Proactive Secret Sharing using a Trivariate Polynomial

Chinneli Ashwini. Int. Journal of Engineering Research and Application www.ijera.com
ISSN : 2248-9622, Vol. 6, Issue 7, ( Part -3) July 2016, pp.69-72
www.ijera.com 69 | P a g e
Proactive Secret Sharing using a Trivariate Polynomial
Chinneli Ashwini, Aalaya Seshadri,
chinneliashwini4@gmail.com
aalaya6@gmail.com
ABSTRACT
Secret sharing technique is a tool in cryptography which refers to distribution of a secret data among a group of
n participants .The secret can be reconstructed by combining the individual share. To reconstruct secret,
minimum of any t threshold subgroup or more shares are combined together. By secret sharing technique we can
acquire secured and decentralized communication. The shares of the participants may be compromised because
of huge exchange of messages. Secret sharing technique can be easily implemented by using polynomials. We
propose a proactive secret sharing scheme, where shares are distributed and renewed periodically without
changing the secret. This scheme also allows us to reconstruct and recover the share if share is lost. The share
can also be verified to ensure its validity. Major contribution of the paper is implementing Proactive secret
sharing scheme using Elliptic Curve cryptography and Trivariate polynomial [1].
Index Terms: Elliptic Curve cryptography, Secret Sharing, Proactive Secret Sharing.
I. INTRODUCTION
ELLIPTIC CURVE CRYTOGRAPHY (ECC) was
first proposed by Neil Koblitz and Victor Miller in
1985. ECC is a public-key cryptography approach
based on the algebraic structure of elliptic curves
over finite fields.ECC provides equivalent security
with smaller keys compared to non-ECC
cryptography and also it reduces storage and
transmission requirements. For example, a 256-bit
ECC public key should provide comparable
security to a 3072-bit RSA public key. The security
of ECC depends on the elliptic curve logarithm
problem, a solution which is infeasible if modulus
is large. Security depends on computation of a
point multiplication and it is hard to compute the
multiplicand given the original and product points
[7][8][11].
ECC uses two algebraic structures, an
abelian group and a field. A group {G,.},is a set of
elements with binary operation (.).If pair of
elements (a,b) are in G then element (a.b) is also in
G. A group is said to be an abelian group if it
satisfies properties like Closure, Associative,
Identity element, Inverse element and
Commutative. An abelian group has been defined
over elliptic curves with addition operation that
shows how points on the curve can be added to get
another point on curve. Field is a set of elements
with two binary operations (addition and
multiplication). It can be a non-infinite field of real
numbers, GF(p),where p is of prime order. Elliptic
curve point multiplication is operation of adding a
point along with elliptic curve to itself repeatedly
[7].
Geometric description of Point Addition
Let E be an Elliptic curve equation y2
= x3
+ax+b
with two distinct points P and Q results in negation
of the point on the curve E ,P + Q = -R .We
consider the mirror image (w.r.t x axis) of third
point of intersection[11].P=(xp,yp),Q=(xq,yq)
Therefore P+Q=R=(xr, yr).
Xr = λ2
-xp - xq.
Yr = λ (xp - xr) - yp.
λ = (yq - yp)/(xq -xp).
Secret sharing was first invented by Adi
Shamir and George Blakley independently. In
Shamir’s Secret sharing technique the secret
information is distributed among a group of
participants and only authorized subgroup
(threshold number of participants) are permitted to
reconstruct the secret[2][4].
Suppose the secret is divided among n
participants and to recover the secret only threshold
value (k) participants are required, this protocol is
called as (k,n) threshold protocol. It is impossible
to recover the secret with k-1 or less participants.
Blakley’s secret sharing scheme is
geometric in nature, where a secret is a point in an
m-dimensional space, and n-shares are constructed
with each share defining a hyper plane in this
space. By finding the intersection of any m of these
planes, the secret i.e., the point of intersection is
obtained [9].
The shares distributed among the
participants can be verified by using Verifiable
secret sharing technique [3]. By this method we can
RESEARCH ARTICLE OPEN ACCESS

