Threshold verifiable multi‐secret sharing based on elliptic curves and Chinese remainder theorem

IET Information SecurityVolume 13, Issue 3 p. 278-284 Research ArticleFree Access Threshold verifiable multi-secret sharing based on elliptic curves and Chinese remainder theorem Maryam Sheikhi-Garjan, Maryam Sheikhi-Garjan Department of Pure Mathematics, Faculty of Mathematical Sciences, University of Kashan, Kashan, 87317-53153 IranSearch for more papers by this authorMojtaba Bahramian, Corresponding Author Mojtaba Bahramian bahramianh@kashanu.ac.ir Department of Pure Mathematics, Faculty of Mathematical Sciences, University of Kashan, Kashan, 87317-53153 IranSearch for more papers by this authorChristophe Doche, Christophe Doche Departement of Computing, Faculty of Science and Engineering, Macquarie University, North Ryde, NSW, 2109 AustraliaSearch for more papers by this author Maryam Sheikhi-Garjan, Maryam Sheikhi-Garjan Department of Pure Mathematics, Faculty of Mathematical Sciences, University of Kashan, Kashan, 87317-53153 IranSearch for more papers by this authorMojtaba Bahramian, Corresponding Author Mojtaba Bahramian bahramianh@kashanu.ac.ir Department of Pure Mathematics, Faculty of Mathematical Sciences, University of Kashan, Kashan, 87317-53153 IranSearch for more papers by this authorChristophe Doche, Christophe Doche Departement of Computing, Faculty of Science and Engineering, Macquarie University, North Ryde, NSW, 2109 AustraliaSearch for more papers by this author First published: 01 May 2019 https://doi.org/10.1049/iet-ifs.2018.5174Citations: 9AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract In this study, the authors propose a new protocol to share secret shadows for verifiable secret sharing (VSS) schemes. Unlike traditional VSS schemes, whose communications between the dealer and the participants require a secure channel, the authors’ new scheme relies on the elliptic curve cryptosystem and the Chinese remainder theorem operates over a public channel. The security of the secret shadows and the verification algorithm are based on the hardness of the elliptic curve discrete logarithm problem. They also extend the proposed scheme to an efficient verifiable multi-secret sharing (VMSS) scheme, particularly when the number of secrets is more than the threshold. As a result, their scheme is a multi-use and efficient VMSS on the public channel which provides the same level of security as traditional VMSS schemes with much shorter keys. Nomenclature average cost of scalar multiplication on the elliptic curve cost of modular exponentiation on the finite field cost of a pairing on the elliptic curve cost of a multilinear map cost of a double knapsack algorithm cost of computing a unique solution for a system of n congruencies cost of the Lagrange basis of t points cost of two-variable one-way hash function cost of the calculation of t linear equations 1 Introduction Secret sharing has been an interesting research area of modern cryptography. It is an imperative tool in a vast range of cryptography applications including safeguarding cryptographic keys, secure multiparty computation, access control, e-voting, ad-hoc networks and multi-policy cryptosystems. In 1979, Shamir [1] and Blakley [2] independently introduced the first secret sharing scheme. In those schemes, a secret s is split into n pieces, called shadows or shares. This operation is performed by a dealer and shared among a group of n participants. Only qualified sets can pool their shares together and recomputed the secret s. The family of all qualified sets of participants is called the access structure. If the qualified set is specified by the set of at least t participants, which valid using shares can jointly recover the secret, the protocol is called a threshold secret sharing scheme. In such schemes [1, 2] fewer than t shares cannot provide any knowledge abouts and in this case, an access structure will be referred to as a threshold access structure. In Shamir's scheme, only one secret can be shared during each secret sharing process. Also, the dealer must refresh the secret shadows and redistribute them to the participants to share a new secret, which is a costly process. These weaknesses have been addressed by the introduction of a multi-stage multi-secret sharing (MSS) scheme by He and Dawson [3] in 1994. In a multi-stage MSS scheme, multiple secrets can be