0
$\begingroup$

In this paper[1] Qiong et al.’s CRT-based VSS} {Dealer Phase} To share a secret $ d \epsilon Z_{m_0} $ among a group of $n$ users with verifiable shares, the dealer does the following:

  Use the dealing procedure of the Asmuth-Bloom SSS to obtain the shares

$y_i = y ~mod~ m_i$ for each $1 \le i \le n$ where $y = d+ Am_0 < M$ .

Let $p, q$ be primes such that $q|(p − 1)$.Construct the unique polynomial $F (x) \epsilon Z_q [x] $ where $deg(F (x)) = n − 1$ and $F(m_ i ) = y_ i$ .

Construct a random polynomial $G(x) \epsilon q[x]$ where $deg(G(x)) = n− 1$. Let $ z_i = G(m_i )$ for all $1 \le i \le n$.

Let $g \epsilon Z_p$ with order $q, h$ be a random integer in the group generated by $g$ and $E(a, b) = g^a h^ b ~mod~ p$ for inputs $a, b \epsilon Z_{q}^{*}$.

Compute $E _i = E(F_ i , G_i)= g^{F_ i} h^{{G_{i}} ~ mod ~ p$

where $F_i$ and $G_{i}$ are the $(i − 1)^{th} $coefficients of $F(x)$ and $G(x)$, respectively,

for all $1 \le i \le n$. Broadcast $E_i$s to all users Send $(y_i , z_i )$ secretly to the $i^{th}$ user for all $1 \le i \le n$.

To verify the validity of his share, each user checks

$$E(y_ i , z_i) \equiv \prod_{i=1}^{n} (E_j)^{{m_i}^{j-1}}$$

$$E(y_ i , z_i) \equiv \prod_{i=1}^{n} (g^{F_j})^{{m_i}^{j-1}}\prod_{i=1}^{n} (h^{G_j})^{{m_i}^{j-1}}$$

$$E(y_ i , z_i) \equiv g^{y_i} h^{z_i}$$

The broadcasted verification information $ E_i = E (F_i, G_i)$ does not reveal any information about $F_i$, , $i = O,1,2,... ,n - 1$

It is known that $ g, h \in G_q$ , where $G$, is a cyclic group. According the closure attribute of a group: if $A$ and $B$ are two elements in G, then the product $AB$ is also in $G$ $E_i, = g^{F_i} h^{G_i}$, Let $e$ is the identity element of $G$. Since the degree of $G$ , is $q$, for any $F_i \in q$,

, and randomly selected $G_i \in q$ , we can randomly select integers $a,b \in Z_p$

such that $$g^{qa+F_i} F^{qb+G_i}$$

$${g^{q}}^{a} g^{F_i}{F^{q}}^{b} F^{G_i}$$

$$ e^{a} g^{F_i} e^{b} g^{G_i}$$

$$ g^{F_i} g^{G_i}$$

Therefore, $$ E_i = g^{F_i} g^{G_i}$$ is uniformly distributed in $G_q$, , which means it does not reveal any information about $F_i$.

I understood theorem mathematical part but i didnot understood conclusion statement i.e

Therefore, $$ E_i = g^{F_i} g^{G_i}$$ is uniformly distributed in $G_q$, , which means it does not reveal any information about $F_i$.

please explain conclusion statement

[1] https://www.researchgate.net/publication/4165856_A_non-interactive_modular_verifiable_secret_sharing_scheme

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.