the security. Kato [59] presented a kind of (3, 2, 3)threshold VSS schemes which can decrypt a secret image from three shares although no information of the secret image is obtained from one share. In this case, if we have two shares, some partsof the secret image appears. But, in many cases, we can imagine the secret image correctly fromthe partially appeared image. Therefore, Kato’s ramp VSS schemes is not secure in the senseof ramp VSS schemes. Furthermore, [59] did not give any definition of ramp VSS schemes formally. On the other hand, (2, 2)-VSS schemes with ID images such as gray-scale pictures are
considered in [25], [78]. In their scheme, the security of a secret image is weakened to attainhigh quality of ID images and hence their method can also be considered as a kind of ramp VSS
schemes with ID images. However, the ramp VSS schemes have not studied theoretically at all,and they are important VSS schemes for future works.
Recently, another definitions of VSS schemes are proposed in [45] and [111] for BW-binary
images and color images with shades, respectively.
In [111], VSS schemes are designed under the assumption that in the case of BW-binary
secret images, negative images obtained by reversing white and black pixels are equal to theirpositive images. The optimization of pixel expansion and contrast in such VSS schemes may beinteresting problems.
As we pointed out in Remark 7.16, the meanvalue-color mixing (MCM) VSS schemes proposed in [45] can treat color images with shades, although they require large pixel expansion.
Hence, the realization of the MCM-VSS schemes with smaller subpixels may also be an important future work.

Appendix A
Examples of Visual Secret Sharing
SchemesIn this appendix, we give some examples of shares and decrypted images of VSS schemes treatedin this thesis.1

A.1 Visual Secret Sharing Schemes for BW-binary Secret Images
Figures A.1–A.3 are the examples of shares for a (2, 2)-threshold VSS scheme with a BW-binary
image. The basis matrices of shares V1BW and V2BW shown in Figures A.1 and A.2, respectively,
are given by
 
 
01
01
B1 =
and B0 =
,
(A.1)
10
01
which are obtained by the method proposed by Naor-Shamir [81]. Figure A.3 is the decrypted
image obtained by stacking up V1BW and V2BW , and it holds that α = 12 and m = 2.

1

These examples of VSS schemes are constructed by the software program provided by Prof. H. Koga.

117

118

Chapter A. Examples of Visual Secret Sharing Schemes

Figure A.1. The first share of a (2, 2)-threshold VSS scheme for a BW-binary image: V1BW

Figure A.2. The second share of a (2, 2)-threshold VSS scheme for a BW-binary image: V2BW

A.1. Visual Secret Sharing Schemes for BW-binary Secret Images

Figure A.3. The decrypted image obtained from V1BW and V2BW

119

Chapter A. Examples of Visual Secret Sharing Schemes120

A.2 Visual Secret Sharing Schemes for Color Images
In this section, we show three examples of VSS schemes for color images treated in [66], [67]and Chapter 6.
Figures A.4–A.6 are the shares and decrypted images of a (2, 2)-threshold VSS scheme withcolor set D = {0, g, b}. The basis matrices are given by






01gb1
b1g01
g10b1
B0 =
, Bb =
and Bg =
,
(A.2)
0g11b
bg110
g011b
which have contrast α = 15 and pixel expansion m = 5.
Next example is a (2, 3)-threshold VSS schemes with color set D = {c, g, y}. If we use basis
matrices






01c1c011y11y
c1y1yc110110
01y1y011c11c
Bc = 101c0c1y11y1 , Bg = 1c1ycy101101 , and By = 101y0y1c11c1 ,cc0011y11y11
yycc11011011
yy0011c11c11(A.3)
then we can obtain shares V1C2 , V2C2 , and V3C2 shown in Figures A.7–A.9, and it holds that1
, m = 12. The decrypted image from V1C2 and V2C2 is shown in Figure A.10. Note thatα = 12the same decrypted images can be obtained from the other combinations of 2-out-of-3 shares.
The third example is a VSS scheme with color set D = {c, y, g} for the access structure givenby (6.116) and (6.117). If we use the following basis matrices given by (6.118)–(6.120), shares
V1C3 , V2C3 , V3C3 , and V4C3 are obtained as shown in Figures A.11–A.14.

c00c0011yy0011yy0011ccyy10101c1c
0cc0ccyy1111yy1111gg111111111111

Bc = 
 c0cc0c111y1y111y1y11g11g11111111 ,0c00c0y001y1y001y1yc1yc10101c1c1

y00y0011cc0011cc0011yycc10101y1y0yy0yycc1111cc1111gg111111111111

By = 
y0yy0y111c1c111c1c11g11g11111111 ,0y00y0c001c1c001c1cy1cy10101y1y1

00yycc11cc0011yy000010011c1c1y1y
ggccyycc1111yy111111011011111111

Bg = 
 cygycg111c1c111y1y10110111111111 .
yc0cy0c001c1y001y1010010c1c1y1y1

(A.4)

(A.5)

(A.6)

3
Then, it holds that α = 16
and m = 32. From a qualified set {V1C3 , V2C3 }, we can obtain
the decrypted image shown in Figure A.15 although no information can be decrypted from aforbidden set {V1C3 , V3C3 } as shown in Figure A.16.