derived in particular/any order in the reconstruction phase [4-9]. The MSS schemes that all secrets could be constructed simultaneously are proposed in [10-15]. To share secrets with various thresholds, an MSS scheme based on CRT and Shamir's scheme is presented in [16]. In order to correctly reconstruct the secret in Shamir's scheme [1], the dealer, who distributes the shadows and the participants, who receive the shadows are all assumed, to be honest. One of the weaknesses of Shamir's scheme is that malicious participants or/and the dealer can submit invalid shares to cheat other participants from recovering the valid secret. A verifiable secret sharing (VSS) scheme, introduced by Chor et al. [17] is designed to prevent this problem. In such a scheme, there is an additional algorithm called verification, which allows each participant to verify the consistency and the validity of the shadows received from the dealer or from other participants. Furthermore, Publicly VSS (PVSS) is introduced by Stadler [18]. PVSS schemes allow anyone, not just participants can check the validity of the shares during the reconstruction phase. An effective threshold PVSS scheme using properties of a multilinear map was presented in [19] whose security relies on the multilinear Diffie–Hellman (MDH) assumption. The verification algorithm of [11, 12, 18, 20, 21] relies on the discrete logarithm problem (DLP). In addition, as a special case of a secret sharing scheme, a geometry-based -VSS based on personalised spherical coordinate space is proposed in [22]. In traditional secret sharing schemes, a secure channel between the dealer and the participants is required. It is used by the dealer or participants to distribute the private values (shadows). Certain verifiable MSS (VMSS) schemes removed the need for a secure channel. In [11], Shao and Cao proposed an efficient VMSS scheme based on [10] by adding the verification property. The distribution of secret shadows in both is done over a secure channel. Zhao et al. [20] in 2006 and Dehkordi and Mashhadi [12, 23] in 2008 were solved this problem and proposed public channel between the dealer and participants relies on the intractability of the DLP and of integer factorisation. So far, many VMSS schemes were proposed [10-13, 20, 23] to provide some improvements by reducing public values, computational cost and increasing the security and efficiency. The security of [12, 20, 21, 23, 24] relies either on the hardness of the DLP in a finite field or on the integer factoring problem and the most time-consuming part in these schemes is modular exponentiation. Recently, elliptic curve cryptography (ECC) [25-27] has received much attention. ECC provides the same level of security ElGamal or RSA using much smaller keys. Thus ECC is an interesting choice, especially since it can also reduce the computational cost. Also, bilinear pairing (BP) on elliptic curves [28] is applied as an important tool in detecting cheaters in the verification phase of secret sharing schemes. The security of BP relies on the computational Diffie–Hellman problem (CDHP). The use of ECC and BP has been found in [13, 14, 16, 29-31]. The VMSS schemes proposed in [13, 14] are based on ECC and BP. Moreover, multiple secrets are reconstructed at one time, there is no secure channel and flexible to change the threshold value. The scheme [14] has performed two improvements on [13] by reducing the number of public values and removing the limitation on the number of secrets. In [15], the ECC and double knapsack algorithm were employed in the structure of VMSS scheme which has improved the scheme [32] by providing a verification algorithm and public channel. In [31], a multi-use MSS was proposed. In this scheme, the distribution of the secret shadows on the secure channel and reconstruction phase is done using the ECC and Weil pairing on elliptic curves. Furthermore, the secrets can be recovered in any desired order. In this paper, a new way to share secret shadows based on ECC and Chinese remainder theorem (CRT) are introduced. Our VMSS scheme eliminates the need for a secure channel and multiple secrets can be shared and reconstructed efficiently. The security of the proposed scheme is based on the elliptic curve DLP (ECDLP). The remaining of this paper is organised as follows: In Section 2, we present Shamir's scheme, Shao and Cao's scheme, some background on elliptic curves and CRT. Then we propose our scheme in Section 3 and finally, we analyse the performance and security of our scheme in Section 4 before concluding in Section 5. 