SECRET sharing schemes were introduced by Blakley [5]

Transcription

1 206 IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 52, NO. 1, JANUARY 2006 Secret Sharing Schemes From Three Classes of Linear Codes Jin Yuan Cunsheng Ding, Senior Member, IEEE Abstract Secret sharing has been a subject of study for over 20 years, has had a number of real-world applications. There are several approaches to the construction of secret sharing schemes. One of them is based on coding theory. In principle, every linear code can be used to construct secret sharing schemes. But determining the access structure is very hard as this requires the complete characterization of the minimal codewords of the underlying linear code, which is a dficult problem in general. In this paper, a sufficient condition for all nonzero codewords of a linear code to be minimal is derived from exponential sums. Some linear codes whose covering structure can be determined are constructed, then used to construct secret sharing schemes with nice access structures. Index Terms Cryptography, linear codes, secret sharing, covering problem, exponential sums. I. INTRODUCTION SECRET sharing schemes were introduced by Blakley [5] Shamir [17] in Since then, many constructions have been proposed. The relationship between Shamir s secret sharing scheme the Reed Solomon codes was pointed out by McEliece Sarwate in 1981 [12]. Later, several authors have considered the construction of secret sharing schemes using linear error correcting codes [6], [8], [10], [11], [14], [15]. Massey utilized linear codes for secret sharing pointed out the relationship between the access structure the minimal codewords of the dual code of the underlying code [10], [11]. Unfortunately, determining the minimal codewords is extremely hard for general linear codes. This was done only for a few classes of special linear codes. In special cases, the Ashikhmin Barg lemma [2] (see Lemma 3 in this paper) is very useful in determining the minimal codewords. Several authors have investigated the minimal codewords for certain codes characterized the access structures of the secret sharing schemes based on their dual codes [16], [1], [2], [18]. In this paper, we first characterize the minimal codewords of certain linear codes using exponential sums, then construct some linear codes suitable for secret sharing. Finally, we determine the access structure of the secret sharing schemes based on the duals of those linear codes. Manuscript received May 14, 2004; revised July 7, This work of the authors is supported by the Research Grants Council of the Hong Kong Special Administrative Region, Project HKUST6183/04E, China. The authors are with the Department of Computer Science, The Hong Kong University of Science Technology, Clear Water Bay, Kowloon, Hong Kong, China ( [email protected]; [email protected]). Communicated by A. E. Ashikhmin, Associate Editor for Coding Theory. Digital Object Identier /TIT II. A LINK BETWEEN SECRET SHARING SCHEMES AND LINEAR CODES The Hamming weight of a vector in is the total number of nonzero coordinates. An code is a linear subspace of with dimension minimum nonzero Hamming weight. Let be a generator matrix of an code, i.e., the row vectors of generate the linear subspace. For all the linear codes mentioned in this paper, we always assume that no column vector of any generator matrix is the zero vector. There are several ways to use linear codes to construct secret sharing schemes. One of them is the following described by Massey [10]. In the secret sharing scheme based on, the secret is an element of, which is called the secret space, participants a dealer are involved. The dealer is a trusted person. In order to compute the shares with respect to a secret, the dealer chooses romly a vector such that. There are altogether such vectors. The dealer then treats as an information vector computes the corresponding codeword gives to participant as share for each. Since, a set of shares, determines the secret only is a linear combination of. Hence we have the following lemma [10]. Proposition 1: Let be a generator matrix of an code. In the secret sharing scheme based on, a set of shares, determines the secret only there is a codeword in the dual code, where for at least one. If there is a codeword of (1) in, then the vector is a linear combination of, say,. Then the secret is recovered by computing. If a group of participants can recover the secret by combining their shares, then any group of participants containing this group can also recover the secret. A group of participants is referred to as a minimal access set they can recover the secret with their shares, while any of its proper subgroups cannot do so. Here, a proper subgroup has fewer members than this group. In view of these facts, we are only interested in the set of all minimal (1) /$ IEEE

