Secret sharing system, sharing apparatus, share management apparatus, acquisition apparatus, secret sharing method, program and recording medium
View Patent ↗A sharing apparatus independently shares a value corresponding to each element θ(ψ, i, β)·g 2 of basis vectors b i *(θ) among each subset SUB(α) consisting of H(α) share management apparatuses PA(α, 1), . . . , PA(α, H(α)) to generate share information SH(ψ, i, β, α, h(α)) corresponding to each element θ(ψ, i, β)·g 2 . The share management apparatus PA(α, h(α)) generates a share secret value DSH(ψ, α, h(α)) by performing a common calculation common in the subset SUB(α) on common information shared in the subset SUB(α) and the share information SH(ψ, i, β, α, h(α)). An acquisition apparatus generates reconstructed secret values SUBSK(ψ, α) for each subset SUB(α) by performing a reconstruction processing for the subset SUB(α) and generates generation information D*(ψ) from the reconstructed secret values SUBSK(ψ, α).
1. A secret sharing system, comprising:
a sharing apparatus;
Σ α=1 L h(α) share management apparatuses PA(α, h(α)), where α=1, . . . L, L≧2, h(α)=1, . . . , H(α), H(α)≧2; and
an acquisition apparatus,
wherein the sharing apparatus includes:
a secret sharing unit that independently shares a value corresponding to each element θ(ψ, i, β)·g 2 of basis vectors b i *(ψ) among each subset SUB(α) consisting of H(α) share management apparatuses PA(α, 1), . . . , PA(α, H(α)) according to a predetermined secret sharing scheme to generate share information SH(ψ, i, β, α, h(α)) corresponding to each element θ(ψ, i, β)·g 2 and the share management apparatuses PA(α, h(α)), where h(α)=1, . . . , H(α), provided that Ψ denotes an integer equal to or greater than 1, ψ denotes an integer equal to or greater than 0 and equal to or smaller than Ψ, ψ=0, . . . , Ψ, n(ψ) denotes an integer equal to or greater than 1, ζ(ψ) denotes an integer equal to or greater than 0, a generator of a cyclic group G 2 is denoted by g 2 , and the basis vectors b i *(ψ)=(θ(ψ, i, 1)·g 2 , . . . , θ(ψ, i, n(ψ)+ζ(ψ))·g 2 )εg 2 )εG 2 n(ψ)+ζ(ψ) are n(ψ)+ζ(ψ)-dimensional basis vectors for θ(ψ, i, β), where i=1, . . . , n(ψ)+ζ(ψ), β=1, . . . , n(ψ)+(ψ), n(ψ)≧1, ζ(ψ)≧1, elements of the basis vectors b i *(ψ) are n(ψ)+ζ(ψ) elements of the cyclic group G 2 ,
each of the share management apparatuses PA(α, h(α)) includes:
a share secret value generation unit that receives the share information SH(ψ, i, β, α, h(α)) corresponding to the share management apparatuses PA(α, h(α)), and generates share secret values DSH(ψ, α, h(α)) corresponding to the share management apparatuses PA(α, h(α)) by performing a common calculation common in the subset SUB(α) on common information shared in the subset SUB(α) and the share information SH(ψ, i, β, α, h(α)), where h(α)=1, . . . , H(α), and
the acquisition apparatus includes:
a reconstruction unit that generates reconstructed secret values SUBSK(ψ, α) for each subset SUB(α) from a plurality of the share secret values DSH(ψ, α, h(α)) for the subset SUB(α) by performing reconstruction processing for the subset SUB(α) according to the secret sharing scheme; and
a synthesis unit that generates generation information D*(ψ) from the reconstructed secret values SUBSK(ψ, α).
2. The secret sharing system according to claim 1 , wherein pieces of the common information shared in different subsets SUB(α) are independent from each other.
3. The secret sharing system according to claim 1 , wherein the common calculation is a linear calculation.
4. The secret sharing system according to claim 2 , wherein the common calculation is a linear calculation.
5. The secret sharing system according to claim 1 , wherein the synthesis unit generates the generation information D*(ψ) by a linear combination of the reconstructed secret values SUBSK(ψ, α).
