How to construct a verifiable multi‐secret sharing scheme based on graded encoding schemes

IET Information SecurityVolume 13, Issue 4 p. 343-351 Research ArticleFree Access How to construct a verifiable multi-secret sharing scheme based on graded encoding schemes Massoud Hadian Dehkordi, Massoud Hadian Dehkordi Cryptography and Data Security Laboratory, School of Mathematics, Iran University of Science & Technology, Narmak, Tehran, 1684613114 IranSearch for more papers by this authorHossein Oraei, Corresponding Author Hossein Oraei hossein_oraei@mathdep.iust.ac.ir Cryptography and Data Security Laboratory, School of Mathematics, Iran University of Science & Technology, Narmak, Tehran, 1684613114 IranSearch for more papers by this author Massoud Hadian Dehkordi, Massoud Hadian Dehkordi Cryptography and Data Security Laboratory, School of Mathematics, Iran University of Science & Technology, Narmak, Tehran, 1684613114 IranSearch for more papers by this authorHossein Oraei, Corresponding Author Hossein Oraei hossein_oraei@mathdep.iust.ac.ir Cryptography and Data Security Laboratory, School of Mathematics, Iran University of Science & Technology, Narmak, Tehran, 1684613114 IranSearch for more papers by this author First published: 01 July 2019 https://doi.org/10.1049/iet-ifs.2018.5306Citations: 1AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract In a verifiable multi-secret sharing scheme, a dealer distributes multiple secrets between a group of participants and also additional information is given that allows each participant to check whether his share is valid. In this study, the authors present a novel verifiable multi-secret sharing (VMSS) scheme with general access structure using monotone span programs, which its security is based on graded encoding schemes. More precisely, they reduce the hardness of graded decision-Diffie–Hellman problem to the computational security of the authors’ scheme in the standard model. To the best of the authors’ knowledge, this is the first study to present a VMSS scheme based on graded encoding schemes. 1 Introduction In a multi-secret sharing (MSS) scheme, several secrets are distributed among a group of participants by a dealer D such that only authorised sets can reconstruct the secrets by combining their shares (or their pseudo shares), while other subsets cannot know any information about them [1]. For sharing the secrets, there are many techniques such as multilinear maps [2], polynomial interpolation [3, 4], using the Chinese remainder theorem [5, 6], monotone span program (MSP) [7, 8] and so on. The notion of MSP which will be described later, was introduced by Karchmer and Wigdersonm [9]. In an MSS scheme based on MSP, the secrets are taken from a finite field, and each participant's share is obtained by computing a linear combination of some random numbers and the secrets [10, 11]. In the reconstruction phase, all participants of an authorised set compute a linear combination of their shares. 1.1 Background The notion of multilinear maps was introduced by Boneh and Silverberg [12] as an extension of bilinear maps and provided two applications: a one-round multi-party key exchange protocol and a broadcast encryption scheme. Different from bilinear maps, which can be built from the pairing of elliptic curves, constructing multilinear maps was a long-standing open problem. This problem was eventually solved by Garg et al. [13], who constructed the first approximate construction of multilinear maps. They introduced the notion of graded encoding scheme as a variant of multilinear maps and proposed a candidate construction by using ideal lattices which is called GGH13. Graded encoding schemes are useful tools, enabling many important applications, such as functional encryption [14, 15], obfuscation [16, 17], witness encryption [18-20], multipartite key exchange [13] and so on. 1.2 Related work So far, several provably secure secret sharing schemes for different purposes have been proposed by many researchers [21-29]. Among them, there are verifiable secret sharing (VSS) schemes such as [22, 24-26, 29]. In 2009, Heidarvand and Villar [22] proposed the notion of indistinguishability (IND) of secrets and also two new secure definitions for (Publicly) VSS schemes, that capture the notion of IND of secrets in the standard model (IND-secrecy and CSA-secrecy). In the first definition (IND-secrecy), an adversary cannot distinguish between a random value and the shared secret, while in the second definition (CSA-secrecy) secrets of the challenge are chosen by the adversary. In the random oracle model, Wu and Tseng [24] proposed a secure (Publicly) VSS scheme. They also presented a realisation of the (Publicly) verifiable property to propose their (Publicly) VMSS scheme from bilinear pairings in [26]. Afterward, using decisional bilinear Diffie–Hellman (DBDH) assumption, a threshold (Publicly) VSS scheme was proposed which has CSA-secrecy [25]. They used one-way hash functions to prove the indistinguishability of their scheme against adaptively chosen secret attacks in the standard model. The use of bilinear maps for constructing verifiable secret sharing schemes is a common method used in other papers [30]. It should be noted that there are other methods for constructing verifiable secret sharing schemes, such as lattices [29]. By multiple linear pairs, two (Publicly) VSS schemes were proposed by Peng and Tian [2, 31]. These two schemes are based on multilinear maps and not on graded encoding schemes. 