2 YUAN AND DING: SECRET SHARING SCHEMES FROM THREE CLASSES OF LINEAR CODES 207 access sets. To determine this set, we need the notion of minimal codewords. Definition 1: The support of a vector is defined to be. A codeword covers a codeword the support of contains that of. If a nonzero codeword covers only its scalar multiples, but no other nonzero codewords, then it is called a minimal codeword. From Proposition 1 the preceding discussions, it is clear that there is a one-to-one correspondence between the set of minimal access sets the set of minimal codewords of the dual code whose first coordinate is. To determine the access structure of the secret sharing scheme, we need to determine only the set of minimal codewords whose first coordinate is, i.e., a subset of the set of all minimal codewords. However, in almost every case we should be able to determine the set of all minimal codewords as long as we can determine the set of minimal codewords whose first coordinate is. The covering problem of a linear code is to determine the set of all its minimal codewords. It is clear that the shares for the participants depend on the selection of the generator matrix of the code. However, by Proposition 1, the selection of does not affect the access structure of the secret sharing scheme. Therefore, in the sequel we will call it the secret sharing scheme based on, without mentioning the generator matrix used to compute the shares. We say that a secret sharing scheme is democratic of degree every group of participants is in the same number of minimal access sets, where. III. THE ACCESS STRUCTURE OF THE SECRET SHARING SCHEMES BASED ON THE DUALS OF THE CODES In Section II, we described the secret sharing scheme based on a linear code. Naturally, we have also the secret sharing scheme based on the dual code. In this later sections, we consider only the secret sharing scheme based on the dual code of a given linear code. The following proposition describes properties of the minimal access sets of the secret sharing scheme based on [7]. Note that the vectors s in this later sections are not the same as those in Section II. Proposition 2: [7] Let be an code, let be its generator matrix, where all are nonzero. If each nonzero codeword of is minimal, then in the secret sharing scheme based on, there are altogether minimal access sets. In addition, we have the following. 1 If is a scalar multiple of, then participant must be in every minimal access set. Such a participant is called a dictatorial participant. 2 If is not a scalar multiple of, then participant must be in out of minimal access sets. In view of Proposition 2, it is an interesting problem to construct codes whose nonzero codewords are all minimal. Such a linear code gives a secret sharing scheme with the interesting access structure described in Proposition 2. IV. CHARACTERIZATIONS OF MINIMAL CODEWORDS A. Sufficient Condition From Weights If the weights of a linear code are close enough to each other, then all nonzero codewords of the code are minimal, as described as follows. Lemma 3: (Ashikhmin Barg lemma [2]) In an code, let be the minimum maximum nonzero weights, respectively. If then all nonzero codewords of are minimal. The Ashikhmin Barg lemma is quite useful in determining the minimal codewords for special linear codes. B. Sufficient Necessary Condition Using Exponential Sums Let, where is a prime is a positive integer. Throughout this paper, let denote the canonical additive character of, i.e., It is well known that each linear function from to can be written as for some. Hence, for any linear code with generator matrix, there exist such that every codeword can be expressed as for some. On the other h, for every, the vector in (2) is in the code. Hence, any linear code has a trace form of (2). We now consider two nonzero codewords of, where. If, then the two codewords would be scalar multiples of each other. Let be the number of coordinates in which takes on zero, let be the number of coordinates in which both take on zero. By definition,. Clearly, covers only. Hence we obtain the following proposition. Proposition 4: For all is minimal only for all with. We would use this proposition to characterize the minimal codewords of the code. To this end, we would compute the values of both. But this is extremely hard in general. Thus, we would give tight bounds on them using known bounds on exponential sums. By definition (2) (3)

