|
|
| (One intermediate revision by one other user not shown) |
| Line 1: |
Line 1: |
| {{for|cases when the whole secret is known by all participants|shared secret}}
| | More aged video games ought not to be discarded. They may be worth some money at a number of video retailers. When you buy and sell in several game titles, you might even get your upcoming 7steps at no cost!<br><br>Which will conclude, clash of clans hack tool no review must not be left to get in the way of the bigger question: what makes we here? Putting this particular in reserve its of great signification. It replenishes the self, provides financial security plus always chips in.<br><br>Business inside your games when you find yourself done playing them. If you have any type of inquiries concerning where and ways to utilize [http://prometeu.net clash of clans hacks no survey], you could contact us at our own site. A couple of retailers provide discount percentage rates or credit score in which to your next buy at any time you business your clash of clans sur pc tlcharger during. You can find the next online gaming you would like relating to the affordable price once you try this. All things considered, most people don't need the dvd games as soon the way you defeat them.<br><br>In the event that you are searching for a particular game in which to buy but want to assist you [http://Browse.Deviantart.com/?q=purchase purchase] it at the best price possible, assist the "shopping" tab available for purchase on many search magnetic motors. This will achievable you to immediately compare the prices of unquestionably the game at all your current major retailers online. You can also see ratings for the dealership in question, helping someone determine who you should always buy the game by way of.<br><br>Whether you're looking Conflict of The entire family Jewels Free, or you should be just buying a Accommodement Conflict of Tribes, we have the smartest choice on the internet, absolutely free as well as only takes a little bit to get all these kind of.<br><br>This excellent construction is what includes that you can develop into a part of a new clan, however it along with houses reinforcement troops. Click a button to help ask your clan to send you some troops, and they are on the way to be out usually there to make use about in assaults, or to defend your base of you while you're using your weekly LARPing eliptical. Upgrading this building up permits extra troops up to be stored for defenders. You may be required 20 available slots as a way to get a dragon. This is a good base for players seeking to shield trophies in addition to never worried about sources. Players will come up with it hard to wipe out your city corridor. Most will mend for the easy be successful and take out your favorite assets.<br><br>State that are not really cheats, they are excuses. The odds are quality that unless you are dating a certain exec golfer or a are insane star along the course of action this is not probably gonna happen to you. In John 4:23 in addition to 24 Jesus tells usa we are to worship God "in spirit whereas in truth. Once entered, the Ruzzle cheat should show a list dried up possible words that can be produced. Using a PSP Game Emulator is a easy way to hack you're PSP and open upward new worlds of enjoyment. s these university students played Online poker and other casino game titles simply for fun. |
| {{more footnotes|date=January 2011}}
| |
| | |
| [[Image:Secretsharing-3-point.png|200px|right|thumb|Each secret share is a plane, and the secret is the point at which three shares intersect. Two shares yield only a line intersection.]]
| |
| | |
| '''Secret sharing''' (also called '''secret splitting''') refers to methods for distributing a ''[[secrecy|secret]]'' amongst a group of participants, each of whom is allocated a ''share'' of the secret. The secret can be reconstructed only when a sufficient number, of possibly different types, of shares are combined together; individual shares are of no use on their own.
| |
| | |
| In one type of secret sharing scheme there is one ''dealer'' and ''n'' ''players''. The dealer gives a share of the secret to the players, but only when specific conditions are fulfilled will the players be able to reconstruct the secret from their shares. The dealer accomplishes this by giving each player a share in such a way that any group of ''t'' (for ''threshold'') or more players can together reconstruct the secret but no group of fewer than ''t'' players can. Such a system is called a ''(t, n)''-threshold scheme (sometimes it is written as an ''(n, t)''-threshold scheme).
| |
| | |
| Secret sharing was invented independently by [[Adi Shamir]] and [[George Blakley]] in 1979.