1.3 Motivation The VSS schemes [22, 24-26] are based on bilinear maps, which can be built from the pairing of elliptic curves. Also, there are VSS schemes such as [2, 31] which have been constructed using multilinear maps (the maps which do not exist). On the other hand, all of the above-mentioned schemes, have threshold access structures in which only any at least t participants can reconstruct the secret, while in general access structure the participants do not have the same ability to recover the secret. However, there are many situations in which general access structures are required [10, 11, 32, 33]. Unfortunately, in these MSP based schemes: There not exists computational verification property. When one of the secrets is reconstructed, the shares are not reusable. There not exists any formal proof. 1.4 Contribution To the best of our knowledge, currently, there are no studies that indicate how a secret sharing scheme can be built from the realisation of multilinear maps (i.e. graded encoding schemes). In this paper, we use monotone span programs to construct a VMSS scheme based on graded encoding schemes. In summary, our new proposed scheme has the following properties: It has the computational verification property. It supports the general access structure which makes it more applicable than threshold VMSS schemes. The share of each participant is reusable when secrets are reconstructed. The most important part of this work is the formal security analysis that we provide for our VMSS scheme by giving the exact relation between the GDDH problem and the security of our scheme. We present a security experiment to prove that our VMSS scheme enjoys the IND-secrecy. 1.5 Organisation The paper is organised as follows. Section 2 describes the required tools. In Section 3, we give formal definitions of computational security of a VMSS scheme. In Section 4, we propose a secret sharing scheme based on graded encoding schemes and its security is discussed in Section 5. In Section 6, we show how the first scheme can become a VMSS scheme and finally in Section 7, we conclude the paper. 2 Preliminaries Here, we summarise some preliminary concepts about secret sharing schemes, multilinear maps and also graded encoding schemes. 2.1 Secret sharing schemes Definition 1.Suppose that be a set of participants. Then, a monotone access structure on is a set of non-empty subsets of participants which satisfies the monotone ascending propertyThe sets in and are called authorised sets and unauthorised sets, respectively, where denotes the power set of . The set that we call adversary structure satisfies the monotone descending property We denote by the minimal elements in and by the maximal elements in . That is and Definition 2.For any adversary structure over , its dual is defined as 2.1.1 Monotone span program and LMSS schemes In 1993, Wigdersonm and Karchmer introduced the concept of MSP which is a model of computation as follows [9]: Definition 3.A MSP over a set is a triple , in which is a finite field, is a distribution matrix with entries in and is a function.In the above definition, is a surjective function that distributes to each participant of some rows of . Definition 4.Suppose that be an access structure for which . A monotone span program is called an MSP for concerning a target vector , if for all the following conditions are satisfied: if , then . if , then there exists a sweeping vector such that with . where is the matrix restricted to the rows i with , with the notation we mean that there is a vector for which and is the number of participants in A.Similar to the case of one target vector, we say that is an MSP for access structures , concerning some target vectors , if it is true that for each , if , where means that there is for which . It is proved that constructing an MSP for access structures is equivalent to devising a linear multi-secret sharing (LMSS) scheme for , [34]. Also, is an MSP for access structures , if there exists a (target) vector , in which is the space spanned by the row vectors of distributed to the player and can be considered as the above target vectors. According to the above discussion, we consider the target vector to be an l -rowed vector whose j th component is and other components are , . Now, we describe how an LMSS scheme which