A.2. Visual Secret Sharing Schemes for Color Images

Figure A.4. The first share of a (2, 2)-threshold VSS scheme for a color image: V1C1

Figure A.5. The second share of a (2, 2)-threshold VSS scheme for a color image: V2C1

121

122

Chapter A. Examples of Visual Secret Sharing Schemes

Figure A.6. The decrypted image obtained from V1C1 and V2C1

A.2. Visual Secret Sharing Schemes for Color Images

Figure A.7. The first share of a (2, 3)-threshold VSS scheme for a color image: V1C2

Figure A.8. The second share of a (2, 3)-threshold VSS scheme for a color image: V2C2

123

124

Chapter A. Examples of Visual Secret Sharing Schemes

Figure A.9. The third share of a (2, 3)-threshold VSS scheme for a color image: V3C2

Figure A.10 The decrypted image obtained from V1C2 and V2C2 . (“UT” is the abbreviation ofUniv. of Tokyo.)A.2. Visual Secret Sharing Schemes for Color Images

125

Figure A.11 The first share of a VSS scheme for a color image with the access structure given by(6.116) and (6.117): V1C3

126

Chapter A. Examples of Visual Secret Sharing Schemes

Figure A.12 The second share of a VSS scheme for a color image with the access structure givenby (6.116) and (6.117): V2C3

A.2. Visual Secret Sharing Schemes for Color Images

127

Figure A.13 The third share of a VSS scheme for a color image with the access structure givenby (6.116) and (6.117): V3C3

128

Chapter A. Examples of Visual Secret Sharing Schemes

Figure A.14 The fourth share of a VSS scheme for a color image with the access structure givenby (6.116) and (6.117): V4C3

A.2. Visual Secret Sharing Schemes for Color Images

Figure A.15. The decrypted image obtained from V1C3 and V2C3

129

130

Chapter A. Examples of Visual Secret Sharing Schemes

Figure A.16 The image obtained from V1C3 and V3C3 which has no information about the secretimageA.3. Visual Secret Sharing Schemes for Gray-scale Images

131

A.3 Visual Secret Sharing Schemes for Gray-scale Images
In this thesis, we treated the VSS-GS-L schemes in Chapter 8. Here, we show an example of a
1
VSS-GS-8 scheme, which has the following basis matrices. It holds that m = 15, β = 15, and2α(`) = 15 for ` = 2, 3, . . . , 8.


011111110000000
001111110000001
B(1) =, B(2) =,(A.7)
000000001111111
000000001111111

000111110000011
000011110000111
B(3) =, B(4) =,(A.8)
000000001111111
000000001111111

000001110001111
000000110011111
B(5) =, B(6) =,(A.9)
000000001111111
000000001111111

000000010111111
000000001111111
B(7) =, B(8) =.
(A.10)
000000001111111
000000001111111
Figures A.17–A.19 are the two shares and decrypted image of this example.

132

Chapter A. Examples of Visual Secret Sharing Schemes

Figure A.17. The first share of a (2, 2)-threshold VSS-GS-8 scheme: V1GS

A.3. Visual Secret Sharing Schemes for Gray-scale Images

Figure A.18. The second share of a (2, 2)-threshold VSS-GS-8 scheme: V2GS

133

134

Chapter A. Examples of Visual Secret Sharing Schemes

Figure A.19. The decrypted image obtained from V1GS and V2GS

A.4. Visual Secret Sharing Scheme with Plural Secret Images

135

A.4 Visual Secret Sharing Scheme with Plural Secret Images
In this section, we present two examples of VSS-q-PI schemes treated in Chapter 9.
First, we show an example of a (2, 2)-threshold VSS scheme with ID images which can beconsidered as a special case of VSS-3-PI schemes. Let DI hh1ii and DI hh2ii be the ID images foreach share V1ID V2ID with color sets Dhh1ii = {0, c} and Dhh2ii = {0, g}, respectively, while let
DI hh3ii be the decrypted images with color set Dhh3ii = {b, y}. In this case, the color matrix isrepresented as follows.