3 208 IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 52, NO. 1, JANUARY 2006 Similarly Proposition 8: [9, Ch. 5] Let be of degree with let be a nontrivial additive character of. Then (8) In the expressions of, when or is fixed, the inner sum for both is for some fixed, is called an incomplete exponential sum in general. Note that most known bounds on exponential sums are summed over the whole, may not be used to give bounds on. However, the set constitutes the range of some function defined over, each element in this range is taken on the same number of times by this function, we will be able to derive bounds on using known bounds on exponential sums. This will become clear in later sections. V. SOME BOUNDS ON EXPONENTIAL SUMS The objective of this section is to introduce the following bounds on exponential sums which will be needed later. Definition 2: [9, Ch. 5] Let be a multiplicative an additive character of. Then the Gaussian sum is defined by It is well known that both are nontrivial, Proposition 5: [9, Ch. 5] Let be a finite field with, where is an odd prime is a positive integer. Let be the quadratic character of let be the canonical additive character of. Then Proposition 6: [9, Ch. 5] Let be a nontrivial additive character of a positive integer,. Then be a nontrivial additive char- for any with. Proposition 7: [9, Ch. 5] Let acter of with odd, let with. Then (4) (5) (6) (7) Later we shall need the following bounds on incomplete exponential sums of rational functions [13]. Lemma 9: [13] Let be the finite field of elements characteristic, let be the quotient of two polynomials with coefficients in that satisfies for any, where is the algebraic closure of.define Let be the number of distinct roots of in.if denotes a nontrivial additive character of, then we have (9) (10) where when,, otherwise. In fact, we need a special case of the above result, state it as follows. Lemma 10: Let be the finite field of elements characteristic ; let be the quotient of two polynomials with coefficients in that satisfies, has distinct roots in. If denotes a nontrivial additive character of, then we have (11) where the sum runs over all excluding the zeros of. VI. SECRET SHARING SCHEMES FROM A CLASS OF LINEAR CODES In this section, we first describe a class of linear codes which are a generalization of the irreducible cyclic codes [4], then describe the access structure of the secret sharing scheme based on the duals of these codes. This section is a generalization of some results in [7]. Definition 3: Let be a prime, let. Suppose. Let be a primitive th root of unity in, with.define as where (12) where is the quadratic character of. The following is called the Weil bound. to. is the trace function from

4 YUAN AND DING: SECRET SHARING SCHEMES FROM THREE CLASSES OF LINEAR CODES 209 The code of (12) has dimension, where. It is not cyclic, it is a generalization of the irreducible cyclic codes [4]. When, the code is called nondegenerate. In this section, we consider only the nondegenerate case. We are interested in the secret sharing scheme based on the dual code. To analyze the access structure of the secret sharing scheme, we would solve the covering problem of the code under certain conditions. Now we derive bounds on the of (3) for the code.by (3), we have scheme can be determined under conditions that are weaker than that of (15). The reader is referred to [7] for details. Open Problem 1: Solve the covering problem for the code of (12) determine the access structure of the secret sharing scheme based on when the condition of (15) is not met. Before ending this section, we present a specic example of the secret sharing scheme described above. We set. Let be a primitive element of define. We choose. Then the code of (12) is a nondegenerate code. Although the condition of (15) is not met, all nonzero codewords of are minimal. This is because this condition is sufficient, but not necessary. The dual code has parameters generator matrix where otherwise. Applying the bound of (6), we have (13) As before, let denote the minimum maximum nonzero weights of. It follows from (13) that In the secret sharing scheme based on, 12 participants a dealer are involved. There are altogether minimal access sets (14) By (14), we have that (15) It then follows from the Ashikhmin Barg lemma (Lemma 3) that every nonzero codeword of is minimal under the condition of (15). We remark that the condition of (15) is sufficient, but not necessary. By Proposition 2, the set of dictatorial participants in the secret sharing scheme based on is (16) whose cardinality is between. Combining the discussions above Proposition 2, we have proved the following. Proposition 11: When the condition of (15) is met, all nonzero codewords of are minimal. Furthermore, in the secret sharing scheme based on, the set of possible dictatorial participants is given in (16), each of the other participants is involved in minimal access sets. For two subclasses of the codes of (12), the covering problem can be solved the access structure of the secret sharing Participant 7 is a dictatorial participant because it is involved in every minimal access set. Hence, any group of participants who can determine the secret must include participant 7. Each participant in the set is in minimal access sets. If a group of participants can recover the secret, it must have at least six members (50% of the total number of participants). Such a secret sharing scheme could be useful in applications where the boss must be involved in every decision making. VII. SECRET SHARING SCHEMES FROM QUADRATIC FORM CODES Let be an odd prime,. Let. Consider defined over. It is easily seen that 1 for any ; 2 ; 3 when. Let Range