realises access structure , can be constructed using any MSP : Distribution step: Suppose the dealer D has secrets . Then, he can construct a distribution vector in which are random elements in . Next, he computes and gives to the participant . Reconstruction step: In the following, suppose that the notation be the vector restricted to the indices in A. For each authorised set , there is a vector for which . So i.e. the secret can be reconstructed by computing a linear computation of the shares of participants in A. 2.2 Multilinear maps The notion of multilinear maps is defined by Boneh and Silverberg as follows [12]. For cyclic groups and of the same prime order q, a k -multilinear map is a map such that (i) Multilinear: For all and , we have . (ii) Non-degenerate: If for , be a generator of the group , then is a generator of . (iii) Computable: For all , the value is computed efficiently. 2.2.1 Multilinear DDH (MDDH) problem Here for each multilinear map e, we propose a game between as an adversary and as a challenger which is called multilinear decision-Diffie–Hellman problem. Game : (i) Using the security parameter , the challenger firstly chooses the groups G and of prime order q, a generator g of G and a symmetric k -multilinear map . (ii) Using the integers which are chosen uniformly at random, the challenger computes . (iii) Using the integer which is chosen uniformly at random, the challenger computes . (iv) randomly selects a bit and sends to the adversary . (v) Finally, publishes a bit . In this game, we define the advantage of the adversary in solving MDDH problem to be We say that the MDDH problem is hard, if for each polynomial time adversary , is a negligible function of . 2.3 Graded encoding schemes Garg et al. [13] defined the notion of k -graded encoding schemes as an approximation of k -multilinear maps as follows: Definition 5.(k-graded encoding scheme): Let R be a ring and be a family of sets such that for each constant index i , the sets are disjoint. Then a k - graded encoding scheme with the ring R and the family of sets consists of the following procedures: The randomised instance-generation procedure takes as input a security parameter and also multilinearity parameter k. It outputs , where is a zero-test parameter (as below) and params is a description of a k -graded encoding scheme. Samp (params) The randomised ring sampler procedure outputs which is a ‘level-zero encoding’, where is a random and nearly uniform element. The (possibly randomised) encoding procedure takes as input an index and a ‘level-zero’ encoding and outputs which is a ‘level-i’ encoding for the same . On input of params, an index and two level-i encodings and , the addition and negation procedures compute and , respectively. Here, and are negation and addition in the ring R. This implies that for a collection of h encodings , where , we get . On input of params, two indices with , a level- encoding and a level- encoding , the multiplication procedure computes , where is integer addition and is multiplication in the ring R. This implies that for a collection of h encodings where , we get as long as . On input of params and u, the zero-test procedure outputs 1 if and 0 otherwise. In other words, this procedure only outputs 1 if u be the level-k encoding of 0. On input of params, the zero-test parameter and , the extraction procedure outputs such that For every and two level-k encodings , The distribution over is nearly uniform. We now give a more precise description of the above procedures. The real-life version of efficient procedures. Garg et al. proposed GGH13 which is a k -graded encoding scheme over ideal lattices. Their realisation of the above procedures has two changes in the zero-test and extraction procedures as follows: Zero-test: This procedure sometimes allows false positives, but not false negatives. More precisely, for every it is held that , but for which is a nearly uniform random element Extraction: According to the ring sampler and encoding procedures, to get a level-i encoding of a nearly uniform random element where , we first run the ring sampler procedure to get a level- encoding of , and then run the encoding procedure to get a level-i encoding of . On the other hand, in the extraction procedure of GGH13, there is a good probability of generating the same output for any two different level-k encodings of . Thus, the properties (a) and (b) of the extraction procedure are replaced by two weaker requirements: (a′) For every , where , if the (randomised) encoding procedure is run twice on a to obtain two level-k encodings , then (b′) The following distribution over is nearly uniform: Remark 1.As explained in the extraction procedure, for every and two level-k encodings , it is held that (with high probability in the real-life version). In the remaining of this paper, for simplicity, we work with the dream version of extraction procedure in which this probability is one. If we want to use the real-life version, we must consider the negligible probability that . One better way is to use the idea presented in [35] in which a graded encoding scheme is presented that realises the ‘dream version’ of GGH13. Thus, for every , we write to denote this bit string. Remark 2.A k -graded encoding scheme may be consist of some secret parameters (e.g. see the description of in [36]). Nevertheless, anyone can use a k -graded encoding scheme without knowing their secret parameters. 