Timed-Release Secret Sharing Schemes with Information Theoretic Security

Abstract

In modern cryptography, the secret sharing scheme is an important cryptographic primitive and it is used in various situations. In this paper, timed-release secret sharing (TR-SS) schemes with information-theoretic security is first studied. TR-SS is a secret sharing scheme with the property that participants more than a threshold number can reconstruct a secret by using their shares only when the time specified by a dealer has come. Specifically, in this paper we first introduce models and formalization of security for two kinds of TR-SS based on the traditional secret sharing scheme and information-theoretic timed-release security. We also derive tight lower bounds on the sizes of shares, time-signals, and entities’ secret-keys required for each TR-SS scheme. In addition, we propose direct constructions for the TR-SS schemes. Each direct construction is optimal in the sense that the construction meets equality in each of our bounds, respectively. As a result, it is shown that the timed-release security can be realized without any additional redundancy on the share size.

Appendices

A    Proof of Theorem 1

The proof of Theorem 1 follows from the following lemmas.

Lemma 1

$H(U_i^{(t)}) \ge H(S)$ for any $i \in \{1,2,\dots , n\}$ and any $t \in \mathcal {T}$.

Proof

The proof of this lemma can be proved in a way similar to the proof of Lemma 4. For arbitrary $i\in \{1,2,\dots ,n\}$, we take a subset $\mathcal {B}_i \in \mathcal {PS}(\mathcal {P}\setminus \{P_i\},k-1,k-1)$ of participants. Then, for any $t \in \mathcal {T}$, we have

$$\begin{aligned} H(U_i^{(t)})&\ge H(U_i^{(t)} \mid U_{\mathcal {B}_i}^{(t)}, TI^{(t)}) \nonumber \\&\ge I(S;U_i^{(t)} \mid U_{\mathcal {B}_i}^{(t)}, TI^{(t)}) \nonumber \\&= H(S \mid U_{\mathcal {B}_i}^{(t)}, TI^{(t)}) \end{aligned}$$

(3)

$$\begin{aligned}&= H(S), \end{aligned}$$

(4)

where (3) follows from the correctness of (k, n)-TR-SS and (4) follows from the condition (i) in Definition 2.    $\square$

Lemma 2

$H(TI^{(t)} \mid TI^{(1)}, \dots , TI^{(t-1)}) \ge H(S)$ for any $t \in \mathcal {T}$. In particular, $H(TI^{(t)}) \ge H(S)$ for any $t \in \mathcal {T}$.

Proof

For any $\mathcal {A} \in \mathcal {PS}(\mathcal {P},k,n)$ and any $t \in \mathcal {T}$, we have

$$\begin{aligned} H(TI^{(t)}) \ge&H(TI^{(t)} \mid TI^{(1)}, \dots , TI^{(t-1)}) \nonumber \\ \ge&H(TI^{(t)} \mid U_{\mathcal {A}}^{(t)}, TI^{(1)}, \dots , TI^{(t-1)}) \nonumber \\ \ge&I(S;TI^{(t)} \mid U_{\mathcal {A}}^{(t)}, TI^{(1)}, \dots , TI^{(t-1)}) \nonumber \\ =&H(S \mid U_{\mathcal {A}}^{(t)}, TI^{(1)}, \dots , TI^{(t-1)}) \end{aligned}$$

(5)

$$\begin{aligned} =&H(S), \end{aligned}$$

(6)

where (5) follows from the correctness of (k, n)-TR-SS and (6) follows from the condition (ii) in Definition 2.    $\square$

Lemma 3

$H(SK) \ge \tau H(S)$.

