Recursive Secret Sharing for Distributed Storage and Information Hiding

0.06 MB·English

by  Abhishek Parakh

Recursive Secret Sharing for Distributed Storage
and Information Hiding
Abhishek Parakh Subhash Kak
Computer Science Department Computer Science Department
Oklahoma State University Oklahoma State University
Stillwater, OK 74078 USA Stillwater, OK 74078 USA
Email: [email protected] Email: [email protected]
0
1
0
Abstract—This paper presents a recursive computational In a multiparty scenario, such as in secret sharing, the hid-
2 multi-secret sharing technique that hides k−2 secrets of size den information may be used as a means of authentication of
n b each into n shares of a single secret S of size b, such that any the share (and of reconstructed secret), thus provide cheating
a k of the n shares suffice to recreate the secret S as well as all
detection. For example, the dealer may hide a “specially”
J the hidden secrets. This may act as a steganographic channel
9 to transmit hidden information or used for authentication and chosen message in the shares of the secret and distribute the
1 verification of shares and the secret itself. Further, such a hash of this message to all the players along with the shares.
recursive technique may be used as a computational secret The players may later reconstruct the secret and the hidden
] sharing technique that has potential applications in secure and message, find the hash of the hidden message and verify it
R reliable storage of information on the Web, in sensor networks
against the hash they have.
C and information dispersal schemes. The presented technique,
unlike previous computational techniques, does not require the The presented scheme may be used as a multi-secret shar-
.
s use of any encryption key or storage of public information. ing scheme that uses Shamir’s secret sharing scheme as its
c buildingblockandencodesk−2additionalsecretswithinthe
[ I. INTRODUCTION shares of the message originally intended to be shared. And

1 An information theoretically secure k-out-of-n secret shar- the scheme may be used as a computational secret sharing
v ing technique used to share a secret of size b requires a total scheme, effectively resulting in smaller shares, by dividing a
1
storage space of size b·n. Since, k−1 shares do not reveal secret into smaller pieces and then simulating a multi-secret
3
any information about the secret, such techniques use k−1 sharingscheme.Sincetheproposedalgorithmgeneratesshares
3
3 randomelementsofsizebinordertocreatetheshares.Inthis on the order of size of secrets encoded, smaller pieces will
. paper,weproposethattheserandomelementsbereplacedwith give rise to smaller shares. Moreover, the proposed scheme
1
0 certainhiddeninformationthatmayserveasa steganographic does not require any encryption key.
0 channel.Notethatifasecretsharingschemeusesk−1random An efficient method for sharing multiple secrets with se-
1 elementsthenk−1istheupperlimitonthenumberofsecrets curity based on assumption of hardness of discrete logarithm
v: thatcanbehidden.Wehidek−2secretswhichisnearoptimal. problem is presented in [5]. Whereas [6] proposes a scheme
i If user A transmits a secret message to user B over a based on systematic block codes and [7] propose schemes
X
publicchannel,he maydividethe messageinto severalpieces based on Shamir’s secret sharing scheme but require a large
r
a (possiblyredundant)andsend the piecesonparallelchannels, amount of side information to be stored as public knowldege
such that an eavesdroppermay need to compromiseat least k and further [6], [7], [8] attempt to maintain ideal security.
out of n channels to retrieve the message. B upon receiving Otherschemes[9],[10]focusatimprovingefficiencyofcom-
the pieces may reconstruct the message and authenticate it putations involved in share creation and secret reconstruction
using the signed hash of the message that A sends to B. rather than space and transmission efficiency.
Transmission of this signature is an additional burden on the In an earlier paper [11], [12], a 2-out-of-2 (k = 2 and
network. In the proposed scheme, A may hide the signature n = 2) recursive scheme for secret sharing was proposed. In
within the pieces of the message that is transmitted. this method, if k secrets are chosen such that they double in
Information dispersal schemes for distributed storage net- size,thenallofthesmallersecretscanberecursivelystoredin
works primarily use computational secret [1], [2] sharing the shares of larger secrets, so that two shares of size 2m can
schemes.Ingeneral,inacomputationalsecretsharingscheme encode 2m+1−1 bits of information. For example, if we are
an encryption key is used to encrypt the secret that is to be to share 3 secrets s = 1, s = 01, and s = 1011, then the
1 2 3
securely stored/transmitted. The encrypted message is then two shares for s would be D = 0 and D = 1; where
1 s11 s12
divided into several (possibly redundant) pieces. The key is exclusive-OR operation is used for secret reconstruction. The
divided into shares using conventional secret sharing tech- sharesofs canbeusedtocreatetwosharesofs asfollows:
1 2
niques and these shares are stored along with the pieces of D = D 0 = 00 and D = 0D = 01. Here D 0
s21 s11 s22 s12 s11
the encrypted message, as an overhead [3], [4], [2]. denotes concatenation of share 1 of secret s with 0; and
1
0D denotes concatenation of 0 with share 2 of secret s , the third piece of the message as point (0,s ) interpolate 3rd
s12 1 3
and so on. Similarly, we can recursively use the shares of degree polynomial p (x). We continue this process until we
3
s2 to create the shares of s3: Ds31 = Ds2110 = 0010 and haveusedallthepiecesandreached(0,sk−2)andinterpolated
Ds32 = 10Ds22 =1001. As a result, the final two shares for (k−2)thdegreepolynomialpk−2(x).Wethensamplepk−2(x)
all the three secrets are 0010 and 1001. Consequently, using at k−1 points y(k−1)1 = pk−2(k−1), y(k−1)2 = pk−2(k),
8 bits of shares we have encoded 7 bits of secrets. This is in y(k−1)3 =pk−2(k+1), ..., y(k−1)(k−1) =pk−2(2k−3).
