JP2016173531A - Sharing value conversion system, sharing value conversion device, sharing value conversion method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To convert a sharing value of Shamir secret sharing to a sharing value of a replicated secret sharing.SOLUTION: A conversion unit 12 converts a replicated secret sharing value {r} of a random number r to a Shamir secret sharing value [r]. A concealing unit 13 calculates a Shamir secret sharing value [b] by subtracting a Shamir secret sharing value [a] of information a from the Shamir secret sharing value [r]. A disclosing unit 14 generates a value b by restoring the Shamir secret sharing value [b]. A re-sharing unit 15 generates a replicated secret sharing value {b} of a value b. A restoring unit 16 generates a replicated secret sharing value {a} of the information a by subtracting the replicated secret sharing value {b} from a replicated secret sharing value {r}.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a secret sharing technique, and more particularly to a technique for converting a distributed value of one secret sharing into a distributed value of another secret sharing.

  Secret sharing is a technology that converts data into multiple distributed values and restores the original data if more than a certain number of shares are used, and makes it impossible to restore the original data from less than a certain number of shares. is there. A set of a plurality of secret-distributed values is called a distributed value, and one fragment of the distributed values is called a share.

  Examples of secret sharing include Shamir's Secret Sharing and Replicated Secret Sharing. Non-Patent Document 1 describes a technique for converting a replication secret distribution value into a Shamir secret distribution value.

R. Cramer, I. Damgard, and Y. Ishai, “Share Conversion, Pseudorandom Secret-Sharing and Applications to Secure Computation”, TCC 2005, vol. 3378 of Lecture Notes in Computer Science, pp. 342-362, 2005.

  A method for converting a distributed value of a replica secret sharing into a distributed value of Shamir secret sharing has been known. On the other hand, there is no known method for converting a shared value of Shamir secret sharing into a distributed value of replicating secret sharing.

  An object of the present invention is to provide a technique for converting a distributed value of Shamir secret sharing into a distributed value of replicating secret sharing.

  In order to solve the above problem, a distributed value conversion system of the present invention is a distributed value conversion system including n distributed value conversion devices, wherein n is an integer of 3 or more, and the distributed value conversion device is a random number A conversion unit that converts the replica secret sharing value {r} of r into a Shamir secret sharing value [r], and a Shamir secret sharing value [r] by subtracting the Shamir secret sharing value [a] of information a A concealment unit that calculates the value [b], a public unit that restores the Shamir secret sharing value [b] and generates a value b, and a redistribution unit that generates a duplicate secret sharing value {b} of the value b A restoration unit that subtracts the duplicate secret sharing value {b} from the duplicate secret sharing value {r} to generate the duplicate secret sharing value {a} of the information a.

  According to the distributed value conversion technique of the present invention, the distributed value of Shamir secret sharing can be converted to the distributed value of replicating secret sharing. Further, it is possible to detect tampering during conversion.

FIG. 1 is a diagram illustrating a functional configuration of a distributed value conversion system. FIG. 2 is a diagram illustrating a functional configuration of the distributed value conversion apparatus. FIG. 3 is a diagram illustrating a processing flow of the distributed value conversion method.

Prior to the description of the embodiments, the notation method in this specification and the basic concept of the present invention will be described.
[Notation]
p _i represents a party having the i-th share.
P = (p ₀ ,..., P _n−1 ) represents a set of all n parties possessing a share.
P′⊆P represents a set of n− (k−1) parties selected from the n party set P.
[·] ^X (square brackets) represents a distributed value based on Shamir secret sharing in plain text. x represents the number of elements in the plaintext space. When x = p, x is omitted and expressed as [•]. p is a prime number is the order of the group Z _p.
[·] _I represents the share owned by the party p _i εP among the Shamir secret sharing values [·].
{•} ^x (curly brackets) represents a distributed value by a plaintext / replica secret sharing. x represents the number of elements in the plaintext space. When x = 2, x is abbreviated as {•}.
{·} _I represents a share possessed by the party p _i εP among the duplicate secret sharing values {·}.
[•] ^x (brackets) represents a semi-public value of plaintext. x represents the number of elements in the plaintext space. When x = p, x is omitted and expressed as {•}. p is a prime number is the order of the group Z _p.