2.3.1 Graded DDH (GDDH) problem The analogue of MDDH in k -graded encoding schemes is called ‘Graded Decision-Diffie–Hellman’ problem. Now, between as an adversary and as a challenger, we define the GDDH problem for each k -graded encoding scheme , which is a game as follows: Game : (i) Based on the multilinearity parameter k and the security parameter , the challenger runs to get a description of a k -graded encoding scheme. (ii) For , the challenger firstly runs to get level-zero encodings , where are random and nearly uniform elements. Then, performs the following three steps: runs to get level- encodings . According to the multiplication procedure, computes runs to get the level-k encoding . (iii) The challenger runs to get which is a level-zero encoding, where is a random and nearly uniform element. Then runs to get level- k encoding . (iv) Consequently, the challenger considers two distributions in which is the level-k encoding of the right product , and where is the level-k encoding of a random element . Then, randomly generates a bit and sends to . (v) Finally, publishes a bit . In this game, we define the advantage of the adversary in solving GDDH problem to be We say that the GDDH problem is hard, if for each polynomial time adversary , is a negligible function of . Remark 3.We can also define the analogue of discrete logarithm problem in k -graded encoding schemes as follows: Given a level-i encoding , where and is a random and nearly uniform element, the adversary must output a level-zero encoding . 3 Computational VMSS schemes We now present the formal model of VMSS schemes. A VMSS scheme can be described by the following algorithms: On input of a security parameter , the set of participants and access structures , the setup algorithm outputs some public parameters: . On input of and the secrets , the distribution algorithm broadcasts the set of shares and some public output . This public value is used to verify the correctness of the shares: . On input of , Proof and , the verification algorithm outputs True if the share is a valid share for the participant or otherwise. On input of pms, Proof and the shares of the participants in an authorised set , the reconstruction algorithm Rec outputs the secret , where . There exist three properties which the VMSS scheme must satisfy them. Let be an authorised subset of the access structure , and is an unauthorised set. These properties are as follows: (i) Correctness: This property means that by using the shares of participants of , the same secret must be reconstructed. (ii) Verifiability: In a VMSS scheme, there must exist some tests to prevent cheating by dealer or participants. The participants of will recover the same secret , if these tests are passed correctly. (iii) Secrecy: Let the dealer is honest. Then, the participants of cannot reconstruct the secret , or even know any information about it, even knowing some of the other secrets. In a secret sharing scheme, adversaries can be divided into active and passive [22]. An active adversary has full control over the corrupted participants, while a passive one only obtains the information held by them. On the other hand, adversaries can be classified into adaptive and static. An adaptive adversary at any time can attempt to corrupt a new participant, while a static one can only corrupt a participant at the beginning of the protocol. 3.1 IND-secrecy Here, we define the IND-secrecy for a verifiable secret sharing scheme by proposing an experiment between as an adversary and as a challenger in the computational scenario. This experiment means that cannot distinguish between a random value and the shared secret. Game : (i) The set of participants and also an access structure are broadcast by the adversary . (ii) runs and then sends to the adversary . (iii) A subset of corrupted participants is published by such that . (iv) chooses two random secrets and also a random bit . Next, he runs and sends to , along with . (v) Finally, publishes a bit . In this game, we define the advantage of the adversary to be We say that a VSS scheme has indistinguishability of secrets in the standard model, if for any polynomial time adversary , is a negligible function of . 