Abelian sharing, common informations, and linear rank inequalities

Carolina Mejia; Juan Andres Montoya

doi:10.1515/jmc-2022-0020

Article Open Access

Abelian sharing, common informations, and linear rank inequalities

Carolina Mejia and Juan Andres Montoya

Published/Copyright: August 17, 2022

Published by

Become an author with De Gruyter Brill

Submit Manuscript Author Information Explore this Subject

From the journal Journal of Mathematical Cryptology Volume 16 Issue 1

Abstract

Dougherty et al. introduced the common information (CI) method as a method to produce non-Shannon inequalities satisfied by linear random variables, which are called linear rank inequalities. This method is based on the fact that linear random variables have CI. Dougerthy et al. asked whether this method is complete, in the sense that it can be used to produce all linear rank inequalities. We study this question, and we attack it using the theory of secret sharing schemes. To this end, we introduce the notions of Abelian secret sharing scheme and Abelian capacity. We prove that: If there exists an access structure whose Abelian capacity is smaller than its linear capacity, then the CI method is not complete. We investigate the existence of such an access structure.

Keywords: secret sharing; polymatroids; linear rank inequalities

MSC 2010: 94D99

1 Introduction

This work is mainly devoted to the following three topics:

Linear information inequalities.
The common information (CI) method.
Secret sharing schemes.

Linear information inequalities are the linear inequalities satisfied by Shannon entropy. It has been said that linear information inequalities are the fundamental laws of information processing. The true fact is that those inequalities are important tools in the analysis of communication networks [22]. This follows from the following fact:

Let G be a network topology, and let P G be a communication problem related to G . The set of solutions for P G can be suitably represented as the set of functions that satisfy all linear information inequalities plus some additional constraints that depend on G .

Access structures are a special type of network topology. An access structure is a pair C = ( P , A ) , where P is a finite set of parties and A ⊂ Pow ( P ) . Moreover, the set A must be upward closed as it is supposed to be constituted by the large authorized subsets of P . The sharing problem P C is to distribute, to the parties in P , the shares of a secret s . The distribution protocol should guarantee the following:

Large authorized sets of shareholders can reconstruct the secret.
Small sets of shares convey zero information about the secret.

Distribution protocols that fulfill both conditions are called secret sharing schemes. Secret sharing schemes are the backbone of most protocols for secure multiparty computation. Therefore, it is important to construct efficient schemes for different access structures. We say that a secret sharing scheme is efficient when the shares can be quickly computed, when the secret can be quickly reconstructed, and when the sizes of the shares are close to the size of the secret. We are interested in efficient secret sharing schemes that can be constructed with linear maps or some more general types of algebraic morphisms.

Linear secret sharing schemes are the sharing schemes that are built using linear maps. The random variables that are determined by those schemes are called linear random variables. Those random variables satisfy all linear information inequalities and some other inequalities that are specific for the linear world. We use the term linear rank inequalities to designate the linear inequalities that are satisfied by linear random variables. The analysis of an access structure C = ( P , A ) over n parties forces us to consider a set of n + 1 linear random variables that model the secret, the shares, and the topology of C . The same analysis forces us to work with the linear rank inequalities that involve n + 1 random variables. We would like to generate all those inequalities. It is natural to ask: Is the set of linear rank inequalities spanned by Shannon inequalities?

Ingleton discovered, long time ago, the first non-Shannon inequality satisfied by linear random variables [11]. We know that there are many non-Shannon linear rank inequalities. We also know that we need all of them to prove tight bounds for linear secret sharing over general access structures. Can we enumerate all those inequalities?

Dougherty et al. introduced the CI method as a method to produce non-Shannon linear rank inequalities [8]. This method is based on the fact that linear random variables have CI [10]. We observed earlier:

If there exists a class of random variables, which is larger than the class of linear random variables, which have common information, and which outperforms the class of linear random variables. Then, the CI method cannot be complete.

This is the starting point of our investigations [16]. We introduced the novel notions of Abelian random variable, Abelian secret sharing scheme, and Abelian capacity [17]. We introduced those notions as a way of copying with the question of Dougherty et al. [18]. In this work, we prove that:

Suppose that there exists an access structure over n parties whose Abelian capacity is smaller than its linear capacity. Then, the CI method cannot produce all the linear rank inequalities over n + 1 variables.

We investigate the validity of the hypothesis, that is: we study the existence of access structures for which Abelian secret sharing outperforms linear secret sharing.

Relations to previous studies, contributions, and organization of the article.

This work is related to the research on linear information inequalities and linear rank inequalities [8]. We cope, in this study and in previous research, with a question of Dougherty et al. that is related to the completeness of the CI method [8]. This question led us to consider Abelian secret sharing schemes and to study the relations of those sharing schemes with linear secret sharing schemes [18]. The latter type of schemes has been profusely studied in the related literature (see [1] and references therein). We introduced the notions of Abelian random variable, Abelian secret sharing scheme, and Abelian capacity. We cannot find those exact notions in the previous literature. However, the idea of Abelian secret sharing is implicit in many previous studies related to secret sharing. The very basic idea of using Abelian groups to construct secret sharing schemes occurs many times in the research on homomorphic secret sharing schemes (see [2] and references therein). We say that a secret sharing scheme is homomorphic, if and only if, the secret and the shares are elements of suitable algebraic structures, and all the functions used in the scheme are homomorphisms (i.e., the functions that compute the shares, and the function that reconstructs the secret from the shares are homomorphisms). Homomorphic schemes are important in the construction of voting protocols and some other types of multiparty protocols [2]. Liu and Zhou studied the construction of homomorphic secret sharing schemes over cyclic groups [14]. Those authors were able to characterize the access structures that admit ideal homomorphic secret sharing schemes over cyclic groups. Recall that a secret sharing scheme is ideal, if and only if, it achieves the best possible information ratio, which is as a matter of fact equal to 1 (for the definition and characterization of ideal schemes see [3] and references therein).

It is important to stress that most of the aforementioned studies focus on cyclic groups. Desmedt and Fraenkel consider secret sharing schemes over general Abelian groups [5]. However, they did not construct secret sharing schemes using the pure algebraic structure of those groups. They used the algebra of finite Abelian groups to construct scrambled versions of Shamir’s scheme [6]. Those scrambled versions of Shamir’s scheme are linear schemes that hold a further property, namely, zero-knowledge [7]. We would like to stress that the sharing schemes constructed by Desmedt and Fraenkel are not Abelian schemes. We define Abelian secret sharing schemes as the secret sharing schemes that can be entirely constructed from a tuple of group homomorphisms defined over the same Abelian group. We use the term Abelian arrangement to designate those tuples. Abelian arrangements naturally occur in the representation theory of entropic vectors [4]. If we say that the secret sharing scheme D is obtained from the Abelian arrangement A , then the connection is transparent, since A is nothing less than a full set of assembly instructions for D : A includes all the details and all the mappings that are necessary for the construction of A . The sharing schemes of Desmedt and Fraenkel cannot be represented this way over the Abelian groups that are used in the construction. Those sharing schemes are linear schemes that can be represented over vector spaces, which in turn are constructed from the groups using tensor products.