6. The secret sharing system according to claim 2 , wherein the synthesis unit generates the generation information D*(ψ) by a linear combination of the reconstructed secret values SUBSK(ψ, α).
7. The secret sharing system according to claim 3 , wherein the synthesis unit generates the generation information D*(ψ) by a linear combination of the reconstructed secret values SUBSK(ψ, α).
8. The secret sharing system according to claim 4 , wherein the synthesis unit generates the generation information D*(ψ) by a linear combination of the reconstructed secret values SUBSK(ψ, α).
9. The secret sharing system according to claim 1 , 2 , 3 , 4 , 5 , 6 , 7 , or 8 , wherein the value corresponding to each element θ(ψ, i, β)·g 2 of the basis vectors b i *(ψ) are θ(ψ, i, β),
the common information includes coef t (0, α), coef(λ, α), coef t (λ, α), SE(α) and share(λ, α), provided that λ denotes an integer equal to or greater than 1 and equal to or smaller than Ψ, λ=1, . . . , Ψ, and the share secret value generation unit generates:
DSH (0,α, h (α))=− SE (α)· SHb 1 *(0,α, h (α))· g 2 +Σ t=2 I coef t (0,α)· SHb t *(0,α, h (α))· g 2
as a share secret value for ψ=0, provided that
SHb i *(0, α, h(α))=(SH(0, i, 1, α, h(α)), . . . , SH(0, i, I, α, h(α)) and I is a constant equal to or greater than 2 and equal to or smaller than n(0)+ζ(0); and
D
S
H
(
λ
,
α
,
h
(
α
)
)
=
(
share
(
λ
,
α
)
+
coef
(
λ
,
α
)
·
v
1
(
λ
)
)
·
SHb
1
*
(
λ
,
α
,
h
(
α
)
)
·
g
2
+
∑
l
=
2
n
(
λ
)
coef
(
λ
,
α
)
·
v
1
(
λ
)
·
SHb
l
*
(
λ
,
α
,
h
(
α
)
)
·
g
2
+
∑
l
=
n
(
λ
)
+
1
n
(
λ
)
+
ζ
(
λ
)
coef
l
(
λ
,
α
)
·
SHb
l
*
(
λ
,
α
,
h
(
α
)
)
·
g
2
or
D
S
H
(
λ
,
α
,
h
(
α
)
)
=
share
(
λ
,
α
)
·
∑
l
=
1
n
(
λ
)
v
i
(
λ
)
·
SHb
1
*
(
λ
,
α
,
h
(
α
)
)
·
g
2
+
∑
l
=
n
(
λ
)
+
1
n
(
λ
)
+
ζ
(
λ
)
coef
l
(
λ
,
α
)
·
SHb
l
*
(
λ
,
α
,
h
(
α
)
)
·
g
2
as a secret share value for each λ, provided that
SHb i *(λ, α, h(α))=(SH(λ, i, 1, α, h(α)), . . . , SH(λ, i, n(λ)+ζ(λ), α, h(α)) and v(λ) → =(v 1 (λ), . . . , v n(λ) (λ)) are n(λ)-dimensional vectors.
