Fang‐Wei Fu

Xiaofeng Liu, Jun Zhang, Fang-Wei Fu

Motivated by the studies of twisted generalized Reed-Solomon (TGRS) codes, we initiate the study of twisted elliptic curve codes (TECCs) in this paper. In particular, we study a class of TECCs with one twist. The parity-check matrices of the TECCs are explicitly given by computing the Weil differentials. Then the sufficient and necessary conditions of self-duality are presented. The minimum distances of the TECCs are also determined. Moreover, examples of MDS, AMDS, self-dual and MDS self-dual TECCs are given. Finally, we calculate the dimensions of the Schur squares of TECCs and show the non-equivalence between TECCs and ECCs/GRS codes.

Jing Yang, Fang-Wei Fu

Secret sharing was firstly proposed in 1979 by Shamir and Blakley respectively. To avoid deficiencies of original schemes, researchers presented improvement schemes, among which the multi-secret sharing scheme (MSS) is significant. There are three categories of MSSs, however, we focus on multi-stage secret sharing scheme (MSSS) recovering secrets with any order in this work. By observing inhomogeneous linear recursions (ILRs) in the literature, we conclude a general formula and divide ILRs into two types according to different variables in them. Utilizing these two kinds of ILRs, we propose four verifiable MSSSs with Ajtai's function, which is a lattice-based function. Our schemes have the following advantages. Firstly, our schemes can detect cheat of the dealer and participants, and are multi-use. Secondly, we have several ways to restore secrets. Thirdly, we can turn our schemes into other types of MSSs due to the universality of our method. Fourthly, since we utilize a lattice-based function to mask shares, our schemes can resist the attack from the quantum computer with computational security. Finally, although our schemes need more memory consumption than some known schemes, we need much less time consumption, which makes our schemes more suitable facing limited computing power.

Wenshuo Guo, Fang-Wei Fu

This paper presents a key recovery attack on the cryptosystem proposed by Lau and Tan in a talk at ACISP 2018. The Lau-Tan cryptosystem uses Gabidulin codes as the underlying decodable code. To hide the algebraic structure of Gabidulin codes, the authors chose a matrix of column rank $n$ to mix with a generator matrix of the secret Gabidulin code. The other part of the public key, however, reveals crucial information about the private key. Our analysis shows that the problem of recovering the private key can be reduced to solving a multivariate linear system over the base field, rather than solving a multivariate quadratic system as claimed by the authors. Solving the linear system for any nonzero solution permits us to recover the private key. Apparently, this attack costs polynomial time, and therefore completely breaks the cryptosystem.

Jing Yang, Fang-Wei Fu

Secret sharing was proposed primarily in 1979 to solve the problem of key distribution. In recent decades, researchers have proposed many improvement schemes. Among all these schemes, the verifiable multi-secret sharing (VMSS) schemes are studied sufficiently, which share multiple secrets simultaneously and perceive malicious dealer as well as participants. By pointing out that the schemes presented by Dehkordi and Mashhadi in 2008 cannot detect some vicious behaviors of the dealer, we propose two new VMSS schemes by adding validity check in the verification phase to overcome this drawback. Our new schemes are based on XTR public key system, and can realize $GF(p^{6})$ security by computations in $GF(p^{2})$ without explicit constructions of $GF(p^{6})$, where $p$ is a prime. Compared with the VMSS schemes using RSA and linear feedback shift register (LFSR) public key cryptosystems, our schemes can achieve the same security level with shorter parameters by using trace function. What's more, our schemes are much simpler to operate than those schemes based on Elliptic Curve Cryptography (ECC). In addition, our schemes are dynamic and threshold changeable, which means that it is efficient to implement our schemes according to the actual situation when participants, secrets or the threshold needs to be changed.

Jing Yang, Fang-Wei Fu

A verifiable multi-secret sharing (VMSS) scheme enables the dealer to share multiple secrets, and the deception of both participants and the dealer can be detected. After analyzing the security of VMSS schemes proposed by Mashhadi and Dehkordi in 2015, we illustrate that they cannot detect some deception of the dealer. By using nonhomogeneous linear recursion and LFSR public key cryptosystem, we introduce two new VMSS schemes. Our schemes can not only overcome the drawback mentioned above, but also have shorter private/public key length at the same safety level. Besides, our schemes have dynamism.