We would say that our goal is to establish the superiority of Abelian schemes. We would like to find Abelian schemes that outperform all their linear counterparts. It could happen that this separation cannot be achieved with ideal schemes. Therefore, we cannot focus on ideal schemes and much less on access structures that are known to admit linear ideal schemes. Most of the previous studies on homomorphic secret sharing using groups focus on ideal secret sharing schemes [14]. Desmedt and Fraenkel focus on ideal schemes over threshold access structures [3]. It is well-known that those access structures admit ideal schemes that are linear.

Remark 1

We are obligated to mention the work of Jafari and Khazaei [13]. Jafari and Khazaei studied Abelian sharing in its full generality. Those authors arrived to the notion of Abelian sharing at the same time as us, independently, and motivated by different questions.

We have to observe that linear secret sharing schemes constitute a subset of the set of Abelian secret sharing schemes (any vector space is an Abelian group). Thus, if we are asked to provide examples of Abelian schemes, we can pick any linear scheme and present it as the requested example. However, we would like to remark that we do not know the construction of a nonlinear scheme based on Abelian groups. We study along the text a construction that is based on Chinese remaindering, which gets close to be a secret sharing scheme [19]. We discuss this construction in some depth and we show that it does not provide perfect secrecy.

The remainder of this article is organized into seven sections. In Section 1, we introduce linear polymatroids and linear random variables. In Section 2, we introduce the CI method and we use it to derive Ingleton inequality. In Section 3, we introduce a formal description of the CI method as an algorithm. In Section 4, we introduce Abelian polymatroids and Abelian random variables. We show that those random variables satisfy the linear inequalities that can be derived using the CI method. We conclude that tuples of random variables that violate some linear rank inequalities are witnesses of the conjectured incompleteness of the CI method. In Section 5, we introduce Abelian secret sharing. We begin in this section the search for Abelian secret sharing schemes that cannot be represented as linear schemes. In section 6 we study the connections between Abelian secret sharing, the existence of nonlinear schemes, and the completeness of the CI method complete. We finish in Section 7 asking some questions and sketching some concluding remarks.

2 Linear polymatroids and linear random variables

We introduce the notions of linear polymatroid, linear rank inequality, and linear random variable. All those notions are closely related to each other.

Definition 2

A function h : ( ℘ ( [ n ] ) − ∅ ) → R + is a polymatroid, if and only if, it satisfies all Shannon information inequalities [22].

Polymatroids are abstract objects but some of them have concrete representations by entropies of random variables. We say that those latter polymatroids are entropic polymatroids. The set of all entropic polymatroids encodes the solutions to all communication problems one can figure out. The entropic vectors that admit algebraic representations are of special interest. We are interested in linear polymatroids. Those are the polymatroids that can be represented by linear spaces, and those are the polymatroids that encode solutions to communication problems that entirely depend on linear algebra.

Definition 3

A linear polymatroid of order n is a polymatroid h : ( ℘ ( [ n ] ) − ∅ ) → R + for which there exists a tuple ( V , π 1 , … , π n ) such that:

V is a finite vector space.
π 1 , … , π n are linear maps with domain V .
For all I ∈ ( ℘ ( [ n ] ) − ∅ ) the equality
h ( I ) = log V ⋂ i ∈ I ker ( π i )
holds.

Linear polymatroids come from linear random variables.

Definition 4

Let ( V , π 1 , … , π n ) be a tuple as above, let X V be a random variable that is uniformly distributed over V , and let X 1 , … , X n be the random variables that are induced by X V over the quotients V ker ( π 1 ) , V ker ( π 2 ) , … , V ker ( π n ) . We say that the tuple ( X V , X 1 , … , X n ) is a tuple of linear random variables, and any tuple of linear random variables is constructed in this way from a suitable tuple of linear maps.

Notation 5

The symbol H ( X I ) denotes the joint entropy of the tuple ( X i ) i ∈ I .

We have the following basic result [16]:

Theorem 6

Let ( X V , X 1 , … , X n ) be a tuple of linear random variables, the function h : ( ℘ ( [ n ] ) − ∅ ) → R + that is defined by

h ( I ) = H ( X I ) ,

is a linear polymatroid, and all linear polymatroids have entropic representations.

We obtain that linear polymatroids are the entropic vectors of tuples of linear random variables. Those polymatroids constitute a subset of the set of entropic vectors, satisfy all linear inequalities satisfied by those vectors, and satisfy some additional inequalities that are specific for the linear world.

Notation 7

Let F be a field, and let v , w ∈ F k . We use the symbol ⟨ v ∣ w ⟩ to denote the scalar product of v and w , which is defined by

⟨ v ∣ w ⟩ = v 1 w 1 + v 2 w 2 + … + v k w k ,

where the arithmetical operations are computed on F .

We write h ( i ) instead of h ( { i } ) , whenever h is a polymatroid and i is an element of its domain. Moreover, if I , J ⊂ [ n ] , we write I J instead of I ∪ J .

Definition 8

(Linear rank inequalities). Linear rank inequalities are the linear inequalities satisfied by the entropic vectors of linear random variables, that is: a linear rank inequality of order n is a vector v ∈ R 2 n − 1 such that for all linear polymatroids h ∈ R 2 n − 1 the inequality ⟨ h ∣ v ⟩ ≥ 0 holds.

The class of linear rank functions is a well-known class of functions coming from matroid theory and representation theory (see [20] and references therein).

Definition 9

A linear rank function of order n is a function r : ( ℘ ( [ n ] ) − ∅ ) → R + that admits a linear representation. A linear representation of r is a tuple ( V , V 1 , … , V n ) that satisfies the following conditions:

V is a finite vector space and V 1 , … , V n are subspaces of V .
For all I ∈ ( ℘ ( [ n ] ) − ∅ ) , the equality
r ( I ) = dim ( ⟨ ⋃ i ∈ I V i ⟩ )
holds.

Notation 10

Let A ⊂ R k , we use the symbol c h ( A ) to denote the convex hull of A .

We use the symbol ℒℛℱ n to denote the set of linear rank functions of order n , and we use the symbol ℒP n to denote the set of linear polymatroids of order n .

We have [16]:

Theorem 11

Let n ≥ 0 , the following facts hold true:

The equality c h ( ℒℛℱ n ) = c h ( ℒP n ) holds.
The set of linear rank inequalities of order n is equal to the set of linear inequalities that are satisfied by linear rank functions of the same order, that is: linear rank inequalities are the inequalities satisfied by dimensions of vector spaces.

Definition 12

We use the symbol ℒ n to denote the set

{ v ∈ R 2 n − 1 : v is a linear rank inequality } ,

and we say that it is the linear region of order n .

