Secure Network Coding for Distributed Secret Sharing with Low Communication Cost

Transcription

1 Secure Network Coing for Distribute Secret Sharing with Low Communication Cost Nihar B. Shah, K. V. Rashmi an Kannan Ramchanran, Fellow, IEEE Abstract Shamir s (n,k) threshol secret sharing is an important component of several cryptographic protocols, such as those for secure multiparty-computation. These protocols typically assume the presence of irect communication links from the ealer to all participants, in which case the ealer can irectly pass the shares of the secret to every participant. In this paper, we consier the problem of secret sharing when the ealer oes not have irect communication links to all participants, an instea, they form a general network. We present an algorithm for secret sharing over networks that satisfy what we call the k- propagating-ealer conition. The algorithm is communicationefficient, istribute an eterministic. Interestingly, the solution constitutes an instance of a network coing problem amitting a istribute an eterministic solution, an furthermore, hanles the case of noal-eavesropping, about which very little appears to be known in the literature. In the secon part of the paper, we erive information-theoretic lower bouns on the communication complexity of secret sharing over any network, which may also be of inepenent interest. We show that for networks satisfying the k-propagating-ealer conition, the communication complexity of our algorithm is Θ(n), an furthermore, is always within a constant factor of the lower boun. We also show that, in contrast, existing solutions in the literature entail a communication-complexity that is superlinear for a wie class of networks, an is Θ(n ) in the worst case. Our algorithm thus allows for efficient generalization of several cryptographic protocols to a large class of networks. I. INTRODUCTION Shamir s classical (n,k) secret sharing scheme [1] is an essential ingreient of several cryptographic protocols. The scheme consiers a set of (n +1) entities: a ealer an n participants. The ealer possesses a secret s an wishes to pass functions (calle shares) of this secret to the n participants, such that the following properties are satisfie: k-secret-recovery: the shares of any k participants suffice to recover the secret s (k 1)-collusion-resistance: the aggregate ata gathere by any (k 1) noes reveals no knowlege (in the informationtheoretic sense) about the secret s. Several cryptographic protocols in the literature require execution of one or more instances of secret sharing among all the participants. These inclue protocols for secure multipartycomputation [], secure key management [3], an secure archival storage [4]. For instance, uner the celebrate Ben- Or-Golwasser-Wigerson (BGW) protocol [] for securemultiparty function computation, the initialization step requires n instances of secret sharing an every multiplication operation requires n aitional instances. Most protocols incluing those liste above assume that the ealer has irect communication links to every participant. In The authors are with the Dept. of EECS, University of California, Berkeley. {nihar, rashmikv, kannanr}@eecs.berkeley.eu N. B. Shah was supporte by a Berkeley Fellowship an K. V. Rashmi was supporte by a Facebook Fellowship. This work was also supporte in part by AFOSR grant FA an in part by NSF grant CCF this case, the ealer can compute the shares as per Shamir s scheme [1] an irectly pass the shares to the respective participants. In several situations, the ealer may not have irect communication links with every participant; instea, the ealer an the participants may form a general network, e.g., as in Fig. 1. The network is escribe by a graph G with (n +1) noes. These (n +1) noes comprise the ealer an the n participants. An ege represents a secure communication link between its two en-points. We shall say a participant is irectly connecte to the ealer if there exists an ege from the ealer to that participant. We shall use the terms ege or link to refer to a communication link. Uner a general network, all communication between the ealer an a participant who is not irectly connecte to it, must pass through other participants in the network. This poses the challenge of secret sharing over a network without leaking any aitional information to any participant. Previous solutions: The current practice is to perform separate secure transmissions across the network [5] from the ealer to each participant. Uner this solution, the ealer first encoes s into n shares {t l } n l=1 using Shamir s secret sharing scheme. To every noe l irectly connecte to the ealer, the ealer irectly passes the share t l. To isseminate shares to the remaining noes, the ealer performs the following actions, once separately for each remaining noe l {1,...,n}. The ealer applies Shamir s secret sharing treating t l as a secret. The resultant k shares are then passe to noe l via k noeisjoint paths in the graph. Noe l can ecoe its esire share t l, while the remaining noes in the network o not obtain any information about s or t l. Such a solution incurs a high communication cost, since the ealer nees to transmit shares across the network separately to every participant. Moreover, the requirement of setting up k noe-isjoint paths to every participant requires knowlege of the global topology, an also requires significant coorination in the network. 