0000cccc
def(A.11)
DID = 00gg00gg = [ c1ID c2ID c3ID c4ID c5ID c6ID c7ID c8ID ],bybybyybjThen, the following bases matrices BID, j = 1, 2, . . . , 8, corresponding to each column vectorjcID can be constructed according to Ishihara-Koga [43].








b1y01
y1b01
b1y01
y1b01
1
2
3
4
BID =
, BID =, BID =, BID =,
(A.12)
by110
yb110
by11g
yb11g








b1yc1
y1bc1
b1yc1
y1bc1
5
6
7
8
BID =
, BID =, BID =, BID =.
(A.13)
by110
yb110
by11g
yb11g

Figures A.20–A.22 are two shares V1ID = DI hh1ii, V2ID = DI hh2ii and decrypted image. In thisVSS scheme, note that both ID images, DI hh1ii and DI hh2ii do not satisfy the condition (i) in
Definition 8.4.
Next, let us consider a VSS-3-PI scheme such that three secret images can be decrypted fromarbitrary 2-out-of-3 shares, V1P L , V2P L , and V3P L . Assume that three decrypted images IDhh1ii ,IDhh2ii, and IDhh3ii have color sets Dhh1ii = {r, y}, Dhh2ii = {g, y}, and Dhh3ii = {b, y}, and can bedecrypted from share set {V1P L , V2P L }, {V2P L , V3P L }, and {V1P L , V3P L }, respectively. Then, thecolor matrix is represented as follows.

yyyyr r r r
def
DP L = yyggyygg = [ c1P L c2P L c3P L c4P L c5P L c6P L c7P L c8P L ].
(A.14)
bybybyby

Then, we have the following basis matrices based on the method proposed in Chapter 9.

yym 1 1111b1y
yym 1 1111y1b
BP1 L = yy 1 myyc1111 , BP2 L = yy 1 myyc1111 ,(A.15)
11 1 1 yy1cby1
11 1 1 yy1cyb1yym 1 1111b1y
yym 1 1111y1b
BP3 L = yy 1 mcyy1111 , BP4 L = yy 1 mcyy1111 ,(A.16)
11 1 1 yc1yby1
11 1 1 yc1yyb1m y y11111b1y
m y y11111y1b
BP5 L =  y m1yyyc1111 , BP6 L =  y m1yyyc1111 ,(A.17)
1 1 11yy1cby1
1 1 11yy1cyb1

136

Chapter A. Examples of Visual Secret Sharing Schemesm y y11111y1b
m y y11111b1y
BP7 L =  y m1ycyy1111 , BP8 L =  y m1ycyy1111 .
1 1 11yc1yyb1
1 1 11yc1yby1(A.18)

Figures A.23–A.25 are the shares of this example, and three decrypted images are shown in2
and pixel expansion m = 11.
Figures A.26-A.28. All the decrypted images have contrast α = 11

A.4. Visual Secret Sharing Scheme with Plural Secret Images

137

Figure A.20 The first share of a (2, 2)-threshold VSS scheme with ID images: V1ID (The first ID
is VASE.)

138

Chapter A. Examples of Visual Secret Sharing Schemes

Figure A.21 The second share of a (2, 2)-threshold VSS scheme with ID images: V2ID (The first
ID is FACE.)

A.4. Visual Secret Sharing Scheme with Plural Secret Images

Figure A.22. The decrypted image obtained from V1ID and V2ID

139

140

Chapter A. Examples of Visual Secret Sharing Schemes

Figure A.23. The first share of a VSS-3-PI scheme: V1P L

A.4. Visual Secret Sharing Scheme with Plural Secret Images

Figure A.24. The second share of a VSS-3-PI scheme: V2P L

141

142

Chapter A. Examples of Visual Secret Sharing Schemes

Figure A.25. The third share of a VSS-3-PI scheme: V3P L

A.4. Visual Secret Sharing Scheme with Plural Secret Images

Figure A.26. The decrypted image obtained from V1P L and V2P L

143

144

Chapter A. Examples of Visual Secret Sharing Schemes

Figure A.27. The decrypted image obtained from V2P L and V3P L

A.4. Visual Secret Sharing Scheme with Plural Secret Images

Figure A.28. The decrypted image obtained from V1P L and V3P L

145

Bibliography[1] G. Ateniese, C. Blundo, A. De Santis, and D. R. Stinson. Visual cryptography for generalaccess structures. Information and Computation, 129, issue 2:86–106, 1996.
[2] G. Ateniese, C. Blundo, A. De Santis, and D. R. Stinson. Extended capabilities for visual
cryptography. Theoretical Computer Science, 250(1–2):143–161, 2001.
[3] J. Benaloh. Secret sharing homomorphisms: keeping shares of a secret secret. Advancesin Cryptology-CRYPTO’86, LNCS 263, Springer-Verlag, pages 251–260, 1986.
[4] J. Benaloh and J. Leichter. Generalized secret sharing and monotone functions. Advancesin Cryptology-CRYPTO’88, LNCS 403, Springer-Verlag, pages 27–35, 1990.
[5] C. H. Bennett and G. Brassard. Quantum cryptography: Public key distribution and cointossing. Proc. of IEEE Int. Conf. on Comp. Sys. and Signal Proc., pages 175–179, 1984.
[6] I. Biehl and S. Wetzel. Traceable visual cryptography. Proc. of ICICS’97, LNCS 1334,
Springer-Verlag, pages 63–71, 1997.
[7] B. Blakley, G. R. Blakley, A. H. Chan, and J. Massey. Threshold schemes with disenrollment. Advances in Cryptology-CRYPTO’92, LNCS 740, Springer-Verlag, pages 540–548,
1993.
[8] G. R. Blakley. Safeguarding cryptographic keys. AFIPS 1979 Nat. Computer Conf.,
48:313–317, 1979.
[9] G. R. Blakley and C. Meadows. Security of ramp schemes. Advances in CryptologyCRYPTO’84, LNCS 196, Springer-Verlag, pages 242–269, 1985.
[10] C. Blundo, A. D. Bonis, and A. De Santis. Improved schemes for visual cryptography.
Designs, Codes and Cryptography, 24(3):255–278, 2001.
[11] C. Blundo, A. Cresti, A. De Santis, and U Vaccaro. Fully dynamic secret sharing scheme.
Theoretical Computer Science, 165(2):407–440, 1996.
[12] C. Blundo, P. D’Arco, A. De Santis, and D. R. Stinson. On the contrast in visual cryptography schemes. J. of Cryptology, 12, issue 4:261–289, 1999.
147