5 210 IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 52, NO. 1, JANUARY 2006 Let, then. Write. We define a linear code as If, let, then by (21) (17) where is the trace function from to. In [7], we proved that is an code, analyzed the weights of this code for the case even. In this section, we determine its weights for the case odd, describe the access structure of the secret sharing scheme based on its dual code. Now we investigate the weights of. Note for any, by Proposition 7 (22) Let, denote the canonical additive character quadratic character over by, respectively. Note that since is odd, one can easily prove that for any. It follows from (22) (5) that (18) Define. Then by (3) Then by (19) the code has three possible nonzero weights (19) To determine the weight of, we need to compute. By definition, is a th root of unity. Note that otherwise. We have (20) When is even, because It follows from (18) that all nonzero codewords of are minimal. When is odd, because (21) In the case that is even, it is proved in [7] that the code has the following four possible nonzero weights: all nonzero codewords of are minimal. Proposition 12: If, all nonzero codewords of the quadratic form code are minimal. Furthermore, in the secret sharing scheme based on, the set of dictatorial participants is given by We now consider the case that is odd. If, then by (21) which has cardinality at most, each of the other participants is involved in minimal access sets. Proof: The first part follows from the earlier discussions. The number of dictatorial participants is at most because the elements are all distinct,. The remaining part of the conclusion follows from Proposition 2. Open Problem 2: Solve the covering problem for the code of (17) determine the access structure of the secret sharing scheme based on for the case. We now present an example of the secret sharing scheme described above. We choose. Let be a primitive element of. Then

6 YUAN AND DING: SECRET SHARING SCHEMES FROM THREE CLASSES OF LINEAR CODES 211 Then the of (17) is a three-weight code with nonzero weights. The dual code has parameters generator matrix The code is dferent from the Goppa codes. Obviously, the dimension of is at most the codeword length is. Now we give a condition on under which. Lemma 13: when (24) Proof: It suffices to prove that at least one of is nonzero, cannot be the zero codeword. Suppose are nonzero, where The augmented code of is a code which is optimal. In the secret sharing scheme based on, 11 participants a dealer are involved. There are altogether minimal access sets for other s. Then for any where is a polynomial in with degree at most. For all,wehave Participant 1 is a dictatorial participant because it is involved in every minimal access set. Hence, any group of participants who can determine the secret must include participant 1. Each participant in the set is in minimal access sets. If a group of participants can recover the secret, it must have at least six members (54% of the total number of participants). Such a secret sharing scheme could be useful in applications where the boss must be involved in every decision making. VIII. SECRET SHARING SCHEMES FROM THE THIRD CLASS OF CODES Let be pairwise distinct elements of. Define because all are pairwise distinct. Thus, the condition of Lemma 10 is satisfied. Let be the canonical additive character of. Then by Lemma 10 On the other h, is the zero codeword, the sum above would be. Hence, the conclusion follows. Now we estimate the weights of. Let be the number of zeros in the codeword, then Write as Using Lemma 10 we obtain that Given, for any, let We define a linear code as where (23) Hence, we have proved the following. Lemma 14: We have that