It is easy to check that ℒ n is a convex cone. It can also be checked that ℒ 3 is equal to the set of Shannon inequalities over three variables, which in turn is equal to the set of linear information inequalities over the same number of variables [16]. However, the symmetry is lost at n = 4 :

The set ℒ 4 is a polyhedral cone spanned by Shannon inequalities plus six non-Shannon inequalities called Ingleton inequalities. We use the symbol Γ n to denote the polyhedral cone spanned by the Shannon inequalities over n variables. We obtain that Γ 4 ⊂ ℒ 4 .
Matuš proved that given n ≥ 4 the set of linear information inequalities over n random variables is not polyhedral [15]. We obtain that ℒ 4 ⊂ ℐ 4 , where ℐ 4 is the set of linear information inequalities over four random variables.

The linear region of order five is a polyhedral cone [8]. However, the geometrical complexity of the linear cones seems to grow dramatically with n :

The cone ℒ 5 is spanned by several thousands of extreme rays [8].
Dougherty reported on the existence of more than a billion of non-Shannon linear rank inequalities of order six, which are independent, and which do not span the linear region of order six [9].

Thus, it is natural to ask: Are the linear regions polyhedral cones?

3 Ingleton inequality and the CI method

We introduce, in this section, the CI method [8]. We use this method to prove that there exist non-Shannon inequalities that are satisfied by all linear polymatroids or, equivalently, by all linear rank functions.

Definition 13

Given random variables X 1 , … , X n and given two sets I , J ⊆ [ n ] , a CI for X I and X J is a random variable Y such that:

H ( Y ∣ X I ) = H ( Y ∣ X J ) = 0 and
H ( Y ) = H ( X I ) + H ( X J ) − H ( X I J ) .

Gács and Körner proved that CI are not common: most pairs of random variables do not have CI [10]. On the other hand, linear random variables do have CI:

Theorem 14

Let ( X V , X 1 , … , X n ) be a tuple of linear random variables, and let I , J ⊆ [ n ] . The joint random variables X I , X J have CI.

Proof

Suppose that ( X V , X 1 , … , X n ) is determined by the tuple ( V , π 1 , … , π n ) . Set W = ⟨ ⋃ k ∈ I J ker ( π k ) ⟩ , and let X I , J be equal to the random variable that is induced by X over the quotient V W . It is easy to check that X I , J is the CI of X I and X J .□

Notation 15

Let n ≥ 1 , we use the set { I : I ∈ ℘ ( [ n ] ) − ∅ } as the set of indices of the canonical basis of R 2 n − 1 . We use this labeling of the canonical basis to express an entropic vector ( H ( X I ) ) I ⊆ [ n ] as a linear combination ∑ I ⊆ [ n ] H ( X I ) ⋅ e I .

Definition 16

(Ingleton vector) The Ingleton vector is the 15-dimensional vector:

ℐ = − ( e 1 + e 2 + e { 1 , 2 , 3 } + e { 1 , 2 , 4 } + e { 3 , 4 } ) + e { 1 , 3 } + e { 1 , 4 } + e { 2 , 3 } + e { 2 , 4 } + e { 1 , 2 } .

Theorem 17

The Ingleton vector is a linear rank inequality, that is: for all linear rank functions of order 4, say the function f , the inequality ⟨ ℐ ∣ f ⟩ ≥ 0 holds.

Proof

Let α be equal to the vector

− ( e { 1 , 2 , 3 } + e { 1 , 2 , 4 } + + e { 3 , 4 } + 2 e 1 + 2 e 2 + e 5 ) + e { 1 , 3 } + e { 1 , 4 } + e { 2 , 3 } + e { 2 , 4 } + 2 e { 1 , 5 } + 2 e { 2 , 5 } .

It can be checked that α encodes a Shannon inequality that holds for all the entropic polymatroids of order 5. Let V = ( V , π 1 , … , π 4 ) be a linear tuple, and let ( X V , X 1 , … , X 4 ) be the associated tuple of linear random variables. We suppose that X 5 is a CI of X 1 and X 2 . We have that

− ( H ( X 1 , 2 , 3 ) + H ( X 1 , 2 , 4 ) + H ( X 3 , 4 ) + 2 H ( X 1 ) + 2 H ( X 2 ) + H ( X 5 ) ) + H ( X 1 , 3 ) + H ( X 1 , 4 ) + H ( X 2 , 3 ) + H ( X 2 , 4 ) + 2 H ( X 1 , 5 ) + 2 H ( X 2 , 5 ) ≥ 0 .

If we use the hypothesis ( X 5 is the CI of X 1 and X 2 ), we obtain that

⟨ h V , ℐ ⟩ = − ( H ( X 1 ) + H ( X 2 ) + H ( X 1 , 2 , 3 ) + H ( X 1 , 2 , 4 ) + H ( X 3 , 4 ) ) + H ( X 1 , 3 ) + H ( X 1 , 4 ) + H ( X 2 , 3 ) + H ( X 2 , 4 ) + H ( X 1 , 2 ) ≥ 0 .

The theorem is proved.□

It can be checked that Ingleton’s inequality is not spanned by Shannon inequalities [22]. Thus, given n ≥ 4 , the linear region ℒ n is not equal to the set of Shannon inequalities of order n .

Remark 18

One can obtain six different linear rank inequalities from the vector ℐ . Those six inequalities can be obtained from ℐ by suitably permuting the variables X 1 , … , X 4 .

Note that the above proof entails a method for generating linear rank inequalities. This method is called the CI method.

4 The CI method

Let h be a linear polymatroid of order n , let ( V , π 1 , … , π n ) be a linear representation of h , and let ( X V , X 1 , … , X n ) be the tuple of linear random variables determined by this representation. Given I , J ⊆ [ n ] , the random variables X I and X J have CI. This fact is the basis of the CI method.

Definition 19

Let n ≥ 1 , let J , K ⊆ [ n ] , and let v = ∑ I ⊆ [ n + 1 ] a I e I be a linear rank inequality of order n + 1 . The vector v belongs to Δ J , K n + 1 ⊂ ℒ n + 1 , if and only if, the following two conditions are satisfied:

Let R ⊆ [ n + 1 ] , and suppose that a R ≠ 0 and { n + 1 } ⊂ R . Then,
R ∈ { J ∪ { n + 1 } , K ∪ { n + 1 } , { n + 1 } } .
The equalities
a J { n + 1 } = a J , a K { n + 1 } = a K and a { n + 1 } = a J + a K − a J K
hold.

Observe that we use a linear projection from ℒ 5 to ℒ 4 to obtain Ingleton inequality. The set Δ J , K n + 1 is constituted by linear rank inequalities of order n + 1 to which we can apply a similar projection. Let us define this projection:

Definition 20

Given v ∈ Δ J , K n + 1 , we define T J , K n + 1 ( v ) = ∑ I ⊆ [ n ] a I ∗ e I , where

a I ∗ = a J + a J { n + 1 } + a { n + 1 } , if I = J a K + a K { n + 1 } + a { n + 1 } , if I = K a J K − a { n + 1 } , if I = J ∪ K a I , otherwise .