148

BIBLIOGRAPHY[13] C. Blundo, P. D’arco, A. De Santis, and D. R. Stinson. Contrast optimal threshold visual
cryptography. SIAM J. of Discrete Math., 16(2):224–261, 2003.
[14] C. Blundo, A. De Santis, and M. Naor. Visual cryptography for gray-level images. Information Processing Letters, 75, issue 6:255–259, 2001.
[15] C. Blundo, A. De Santis, R. De Simone, and U. Vaccaro. Tight lower bounds on theinformation rate of secret sharing schemes. Design, Codes and Cryptography, 11:101–
122, 1997.
[16] C. Blundo, A. De Santis, D. R. Stinson, and U. Vaccaro. Graph decomposition and secretsharing schemes. J. of Cryptology, 8:39–64, 1995.
[17] C. Blundo, A. De Santis, D. R. Stinson, and U. Vaccaro. Graph decompositions and secretsharing schemes. J. of cryptology, 8:39–64, 1995.
[18] C. Blundo, A. De Santis, and U. Vaccaro. Efficient sharing of many secrets. Proc. of
STACS’93 LNCS 665, Springer-Verlag, pages 692–703, 1993.
[19] C. Blundo, A. De Santis, and U. Vaccaro. On secret sharing schemes. Information Processing Letters, 65(1):25–32, 1998.
[20] C. Blundo and D. R. Stinson. Anonymous secret sharing schemes. Discrete Applied
Mathematics, 77, issue 1:13–28, 1997.
[21] E. F. Brickell and D. M. Davenport. On the classification of ideal secret sharing schemes.
J. of Cryptology, 4:123–134, 1991.
[22] E. F. Brickell and D. R. Stinson. Some improved bounds on the information rate of perfectsecret sharing schemes. J .of Cryptology, 5:153–166, 1992.
[23] C. Cachin. On-line secret sharing. 5th IMA Conference in Cryptography and Coding,
LNCS 1025, Springer-Verlag, pages 190–198, 1995.
[24] R. M. Capocelli, A. De Santis, L. Gargano, and U. Vaccaro. On the size of shares for
secret sharing schemes. J. of Cryptology, 6:157–167, 1993.
[25] C.-C. Chang and T.-X. Yu. Sharing a secret gray image in multiple secret. Proc. of 1stInternational Symposium on Cyber Worlds, pages 1–8, 2002.
[26] S.-Y. Chiou and C.-S. Laih. A tempo-based audio cryptography scheme. IEICE Trans.
Fundamentals, E86–A(8):2091–2098, 2003.
[27] B. Chor, G. Goldwasser, S. Micali, and B. Awerbuch. Verifiable secret sharing simultaneity in the presence of faults. Proc. of IEEE 26th Annual Symposium on Foundations ofComputer Science, pages 383–395, 1985.

