“Publicly Verifiable Secret Sharing”的意思、由来-开放百科全书

词条

Publicly Verifiable Secret Sharing

释义

Initialization
Distribution
Reconstruction
Chaum-Pedersen Protocol
See also
References

In cryptography, a secret sharing scheme is publicly verifiable (PVSS) if it is a verifiable secret sharing scheme and if any party involved can verify the validity of the shares distributed by the dealer.

{{quotation|

    In verifiable secret sharing (VSS) the object is to resist malicious players, such as
 (i) a dealer sending incorrect shares to some or all of the participants, and
 (ii) participants submitting incorrect shares during the reconstruction protocol,cf. [CGMA85].
 In publicly verifiable secret sharing (PVSS), as introduced by Stadler [Sta96], it is an explicit goal that not just the participants can verify their

own shares, but that anybody can verify that the participants received correct shares.

Hence, it is explicitly required that can be verified publicly.

|Berry Schoenmakers. A Simple Publicly Verifiable Secret Sharing Scheme and its Application to Electronic Voting .}}

The method introduced here according to the paper by Chunming Tang, Dingyi Pei, Zhuo Liu, and Yong He is non-interactive and maintains this property throughout the protocol.

Initialization

The PVSS scheme dictates an initialization process in which:

All system parameters are generated.
Each participant must have a registered public key.

Excluding the initialization process, the PVSS consists of two phases:

Distribution

1.Distribution of secret shares is performed by the dealer , which does the following:

The dealer creates for each participant respectively.
The dealer publishes the encrypted share for each .
The dealer also publishes a string to show that each encrypts

(note: guarantees that the reconstruction protocol will result in the same .

2. Verification of the shares:

Anybody knowing the public keys for the encryption methods , can verify the shares.
If one or more verifications fails the dealer fails and the protocol is aborted.

Reconstruction

1. Decryption of the shares:

The Participants decrypts their share of the secret using .

(note: fault-tolerance can be allowed here: it's not required that all participants succeed in decrypting as long as a qualified set of participants are successful to decrypt ).

The participant release plus a string this shows the released share is correct.

2. Pooling the shares:

Using the strings to exclude the participants which are dishonest or failed to decrypt .
Reconstruction can be done from the shares of any qualified set of participants.

Chaum-Pedersen Protocol

A proposed protocol proving: :

The prover chooses a random
The verifier sends a random challenge
The prover responds with
The verifier checks and

Denote this protocol as:

A generalization of is denoted as: where as: and :

The prover chooses a random and sends and
The verifier sends a random challenge .
The prover responds with , .
The verifier checks and

The Chaum-Pedersen protocol is an interactive method and needs some modification to be used in a non-interactive way:

Replacing the randomly chosen by a 'secure hash' function with as input value.

References

Markus Stadler, Publicly Verifiable Secret Sharing
Berry Schoenmakers, A Simple Publicly Verifiable Secret Sharing Scheme and its Application to Electronic Voting, Advances in Cryptology—CRYPTO, 1999, pp. 148–164

1 : Applications of cryptography

随便看

开放百科全书收录14589846条英语、德语、日语等多语种百科知识，基本涵盖了大多数领域的百科知识，是一部内容自由、开放的电子版国际百科全书。

Initialization

Distribution

Reconstruction

Chaum-Pedersen Protocol

See also

References