Note that for all J , K ⊆ [ n ] the function T J , K n + 1 is a linear map. Those linear maps are the projections that are employed in the CI method. Next theorem asserts that given v ∈ Δ J , K n + 1 , the vector T J , K n + 1 ( v ) is a linear rank inequality of order n . This is the mathematical core of the method.

Theorem 21

Suppose that v ∈ Δ J , K n + 1 , we have that T J , K n + 1 ( v ) ∈ ℒ n .

Proof

Let v ∈ Δ J , K n + 1 and suppose that T J , K n + 1 ( v ) ∉ ℒ n . There exists a tuple of linear random variables X → = ( X V , X 1 , … , X n ) , such that ⟨ h X → , T J , K n + 1 ( v ) ⟩ < 0 . Consider the tuple Y → = ( X V , X 1 , … , X n , X n + 1 ) , where X n + 1 is a CI of X I and X J . It is easy to check that the equality ⟨ h Y → , v ⟩ = ⟨ h X → , T J , K n + 1 ( v ) ⟩ holds. It implies that ⟨ v , h Y → ⟩ < 0 . Then, we have that v is not a linear rank inequality, but this is a contradiction. The theorem is proved.□

Example 22

(Ingleton inequality) Let α be equal to

− ( e { 1 , 2 , 3 } + e { 1 , 2 , 4 } + + e { 3 , 4 } + 2 e 1 + 2 e 2 + e 5 ) + e { 1 , 3 } + e { 1 , 4 } + e { 2 , 3 } + e { 2 , 4 } + 2 e { 1 , 5 } + 2 e { 2 , 5 }

It can be checked that α ∈ Δ { 1 } , { 2 } 5 , and it can also be checked that

T { 1 } , { 2 } 5 ( α ) = − ( e 1 + e 2 + e { 1 , 2 , 3 } + e { 1 , 2 , 4 } + e { 3 , 4 } ) + e { 1 , 3 } + e { 1 , 4 } + e { 2 , 3 } + e { 2 , 4 } + e { 1 , 2 }

It follows from Theorem 21 that the vector T { 1 } , { 2 } 5 ( α ) is a linear rank inequality. Note that this linear rank inequality is the aforementioned Ingleton inequality [11], which was the first ever discovered non-Shannon inequality that holds for all linear polymatroids.

Let ℐCℐ be the set of linear inequalities that are satisfied by the tuples of random variables that have CI. The above method can be easily turned into an algorithm that recursively enumerates a spanning set for ℐCℐ (see [16]). Dougherty et al. used this algorithm to produce a spanning set for the cone ℒ 5 , a spanning set that is constituted by several thousands of linear rank inequalities [8]. Dougherty et al. used the same algorithm to search for linear rank inequalities over six variables, and he reported on the discovering of more than one billion of those inequalities, which are independent and which do not span the cone ℒ 6 (see [9]). Dougherty et al. asked the following two questions [8]:

Are the linear regions polyhedral cones?
Is the CI method a complete method?

We consider that those two questions are the most important open problems related to the structure of the linear regions. From now on we focus on the second question. We attack this question using the following strategy:

We detect a class of random variables that contain all the linear random variables. We use the term Abelian random variables to designate this new type of random variables.
We prove that Abelian random variables have CI.
We investigate the following question: Does there exist a linear rank inequality that is violated by a suitable tuple of Abelian random variables?

Linear random variables come from vector spaces. Then, if we want to detect a larger set of random variables, we can try with a larger set of algebraic structures that behave similar to vector spaces. Abelian groups constitute a possible choice. We prove that the random variables determined by Abelian groups have CI. Then, we cope with the question about the existence of a linear rank inequality that is violated by Abelian variables. We use the theory of secret sharing schemes to deal with this latter question.

5 Abelian polymatroids and Abelian random variables

We know that entropic polymatroids can be suitably represented by group arrangements [4]. What are the entropic polymatroids that can be represented using Abelian groups?

Definition 23

An Abelian arrangement of order n is a tuple G = ( G , π 1 , … , π n ) such that:

G is a finite Abelian group.
π i is a group homomorphism with domain G .

Given an Abelian arrangement G , it determines a polymatroid of order n that is denoted by the symbol h G , and such that for each I ⊆ [ n ] the equality

h G ( I ) = log G ⋂ i ∈ I ker ( π i )

holds. We say that h G is an Abelian polymatroid, and we say that G is an Abelian representation of h G .

Definition 24

Given an Abelian arrangement G = ( G , π 1 , … , π n ) , we use the symbol X G to denote a random variable that is uniformly distributed over G . Given i ≤ n , we use the symbol X i to denote the random variable that is induced by X G over the quotient G ker ( π i ) . Set X G = ( X G , X 1 , … , X n ) . We say that X G is a tuple of Abelian random variables.

Remark 25

A reviewer pointed out to us that the notions of Abelian arrangement and Abelian random variable can be entirely given in terms of subgroups. Note that all that we use of π i is the subgroup ker ( π i ) . Note that the same is true of linear arrangements and linear random variables. It could be more natural to think in substructures instead of homomorphisms but we prefer to stick with this presentation. We do this since we want to use algebraic arrangements to construct secret sharing schemes. And it happens that the mappings that constitute our arrangements are all the mappings that we use in the secret sharing schemes that we extract from those algebraic arrangements.

We prove that Abelian variables have CI. We need a famous lemma from group theory that is called The Product Lemma.

Lemma 26

Let G be a finite Abelian group, and let K , R be two subgroups of G . We have that ∣ ⟨ K ∪ R ⟩ ∣ = ∣ K ∣ ∣ R ∣ ∣ R ∩ K ∣ .

Proof

Let P = K × R . Note that ∣ P ∣ = ∣ K ∣ ∣ R ∣ . Let ϕ : P → ⟨ K ∪ R ⟩ be the homomorphism defined by ϕ ( x , y ) = x y . Note that ker ( ϕ ) is equal to the set

{ ( y , y − 1 ) : y ∈ K ∩ R } .

We obtain that ∣ ⟨ K ∪ R ⟩ ∣ = ∣ K ∣ ∣ R ∣ ∣ R ∩ K ∣ .□

Theorem 27

Abelian random variables have CI.

Proof

Let X G = ( X G , X 1 , … , X n ) be an Abelian tuple, and let G = ( G , π 1 , … , π n ) be an Abelian arrangement that defines the tuple X G . Pick I ⊆ [ n ] , we have that X I , which is the join random variable determined by the set { X i : i ∈ I } , is equal to the random variable that is induced by X G over the quotient G ⋂ i ∈ I ker ( G i ) .

Let I , J ⊆ [ n ] , we have to prove that the pair ( X I , X J ) has CI, that is: we have to define a random variable Z such that:

I ( X I : X J ) = H ( Z ) ,
H ( Z ∣ X I ) = H ( Z ∣ X J ) = 0 .