10. The secret sharing system according to claim 1 , 2 , 3 , 4 , 5 , 6 , 7 , or 8 , wherein the value corresponding to each element θ(ψ, i, β)·g 2 of the basis vectors b i *(ψ) are θ(ψ, i, β)·g 2 ,
the common information includes coef t (0, α), coef(λ, α), coef t (λ, α), SE(α) and share(λ, α), provided that λ denotes an integer equal to or greater than 1 and equal to or smaller than Ψ, λ=1, . . . , Ψ, and
the share secret value generation unit generates:
DSH (0,α, h (α))=− SE (α)· SHb 1 *(0,α, h (α))+Σ t=2 I coef t (0,α)· SHb t *(0,α, h (α))
as a share secret value for ψ=0, provided that
SHb i *(0, α, h(α))=(SH(0, i, 1, α, h(α)), . . . , SH(0, i, I, α, h(α)) and I is a constant equal to or greater than 2 and equal to or smaller than n(0)+ζ(0); and
D
S
H
(
λ
,
α
,
h
(
α
)
)
=
(
share
(
λ
,
α
)
+
coef
(
λ
,
α
)
·
v
1
(
λ
)
)
·
SHb
1
*
(
λ
,
α
,
h
(
α
)
)
+
∑
l
=
2
n
(
λ
)
coef
(
λ
,
α
)
·
v
i
(
λ
)
·
SHb
l
*
(
λ
,
α
,
h
(
α
)
)
+
∑
l
=
n
(
λ
)
+
1
n
(
λ
)
+
ζ
(
λ
)
coef
i
(
λ
,
α
)
·
SHb
l
*
(
λ
,
α
,
h
(
α
)
)
or
D
S
H
(
λ
,
α
,
h
(
α
)
)
=
share
(
λ
,
α
)
·
∑
l
=
1
n
(
λ
)
v
i
(
λ
)
·
SHb
1
*
(
λ
,
α
,
h
(
α
)
)
+
∑
l
=
n
(
λ
)
+
1
n
(
λ
)
+
ζ
(
λ
)
coef
l
(
λ
,
α
)
·
SHb
l
*
(
λ
,
α
,
h
(
α
)
)
as a secret share value for each λ, provided that
SHb i *(λ, α, h(α))=(SH(λ, i, 1, α, h(α)), . . . , SH(λ, i, n(λ)+ζ(λ), α, h(α)) and v(λ) → =(v 1 (λ), . . . , v n(λ) (λ)) are n(λ)-dimensional vectors.
11. The secret sharing system according to claim 9 , wherein the reconstruction unit generates:
SUBSK (0,α)=− SE (α)· b 1 *(0)+Σ t=2 I coef t (0,α)· b t *(0)
as a reconstructed secret value for ψ=0; and
S
U
B
S
K
(
λ
,
α
)
=
(
share
(
λ
,
α
)
+
coef
(
λ
,
α
)
·
v
1
(
λ
)
)
·
b
1
*
(
λ
)
+
∑
l
=
2
n
(
λ
)
coef
(
λ
,
α
)
·
v
i
(
λ
)
·
b
i
*
(
λ
)
+
∑
l
=
n
(
λ
)
+
1
n
(
λ
)
+
ζ
(
λ
)
coef
l
(
λ
,
α
)
·
b
i
*
(
λ
)
or
S
U
B
S
K
(
λ
,
α
)
=
share
(
λ
,
α
)
·
∑
l
=
1
n
(
λ
)
v
1
(
λ
)
·
b
1
*
(
λ
)
+
∑
l
=
n
(
λ
)
+
1
n
(
λ
)
+
ζ
(
λ
)
coef
l
(
λ
,
α
)
·
b
i
*
(
λ
)
as a reconstructed secret value for each λ.
12. The secret sharing system according to claim 10 , wherein the reconstruction unit generates:
SUBSK (0,α)=− SE (α)· b 1 *(0)+Σ t=2 I coef t (0,α)· b t *(0)
as a reconstructed secret value for ψ=0; and
S
U
B
S
K
(
λ
,
α
)
=
(
share
(
λ
,
α
)
+
coef
(
λ
,
α
)
·
v
1
(
λ
)
)
·
b
1
*
(
λ
)
+
∑
l
=
2
n
(
λ
)
coef
(
λ
,
α
)
·
v
1
(
λ
)
·
b
i
*
(
λ
)
+
∑
l
=
n
(
λ
)
+
1
n
(
λ
)
+
ζ
(
λ
)
coef
l
(
λ
,
α
)
·
b
l
*
(
λ
)
or
S
U
B
S
K
(
λ
,
α
)
=
share
(
λ
,
α
)
·
∑
l
=
1
n
(
λ
)
v
i
(
λ
)
·
b
1
*
(
λ
)
+
∑
l
=
n
(
λ
)
+
1
n
(
λ
)
+
ζ
(
λ
)
coef
l
(
λ
,
α
)
·
b
l
*
(
λ
)
as a reconstructed secret value for each λ.