7 212 IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 52, NO. 1, JANUARY 2006 Now we investigate the minimum distance of the dual code. Proposition 15: If, then. Proof: Obviously,.If, from the construction of, there must exist distinct elements, such that for any. Then. Since, this cannot hold for all. Therefore,. Proposition 16: If (25) then is a code all nonzero codewords of are minimal. Furthermore, in the secret sharing scheme based on every participant is in out of minimal access sets. Hence, the secret sharing scheme is democratic of degree at least. Proof: Clearly, the condition of (25) implies that of (24). Hence, under the condition of (25), has dimension. Under this condition it is easily veried that It then follows from the Ashikhmin Barg lemma (Lemma 3) that all nonzero codewords of are minimal. On the other h, by Proposition 15. The conclusion of this proposition then follows from Proposition 2. Open Problem 3: Solve the covering problem for the code of (23) determine the access structure of the secret sharing scheme based on when the condition of (25) is not met. IX. CONCLUDING REMARKS In this paper, under certain conditions, we solved the covering problem for three classes of linear codes determined the access structure of the secret sharing schemes based on their dual codes. The access structures are of two types. In the first type, there are a number of dictatorial participants who must be involved in recovering the secret, each of the remaining participants is involved in the same number of minimal access sets. These secret sharing schemes are not democratic, could be used in applications where a few dictatorial participants are necessary. In the second type, every participant appears in the same number of minimal access sets. The degree of democracy is usually one or two. Secret sharing schemes with access structures of this type could be useful in applications where a small degree of democracy is necessary. Note that a threshold secret sharing scheme is democratic of degree, which is useful in applications where a high degree of democracy is required. The information rate of the secret sharing schemes described in this paper is one, the best possible. The goal of this paper is not to construct error-correcting codes, although we constructed several classes of error-correcting codes. Our purpose is to use some existing classes of error-correcting codes those constructed in this paper to construct secret sharing schemes with nice access structures. The linear codes described in this paper may not be optimal, but give secret sharing schemes with interesting access structures. In this paper, we presented several open problems regarding the covering problem of linear codes the access structures of secret sharing schemes based on linear codes. It would be nice these open problems could be settled in the near future. ACKNOWLEDGMENT The authors wish to thank the referees the Associate Editor Alexei E. Ashikhmin for their constructive comments suggestions that much improved the paper. REFERENCES [1] A. Ashikhmin, A. Barg, G. Cohen, L. Huguet, Variations on minimal codewords in linear codes, in Proc. Applied Algebra, Algebraic Algorithms Error-Correcting Codes (AAECC 1995) (Lecture Notes in Computer Science). Berlin, Germany: Springer-Verlag, 1995, vol. 948, pp [2] A. Ashikhmin A. Barg, Minimal vectors in linear codes, IEEE Trans. Inf. Theory, vol. 44, no. 5, pp , Sep [3] L. D. Baumert W. H. Mills, Unorm cyclotomy, J. Number Theory, vol. 14, pp , [4] L. D. Baumert R. J. McEliece, Weights of irreducible cyclic codes, Inf. Control, vol. 20, no. 2, pp , [5] G. R. Blakley, Safeguarding cryptographic keys, in Proc National Computer Conf., New York, Jun. 1979, pp [6] C. Ding, D. Kohel, S. Ling, Secret sharing with a class of ternary codes, Theor. Comp. Sci., vol. 246, pp , [7] C. Ding J. Yuan, Covering secret sharing with linear codes, in Discrete Mathematics Theoretical Computer Science (Lecture Notes in Computer Science). Berlin, Germany: Springer-Verlag, 2003, vol. 2731, pp [8] E. D. Karnin, J. W. Greene, M. E. Hellman, On secret sharing systems, IEEE Trans. Inf. Theory, vol. IT-29, no. 1, pp , Jan [9] R. Lidl H. Niederreiter, Finite Fields. Cambridge, U.K.: Cambridge Univ. Press, [10] J. L. Massey, Minimal codewords secret sharing, in Proc. 6th Joint Swedish-Russian Workshop on Information Theory, Mölle, Sweden, Aug. 1993, pp [11], Some applications of coding theory, Cryptography, Codes Ciphers: Cryptography Coding IV, pp , [12] R. J. McEliece D. V. Sarwate, On sharing secrets reed-solomon codes, Commun. Assoc. Comp. Mach., vol. 24, pp , [13] C. Moreno O. Moreno, Exponential sums Goppa codes, in Proc. Amer. Math. Soc., vol. 111, 1991, pp [14] K. Okada K. Kurosawa, MDS secret sharing scheme secure against cheaters, IEEE Trans. Inf. Theory, vol. 46, no. 3, pp , May [15] J. Pieprzyk X. M. Zhang, Ideal threshold schemes from MDS codes, in Information Security Cryptology Proc. of ICISC 2002 (Lecture Notes in Computer Sceince). Berlin, Germany: Springer-Verlag, 2003, vol. 2587, pp [16] A. Renvall C. Ding, The access structure of some secret-sharing schemes, in Information Security Privacy (Lecture Notes in Computer Science). Berlin, Germany: Springer-Verlag, 1996, vol. 1172, pp [17] A. Shamir, How to share a secret, Commun. Assoc. Comp. Mach., vol. 22, pp , [18] J. Yuan C. Ding, Secret sharing schemes from two-weight codes, in Proc. R. C. Bose Centenary Symp. Discrete Mathematics Applications, Kolkata, India, Dec