1 Due to lack of a specific name, in the sequel, we shall refer this solution simply as the previous solution. In this paper, we consier the problem of efficient issemination of the shares of a secret to participants forming a network. We provie an algorithm that performs this task over a wie class of networks in a communication-efficient an istribute manner. Our algorithm provies significant gains over the previous solution, with a communication complexity that is within a constant factor from the information-theoretic lower bouns, that are also erive in this paper. As a secure network coing problem: The problem of secret share issemination can also be cast as a specific instance of 1 The communication efficiency of this solution can be improve if more than k noe-isjoint paths are available, by employing two-threshol secret sharing over these noe-isjoint paths. The analysis an comparisons performe subsequently in Section IV consier this version of the solution /13/$ IEEE 404

2 D 1 3 Fig. 1: A network forme by the ealer (D) an participants (1 to 6), as consiere in Example 1. a secure network coing problem, by connecting sinks to each of the ( n k) subsets of k participants. It requires secrecy from an eavesropper that can gain access to subsets of the noes (in particular, to any subset of (k 1) participants). However, to the best of our knowlege, only the setting where the eavesropper can access subsets of links is well unerstoo in the literature. [6], [7] consier the setting where a collection of subsets of the links is specifie, an an eavesropper may gain access to precisely one of these subsets. This work aresses the problem of noe-compromise by treating it as a case of link-compromise by allowing the eavesropper to gain access to all links that are incient upon the compromise noes. However, this scheme requires the network to satisfy a certain conition, which is almost always violate in our problem. Moreover, the scheme is not explicit an requires the size of the finite fiel to be exponential in n. Communication-efficient algorithms to secure a network from an eavesropper having access to a boune number of links are provie in [8], [9]. These algorithms communicate a message of size equal to the ifference between the largest message that can be sent in the absence of secrecy requirements an the boun on number of compromise links. In our problem, this ifference is generally 0 or smaller (e.g., the ifference is in the network of Fig. 1), thus making these algorithms inapplicable here. The algorithms currently foun in the network coing literature, even for the setting where there are no secrecy requirements, are either ranom (thus not guarantee) [10], or eterministic but centralize [11]. On the other han, our algorithm is both istribute an eterministic (i.e., is successful with probability 1). Illustrative example: The following toy example illustrates the previous solution an our new algorithm. Example 1: Consier the network epicte in Fig. 1. Let n =6 an k =, with the finite fiel F 7 as the alphabet of operation. Uner Shamir s scheme of encoing the secret s, the share t i (1 i 6) for participant i is t i = s + ir where r is a value chosen by the ealer uniformly at ranom from F 7. While the ealer can irectly pass shares t 1 an t to participants 1 an respectively, the ifficulty arises in communicating shares to the remaining participants with whom the ealer oes not have irect communication links. For instance, if the ealer tries to pass share t 3 to 3 by passing t 3 along the path D 1 3, then 1 gains access to two shares, t 1 an t 3. Using these two shares, 1 can recover s, thus violating the (k 1)-collusion resistance requirement. The solution previously propose in the literature is to perform separate secure transmissions from the ealer to each participant [5]. In the example of Fig. 1, in orer to pass the share t 3 to participant 3, the ealer chooses another ranom value r 3, passes (t 3 + r 3 ) along the path D 1 3, an r 3 along D 3. Now, participant 3 can recover its share t 3, an no participant gains any aitional information about s or t 3 in this process. In a similar manner, the ealer communicates t i (4 i 6) to participant i by passing (t i + r i ) an r i through k = noe-isjoint paths. Although this solution guarantees successful share issemination, it is communication