On the Cost of Reconstructing a Secret, or VSS with Optimal Reconstruction Phase

Consider a scenario where an l-bit secret has been distributed among n players by an honest dealer using some secret sharing scheme. Then, if all players behave honestly, the secret can be reconstructed in one round with zero error probability, and by broadcasting nl bits. We ask the following question: how close to this ideal can we get if up to t players (but not the dealer) are corrupted by an adaptive, active adversary with unbounded computing power? - and where in addition we of course require that the adversary does not learn the secret ahead of reconstruction time. It is easy to see that t = (n − 1)/2 is the maximal value of t that can be tolerated, and furthermore, we show that the best we can hope for is a one-round reconstruction protocol where every honest player outputs the correct secret or “failure”. For any such protocol with failure probability at most 2−Ω(k) , we show a lower bound of Ω(nl + kn2 ) bits on the information communicated. We further show that t...

• Type: Conference
• Year: 2001
• Where: CRYPTO
• Authors: Ronald Cramer, Ivan Damgård, Serge Fehr
• Keywords: Constant Factor, CRYPTO 2001, Cryptology, Lower Bound, Secret Sharing Scheme