Proof

We can prove in a similar way to the proof of Lemma 6. We have

$$\begin{aligned} H(SK)&\ge I(TI^{(1)}, \dots , TI^{(\tau )};SK) \nonumber \\&= H(TI^{(1)}, \dots , TI^{(\tau )}) - H(TI^{(1)}, \dots , TI^{(\tau )} \mid SK) \nonumber \\&= H(TI^{(1)}, \dots , TI^{(\tau )}) \nonumber \\&=\sum _{t=1}^{\tau }H(TI^{(t)} \mid TI^{(1)}, \dots , TI^{(t-1)}) \\&\ge \tau H(S), \end{aligned}$$

where the last inequality follows from Lemma 2.    $\square$

Proof of Theorem 1: From Lemmas 1–3, the proof of Theorem 1 is completed.    $\square$

B    Proof of Theorem 3

The proof of Theorem 3 follows from the following lemmas.

Lemma 4

$H(U_i^{(t)}) \ge H(S)$ for any $i \in \{1,2,\dots , n\}$ and any $t \in \mathcal {T}$.

Proof

The proof can be proved in a way similar to the proof in [10, Theorem 1]. For arbitrary $i\in \{1,2,\dots ,n\}$, we take a subset $\mathcal {B}_i \in \mathcal {PS}(\mathcal {P}\setminus \{P_i\},k_2-1,k_2-1)$ of participants. Then, for any $t \in \mathcal {T}$, we have

$$\begin{aligned} H(U_i^{(t)})&\ge H(U_i^{(t)} \mid U_{\mathcal {B}_i}^{(t)}, TI^{(1)},\ldots ,TI^{(t-1)}) \end{aligned}$$

(7)

$$\begin{aligned}&\ge I(S;U_i^{(t)} \mid U_{\mathcal {B}_i}^{(t)}, TI^{(1)},\ldots ,TI^{(t-1)}) \nonumber \\&= H(S \mid U_{\mathcal {B}_i}^{(t)}, TI^{(1)},\ldots ,TI^{(t-1)}) \end{aligned}$$

(8)

$$\begin{aligned}&= H(S), \end{aligned}$$

(9)

where (8) follows from the correctness of $(k_1,k_2,n)$-TR-SS and (9) follows from the condition (ii) in Definition 5.    $\square$

Lemma 5

If $H(U_i^{(t)})=H(S)$ for any $i\in \{1,2,\ldots ,n\}$ and $t\in \mathcal {T}$, $H(TI^{(t)}) \ge H(TI^{(t)} \mid TI^{(1)}, \dots ,$ $TI^{(t-1)}) \ge (k_2-k_1)H(S)$ for any $t \in \mathcal {T}$.

Proof

The statement is true in the case that $k_1=k_2$, since Shannon entropy is non-negative. Therefore, in the following, we assume $k_1<k_2$. For arbitrary $i\in \{1,2,\dots ,n\}$, we take a subset $\mathcal {B}_i \in \mathcal {PS}(\mathcal {P}\setminus \{P_i\},k_2-1,k_2-1)$ of participants. For any $t \in \mathcal {T}$, we have