4 Proposed secret sharing scheme Here, using MSPs, we propose our secret sharing scheme based on k -graded encoding schemes. In the next section, we show how verifiability can be achieved by using the k -graded encoding schemes. Suppose that be a set of n participants. The dealer D firstly chooses a k -graded encoding scheme as defined in Definition 5. Next, D runs to get two level-zero encodings and , where are random and nearly uniform elements. Then, D considers as an element of the field in which q is a sufficiently large prime number and distributes the secret according to a given general access structure as follows. 4.1 Setup: The dealer D runs the encoding procedure to get the level-k encoding . The dealer also chooses an MSP with a target vector for access structure . The public parameters are . 4.2 Distribution: The dealer shares the secret among n participants as follows: Suppose that be the distribution matrix. Choose a distribution vector , where and 's, are uniformly random chosen elements in . Now, compute . By using the bijection function , secretly transmit to the participant where . For simplicity, we assume that . Thus, the share of each participant is , . 4.3 Reconstruction: The participants of an authorised set can reconstruct the secret S as follows: Firstly, all participants pool their shares. Then, according to the previous discussion in Section 2, for the authorised set A, there exist a vector such that , where denotes the number of elements of A. Thus, the participants of A can get the level-zero encoding by the equation (1)Finally, the participants of A can recover the secret S by firstly running the multiplication procedure and then running the extraction procedure to get the secret 5 Correctness and security proofs 5.1 Correctness Here we show the correctness of our scheme. If the dealer and the participants behave honestly, the participants of the authorised set can get the secret by firstly computing (1) as and then running the multiplication procedure . Finally, they run the extraction procedure to get the secret 5.2 Secrecy Now, we prove the security of the secret sharing scheme. We explain how an adversary for the proposed secret sharing scheme can be used to define an adversary that is a solver for the GDDH problem. More precisely, we reduce the hardness of GDDH problem to the computational security of the proposed scheme. Theorem 1.If there is any polynomial-time adversary who can break the secret sharing scheme, then there exists a polynomial-time adversary that is a solver for the GDDH problem such that Proof.Consider an adaptive and active probabilistic polynomial time adversary which acts according to the game against the security of the proposed scheme, such that his advantage is non-negligible. In the following, we will construct an adversary which acts according to the game to solve the GDDH problem with a non-negligible advantage in polynomial time and uses as a sub-routine. □ Based on the multilinearity parameter k and the security parameter , the challenger of the game (i.e. ) runs to get a description of a k -graded encoding scheme . For , the challenger firstly runs to get level-zero encodings , where are random and nearly uniform elements. Then, performs the following three steps: runs to get level-1 encodings . According to the multiplication procedure, computes runs to get the level-k encoding . The challenger runs to get which is a level-zero encoding, where is a random and nearly uniform element. Then runs to get level-k encoding . Consequently, the challenger considers two distributions in which is the level-k encoding of the right product , and , where is the level-k encoding of a random element . Then, randomly selects a bit and sends to ( is either identical to or ). The set of participants and also an access structure are broadcast by the adversary (the start of the game ). acts as a challenger for in the secret sharing scheme. So simulator runs the multiplication procedure to get the level-k encoding . Next, considers the (unknown) level-zero encoding as an element of the field in which q is a sufficiently large prime number to distribute the (unknown) secret using the general access structure . The ‘adaptive’ adversary publishes a subset which is the corrupted participants at the beginning of the game . Next, (as the challenger of this game) guesses the set of all corrupted participants B for which and (for simplicity, we assume that ). In order to share the (unknown) secret , the simulator uses with target vector which is an MSP for access structure : broadcasts public parameters . Using the integers which are chosen uniformly at random, the challenger constructs a vector . As previously discussed in Section 2, there exists a sweeping vector with such that for the unauthorised set B (), it holds that . Using the vector , the distribution vector is computed as . For each participant , the simulator secretly transmits the shares , that is because for we have For the rest participants , the simulator secretly transmits a uniformly random element of as