inefficient, an requires knowlege of the global topology, as well as consierable coorination in the network. Observe that the solution escribe above transmits ata across several hops in the network in every step, which is however, never use subsequently in the protocol. Thus, in orer to esign efficient algorithms, one may wish to propagate ata in a manner that allows its subsequent reuse ownstream, thus reucing the overall communication in the network, as typical of solutions base on network coing. Uner our algorithm, the ealer first raws two values r an r a uniformly at ranom from F 7. The ealer then passes the two values (s + r) an (r + r a ) to noe 1, an the two values (s +r) an (r +r a ) to noe. Now, noe 1 passes (s + r)+j(r + r a ) to its neighbouring noe j =3, an this expression can equivalently be written as (s + jr)+(r + jr a ). Similarly, noe passes (s +r)+j(r +r a )(=(s + jr)+ (r + jr a )) to its neighbours j {3,4}. Noe 3 thus receives (s +3r)+(r +3r a ) an (s +3r)+(r +3r a ) from which it recovers the two values (s +3r) an (r +3r a ). Noe 3 now passes (s +3r)+j(r +3r a )(=(s + jr)+3(r + jr a )) to its other neighbours j {4,5}. Noe 4 thus receives (s +4r)+ (r +4r a ) an (s +4r)+3(r +4r a ) from noes an 3 respectively, from which it recovers (s +4r) an (r +4r a ). In general, in this network, every noe i {1,...,6} recovers (r + ir a ) an (s + ir), an can thus recover its requisite share (s + ir), along with a ranom counterpart (r + ir a ) which is use to isseminate shares further ownstream. One can see that the new algorithm presente in this paper requires a communication of only 1 values, as oppose to 4 in the previous solution. Furthermore, this algorithm requires knowlege of only the local topology, whereas the previous solution requires the knowlege of the global topology to setup communication over noe-isjoint paths. Summary of results: We first present an algorithm that enables a ealer to isseminate shares of a secret to n participants in network G, such that the properties of k-secret-recovery (when G satisfies a conition, which we term the k-propagating-ealer conition) (k 1)-collusion-resistance (for any G) are satisfie. The algorithm is completely istribute, an each noe nees to know only the ientities of its neighbours. The algorithm is explicit, works with any finite fiel of size n or higher, an requires computations consisting only of encoing an ecoing one instance of a Ree-Solomon coe at every noe. Thus, this algorithm allows for efficient generalization of various cryptographic protocols, that previously assume irect communication links from the ealer to every participant, to a large class of networks. For any (n,k), an G with (n +1) noes, we also erive Information-theoretic lower bouns on the total communication complexity uner any algorithm. 405

3 Communication complexity uner our algorithm Lower bouns on the communication complexity uner the previous solution. Using these results, we establish that when the k-propagating ealer property is satisfie, the communication complexity of our algorithm is Θ(n), an is always within a constant factor from the lower bouns. On the other han, the communication complexity of the previous solution grows super-linearly for a large class of graphs, an is Θ(n ) in the worst case. Aitional results in the extene version [1]: Heuristic methos, base on this algorithm, aressing the case when the k-propagating-ealer conition is not satisfie are provie. Extensions incorporating active aversaries, efficient aition of new participants in the absence of truste entities, an twothreshol secret sharing are also presente. Bouns on the amount of ranomness require are erive: the amount of ranomness require uner our algorithm is inepenent of n, which is not the case with the previous solution. Our algorithm is base on a variant of the Prouct-Matrix coes [13] which were originally constructe for istribute storage systems. Organization of the paper: Section II escribes the system moel. Section III presents the main algorithm. Section IV presents an analysis of the communication-complexity of the algorithm, lower bouns for the problem, an comparisons with the performance of the previous solution. Finally, Section V presents conclusions an iscusses open problems. II. SYSTEM MODEL A. Secret Sharing in a Network The ealer possesses a secret s that is rawn from some alphabet A, an wishes to pass shares of this secret to n participants. The ealer an the participants form a network, enote by graph G. The graph G has (n +1) noes comprising the ealer an the n participants, an an ege in the graph enotes a secure an private communication link between the two en-points. The problem is to esign a protocol which will allow the ealer to pass shares (of the secret) to the n participants, meeting the requirements of (k 1)- collusion-resistance an k-secret-recovery. All the participants are assume to be honest-but-curious, i.e., they follow the protocol correctly, but may store any accessible ata to gain information about the secret. 