$$\begin{aligned} H(TI^{(t)}) \ge&H(TI^{(t)} \mid TI^{(1)}, \dots , TI^{(t-1)}) \nonumber \\ \ge&I(TI^{(t)};U_1^{(t)},U_2^{(t)},\ldots ,U_n^{(t)}\mid TI^{(1)},\ldots ,TI^{(t-1)}) \nonumber \\ =&H(U_1^{(t)},U_2^{(t)},\ldots ,U_n^{(t)}\mid TI^{(1)},\ldots ,TI^{(t-1)}) \nonumber \\&\qquad -H(U_1^{(t)},U_2^{(t)},\ldots ,U_n^{(t)}\mid TI^{(1)},\ldots ,TI^{(t)}) \nonumber \\ =&H(U_1^{(t)},\ldots ,U_{k_1}^{(t)}\mid TI^{(1)},\ldots ,TI^{(t-1)})\nonumber \\&\qquad +H(U_{k_1+1}^{(t)},\ldots ,U_{k_2}^{(t)}\mid TI^{(1)},\ldots ,TI^{(t-1)},U_1^{(t)},\ldots ,U_{k_1}^{(t)}) \nonumber \\&\qquad \qquad +H(U_{k_2+1}^{(t)},\ldots ,U_n^{(t)}\mid TI^{(1)},\ldots ,TI^{(t-1)},U_1^{(t)},\ldots ,U_{k_2}^{(t)}) \nonumber \\&-H(U_1^{(t)},\ldots ,U_{k_1}^{(t)}\mid TI^{(1)},\ldots ,TI^{(t)}) \nonumber \\&\qquad -H(U_{k_1+1}^{(t)},\ldots ,U_{k_2}^{(t)}\mid TI^{(1)},\ldots ,TI^{(t)},U_1^{(t)},\ldots ,U_{k_1}^{(t)}) \nonumber \\&\qquad \qquad -H(U_{k_2+1}^{(t)},\ldots ,U_n^{(t)}\mid TI^{(1)},\ldots ,TI^{(t)},U_1^{(t)},\ldots ,U_{k_2}^{(t)}) \nonumber \\ \ge&H(U_1^{(t)},\ldots ,U_{k_1}^{(t)}\mid TI^{(1)},\ldots ,TI^{(t)}) \nonumber \\&\qquad +H(U_{k_1+1}^{(t)},\ldots ,U_{k_2}^{(t)}\mid TI^{(1)},\ldots ,TI^{(t-1)},U_1^{(t)},\ldots ,U_{k_1}^{(t)}) \nonumber \\&\qquad \qquad +H(U_{k_2+1}^{(t)},\ldots ,U_n^{(t)}\mid TI^{(1)},\ldots ,TI^{(t)},U_1^{(t)},\ldots ,U_{k_2}^{(t)}) \nonumber \\&-H(U_1^{(t)},\ldots ,U_{k_1}^{(t)}\mid TI^{(1)},\ldots ,TI^{(t)}) \nonumber \\&\qquad -H(U_{k_1+1}^{(t)},\ldots ,U_{k_2}^{(t)}\mid TI^{(1)},\ldots ,TI^{(t)},U_1^{(t)},\ldots ,U_{k_1}^{(t)}) \nonumber \\&\qquad \qquad -H(U_{k_2+1}^{(t)},\ldots ,U_n^{(t)}\mid TI^{(1)},\ldots ,TI^{(t)},U_1^{(t)},\ldots ,U_{k_2}^{(t)}) \nonumber \\ =&H(U_{k_1+1}^{(t)},\ldots ,U_{k_2}^{(t)}\mid TI^{(1)},\ldots ,TI^{(t-1)},U_1^{(t)},\ldots ,U_{k_1}^{(t)}) \nonumber \\&\qquad -H(U_{k_1+1}^{(t)},\ldots ,U_{k_2}^{(t)}\mid TI^{(1)},\ldots ,TI^{(t)},U_1^{(t)},\ldots ,U_{k_1}^{(t)}) \nonumber \\ \ge&\sum _{i=k_1+1}^{k_2}H(U_{i}^{(t)}\mid TI^{(1)},\ldots ,TI^{(t-1)},U_{\mathcal {B}_i}^{(t)}) \nonumber \\&\qquad -\sum _{i=k_1+1}^{k_2}H(U_{i}^{(t)}\mid TI^{(1)},\ldots ,TI^{(t)},U_1^{(t)},\ldots ,U_{i-1}^{(t)}) \nonumber \\ =&(k_2-k_1)H(S), \end{aligned}$$

(10)

where (10) follows from (7) in the proof of Lemma 4, the assumption of $H(U_i^{(t)})=H(S)$, and the following claim.

Claim

If $k_1<k_2$ and $H(U_i^{(t)})=H(S)$ for any $i\in \{1,2,\ldots ,n\}$ and $t\in \mathcal {T}$, $H(U_i^{(t)}\mid U_{\mathcal {A}_i},TI^{(t)})=0$ for any $i\in \{1,2,\ldots ,n\}$, any $\mathcal {A}_i\in \mathcal {PS}(\mathcal {P}\setminus \{P_i\},k_1,k_2-1)$, and any $t\in \mathcal {T}$.