[Shamir secret sharing]
Shamir's Secret Sharing is one of (k, n) -secret sharing. (k, n) -secret sharing is a method of restoring the plaintext by dividing the input plaintext into n pieces and keeping them distributed in n computation subjects. , Secret sharing in which no information about plaintext can be obtained from less than k shares. At this time, n and k are integers of 1 or more, and n = 2k-1. See Reference 1 below for details on Shamir secret sharing.
[Reference 1] A. Shamir, “How to share a secret”, Communications of the ACM, vol. 22 (11), pp. 612-613, 1979.

In Shamir secret sharing, coordinates x _i are assigned to the i-th party p _i , and the plaintext a is distributed using the random number r _{i according} to the following equation.

  The advantage of Shamir secret sharing is that the data capacity is small. On the other hand, the disadvantage is that the number of body elements must be n + 1 or more, and mod 2 cannot be used.

[Replicated secret sharing]
Replicated secret sharing is one of (k, n) -secret sharing. Refer to Non-Patent Document 1 for details on the duplicate secret sharing.

For example, in the case of n = 3 and k = 2, the replica secret sharing transforms plaintext a into a: = a ₀ + a ₁ + a ₂ and (a ₀ , a ₁ ), (a ₁ , a ₂ ) , (a ₂ , a ₀ ). Each element a ₀ , a ₁ , a ₂ constituting the share is called a sub-share.

  The advantage of duplicate secret sharing is that the number of body elements is not limited and mod 2 can be used. It can also be used by groups instead of bodies. On the other hand, the disadvantage is that the size of each share is relatively large.

[Public value]
The public value is plaintext that all n parties have the same value. For example, when n = 3 and k = 2, the parties p ₀ , p ₁ and p ₂ have plaintext a.

[Semi-public value]
The quasi-public value is plaintext with the same value for n- (k-1) parties. At this time, the other parties have 0. For example, when n = 3 and k = 2, the parties p ₀ and p ₁ have plaintext a and the party p ₂ has 0. The quasi-public value can be converted to a duplicate secret sharing value without communication and has redundancy. However, it is not secret sharing and there is no secrecy.

  Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the component which has the same function in drawing, and duplication description is abbreviate | omitted.

As illustrated in FIG. 1, the distributed value conversion system includes n (≧ 3) number of distributed value conversion apparatuses 1 ₁ ,..., 1 _n . In this embodiment, distributed value conversion apparatuses 1 ₁ ,..., 1 _n are each connected to communication network 2. The communication network 2 is a circuit-switched or packet-switched communication network configured such that connected devices can communicate with each other. For example, the Internet, a LAN (Local Area Network), or a WAN (Wide Area Network). Etc. can be used. Each device does not necessarily need to be able to communicate online via the communication network 2. For example, the dispersion value conversion device 1 _1, ..., and stores information to be input to 1 _n in a portable recording medium such as a magnetic tape or a USB memory, secure computing apparatus 1 ₁ from the portable recording medium, ..., to 1 _n You may comprise so that it may input offline.

As illustrated in FIG. 2, the distributed value conversion apparatus 1 _i (i = 1,..., N) includes an input unit 10, a random number generation unit 11, a conversion unit 12, a concealment unit 13, a disclosure unit 14, and a redistribution unit. 15, a restoration unit 16, and an output unit 17.

The distributed value conversion apparatus 1 _i is configured, for example, by loading a special program into a known or dedicated computer having a central processing unit (CPU), a main storage (RAM), and the like. Special equipment. The variance value conversion apparatus 1 _i executes each process under the control of the central processing unit, for example. The data input to the distributed value converter 1 _i and the data obtained in each process are stored in, for example, the main storage device, and the data stored in the main storage device is read to the central processing unit as necessary. And used for other processing. Each processing unit of the distributed value conversion apparatus 1 _i may be at least partially configured by hardware such as an integrated circuit.

  With reference to FIG. 3, a processing procedure of the distributed value conversion method of the embodiment will be described.

