 # Smallest graphs achieving the Stinson bound

Perfect secret sharing scheme is a method of distribute a secret information s among participants such that only predefined coalitions, called qualified subsets of the participants can recover the secret, whereas any other coalitions, the unqualified subsets cannot determine anything about the secret. The most important property is the efficiency of the system, which is measured by the information ratio. It can be shown that for graphs the information ratio is at most (δ+1)/2 where δ is the maximal degree of the graph. Blundo et al. constructed a family of δ-regular graphs with information ratio (δ+1)/2 on at least c· 6^δ vertices. We improve this result by constructing a significantly smaller graph family on c· 2^δ vertices achieving the same upper bound both in the worst and the average case.

## Authors

##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## 1 Introduction

Secret sharing schemes were first introduced by Shamir  and Blakley  as a method of distribute a secret information among participants such that only predefined coalitions, called qualified subsets of the participants can recover the secret. If the unqualified subsets have no information about , then we call it a perfect secret sharing. The set of the qualified subsets is called access structure. If all minimal elements of the access structure have exactly two elements, then the access structure can be represented with a graph: let the participants denote the vertices, and two vertices are supposed to be connected by an edge if the respective participants are qualified together.

One of the most frequently examined problem on secret sharing is the efficiency of a particular system. This can be characterized by the amount of information a given participant must remember correlate to the size of the secret. This amount is called the information ratio of the share of this participant. From the whole system point of view, it is possible to investigate two, slightly different quantities: the worst case information ratio is the information that the most heavily loaded participant must remember; or the average case, which is the average of the information ratios of the participants. Determining the information ratio is a challenging but interesting problem for both cases even for small access structures.

The exact value of the worst-case information ratio was determined for most of the graphs with at most six vertices ,,,,  for trees , for -dimensional cubes , for graphs with large girth . On the other hand, there are some sporadic results on the average case as well, see , , , . In general however, there is a large gap between the best known upper and lower bound. One notable universal upper bound was proved by Stinson in . He showed that if the maximal degree of a graph is , then the information ratios are at most . Blundo et al. in  showed that this bound is sharp for an infinite graph class with maximal degree .

The graph class constructed by Blundo et al. with maximal degree has vertices, where . We give a significant improvement of that result by presenting graph classes with much less vertices, i.e. for the worst case, and for the average case.

## 2 Preliminaries

Let be a finite set of participants. The access structure on is a subset of which is monotone increasing in the sense, that if and , then .

A perfect secret sharing scheme realizing

is a collection of random variables

for every and

with a joint distribution such that

• if , then determines

• if , then is independent of

Note that as a consequence of the monotonicity, the minimal elements of determine . In this paper we consider only graph-based secret sharing schemes, where all the minimal elements of the access structure have two elements, hence from now on we will use a graph instead of an

The size of a discrete random variable

is measured by it’s Shannon-entropy, defined as , where has possible values

with probabilities

. The information ratio of a participant in is .

Let be a graph. Then the information ratio of is

• in the worst case;

• in the average case

where every infimum is taken over all perfect secret sharing schemes realizing

Every construction yields an upper bound for the information ratio, one notable example is the decomposition theorem of Stinson  yielding an upper bound derived from any covering of the graph. Let us mention, that this fundamental result has more general possible interpretations though, here we present a simple consequence of covering with stars only:

[Stinson-bound] Let be a graph with maximal degree . Then

 σ(G)≤(δ+1)/2 (1) ¯¯¯σ(G)≤(δ+1)/2 (2)

Note that in the average case this bound can be sharp only for regular graphs.

Let be a perfect secret sharing scheme based on graph with shares for and secret , and define the values

 f(A)=H(ξv:v∈A)H(ξs)

for each . Using the standard properties of the entropy function and the definition of the perfect secret sharing we get the following, so called Shannon-inequalities:

• , and in general (positivity);

• if then (monotonicity);

• (submodularity).

• if , is an independent set and is not, then (strong monotonicity);

• if neither nor is independent but is so, then (strong submodularity).

Let be any function satisfying these five type of inequalities. Then is a lower bound for the information ratio in the worst case, and is a lower bound for the information ratio in the average case. This is the so-called entropy method. In some cases we shall use the rearrangement of the inequalities.

For simplicity we usually write instead of for subsets of vertices, and instead of for vertices.