13. A share management apparatus PA(α, h(α)) that receives share information SH(ψ, i, β, α, h(α)) corresponding to share management apparatuses PA(α, h(α)), and generates share secret values DSH(ψ, α, h(α)) corresponding to the share management apparatuses PA(α, h(α)) by performing a common calculation common in each subset SUB(α) consisting of H(α) share management apparatuses PA(α, 1), . . . , PA(α, H(α)), where α=1, . . . , L, L≧2, h(α)=1, . . . , H(α), H(α)≧2, on common information shared in the subset SUB(α) and the share information SH(ψ, i, β, α, h(α)) obtained by independently sharing a value corresponding to each element θ(ψ, i, β)·g 2 of a basis vectors b i *(ψ) among the subset SUB(α), provided that h(α)=1, . . . , H(α), Ψ denotes an integer equal to or greater than 1, ψ denotes an integer equal to or greater than 0 and equal to or smaller than Ψ, ψ=0, . . . , Ψ, n(ψ) denotes an integer equal to or greater than 1, ζ(ψ) denotes an integer equal to or greater than 0, a generator of a cyclic group G 2 is denoted by g 2 , and the basis vectors are n(ψ)+ζ(ψ)-dimensional basis vectors b i *(ψ)=(θ(ψ, i, 1)·g 2 , . . . , θ(ψ, i, n(ψ)+ζ(ψ))·g 2 )εG 2 n(ψ)+ζ(ψ) for θ(ψ, i, β), where i=1, . . . , n(ψ)+ζ(ψ), β=1, . . . , n(ψ)+ζ(ψ), n(ψ)≧1, ζ(ψ)≧1, the elements of the basis vectors b i *(ψ) are n(ψ)+ζ(ψ) elements of the cyclic group G 2 .
14. An acquisition apparatus, comprising:
a reconstruction unit that generates reconstructed secret values SUBSK(ψ, α) for each subset SUB(α) from a plurality of share secret values DSH(ψ, α, h(α)) for the subset SUB(α) by performing a reconstruction processing for the subset SUB(α) according to a predetermined secret sharing scheme, provided that Ψ denotes an integer equal to or greater than 1, ψ denotes an integer equal to or greater than 0 and equal to or smaller than Ψ, ψ=0, . . . , Ψ, SUB(α) denotes the subset consisting of H(α) share management apparatuses PA(α, 1), . . . , PA(α, H(α)), α=1, . . . , L, L≧2, h(α)=1, . . . , H(α), H(α)≧2; and
a synthesis unit that generates generation information D*(ψ) from the reconstructed secret values SUBSK(ψ, α), wherein
SUBSK (0,α)=− SE (α)· b i *(0)+Σ t=2 I coef t (0,α)· b t *(0),
and
SUBSK (λ,α)=(share(λ,α)+coef(λ,α)+ v 1 (λ))· b 1 *(λ)±Σ t=2 n(λ) coef(λ,α)· v t (λ)· b t *(λ)±Σ t=n(λ)+1 n(λ)+ζ(λ) coef t (λ,α)· b t *(λ),
or
SUBSK (λ,α)=share(λ,α)·Σ t=1 n(λ) v 1 (λ)· b 1 *(λ)±Σ t=n(λ)+1 n(λ)+ζ(λ) coef t (λ,α)· b 1 *(λ),
where
coef 1 (0, α), coef(λ, α), coef t (λ, α), SE(α) and share(λ, α) are common information, λ denotes an integer equal to or greater than 1 and equal to or smaller than Ψ, λ=1, . . . , Ψ, b i *(ψ) are basis vectors, i=1, . . . , n(ψ)+ζ(ψ), n(ψ) denotes an integer equal to or greater than 1, ζ(ψ) denotes an integer equal to or greater than 0, v(λ) → =(v 1 (λ), . . . , v n(λ) (λ)) are n(λ)-dimensional vectors, and I is a constant equal to or greater than 2 and equal to or smaller than n(0)+ζ(0).