BIBLIOGRAPHY

149[28] R. Cleve, D. Gottesman, and H.-K. Lo. How to share a quantum secret. Physical Review
Letters, 83(3):648–651, 1999.
[29] G. D. Crescenzo. Sharing one secret vs. sharing many secrets. Theoretical Computer
Science, 295, issue 1–3:123–140, 2003.
[30] L. Csirmaz. The size of a share must be large. J. of Cryptology, 10:223–231, 1997.
[31] D. Daeman and V. Rijmen. The Design of Rijndael: Aes-The Advanced Encryption Standard. Springer-Verlag, 2002.
[32] Y. Desmedt, S. Hou, and J.-J. Quisquater. Audio and optical cryptography. Advances in
Cryptology-ASIACRYPT’98, LNCS 1514, Springer-Verlag, pages 392–404, 1998.
[33] Y. Desmedt, S. Hou, and J.-J. Quisquater. Cerebral cryptography. Proc. of Information
Hiding, LNCS 1525, Springer-Verlag, pages 62–72, 1998.
[34] W. Diffie and M. Hellman. New directions of cryptography. IEEE Trans. Inform. Theory,
IT–22(6):644–656, 1976.
[35] S. Droste. New results on visual cryptography. Advances in Cryptology-CRYPTO’96,
LNCS 1109, Springer-Verlag, pages 401–415, 1996.
[36] P. A. Eisen and D. R. Stinson. Threshold visual cryptography schemes with specified
whiteness levels of reconstructed pixels. Designs, Codes and Cryptography, 25(1):15–61,
2002.
[37] P. Feldman. A practical scheme for non-iterative verifiable secret sharing. Proc. of
FOCS’87, pages 427–437, 1987.
[38] J. D. Golić. On matroid characterization of ideal secret sharing schemes. J. of Cryptology,
11:75–86, 1998.
[39] D. Gottesman. Theory of quantum secret sharing. Physical Review A, 61(042311), 2000.
[40] A. Herzberg, S. Jarecki, H. Krawczyk, and M. Yung. Proactive secret sharing or: how tocope with perpetual leakage. Advances in Cryptology-CRYPTO’95, LNCS 963, SpringerVerlag, pages 339–352, 1995.
[41] M. Hillery, V. Buzěk, and A. Berthiaume. Quantum secret sharing. Los Alamos e-printarchive, quant-ph/9806063, 1998.
[42] T. Hofmeister, M. Krause, and H. U. Simmon. Contrast-optimal k out of n secret sharing
schemes in visual cryptology. Theoretical Computer Science, pages 471–485, 2000. Preliminary version is appeared in COCOON’97, LNCS 1276, Springer-Verlag, pp. 176–185,
1997.

150

BIBLIOGRAPHY[43] T. Ishihara and H. Koga. New constructions of the lattice-based visual secret sharing using
mixture of colors. IEICE Trans. Fundamentals, E85–A(1):158–166, 2002.
[44] T. Ishihara and H. Koga. On a general formula of the (t, n)-visual secret sharing scheme
for color images. Proc. of SCIS’03, pages 1077–1082, 2003. (in Japanese).
[45] T. Ishihara and H. Koga. A visual secret sharing scheme for color images based on
meanvalue-color mixing. IEICE Trans. Fundamentals, E86–A(1):194–197, 2003.
[46] R. Ito, H. Kuwakado, and H. Tanaka. Image size invariant visual cryptography. IEICE
Trans. Fundamentals, E82–A(10):2172–2176, 1999.
[47] M. Itoh, A. Saito, and T. Nishizeki. Secret sharing scheme realizing general access structure. IEEE Globecom, pages 99–102, 1987.
[48] M. Itoh, A. Saito, and T. Nishizeki. Secret sharing scheme realizing general access structure. IEICE Trans. Fundamentals, J71–A(8):1592–1598, 1988. (in Japanese).
[49] M. Itoh, A. Saito, and T. Nishizeki. Multiple assignment scheme for sharing secret. J. of
Cryptology, 6:15–20, 1993.
[50] M. Iwamoto, H.Yamamoto, and H. Ogawa. A general construction method of secret sharing schemes based on (k, n)-threshold schemes using integer programming. Technical
Report of IEICE, 103(61, ISEC2003-11):63–70, 2003. (in Japanese).
[51] M. Iwamoto and H. Yamamoto. Non-ideal ramp secret sharing schemes for general accessstructures. Proc. of Symposium on Information Theory and Its Applications, pages 227–
230, 2002. (in Japanese).
[52] M. Iwamoto and H. Yamamoto. The optimal n-out-of-n visual secret sharing scheme forgray-scale images. IEICE Trans. Fundamentals, E85–A(10):2238–2247, 2002.
[53] M. Iwamoto and H. Yamamoto. A construction method of visual secret sharing schemes
for plural secret images. IEICE Trans. Fundamentals, 86–A(10):2577–2588, 2003.
[54] W.-A. Jackson, K. L. Martin, and C. M. O’Keefe. Ideal secret sharing schemes withmultiple secrets. J. of Cryptology, 9:233–250, 1996.
[55] W.-A. Jackson, K. M. Martin, and C. M. O’Keefe. Multisecret threshold schemes. Advances in Cryptology-CRYPTO’93, LNCS 963, Springer-Verlag, pages 126–135, 1994.
[56] B. Julesz. Binocular depth perception computer-generated patterns.
39:1125–1162, 1960.

Bell Tech. J.,[57] A. Karlsson, M. Koashi, and N. Imoto. Quantum entanglement for sharing secret splitting.
Physical Review A, 59(1):162–168, 1999.