To this end, we define a subgroup L ⊴ G such that Z is the random variable induced by X over G L . The second condition on Z indicates that ⋂ i ∈ I ker ( π i ) and ⋂ i ∈ J ker ( π i ) must be contained in L , while the first condition suggests that L must be as small as possible. We set L = ⟨ ( ⋂ i ∈ I ker ( π i ) ) ∪ ( ⋂ i ∈ J ker ( π i ) ) ⟩ . Let K = ⋂ i ∈ I ker ( π i ) and R = ⋂ i ∈ J ker ( π i ) . We have

I ( X I : X J ) = H ( X I ) + H ( X J ) − H ( X I , X J ) = log G K + log G R − log G K ∩ R = log ∣ G ∣ ∣ R ∩ K ∣ ∣ K ∣ ∣ R ∣ = log ∣ G ∣ ∣ ⟨ K ∪ R ⟩ ∣ = H ( Z ) .

It is easy to check that H ( Z ∣ X I ) = H ( Z ∣ X J ) = 0 .□

Definition 28

We use the symbol AP n to denote the set of Abelian polymatroids of order n .

We have ℒP n ⊆ AP n : any linear polymatroid is an Abelian polymatroid. On the other hand, we have:

Proposition 29

There exist Abelian polymatroids that are not linear.

Proof

Let M , N be two linear matroids of the same order. We can suppose that M does not have linear representations over fields of characteristic two. We can also suppose that N does not have linear representations over fields whose characteristic is odd [20].

Let ( V , π 1 , … , π n ) and ( W , σ 1 , … , σ n ) be linear representations of the above two matroids, and let h V , h W be the corresponding linear polymatroids. We set G = V × W , and given i ≤ n we define a function

π i × σ i : V × W → Im ( π i ) × Im ( σ i )

by means of the equation

( π i × σ i ) ( g , h ) = ( π i ( g ) , σ i ( h ) ) .

The product ( G , π 1 × σ 1 , … , π n × σ n ) is an Abelian arrangement, and we have that h G = h V + h W . We obtain that h V + h W ∈ AP n and h V + h W ∉ ℒP n . The proposition is proved.□

We would like to prove that there exists a linear inequality that is satisfied by the elements of ℒP n but which is not satisfied by some element of AP n . We know that ℒP n ⊂ AP n . However, this is not enough: we have to prove that c h ( AP n ) ⊂ c h ( ℒP n ) . How can we prove this? The sets c h ( AP n ) and c h ( ℒP n ) are convex cones. Then, if the containment is strict those two sets are separated by a linear program. We introduced Abelian sharing in our search for those linear problems [16].

6 Abelian secret sharing

Secret sharing schemes are used in secure multiparty computation to distribute shares of a secret into a set of parties. Secret sharing schemes must satisfy some basic requirements:

The secret can be reconstructed from the shares.
No information about the secret can be computed from small sets of shares.

Let us consider an important example of secret sharing scheme.

6.1 Shamir’s secret sharing scheme

Suppose that we want to distribute a secret w ∈ { 0 , 1 } l between a set of m parties. Let n < m , and let U n , m be the set

{ I ⊆ [ m ] : ∣ I ∣ ≥ n } .

We would like to share the secret w in such a way that:

The secret can be reconstructed from any set of n different shares.
n − 1 shares convey zero information about w .

Let us proceed, but let us first introduce the basic definitions of access structure and secret sharing scheme.

Definition 30

An access structure over m parties is a set C ⊂ P ( { 1 , … , m } ) that is upward closed, that is: let I ⊂ J ⊆ { 1 , … , m } and suppose that I ∈ C , we obtain that J ∈ C .

An access structure C determines a collection of large authorized sets.

Example 31

The set U n , m is an example of an access structure over a set of n parties. We say that U n , m is a threshold access structure since the condition that determines which sets of parties are the authorized sets is given by the threshold n .

Recall that we want to construct a secret sharing scheme for the access structure U n , m . Let F be a finite field whose size is larger than max { m + 1 , 2 l } . Note that { 0 , 1 } l can be embedded in F . We can fix such an embedding, and we can assume that the secret to be distributed is an element a of the set F \ { 0 } . The m shares of a are the images of this field element under a suitable set of m functions.

Definition 32

Let V = ( V × W , π 1 , … , π m , π m + 1 ) be a linear arrangement and let h V be the linear polymatroid determined by V . We say that V is a Linear secret sharing scheme for C , if and only if, the following two conditions are satisfied.

Perfect recovery. For all I ∈ C the equality
h V ( I ∪ { m + 1 } ) = h G ( I )
holds.
Perfect secrecy. For all I ∉ C the equality
h V ( I ∪ { m + 1 } ) = h G ( I ) + h G ( m + 1 )
holds.

Let a ∈ F \ { 0 } be the secret, and let a 1 , … , a m be m different nonzero elements of F that are known by the m parties. The dealer can use linear algebra over F to construct a linear secret sharing scheme for the access structure U n , m . First of all, she chooses uniformly at random b n − 2 , … , b 0 ∈ F . She keeps secret this tuple, and then she computes the linear array

S a , b = ( V × W , e v 1 , … , e v m , e v m + 1 ) ,

where:

V is the subspace of F [ X ] spanned by X n − 1 . Note that V is isomorphic to F .
W is the subspace of F [ X ] spanned by X 0 , … , X n − 2 .
Given i ≤ m the linear map e v i : V × W → F is defined by
e v i ( a , b n − 2 , … , b 0 ) = a a i n − 1 + b n − 2 a i n − 2 + ⋯ + b 1 a i + b 0 .
Function e v m + 1 : V × W → V is equal to the linear map
e v m + 1 ( a , b n − 2 , … , b 0 ) = a .

Then, she uses this linear array to distribute the secret a . To do this she proceeds as follows:

The dealer knows the polynomial
p a , b ( X ) = a X n − 1 + b n − 2 X n − 2 + ⋯ + b 1 X + b 0 ,
and she also knows that e v m + 1 ( p a , b ( X ) ) = a .
The dealer uses the above polynomial to compute the shares e v 1 ( p a , b ) , … , e v m ( p a , b ) : she evaluates the functions e v 1 , … . , e v m at the vector p a , b ( X ) ∈ e v m + 1 − 1 ( p a , b ( X ) ) .
Perfect recovery. If we know n shares, we know n points in the graph of p a , b ( X ) , and we know the polynomial. Then, we can compute the secret e v m + 1 ( p a , b ( X ) ) . Thus, if we know p a , b ( X ) the reconstruction of the secret reduces to evaluate e v m + 1 at this vector.
Perfect secrecy. If we know n − 1 shares, we know no more than n − 1 points in the graph of p a , b ( X ) . Let S be this set of n − 1 points and let b ∈ F . We use the symbol Pr ( b ∣ S ) to denote the probability that b is the leading coefficient of p a , b ( X ) given that the graph of p a , b ( X ) contains the set S . It is easy to check that Pr ( b ∣ S ) = 1 ∣ F ∣ . This means that, if we know no more than n − 1 shares, we know nothing about the secret a .

