A Distributed and Computationally Secure Key Distribution Scheme*

Abstract

In [16], Naor, Pinkas and Reingold introduced schemes in which some groups of servers distribute keys among a set of users in a distributed way. They gave some specic proposals both in the unconditional and in the computational security framework. Their computationally secure scheme is based on the Decisional DiÆe-Hellman Assumption. This model assumes secure communication between users and servers. Furthermore it requires users to do some expensive computations in order to obtain a key. In this paper we modify the model introduced in [16], requiring au-thenticated channels instead of assuming the existence of secure channels. Our model makes the user's computations easier, because most compu-tations of the protocol are carried out by servers, keeping to a more re-alistic situation. We propose a basic scheme, that makes use of ElGamal cryptosystem, and that ts in with this model in the case of a passive ad-versary. We then add zero-knowledge proofs and veriable secret sharing to prevent from the action of an active adversary. We consider general structures (not only the threshold ones) for those subsets of servers that can provide a key to a user and for those tolerated subsets of servers that can be corrupted by the adversary. We nd necessary combinatorial conditions on these structures in order to provide security to our scheme. 1