In the following, it is assumed that p ₀ ,..., P _n−1 are n distributed value conversion apparatuses that distribute and hold n shares. p ₀ ,..., p _n−1 are codes that logically indicate the role of the distributed value converter, and which distributed value converters 1 ₁ ,..., 1 _n are which distributed value converters p _{0 ,.} Whether it corresponds to _-1 is arbitrarily determined at runtime.

In step S10, Shamir secret shared values [a] _i to be converted are respectively input to the input units 10 of the n number of distributed value converters p _i (i = 0,..., N−1). The Shamir secret sharing value [a] _i is sent to the anonymity providing unit 13.

In step S11, the random number generation unit 11 of the n number of distributed value conversion apparatuses p _i generates a duplicate secret sharing value {r} _i of the random number r. The duplicate secret sharing value {r} _i is sent to the conversion unit 12. For example, when n = 3 and k = 2, the duplicate secret sharing value {r} _i is generated as follows. Variance converter p ₀ generates a random number r _0, and transmits the random number r ₀ to variance converter p _1. Thereby, the distributed value conversion devices p ₀ and p ₁ share the random number r ₀ . Similarly, distributed value converters p ₁ and p ₂ share random number r ₁ , and distributed value converters p ₀ and p ₂ share random number r ₂ . The distributed value conversion apparatus p ₀ generates and holds a duplicate secret shared value {r} ₀ = (r ₀ , r ₂ ) in which random numbers r ₀ and r ₂ are paired. Similarly, the distributed value conversion apparatus p ₁ holds the duplicate secret sharing value {r} ₁ = (r ₀ , r ₁ ), and the distributed value conversion apparatus p ₂ uses the duplicate secret sharing value {r} ₂ = (r Hold ₁ , r ₂ ). If the random number generation unit 11 shares the pseudo-random number in advance, the random number generation unit {r} _i can be generated by offline processing.

In step S12, the conversion unit 12 of the n distributed value conversion apparatuses p _i converts the duplicated secret shared value {r} _i into the Shamir secret shared value [r] _i . The Shamir secret sharing value [r] _i is sent to the anonymity providing unit 13. For example, when n = 3 and k = 2, the conversion from the duplicated secret sharing value to the Shamir secret sharing value is performed as follows. The distributed value conversion apparatus p ₀ performs Shamir secret sharing on the sub-shares r ₀ and r ₂ of the replicating secret sharing value {r} ₀ = (r ₀ , r ₂ ), respectively, and Shamir secret sharing values [r ₀ ], [r ₂ ] is generated. Variance value conversion device p ₁ is Sabushea r ₀ of replication secret sharing values _{{r} 1 = (r 0} , r 1), r 1 was respectively Shamir secret sharing, Shamir secret sharing value [r _0], [r ₁ ] is generated. The distributed value converter p ₁ transmits the share [r ₁ ] ₀ of the Shamir secret shared value [r ₁ ] to the distributed value converter p ₀ . The distributed value conversion apparatus p ₀ adds [r ₀ ] ₀ , [r ₁ ] ₀ , [r ₂ ] ₀ and Shamir secret shared value [r] ₀ = [r ₀ + r ₁ + r ₂ ] for the random number r ] Get ₀ . Similarly, all the distributed value conversion devices p _i obtain the Shamir secret shared value [r] _i . For details of the conversion method, refer to Non-Patent Document 1, for example.

For each sub-share of the replication-type secret sharing value {r}, the conversion unit 12 sums up the values restored by Lagrange interpolation using k-1 0s with the sub-share as plain text, thereby performing Shamir secret sharing by offline processing. The value [r] _i can be obtained. Specifically, for example, when n = 3 and k = 2, the distributed value conversion apparatus p ₀ uses Lagrange from r ₀ and 0 for the duplicate secret shared value {r} ₀ = (r ₀ , r ₁ ). The value obtained by interpolation is [r ₀ ] ₀ , the value obtained by Lagrange interpolation from r ₁ and 0 is [r ₁ ] ₀ , 0 is [r ₂ ] ₀ , [r ₀ ] ₀ , [r ₁ ] ₀ and [r ₂ ] ₀ are summed to obtain [r] ₀ = [r ₀ + r ₁ + r ₂ ] ₀ . Similarly, all of the distributed value conversion devices p ₁ and p ₂ obtain Shamir secret shared values [r] ₁ and [r] ₂ .

