Efficient Threshold Function Secret Sharing With Information-Theoretic Security

Function secret sharing (FSS) is a cryptographic primitive that is introduced by Boyle <italic>et al.</italic> (Eurocrypt 2015), motivated by application scenarios involving private access to large distributed data while minimising the overhead of communication, for example, private information retrieval. Informally, an <inline-formula> <tex-math notation="LaTeX">$n$ </tex-math></inline-formula>-party FSS scheme splits a function <inline-formula> <tex-math notation="LaTeX">$f$ </tex-math></inline-formula> into <inline-formula> <tex-math notation="LaTeX">$n$ </tex-math></inline-formula> functions <inline-formula> <tex-math notation="LaTeX">$f_{1},\ldots,f_{n}$ </tex-math></inline-formula> such that <inline-formula> <tex-math notation="LaTeX">$f=f_{1}+\cdots +f_{n}$ </tex-math></inline-formula> and every strict subset of the function shares hide <inline-formula> <tex-math notation="LaTeX">$f$ </tex-math></inline-formula>. Most of the known FSS constructions only have computational hiding, namely, the hiding property holds only against a computationally bounded adversary. We consider information-theoretic hiding in this work while allowing <inline-formula> <tex-math notation="LaTeX">$f$ </tex-math></inline-formula> to be recovered from <inline-formula> <tex-math notation="LaTeX">$t$ </tex-math></inline-formula> function shares and correspondingly, any <inline-formula> <tex-math notation="LaTeX">$(t-1)$ </tex-math></inline-formula> function shares unconditionally hide <inline-formula> <tex-math notation="LaTeX">$f$ </tex-math></inline-formula>. Call it <inline-formula> <tex-math notation="LaTeX">$(t,n)$ </tex-math></inline-formula>-threshold function secret sharing (<inline-formula> <tex-math notation="LaTeX">$(t,n)$ </tex-math></inline-formula>-TFSS for short). Using information-theoretic tools and through a series of optimizations, we show that our <inline-formula> <tex-math notation="LaTeX">$(t,n)$ </tex-math></inline-formula>-TFSS have better performance than FSS in terms of communication complexity, a criterion that measures the efficiency of such protocols. Specifically, a <inline-formula> <tex-math notation="LaTeX">$(t,n)$ </tex-math></inline-formula>-TFSS scheme with communication complexity <inline-formula> <tex-math notation="LaTeX">$O(l)$ </tex-math></inline-formula> is designed in this paper and it is better than the existing FSS schemes with lowest communication complexity <inline-formula> <tex-math notation="LaTeX">$O(\lambda l)$ </tex-math></inline-formula>, where <inline-formula> <tex-math notation="LaTeX">$\lambda $ </tex-math></inline-formula> is the length of pseudo-random generator’s seeds. In addition, the <inline-formula> <tex-math notation="LaTeX">$(t,n)$ </tex-math></inline-formula>-TFSS have an extra robustness property in the sense that even if up to <inline-formula> <tex-math notation="LaTeX">$(n-t)$ </tex-math></inline-formula> function shares are not available, the protocol still computes the function value at a given point correctly.