Theory and practice of verifiable secret sharing

Secret Sharing is a fundamental notion for secure cryptographic design. In a Secret Sharing protocol a dealer shares a secret among n parties. In the so called threshold model, the sharing is done so that subsets of t + 1 (or more) parties can later reconstruct the secret, while subsets of t (or less) parties have no information about it. The notion can be generalized by having the dealer specify a family of subsets of the n parties, called the access structure. The dealer shares the secret in such a way that only subsets of players in such family (usually called authorized subsets) can reconstruct the secret, while non-authorized subsets have no information about it. Veriiable Secret Sharing (VSS) protocols achieve the above task in the presence of malicously behaving parties. In our thesis we present a new and stronger deenition of VSS. The novelty of the deenition is that it satisses the composition property of secure protocols. That is VSS protocols satisfying the requirements of our deenition, can be proven to remain secure even when used as sub-protocols inside larger protocols. Previous deenitions did not enjoy this property. We present also the rst VSS protocols in the access structure model, whose security does not depend on unproven computational assumptions. One of the most important application of VSS protocols is the implementation of robust shared signature schemes. Such protocols allow a group of servers to sign a document with a secret key that is shared among them. We present eecient threshold signature schemes for the Digital Signature Standard and the RSA Signature Algorithm. The protocols are fully robust, that is they tolerate the presence of a threshold of malicious servers who may try to forge signatures or impede the signature process. Acknowledgments First and foremost I would like to thank my advisor, Silvio Micali. I just cannot imagine a better person to work with. His enthusiasm makes research work always exciting. He is also an extremely supportive person, always ready to pump up your self{esteem when things do not go as well as desired. Special thanks are due to Shaa Goldwasser and Tal Rabin, for serving in my thesis committee. Shaa introduced me to cryptography and always showed a genuine interest in my research. Tal is not only a great person to work with, but also a special friend. The Theory Group at the MIT Laboratory for Computer Science has …