Xuan Guang, Jiyong Lu, Fang-Wei Fu

In this paper, we propose a class of threshold secret sharing schemes with repairing function between shares without the help of the dealer, that we called repairable threshold secret sharing schemes. Specifically, if a share fails, such as broken or lost, it will be repaired just by some other shares. A construction of such repairable threshold secret sharing schemes is designed by applying linearized polynomials and regenerating codes in distributed storage systems. In addition, a new repairing rate is introduced to characterize the performance and efficiency of the repairing function. Then an achievable upper bound on the repairing rate is derived, which implies the optimality of the repair and describes the security between different shares. Under this optimality of the repair, we further discuss traditional information rate and also indicate its optimality, that can describe the efficiency of secret sharing schemes in the aspect of storage. Finally, by applying the minimum bandwidth regenerating (MBR) codes, our construction designs repairable threshold secret sharing schemes achieving both optimal repairing and information rates simultaneously.

Jun Zhang, Xinran Li, Fang-Wei Fu

In this paper, we construct an authentication scheme for multi-receivers and multiple messages based on a linear code $C$. This construction can be regarded as a generalization of the authentication scheme given by Safavi-Naini and Wang. Actually, we notice that the scheme of Safavi-Naini and Wang is constructed with Reed-Solomon codes. The generalization to linear codes has the similar advantages as generalizing Shamir's secret sharing scheme to linear secret sharing sceme based on linear codes. For a fixed message base field $\f$, our scheme allows arbitrarily many receivers to check the integrity of their own messages, while the scheme of Safavi-Naini and Wang has a constraint on the number of verifying receivers $V\leqslant q$. And we introduce access structure in our scheme. Massey characterized the access structure of linear secret sharing scheme by minimal codewords in the dual code whose first component is 1. We slightly modify the definition of minimal codewords in \cite{Massey93}. Let $C$ be a $[V,k]$ linear code. For any coordinate $i\in \{1,2,\cdots,V\}$, a codeword $\vec{c}$ in $C$ is called minimal respect to $i$ if the codeword $\vec{c}$ has component 1 at the $i$-th coordinate and there is no other codeword whose $i$-th component is 1 with support strictly contained in that of $\vec{c}$. Then the security of receiver $R_i$ in our authentication scheme is characterized by the minimal codewords respect to $i$ in the dual code $C^\bot$.

Jun Zhang, Xinran Li, Fang-Wei Fu

Network coding provides the advantage of maximizing the usage of network resources, and has great application prospects in future network communications. However, the properties of network coding also make the pollution attack more serious. In this paper, we give an unconditional secure authentication scheme for network coding based on a linear code $C$. Safavi-Naini and Wang gave an authentication code for multi-receivers and multiple messages. We notice that the scheme of Safavi-Naini and Wang is essentially constructed with Reed-Solomon codes. And we modify their construction slightly to make it serve for authenticating subspace codes over linear network. Also, we generalize the construction with linear codes. The generalization to linear codes has the similar advantages as generalizing Shamir's secret sharing scheme to linear secret sharing sceme based on linear codes. One advantage of this generalization is that for a fixed message space, our scheme allows arbitrarily many receivers to check the integrity of their own messages, while the scheme with Reed-Solomon codes has a constraint on the number of verifying receivers. Another advantage is that we introduce access structure in the generalized scheme. Massey characterized the access structure of linear secret sharing scheme by minimal codewords in the dual code whose first component is 1. We slightly modify the definition of minimal codewords. Let $C$ be a $[V,k]$ linear code. For any coordinate $i\in \{1,2,\cdots,V\}$, a codeword $\vec{c}$ in $C$ is called minimal respect to $i$ if the codeword $\vec{c}$ has component 1 at the $i$-th coordinate and there is no other codeword whose $i$-th component is 1 with support strictly contained in that of $\vec{c}$. Then the security of receiver $R_i$ in our authentication scheme is characterized by the minimal codewords respect to $i$ in the dual code $C^\bot$.

Jun Zhang, Xinran Li, Fang-Wei Fu

We analyze the security of the authentication code against pollution attacks in network coding given by Oggier and Fathi and show one way to remove one very strong condition they required. Actually, we find a way to attack their authentication scheme. In their scheme, they considered that if some malicious nodes in the network collude to make pollution in the network flow or make substitution attacks to other nodes, they thought these malicious nodes must solve a system of linear equations to recover the secret parameters. Then they concluded that their scheme is an unconditional secure scheme. Actually, note that the authentication tag in the scheme of Oggier and Fathi is nearly linear on the messages, so it is very easy for any malicious node to make pollution attack in the network flow, replacing the vector of any incoming edge by linear combination of his incoming vectors whose coefficients have sum 1. And if the coalition of malicious nodes can carry out decoding of the network coding, they can easily make substitution attack to any other node even if they do not know any information of the private key of the node. Moreover, even if their scheme can work fruitfully, the condition in their scheme $H\leqslant M$ in a network can be removed, where $H$ is the sum of numbers of the incoming edges at adversaries. Under the condition $H\leqslant M$, $H$ may be large, so we need large parameter $M$ which increases the cost of computation a lot. On the other hand, the parameter $M$ can not be very large as it can not exceed the length of original messages.