comparison with conventional methods that would require a Mapping these k − 1 samples as points (1,y(k−1)1),
total 14 bits of shares. (2,y(k−1)2), ..., (k −1,y(k−1)(k−1)) along with (0,S) con-
The above efficiency increase is obtained as a tradeoff struct a (k−1)th degree polynomial pk−1(x). We can now
againstsecurityofthescheme.Anon-recursiveschemewould sample pk−1(x) at n points such that any k points would
require7bitsforeachsharebuttherecursiveschemerequires reconstruct the secret and the hidden information.
4bitspershare,andaplayeronlyneedstodetermine4bitsto The process of share creation and information hiding is
break the scheme. However, in practice secrets are thousands formally described in Algorithm 2.
ofbitslong.Forexample,asecretof1048bitslengthwouldbe Algorithm 2 - Dealing Phase
encodedin approximately1024bits per share,and would still 1) Consider k−2 secrets s ∈Z , 1≤i≤(k−2).
i p
require 21024 combinations to break. This may be sufficient 2) Choose prime p=max(s ,S), for all 1≤i≤k−2.
i
for many cases. 3) Randomly and uniformly choose a number y ∈ Z
11 p
and map it as point (1,y ).
II. SPACE EFFICIENT SECRETSHARING 11
4) Do for 1≤i≤(k−2)
We proposea methodto hidek−2 secretsofsize b, within
a) Interpolate points (0,s ) and (j,y ), for all 1 ≤
the shares of a secret S of size b, using a (k,n) modified i ij
j ≤i to generate a ith degree polynomial p (x).
Shamir’s secret sharing scheme. The secret is divided into n i
b) Sample the polynomial p (x) at i + 1 points:
shares using modified Shamir’s secret sharing scheme such i
y =p (j+i), for all 1≤j ≤(i+1).
thatanyk of themcanbe broughttogetherforreconstruction. (i+1)j i
c) Map the i+1 points as: (j,y ), for all 1 ≤
Algorithm 1 (Modified Shamir’s secret sharing scheme) (i+1)j
j ≤(i+1).
1) Chooseaprimep,p>max(S,n),whereSisthesecret.
2) Choose k −1 random numbers y1, y2, ..., yk−1, uni- 5) Ijnt≤erp(okla−te1p)otiontsge(n0e,rSat)ea(nkd−(j1,)yth(k−d1e)gjr)e,efoprolaylnlo1mi≤al
formly and independently, from the field Z .
3) Map these random numbers y s as y copordinates of pk−1(x).
points: (i,y ), for all 1≤y ≤(ik−1). 6) Sample pk−1(x) at n points to generate n shares:
4) Map the seciret S as point (i0,S). (i,pk−1(i)), for all k ≤i≤k+n−1.
Algorithm 2 - Reconstruction Phase
5) Usingkpoints(i,y ),forall1≤y ≤(k−1)and(0,S)
i i
interpolate a polynomial p(x) of degree k−1 modulo 1) Interpolate any k shares to generate (k −1)th degree
prime p. polynomialpk−1(x)=S+a1x+a2x2+...+ak−1xk−1.
6) Sample p(x) at n points Di =p(i), k ≤i≤k+n−1 2) Evaluate S =pk−1(0).
such that the shares are given by (i,D ). 3) Do for i=k−2 down to 1
i
The reconstruction procedure for the secret follows the a) Mapthecoefficientsofpolynomialpi(x)aspoints:
conventionalmethod [13]. (j,aj), for all (i+1)≤j ≤2(i+1).