Note that Shamir’s key idea gives us a mechanism to construct secret sharing schemes from linear arrangements that behave as the arrangement S a , b [12]. We can do the same with Abelian arrangements that behave similar to S a , b . In the next section, we explore this possibility and we determine the conditions under which an Abelian arrangement G encodes a secret sharing scheme for an access structure C .

6.2 Abelian secret sharing schemes

Let

G = ( G , π 1 , … , π m , π m + 1 )

be an Abelian arrangement. We can use G to distribute m shares of a secret that belongs to the set G ker ( π m + 1 ) . We use the symbol Σ G to denote this mechanism. Mechanism Σ G works as follows:

Set S = G ker ( π m + 1 ) .
Let s ∈ S be the secret.
The secret dealer computes g ∈ G such that π m + 1 ( g ) = s .
Given i ≤ m , the secret dealer computes π i ( g ) and communicates this share to party i . Thus, the shares of s are π 1 ( g ) , … , π m ( g ) .

Remark 33

Note that in the above distribution mechanism, the dealer does not use something extra to the group structure encoded by G . She only has to compute π m + 1 − 1 ( s ) and the tuple ( π 1 ( π m + 1 − 1 ( s ) ) , … , π m ( π m + 1 − 1 ( s ) ) ) .

Definition 34

We say that G = ( G , π 1 , … , π m , π m + 1 ) is an Abelian distribution scheme for C , if and only if, for all I ∈ C the equality

h G ( I ∪ { m + 1 } ) = h G ( I )

holds.

Example 35

Let us consider an elementary example of an Abelian distribution scheme for the threshold structure U 2 , 2 . Let p , q be two large primes that are close to each other. We use the symbol D c h , p , q to denote the Abelian distribution scheme ( G , π 1 , π 2 , π 3 ) , where:

G = Z p 2 q 2 .
π 1 is the projection of G onto Z p 2 q 2 Z q 2 .
π 2 is the projection of G onto Z p 2 q 2 Z p 2 .
π 3 is the projection of G onto Z p 2 q 2 Z p q .

Let a ∈ { 0 , … , p q − 1 } be the secret. The dealer chooses a random g such that g is equal to l p q + a for some l . Then, the dealer computes b , c such that for some s and t the equalities

g = s q 2 + b = t p 2 + c

hold. Then, she sends share b to party 1 and share c to party 2.

Let us see that D c h , p , q provides perfect recovery. The single authorized set is the set { 1 , 2 } . The shares given to the members of this coalition are b and c . We have that there exists a unique g ∈ G , such that

π 1 ( g ) = b and π 2 ( g ) = c .

This g can be computed from b and c using Chinese remaindering. Moreover, the secret π 3 ( g ) can be easily computed from g . We obtain that D c h , p , q is an Abelian distribution scheme.

Perfect recovery does not suffice for applications. We need perfect secrecy:

Definition 36

We say that G = ( G , π 1 , … , π m , π m + 1 ) is an Abelian secret sharing scheme for C , if and only if, G is an Abelian distribution scheme and for all I ∈ C the equality

h G ( I ∪ { m + 1 } ) = h G ( I )

holds.

Let C be an access structure over m parties. Next theorem provides us with a characterization of the Abelian arrangements that yield secret sharing schemes for C .

Theorem 37

Let G = ( G , π 1 , … , π m , π m + 1 ) be an Abelian arrangement, we have:

G provides perfect recovery, if and only if, for all I ∈ C the inclusion ⋂ i ∈ I ker ( π i ) ⊆ ker ( π m + 1 ) holds.
G provides perfect secrecy, if and only if, for all I ∉ C the equalities
G ⋂ i ∈ I ker ( π i ) = ker ( π m + 1 ) ( ⋂ i ∈ I ker ( π i ) ) ∩ ker ( π m + 1 )
and
G ker ( π m + 1 ) = ⋂ i ∈ I ker ( π i ) ( ⋂ i ∈ I ker ( π i ) ) ∩ ker ( π m + 1 )
both hold.

Proof

Let us prove the second item, the proof of the first item is easy and we omit it.

Let us suppose that G provides secrecy and let us suppose that I ∉ C . We have that

h G ( I ∪ { m + 1 } ) = log G ( ⋂ i ∈ I ker ( π i ) ) ∩ ker ( π m + 1 ) = log G ( ⋂ i ∈ I ker ( π i ) ) + log G ker ( π m + 1 ) = h G ( I ) + h G ( m + 1 ) .

We obtain that

G ( ⋂ i ∈ I ker ( π i ) ) ∩ ker ( π m + 1 ) = G ( ⋂ i ∈ I ker ( π i ) ) G ker ( π m + 1 ) ,

and also that both equalities in the statement of the theorem hold.

Let us prove the converse. Consider the group homomorphism π : G → ∏ i ∈ I Im ( π i ) × Im ( π m + 1 ) , which is defined by

π ( g ) = ( ( π i ( g ) ) i ∈ I , π m + 1 ( g ) ) .

We have that:

ker ( π ) = ( ⋂ i ∈ I ker ( π i ) ) ∩ ker ( π m + 1 ) .
The size of Im ( π ) is a subset of ∏ i ∈ I Im ( π i ) × Im ( π m + 1 ) , and the size of this subset is equal to ∣ ∏ i ∈ I Im ( π i ) × Im ( π m + 1 ) ∣ .

We obtain that π is onto, and we obtain that for all k ∈ K and for all h ∈ H there exists x k h ∈ G such that k = [ x k h ] K and h = [ x k h ] H . Moreover, we obtain that for all pair ( k , h ) the number of solutions is the same. Altogether, we obtain that

h G ( I ∪ { m + 1 } ) = H ( X I { m + 1 } ) = H ( X I { m + 1 } ) = h G ( I ) ,

and the theorem is proved.□

Example 38

Let us continue with the analysis of D c h , p , q . Is D c h , p , q an Abelian secret sharing scheme? It is easy to check that

Z p q Z p q ∩ Z p 2 = q ≠ q 2 = Z p 2 q 2 Z p 2 .

We obtain that D c h , p , q cannot provide perfect secrecy.

6.3 Information rates

Let G be a secret sharing scheme for C . The secret dealer can claim that her scheme is efficient only if the shares that she distributes are small when compared with the secret.

Definition 39

Let G be a distribution scheme for C . We define the average information ratio of G as the quotient

σ ∗ ( G ) = ∑ i ≤ n h G ( i ) m ⋅ h G ( m + 1 ) .

Example 40

Let us continue with the analysis of the Abelian distribution scheme D c h , p , q . The entropy of the message is log ( p q ) , and the entropies of the shares are log ( p 2 ) and log ( q 2 ) . Thus, the average information ratio is equal to 2 log p + 2 log ( q ) 2 log ( p q ) , which is in turn equal to 1.