3 The eges in G can be irecte or unirecte: a irecte ege implies existence of only a one way communication link an an unirecte ege implies irect communication links both ways. n an k are assume to satisfy n k>1, since n k 1 prohibits the secret from ever being recovere, while k =1egenerates the problem to the case wherein no security is require. We shall now iscuss a conition that the graph G must necessarily satisfy for any algorithm to successfully perform secret sharing on it. Definition 1 (m-connecte-ealer): A graph with (n +1) noes (the ealer an n participants) satisfies the m- Thus, at times, we will also refer to a participant as a noe of the graph. We will also use the terms network an graph interchangeably. 3 An extension to hanling active aversaries is presente in the extene version [1] of this paper. connecte-ealer property for a positive integer m, if each of the n participants in the graph either has an incoming ege irectly from the ealer or has at least m noe-isjoint paths from the ealer to itself. Lemma 1 (Necessary conition): For any graph G, a necessary conition for any algorithm to perform (n,k) secret sharing is that G satisfies the k-connecte-ealer property. Proof: The proof is straightforwar. Suppose G oes not satisfy the k-connecte-ealer property. Then there exists some noe (say, noe i) that is not irectly connecte to the ealer, an has at most (k 1) noe-isjoint paths from the ealer to itself. Since every path from the ealer to noe i must necessarily pass through at least one of these (k 1) noes, they can together recover the entire share of participant i. Putting in their own (k 1) shares, these (k 1) participants can together recover s, thus violating the (k 1) collusion resistance requirement. Thus no algorithm can operate successfully on all network topologies, an must require the graph G to obey at least the k-connecte-ealer conition. In this regar, we remark that the algorithm presente in this paper is robust to the network topology, i.e., the (k 1)-collusion-resistance property is satisfie irrespective of the topology of the network. Our algorithm successfully isseminates secret shares on a large class of networks. This class is escribe below. B. Class of Networks Consiere The algorithm presente in this paper requires the communication network G to satisfy an aitional conition, the k-propagating-ealer conition, as iscusse below. Definition (m-propagating-ealer): A graph with (n + 1) noes (the ealer an n participants) satisfies the m- propagating-ealer property for a positive integer m, if there exists an orering of the n participants in the graph such that every noe either has an incoming ege irectly from the ealer, or has incoming eges from at least m noes preceing it in the orering. As an illustration of this conition, consier the network of Example 1 (Fig. 1). This network satisfies the -propagatingealer conition, with the orering 1,,3,4,5,6 (observe that this is also the orer in which the participants receive their shares uner our algorithm in Example 1). Examples of other classes of graphs that satisfy this conition inclue layere networks, one-imensional geometric graphs, backbone networks. In each of these graphs, the k-propagating-ealer conition is satisfie for any noe as the ealer. In aition, any irecte acyclic graph (DAG) that satisfies the m-connecteealer conition automatically satisfies the m-propagatingealer conition (any topological orering of the DAG suffices as the requisite noe-orering). Our algorithm successfully performs secret share issemination to all participants if the graph satisfies the k-propagatingealer property. We note that while our algorithm requires existence of some orering of the noes satisfying the k- propagating-ealer property, the algorithm itself is completely istribute an oblivious of this orering. Apart from the parameters n an k, an aitional parameter is associate to our algorithm. We saw earlier that the k- 406

4 connecte-ealer conition is necessary for any secret sharing algorithm, an our algorithm requires the k-propagating-ealer conition to be satisfie. Now, assuming that these necessary conitions have been met, one woul intuitively expect the efficiency of the algorithm to be higher if the graph has a greater connectivity. The parameter is use to capture this intuition: our algorithm takes the parameter ( k) as input, an uner the assumption that the graph satisfies the -propagating-ealer conition, achieves a greater communication efficiency. Note that in the scenario that one oes not have an estimate of, one can execute the algorithm by simply setting to be equal to the secret sharing parameter k. C. Notational Conventions For any noe j, the set of its neighbouring noes is enote as N (j). In case of a irecte