ensure the share obtained is acceptable and later
used for reconstruction of secret.
Earlier the process of controlling and
coordinating the whole share generation and
allocation of shares among participants was
through certification authority (CA). The role of
CA is to distribute the individual share to each
participant and ensuring that no participant gets any
information about the actual secret. The dealer is
responsible to protect the secret and renew the
secret in case of loss of share or if share gets
compromised. The goal of our paper is
1) To distribute the role of central authority
among shareholders and build a decentralized
process (without CA).
2) To construct a secure long lived
communication by using our Proactive Secret
sharing scheme which construct, distribute,
verify, re-cover and renew the shares but the
actual secret remains unchanged.
II. BACKGROUND
In the field of cryptography there are
several techniques to convey the information
securely as it provides Confidentiality and
Integrity. By using Secret sharing technique the
data can be transmitted securely among group of
users (shareholders).Proactive secret sharing
technique is more efficient to secure the shares as
the renewal of shares is periodically performed and
reconstruction of secret is done by threshold
number of participants. Traditional secret sharing
scheme and verifiable secret sharing scheme are
described below:
2.1 Shamir’s Secret Sharing
In Shamir’s threshold scheme (k,n) [2],
Data D is divided into D1,D2,D3..... Dn among n
participants. The computation of reconstructing the
secret is carried out by polynomial interpolation. In
case of trusted third party, the dealer chooses the
polynomial with a degree less than threshold k-1 (if
threshold value is 3, then polynomial of degree 2 is
chosen). Let the polynomial chosen by dealer is :
p(x) = a0 + a1x + a2x2
+ a3x3
+….+a k-1xk-1
The secret data D = a0 and shares are computed by
substituting the corresponding share numbers in
polynomial. Share of 1st
participant = p(1), Share to
2nd
participant = p(2), ...., Share to nth
participant =
p(n).In order to find the polynomial chosen by
dealer, we need to interpolate k out of n shares as
degree of polynomial is k-1.
Recovering the secret
The polynomial is computed from shares
using Lagrange interpolation [10]. To recover the
secret we must obtain a polynomial and consider its
independent term. To calculate a0 we have
(x1,y1)…. (xk,yk) points and P(x) = yj . Lj (x)𝑘
𝑗=1 ,
Where Lj is Lagrange coefficient,
Lj= (x − xi)/(xj − xi)𝑘
𝑖=1,𝑖≠𝑗 .
After generation of polynomial, we obtain the
secure data D by substituting 0 in P(x). Shamir’s
scheme is generally used in applications which
involve mutual cooperation of individual and must
cooperate.
2.2 Feldman’s verifiable secret sharing
Scheme
In Shamir’s scheme, dealer distributes the
secure data among the participants (share holders)
but dealer may misbehave and distribute
inconsistent shares to shareholders, by which they
cannot reconstruct the secret. To overcome such
abnormal behavior of the dealer, shareholders must
verify the shares distributed to them. A scheme
which has been implemented to verify consistent
dealing of shares is known as Verifiable secret
sharing [3][6].
Verification of Shares
In Feldman’s secret sharing scheme,
dealer selects an element g and a polynomial P(x)
with coefficients p0
, p1
, p2
....pk−1
.Broadcasts the
corresponding values gp0 , gp1 , gp2 ...., g
p
k-1 and
then secretly transmits the value xi = P (i) to
the ith shareholder. Now each shareholder
verifies his own share by checking with the
following equation g
x
i = g
p
0 .g
p
1 , g
p
2 ...., g
p
k−1
Participant accepts the share if the above g
x
i value
holds true and sends a message accepting its share
as consistent or else sends a message as an
inconsistent share which means the dealer is
malicious.
III. PROACTIVE SECRET SHARING
Let the initial set (N) consists of n
participants. Public parameters such as additive
group G of prime order q, collision resistant hash
function h:{0, 1}*→Zq and the threshold value
t(which determines the security level of group) are
set. If we want to deal with subgroups threshold
t’value must be set. Security condition is t’ ≤t ≤ n
[1].
3.1 Description of our proposal
Proactive Secret sharing technique is an
efficient way to transmit the data securely[5].To
make the network robust and reliable the secrets of
participants must be renewed periodically, verify
and recover if share is lost.