15. A secret sharing method performed by a sharing apparatus, Σ α=1 L h(α) share management apparatuses PA(α, h(α)), where α=1, . . . , L, L≧2, h(α)=1, . . . , H(α), H(α)≧2, and an acquisition apparatus, the method comprising:
(A) a step of independently sharing, at the sharing apparatus, a value corresponding to each element θ(ψ, i, β)·g 2 of basis vectors b i *(ψ) among each subset SUB(α) consisting of H(α) share management apparatuses PA(α, 1), . . . , PA(α, H(α)) according to a predetermined secret sharing scheme to generate share information SH(ψ, i, β, α, h(α)) corresponding to each element θ(ψ, i, β)·g 2 and the share management apparatuses PA(α, h(α)), where h(α) 1, . . . , H(α), provided that Ψ denotes an integer equal to or greater than 1, ψ denotes an integer equal to or greater than 0 and equal to or smaller than Ψ, ψ=0, . . . , Ψ, n(ψ) denotes an integer equal to or greater than 1, ζ(ψ) denotes an integer equal to or greater than 0, a generator of a cyclic group G 2 is denoted by g 2 , and the basis vectors b i *(ψ)=(θ(ψ, i, 1)·g 2 , . . . , θ(ψ, i, n(ψ)+ζ(ψ))·g 2 )εG 2 n(ψ)+ζ(ψ) are an n(ψ)+ζ(ψ)-dimensional basis vectors for θ(ψ, i, β), where i=1, . . . , n(ψ)+ζ(ψ), β=1, . . . , n(ψ)+ζ(ψ), n(ψ)≧1, ζ(ψ)≧1, the elements of the basis vectors b i *(ψ) are n(ψ)+ζ(ψ) elements of the cyclic group G 2 ;
(B) a step of receiving the share information SH(ψ, i, β, α, h(α)) corresponding to the share management apparatuses PA(α, h(α)), at each of the share management apparatuses PA(α, h(α)), and generating, at each of the share management apparatuses PA(α, h(α)), share secret values DSH(ψ, α, h(α)) corresponding to the share management apparatuses PA(α, h(α)) by performing a common calculation common in the subset SUB(α) on common information shared in the subset SUB(α) and the share information SH(ψ, i, β, α, h(α)), where h(α)=1, . . . , H(α);
(C) a step of generating, at the acquisition apparatus, reconstructed secret values SUBSK(ψ, α) for each subset SUB(α) from a plurality of the share secret values DSH(ψ, α, h(α)) for the subset SUB(α) by performing a reconstruction processing for the subset SUB(α) according to the secret sharing scheme; and
(D) a step of generating, the acquisition apparatus, generation information D*(ψ) from the reconstructed secret values SUBSK(ψ, α).
16. The secret sharing method according to claim 15 , wherein pieces of the common information shared in different subsets SUB(a) are independent from each other.
17. The secret sharing method according to claim 15 , wherein the common calculation is a linear calculation.
18. The secret sharing method according to claim 16 , wherein the common calculation is a linear calculation.
19. The secret sharing method according to claim 15 , wherein the step (D) includes a step of generating the generation information D*(ψ) by a linear combination of the reconstructed secret values SUBSK(ψ, α).
20. The secret sharing method according to claim 16 , wherein the step (D) includes a step of generating the generation information D*(ψ) by a linear combination of the reconstructed secret values SUBSK(ψ, α).
21. The secret sharing method according to claim 17 , wherein the step (D) includes a step of generating the generation information D*(ψ) by a linear combination of the reconstructed secret values SUBSK(ψ, α).
22. The secret sharing method according to claim 18 , wherein the step (D) includes a step of generating the generation information D*(ψ) by a linear combination of the reconstructed secret values SUBSK(ψ, α).