graph, N (j) enotes the set of noes that have an incoming ege from noe j. The ealer is enote by D. We say that a noe j is irectly connecte to the ealer if j N(D). Transpose of a vector or matrix is enote by a superscript T. For any integer l 1, [l] represents the set {1,...,l}. III. MAIN ALGORITHM Consier a network G that obeys the -propagating-ealer conition for some parameter ( k). Assume secret s belongs to the alphabet F k+1 q, for some q>n. Thus we can equivalently enote the secret as a vector s = [s 1 s s k+1 ] T with each element of this vector belonging to the finite fiel F q. A. Initial Setting up by the Dealer The ealer first constructs an (n ) Vanermone matrix Ψ, with the i th (1 i n) row of Ψ being ψ T i =[1 ii i 1 ]. (1) The vector ψ i is terme the encoing vector of noe i. Next, the ealer constructs a ( ) symmetric matrix M comprising the secret s an a collection of ranom values as: M = s T T A r a s B r a R b Rc T () s B R c 0 }{{}}{{}}{{} 1 k 1 k where the epicte sub-matrices of M are s A = s k+1 is a scalar, s B =[s 1 s k ] T is a vector of length ( k), r a is a ranom vector of length (k 1), R b is a ((k 1) (k 1)) symmetric matrix with its k(k 1) istinct entries populate by ranom values, R c is a (( k) (k 1)) matrix with its (k 1)( k) entries populate by ranom values. These ranom values are all picke inepenently an uniformly from F q. Note that the total number of ranom values R in matrix M is The share t j for participant j (1 j n) is a vector of length ( k +1): t T j = ψ T s T A s B j r a Rc T. (3) s B 0 We shall show subsequently in Theorem 3 that any k of these shares suffice to recover the entire secret. B. Communication across the Network Algorithm 1 escribes the communication protocol to securely transmit the shares {t j } n j=1 to the n participants. Algorithm 1 Communication Protocol Dealer: For every j N(D), compute an pass the -length vector ψ T j M to participant j. Participant l N(D): Wait until receipt of ata ψ T l M from the ealer. Then, for every j N(l), compute inner prouct of the ata ψ T l M with the encoing vector ψ j of participant j. Pass the resultant value ψ T l Mψ j to participant j. Participant l/ N(D): Wait until receipt of one value each from any neighbours. Then, enote this set of neighbours as {i 1,...,i }, an the values receive from them as {σ 1,...,σ } respectively. Compute the vector v T =[σ 1 σ ] T [ψ i1 ψ i ] 1. For every neighbour i N(l) from whom you i not receive ata, pass the inner prouct v T ψ i to participant i. 4 C. Correctness of the Algorithm The proofs of the following theorems are available in [1]. Theorem (Successful share issemination): Uner the algorithm presente, every participant l [n] can recover ψ T l M, an hence obtain its intene share (3). Theorem 3 (k-secret-recovery): Any k shares suffice to recover the secret. Theorem 4 ((k 1)-collusion-resistance): Any set of (k 1) or fewer colluing participants can gain no information about the secret. This hols for any graph, irrespective of whether it satisfies the require conitions. This algorithm is also robust to any run-time changes in the network topology (e.g., removal or aition of new links). IV. COMPLEXITY ANALYSIS AND LOWER BOUNDS In this section we provie an analysis an comparison of the communication complexity of our algorithm, the previous solution, an lower bouns for any scheme. Let N (D) enote the size of the set N (D). In the analysis, the parameters k an are treate as constants, however, most part of the analysis consiers finite n, k, an, an hence hols even when these parameters epen on n. All proofs are available in [1]. ( ) We efine, without loss of generality, one unit of ata to be k(k 1) k 1 the size of the secret. We shall use the notation Γ(.) to enote R =(k 1) + +(k 1)( k)=(k 1). communication complexity. The following theorem provies a The entire secret is containe in the components s A an s B comparison of the communication complexity of our algorithm as s T =[s 1 s k+1 ]=[s T B s A ]. Observe that the structure with lower bouns an with the previous solution. of M as escribe in (), along with the symmetry of matrix R b, makes the matrix M symmetric. Theorem 5: For any (n,k) an any G satisfying the k- propagating-ealer conition, the communication complexity 407