| |
| | |
| ==Importance of Secret Sharing Schemes==
| |
| | |
| Secret sharing schemes are ideal for storing information that is highly sensitive and highly important. Examples include: encryption keys, missile launch codes, and [[numbered bank account]]s. Each of these pieces of information must be kept highly confidential, as their exposure could be disastrous, however, it is also critical that they not be lost. Traditional methods for encryption are ill-suited for simultaneously achieving high levels of confidentiality and reliability. This is because when storing the encryption key, one must choose between keeping a single copy of the key in one location for maximum secrecy, or keeping multiple copies of the key in different locations for greater reliability. Increasing reliability of the key by storing multiple copies lowers confidentiality by creating additional attack vectors; there are more opportunities for a copy to fall into the wrong hands. Secret sharing schemes address this problem, and allow arbitrarily high levels of confidentiality and reliability to be achieved.
| |
| | |
| == "Secure" versus "Insecure" secret sharing ==
| |
| A secure secret sharing scheme distributes shares so that anyone with fewer than ''t'' shares has no extra information about the secret than someone with 0 shares.
| |
| | |
| Consider for example the secret sharing scheme in which the secret phrase "password" is divided into the shares "pa------," "--ss----," "----wo--," and "------rd,". A person with 0 shares knows only that the password consists of eight letters. He would have to guess the password from 26<sup>8</sup> = 208 billion possible combinations. A person with one share, however, would have to guess only the six letters, from 26<sup>6</sup> = 308 million combinations, and so on as more persons collude. Consequently this system is not a "secure" secret sharing scheme, because a player with fewer than ''t'' secret-shares is able to reduce the problem of obtaining the inner secret without first needing to obtain all of the necessary shares.
| |
| | |
| In contrast, consider the secret sharing scheme where X is the secret to be shared, P<sub>i</sub> are public [[asymmetric encryption]] keys and Q<sub>i</sub> their corresponding private keys. Each player J is provided with {P<sub>1</sub>(P<sub>2</sub>(...(P<sub>N</sub>(X)))), Q<sub>j</sub>}. In this scheme, any player with a private key 1 can remove the outer layer of encryption, a player with keys 1 and 2 can remove the first and second layer, and so on. A player with fewer than N keys can never fully reach the secret X without first needing to decrypt a public-key-encrypted blob for which he does not have the corresponding private key - a problem that is currently believed to be computationally infeasible. Additionally we can see that any user with all N private keys is able to decrypt all of the outer layers to obtain X, the secret, and consequently this system is a secure secret distribution system.
| |
| | |
| ==Limitations of secret sharing schemes==
| |
| Several secret sharing schemes are said to be [[information theoretic security|information theoretically secure]] and can be proven to be so, while others give up this ''unconditional security'' for improved efficiency while maintaining enough security to be considered as secure as other common cryptographic primitives. For example, they might allow secrets to be protected by shares with 128-bits of entropy each, since each share would be considered enough to stymie any conceivable present-day adversary, requiring a brute force attack of average size 2<sup>127</sup>.
| |
| | |
| Common to all unconditionally secure secret sharing schemes, there are limitations:
| |
| * Each share of the secret must be at least as large as the secret itself. This result is based in [[information theory]], but can be understood intuitively. Given ''t-1'' shares, no information whatsoever can be determined about the secret. Thus, the final share must contain as much information as the secret itself.
| |
| * All secret sharing schemes use [[random]] [[bit]]s. To distribute a one-bit secret among threshold ''t'' people, ''t-1'' random bits are necessary. To distribute a secret of arbitrary length entropy of ''(t-1)*length'' is necessary.
| |
| | |
| ==Trivial secret sharing==
| |
| === ''t'' = 1 ===
| |
| ''t = 1'' secret sharing is very trivial. The secret can simply be distributed to all ''n'' participants.
| |
| | |
| === ''t'' = ''n'' ===
| |
| There are several ''(t, n)'' secret sharing schemes for ''t = n'', when all shares are necessary to recover the secret:
| |
| | |
| # Encode the secret as an arbitrary length [[Binary numeral system|binary]] number ''s''. Give to each player ''i'' (except one) a random number ''p<sub>i</sub>'' with the same length as ''s''. Give to the last player the result of ''(s XOR p<sub>1</sub> XOR p<sub>2</sub> XOR ''...'' XOR p<sub>n-1</sub>)'' where ''XOR'' is [[bitwise operation#XOR|bitwise exclusive or]]. The secret is the bitwise XOR of all the players' numbers (''p'').