This technique consists of 5 phases
1. Share Distribution
2. Share Verification
3. Share Reconstruction
4. Share Renewal
5. Share Recovery.
3.2 Architecture of Our proposal
Fig 1, represents the various phases of proactive
secret sharing scheme and the flow of protocol can
be easily understood.
3.3 Share Distribution Protocol
In Share distribution phase each
participant select a trivariate polynomial and
distributes a bivariate share value by substituting
the corresponding hash value of the participant
in polynomial and then each participant computes
his final share. It also provides commitments to
other participants for verification of share. Let
G be additive group and P is the generator point in
G. All the participants run the following protocol
[1].
1) Each participant Ni ∈ N chooses a random
trivariate polynomial Pi (x, y, z) ∈ Zq [x, y, z],
with degree at most t-1 in the variables x and y,
degree at most t’-1 in the variable z and
symmetric with respect to variables x and y.
P(x, y, z) = Pi(x, y, z)NiϵN . Let pi,0 = Pi (0, 0, 0)
and s = NiϵN pi,0 = P(0, 0, 0).
2) Each participant Ni ∈ N secretly sends to each
of the other participants Nj ∈ N the polynomial
Pij = Pi (x, h(Nj ), z) and the value Yi = pi,0 ∗ P .
Where h(Nj ) is the hash value of ith
participant
and P is point generator in group G.
3) Each participant in Ni ∈ N after btaining Pij
from all other participants, computes its final
secret information Pj(x,z),which is a bivariate
polynomial.
Pj(x,z)= Pij(x, z)NiϵN = Pi(x, h Nj , z)NiϵN .
4) Each participant Ni ϵN secretly sends its
commitment Cik to all other participants Nk 𝜖𝑁.
Ci
mnj = bi
mnj * P, where bi
mnj is co-efficient
multiplying xm
yn
zj
in Pi(x, y, z).
Cik
= ∑Ci
mnj _*h(Nk)n
.
3.4 Share Verification Protocol
Share Verification phase is important
phase in proactive secret sharing technique because
if the share received is incorrect the secret cannot
be recovered. In this phase the shares received from
other participants will be verified by using the
commitment which is sent by the participant. If the
shares received from all participants are correct
then each participant computes the final share. If
the share obtained is incorrect then share recovery
can be applied and obtain correct share.
1) Each participant NiϵN receives commitment Cik
and share Pij(x,z) from all other shareholders Nk ϵ
N. Ci
mnj = bi
mnj * P, Where bi
mnj is co-efficient
multiplying xm
yn
zj
in Pi(x, y, z). Cik
= ∑Ci
mnj *
h(Nk)n
.
2) Each participant k calculates ∑bk
mj* P, where
bk
mj is a coefficient of xm
zj
in share sik.
3) Participant verifies share sik by comparing Cik
=
∑bk
mj *P. If it holds true share received is correct.
3.5 Share Renewal Protocol
Share Renewal Phase is important in
proactive secret sharing technique as it helps in
long lived communication. In this phase, the share
of each participant is renewed periodically to
provide secure and robust network. The actual
secret remains unchanged but shares of participants
get renewed. Initial polynomials of each participant
be Pi(x, y, z) and share be Pi(x, z).
1) Each participant has to select a new trivariate
polynomial Pì(x, y, z) ϵ Zq[x, y, z] such that its free
term must be zero i.e. P`(0,0,0)=0.
2) Each participant Ni ϵ N secretly sends to each of
the other participants Nj ϵ N the polynomial.
Pìj=Pì(x,h(Nj), z).where h(Nj) is the hash value of
jth
node .
3) Each participant in N after obtaining Pìj from all
other participants, each participant Ni ϵ N computes
its final secret information P`j(x,z) , which is a
bivariate polynomial.