Proof

First, for arbitrary $i\in \{1,2,\ldots ,n\}$, we take subsets $\mathcal {B}_i:=\mathcal {PS}(\mathcal {P}\setminus \{P_i\},k_1-1,k_1-1)$ and $\mathcal {A}_i:=\mathcal {PS}(\mathcal {P}\setminus \{P_i\},k_1,k_2-1)$ of participants such that $\mathcal {B}_i \subset \mathcal {A}_i$. Then, for any $t\in \mathcal {T}$, we have

$$\begin{aligned} H(U_i^{(t)}) \ge&H(U_i^{(t)}\mid U_{\mathcal {B}_i}^{(t)},TI^{(t)}) \nonumber \\ \ge&H(U_i^{(t)}\mid U_{\mathcal {B}_i}^{(t)},TI^{(t)})-H(U_i^{(t)}\mid U_{\mathcal {B}_i}^{(t)},TI^{(t)},S) \end{aligned}$$

(11)

$$\begin{aligned} =&I(U_i^{(t)};S\mid U_{\mathcal {B}_i}^{(t)},TI^{(t)}) \nonumber \\ =&H(S\mid U_{\mathcal {B}_i}^{(t)},TI^{(t)}) -H(S\mid U_{\mathcal {B}_i}^{(t)},U_i^{(t)},TI^{(t)}) \nonumber \\ =&H(S\mid U_{\mathcal {B}_i}^{(t)},TI^{(t)}) \end{aligned}$$

(12)

$$\begin{aligned} =&H(S), \end{aligned}$$

(13)

where (12) follows form the correctness of $(k_1,k_2,n)$-TR-SS and (13) follows from the condition (i) in Definition 5.

From (11) and the assumption of $H(U_i^{(t)})=H(S)$, we have

$$\begin{aligned} H(U_i^{(t)}\mid U_{\mathcal {B}_i}^{(t)},TI^{(t)}) = H(U_i^{(t)}\mid U_{\mathcal {B}_i}^{(t)},TI^{(t)})-H(U_i^{(t)}\mid U_{\mathcal {B}_i}^{(t)},TI^{(t)},S). \end{aligned}$$

Therefore, we have

$$\begin{aligned} H(U_i^{(t)}\mid U_{\mathcal {B}_i}^{(t)},TI^{(t)},S)=0. \end{aligned}$$

Hence, we have

$$\begin{aligned} H(U_i^{(t)}\mid U_{\mathcal {A}_i}^{(t)},TI^{(t)}) =H(U_i^{(t)}\mid U_{\mathcal {A}_i}^{(t)},TI^{(t)},S) \le H(U_i^{(t)}\mid U_{\mathcal {B}_i}^{(t)},TI^{(t)},S) =0. \end{aligned}$$

Since $H(U_i^{(t)}\mid U_{\mathcal {A}_i}^{(t)},TI^{(t)})\ge 0$, we have $H(U_i^{(t)}\mid U_{\mathcal {A}_i}^{(t)},TI^{(t)})=0$.    $\square$

Proof of Lemma 5: From the above claim, the proof of Lemma 5 is completed.    $\square$

Lemma 6

If $H(U_i^{(t)})=H(S)$ for any $i\in \{1,2,\ldots ,n\}$ and $t\in \mathcal {T}$, $H(SK) \ge \tau (k_2-k_1)H(S)$.