| |
| # Additionally, (1) can be performed using any linear operator in any [[Field_(mathematics)|field]]. For example, here's an alternative that is functionally equivalent to (1). Let's select 32-bit integers with well-defined overflow semantics (i.e. the correct answer is preserved, modulo 2^32). First, ''s'' can be divided into a vector of M 32-bit integers called ''v<sub>secret</sub>''. Then (n-1) players are each given a vector of M random integers, player ''i'' receiving ''v<sub>i</sub>''. The remaining player is given ''v<sub>n</sub>=(v<sub>secret</sub> - v<sub>1</sub> - v<sub>2</sub> - ''...'' - v<sub>n-1</sub>)''. The secret vector can then be recovered by summing across all the player's vectors.
| |
| | |
| === ''1'' ≠ ''t'' ≠ ''n'', and, more general, any desired subset of ''n'' ===
| |
| The difficulty lies in creating schemes that are still secure, but do not require all ''n'' shares. For example, imagine that the Board of Directors of a company would like to protect their secret formula. The president of the company should be able to access the formula when needed, but in an emergency any 3 of the 12 board members would be able to unlock the secret formula together. This can be accomplished by a secret sharing scheme with ''t'' = 3 and ''n'' = 15, where 3 shares are given to the president, and 1 is given to each board member. | |
| | |
| When space efficiency is not a concern, trivial ''t'' = ''n'' schemes can be used to reveal a secret to any desired subsets of the players simply by applying the scheme for each subset. For example, to reveal a secret ''s'' to any two of the three players Alice, Bob and Carol, create three different (2,2) secret shares for ''s'', giving the three sets of two shares to Alice and Bob, Alice and Carol, and Bob and Carol.
| |
| | |
| == Efficient secret sharing ==
| |
| The trivial approach quickly becomes impractical as the number of subsets increases, for example when revealing a secret to any 50 of 100 players. In the worst case, the increase is exponential. This has lead to the search for schemes that allow secrets to be shared efficiently with a threshold of players.
| |
| | |
| ===Shamir's scheme===
| |
| {{main|Shamir's Secret Sharing}}
| |
| | |
| In this scheme, any ''t'' out of ''n'' shares may be used to recover the secret. The system relies on the idea that you can fit a unique polynomial of degree ''(t-1)'' to any set of ''t'' points that lie on the polynomial. It takes two points to define a straight line, three points to fully define a quadratic, four points to define a cubic curve, and so on. That is it takes ''t'' points to define a polynomial of degree ''t-1''. The method is to create a polynomial of degree ''t-1'' with the secret as the first coefficient and the remaining coefficients picked at random. Next find ''n'' points on the curve and give one to each of the players. When at least ''t'' out of the ''n'' players reveal their points, there is sufficient information to fit a ''(t-1)''th degree polynomial to them, the first coefficient being the secret.
| |
| | |
| ===Blakley's scheme===
| |
| Two [[Parallel (geometry)|nonparallel]] lines in the same [[plane (mathematics)|plane]] intersect at exactly one point. Three nonparallel planes in space intersect at exactly one point. More generally, any ''n'' nonparallel ''[[dimension|(n-1)-dimensional]] [[hyperplane]]s'' intersect at a specific point. The secret may be encoded as any single coordinate of the point of intersection. If the secret is encoded using all the coordinates, even if they are random, then an insider (someone in possession of one or more of the [[dimension|(n-1)-dimensional]] [[hyperplane]]s) gains information about the secret since he knows it must lie on his plane. If an insider can gain any more knowledge about the secret than an outsider can, then the system no longer has [[information theoretic security]]. If only one of the n coordinates is used, then the insider knows no more than an outsider (i.e., that the secret must lie on the x-axis for a 2-dimensional system). Each player is given enough information to define a hyperplane; the secret is recovered by calculating the planes' point of intersection and then taking a specified coordinate of that intersection.