2 Preliminaries 2.1 Shamir's scheme Shamir's secret sharing scheme [1] consists of two algorithms: share generation and secret reconstruction. Let us denote by the set of n shareholders and let D a mutually trusted dealer. All computations are performed in the finite field , where p is a large prime number. Share generation algorithm: First, D selects a polynomial of degree such that , where and are randomly chosen. The n shares are computed by D. Each share is distributed to the participant by D using a secure channel. Secret reconstruction algorithm: The secret s can be reconstructed by using any t shares and Lagrange interpolation formula. Without any loss of generality, we assume that the t selected shares are . We then have (1) Although the Shamir's scheme is a simple and efficient method for sharing a secret, one can find the following drawbacks: In one process of Shamir's scheme, only one secret can be shared. It is a one-time use scheme, all information needs to update for sharing a new secret. Need a secure channel between the dealer and participants to distribute the shares. To recover the unique secret, the dealer and participants should be honest. In the next section, we briefly describe Shao and Cao's scheme. In the following scheme, some of the proposed drawbacks are solved. It also gives you some basic information related to a multi-use VMSS scheme. 2.2 Shao and Cao's VMSS Shao and Cao's scheme is based on [10], adding the verifiable property, which relies on the intractability of the DLP over finite fields. In both [10, 11], a two-variable one-way function is used to protect the secret shadows. We refer to [11] for the properties of this one-way function. Let be k secrets to be shared and let be a two-variable one-way function, where r is a random integer and s is a secret shadow. D performs the following steps: Choose a prime p and a generator g of order q such that and the DLP in the group generated by g is hard. Choose randomly n distinct secret shadows and distribute to using a secure channel. Select an integer r and compute . If o Select random numbers in order to construct the polynomial of degree such that: o Compute o Publish If o Construct o Compute , and . o Publish . Each participant can verify whether its share is valid or not by computing the following: When at least t shares are pooled together, participants can check whether others’ secret shadows are valid or not by checking the following equalities: Then the polynomial can be uniquely computed by Lagrange interpolation polynomial as follows: If If Moreover, the participants can check the validity of the secrets that were sent to them by checking that 2.3 Chinese remainder theorem Let be integers where 's denote positive pairwise coprime integers greater than 1, and , respectively, a system of congruencies (2)has a unique solution x modulo . Let and , one gets the solution eventually . 2.4 Elliptic curves Here, we briefly give the definitions and some properties of elliptic curves. For more information see [33]. Let be a field of a characteristic p, with p different from 2 and 3. An elliptic curve E defined over is given by the equation , where and . The set of all solutions together with the point at infinity, denoted by form a finite Abelian group denoted by . Geometrically adding two points is given by the tangent and chord method. More precisely, for two arbitrary points and the addition can be defined as where and The opposite of the point P is denoted by and satisfies . Relying on this addition, we can introduce a new operation called scalar multiplication, which given a non-negative integer and a point consists in adding P or to itself or times, depending if d is positive or negative. The result, denoted by dP is again a point on the curve E. 2.5 Elliptic curve cryptography The well-known public key cryptosystem RSA and ElGamal were based on modular arithmetic. The security of RSA relies on the difficulty to factor integers, while ElGamal hinges on the hardness of DLP in a finite field. In 1985, Koblitz [25] and Miller [27] proposed a new paradigm called elliptic curve cryptography (ECC), which could provide an effective cryptographic system. ECC provides an alternative system for digital