Now consider k −2 secrets s1s2...sk−2, si ∈ Zp for all b) Interpolate (j,aj), for all (i+1) ≤ j ≤ 2(i+1),
1≤i≤(k−2) or pieces of a larger message. Therefore our to generate polynomial pi(x) of degree i.
task is to recursively hide si’s within the shares of secret S. c) Evaluate si =pi(0).
Further,weusethenotationy todenotethey-coordinatesof Security of the proposed method: Algorithm 2 works by
lm
points. Here the first subscriptl is the indexof the step in the repetitive application of Algorithm 1. The first iteration of
recursive process and subscript m is index of share to which the algorithm is a direct application of (2,2) Shamir’s secret
thaty-coordinatebelongsto.Forexample,they-coordinateof sharingscheme.Itusesapolynomialofdegree1andgenerates
share 3 in the 5th recursion is written y . two shares for the first secret s of the message. These two
53 1
The proposed algorithm works as follows - randomly and shares may be viewed as random numbers, such that given
uniformly choose a number y and map it as point (1,y ). any number r ∈ Z , Pr(r = y ) = Pr(r = y ) = 1.
11 11 p 21 22 p
Using (0,s ) and (1,y ) interpolate 1st degree polynomial They are then used to create a quadratic equation along with
1 11
p (x). Sample p (x) at two points y = p (x = 2) and the second secret s mapped at x=0 (the free term of the
1 1 21 1 2
y =p (x=3).Nowmapthesampledpointsas(1,y )and equation).This quadraticequationis then sampled at 3 points
22 1 21
(2,y ). Using the next piece as point (0,s ) and the newly togenerate3sharesofs . Thesethreesharesarethenusedas
22 2 2
generated points (1,y ) and (2,y ) interpolate 2nd degree random points to generate a 4th degree equation and encode
21 22
polynomial p (x). Evaluate p (x) at 3 points y = p (x = s and so on, until we have encoded all the k−2 pieces and
2 2 31 2 3
3), y = p (x = 4), and y = p (x = 5). We then use generated k−1 shares. These k−1 shares are then used as
32 2 33 2
these 3 points as y-coordinates for x=1, 2, 3 and along with points along with secret S at x=0 to generate a polynomial
of degree k −1, which can then be sampled at n points to be looked upon as a way to share large secrets by dividing
create the final shares. These final shares have the shares of thesecretin smallerpiecesandrecursivelyhidingtheminthe
the smaller pieces hidden within them. The security of the shares.
protocolispredicatedupontherandomanduniformchoiceof Such a scheme is useful for secure transmission of infor-
the first coefficient y . mation over parallel channels. Suppose the transmitter and
11
Example.Supposewewanttohide3secretss =46,s = receiver share secret identifications.The transmitter can then
1 2
69, and s = 72 within the shares of a secret S=65. Let divide the identification into pieces and recursively encode it
3
k =5 and n=7, i.e. we are to create 7 pieces such that 5 of into the shares of the message to be sent over parallel lines.
themmustcometogethertorecreatethesecretandthehidden Transmissionofsharesoverparallelchannelsprovidedimplicit
message. We execute the algorithm as follows, security and reliability. Further, the scheme may be used for
1) Choose a prime p=131. information dispersal in storage networks.
2) Randomly and uniformly choose a number y ∈Z , Future Work: It includes implementing a distributed data
11 131
say y =102. Map it as point (1,102). storage scheme on the Web where differentservers store data
11
3) Interpolate (0,s ) = (0,46) and (1,102) to generate bycreatingsharesofthedatausingtheproposedscheme.This
1
p (x)=56x+46. implicitlypreventsanyone(compromised)serverfromhaving
1
4) Sample p (x) at two pointsx=2,3: y =p (2)=27 access all the user data [14]. Such an idea may be useful
1 21 1
and y =p (3)=83. in cloud computing, Chord protocol and FreeNets. Issues
22 1
5) Map these new points as (1,y ) = (1,27) and regarding addressing of data shares on the network need to
21
(2,y )=(2,83). be investigated.
22
6) Interpolate (0,s ) = (0,69), (1,27) and (2,83) to
2 IV. ACKNOWLEDGMENT
generate p (x)=49x2+40x+69.
2
This research has been partly funded by the Center for
7) Samplep (x)atthreepointsx=3,4,5:y =p (3)=
2 31 2
Telecommunication and Network Security (CTANS), Okla-
106, y =p (4)=96 and y =p (5)=53.
32 2 33 2
homa State University, Stillwater.