P` j(x,z) =∑ Ni ϵ N P`ij(x,z)=
∑ Ni ϵ N P`i(x, h(Nj),z).
4) The shares of each participant gets renewed by
adding the previous share Pj(x, z) with new share
P`j(x,z) as Renewed share
RS = Pj(x, z) + P`j(x, z).
3.6 Share Reconstruction Protocol
In Share Reconstruction Phase, the actual
secret can be reconstructed by interpolating any k
(threshold) shares among n shares. By interpolation
of shares (Bivariate polynomials) we acquire a
polynomial as a resultant and secured data is
obtained by substituting zero in polynomial since
the free term is secret data.
1) Select any threshold number of shares and by
applying Lagrange Interpolation. P(x) =∑jϵtPj(x,z).
lj(x).
Where lj(x) = πmϵt(x-xm)/(xj-xm) & m ≠ j and lj(x) is
Lagrange coefficient.
2) Secret can be obtained by substituting zero in the
polynomial P(0)=S(actual secret).
3.7 Share Recovery Protocol
In Share Recovery Phase the participants
whose share is either compromised or damaged can
be recovered as follows:
1) If participant Nr loses its share, then to recover
the previous share. Nr requests a threshold
group (t) NM of existing participants in
process.
2) If a participant Nj ϵ NM accepts to recover the
share of participant Nr, it secretly send
Pj(h(Nr), z) to Nr.
3) Pj(h(Nr),z) = P(h(Nr), h(Nj), z) When
participant Nr receives this information from t
different nodes, it can obtain its secret share
polynomial Pr(x, z) by using Lagrange
interpolation.
IV. CONCLUSION
Secret sharing scheme in field of
cryptography provides a secure transmission of
data. Our proposal proactive secret sharing
technique using trivariate polynomials provide an
effective way to transfer the data securely. Using
this we can handle a decentralized communication
securely for long period of time. By using Elliptic
curve concept the computation for proactive secret
sharing is easy. This scheme can be applied in
Manets to acheive efficient decentralization and
dynamicness.
REFERENCES
[1]. Paz Morillo Vanesa Daza a, Javier
Herranz b. Cryptographic techniques for
mobile ad-hoc networks. Computer
Networks, 51:49384950, 2007.
[2]. Adi Shamir. How to share a secret.
Communications of ACM, 22(11):612613,
1979.
[3]. Feldman, A Practical Scheme for Non-
Interactive Verifiable Secret Sharing,
Proc.of the 28th IEEE Symposium on the
Foundations of Computer Science, 1987,
427-437.
[4]. Amos Beimel, Secret Sharing Schemes:
Survey, Department of Computer
Science,Ben-Gurion University, Isreal.
[5]. Herzberg, Jareck and, Krawczyk,
Proactive Secret Sharing, IBM T.J.
Watson Research Center,NY, 1995.
[6]. Michael Backes, Aniket Kate, Arpita
Patra,Computational Veriable Secret
Sharing.
[7]. William Stallings,”Textbook -
Cryptography and Network Security”
[8]. Forouzan,”Textbook -Cryptography and
Network Security”
[9]. G. Blakley. Safeguarding cryptographic
keys. In Proc. Of AFIPS National
Computer Conference,1979.
[10]. Jeffreys, H. and Jeffreys, B. S.
”Lagrange’s Interpolation Formula.”
9.011 in Methods of Mathematical
Physics, 3rd
ed. Cambridge, England:
Cambridge University Press, p. 260, 1988.
[11]. Anoop MS,”Elliptic Curve
Cryptography”An Implementation Guide.
Chinneli Ashwini graduated
in Computer Science and
Engineering from JNTUH. She
is currently pursuing M.tech
from JNTUH, Hyderabad. Her
research interest include
secret sharing, MANET’s and
Security in Sensor Networks.

Proactive Secret Sharing using a Trivariate Polynomial

More Related Content

What's hot (16)

Viewers also liked (19)

Similar to Proactive Secret Sharing using a Trivariate Polynomial (20)

Recently uploaded (20)

Proactive Secret Sharing using a Trivariate Polynomial