signatures and encryption for secure key distribution [34]. Recently, ECC has drawn lots of attention because of its advantages like short key length, fast computation speed, and smaller storage capacity. The security of an elliptic curve cryptosystem is based on the hardness of the ECDLP. Given a point of order n and let , solving the ECDLP consists in finding an integer d, , such that . The primary advantage of ECC is that solving the ECDLP in is harder than solving the DLP in . The best-known algorithms to solve ECDLP are exponential time, whereas factoring integers or solving the DLP can be done in sub-exponential time. As a corollary, for the same level of security, the size of keys in ECC is smaller than its rival cryptosystems RSA and ElGamal. For instance, 224-bit keys for ECC provide the same level of security than 2048-bit keys for RSA or ElGamal. By increasing the key size, the security gap increases dramatically between the systems. For example, keys of size 256-bit and 512-bit for ECC, respectively, provide the same level of security as 3000-bit and 15,000-bit keys for RSA or ElGamal [25, 27]. 3 Proposed scheme In this section, we describe our verifiable threshold secret sharing scheme rely on the properties of ECC and CRT. This scheme consists of four algorithms Initialisation, Distribution, Verification and Reconstruction. As before, let D denotes a trusted dealer and denote the set of participants. The secret can be reconstructed by every qualified subset of at least t participants of . It enables each participant to verify the validity of his share. It also allows each participant who is involved in secret reconstruction to check the validity of other participants’ share. The master shadows/shares are multi-use. As they are protected during the secret sharing process and reusable for refreshing the public values of the new secret. The scheme can be extended to a multi-use VMSS. The security of the proposed scheme is based on ECDLP. Therefore, it is a computationally secure scheme. 3.1 Our VSS scheme Initialisation phase: In the initialisation phase, the trusted dealer D chooses the master secret shares and transmits them to the on a public channel. This phase will be executed only once for a multi-use secret sharing scheme. Let E be an elliptic curve defined over a finite field , where is a prime number and be a base point of prime order . The public information i . D chooses a prime number and n distinct positive integers along with the following properties: for . are n pairwise coprime or prime numbers. The following steps are done between D and ’s to transfer the master secret shadows to the participants: D chooses an integer d, as his/her private key and publishes as his/her public key. Each participant randomly selects an integer , as his/her private key, computes and broadcasts . To make sure that ’s are distinct D will ask new one until for and publish as a public key . ( is the corresponding identity of ). is a common key between D and . Both D and using his/her private key and public information and G can compute . D computes , where and finally broadcasts for . Each participant retrieves using his/her private key and G then computes . At the end of this phase both D and get the master share . Distribution phase: Assume that denote the secret which the D wishes to share in a secret sharing process. The D runs the following algorithm: Construct the polynomial of degree , where are randomly chosen integers as coefficients of . Select n random integers for , such that and ’s be n distinct integers. Compute for and . Compute a unique integer such that using the values , and CRT. Publish as public information. Verification phase: Any participant can verify the validity of other participant's shares by using the following verification algorithm, which uses the additive structure of elliptic curves. Each participant can check the following equations to verify whether the public value published by the dealer is consistent with its shadow: (3) Without any loss of generality, suppose that participants are willing to recover multiple secrets from at least t shares pooled together. Each participant can check the validity of others’ secret shadows by checking the following equations: (4) Reconstruction phase : The can be uniquely determined by Lagrange interpolation method, as follows: If the secrets are , using the Lagrange interpolation