It can be checked that the average information ratio of Shamir’s scheme is equal to 1. This is the best possible information ratio for a secret sharing scheme [1]. Therefore, we say that Shamir’s scheme is an ideal secret sharing scheme [3].

Definition 41

Let C be an access structure and let S be a secret sharing scheme for C . We say that S is ideal, if and only if, the average information ratio of S is equal to 1.

We ask: Does there exist an access structure that admit ideal Abelian schemes but which do not admit ideal linear schemes? Note that this question is closely related to the basic DFZ question.

7 Abelian secret sharing and the DFZ questions

Let us go back with the question that motivated this work: Is the CI method complete?

Definition 42

Let C be an access structure. We use the symbol σ A ( C ) to denote the Abelian capacity of C , which is defined as

σ A ( C ) = inf { σ ∗ ( G ) : G is an Abelian secret sharing scheme for C } .

We use the symbol σ ℒ ( C ) to denote the linear capacity of C , and we use the symbol σ ( C ) to denote the capacity of C . Those two latter capacities are defined accordingly.

Example 43

The Abelian and linear capacities of threshold structures are all equal to 1. This follows from the construction of Shamir. Note that Shamir’s scheme is a linear scheme as well as an Abelian scheme. Note that any linear scheme is also an Abelian scheme.

Given an access structure C the inequalities

σ ( C ) ≤ σ A ( C ) ≤ σ ℒ ( C )

hold. We conjecture that Abelian schemes outperform linear schemes, that is: we conjecture that there exists an access structure C such that

σ A ( C ) < σ ℒ ( C ) .

Definition 44

Let C be an access structure over n parties, we use the symbol AP ( C ) to denote the subset of AP n that is defined by the following 2 n − 1 linear equalities:

For all I ∈ C the equality h ( I { n + 1 } ) = h ( I ) holds.
For all I ∉ C the equality h ( I { n + 1 } ) = h ( I ) + h ( n + 1 ) holds.

We define AP ( C ) accordingly.

Note that AP ( C ) is constituted by the polymatroids that come from Abelian secret sharing schemes for C .

Definition 45

Let Ω C be the set

{ e I { n + 1 } − e I : I ∈ C } ∪ { e I { n + 1 } − e I − e n + 1 : I ∈ C } .

Let h ∈ R 2 n − 1 , we have that h belongs to AP ( C ) , if and only if, for all v ∈ Ω C the equality ⟨ v ∣ h ⟩ = 0 holds.

Notation 46

Let us fix some notations and some terminologies:

If h ∈ AP ( C ) , we say that h is an Abelian secret sharing polymatroid for C .
If h ∈ ℒP ( C ) , we say that h is a linear secret sharing polymatroid for C .
Let Ω ⊂ R 2 n − 1 and let h be a polymatroid. We use the symbol h ⊧ Ω to indicate that for all v ∈ Ω the equality ⟨ v ∣ h ⟩ = 0 holds. We use the symbol h ⊩ Ω to indicate that for all v ∈ Ω the inequality ⟨ v ∣ h ⟩ ≥ 0 holds.
We use the symbol A n to denote the set of linear inequalities that are satisfied by all the Abelian polymatroids of order n ( A n denotes the Abelian region of order n ).

We have.

Theorem 47

Let C be an access structure.

σ A ( C ) = min 1 n ∑ i ≤ n h ( i ) : h ( n + 1 ) = 1 and h ⊩ A n and h ⊧ Ω C .
σ ℒ ( C ) = min 1 n ∑ i ≤ n h ( i ) : h ( n + 1 ) = 1 and h ⊩ ℒ n and h ⊧ Ω C .

Proof

Let us write the proof for σ ℒ ( C ) . The proof for σ A ( C ) is completely analogous.

Let ℰS ( C ) be the set of linear polymatroids realizing the access structure C . The set ℰS ( C ) is nonempty [12]. Let v ∈ R 2 n − 1 , the ray ⟨ v ⟩ + is the set

{ λ ⋅ v : λ > 0 } .

We set

ℛℰS ( C ) = { ⟨ v ⟩ + : h ∈ ℰS ( C ) } ,

and we note that our objective function, which is the function ∑ i ≤ n h G ( i ) n ⋅ h G ( n + 1 ) , is constant over any ray. We obtain that

σ ℒ ( C ) = inf 1 n ∑ i ≤ n h ( i ) : h ( n + 1 ) = 1 and h ∈ ℛℰS ( C ) .

The function 1 n ∑ i ≤ n h ( i ) is a linear function. We obtain that

σ ℒ ( C ) = min 1 n ∑ i ≤ n h ( i ) : h ( n + 1 ) = 1 and h ∈ c h ( ℛℰS ( C ) ) ,

and we obtain that

σ ℒ ( C ) = min 1 n ∑ i ≤ n h ( i ) : h ( n + 1 ) = 1 and h ⊩ ℒ n and h ⊧ Ω C .

The theorem is proved.□

We obtain an easy corollary from the above theorem

Corollary 48

If there exists an access structure C that satisfies the inequality σ A ( C ) < σ ℒ ( C ) the CI method cannot be complete.

It remains to look for an access structure C satisfying the inequality σ A ( C ) < σ ℒ ( C ) . We conjecture that such an access structure actually exists. Where can we look for good candidates?

8 Concluding remarks

We have to ask: Have we exhibited a single example of an Abelian secret sharing scheme?

Shamir’s scheme constitutes a good example of an Abelian secret sharing scheme. However, the above question is a question about the existence of Abelian schemes that cannot be represented by linear maps. We say that such a scheme is a nonlinear Abelian scheme. Do there exist nonlinear Abelian secret sharing schemes? We conjecture that there exist Abelian secret sharing schemes that outperform all its linear counterparts. Note that those schemes have to be nonlinear.

8.1 Nonlinear schemes based on Chinese remaindering

In this section, we study an interesting example of a nonlinear scheme that is based on Chinese remaindering [19].

Let p s < p 1 < ⋯ < p n be n + 1 consecutive primes, and let t ≤ n be a positive integer such that the inequality

p s ∏ i = n − t + 2 n p i < ∏ i = 1 t p i

holds. Set G = Z p s p 1 ⋯ p n , and let π i be the map

π i ( x ) = x mod p i .

We obtain the Abelian arrangement

G p s , p 1 , … , p n = ( G , π 1 , … , π n , π s ) ,

which can be used to define an Abelian distribution scheme for n parties. This distribution scheme works as follows:

The dealer chooses a secret s ∈ { 1 , … , p s } .
The dealer chooses an integer α such that s + p s α belongs to the interval ( ∏ i = n − t + 2 n p i , ∏ i = 1 t p i ) .
Given i , the dealer computes π i ( s + p s α ) and sends it to party i . Note that the secret is equal to π s ( s + p s α ) .

