--- title: Additive Secret Sharing Scheme url: https://www.emergentmind.com/topics/additive-secret-sharing-scheme-ass type: topic --- # Additive Secret Sharing Scheme Additive Secret Sharing Schemes (ASS) are cryptographic primitives that enable secure and efficient distribution of a secret value among multiple parties such that only the collective combination of all shares reconstructs the original secret, while individual shares reveal no information. In the canonical (2,2)-threshold version, a value $x$ over a field $\mathbb{F}$ is split into two shares $\{r, x - r\}$, where $r$ is sampled uniformly at random. Additive secret sharing forms the basis of numerous protocols in secure multiparty computation (MPC), offering both simplicity and strong statistical security in the honest-but-curious model. Beyond this, additive secret sharing also appears in more advanced constructions, such as those utilizing additive codes over $GF(4)$, which introduce nontrivial access structures and require multi-step reconstruction procedures. ## 1. Formal Structure of Additive Secret Sharing Let $\mathbb{F}$ denote a field, which may be $\mathbb{R}$, a finite field $\mathbb{Z}_p$, or a ring such as $\mathbb{Z}_{2^\ell}$. In the standard (2,2)-threshold additive secret sharing scheme, the following algorithms are specified: - **ASS.Setup$(1^\lambda)$**: No setup beyond establishing $\mathbb{F}$ is required. - **ASS.Share$(x\in\mathbb{F})$**: - Sample $r \xleftarrow{\$} \mathbb{F}$ uniformly at random. - Compute $[x]_1 = r$, $[x]_2 = x - r$. - Output the pair $\ass{x} = ([x]_1, [x]_2)$. - **ASS.Recon$([x]_1, [x]_2)$**: - Compute $x = [x]_1 + [x]_2$. Correctness holds since $r + (x - r) = x$. Security against semi-honest adversaries follows as each share is independently and uniformly distributed in $\mathbb{F}$, statistically hiding $x$. The scheme generalizes directly to $n$ parties by decomposing $x$ as a sum of $n$ random field elements summing to $x$ [2009.05356]. ## 2. Security Properties and Universal Composability For any party $P_i$, the view of its share $[x]_i$ is indistinguishable from a uniformly random element of $\mathbb{F}$. Theorem 2.1 establishes that there exists a perfect simulator that, on input $\bot$, outputs a simulated share distributed identically to $[x]_i$. Thus, in the honest-but-curious adversary model, the scheme achieves strong statistical secrecy. Protocols based on ASS are proven to be Universally Composable (UC) secure in this model. The composability arises since every protocol step either performs only local linear operations on shares or executes a masked value exchange using Beaver triples, which leak no information about the underlying secret due to additive or multiplicative masking [2009.05356]. ## 3. Multiplicative Secret Sharing and Share Conversion While ASS naturally supports addition and affine linear operations, multiplicative homomorphism requires a dual sharing scheme, termed Multiplicative Secret Sharing (MSS). To multiplicatively share $u \in \mathbb{F}\setminus\{0\}$ between two parties: - Sample $u_1 \xleftarrow{\$} \mathbb{F}^\times$. - Set $[u]_1^\times = u_1$, $[u]_2^\times = u/u_1$. - The reconstruction is $u = [u]_1^\times \cdot [u]_2^\times$. Efficient, constant-round, UC-secure protocols convert between ASS and MSS representations: - **SecMulRes** (MSS → ASS): With a shared Beaver triple $(a,b,c)$ ($c = ab$), the parties manipulate their MSS shares and exchange masked deltas to produce an ASS sharing of the product [2009.05356]. - **SecAddRes** (ASS → MSS): Using similar Beaver triple resources, two communication rounds suffice to obtain an MSS sharing from an ASS sharing. The correctness and UC security of these resharing protocols are formally established in [2009.05356, Thms. 3.2–3.3]. ## 4. Arithmetic Protocols and Functionality ASS serves as the foundation for an extensive suite of secure two-party arithmetic protocols. Core functionalities include: - **Secure Addition (SecLinear):** Locally compute share-wise sums. No communication is required. - **Secure Multiplication (SecMul):** Requires a single round and 4 field elements exchanged by utilizing Beaver triples, thus securely evaluating the product of two ASS-shared