Verification device, secret information restoration device, verification method, program, and secret sharing system

1. A verification device, said verification device comprising:

a computer, wherein said computer:

takes as shared secret information each n item of information that is generated from secret information by a (k, n) threshold secret-sharing scheme that uses a polynomial of the (k−1) th degree on a finite field based on power p of a prime number;

takes as q a prime number that satisfies the relation q≧n*p, takes as r and t natural numbers that satisfy k≧t+r, takes as cheater identification information n items of information generated by means of a t-Cheater Identifiable secret-sharing scheme that uses a polynomial of the t th degree on finite field GF(q) so as to enable identification of any of up to t items of dishonest shared secret information included in n items of said shared secret information; and

identifies dishonest shared information from any k items of shared information among n items of shared information that are pairs of shared secret information and cheater-identification information;

said computer comprising:

an input device that receives as input k items of shared information and said t;

a subset generation unit that generates all subsets that are combinations that select, from said k items of shared information applied as input to said input means, r items of shared information where r≧t+2;

a coherence checking unit that, by using each item of cheater-identification information that belongs to the subset and a polynomial of the t th degree, judges for each of said subsets that were generated by said subset generation unit whether dishonest shared information is contained in the subset; and

a cheater unit that, based on the judgment result by said coherence checking unit and the shared information contained in each subset, identifies dishonest shared information.

2. The verification device as set forth in claim 1 , wherein said r is a natural number that satisfies 2t≧r≧t+2.

3. The verification device as set forth in claim 1 , wherein said r is t+2.

4. The verification device as set forth in claim 1 , wherein:

the finite field based on said p is GF(p);

said cheater-identification information is information obtained by substituting φ({i}, v{i}) in a polynomial of the t th degree on said GF(q), where said shared secret information is v{i} (i=1, 2, . . . n) and φ is a one-to-one function; and

said coherence checking unit judges whether dishonest shared information is included in the subset according to whether (φ({j — 1}, v{j — 1}), A({j — 1}), . . . (φ({j_(t+2)}, v{j_(t+2)}), v{j_(t+2)}) are all points on the same polynomial of the t th degree or lower, where said shared secret information belongs to said subsets as v{j — 1}, . . . v{j_k} and said cheater-identification information belongs to the subset as A{j — 1}, . . . A{j_k}.

5. The verification device as set forth in claim 4 , wherein:

said coherence checking unit generates as a coherence-checked set the set {j — 1}, . . . {j_(t+2)} upon judging that, for each of said subsets, dishonest shared information is not included in the subset, and upon judging that dishonest shared information is included in the subset, generates an empty set as the coherence-checked set; and

said cheater identification unit generates, as said cheater set, the differential set between the sum set of said coherence-checked sets for each said subset that was generated by said coherence checking unit and the set {i — 1}, . . . {i_k}.

6. A secret information restoration device comprising:

the verification device as set forth in claim 5 ; and

a secret information restoration unit that restores and supplies said secret information from k items of said shared secret information if said cheater set that was generated by said cheater identification unit is an empty set.

7. The verification device as set forth in claim 1 , wherein:

the finite field based on said p is GF(p^N);

said cheater-identification information includes:

As{i} that is obtained by substituting {i} (i=1, 2, . . . n) into a first polynomial of the t th degree on said GF(p^N); and

Ae{i} that is obtained by substituting φ({i}, fe(v{i})) into a second polynomial of the t th degree on said GF(q), where said shared secret information is v{i}, function fe(x) is fe(x)=x{0}+x{1}*e+x{2}*e^2+ . . . +x{N}*e^N, and φ is a one-to-one function; and

said coherence checking unit judges whether dishonest shared information is included in the subset according to whether (j — 1, As{j — 1}), . . . (j_(t+2), As{j_(t+2)}) are all points on the same polynomial of the t th degree or lower, and moreover, whether ((φ(j — 1, v{j — 1}), Ae{j — 1}), . . . ((φ(j_(t+2), v{j_(t+2)}), Ae{j_(t+2)}) are all points on the same polynomial of the t th degree or lower.

8. A verification method, said verification method causes a computer to perform the steps of:

taking as shared secret information each n item of information that is generated from secret information by a (k, n) threshold secret-sharing scheme that uses a polynomial of the (k−1) th degree on a finite field based on power p of a prime number;

taking as q a prime number that satisfies the relation q≧n*p, taking as r and t natural numbers that satisfy k≧t+r, and taking as cheater identification information n items of information generated by means of a t-Cheater Identifiable secret-sharing scheme that uses a polynomial of the t th degree on finite field GF(q) so as to enable identification of any of up to t items of dishonest shared secret information included in said n items of shared secret information, and

identifying dishonest shared information from any k items of shared information among n items of shared information that are pairs of shared secret information and cheater-identification information;

said verification method comprising:

generating all subsets that are combinations that select, from k items of shared information, r items of shared information where r≧t+2;

judging, for each of the subsets that were generated, whether dishonest shared information is contained in the subset by using each item of cheater-identification information that belongs to the subset and a polynomial of the t th degree; and

based on the judgment results and shared information contained in each subset, identifying dishonest shared information.

9. A secret sharing system comprising:

a computer comprising:

a secret information sharing unit that generates n items of shared secret information from secret information by means of a (k, n) threshold secret-sharing scheme that uses a polynomial of the (k−1) th degree on a finite field based on a power p of a prime number, that takes as q a prime number that satisfies the relation q≧n*p and takes as r and t natural numbers that satisfy k≧t+r to generate n items of cheater-identification information by means of a t-Cheater identifiable secret-sharing scheme that uses a polynomial of the t th degree on a finite field GF(q) so as to enable identification of any of up to t items of dishonest shared information among said n items of shared information, and that supplies n items of the shared secret information and n items of the cheater-identification information; and

a verification device that, upon input of any k items of shared information among n items of shared information that are pairs of shared secret information and cheater-identification information generated by said secret information sharing device and said t, generates all subsets that are combinations that select, from the k items of shared information, r items of shared information where r satisfies r≧t+2, judges for each subset whether dishonest information is included in the subset by using each item of cheater-identification information that belongs to the subset and a polynomial of the t th degree, and based on the judgment result and the shared information that is contained in each subset, identifies dishonest shared information.