next up previous contents
Next: 2.2.2 Interactive Proofs Up: 2.2.1 Secret Sharing Previous: 2.2.1.2 Sum Secret Sharing

2.2.1.3 Verifiable Secret Sharing

In terms of fault tolerance, both of the above protocols leave something to be desired. The sum secret sharing method is not fault-tolerant in the least, demanding that all participants cooperate fully. Shamir secret sharing detects and tolerates Byzantine faults in a certain number of players, but does not detect or tolerate errors on the part of the dealer, who may simply distribute random values as shares.

Fortunately, there exist secret sharing protocols which allow for secure distributed computations against Byzantine faults in both the dealer and the players. The protocols are rather complicated, and their internal mechanisms are not as important as their existence, so we will only present the result here. The most useful and sweeping result is that of T. Rabin and Ben-Or, who in 1989 constructed a protocol to compute any arithmetic function of secrets in the presence of at most n/2 Byzantine adversaries. As might be expected, these protocols are much more complex than Protocol 1.



Ken Shan (ken@digitas.harvard.edu), 1998-05-15