Proactive secret sharing

Proactive secret sharing is a method to update distributed keys (shares) in a secret sharing scheme periodically such that an attacker has less time to compromise shares. This contrasts to a non-proactive scheme where if the threshold number of shares are compromised during the lifetime of the secret, the secret is compromised.

Motivation

If the players (holders of the shared secret) store their shares on insecure computer servers, an attacker could crack in and steal the shares. Since it is not often practical to change the secret, the uncompromised (Shamir-style) shares should be updated in a way that they generate the same secret, yet the old shares are invalidated.

Mathematics

In order to update the shares, the dealer (i.e., the person who gives out the shares) generates a new random polynomial with constant term zero and calculates for each remaining player a new ordered pair, where the x-coordinates of the old and new pairs are the same. Each player then adds the old and new y-coordinates to each other and keeps the result as the new y-coordinate of the secret.

• The dealer constructs a random polynomial over a field of degree $k - 1$ where $k$ is the threshold
• Each player gets the share ${\displaystyle x_{i}^{0}=f^{0}(i)}$ where ${\displaystyle i\in \{1,...,n\}}$, $n$ is the number of players, and ${\displaystyle x_{i}^{0}}$ is the share for player $i$ at time interval ${\displaystyle 0}$
• The secret can be reconstructed via interpolation of $k$ shares
• To update the shares, all parties need to construct a random polynomial of the form ${\displaystyle \delta _{i}(z)=\delta _{i,1}z^{1}+\delta _{i,2}z^{2}+...+\delta _{i,k}z^{k-1}}$
• Each player $i$ sends all other players ${\displaystyle u_{i,j}=\delta _{i}(j)}$
• Each player updates their share by ${\displaystyle x_{i}^{t+1}=x_{i}^{t}+u_{1,i}^{t}+...+u_{n,i}^{t}}$ where $t$ is the time interval in which the shares are valid

All of the non-updated shares the attacker accumulated become useless. An attacker can only recover the secret if he can find enough other non-updated shares to reach the threshold. This situation should not happen because the players deleted their old shares. Additionally, an attacker cannot recover any information about the original secret from the update process because it only contains random information.

The dealer can change the threshold number while distributing updates, but must always remain vigilant of players keeping expired shares.

Example

The following example has 2 shares and a threshold of 2 with 2 players and 1 dealer. Since shares and polynomials are only valid for a certain time period, the time period they are valid is denoted with a superscript.

• All parties agree on a finite field: ${\displaystyle Z_{11}}$
• The dealer establishes a secret: ${\displaystyle x=6\in Z_{11}}$
• The dealer constructs a random polynomial over ${\displaystyle Z_{11}}$ of degree 2 - 1 (threshold of 2)
  • ${\displaystyle f^{0}(x)=6+2\times x}$
  • note ${\displaystyle f^{0}(0)=x=6}$
• Player 1 gets share ${\displaystyle x_{1}^{0}=f^{0}(1)=6+2\times 1=8}$ and player 2 gets share ${\displaystyle x_{2}^{0}=f^{0}(2)=6+2\times 2=10}$
• To reconstruct the secret, use ${\displaystyle x_{1}^{0}}$ and ${\displaystyle x_{2}^{0}}$
  • Since ${\displaystyle f^{0}(x)}$ is a line, we can use point slope form to interpolate
  • ${\displaystyle m=(f^{0}(2)-f^{0}(1))/(2-1)=(x_{2}^{0}-x_{1}^{0})/(2-1)=(10-8)/(2-1)=2/1=2}$
  • ${\displaystyle b=f^{0}(1)-m=x_{1}^{0}-2=8-2=6}$
  • ${\displaystyle f^{0}(x)=b+m\times x=6+2\times x}$
  • ${\displaystyle f^{0}(0)=6+2\times 0=6=x}$
• To update the shares, all parties need to construct random polynomials of degree 1 such that the free coefficient is zero
  • Player 1 constructs ${\displaystyle \delta _{1}^{0}(z)=\delta _{1,1}^{0}\times z^{1}=2\times z^{1}}$
  • Player 2 constructs ${\displaystyle \delta _{2}^{0}(z)=\delta _{2,1}^{0}\times z^{1}=3\times z^{1}}$
• Each player evaluates their polynomial and shares some information with other players
  • Player 1 computes ${\displaystyle u_{1,1}^{0}=\delta _{1}^{0}(1)=2}$ and ${\displaystyle u_{1,2}^{0}=\delta _{1}^{0}(2)=4}$ in ${\displaystyle Z_{11}}$
  • Player 1 sends Player 2 ${\displaystyle u_{1,2}^{0}}$
  • Player 2 computes ${\displaystyle u_{2,1}^{0}=\delta _{2}^{0}(1)=3}$ and ${\displaystyle u_{2,2}^{0}=\delta _{2}^{0}(2)=6}$ in ${\displaystyle Z_{11}}$
  • Player 2 sends Player 1 ${\displaystyle u_{2,1}^{0}}$
• Each player updates their share by ${\displaystyle x_{i}^{1}=x_{i}^{0}+u_{1,i}^{0}+u_{2,i}^{0}}$
  • Player 1 computes ${\displaystyle x_{1}^{1}=x_{1}^{0}+u_{1,1}^{0}+u_{2,1}^{0}=8+2+3=2\in Z_{11}}$
  • Player 2 computes ${\displaystyle x_{2}^{1}=x_{2}^{0}+u_{1,2}^{0}+u_{2,2}^{0}=10+4+6=9\in Z_{11}}$
• Confirm updated shares generate same original secret
  • Use ${\displaystyle x_{1}^{1}}$ and $x_{{2}}^{{1}}$ to reconstruct the polynomial ${\displaystyle f^{1}(x)}$
  • Since ${\displaystyle f^{1}(x)}$ is a line, we can use point slope
  • ${\displaystyle m=(f^{1}(2)-f^{1}(1))/(2-1)=(x_{2}^{1}-x_{1}{1})/(2-1)=(9-2)/(2-1)=7/1=7}$
  • ${\displaystyle b=f^{1}(1)-m=x_{1}^{1}-7=2-7=-5=6}$
  • ${\displaystyle f^{1}(x)=b+m\times x=6+7\times x}$
  • ${\displaystyle f^{1}(0)=6+7\times 0=6=x}$

See also

• Key (cryptography)
• Key generation
• Key distribution
• Key management
• Shamir's Secret Sharing

References

• Herzberg, Amir; Jarecki, Stanislaw; Hugo, Krawczyk; Yung, Moti (1995). "Proactive Secret Sharing Or: How to Cope With Perpetual Leakage". CRYPTO '95: Proceedings of the 15th Annual International Cryptology Conference on Advances in Cryptology. London, UK: Springer-Verlag: 339–352. ISBN 3-540-60221-6. Retrieved June 14, 2010.
• Yevdokimov, Aleksey (2009). "Dynamic system of proactive security". Application of Information and Communication Technologies, 2009. AICT 2009. Baku, Azerbaijan: IEEE: 1–4. ISBN 978-1-4244-4739-8. Retrieved June 14, 2010.