BIBLIOGRAPHY

151[58] E. D. Karnin, J. W. Greene, and M. E. Hellman. On secret sharing systems. IEEE Trans.
Inform. Theory, 29(1):35–41, 1983.
[59] T. Kato. Studies on Visual Secret Sharing Schemes and Their Applications. PhD thesis,
Univ. of Tokyo, 1996. (in Japanese).
[60] T. Kato and H. Imai. An extended construction method of visual secret sharing scheme.
IEICE Trans. Fundamentals, J79–A(8):1344–1351, 1996. (in Japanese).
[61] Y. Kawamoto and H. Yamamoto. Secret function sharing schemes and their applications
to the oblivious transfer. Proc. of IEEE International Symposium on Information Theory(ISIT), page 281, 2003.
[62] A. Klein and M. Wessler. Extended visual cryptography schemes. preprint, 2003.
[63] H. Koga. A simple construction of a (k, n) visual secret sharing scheme using symmetricpolynomials. private communications, 1998.
[64] H. Koga. General formula of the (t, n)-threshold visual secret sharing scheme. Advancesin Cryptology-ASIACRYPT’02, LNCS 2501, Springer-Verlag, pages 328–345, 2002.
[65] H. Koga. Construction of contrast-optimal (t, n)-visual secret sharing scheme for blackwhite images. Proc. of 3rd asian-european workshop on information theory, pages 45–48,
2003.
[66] H. Koga, M. Iwamoto, and H. Yamamoto. An analytic construction of the visual secretsharing scheme for color images. IEICE Trans. Fundamentals, E84-A(1):262–272, 2001.
[67] H. Koga and H. Yamamoto. Proposal of a lattice-based visual secret sharing scheme forcolor and gray-scale images. IEICE Trans. Fundamentals, E81–A(6):1262–1269, 1998.
[68] M. Krause and H. U. Simmon. Determining the optimal contrast for secret sharing
schemes in visual cryptology. LATIN’00, LNCS 1776, Springer-Verlag, pages 280–291,
2000.
[69] H. Krawczyk. Secret sharing made short. Advances in Cryptology-CRYPTO’93 LNCS
773, Springer-Verlag, pages 136–146, 1994.
[70] K. Kurosawa and K Okada. Combinatorial lower bounds for secret sharing schemes.
Information Processing Letters, 60:301–304, 1996.
[71] K. Kurosawa, K. Okada, K. Sakano, W. Ogata, and T. Tsujii. Nonperfect secret sharing
schemes and matroids. Advances in Cryptology-EUROCRYPT’93, LNCS 765, SpringerVerlag, pages 126–141, 1993.
[72] H. Kuwakado and H. Tanaka. Polynomial representation of visual secret sharing scheme
and its application. IEICE Trans. Fundamentals, E85–A(6):1379–1386, 2002.

152

BIBLIOGRAPHY[73] C.-S. Laih, L. Harn, J.-Y. Lee, and T. Hwang. Dynamic threshold scheme based on thedefinition of cross-product in an n-dimensional linear space. Advances in CryptologyCRYPTO’89, LNCS 435, Springer-Verlag, pages 286–298, 1990.
[74] K. M. Martin and J. Nakahara Jr. Weaknesses of protocols for updating the parameters ofan established threshold scheme. IEE Proc.Comput. Digit. Tech., 148(1):45–48, 2001.
[75] National Bureau of Standards (U.S.A). Data Encryption Standard. Federal Information
Processing Standard Publications 46, National Technical Information Services, Springfield, 1977.
[76] R. J. McEliece and D. V. Sarwate. On sharing secrets and Reed-Solomon codes. Comm.
ACM, 24(9):583–584, 1981.
[77] A. J. Menezes, P. C. Oorschot, and S. A. Vanstone. Handbook of Applied Cryptography.
CRC Press, 1997.
[78] M. Nakajima and Y. Yamaguchi. Extended visual cryptography for natural images. J. of
WSCG, pages 303–310, 2002.
[79] M. Naor and B. Pinkas. Visual authentication and identification. Advances in CryptologyCRYPTO’97, LNCS 1294, Springer-Verlag, pages 322–336, 1997.
[80] M. Naor and B. Pinkas. Distributed oblivious transfer. Advances in CryptologyASIACRYPT2000 LNCS 1976, Springer-Verlag, pages 576–589, 2000.
[81] M Naor and A. Shamir. Visual cryptography. Advances in Cryptology-EUROCRYPT’94,
LNCS 950, Springer-Verlag, pages 1–12, 1994.
[82] M. Naor and A. Shamir. Visual cryptography II : improving the contrast via the coverbase. Security Protocols, LNCS–1189, Springer-Verlag, pages 197–202, 1997.
[83] A. N. Netravali and B. G. Haskell. Digital Pictures: Representation, computation, andstandards. Plenum Press, 2nd. edition, 1994.
[84] S.-L. Ng. A representation of a family of secret sharing matroids. Designs, Codes andCryptography, 30:5–19, 2003.
[85] S.-L. Ng and M. Walker. On the composition of matroids and ideal secret sharing schemes.
Designs, Codes and Cryptography, 24:49–67, 2001.
[86] W. Ogata and K. Kurosawa. Some basic properties of general nonperfect secret sharing
schemes. J. of Universal Computer Science, 4(8):690–704, 1998.
[87] T. Ogawa, A. Sasaki, M. Iwamoto, and H. Yamamoto. Coding efficiency and constructionof quantum secret sharing schemes. Proc. of Symposium on Information Theory and Its
Applications, pages 651–654, 2003. (in Japanese).