23. The secret sharing method according to claim 15 , 16 , 17 , 18 , 19 , 20 , 21 , or 22 , wherein the value corresponding to each element θ(ψ, i, β)·g 2 of the basis vectors b i *(y) are θ(ψ, i, β),
the common information includes coef t (0, α), coef(λ, α), coef t (λ, α), SE(α) and share(λ, α), provided that λ denotes an integer equal to or greater than 1 and equal to or smaller than Ψ, λ=1, . . . , Ψ, and
the step (B) includes:
(B-1) a step of generating
DSH (0,α, h (α))=− SE (α)· SHb 1 *(0,α, h (α))· g 2 +Σ t=2 I coef t (0,α)· SHb t *(0,α, h (α))· g 2
as a share secret value for ψ=0, provided that
SHb i *(0, α, h(α))=(SH(0, i, 1, α, h(α)), SH(0,i,I, α, h(α)) and I is a constant equal to or greater than 2 and equal to or smaller than n(0)+ζ(0); and
(
B
-
2
)
a
step
of
generating
D
S
H
(
λ
,
α
,
h
(
α
)
)
=
(
share
(
λ
,
α
)
+
coef
(
λ
,
α
)
·
v
1
(
λ
)
)
·
SHb
1
*
(
λ
,
α
,
h
(
α
)
)
·
g
2
+
∑
l
=
2
n
(
λ
)
coef
(
λ
,
α
)
·
v
i
(
λ
)
·
SHb
l
*
(
λ
,
α
,
h
(
α
)
)
·
g
2
+
∑
l
=
n
(
λ
)
+
1
n
(
λ
)
+
ζ
(
λ
)
coef
l
(
λ
,
α
)
·
SHb
l
*
(
λ
,
α
,
h
(
α
)
)
·
g
2
or
D
S
H
(
λ
,
α
,
h
(
α
)
)
=
share
(
λ
,
α
)
·
∑
l
=
1
n
(
λ
)
v
i
(
λ
)
·
SHb
1
*
(
λ
,
α
,
h
(
α
)
)
·
g
2
+
∑
l
=
n
(
λ
)
+
1
n
(
λ
)
+
ζ
(
λ
)
coef
l
(
λ
,
α
)
·
SHb
l
*
(
λ
,
α
,
h
(
α
)
)
·
g
2
as a secret share value for each λ, provided that
SHb i *(λ, α, h(α))=(SH(λ, i, 1, α, h(α)), . . . , SH(λ, i, n(λ)+ζ(λ), α, h(α)) and v(λ) → =(v 1 (λ), . . . , v n(λ) (λ)) are n(λ)-dimensional vectors.
24. The secret sharing method according to claim 15 , 17 , 18 , 19 , 20 , 21 , 22 , or 23 , wherein the value corresponding to each element θ(ψ, i, β)·g 2 of the basis vectors b i *(y) are θ(ψ, i, β)·g 2 ,
the common information includes coef t (0, α), coef(λ, α), coef t (λ, α), SE(α) and share(λ, α), provided that λ denotes an integer equal to or greater than 1 and equal to or smaller than Ψ, λ=1, . . . , Ψ, and
the step (B) includes:
(B-1) a step of generating
DSH (0,α, h (α))=− SE (α)· SHb 1 *(0,α, h (α))+Σ t=2 I coef t (0,α)· SHb t *(0,α, h (α))
as a share secret value for ψ=0, provided that
SHb i *(0, α, h(α))=(SH(0, i, 1, α, h(α)), . . . , SH(0, i, I, α, h(α)) and I is a constant equal to or greater than 2 and equal to or smaller than n(0)+ζ(0); and
(B-2) a step of generating
D
S
H
(
λ
,
α
,
h
(
α
)
)
=
(
share
(
λ
,
α
)
+
coef
(
λ
,
α
)
·
v
1
(
λ
)
)
·
SHb
1
*
(
λ
,
α
,
h
(
α
)
)
+
∑
l
=
2
n
(
λ
)
coef
(
λ
,
α
)
·
v
i
(
λ
)
·
SHb
l
*
(
λ
,
α
,
h
(
α
)
)
+
∑
l
=
n
(
λ
)
+
1
n
(
λ
)
+
ζ
(
λ
)
coef
l
(
λ
,
α
)
·
SHb
l
*
(
λ
,
α
,
h
(
α
)
)
or
D
S
H
(
λ
,
α
,
h
(
α
)
)
=
share
(
λ
,
α
)
·
∑
l
=
1
n
(
λ
)
v
i
(
λ
)
·
SHb
1
*
(
λ
,
α
,
h
(
α
)
)
+
∑
l
=
n
(
λ
)
+
1
n
(
λ
)
+
ζ
(
λ
)
coef
l
(
λ
,
α
)
·
SHb
l
*
(
λ
,
α
,
h
(
α
)
)
as a secret share value for each λ, provided that
SHb i *(λ, α, h(α))=(SH(λ, i, 1, α, h(α)), . . . , SH(λ, i, n(λ)+ζ(λ), α, h(α)) and v(λ) → =(v 1 (λ), . . . , v n(λ) (λ)) are n(λ)-dimensional vectors.