In step S13, the concealment unit 13 of the n number of distributed value conversion apparatuses p _i subtracts the Shamir secret shared value [a] _i from the Shamir secret shared value [r] _i to obtain the Shamir secret shared value [b] _i . calculate. The Shamir secret sharing value [b] _i is sent to the public section 14. In Shamir secret sharing, addition / subtraction between shared values is realized by each party individually adding / subtracting shares. Therefore, the Shamir secret sharing value [b] _i can be calculated by [b] _i = [r] _i- [a] _i .

In step S14, the public unit 14 of at least n- (k-1) dispersion value conversion apparatuses p _i (εP ′) receives from the other k−1 dispersion value conversion apparatuses p _j (j ≠ i). k-1 Shamir secret sharing values [b] _j are received, and k Shamir secret sharing values [b] are restored to obtain a value b. The value b is sent to the redistribution unit 15. The disclosure unit 14 may generate a public value or a semi-public value. When n variance value conversion devices p _i obtain the value b, the public value b is obtained. When n- (k−1) variance value conversion devices p _i obtain a value b and the other k−1 variance value conversion devices p _j hold 0, the quasi-public value [b] is obtained. The disclosure unit 14 may use a secret disclosure method capable of detecting falsification at the time of restoration. As a secret disclosure method capable of detecting falsification, for example, there is a method described in Reference Document 2 below.
[Reference 2] I. Damgard, JB Nielsen, “Scalable and Unconditionally Secure Multiparty Computation”, CRYPTO 2007, vol. 4622 of Lecture Notes in Computer Science, pp. 572-590, 2007.

Further, tampering detection is possible even if the value b is restored as follows. k−1 distributed value conversion devices p ₁ ,..., p _k−1 transmit Shamir secret shared values [b] ₁ ,..., [b] _k−1 to the distributed value conversion device p ₀ . The nk distributed value converters p _k , ..., p _n-1 calculate check sums c _k , ..., c _n-1 from Shamir secret shared values [b] _k , ..., [b] _n-1. The checksums c _k ,..., C _n−1 are transmitted to the distributed value conversion apparatus p ₀ . Variance converter p ₀ is, k number of Shamir secret sharing value _{[b] 0, ..., [} b] nk number of Shamir secret sharing value from _{k-1 [b] k,} ..., a [b] _n-1 restored, the secret variance [b] _k, ..., calculates respective checksums _{c 'k, ..., c'} n-1 from [b] _n-1. Variance converter p ₀ is the checksum c _k, ..., c _n-1 and checksum c _'k, ..., c' in the case where the _n-1 match all, k pieces of Shamir secret sharing value [b ] ₀ , ..., [b] Restore the value b from _k-1 .

In step S15, the re-distribution unit 15 of the n number of distributed value conversion apparatuses p _i uses the value b to generate a duplicate secret sharing value {b}. The duplicate secret sharing value {b} is sent to the restoration unit 16. The redistribution unit 15 can generate the duplicate secret sharing value {b} by offline processing as follows. The n- (k−1) number of distributed value conversion devices p _i (∈P ′) generate a duplicate secret shared value {b} _i = (b, 0) using the values b and 0 as sub-shares. The remaining (k−1) units of distributed value conversion devices p _j (∈P ″ ≠ P ′) generate duplicate secret sharing values {b} _i = (0, 0) with 0 as a subshare.

In step S16, the restoration unit 16 of the n number of distributed value conversion apparatuses p _i subtracts the duplicated secret shared value {b} _i from the duplicated secret shared value {r} _i to copy the duplicated secret shared value of the information a. {a} _i is generated. The duplicate secret sharing value {a} _i is sent to the output unit 17. In replicating secret sharing, the addition / subtraction between the shared values is realized by each party individually adding / subtracting the sub-shares. For example, {r} _i = (r _α , r _β ), {b} _i = (b _α , b _β ) _i , {a} _i = {r} _i- {b} _i = (r _α- b _α , r _β -b _β ), the replica secret sharing value {a} _i can be calculated by offline processing.