BIBLIOGRAPHY

153[88] K. Okada and K. Kurosawa. Lower bound on the size of shares of nonperfect secretsharing schemes. Advances in Cryptology-ASIACRYPT’94, LNCS 917, Springer-Verlag,
pages 34–41, 1994.
[89] K Okada, W. Ogata, K. Sakano, and K. Kurosawa. Analysis on secret sharing schemeswith non-graphical access structures. IEICE Trans. Fundamentals, E80–A(1):85–89,
1997.
[90] E. Okamoto and G. R. Blakley. More flexible secret sharing scheme. Proc. of SCIS’00,
A39, 2000.
[91] T. Okamoto and H. Yamamoto. Gendai-angou. Sangyo Tosho, 1997. (in Japanese).
[92] C. Padró and G. Sáez. Secret sharing schemes with bipartite access structure. IEEE Trans.
Inform. Theory, 46(7):2596–2604, 2000.
[93] T.P̃. Pedersen. Distributed provers with applications to undeniable signatures. Advancesin Cryptology-EUROCRYPT’91, LNCS 547, Springer-Verlag, pages 221–242, 1992.
[94] T.P̃. Pedersen. Non-interactive and information theoretic secure verifiable secret sharing.
Advances in Cryptology-CRYPTO’91, LNCS 576, Springer-Verlag, pages 129–140, 1992.
[95] T. Rabin and M. Ben-Or. Verifiable secret sharing and multiparty protocols with honest
majority. Proc. of the 21st Annual ACM Symposium on Theory of Computing, pages 73–
89, 1989.
[96] V. Rijmen and B. Preneel. Efficient color visual encryption or ‘shared colors of benetton’.
presented at the rump session of EUROCRYPT’96, 1996.
[97] R. Rivest, A. Shamir, and L. Adleman. A method for obtaining digital signatures andpublic-key cryptosystems. Comm. ACM, 21(2):120–126, 1978.
[98] P. D. Seymour. On secret-sharing matroids. J. of Combin. Theory B, 56:69–73, 1992.
[99] A. Shamir. How to share a secret. Comm. ACM, 22(11):612–613, 1979.
[100] C.Ẽ. Shannon. Communication theory of secrecy systems. Bell Tech. J., 28:656–715, Oct.
1949.
[101] G. J. Simmons. An introduction to shared secret and/or shared control schemes and theirapplications, chapter 9, pages 441–497. IEEE Press, 1991.
[102] G. J. Simmons, W.-A. Jackson, and K. Martin. The geometry of shared secret schemes.
Bulletin of the ICA, 1(2):230–236, 1991.

154

BIBLIOGRAPHY[103] K. Srinathan, N. T. Rajan, and C. P. Rangan. Non-perfect secret sharing over generalaccess structures. Progress in Cryptology-INDOCRYPT’02, LNCS 2551, Springer-Verlag,
pages 409–421, 2002.
[104] D. R. Stinson. Decomposition construction for secret-sharing schemes. IEEE Trans.
Inform. Theory, 40(1):118–125, 1994.
[105] D. R. Stinson. CRYPTOGRAPHY Theory and Practice. CRC Press, 1995. (1st. ed.).
[106] D.R. Stinson. An explication of secret sharing schemes. Designs, Codes and Cryptography, 2:357–390, 1992.
[107] Y. Suga, K. Iwamura, K. Sakurai, and H. Imai. Extended graph-type visual secret sharing
schemes with embedded plural images. IPSJ J., 42(8):2106–2113, 2001. (in Japanese).
[108] Y. Tamura, M. Tada, and E. Okamoto. Update of access structure in Shamir’s (k, n)
threshold scheme. Proc. of SCIS’99, pages 469–474, 1999.
[109] K. Tochikubo. Remarks on the secret sharing scheme for general access structures. Proc.
of Symposium on Cryptography and Information Security, pages 779–804, 2001. (inJapanese).
[110] M. Tompa and H. Woll. How to share a secret with cheaters. J. of Cryptology, 1:133–138,
1988.
[111] W.-G. Tzeng and C.-M. Hu. A new approach for visual cryptography. Designs, Codes
and Cryptography, 27(3):207–227, 2002.
[112] T. Uehara, T. Nishizeki, E. Okamoto, and K. Nakamura. Secret sharing systems withmatroidial schemes. IECE Trans., J69–A(9):1124–1132, 1986. (in Japanese).
[113] M. van Dijk. On the information rate of perfect secret sharing schemes. Designs, Codes
and Cryptography, 6:143–169, 1995.
[114] M. van Dijk. More information theoretical inequalities to be used in secret sharing? Information Processing Letters, 63:41–44, 1997.
[115] M. van Dijk. Secret key sharing and secret key generation. PhD thesis, Univ. of Eindhoven,1997.
[116] M. van Dijk. A general decomposition construction for incomplete secret sharing schemes.
Designs, Codes and Cryptography, 15:301–321, 1998.
[117] E. R. Verheul and H. C. A. van Tilborg. Constructions and properties of k out of n visualsecret sharing scheme,. Designs, Codes, and Cryptography, 1(2):179–196, 1997.