method, the polynomial can be determined as follows: 3.2 Our VMSS scheme Assume that denote k secrets to be shared in one secret sharing process. If like the schemes [10-12], the secrets can be considered as the coefficients of the in the proposed VSS scheme. Here we introduce an efficient scheme to share k secrets simultaneously when . The dealer does the following: Run the initialisation phase of the previous VSS scheme. Set the polynomial of degree , where are coefficients Choose randomly an integer and compute Compute the polynomial . Run the distribution phase of the proposed VSS scheme. Publish Run the verification phase of the proposed VSS scheme. Recovery phase : As before, can be uniquely determined by Lagrange interpolation method, as follows: Compute the polynomial , The polynomial along with public values result in as follows: 3.3 Updating phase To share the new secrets, some public values need to refresh. As in our scheme, the master secret shadows are multi-use, there is no need to run initialisation again, the D just updates the public values in the distribution part. In particular, computing a new X is very efficient. As we pointed before, where and . Once the values for are computed by D, can be saved and reused again to refresh X. In each updating phase, D only selects ’s and compute a new X using ’s. 4 Security and performance In this section, we examine the security of the proposed scheme regarding the following aspects: 4.1 Security Theorem 1.Any group of t or more participants can compute k secrets and any group of or fewer, cannot reconstruct any secrets. Proof.Without loss of generality, assume that and , ,…, pool together their valid secret shares , ,…, . Let be a polynomial of a degree in which coefficients are secret. In this case, using the public values , we have a system of t linear equations and t unknown values . By our assumption on the choice of ’s, for , the system has a unique solution. One can also interpolate through t points with an at-most degree polynomial using the Lagrange interpolating method. The uniqueness of the interpolating polynomial shows that . It is clear that for any points , we have a system of linear equations and t unknown values. Moreover, the degree of interpolating polynomial is at most . □ Theorem 2.In the proposed scheme, the master secret shadows cannot be computed from public parameters and . Proof.If an attacker (or ) wants to derive from the public parameters would need to solve the CDHP to compute from or the ECDLP, which is computationally hard. Therefore, only using her/his private key can compute and obtain the corresponding master secret shadow . □ Theorem 3.In the proposed VSS scheme, it is computationally hard to compute the secrets from public values . Proof. and ’s are public information and used in the verification phase. If an attacker wants to obtain directly from the public value would effectively be able to solve the ECDLP. The same is true for the VMSS scheme. □ Theorem 4.The scheme is secure against the participants-cheating scenario, i.e. the secret shares provided by the participants in the reconstruction phase can be verified and the cheaters can be detected. Furthermore, the scheme can check the validity of the secrets after reconstruction phase, so invalid secrets can be identified. Proof.Suppose that provides an invalid share instead of to the combiner or participant who is responsible for reconstructing the secrets. As we know, and are public values. Combiner computes and checks whether or not. If combiner identifies as a cheater. If combiner is not trusted and wants to cheat other participants by publishing invalid secrets at the end of reconstructing phase, in this case upon receiving ’s each participant can verify the validity of the secrets using the public information ’s if holds. □ Theorem 5.In our scheme, the master secret shadows are multi-use. Proof.Once the secrets are shared, only ’s will be revealed and ’s are kept secret, as we mentioned above, it is computationally hard obtaining ’s from ’s. Regarding and , the possibility of computing from is equal to find all possible values in which and search all values that divide which has exponential time complexity. □ 4.2 Performance In this section, we analyse the efficiency of our new verifiable MSS scheme. The performance analysis and comparison with similar schemes can be viewed from the following