In step S17, the converted duplicate secret sharing value {a} _i is output from the output unit 17 of the n number of distributed value conversion apparatuses p _i .

  In the distributed value conversion system and method according to the present embodiment, all processing steps can be executed by offline processing with no fear of falsification or a processing procedure capable of falsification detection. Specifically, the random number generation unit 11, the conversion unit 12, the concealment unit 13, the redistribution unit 15, and the restoration unit 16 can be offline processing. Further, the disclosure unit 14 can use a secret disclosure method capable of detecting falsification. For this reason, the distributed value conversion method of this embodiment can be configured so that alteration detection is possible as a whole.

  The present invention is not limited to the above-described embodiment, and it goes without saying that modifications can be made as appropriate without departing from the spirit of the present invention. The various processes described in the above embodiment may be executed not only in time series according to the order of description, but also in parallel or individually as required by the processing capability of the apparatus that executes the processes or as necessary.

[Program, recording medium]
When various processing functions in each device described in the above embodiment are realized by a computer, the processing contents of the functions that each device should have are described by a program. Then, by executing this program on a computer, various processing functions in each of the above devices are realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  This program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. A configuration in which the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes a processing function only by an execution instruction and result acquisition without transferring a program from the server computer to the computer. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

DESCRIPTION OF SYMBOLS 1 Distributed value conversion apparatus 2 Communication network 10 Input part 11 Random number generation part 12 Conversion part 13 Concealment part 14 Public part 15 Re-distribution part 16 Restoration part 17 Output part

Claims (5)

n is an integer greater than or equal to 3, and a distributed value conversion system including n distributed value conversion devices,
The variance value conversion apparatus is
A conversion unit for converting the replicating secret sharing value {r} of the random number r into the Shamir secret sharing value [r];
A concealing unit that calculates the Shamir secret sharing value [b] by subtracting the Shamir secret sharing value [a] of the information a from the Shamir secret sharing value [r].
A public part that restores the Shamir secret sharing value [b] and generates a value b;
A re-distribution unit that generates a duplicate secret sharing value {b} of the value b;
A restoration unit that subtracts the duplicate secret sharing value {b} from the duplicate secret sharing value {r} to generate the duplicate secret sharing value {a} of the information a;
Distributed value conversion system including The distributed value conversion system according to claim 1,
The conversion unit sets n = 2k-1 and sums the values restored by Lagrange interpolation using k-1 0s for each subshare of the duplicate secret sharing value {r} as plaintext. To convert to Shamir secret sharing value [r]
The public part is for generating the value b by restoring the Shamir secret sharing value [b] by a secret disclosure method capable of tampering detection,
The redistribution unit generates the duplicate secret sharing value {b} using the values b and 0 as a subshare. A conversion unit for converting the replicating secret sharing value {r} of the random number r into the Shamir secret sharing value [r];
A concealing unit that calculates the Shamir secret sharing value [b] by subtracting the Shamir secret sharing value [a] of the information a from the Shamir secret sharing value [r].
A public part that restores the Shamir secret sharing value [b] and generates a value b;
A re-distribution unit that generates a duplicate secret sharing value {b} of the value b;
A restoration unit that subtracts the duplicate secret sharing value {b} from the duplicate secret sharing value {r} to generate the duplicate secret sharing value {a} of the information a;
A distributed value conversion apparatus including: Let n be an integer greater than or equal to 3,
a conversion step in which n distributed value conversion devices convert a replicating secret sharing value {r} of a random number r into a Shamir secret sharing value [r];
A concealment step in which the n distributed value conversion devices calculate the Shamir secret sharing value [b] by subtracting the Shamir secret sharing value [a] of the information a from the Shamir secret sharing value [r],
A public step in which at least n- (k-1) distributed value conversion devices restore the Shamir secret shared value [b] to generate a value b;
A re-distribution step in which the n distributed value conversion devices generate a duplicate secret sharing value {b} of the value b;
Restoration step in which the n distributed value conversion devices generate the duplicate secret sharing value {a} of the information a by subtracting the duplicate secret sharing value {b} from the duplicate secret sharing value {r} When,
Variance value conversion method.   A program for causing a computer to function as the distributed value conversion apparatus according to claim 3.

Images