25. The secret sharing method according to claim 23 wherein the step (C) includes:
(C-1) a step of generating
SUBSK (0,α)=− SE (α)· b 1 *(0)+Σ t=2 I coef t (0,α)· b i *(0)
as a reconstructed secret value for ψ=0; and
(C-2) a step of generating
S
U
B
S
K
(
λ
,
α
)
=
(
share
(
λ
,
α
)
+
coef
(
λ
,
α
)
·
v
1
(
λ
)
)
·
b
1
*
(
λ
)
+
∑
l
=
2
n
(
λ
)
coef
(
λ
,
α
)
·
v
l
(
λ
)
·
b
l
*
(
λ
)
+
∑
l
=
n
(
λ
)
+
1
n
(
λ
)
+
ζ
(
λ
)
coef
l
(
λ
,
α
)
·
b
l
*
(
λ
)
or
S
U
B
S
K
(
λ
,
α
)
=
share
(
λ
,
α
)
·
∑
l
=
1
n
(
λ
)
v
i
(
λ
)
·
b
1
*
(
λ
)
+
∑
l
=
n
(
λ
)
+
1
n
(
λ
)
+
ζ
(
λ
)
coef
l
(
λ
,
α
)
·
b
l
*
(
λ
)
as a reconstructed secret value for each λ.
26. The secret sharing method according to claim 24 , wherein the step (C) includes:
(C-1) a step of generating
SUBSK ( 0 ,α)=− SE (α)· b 1 *(0)+Σ t=2 I coef t (0,α)· b t *(0)
as a reconstructed secret value for ψ=0; and
(C-2) a step of generating
S
U
B
S
K
(
λ
,
α
)
=
(
share
(
λ
,
α
)
+
coef
(
λ
,
α
)
·
v
1
(
λ
)
)
·
b
1
*
(
λ
)
+
∑
l
=
2
n
(
λ
)
coef
(
λ
,
α
)
·
v
l
(
λ
)
·
b
l
*
(
λ
)
+
∑
l
=
n
(
λ
)
+
1
n
(
λ
)
+
ζ
(
λ
)
coef
l
(
λ
,
α
)
·
b
l
*
(
λ
)
or
S
U
B
S
K
(
λ
,
α
)
=
share
(
λ
,
α
)
·
∑
l
=
1
n
(
λ
)
v
i
(
λ
)
·
b
1
*
(
λ
)
+
∑
l
=
n
(
λ
)
+
1
n
(
λ
)
+
ζ
(
λ
)
coef
l
(
λ
,
α
)
·
b
l
*
(
λ
)
as a reconstructed secret value for each λ.
27. A non-transitory computer-readable recording medium that stores a program that makes a computer function as a share management apparatus according to claim 13 .
28. A non-transitory computer-readable recording medium that stores a program that makes a computer function as an acquisition apparatus according to claim 14 .