| |
| | |
| <div align="center">
| |
| {| border="0" cellspacing="2px" style="margin-left: auto; margin-right:auto;" width="600px"
| |
| | [[Image:Secretsharing-1.png|250px|One share]]
| |
| | [[Image:IntersectingPlanes.png|250px|Two shares intersecting on a line]]
| |
| | [[Image:Secretsharing-3-point.png|250px|Three shares intersecting at a point]]
| |
| |-
| |
| | colspan="3" | ''Blakley's scheme in three dimensions: each share is a [[plane (mathematics)|plane]], and the secret is the point at which three shares intersect. Two shares are insufficient to determine the secret, although they do provide enough information to narrow it down to the [[line (mathematics)|line]] where both planes intersect.''
| |
| |}
| |
| </div>
| |
| | |
| Blakley's scheme is less space-efficient than Shamir's; while Shamir's shares are each only as large as the original secret, Blakley's shares are ''t'' times larger, where ''t'' is the threshold number of players. Blakley's scheme can be tightened by adding restrictions on which planes are usable as shares. The resulting scheme is equivalent to Shamir's polynomial system.
| |
| | |
| === Using the Chinese Remainder Theorem ===
| |
| | |
| {{main|Secret Sharing using the Chinese Remainder Theorem}}
| |
| | |
| The [[Chinese Remainder Theorem]] can also be used in secret sharing, for it provides us with a method to uniquely determine a number ''S'' modulo ''k'' many [[relatively prime]] integers <math>m_1, m_2, ..., m_k</math>, given that <math>S < \prod_{i=1}^k m_i</math>. There are two secret sharing schemes that make use of the [[Chinese Remainder Theorem]], Mignotte's and Asmuth-Bloom's Schemes. They are threshold secret sharing schemes, in which the shares are generated by reduction modulo the integers <math>m_i</math>, and the secret is recovered by essentially solving the system of congruences using the [[Chinese Remainder Theorem]].
| |
| | |
| ==Proactive secret sharing==
| |
| {{main|Proactive secret sharing}}
| |
| If the players store their shares on insecure computer servers, an [[attacker]] could crack in and steal the shares. If it is not practical to change the secret, the uncompromised (Shamir-style) shares can be renewed. The dealer generates a new random polynomial with constant term zero and calculates for each remaining player a new ordered pair, where the x-coordinates of the old and new pairs are the same. Each player then adds the old and new y-coordinates to each other and keeps the result as the new y-coordinate of the secret.
| |
| | |
| All of the non-updated shares the attacker accumulated become useless. An attacker can only recover the secret if he can find enough other non-updated shares to reach the threshold. This situation should not happen because the players deleted their old shares. Additionally, an attacker cannot recover any information about the original secret from the update files because they contain only random information.
| |
| | |
| The dealer can change the threshold number while distributing updates, but must always remain vigilant of players keeping expired shares.
| |
| | |
| ==Verifiable secret sharing==
| |
| {{main|Verifiable secret sharing}}
| |
| | |
| A player might lie about his own share to gain access to other shares. A ''verifiable secret sharing'' (VSS) scheme allows players to be certain that no other players are lying about the contents of their shares, up to a reasonable probability of error. Such schemes cannot be computed conventionally; the players must collectively add and multiply numbers without any individual's knowing what exactly is being added and multiplied. [[Tal Rabin]] and [[Michael Ben-Or]] devised a ''[[Secure multiparty computation|multiparty computing]] (MPC)'' system that allows players to detect dishonesty on the part of the dealer or on part of up to one third of the threshold number of players, even if those players are coordinated by an "adaptive" attacker who can change strategies in realtime depending on what information has been revealed.
| |
| | |
| ==Computationally secure secret sharing==
| |
| | |
| The disadvantage of unconditionally secure secret sharing schemes is that the storage and transmission of the shares requires an amount of storage and bandwidth resources equivalent to the size of the secret times the number of shares. If the size of the secret were significant, say 1 GB, and the number of shares were 10, then 10 GB of data must be stored by the shareholders. Alternate techniques have been proposed for greatly increasing the efficiency of secret sharing schemes, by giving up the requirement of unconditional security.