## 3 Results

As we noted above, the information ratio of any graph is at most , where is the maximal degree of the graph as a simple consequence of Stinson’s decomposition theorem . Within this section we construct infinite classes of graphs with this best achievable information ratio both in the worst and the average case. Additionally, these graphs are significantly smaller than the recently known examples satisfying this property.

### 3.1 Construction for the worst case

Let be a graph with vertices, built from a -dimensional cube, independent vertices and a 1-factor between the vertices of the cube and the independent vertex set.

Let be any function satisfying the Shannon-inequalities for , and such that . We shall use the following notation.

 [[X,B,A]]=∑b∈Bf(bX)−∑a∈Af(X−a) (3)

Split the vertices of into two equal independent sets the chessboard like fashion: , , , and and are independent. Let be the -dimensional subcube of and and . Clearly and are equal, independent and disjoint sets and .

###### Proof.

First we check for . is a path of length 3, with vertices respectively. The inequality in 4 becomes

 f(a)+f(b)≥[[ax,b,a]]+1=f(abx)−f(x)+1.

Using the strong submodularity

 f(ab)+f(ax)≥f(a)+f(abx)+1

and the submodularities

 f(a)+f(b)≥f(ab) f(a)+f(x)≥f(ax),

we get:

 f(abx)−f(x)≤f(ab)+f(ax)−f(a)−1−f(x)≤f(a)+f(b)−1,

which is the statement of the lemma.

Now suppose that 4 holds for the dimensional case. consist of two disjoint copy of and the vertices of the -dimensional cubes are connected with a perfect matching . Split this two copies of the chess-board like fashion to , and respectively such that edges of are between and , and and . , , , , , and are define as above. Clearly , , and , and is between and .

Let arbitrary, and its pair in is . By submodularity

 f(bXd)−f(Xd)≥f(bXdX′d−a′)−f(XdX′d−a′) (5)

Let be arbitrary neighbor of . Then and are both qualified, but their intersection, is independent, hence by the strong submodularity.

 f(bX′d)−f(bX′d−a′)≥f(abX′d)−f(abX′d−a′)+1 (6)

Using the submodularity, we can write two additional inequalities:

 f(Xd)−f(X′d−a′) ≥f(bX′d)−f(bX′d−a′) (7) f(abX′d)−f(abX′d−a′) ≥f(bXdX′d)−f(bXdX′d−a′) (8)

Adding the inequalities 5, 6, 7, 8, we get

 f(bXd)−f(Xd)+f(X′d)−f(X′d−a′)≥f(bXdX′d)−f(XdX′d−a′)+1 (9)

Similarly if we choose arbitrary and is the pair of in , then

 f(b′X′d)−f(X′d)+f(Xd)−f(Xd−a)≥f(b′XdX′d)−f(XdX′d−a)+1 (10)

All edges between and , and and yield an inequality as 9 and 10 respectively. Adding up all these inequalities, on the left hand side all and cancel out the remaining is

Using the facts that , , and this can be written as

Applying the inductive hypothesis we get

This inequality and 11 together yield the statement of the lemma. ∎

###### Proof.

is a regular bipartite graph with parts and hence there is a perfect matching between and . Let be a pair in the perfect matching, , , and let be the leaf neighbor of . and are independent, but and are not, thus by the strong monotonicity and the submodularity:

 f(bXd)−f(Xd)≥1 f(yXd)−f(yXd−a)≥1 f(yXd−a)+f(Xd)−f(Xd−a)−f(yXd)≥0

The sum of this three inequality gives

 f(bXd)−f(Xd−a)≥2 (13)

Adding up 13 for all the edges in the perfect matching between and gives the statement of the lemma ∎

 ∑v∈Cdf(v)≥(d+2)2d−1
###### Proof.

This is just an easy corollary of lemma 3.1 and lemma 3.1. ∎

The information ratio of in the worst case is

 σ(C∗δ−1)=δ+12
###### Proof.

The maximal degree of is , hence we get from the Stinson-bound 2.

On the other hand, has vertices, hence by Lemma 3.1 for at least one vertex

 f(v)≥(δ+1)2δ−22δ−1=δ+12

holds, which completes the proof. ∎

### 3.2 Construction for the average case

We construct the graph class as follows. Let , and be three disjoint -dimensional cubes. The vertices of each cube can divide into two independent sets of vertices the chessboard-like fashion, . Now we get by adding arbitrary 1-factors between and for . The family consists of all graphs constructed by this method, see the following example of a

The average information ratio of every graph is

 ¯¯¯σ(Dδ−1)=δ+12
###### Proof.