BIBLIOGRAPHY

155[118] H. Yamamoto. Useful codes for secret sharing communication systems. Technical Reportsof IECE, IT84-8:23–29, 1984. (In Japanese).
[119] H. Yamamoto. On secret sharing systems using (k, L, n) threshold scheme. IECE. Trans.,
J68–A(9):945–952, 1985. (in Japanese). English translation: Electronics and Communications in Japan, Part I, vol. 69, no. 9, pp. 46–54, Scripta Technica, Inc., 1986.
[120] H. Yamamoto. On secret sharing communication systems with two or three channels.
IEEE Trans. Inform. Theory, 32(3):387–393, 1986.
[121] H. Yamamoto. Coding theorem for secret sharing communication systems with two noisy
channels. IEEE Trans. Inform. Theory, 35(3):572–578, 1989.
[122] H. Yamamoto. A coding theorem for secret sharing communication systems with two
gaussian wiretap channels. IEEE Trans. Inform. Theory, 37(3):634–638, 1991.
[123] C.-N. Yang and C.-S. Laih. New colored visual secret sharing scheme. Designs, codes,
and cryptography, 20(3):325–335, 2000.
[124] R. W. Yeung. A new outlook on Shannon’s information measures. IEEE Trans. Inform.
Theory, 37(3):466–474, 1991.

List of Publications
Journal and International Symposium
1. H. Koga, M. Iwamoto, and H. Yamamoto. An analytic construction of the visual secretsharing scheme for color images. IEICE Trans. Fundamentals, E84-A(1):262–272, 2001.
([66])
2. M. Iwamoto and H. Yamamoto. The optimal n-out-of-n visual secret sharing scheme forgray-scale images. IEICE Trans. Fundamentals, E85–A(10):2238–2247, 2002. ([52])3. M. Iwamoto and H. Yamamoto. Visual secret sharing schemes for plural secret images.
IEEE International Symposium on Information Theory, p. 283, June–July, 2003.
4. M. Iwamoto and H. Yamamoto. A construction method of visual secret sharing schemes
for plural secret images. IEICE Trans. Fundamentals, 86–A(10):2577–2588, 2003. ([53])Domestic Symposium and Technical Meeting
5. M. Iwamoto, H. Koga, and H. Yamamoto. Another constructions of the (k, n) latticebased visual secret sharing scheme and its application to general access structures. Proc.
of Symposium on Information Theory and Its Applications (SITA99), pp. 761–764, Nov.–
Dec., 1999. (in Japanese).
6. H. Koga, M. Iwamoto, and H. Yamamoto. An analytic construction of the visual secretsharing scheme for color images. Proc. of Symposium on Cryptography and Information
Security (SCIS2000), SCIS2000-B45, Jan., 2000.
7. M. Iwamoto and H. Yamamoto. An optimal n-out-of-n visual secret sharing scheme forgray-scale images. Proc. of Computer Security Symposium (CSS2001), pp. 337–342, Oct.,
2001. (in Japanese).
8. M. Iwamoto and H. Yamamoto. A visual secret sharing scheme for plural images. Proc.
of Symposium on Information Theory and Its Applications (SITA2001), pp. 565–568, Dec.,
2001. (in Japanese).
157

158

BIBLIOGRAPHY

9. M. Iwamoto and H. Yamamoto. The security condition of visual secret sharing schemes
for plural images. Technical Report of IEICE, ISEC2001–121, pp. 51–56, March, 2002.
(in Japanese).
10. M. Iwamoto and H. Yamamoto. Non-ideal ramp secret sharing schemes for general accessstructures. Proc. of Symposium on Information Theory and Its Applications (SITA2002),
pp. 227–230, Dec., 2002. (in Japanese, [51]).
11. M. Iwamoto, H.Yamamoto, and H. Ogawa. A general construction method of secretsharing schemes based on (k, n)-threshold schemes using integer programming. Technical
Report of IEICE, 103(61, ISEC2003-11):63–70, 2003. (in Japanese, [50]).
12. T. Ogawa, A. Sasaki, M. Iwamoto, and H. Yamamoto. Coding efficiency and constructionof quantum secret sharing schemes. Proc. of Symposium on Information Theory and Its
Applications, pages 651–654, 2003. (in Japanese, [87]).

Patent13. 岩 本 貢, 山本 博資, 小川博久 . 秘密分散法の 最適割 り 当て 決定方法及 び そ の 方法を 実現
す る コン ピ ュ ー タプ ロ グラ ム . (特願 003-132265, 国際特許分類 G06F 17/60, 申請中),
2003.