| |
| | |
| One of these techniques, known as ''secret sharing made short'',<ref>{{cite conference |url=http://www.cs.cornell.edu/courses/cs754/2001fa/secretshort.pdf |title=Secret Sharing Made Short |first=Hugo|last=Krawczyk|author= |authorlink= |month= |year=1993 |conference=CRYPTO '93 }}</ref> combines Rabin's [[information dispersal algorithm]]<ref>{{cite journal |last1=Rabin |first1=Michael O. |year=1989 |title=Efficient dispersal of information for security, load balancing, and fault tolerance |journal=Journal of the ACM |volume=36 |issue=2 |pages= |publisher= |doi= |url= |accessdate= }}</ref> (IDA) with Shamir's secret sharing. Data is first encrypted with a randomly generated key, using a symmetric encryption algorithm. Next this data is split into N pieces using Rabin's IDA. This IDA is configured with a threshold, in a manner similar to secret sharing schemes, but unlike secret sharing schemes the size of the resulting data grows by a factor of (number of fragments / threshold). For example, if the threshold were 10, and the number of IDA-produced fragments were 15, the total size of all the fragments would be (15/10) or 1.5 times the size of the original input. In this case, this scheme is 10 times more efficient than if Shamir's scheme had been applied directly on the data. The final step in secret sharing made short is to use Shamir secret sharing to produce shares of the randomly generated symmetric key (which is typically on the order of 16–32 bytes) and then give one share and one fragment to each shareholder.
| |
| | |
| A related approach, known as AONT-RS,<ref>{{cite conference |url=http://web.eecs.utk.edu/~plank/plank/papers/FAST-2011.pdf |title=AONT-RS: Blending Security and Performance in Dispersed Storage Systems |first=Jason |last=Resch |author= |authorlink= |coauthors=Plank, James |date=February 15, 2011 |month= |year= |conference=Usenix FAST'11 |conferenceurl=http://www.usenix.org/events/fast11/ }}</ref> applies an [[All-or-nothing transform]] to the data as a pre-processing step to an IDA. The All-or-nothing transform guarantees that any number of shares less than the threshold is insufficient to decrypt the data.
| |
| | |
| ==Other uses and applications==
| |
| A secret sharing scheme can secure a secret over multiple servers and remain recoverable despite multiple server failures. The dealer may act as several distinct participants, distributing the shares among the participants. Each share may be stored on a different server, but the dealer can recover the secret even if several servers break down as long as they can recover at least ''t'' shares; however, [[Security cracking|cracker]]s that break into one server would still not know the secret as long as fewer than ''t'' shares are stored on each server.
| |
| | |
| This is one of the major concepts behind the [[Vanish (computer science)|Vanish]] computer project at the [[University of Washington]], where a random key is used to encrypt data, and the key is distributed as a secret across several nodes in a [[Peer-to-peer|P2P]] network. In order to decrypt the message, at least ''t'' nodes on the network must be accessible; the principle for this particular project being that the number of secret-sharing nodes on the network will decrease naturally over time, therefore causing the secret to eventually ''vanish''. However, the network is vulnerable to a [[Sybil attack]], thus making Vanish insecure.<ref>{{cite web | url=http://z.cs.utexas.edu/users/osa/unvanish/home | title = 'Unvanish: Reconstructing Self-Destructing Data'}}</ref>
| |
| | |
| Note also that any shareholder who ever has enough information to decrypt the content any point is able to take and store a copy of X. Consequently although tools and techniques such as Vanish can make data irrecoverable within their own system after a time, it is not possible to force the deletion of data once a malicious user has seen it. This is one of the leading conundrums of [[Digital Rights Management]].
| |
| | |
| A dealer could send ''t'' shares, all of which are necessary to recover the original secret, to a single recipient. An attacker would have to intercept all ''t'' shares to recover the secret, a task which is more difficult than intercepting a single file, especially if the shares are sent using different media (e.g. some over the [[Internet]], some mailed on [[Compact Disc|CD]]s).
| |
| | |
| For large secrets, it may be more efficient to encrypt the secret and then distribute the key using secret sharing.
| |
| | |
| Secret sharing is an important primitive in several protocols for [[secure multiparty computation]].
