Multi-receiver Authentication Scheme for Multiple Messages Based on Linear Codes

TL;DR

This paper introduces a generalized multi-receiver authentication scheme based on linear codes, allowing unlimited receivers and incorporating access structures, extending prior Reed-Solomon based methods with enhanced flexibility and security characterization.

Contribution

It generalizes existing authentication schemes to linear codes, enabling unlimited receivers and integrating access structures, with security characterized by minimal codewords in the dual code.

Findings

Supports arbitrarily many receivers for message verification.

Extends the scheme of Safavi-Naini and Wang beyond Reed-Solomon codes.

Characterizes receiver security via minimal codewords in the dual code.

Abstract

In this paper, we construct an authentication scheme for multi-receivers and multiple messages based on a linear code $C$. This construction can be regarded as a generalization of the authentication scheme given by Safavi-Naini and Wang. Actually, we notice that the scheme of Safavi-Naini and Wang is constructed with Reed-Solomon codes. The generalization to linear codes has the similar advantages as generalizing Shamir's secret sharing scheme to linear secret sharing sceme based on linear codes. For a fixed message base field $\f$, our scheme allows arbitrarily many receivers to check the integrity of their own messages, while the scheme of Safavi-Naini and Wang has a constraint on the number of verifying receivers $V\leqslant q$. And we introduce access structure in our scheme. Massey characterized the access structure of linear secret sharing scheme by minimal codewords in the dual code whose first component is 1. We slightly modify the definition of minimal codewords in \cite{Massey93}. Let $C$ be a $[V,k]$ linear code. For any coordinate $i\in \{1,2,\cdots,V\}$, a codeword $\vec{c}$ in $C$ is called minimal respect to $i$ if the codeword $\vec{c}$ has component 1 at the $i$-th coordinate and there is no other codeword whose $i$-th component is 1 with support strictly contained in that of $\vec{c}$. Then the security of receiver $R_i$ in our authentication scheme is characterized by the minimal codewords respect to $i$ in the dual code $C^\bot$.