aspects in Table 1 : The need for a secure channel. The verifiability of secret shadows. Multi-use. The degree of the polynomial in the distribution phase. The security of the scheme. The number of public values needs to be updated. The computing in the verification phase. Table 1. Comparison with other schemes Features Our scheme [12] [13] [15] [16] [19] [30] [31] (1) no no no no yes no no yes (2) yes yes yes yes no yes yes no (3) yes yes yes yes no yes yes yes (4) t −1 k −1 t −1 k t t −1 t −1 t −1 (5) ECDLP DLP-RSA ECDLP-DLP ECDLP-DKP FCRT MDHP ECDLP ECDLP-DLP (6) , , , (7) SM ME BP DKE-SM unverifiable MP BP unverifiable We also compared the computation complexity of our scheme with the schemes [12, 13, 15, 16, 19, 30, 31] to share k () secrets in the distribution, recovery and verification phases. We only consider major time-consuming operations in performance analysis of our scheme and other schemes. So, we do not count the number of finite field multiplications and additions are done in the process of sharing a secret or secrets. In our scheme, the initialisation phase is responsible for generating public channel between the dealer and participants to share reusable master secret shares. The security of the proposed public channel is based on ECDLP. In this phase, two elliptic curve scalar multiplications () are done by the dealer and each participant to compute and common key . So, to share multi-use master shares among n participants are done by the dealer and participants. For the multi-use purpose, this algorithm runs only once so, we do not include the computational cost of this phase in Table 2. Table 2. Performance Phases Our scheme [12] [13] [15] [16] [19] [31] distribution verification unverifiable unverifiable recovery The major operations in the distribution phase are and for computing of X and , respectively. In the verification phase, to check the validity of a secret shadow using (3), are needed. Therefore, to verify t secret shadows, are done by the combiner. In the recovery phase, combiner computes t Lagrange basis to reconstruct the secret or secrets. More detailed information is given in Table 2. 4.3 Comparison with previous works In this section, we compared the efficiency of our new verifiable MSS scheme with other schemes regarding performance and security. In Table 2, we only compare the proposed scheme with the schemes [12, 13, 15, 16, 19, 31] which all have trusted party. In the schemes [16, 31], there exists a secure channel between the dealer and participants, while our scheme and [12, 13, 15, 19] provide the computationally secure public channel. The security of our public channel and [13, 15, 19] is based on ECDLP to transfer the multi-use master secret shadows between the dealer and participants. The public channel of the scheme [12] is based on the intractability of the factorisation and the discrete logarithm modulo a large composite number. In [15], there is another public channel. The security of the public channel between the dealer and trusted combiner is based on finding double knapsack constants which are only known by the dealer and trusted combiner. In addition, the communication between the participants and trusted combiner is done on a public channel by employing the double knapsack algorithm. In the same security level, our proposed public channel provides a higher security level with the small bitlength size of required parameters. In recent years, Weil pairing on elliptic curves has been used in the construction of MSS and VMSS schemes [13, 14, 30, 31]. Weil pairing has been used as a tool to transfer the ECDLP on to DLP in the finite field . A necessary requirement for security of pairing-based schemes is that DLP cannot be feasibly computed in the finite field . For instance, in an 80-bit security level, the bitlength of should be at least 1024 which is equivalent to bitlength of an RSA modulus in the same level. While the minimum bitlength of (prime order of base point ) so that ECDLP to be hard enough, is 160. As security requirements increase, the gap between the size of and increases. In a 256-bit security level, the minimum bitlength of is 15,360 opposed to 512 for . The properties of ECC (i.e. non-pairing based) in the setup and verification phases of our scheme can provide small parameters which save much power, bandwidth, storage and speed up computations. If , our VMSS scheme is more efficient