| |
| | |
| ==See also==
| |
| | |
| * [[Shamir's Secret Sharing]]
| |
| * [[Homomorphic secret sharing]] - A simplistic decentralized voting protocol.
| |
| * [[Byzantine fault tolerance]]
| |
| * [[Access structure]]
| |
| * [[Secure multiparty computation]]
| |
| * [[Visual cryptography]]
| |
| * [[Tontine]]
| |
| * [[Secret sharing using the Chinese remainder theorem]]
| |
| * [[Orthogonal array#Applications|Orthogonal array]] - Used to construct some threshold schemes.
| |
| | |
| ==Notes==
| |
| {{reflist}}
| |
| | |
| ==References==
| |
| * {{cite journal
| |
| | first = G. R. | last = Blakley
| |
| | title = Safeguarding cryptographic keys | journal = Proceedings of the National Computer Conference
| |
| | volume = 48 | pages = 313–317 | year = 1979
| |
| }}
| |
| * {{cite journal
| |
| | first = Adi | last = Shamir | authorlink = Adi Shamir
| |
| | title = How to share a secret | journal = Communications of the ACM
| |
| | volume = 22 | issue =11 | pages = 612–613 | year = 1979 | url = http://www.cs.tau.ac.il/~bchor/Shamir.html
| |
| | doi = 10.1145/359168.359176
| |
| }}
| |
| * {{Cite book
| |
| | first = Donald | last = Knuth | authorlink = Donald Knuth
| |
| | series = [[The Art of Computer Programming]] | volume = 2
| |
| | title = Seminumerical Algorithms | edition = 3 | publisher = Addison-Wesley
| |
| | year = 1997 | isbn = 0-201-89684-2 | page = 505
| |
| | oclc = 174593116
| |
| }}
| |
| *{{cite web|last=Beimel|first=Amos|title=Secret-Sharing Schemes: A Survey|year=2011|url=http://www.cs.bgu.ac.il/~beimel/Papers/Survey.pdf}}
| |
| | |
| ==External links==
| |
| * [http://point-at-infinity.org/ssss/ ssss: A free (GPL) implementation of Shamir's Scheme] with [http://point-at-infinity.org/ssss/demo.html online demo].
| |
| * [http://www.digital-scurf.org/software/libgfshare libgfshare] is a free implementation (C library and commandline tools) of Shamir's scheme in [[Galois field|GF(256)]].
| |
| * [http://www.rsasecurity.com/rsalabs/node.asp?id=2259 Description of Shamir's and Blakley's schemes]
| |
| * Patent for use of secret sharing for recovering PGP (and other?) pass phrases {{US patent|6662299}}
| |
| * [http://www.cacr.math.uwaterloo.ca/~dstinson/ssbib.html A bibliography on secret-sharing schemes]
| |
| * [http://web.archive.org/web/20080214135432/http://www.xml-dev.com/blog/index.php?action=viewtopic&id=130 Code signing systems using Shared Secret]
| |
| * [http://www.christophedavid.org/w/c/w.php/Calculators/ShamirSecretSharing Christophe David's web based implementation of Shamir's scheme 'How to share a Secret']
| |
| * Software products from [http://publib.boulder.ibm.com/infocenter/dmndhelp/v6rxmx/index.jsp?topic=/com.ibm.websphere.nd.doc/info/ae/ae/trun_ha_newpolicy.html IBM], [http://docs.sun.com/source/816-5547-10/index.html Sun], [http://docs.sun.com/source/816-5531-10/kycrt_ee.htm Netscape] and [http://www.zenithsecure.com/products/zenithvault-enterprise/how-does-it-work/ ZenithSecure] and hardware products from [http://www.safenet-inc.com/products/pki/lunaCA3.asp Safenet] use secret sharing. There are libraries for secret sharing in several programming languages.
| |
| * [http://sourceforge.net/projects/secretsharing/ SecretSharing] A QT implementation of Shamir's scheme using GF(2^8) field arithmetic.
| |
| * [https://github.com/Archistar/archistar-smc Java library implementation of multiple secret sharing methods, opensource(LGPLv2)]
| |
| | |
| {{Cryptography navbox}}
| |
| | |
| [[Category:Secret sharing]]
| |