viff

view viff/shamir.py @ 1575:cfb8e1485006

find changesets by author, revision, files, or words in the commit message
Updated email address.
author Thomas P Jakobsen <tpj@cs.au.dk>
date Wed Dec 15 13:00:00 2010 +0100 (17 months ago)
parents 4e36cad23bc1
children
line source
1 # Copyright 2007, 2008 VIFF Development Team.
2 #
3 # This file is part of VIFF, the Virtual Ideal Functionality Framework.
4 #
5 # VIFF is free software: you can redistribute it and/or modify it
6 # under the terms of the GNU Lesser General Public License (LGPL) as
7 # published by the Free Software Foundation, either version 3 of the
8 # License, or (at your option) any later version.
9 #
10 # VIFF is distributed in the hope that it will be useful, but WITHOUT
11 # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General
13 # Public License for more details.
14 #
15 # You should have received a copy of the GNU Lesser General Public
16 # License along with VIFF. If not, see <http://www.gnu.org/licenses/>.
17
18 """Shamir secret sharing and recombination. Based on the paper *How to
19 share a secret* by Adi Shamir in *Communications of the ACM* **22**
20 (11): 612-613.
21 """
22
23 import operator
24 from viff.util import rand, fake
25
26
27 @fake(lambda s, t, n: [(s.field(i+1), s) for i in range(n)])
28 def share(secret, threshold, num_players):
29 """Shamir share secret.
30
31 The *threshold* indicates the maximum number of shares that reveal
32 nothing about *secret*. The return value is a list of ``(player
33 id, share)`` pairs.
34
35 It holds that sharing and recombination cancels each other:
36
37 >>> from field import GF
38 >>> Zp = GF(47)
39 >>> secret = Zp(42)
40 >>> recombine(share(secret, 7, 15)[:8]) == secret
41 True
42
43 The threshold can range from zero (for a dummy-sharing):
44
45 >>> share(Zp(10), 0, 5)
46 [({1}, {10}), ({2}, {10}), ({3}, {10}), ({4}, {10}), ({5}, {10})]
47
48 up to but not including *num_players*:
49
50 >>> share(Zp(10), 5, 5)
51 Traceback (most recent call last):
52 ...
53 AssertionError: Threshold out of range
54 """
55 assert threshold >= 0 and threshold < num_players, "Threshold out of range"
56
57 coef = [secret]
58 for j in range(threshold):
59 # TODO: introduce a random() method in FieldElements so that
60 # this wont have to be a long when we are sharing a
61 # GMPIntegerFieldElement.
62 coef.append(rand.randint(0, long(secret.modulus)-1))
63
64 shares = []
65 for i in range(1, num_players+1):
66 # Instead of calculating s_i as
67 #
68 # s_i = s + a_1 x_i + a_2 x_i^2 + ... + a_t x_i^t
69 #
70 # we avoid the exponentiations by calculating s_i by
71 #
72 # s_i = s + x_i (a_1 + x_i (a_2 + x_i ( ... (a_t) ... )))
73 #
74 # This is a little faster, even for small n and t.
75 cur_point = secret.field(i)
76 cur_share = coef[threshold]
77 # Go backwards from threshold-1 down to 0
78 for j in range(threshold-1, -1, -1):
79 cur_share = coef[j] + cur_share * cur_point
80
81 shares.append((cur_point, cur_share))
82
83 return shares
84
85 #: Cached recombination vectors.
86 #:
87 #: The recombination vector used by `recombine` depends only on the
88 #: recombination point and the player IDs of the shares, and so it can
89 #: be cached for efficiency.
90 _recombination_vectors = {}
91
92
93 @fake(lambda s, x=0: s[0][1])
94 def recombine(shares, x_recomb=0):
95 """Recombines list of ``(xi, yi)`` pairs.
96
97 Shares is a list of *threshold* + 1 ``(player id, share)`` pairs.
98 Recombination is done in the optional point *x_recomb*.
99
100 Note that player ids must be elements in the same field as the
101 shares or otherwise the algorithm will not work.
102
103 >>> from field import GF
104 >>> Zp = GF(19)
105 >>> shares = [(Zp(i), 7 * Zp(i) + 3) for i in range(1, 4)]
106 >>> print shares
107 [({1}, {10}), ({2}, {17}), ({3}, {5})]
108 >>> del(shares[1])
109 >>> recombine(shares)
110 {3}
111 """
112 xs, ys = zip(*shares)
113 key = xs + (x_recomb, )
114 try:
115 vector = _recombination_vectors[key]
116 except KeyError:
117 vector = []
118 for i, x_i in enumerate(xs):
119 factors = [(x_k - x_recomb) / (x_k - x_i)
120 for k, x_k in enumerate(xs) if k != i]
121 vector.append(reduce(operator.mul, factors))
122 _recombination_vectors[key] = vector
123 return sum(map(operator.mul, ys, vector))
124
125
126 def verify_sharing(shares, degree):
127 """Verifies that a sharing is correct.
128
129 It is verified that the given shares correspond to points on a
130 polynomial of at most the given degree.
131
132 >>> from field import GF
133 >>> Zp = GF(47)
134 >>> shares = [(Zp(i), Zp(i**2)) for i in range(1, 6)]
135 >>> print shares
136 [({1}, {1}), ({2}, {4}), ({3}, {9}), ({4}, {16}), ({5}, {25})]
137 >>> verify_sharing(shares, 2)
138 True
139 >>> verify_sharing(shares, 1)
140 False
141 """
142 used_shares = shares[0:degree+1]
143 for i in range(degree+1, len(shares)+1):
144 if recombine(used_shares, i) != shares[i-1][1]:
145 return False
146
147 return True
148
149
150 if __name__ == "__main__":
151 import doctest #pragma NO COVER
152 doctest.testmod() #pragma NO COVER