in the reconstruction phase compare with [11, 12, 15, 31]. As main computation related to interpolation, verification, and public values are done over a th degree polynomial. In the scheme proposed, in [11, 12, 15] a th degree polynomial is reconstructed to share k secrets when . In this case, one has to do k main operations instead of t. In [31] the degree of polynomial is but to reconstruct k secrets kt pairings, kt exponentiations (apart from multiplications) are needed. Hence, as k grows the computational cost consequently will increase in such schemes. In [16], a threshold MSS scheme using CRT is proposed. Because of the mathematical structure of CRT, the dealer can set a polynomial to share k secrets among participants so that each secret can be reconstructed with a specific threshold. While in [16], the dealer submits all one-time use master shadows and the CRT modulo and its prime factorisation on a secure channel to the participants, in our proposed scheme by generating reusable master secret shadows, public channel and verification algorithm gains more efficiency. Furthermore, to share new secrets some information needs to be refreshed, in Shao and Cao's scheme and [12], the master secret shadows (’s) are protected by a two-variable one-way function during the secrets reconstruction. So the dealer has to calculate for n secret shadows . Moreover, each of t participants is involved in secrets recovery phase has to compute . To share new secrets these computations will be repeated with new r. To share new k secrets in [31], k scalar multiplications on the group of elliptic curve points are needed, while in our scheme, the updating phase is very efficient. We use the properties of CRT to reduce the computations in this part. As we mentioned in Section 3.3, the dealer computes X using and for . So, the dealer can save ’s and reuse them in the computation of a new X using new ’s. In [15, 30], verifiable threshold secret sharing schemes were proposed based on BP and MDH assumption, respectively. While Meng and Li [30] have solved key management problem for threshold signature in mobile ad-hoc network by removing the need for a trusted party, the computational cost of the scheme in distribution, verification and recovery phase compare to our scheme is really high. As in [30], each participant constructs a polynomial of degree which all t coefficients of the polynomial are points on elliptic curves, and each participant provides shares to other participants. In addition, the scheme has public values and two verification algorithms based on the BP, which are used in the distribution and recovery phases. In [15], a publicly verifiable secret sharing is proposed to share a secret which is assumed to be a multilinear pairing. This scheme requires to refresh public information to share a new secret in comparison with in our VSS to share t secrets. 5 Conclusion This paper proposes a multi-use VSS and VMSS with the interesting property that no secure channel between the dealer and the participants is needed to exchange master multi-use secret shadows. The proposed scheme efficiently renews the public information and uses ECC, CRT and features. The secret shadows distribution and verification phases that are computationally secure under the hardness of the ECDLP. 6 Acknowledgments The authors thank the referees for their careful reading and valuable comments. This research was partially supported by the University of Kashan under grant no. 682460/004. 7 References 1Shamir, A.: ‘How to share a secret’, Commun. ACM, 1979, 22, (11), pp. 612– 613 2Blakley, G.R.: ‘Safeguarding cryptographic keys’. Proc. 1979 AFIPS National Computer Conf., New York, New York, 1979, vol. 48, pp. 313– 317 3He, J., Dawson, E.: ‘Multistage secret sharing based on one-way function’, Electron. Lett., 1994, 30, (19), pp. 1591– 1592 4He, J., Dawson, E.: ‘Multisecret-sharing scheme based on one-way function’, Electron. Lett., 1995, 31, (2), pp. 93– 95 5Harn, L.: ‘Comment: multistage secret sharing based on one-way function’, Electron. Lett., 1995, 31, (4), pp. 262– 262 6Harn, L.: ‘Efficient sharing (broadcasting) of multiple secrets’, IEEE Proc. Comput. Digit. Techn., 1995, 142, (3), pp. 237– 240 7Chang, T.Y., Hwang, M.S., Yang, W.P.: ‘A new multi-stage secret sharing scheme using one-way function’, ACM SIGOPS Oper. Syst., 2005, 39, (1), pp. 48– 55 8Li, H.X., Cheng, C.T., Pang, L.J.: ‘An improved multi-stage (t,n)-threshold secret sharing scheme’. Advances in Web-Age Information Management, Hangzhou, China, 2005 (LNCS, 3739), pp. 267– 274 9Fatemi, M., Eghlidos, T., Aref, M.: ‘ A multi-stage secret sharing scheme using all-or-nothing transform’, 2009 10Yang, C.C., Chang, T.Y., Hwang, M.S.: ‘A (t, n) multi-secret sharing scheme’, Appl. Math. Comput., 2004, 151, (2), pp. 483– 490 11Shao, J., Cao, Z.: ‘A new efficient (t, n) verifiable multi-secret sharing (VMSS) based on YCH scheme’, Appl. Math. Comput., 2005, 168, (1), pp. 135– 140 12Dehkordi, M.H., Mashhadi, S.: ‘An efficient threshold verifiable multi-secret sharing’, Comput. Stand. Interfaces, 2008, 30, (3), pp. 187– 190 13Wang, S.J., Tsai, Y.R., Shen, C.C.: ‘Verifiable threshold scheme in multi-secret sharing distributions upon extensions of ECC’, Wirel. Pers. Commun., 2011, 56, (1), pp. 173– 182 14Eslami, Z., Rad, S.K.: ‘A new verifiable multi-secret sharing scheme based on bilinear maps’, Wirel. Pers. Commun., 2012, 63, (2), pp. 459– 467 15Patel, N., Vyavahare, P.D., Panchal, M.: ‘A novel verifiable multi-secret sharing scheme based on elliptic curve cryptography’. The Tenth Int. Conf. on Emerging Security Information, Systems and Technologies (SECURWARE 2016), Nice, France, 2016, pp. 230– 234 16Chan, C.-W., Chang, C.-C.: ‘A scheme for threshold multi-secret sharing’, Appl. Math. Comput., 2005, 166, (1), pp. 1– 14 17Chor, B., Goldwasser, S., Micali, S. et al: ‘Verifiable secret sharing and achieving simultaneity in the presence of faults’. Proc. of the 26th IEEE Annual Symp. on Foundations of Computer Science, Washington DC, 1985, pp. 383– 395 18Stadler, M.: ‘Publicly verifiable secret sharing’. Proc. of the 15th Annual Int. Conf. on Theory and Application of Cryptographic Techniques, Saragossa, Spain, 1996 (LNCS, 1070), pp. 190– 199 19Peng, Q., Tian, Y.: ‘A publicly verifiable secret sharing scheme based on multilinear Diffie-Hellman assumption’, Int. J. Netw. Secur., 2016, 18, (6), pp. 1192– 1200 20Zhao, J., Zhang, J., Zhao, R.: ‘A practical verifiable multi-secret sharing scheme’, Comput. Stand. Interfaces, 2007, 29, (1), pp. 138– 141 21Wang, F., Zhou, Y.-S., Li, D.-F.: ‘Dynamic threshold changeable multi-policy secret sharing scheme’, Secur. Commun. Netw., 2015, 8, (18), pp. 3653– 3658 22Tan, Z., Yang, G., Cheng, W. et al: ‘Distributed secret sharing scheme based on personalized spherical coordinates space’, Comput. Sci. Inf. Syst., 2013, 10, (3), pp. 1269– 1291 23Dehkordi, M.H., Mashhadi, S.: ‘New efficient and practical verifiable multi-secret sharing schemes’, Inf. Sci., 2008, 178, (9), pp. 2262– 2274 24Chen, L., Gollmann, D., Mitchell, C.J. et al: ‘Secret sharing with reusable polynomials’. Proc. of the Second Australian Conf. on Information Security and Privacy-ACISP'97, Sydney, NSW, Australia, 1997 (LNCS), pp. 183– 193 25Koblitz, N.: ‘Elliptic curve cryptosystems’, Math. Comput., 1987, 48, (177), pp. 203– 209 26Koblitz, N., Menezes, A., Vanstone, S.: ‘The state of elliptic curve cryptography’, Des. Codes Cryptogr., 2000, 19, (2), pp. 173– 193 27Miller, V.S.: ‘Use of elliptic curves in cryptography’. Advances in Cryptology CRYPTO85 Proc., SantaBarbara, CA, USA, 1986, pp. 417– 426 28Menezes, A.J., Okamoto, T., Vanstone, S.A.: ‘Reducing elliptic curve logarithms to logarithms in a finite field’, IEEE Trans. Inf. Theory, 1993, 39, (5), pp. 1639– 1646 29Hua, S., Aimin, W.: ‘A multi-secret sharing scheme with general access structures based on elliptic curve’. 3rd Int. Conf. on Advanced Computer Theory and Engineering (ICACTE), Chengdu, China, 2010, pp. 629– 632, (2), 173–193 (2000) 30Meng, X., Li, Y.: ‘A novel verifiable threshold signature scheme based on bilinear pairing in mobile ad hoc network’. Proc. of the IEEE Int. Conf. on Information and Automation (ICIA'12), Shenyang, China, 2012, pp. 361– 366 31Fatemi, M., Ghasemi, R., Eghlidos, T. et al: ‘Efficient multistage secret sharing scheme using bilinear map’, IET Inf. Sec., 2014, 8, (4), pp. 224– 229 32Lin, H.Y., Yeh, Y.S.: ‘Dynamic multi-secret sharing scheme’, Int. J. Contemp. Math. Sci., 2008, 3, pp. 37– 42 33Washington, L.C.: ‘ Elliptic curves: number theory and cryptography’ ( CRC Press, London, New York, 2008) 34Diffie, W., Hellman, M.E.: ‘New directions in cryptography’, IEEE Trans. Inf. Theory, 1976, 22, (6), pp. 644– 654 Citing Literature Volume13, Issue3May 2019Pages 278-284 ReferencesRelatedInformation