their shares. Thus, acts as a challenger for in distribution phase . Then, sends to . Suppose that , be the set of all participants corrupted by the ‘adaptive’ adversary such that . If it holds that , then leaves the game and randomly gives a bit as final output. Otherwise sends the share of each to . Then, The adversary outputs as follows: (game ) o If , outputs . o Otherwise, outputs . outputs as output of the game . Now, suppose that , and Fail be the event that , the event that and the event that leaves the game at step 9, respectively. For the events Fail and , note that if Fail occurs, then the probability of will be . Thus and so . For any possible choice of , the probability of is computed as which ranges from 1 if to if and . Consequently, it holds that . 5.3 Instantiating the used graded encoding scheme In this paper, we have presented a general VMSS scheme whose security is based on a graded encoding scheme . To use the proposed VMSS scheme, the graded encoding scheme must be instantiated. The instantiation of can be done by selecting one of the existing graded encoding schemes [13, 37, 38, 35] or ones that are offered in the future. Here, we discuss how can be instantiated to ensure the VMSS scheme's security. As we saw, the security of the proposed VMSS scheme is based on the GDDH problem. So, in the graded encoding scheme that is chosen, the GDDH problem must be hard. In [39], Hu and Jia provided their cryptanalysis of GGH13 that led to breaking the GGH13-GDDH problem. So, instantiating using GGH13 cannot be a good choice. Very recently, Farshim et al. [35] showed how to construct a graded encoding scheme from obfuscation. They proved that in their proposed graded encoding scheme, the GDDH problem is hard, if the used components are secure. So, should be instantiated by this graded encoding scheme which leads to the security of the proposed VMSS scheme. 6 VMSS scheme Based on the scheme proposed in Section 4, in this section, we describe a technique to construct a verifiable multi-secret sharing scheme from k -graded encoding schemes. 6.1 Description of the scheme Suppose that be a set of n participants. The dealer D firstly chooses a k -graded encoding scheme as defined in Definition 5. Next, D runs to get level-zero encodings , and , where are random and nearly uniform elements. Then, D considers as an element of the field in which q is a sufficiently large prime number and distributes the secret according to a given general access structure as follows (). 6.1.1 Setup : The dealer runs the encoding procedures and to get the level-k encodings and . The dealer also runs the multiplication procedures and . Next, the dealer chooses an MSP with target vectors for access structures , where . The public parameters are . 6.1.2 Distribution : The dealer shares the secret , among n participants as follows: Suppose that be the distribution matrix. Choose a distribution vector where and 's, are uniformly random chosen elements in () and then compute . By using the bijection function , secretly transmit to the participant where . For simplicity, we assume that . Thus, the share of each participant is . For , run the addition procedure to compute . The public outputs of the distribution phase are . 6.1.3 Verification of shares : Participant runs the addition procedure to compute the values and . Next, he can verify whether his share is valid by checking the equation 6.1.4 Reconstruction : The participants of an authorised set can reconstruct the secret as follows: (i) Firstly, each participant chooses a vector such that and computes . (ii) Next, all participants pool their pseudo shares. The pseudo share of the participant is . (iii) Verifiability in the reconstruction: Suppose that . He runs the addition procedure to compute and broadcast . Now, any participant can verify the 's pseudo share by checking the following equation: (iv) According to the previous discussion in Section 2, for the authorised set A, there exist a vector such that , where denotes the number of elements of A. Thus, the participants of A can get the level-zero encoding by the following equation: (2) Finally, the participants of A can recover the secret by firstly running the multiplication procedure and then running the extraction procedure to get the secret 6.2 Correctness Here we show the correctness of our scheme. If the dealer and the participants behave honestly, the participants of the authorised set can get the secret by firstly computing (2) as and then running the multiplication procedure . Finally, they run the extraction procedure to get the secret 6.3 Verifiability Now, we determine the verifiability of our scheme using the following theorems: Theorem 2.If a participant accepts his share, then there exists a unique value for which Proof.Suppose that the share of is computed as and the dealer sends the value to . If accepts , then (3)where the first equality is due