5 of our algorithm is Θ(n), an is always within a constant (multiplicative) factor of the lower boun. The previous solution entails a super-linear communication-complexity for a wie class of networks, an there exists a class of graphs for which its communication complexity is Θ(n ). These claims are mae more precise via the following results, which may also be of inepenent interest. 1) Our Algorithm Theorem 6: For any (n,k), an any G with (n +1) noes satisfying the -propagating-ealer conition for some (known), our algorithm entails a communication complexity Γ our (G)=n k +1. ) Information-theoretic Lower Bouns The following theorem provies an information-theoretic lower boun to the amount of ownloa at any noe in the network uner any scheme. Theorem 7: For an (n,k) secret sharing problem on any graph G with (n +1) noes, any noe l [n] must ownloa eg(l) eg(l) k+1 if l/ N(D) an eg(l) k Γ any (l) 1 if l N(D) if l/ N(D) an eg(l) <k where eg(l) enotes the number of incoming eges at noe l. Furthermore, this boun is the best possible, given only the ientities of the neighbours of noe l. Corollary 8: For an (n,k) secret sharing problem on any graph G with (n +1) noes, the total communication complexity is lower boune by Γ any (G) N(D) + eg(i) eg(i) k +1 n. i/ N (D) Thus the communication complexity of our algorithm is a constant multiplicative factor away from the lower boun. Corollary 9: For any (n,k) an any -regular graph with (n +1) noes satisfying the -propagating-ealer conition, uner our algorithm, the amount of ata ownloae by any noe l/ N(D) is the minimum possible. Furthermore, the amount of ata ownloae by any noe l N(D) is inepenent of n. Corollary 10: For any (n,k), an any (k <n), there exists a class of graphs with (n +1) noes such that each graph in this class satisfies the -propagating ealer property, an the communication complexity for (n,k) secret sharing on any graph G in this class is lower boune by Γ any (G) n (k 1) k +1 k +1. Thus, the complexity of our algorithm is a constant aitive factor away from the lower boun for this class of graphs. 3) Previous Solution Theorem 11: For any (n,k) an G, the communication complexity of the previous solution is Γ prev (G)= N (D) + [ ] w min w k w k +1 l w(d i) i/ N (D) where l w (D i) is the average of the path lengths of the w shortest noe-isjoint paths from D to i (with l w (D i)= if there o not exist w noe-isjoint paths from D to i). Corollary 1: For any sequence of graphs of increasing size with the maximum outgoing egree being O((log n) 1 ɛ )) for some ɛ>0, the previous solution requires a super-linear communication complexity. Corollary 13: For any (n,k) an any (k <n), there exists a class of graphs with (n +1) noes such that each graph in this class satisfies the -propagating ealer property, an (n,k) secret sharing on any graph G in this class using the previous solution requires a communication complexity n(n +1) Γ prev (G). 4 Thus, on a sequence of such classes of graphs, our algorithm requires Θ(n) communication complexity, as compare to Θ(n ) require uner the previous solution. V. CONCLUSIONS AND OPEN PROBLEMS The problem of secret sharing in a network arises funamentally in several problems for security an cryptography. By means of an explicit algorithm an information theoretic bouns, this paper provies upper an lower bouns on the communication complexity require for this problem. However, obtaining the precise complexity still remains open. The algorithm presente here requires the network to satisfy the k- propagating ealer conition, an heuristics to aress general networks are presente in the extene version [1]. However, the guarantees achieve by the algorithm in the general case are not known. Finally, it remains to see if any of the ieas from this specific case of secure network coing carry over to more general network coing problems. REFERENCES [1] A. Shamir, How to share a secret, Communications of the ACM, vol., no. 11, pp , [] M. Ben-Or, S. Golwasser, an A. Wigerson, Completeness theorems for non-cryptographic fault-tolerant istribute computation, in ACM STOC, [3] T. Peersen, A threshol cryptosystem without a truste party, in Avances in Cryptology EUROCRYPT, 1991, pp [4] M. Storer, K. Greenan, E. Miller, an K. Voruganti, Potshars: A secure, recoverable, long-term archival storage system, ACM Trans. on Storage, 009. [5] D. Dolev, C. Dwork, O. Waarts, an M. Yung, Perfectly secure message transmission, Journal of the ACM, vol. 40, no. 1, pp , [6] N. Cai an R. Yeung, Secure network coing on a wiretap network, IEEE Trans. on Inf. Th., Jan [7] J. Felman, T. Malkin, C. Stein, an R. Serveio, On the capacity of secure network coing, in Allerton Conf., 004. [8] H. Yao, D. Silva, S. Jaggi, an M. Langberg, Network coes resilient to jamming an eavesropping, in NetCo, 010. [9] C. Ngai an R. Yeung, Secure error-correcting (sec) network coes, in NetCo, 009. [10] T. Ho, M. Méar, R. Koetter, D. Karger, M. Effros, J. Shi, an B. Leong, A ranom linear network coing approach to multicast, IEEE Trans. Inf. Th., Oct [11] S. Jaggi, P. Saners, P. Chou, M. Effros, S. Egner, K. Jain, an L. Tolhuizen, Polynomial time algorithms for multicast network coe construction, IEEE Trans. Inf. Th., Jun [1] N. B. Shah, K. V. Rashmi, an K. Ramchanran, Secure network coing for istribute secret sharing with low communication cost. [Online]. Available: arxiv: [13] K. V. Rashmi, N. B. Shah, an P. V. Kumar, Optimal exact-regenerating coes for the MSR an MBR points via a prouct-matrix construction, IEEE Trans. Inf. Th., Aug