It is easy to prove that any set of t shares allows the perfect recovery of the secret. Is G p s , p 1 , … , p n an Abelian secret sharing scheme for the access structure U n , t ? Not really, but we have something close: t − 2 shares give null information about the secret [19].

8.2 Nonlinear schemes for Fano and non-Fano

Our main goal is to prove that the CI method is not complete. We have to look for an access structure C satisfying the inequality σ A ( C ) < σ ℒ ( C ) . We have a candidate that we denote with the symbol ℱ + Nℱ . Let us define this structure.

First, we have to define two access structures ℱ and Nℱ . The set of participants of ℱ is the set A = { 1 , … , 6 } , while the set of participants of Nℱ is the set B = { 7 , … , 12 } . The minterms of ℱ are

{ 1 , 4 } , { 2 , 5 } , { 3 , 6 } , { 1 , 2 , 6 } , { 1 , 3 , 5 } , { 2 , 3 , 4 } , and { 4 , 5 , 6 } ,

and the minterms of Nℱ are

{ 7 , 10 } , { 8 , 11 } , { 9 , 12 } , { 7 , 8 , 12 } , { 7 , 9 , 11 } , { 8 , 9 , 10 } , { 10 , 11 , 12 } , and { 9 , 10 , 11 } .

The set of participants of the access structure ℱ + Nℱ is the set { 1 , … , 12 } . We have that I ∈ ℱ + Nℱ , if and only if, I ∩ A ∈ ℱ and I ∩ B ∈ Nℱ .

Remark 49

The symbol ℱ stands for Fano, while the symbol Nℱ stands for non-Fano. The access structure ℱ + Nℱ comes from the amalgamation of the Fano and the non-Fano matroids [1].

The access structure ℱ + Nℱ does not admit ideal linear secret sharing schemes. We know the exact linear capacity of ℱ + Nℱ . Jafari and Khazaei proved that σ ℒ ( ℱ + Nℱ ) = 41 36 [13]. We ask:

Question 50

Does the inequality σ A ( C ℱ + Nℱ ) < 41 36 hold?

Acknowledgments

Juan Andres Montoya thanks Universidad Nacional de Colombia, and the financial support provided through the project Hermes 44048.

Conflict of interest: Authors state no conflict of interest.

References

[1] Beimel A. Secret-sharing schemes: a survey. Lecture Notes Comp Sci. 2011;6639:11–46. 10.1007/978-3-642-20901-7_2Search in Google Scholar

[2] Benaloh J. Secret sharing homomorphisms: keeping shares of a secret secret. Lecture Notes in Comp Sci. 1987;263:251–60. 10.1007/3-540-47721-7_19Search in Google Scholar

[3] Brickell E, Davenport D. On the classification of ideal secret sharing schemes. J Cryptol. 1991;4:123–34. 10.1007/0-387-34805-0_25Search in Google Scholar

[4] Chan T, Yeung R. On a relation between information inequalities and group theory. IEEE Trans Inf Theory. 2002;48(5):1992–5. 10.1109/TIT.2002.1013138Search in Google Scholar

[5] Desmedt Y, Frankel Y. Shared generation of authenticators and signatures. Lecture Notes Comp Sci. 1992;576:457–65. 10.1007/3-540-46766-1_37Search in Google Scholar

[6] Desmedt Y, Frankel Y. Classification of ideal homomorphic threshold schemes over finite abelian groups. Lecture Notes Comp Sci. 1993;658:25–34. 10.1007/3-540-47555-9_2Search in Google Scholar

[7] Desmedt Y, Frankel Y. Homomorphic zero-knowledge threshold schemes over any finite abelian group. SIAM J Discrete Math. 1994;7(4):667–79. 10.1137/S0895480192224713Search in Google Scholar

[8] Dougherty R, Freiling C, Zeger K. Linear rank inequalities on five or more variables. 2009. arxiv.org:0910.0284v3. Search in Google Scholar

[9] Dougherty R. Computations of linear rank inequalities on six variables. In: Proceedings of IEEE International Symposium on Information Theory, 1–4 July 2014. Honololu, USA: IEEE; 2014. p. 2819–23. 10.1109/ISIT.2014.6875348Search in Google Scholar

[10] Gács P, Körner J. Common information is far less than mutual information. Probl Contr lnform Theory. 1973;2(2):149–62. Search in Google Scholar

[11] Ingleton A. Representation of matroids. In: Welsh D, editor. Combinatorial mathematics and its applications. Oxford: Academic Press; 1969. p. 142–67. Search in Google Scholar

[12] Ito M, Saito A, Nishizeki T. Multiple assignment scheme for sharing secret. J Cryptol. 1993:6(1):15–20. 10.1007/BF02620229Search in Google Scholar

[13] Jafari A, Khazaei S. On Abelian secret sharing: duality and separation. IACR Cryptol. 2019;2019:575. Search in Google Scholar

[14] Liu M, Zhou M. Ideal homomorphic secret sharing schemes over cyclic groups. Sci China Ser E-Technol Sci. 1998;41:650–60. 10.1007/BF02917049Search in Google Scholar

[15] Matuš F. Infinitely many information inequalities. In: Proceedings of IEEE International Symposium on Information Theory, 24–29 June 2007. Nice, France: IEEE; 2007. p. 41–4. 10.1109/ISIT.2007.4557201Search in Google Scholar

[16] Mejia C. On the theory of linear rank inequalities. Ph.D thesis. Bogota: Universidad Nacional de Colombia; 2016. Search in Google Scholar

[17] Mejia C. Linear secret sharing and the automatic search of linear rank inequalities. Appl Math Sci. 2015;9:5305–24. 10.12988/ams.2015.57478Search in Google Scholar

[18] Mejia C, Andres Montoya J. On the information rates of homomorphic secret sharing schemes. J Inform Optimiz Sci. 2018;39(7):1463–82. 10.1080/02522667.2017.1367513Search in Google Scholar

[19] Preneel B, Quisquater M, Vandewalle J. On the security of the threshold scheme based on the Chinese remainder theorem. Lecture Notes Comp Sci. 2002;2274:199–210. 10.1007/3-540-45664-3_14Search in Google Scholar

[20] Oxley J. Matroid theory. Oxford: The Clarendon Press, Oxford University Press; 1992. Search in Google Scholar

[21] Shamir A. How to share a secret. Commun ACM. 1979;22:612–13. 10.1145/359168.359176Search in Google Scholar

[22] Yeung R. A first course on information theory. Berlin: Springer Verlag; 2002. 10.1007/978-1-4419-8608-5Search in Google Scholar

Received: 2021-05-31

Accepted: 2022-07-23

Published Online: 2022-08-17

This work is licensed under the Creative Commons Attribution 4.0 International License.

Articles in the same Issue

https://doi.org/10.1515/jmc-2022-0020

Keywords for this article

secret sharing; polymatroids; linear rank inequalities

Creative Commons

BY 4.0