to the fact that and are in . Thus, the second equality of (3) leads to . □ Theorem 3.If a participant accepts 's pseudo share, then there exists a unique value for which Proof.This proof is similar to that of Theorem 2. Suppose that sends in the reconstruction phase. If accepts 's value , then (4)where the first equality is due to the fact that and are in . Thus, the third equality of (4) leads to . □ 7 Conclusion In this paper, we proposed the first VMSS scheme based on graded encoding schemes. More precisely, the security of the proposed VMSS scheme is based on the GDDH problem. As we mentioned earlier, there have already been verifiable (multi)-secret sharing schemes based on multilinear maps (the maps which do not really exist) [2, 31]. So our VMSS scheme is the first realisation of such verifiable schemes. Here, we first propose a comparison of the basic properties in the new VMSS scheme with threshold verifiable (multi)-secret sharing schemes in the literature [2, 31]. For easiness, the abbreviations and are used for our first and second schemes, respectively. The results of this comparison are summarised in Table 1. Table 1. Basic properties of the schemes Property Peng and Tian [2] Peng and Tian [31] have indistinguishability against chosen secret attacks yes yes yes — are secure against active attack no no yes — are secure against adaptive attack no no yes — assumption MCDH MCDH GDDH — method interpolation interpolation MSP MSP general access structure no no yes yes have verification property for dealer yes yes no yes have verification property for participants yes yes no yes distribute multi-secret yes no no yes the share of each participant is reusable no — — yes it is possible that all secrets are not reconstructed simultaneously no — — yes Now, we use the following notations to analyse the number of public values and also complexities of the proposed VMSS scheme: : The time required to execute a multiplication operation. : The time required to execute an addition operation. : The time required to execute the used multilinear map. : The time required to execute one of the efficient procedures of the used k -graded encoding scheme. In Tables 2 and 3, we give a comparison of the schemes mentioned above. From the comparison in the tables, we mention the main properties of the new proposed VMSS scheme: It is the first VMSS scheme based on the GDDH problem which has indistinguishability against chosen secret attacks. Furthermore, our VMSS scheme is secure against active and adaptive adversaries. Every participant uses his pseudo share for reconstructing the secret . So, the 's real share will not be disclosed even after reconstruction of all secrets and therefore the proposed scheme is a multi-use secret sharing scheme. It is impossible for dealers to cheat since every participant can check the reality of his share. It is also impossible for every participant to cheat since everyone can check the reality of pseudo shares that they give. It is very practical in the cases that all of the participants do not have the same level power for reconstructing the secrets. Table 2. Comparison of the computational complexities Step Peng and Tian [2] Peng and Tian [31] setup distribution verification reconstruction Table 3. Comparison of the number of public values Peng and Tian [2] Peng and Tian [31] number of public values 8 References 1Ghasemi, R., Safi, A., Dehkordi, M.H.: ‘Efficient multi-secret sharing scheme using new proposed computational security model’, Int. J. Commun. Syst., 2017, 31, (1), p. e3399 2Peng, Q., Tian, Y.: ‘Publicly verifiable secret sharing scheme and its application with almost optimal information rate’, Sec. Commun. Netw., 2016, 9, (18), pp. 6227– 6238 3Qin, H., Dai, Y., Wang, Z.: ‘A secret sharing scheme based on (t, n) threshold and adversary structure’, Int. J. Inf. Secur., 2009, 8, (5), pp. 379– 385 4Liu, Y.: ‘Linear (k, n) secret sharing scheme with cheating detection’, Sec. Commun. Netw., 2016, 9, (13), pp. 2115– 2121 5Asmuth, C., Bloom, J.: ‘A modular approach to key safeguarding’, IEEE Trans. Inf. Theory, 1983, 29, (2), pp. 208– 210 6Liu, Y., Harn, L., Chang, C.-C.: ‘A novel verifiable secret sharing mechanism using theory of numbers and a method for sharing secrets’, Int. J. Commun. Syst., 2015, 28, (7), pp. 1282– 1292 7Cramer, R., Damgård, I., Maurer, U.: ‘General secure multi-party computation from any linear secret-sharing scheme’. Advances in Cryptology-EUROCRYPT, 2000, pp. 316– 334 8Dehkordi, M.H., Mashhadi, S., Oraei, H.: ‘A proactive multi stage secret sharing scheme for any given access structure’, Wirel. Pers. Commun., 2019, 104, (1), pp. 491– 503 9Karchmer, M., Wigdersonm, A.: ‘On span programs’. Structure in Complexity Theory Conf., 1993, pp. 102– 111 10Liu, M., Xiao, L., Zhang, Z.: ‘Linear multi-secret sharing schemes based on multi-party computation’, Finite Fields Appl., 2006, 12, (4), pp. 704– 713 