2

Shamir's secret sharing can be considered multiplicatively homomorphic, if one is aware of the fact that multiplying two shares of a (n,t)-threshold shared secret yields a share of the same secret, but over a (n, 2t)-threshold sharing.

To overcome this, there is a secure degree reduction protocol, which is already explained in this question. My follow-up question tackles an unexplained point in that question's accepted answer:

The subsharings ($\sigma_3(x)$ to $\sigma_5(x)$ in the referenced answer) are polynomials of degree 1, i.e. 2 shares are needed for proper recombination.

However, trying this using two arbitrary shares for interpolation fails. At the end of this question I paste a short Python script using VIFF that shows the misbehavior. When using a threshold of 2 (needing 3 shares) for recombining the subshares, then the final shares can be arbitrarily recombined using only two shares, as expected from the secure degree reduction protocol.

How comes that you need a larger number of subshares than the degree of the corresponding polynomials for proper recombination?

In the following the Python snippet (note that there is a 1/11 chance that the lower threshold accidentially works):

from viff import shamir
from viff.field import GF

# Zp(x) gives an object that corresponds to x mod 11 and allows for multiplication
# I.e., Zp(3) * Zp(5) == Zp(15) == Zp(4)
Zp = GF(11)

# Share 5 and 2 among 3 players with threshold 1 (>= 2 shares needed)
t = 1
sh1 = (shamir.share(Zp(5), t, 3))
sh2 = (shamir.share(Zp(2), t, 3))

# Multiply shares, implies shares for 5*2 = 10, but threshold is 2
multiplied_shares = [ (Zp(i+1), sh1[i][1] * sh2[i][1]) for i in xrange(0, 3) ]
print('Recombination ' + ('works' if shamir.recombine(multiplied_shares[0:2*t+1]) == Zp(10) else 'does not work'))

# Create subshares of the multiplied shares, using threshold 1 (*)
sh3 = shamir.share(multiplied_shares[0][1], t, 3)
sh4 = shamir.share(multiplied_shares[1][1], t, 3)
sh5 = shamir.share(multiplied_shares[2][1], t, 3)

# Distribute the subshares
p1_shares = [ (Zp(1), sh3[0][1]), (Zp(2), sh4[0][1]), (Zp(3), sh5[0][1]) ]
p2_shares = [ (Zp(1), sh3[1][1]), (Zp(2), sh4[1][1]), (Zp(3), sh5[1][1]) ]
p3_shares = [ (Zp(1), sh3[2][1]), (Zp(2), sh4[2][1]), (Zp(3), sh5[2][1]) ]

# Try to recombine subshares using threshold 1 fails despite sharing (*) above
p1_final1 = shamir.recombine(p1_shares[0:t+1])
p2_final1 = shamir.recombine(p2_shares[0:t+1])
p3_final1 = shamir.recombine(p3_shares[0:t+1])
final_shares1 = [ (Zp(1), p1_final1), (Zp(2), p2_final1), (Zp(3), p3_final1) ]
final1 = shamir.recombine(final_shares1[0:t+1])
print(str(final1) + ' is ' + ('' if final1 == Zp(10) else 'NOT ') + 'correct')

# However, recombining subshares using threshold 2 works
p1_final2 = shamir.recombine(p1_shares[0:2*t+1])
p2_final2 = shamir.recombine(p2_shares[0:2*t+1])
p3_final2 = shamir.recombine(p3_shares[0:2*t+1])
final_shares2 = [ (Zp(1), p1_final2), (Zp(2), p2_final2), (Zp(3), p3_final2) ]
final2 = shamir.recombine(final_shares2[0:t+1])
print(str(final2) + ' is ' + ('' if final2 == Zp(10) else 'NOT ') + 'correct')
Rmn
  • 123
  • 3

1 Answers1

1

This is the correct behavior. Since the degree of the multiplication sharing is $2t$, it will take $2t+1$ shares of either it directly or the subshares. If done on the subshares, the resulting sharing is of degree $t$.

Shamir secret sharing is commutative with respect to polynomial evaluation.

Let $\sigma_1^t$ be the polynomial for sharing $s$ with degree $t$. So, multiplying shares generated by $\sigma_1^t$ and $\sigma_2^t$ (which shares some $s'$), we get a share of $\sigma_3^{2t}$, which shares $ss'$. To reconstruct $ss'$ it would take $2t+1$ shares.

In the degree reduction step, we create subshares with a threshold of $t$, or $\sigma_4^{t}\circ\sigma_3^{2t}$, in other words, we have a degree $t$ sharing of a degree $2t$ share. Due to commutativity, we can rearrange things to get $\sigma_3^{2t}\circ\sigma_4^{t}$, then apply the inverse operation $(\sigma_3^{2t})^{-1}$, to get $(\sigma_3^{2t})^{-1}\circ\sigma_3^{2t}\circ\sigma_4^{t}$, which gives you $\sigma_4^{t}$.

So I have probably thoroughly abused notation, but hopefully that makes sense. You are doing the inverse operation on a $2t$ degree sharing in order to get back to the degree $t$ sharing.

Some consequences of this are 1) in MPC we assume that everyone will participate in the protocol. If one party refuses to participate, the degree reduction won't work. 2) This is used to establish the theoretic upper bound on information theoretic honest-but-curious MPC protocols.

mikeazo
  • 38,563
  • 8
  • 112
  • 180
  • Thank you for this answer. While I can follow the reasoning for needing $2t+1$ shares (and it is somehow intuitive), I am still curious, why we interpolate a polynomial of degree 1 via 3 shares. For me this must mean that the three shares correspond to inconsistent points of the polynomial. But I guess that this is exactly the point since we want to transform shares and not end up with the exactly same shares as before... – Rmn Mar 03 '15 at 07:23
  • You are actually interpolating a degree $2t$ polynomial. In this case $\sigma_3^{2t}$ in the example. The commutative nature of SSS allows you to do this. – mikeazo Mar 03 '15 at 12:20
  • @mikeazo I was about to ask a question of my own like you suggested when I came across this other related answer you wrote. You say that "Due to commutativity, we can rearrange the composition of the two polynomials," and, if you would, could you please elaborate on this? Polynomials do no commute over composition as a rule, therefore for this statement to be true, and I have good reason to believe that it is, there need to be some special properties that sigma 3's and sigma 4's coefficients need to satisfy. Could you specify what these would need to be please? – z.karl May 03 '20 at 22:39
  • Does this answer your question? – mikeazo May 04 '20 at 16:21
  • @mikeazo Unfortunately, this doesn't answer my question because the operation you mention being performed upon the two polynomials is not a multiplication but a composition. That is unless you meant the "circle" between the sigma functions to represent multiplication, in which case I would very much suggest that you edit your answer to reflect that multiplication is being performed, however, I cannot see, at the moment, how multiplication would even make sense in the context with which it is used in your answer, because you refer to the sigmas as functions of which shares of can be created. :/ – z.karl May 04 '20 at 23:24
  • @mikeazo I am very much open to the possibility though that you meant the "circle" to be a multiplication and will explore that! Though, from what I understand of Shamir Secret Sharing and the multiplying of those shares, nowhere should a share of threshold 2t be MULTIPLIED by a share of threshold t, but COMPOSED with it. – z.karl May 04 '20 at 23:29