Assume that there are players and an eavesdropper Eve of unlimited computational power and that several pairs of players have shared secret keys beforehand. In a key sharing graph, each vertex corresponds to a player, and each edge corresponds to a secret key shared by the two players corresponding to the ends of the edge. Given a key sharing graph, a player wishes to send a message to another player so that the eavesdropper Eve and any other player can get no information on the message. In this paper, we first give a necessary and sufficient condition on a key sharing graph for the existence of such a unicast protocol. We then extend the condition to the case where a multiple number of players other than the sender and receiver passively collude. We finally give a sufficient condition for the existence of a secure multicast protocol.
Assume that there are players and an eavesdropper Eve of unlimited computational power and that several pairs of players have shared secret keys beforehand. In a key sharing graph, each vertex corresponds to a player, and each edge corresponds to a secret key shared by the two players corresponding to the ends of the edge. Given a key sharing graph, a player wishes to send a message to another player so that the eavesdropper Eve and any other player can get no information on the message. In this paper, we first give a necessary and sufficient condition on a key sharing graph for the existence of such a unicast protocol. We then extend the condition to the case where a multiple number of players other than the sender and receiver passively collude. We finally give a sufficient condition for the existence of a secure multicast protocol.
Several protocols are presented that allow two parties Alice and Bob not sharing any secret information initially (except possibly a short key to be used for authentication) to generate a long shared secret key such that even an enemy Eve with unlimited computing power is unable to obtain a non-negligible amount of information (in Shannon's sense) about this key. Two different models are considered. In a first model we assume that Alice can send information to Bob over a noisy main channel but that Eve is able to receive the same information over a parallel independent noisy channel from Alice to Eve. In a second, more general model we assume that Alice, Bob and Eve receive the output of a random source (e.g., a satellite broadcasting random bits) over three independent individual channels. The condition that the channels be independent can be replaced by the condition that they be independent only to a known, arbitrarily small degree. We demonstrate that even when Eve's channel is sup...
Assume that there are players and an eavesdropper Eve, where several pairs of players have shared secret keys beforehand. We regard each player as a vertex of a graph and regard each pair of players sharing a key as an edge. Consider the case where Eve knows some of the keys according to a certain probability distribution. In this paper, applying the technique of st-numbering, we propose a protocol which allows any two designated players to agree on a secret key through such a "partially leaked key exchange graph." Our protocol is optimal in the sense that Eve's knowledge about the secret key agreed on by the two players is as small as possible.
The multiparty secret key exchange problem is to find a k-player protocol for generating an n-bit random key. At the end of the protocol, the key should be known to each player but remain completely secret from a computationally unlimited eavesdropper, Eve, who overhears all communication among the players. The players are initially dealt hands of cards of prespecified sizes from a deck of distinct cards; any remaining cards are given to Eve. Considered here is the case in which each player receives the same fraction fi of the cards in the deck, for fi in the interval (0; 1=k]. The efficiency of a secret key exchange protocol is measured by the smallest deck size d 0 for which the protocol is guaranteed of success. A secret key exchange protocol is presented with d 0 = O(n(1=fi) 2:71 ). The best previous bound, by Fischer, Paterson, and Rackoff (1991), was super-polynomial in 1=fi and only handled the special case of k = 2 and n = 1. 1 Introduction The problem of multiparty secret ...
The problem of secure message transmission (SMT), due to its importance in both \npractice and theory, has been studied extensively. Given a communication network in \nwhich a sender S and a receiver R are indirectly connected by unreliable and distrusted \nchannels, the aim of SMT is to enable messages to be transmitted from S to R with a \nreasonably high level of privacy and reliability. SMT must be achieved in the presence \nof a Byzantine adversary who has unlimited computational power and can corrupt the \ntransmission. In the general adversary model, the adversary is characterized by an \nadversary structure. We study two diff�erent measures of security: perfect (PSMT) and \nalmost perfect (APSMT). Moreover, reliable (but not private) message transmission (RMT) are considered as a specifi�c part of SMT. In this thesis, we study RMT, APSMT \nand PSMT in two di�fferent network settings: point-to-point and multicast. \nTo prepare the study of SMT in these two network settings, we present some ideas \nand observations on secret sharing schemes (SSSs), generalized linear codes and critical \npaths. First, we prove that the error-correcting capability of an almost perfect SSS is \nthe same as a perfect SSS. Next, we regard general access structures as linear codes, \nand introduce some new properties that allow us to construct pseudo-basis for efficient \nPSMT protocol design. In addition, we de�fine adversary structures over "critical paths", \nand observe their properties. Having these new developments, the contributions on SMT \nin the aforementioned two network settings can be presented as follows. \nThe results on SMT in point-to-point networks are obtained in three aspects. First, \nwe show a Guessing Attack on some existing PSMT protocols. This attack is critically \nimportant to the design of PSMT protocols in asymmetric networks. Second, we determine necessary and sufficient conditions for di�fferent levels of RMT and APSMT. \nIn particular, by applying the result on almost perfect SSS, we show that relaxing the \nrequirement of privacy does not weaken the minimal network connectivity. Our �final \ncontribution in the point-to-point model is to give the �first ever efficient, constant round \nPSMT protocols in the general adversary model. These protocols are designed using \nlinear codes and critical paths, and they signifi�cantly improve some previous results in \nterms of communication complexity and round complexity. \nRegarding SMT in multicast networks, we solve a problem that has been open for \nover a decade. That is, we show the necessary and sufficient conditions for all levels of \nSMT in di�fferent adversary models. First, we give an Extended Characterization of the \nnetwork graphs based on our observation on the eavesdropping and separating activities \nof the adversary. Next, we determine the necessary and sufficient conditions for SMT \nin the general adversary model with the new Extended Characterization. Finally, we \napply the results to the threshold adversary model to completely solve the problem of \nSMT in general multicast network graphs.
Introduction In Chapter 1 we gave an introduction to the multiparty computation problem and explained what it intuitively means for a protocol to compute a given function securely, namely, we want a protocol that is correct and private. However, we only considered three players, we only argued that a single player does not learn more than he or she is supposed to, and finally, we assumed that all players would follow the protocol. In this chapter we will consider a more general solution to multiparty computation, where we remove the first two restrictions: we will consider any number n ≥ 3 of players, and we will be able to show that as long as at most t < n /2 of the players go together after the protocol is executed and pool all their information, they will learn nothing more than their own inputs and the outputs they were supposed to receive, even if their computing power is unbounded. We will still assume, however, that all players follow the protocol. This is known as semihonest or passive security . To argue security in this chapter, we will use a somewhat weak but very simple definition that only makes sense for semihonest security. We then extend this in Chapter 4 to a fully general model of what protocols are and what security means. Throughout this chapter we will assume that each pair of players can communicate using a perfectly secure channel, so if two players exchange data, a third player has no information at all about what is sent. Such channels might be available because of physical circumstances, or we can implement them relative to a computational assumption using cryptography. For more details on this, see Chapter 7. We end the chapter by showing that the bound t < n /2 is optimal: if t ≥ n /2, then some functions cannot be computed securely in the model mentioned, that is, obtaining perfect security by using only secure point-to-point communication as the communication resource. Secret Sharing Our main tool to build the protocol will be secret-sharing schemes. The theory of secret-sharing schemes is a large and interesting field in its own right with many applications to multiparty computation (MPC), and we look at this in more detail in Chapter 11, where a formal definition of the notion as well as a general treatment of the theory of secret sharing can be found.