Proof

We have

$$\begin{aligned} H(SK)&\ge I(TI^{(1)}, \dots , TI^{(\tau )};SK) \\&= H(TI^{(1)}, \dots , TI^{(\tau )}) - H(TI^{(1)}, \dots , TI^{(\tau )} \mid SK) \\&= H(TI^{(1)}, \dots , TI^{(\tau )}) \\&=\sum _{t=1}^{\tau }H(TI^{(t)} \mid TI^{(1)}, \dots , TI^{(t-1)}) \\&\ge \tau (k_2-k_1)H(S), \end{aligned}$$

where the last inequality follows from Lemma 5.    $\square$

Proof of Theorem 3: From Lemmas 4–6, the proof of Theorem 3 is completed.    $\square$

C    Naive Construction of $(k_1,k_2,n)$-TR-SS

Our idea of a naive construction is a combination of $(k_1,n)$-TR-SS (Sect. 2.3) and Shamir’s $(k_2,n)$-SS [14].

• (a) Initialize. Let q be a prime power, where $q > \max (n, \tau )$, and $\mathbb {F}_q$ be the finite field with q elements. We assume that the identity of each participant $P_i$ is encoded as $P_i \in \mathbb {F}_q \backslash \{0\}$. Also, we assume $\mathcal {T} = \{1, 2, \dots , \tau \} \subset \mathbb {F}_q \backslash \{ 0 \}$ by using appropriate encoding. First, TA chooses uniformly at random $\tau$ numbers $r^{(j)} (1 \le j \le \tau )$ from $\mathbb {F}_q$. TA sends a secret key $sk:=(r^{(1)},\ldots ,r^{(\tau )})$ to TS and D via secure channels, respectively.

• (b) Share. First, D chooses a secret $s \in \mathbb {F}_q$. Also, D specifies the time t when at least $k_1$ participants can reconstruct the secret and chooses t-th key $r^{(t)}$. Next, D randomly chooses two polynomials $f_1(x) := s + r^{(t)} + \sum ^{{k_1}-1}_{i=1}a_{1i}x^i$ and $f_2(x) := s + \sum ^{{k_2}-1}_{i=1}a_{2i}x^i$ over $\mathbb {F}_q$, where each coefficient is randomly and uniformly chosen from $\mathbb {F}_q$. Then, D computes $u_i^{(t)} := (f_1(P_i),f_2(P_i))$. Finally, D sends $(u_i^{(t)}, t)$ to $P_i (i=1, 2, \ldots , n)$ via a secure channel.

• (c) Extract. For sk and time $t \in \mathcal {T}$, TS broadcasts t-th key $r^{(t)}$ as a time-signal at time t to all participants via a (authenticated) broadcast channel.

• (d) Reconstruct with time-signals. First, $\mathcal {A}=\{P_{i_1},P_{i_2},\ldots ,P_{i_{k_1}}\} \in \mathcal {PS}(\mathcal {P},k_1, k_1)$ computes $s + r^{(t)}$ by Lagrange interpolation:

  $$\begin{aligned} s + r^{(t)}=\sum _{j=1}^{k_1}(\prod _{l\ne j}\frac{P_{i_j}}{P_{i_j}-P_{i_l}})f_1(P_{i_j}), \end{aligned}$$

  from $(f_1(P_{i_1}),\ldots ,f_1(P_{i_{k_1}}))$. After receiving $ts^{(t)}=r^{(t)}$, they can compute and get $s =s+ r^{(t)}- ts^{(t)}$.

• (e) Reconstruct without time-signals. Any $\hat{\mathcal {A}}=\{P_{i_1},P_{i_2},\ldots ,P_{i_{k_2}}\} \in \mathcal {PS}(\mathcal {P},k_2,k_2)$ computes

  $$\begin{aligned} s=\sum _{j=1}^{k_2}(\prod _{l\ne j}\frac{P_{i_j}}{P_{i_j}-P_{i_l}})f_2(P_{i_j}), \end{aligned}$$

  by Lagrange interpolation from $(f_2(P_{i_1}),\ldots ,f_2(P_{i_{k_2}}))$.

It is easy to see that the above construction is secure, since this construction is a simple combination of $(k_1,n)$-TR-SS and Shamir’s $(k_2,n)$-SS. Also, the above construction is simple, however not optimal since the resulting share size is twice as large as that of secrets.