All vertices of any graphs have a degree of , hence by Stinson-bound 2 the information ratio is at most .

Restrict an arbitrary fixed graph to . It is easy to see, that is isomorphic to . is a dimensional cube, and is an independent set. Furthermore there is a perfect matching between and , and between and , hence there is a perfect matching between and . This shows that is an induced subgraph of isomorphic to hence we can apply lemma 3.1 for .

 ∑v∈C(1)δ−1f(v)≥(δ+1)2δ−2 (14)

Similarly, if we consider and we obtain

 ∑v∈C(2)δ−1f(v)≥(δ+1)2δ−2 (15) ∑v∈C(3)δ−1f(v)≥(δ+1)2δ−2 (16)

Combining 14, 15, 16, we get

 ∑v∈Dδ−1f(v)≥3(δ+1)2δ−2. (17)

has vertices, hence the information ratio in the average case is at least , which completes the proof. ∎

## 4 Conclusion

In this paper we present new families of graphs of maximal degree achieving the best possible information ratio value given by the Stinson bound . These graphs are asymptotically the smallest ones recently: the first graph class achieves the bound in the worst case on vertices and the other graph class constructed for the average case has vertices in contrast to the best known constructions on vertices.

## Acknowledgement

This research has been partially supported by the European Union, co-financed by the European Social Fund (EFOP-3.6.2-16-2017-00013, Thematic Fundamental Research Collaborations Grounding Innovation in Informatics and Infocommunications). The authors thank the members of the Crypto Group of the Rényi Institute, and especially László Csirmaz and Gábor Tardos, the friutful comments and discussions.

## References

•  G. R. Blakley, Safeguarding cryptographic keys, in: Proc. of the Nat. Comp. Conf., 48, (1979) pp. 313–317.
•  C. Blundo, A. De Santis, R. De Simone, U. Vaccaro, Tight bounds on the information rate of secret sharing schemes, Des., Codes and Crypt. 11 (2) (1997) pp. 107–110.
•  C. Blundo, A. De Santis, L. Gargano, U. Vaccaro, On the information rate of secret sharing schemes, Theor. Comp. Sci. 154 (2) (1996) pp. 283–306.
•  C. Blundo, A. De Santis, D. R. Stinson and U. Vaccaro, Graph decomposition and secret sharing schemes, J. of Crypt. 8 (1995), 39–64.
•  E. F. Brickell and D. R. Stinson, Some improved bounds on the information rate of perfect secret sharing schemes, J. of Crypt. 5 (1992), 153–166.
•  L. Csirmaz, Secret sharing schemes on graphs, Studia Math. Hung. 44 (2007), 297–306.
•  Csirmaz, L.: Secret sharing on the d-dimensional cube. Des. Codes Cryptogr. 74, 719–729 (2015)
•  L. Csirmaz and P. Ligeti, Secret sharing on large girth graphs, submitted to Crypt. and Comm. (2018)
•  L. Csirmaz and G. Tardos, Optimal information rate of secret sharing schemes on trees, IEEE Tr. on Inf. Theory 59 (2013), 2527–2630.
•  M. van Dijk, On the information rate of perfect secret sharing schemes, Des., Codes and Crypt. 6 (1995), 143–160.
• 

O. Farràs, T. Kaced, S. Martin, C. Padró, Improving the Linear Programming Technique in the Search for Lower Bounds in Secret Sharing.

Cryptology ePrint Archive, Report 2017/919,2017; available at https://eprint.iacr.org/2017/919
•  H.-L. Fu, H.-C. Lu, The exact values of the average information ratio for tree-based access structures of perfect secret sharing schemes, Des., Codes and Crypt. 73 (1) (2014), 37–46.
•  H.-L. Fu, H.-C. Lu, The optimal average information ratio of secret-sharing schemes for the access structures based on unicycle graphs and bipartite graphs, Disc. Appl. Math. 233 (2017), 131–142.
•  W. Jackson and K. M. Martin, Perfect secret sharing schemes on five participants, Des., Codes and Crypt. 9 (1996), 233–250.
•  A. Shamir, How to share a secret, Comm. of the ACM 22 (1979), 612–613.
•  D. R. Stinson, Decomposition construction for secret sharing schemes, IEEE Trans. on Inf. Theory, 40 (1) (1994) pp. 118–125.
•  H.L. Sun and B.L. Chen, Weighted decomposition construction for perfect secret sharing schemes, Comp. and Math. with Appl. 43 (2002), 877–887.