8) Map the new points as: (1,y ) = (1,106), (2,y ) =
31 32
(2,96) and (3,y33)=(3,53). REFERENCES
9) Interpolate (0,s ) = (0,72), (1,106), (2,96) and
3
[1] P.RogawayandM.Bellare,“Robustcomputationalsecretsharinganda
(3,53) to generate p (x)=111x3+38x2+16x+72.
3 unifiedaccountofclassicalsecret-sharinggoals,”inCCS’07:Proceed-
10) Sample p3(x) at 4 points x = 4,5,6,7: y41 = p3(4) = ings of the 14th ACM Conference on Computer and Communications
119, y = p (5) = 43, y = p (6) = 98 and y = Security. NewYork,NY,USA:ACM,2007,pp.172–184.
42 3 43 3 44
[2] H. Krawczyk, “Secret sharing made short,” Proceedings of the 13th
p (7)=33.
3 AnnualInternationalCryptologyConferenceonAdvancesinCryptology,
11) Map the new points as (1,y41) = (1,119), (2,y42) = pp.136–146, 1994.
(2,43), (3,y )=(3,98) and (4,y )=(4,33). [3] M. O. Rabin, “Efficient dispersal of information for security, load
43 44
balancing andfault tolerance,” Journal oftheACM,vol.36,no.2,pp.
12) Interpolate (0,S) = (0,65), (1,119), (2,43), (3,98)
335–348,1989.
and(4,33)to generatep4(x)=66x4+106x3+72x2+ [4] J.Garay,R.Gennaro,C.Jutla,andT.Rabin,“Securedistributedstorage
72x+65. andretrieval,” Theoretical Computer Science, pp.275–289,1997.
[5] L. Harn, “Efficient sharing (broadcasting) of multiple secrets,” IEE
13) Sample p (x) at 7 points x = 5,6,7,8,9,10,11 to
4 Proceedings - Computers and Digital Techniques, vol. 142, no. 3, pp.
create7shares:(5,p4(5))=(5,2);(6,p4(6))=(6,40); 237–240,May1995.
(7,p (7))=(7,63); (8,p (8))=(8,130); (9,p (9))= [6] H.-Y.Chien, J.-K.Jan,andY.-M.Tseng,“Apractical (t,n)multi-secret
4 4 4
sharing scheme,” IEICE transactions on fundamentals of electronics,
(9,50); (10,p (10)) = (10,37) and (11,p (11)) =
4 4 communicationsandcomputersciences,vol.83,no.12,pp.2762–2765,
(11,55). 2000.
Any five out of the seven shares can be interpolated to [7] L.-J. Pang and Y.-M. Wang, “A new (t,n) multi-secret sharing scheme
basedonshamir’s secret sharing,” AppliedMathematics andComputa-
regenerate the polynomial p4(x). This polynomial can then tion,vol.167,no.2,pp.840–848,2005.
be sampled to obtain S = p (0). The y-coordinates of the [8] C.-W. Chan and C.-C. Chang, “A scheme for threshold multi-secret
4
samples of p (x) at points x = 1,2,3,4 can the be mapped sharing,” Applied Mathematics and Computation, vol. 166, no. 1, pp.
4 1–14,2005.
as points at x=4,5,6,7 and then interpolated to reconstruct [9] M. Liu, L. Xiao, and Z. Zhang, “Linear multi-secret sharing schemes
p (x), which can be sampled at x = 0 to obtain s = p (0). basedonmulti-partycomputation,”FiniteFieldsandTheirApplications,
3 3 3
Polynomial p (x) can be sampled at x = 1,2,3 to obtain y- vol.12,no.4,pp.704–713,2006.
3 [10] M.H.DehkordiandS.Mashhadi,“Newefficientandpracticalverifiable
coordinates and map them at x = 3,4,5. Interpolating these multi-secretsharingschemes,”InformationSciences,vol.178,no.9,pp.
new points we obtain p (x) and so on. The pieces of the 2262–2274,2008.
2
hidden secrets are retrieved in the reverse order. [11] M.Gnanaguruparan andS.Kak,“Recursive hiding ofsecrets invisual
cryptography,” Cryptologia, vol.26,pp.68–76,2002.
III. CONCLUSIONS [12] A. Parakh and S. Kak, “A recursive threshold visual cryptography
scheme,”Cryptology ePrintArchive,Report535,2008.
We have proposeda recursivetechniquesto hide additional [13] A.Shamir,“Howtoshareasecret,”Communications ofACM,vol.22,
information within the shares of Shamir’s secret sharing no.11,pp.612–613,1979.
[14] A. Parakh and S. Kak, “Online data storage using implicit security,”
schemes. This hidden information may be used for validation
Information Sciences, vol.179,no.19,pp.3323–3331,2009.
of shares at the time of secret reconstruction. Further it may