secrets. - **Secure Comparison (SecCom):** Involves three protocol rounds and $2\ell + 2$ bits of communication for $\ell$-bit fields. - **Element-wise Functions:** Secure exponentiation, logarithms, powers, and trigonometric functions are supported, typically requiring a combination of resharing (between ASS and MSS), local computations, and one to three rounds of online communication. The round complexity and communication costs are tabulated as follows: | Protocol | Rounds | Communication | |------------------|-----------------|-----------------| | SecMul | 1 | 4$\ell$ | | SecMulRes | 1 | 2$\ell$ | | SecAddRes | 2 | 2$\ell$ | | SecCom | 3 | 2$\ell$ + 2 | | SecExp | 1 | 2$\ell$ | | SecLog | 2 | 2$\ell$ | | SecPow | 3 | (2n + 2)$\ell$ | | SecSin/SecCos | 1 | 4$\ell$ | | Division | 3 | 6$\ell$ | | Product | min(3, $\lceil\log_2 n\rceil$) | (2n+2)$\ell$ or (4n-4)$\ell$ | Head-to-head with prior schemes, the ASS-based protocols in [2009.05356] achieve demonstrably lower round and communication complexity for comparison and division functionalities. ## 5. Additive Secret Sharing over Additive Codes ASS can be instantiated more generally using additive codes over $GF(4)$, as formalized by Kim and Lee [1701.04183]. An additive code $C$ of length $n$ over $GF(4)$ is an additive subgroup of $GF(4)^n$, inherently a vector space over $GF(2)$ with generator matrix $G$ of dimensions $k\times n$, $k = \dim_{GF(2)}(C)$. The secret is encoded into the first coordinate $t_0$ of a codeword $t = uG$, where $u$ is a random binary information vector constrained so $u\cdot g_0 = s$ for secret $s$. Each participant $P_i$ receives share $t_i$. Uniformity of $u$ over the affine hyperplane guarantees that all shares (except $t_0$) are independent of $s$. ## 6. Reconstruction and Access Structures in Code-Based Schemes Unlike linear code-based schemes, additive codes over $GF(4)$ require two rounds for reconstruction. The trace-inner product, using the dual code $C^\perp$, yields three classes $H_1, H_2, H_3$ of dual codewords whose first coordinate is $1, \omega, \overline{\omega}$, respectively. Each such codeword produces a trace equation $Q_k$ relating to the secret, but only the combination of two independent equations (from distinct $H_k$) suffices to uniquely recover $s$. This two-step structure defines the access structure: - **Authorized Sets:** Any pair $(A, B)$ with $A\in TH_i$, $B\in TH_j$ for $i \neq j$, where $TH_k$ is the collection of supports of codewords in $H_k$ omitting the secret holder. - **Minimal Access Pairs:** Pairs where neither component strictly contains the support of a smaller dual codeword in $H_k$. For self-dual additive codes, minimal access pairs correspond directly to pairs of minimal supports in distinct $H$-classes. ## 7. Applications, Performance, and Error Detection ASS forms the core of secure two-party computation protocols with constant rounds and minimal bandwidth—properties demonstrated in high-throughput cloud computation and other privacy-preserving settings [2009.05356]. For code-based variants: - **Examples of Additive Codes:** The hexacode ($n=6$), dodecacode QC$_{12}$ ($n=12$), and $S_{18}$ ($n=18$) illustrate schemes with extremal parameters and access structures matching the properties discussed in [1701.04183]. - **Generalized 2-Designs:** The access structures in these schemes are combinatorially uniform, as the supports of codewords form generalized $t$-designs, ensuring symmetric treatment of all participants. - **Error Detection:** The minimum distance $d$ of the code determines the tolerance for cheaters: up to $d-1$ errors can be detected, and up to $\lfloor(d-1)/2\rfloor$ corrected through standard syndrome-based correction. - **Efficiency:** Reconstruction requires only two rounds of combining traces, with each participating share contributing one bit. This yields computational effort $O(|S| + |T|)$ for authorized minimal pairs. The universality, efficiency, and combinatorial access structures of additive secret sharing ensure its continued relevance in privacy-preserving computation, distributed protocols, and cryptographic design [2009.05356][1701.04183]. Source: https://www.emergentmind.com/topics/additive-secret-sharing-scheme-ass