11Hsu, C.F., Cheng, Q., Tang, X. et al: ‘An ideal multi-secret sharing scheme based on MSP’, Inf. Sci., 2011, 181, (7), pp. 1403– 1409 12Boneh, D., Silverberg, A.: ‘Applications of multilinear forms to cryptography’, Contemp. Math., 2003, 324, (1), pp. 71– 90 13Garg, S., Gentry, C., Halevi, S.: ‘Candidate multilinear maps from ideal lattices’. Annual Int. Conf. on the Theory and Applications of Cryptographic Techniques, Berlin, Heidelberg, 2013, pp. 1– 17 14Lin, H., Tessaro, S.: ‘Indistinguishability obfuscation from trilinear maps and block-wise local PRGs’. Annual Int. Cryptology Conf., Cham, 2017, pp. 630– 660 15Ananth, P., Sahai, A.: ‘Projective arithmetic functional encryption and indistinguishability obfuscation from degree-5 multilinear maps’. Annual Int. Conf. on the Theory and Applications of Cryptographic Techniques, Cham, 2017, pp. 152– 181 16Garg, S., Gentry, C., Halevi, S. et al: ‘Candidate indistinguishability obfuscation and functional encryption for all circuits’, SIAM J. Comput., 2016, 45, (3), pp. 882– 929 17Ananth, P., Jain, A., Sahai, A.: ‘Robust transforming combiners from indistinguishability obfuscation to functional encryption’. Annual Int. Conf. on the Theory and Applications of Cryptographic Techniques, Cham, 2017, pp. 91– 121 18Garg, S., Gentry, C., Sahai, A. et al: ‘Witness encryption and its applications’. Proc. of the Forty-fifth Annual ACM Symp. on Theory of Computing, ACM, 2013, pp. 467– 476 19Gentry, C., Lewko, A., Waters, B.: ‘Witness encryption from instance independent assumptions’. Int. Cryptology Conf., Berlin, Heidelberg, 2014, pp. 426– 443 20Garg, S., Gentry, C., Halevi, S. et al: ‘On the implausibility of differing-inputs obfuscation and extractable witness encryption with auxiliary input’, Algorithmica, 2017, 79, (4), pp. 1353– 1373 21Ruiz, A., Villar, J.L.: ‘Publicly verifiable secret sharing from Paillier's cryptosystem’, WEWoRC, 2005, 74, pp. 98– 108 22Heidarvand, S., Villar, J.L.: ‘Public verifiability from pairings in secret sharing schemes’. Int. Workshop on Selected Areas in Cryptography, Berlin, Heidelberg, 2009, pp. 294– 308 23Jhanwar, M.P.: ‘A practical (non-interactive) publicly verifiable secret sharing scheme’. Int. Conf. on Information Security Practice and Experience, Berlin, Heidelberg, 2011, pp. 273– 287 24Wu, T.Y., Tseng, Y.M.: ‘A pairing-based publicly verifiable secret sharing scheme’, J. Syst. Sci. Complex., 2011, 24, (1), pp. 186– 194 25Gan, Y., Wang, L., Wang, L. et al: ‘Publicly verifiable secret sharing scheme with provable security against chosen secret attacks’, Int. J. Distrib. Sens. Netw., 2013, 9, (2), pp. 1– 9 26Wu, T.Y., Tseng, Y.M.: ‘Publicly verifiable multi-secret sharing scheme from bilinear pairings’, IET Inf. Sec., 2013, 7, (3), pp. 239– 246 27Herranz, J., Ruiz, A., Saez, G.: ‘Sharing many secrets with computational provable security’, Inf. Process. Lett., 2013, 113, (14), pp. 572– 579 28Mashhadi, S.: ‘Computationally-secure multiple secret sharing: models, schemes, and formal security analysis’, ISC Int. J. Inf. Sec., 2015, 7, (2), pp. 91– 99 29Rajabi, B., Eslami, Z.: ‘A verifiable threshold secret sharing scheme based on lattices’, Inf. Sci., 2018, https://doi.org/10.1016/j.ins.2018.11.004 30Shen, J., Liu, D., Sun, X. et al: ‘Efficient cloud-aided verifiable secret sharing scheme with batch verification for smart cities’, Future Gener. Comput. Syst., 2018, https://doi.org/10.1016/j.future.2018.10.049 31Peng, Q., Tian, Y.: ‘A publicly verifiable secret sharing scheme based on multilinear Diffie-Hellman assumption’, Int. J. Netw. Sec., 2016, 18, (6), pp. 1192– 1200 32Hsu, C.F., Cui, G.H., Cheng, Q. et al: ‘A novel linear multi-secret sharing scheme for group communication in wireless mesh networks’, J. Netw. Comput. Appl., 2011, 34, (2), pp. 464– 468 33Hsu, C.F., Harn, L., Cui, G.: ‘An ideal multi-secret sharing scheme based on connectivity of graphs’, Wirel. Pers. Commun., 2014, 77, (1), pp. 383– 394 34Xiao, L., Liu, M.: ‘Linear multi-secret sharing schemes’, Sci. China F: Inf. Sci., 2005, 48, (1), pp. 125– 136 35Farshim, P., Hesse, J., Hofheinz, D. et al: ‘Graded encoding schemes from obfuscation’. IACR Int. Workshop on Public Key Cryptography, Cham, 2018, pp. 371– 400 36Garg, S.: ‘ Candidate Multilinear Maps’. PhD thesis, University of California Los Angeles, 2013 37Langlois, A., StehlÃ©, D., Steinfeld, R.: ‘GGHLite: more efficient multilinear maps from ideal lattices’. Annual Int. Conf. on the Theory and Applications of Cryptographic Techniques, Berlin, Heidelberg, 2014, pp. 239– 256 38Coron, J.-S., Lepoint, T., Tibouchi, M.: ‘New multilinear maps over the integers’. Annual Cryptology Conf., Berlin, Heidelberg, 2015, pp. 267– 286 39Hu, Y., Jia, H.: ‘Cryptanalysis of GGH map’. Annual Int. Conf. on the Theory and Applications of Cryptographic Techniques, Berlin, Heidelberg, 2016, pp. 537– 565 Citing Literature Volume13, Issue4July 2019Pages 343-351 ReferencesRelatedInformation