Secret sharing on large girth graphs

TL;DR

This paper disproves a conjecture that large girth graphs have bounded complexity in secret sharing schemes, by constructing regular graphs with arbitrarily large girth and maximal complexity.

Contribution

It introduces a family of regular graphs with large girth and maximal complexity, extending previous results and using entropy and combinatorial methods.

Findings

Constructed regular graphs with large girth and maximal complexity.

Showed that large girth does not bound complexity in secret sharing.

Established combinatorial properties of these graphs related to edge covers.

Abstract

We investigate graph based secret sharing schemes and its information ratio, also called complexity, measuring the maximal amount of information the vertices has to store. It was conjectured that in large girth graphs, where the interaction between far away nodes is restricted to a single path, this ratio is bounded. This conjecture was supported by several result, most notably by a result of Csirmaz and Ligeti saying that the complexity of graphs with girth at least six and no neighboring high degree vertices is strictly below 2. In this paper we refute the above conjecture. First, a family of $d$-regular graphs is defined iteratively such that the complexity of these graphs is the largest possible $(d+1)/2$ allowed by Stinson's bound. This part extends earlier results of van Dijk and Blundo et al, and uses the so-called entropy method. Second, using combinatorial arguments, we show that this family contains graphs with arbitrary large girth. In particular, we obtain the following purely combinatorial result, which might be interesting on its own: there are $d$-regular graphs with arbitrary large girth such that any fractional edge-cover by stars (or by complete multipartite graphs) must cover some vertex $(d+1)/2$ times.

Equations

$$\text{mathbfit}c(G)=\underset{\mathcal{S}}{\inf }\underset{v\in V}{\max }\frac{H({\xi }_v)}{H({\xi }_s)},$$

$$\text{mathbfit}{I}_f(A;B)$$

$$\text{mathbfit}{I}_f(A;B|C)$$

$$\text{mathbfit}I(A;b{B}^{\ast })-\text{mathbfit}I(A;B^{\ast })$$

$$=f(b{B}^{\ast })-f(B^{\ast })+f(a{A}^{\ast }{B}^{\ast })-f(ab{A}^{\ast }{B}^{\ast })$$

$$=\text{mathbfit}I(b;A^{\ast }|a{B}^{\ast })+\text{mathbfit}I(a;b|B^{\ast })\ge 1+0.$$

$$f(A)\geq|B|+\big{(}f(AB)-f(B)\big{)}\geq|B|+1$$

$$\text{mathbfit}I(A;B^{\prime }{B}^{\prime \prime })=\text{mathbfit}I(A;B^{\prime })+\text{mathbfit}I(A;B^{\prime \prime }|B^{\prime })\ge |B^{\prime }|+1$$

$$\sum _{v\in G_d}f(v)\ge \frac{d+1}{2}|G_d|.$$

$$\sum _{v\in G_d}f(v)-f(G_d)\ge \frac{d}{2}|G_d|-1.$$

$$f(G_d^i)\ge |G_d|+1.$$

$$\sum _{v\in G_{d+1}}f(v)$$

$$\ge \sum _{i=1}^{n_{d+1}}\left(|G_d|+|G_d|\frac{d}{2}\right)=\frac{d+2}{2}|G_{d+1}|,$$

$$\sum _{v\in G_2}f(v)\ge f(v_1{v}_2)+f(v_3{v}_4)+\cdots \ge \frac{|G_2|}{2}\cdot 3.$$

$$\text{mathbfit}I(E_1;E_2)+\text{mathbfit}I(E_1{E}_2;E_3)+\text{mathbfit}I(E_1{E}_2{E}_3;E_4{E}_5\dots E_n)+$$

$$+$$

$$\sum _{i=1}^{n}f(v_i)-f(G_2)\ge n-1.$$

$$\text{mathbfit}I(v_1;v_2)+\text{mathbfit}I(v_1{v}_2;v_3)+\text{mathbfit}I(v_1{v}_2{v}_3;v_4{v}_5\dots v_n)+$$

$$+$$

$$\text{mathbfit}I(v_1{v}_2;v_3)$$

$$\text{mathbfit}I(v_4{v}_5;v_6)$$

$$\dots$$

$$\text{mathbfit}I(v_4{v}_5\dots v_{n-1};v_n)$$

$$\sum _{v\in V_i}f(v)-f(V_i)\ge \frac{d}{2}|G_d|-1$$

$$\sum _{i=1}^{n}f(V_i)-f(G_{d+1})$$

$$=\frac{n}{2}|G_d|+n-1.$$

$$\text{mathbfit}I(V_1;V_2)+\text{mathbfit}I(V_1{V}_2;V_3)+\text{mathbfit}I(V_1{V}_2{V}_3;V_4\dots V_n)+$$

$$+$$

$$\text{mathbfit}I(V_1{V}_2{V}_3;V_4\dots V_n)\ge |G_d|+1.$$

$$1+2+4+\cdots +2^{g-1}<2^g.$$

$$2(2^g+s\cdot (2^g+1))2^g(2^g+1).$$

$$\{a_{{\ell }_s},b_{u_s}:1\le s<2^g\}$$

Full text

1 Introduction

1.1 Motivation and notion

Secret sharing is a method for distributing some secret information between a set of participants by giving them partial knowledge of the secret in a way that only pre-described coalitions will be able to reconstruct the original secret from their respective parts. More precisely, let $\cal{P}$ denote the set of participants. A family of subsets $\cal{A}\subset$ $2^{\cal{P}}$ is called access structure if it is monotone increasing, i.e. if $A\in\cal{A}$ and $A\subseteq B$ then $B\in\cal{A}.$ The elements of $\cal{A}$ are called qualified subsets.

Definition 1**.**

A perfect secret sharing $\cal{S}$ realizing the access structure $\cal{A}$ is a collection of random variables $\xi_{i}$ for every $i\in\cal{P}$ and $\xi_{s}$ with a joint distribution such that

• (i)

if $A\in\cal{A}$, then $\{\xi_{i}:i\in A\}$ determines $\xi_{s};$

• (ii)

if $A\notin\cal{A}$, then $\{\xi_{i}:i\in A\}$ is independent of $\xi_{s}.$

In this paper we focus on the special case when every minimal element of $\cal{A}$ has two elements; these are the so-called graph-based schemes. The participants are the vertices of a graph $G=(V,E)$, and a set of participants is qualified if there is an edge $e\in E$ with endpoints in this set.

Traditionally the efficiency of a scheme is measured by the maximal amount of information some participant has to store compared to the size of the secret. This amount is called information ratio, or complexity of the scheme. The complexity of a graph $G$ is the best lower bound on the complexity of schemes realizing $G$, and can be defined formally in following way:

Definition 2**.**

The complexity (or information ratio) of the graph $G=(V,E)$ is

[TABLE]

where the infimum is taken over all perfect secret sharing schemes $\mathcal{S}$ realizing the access structure defined by the graph $G$, and $\mathop{\hbox{\bf H}}(\xi)$ is the Shannon entropy of the random variable $\xi$.

One of the most interesting and challenging problems in this topic is to determine the information ratio exactly for particular graphs or families of graphs [1]. The main tool is to prove general or specific estimations for the information ratio and find constructions which realize these bounds.

1.2 Related works

For a comprehensible account on secret sharing, on its relevance, please consult the survey [1]. In terms of the number of vertices, the best lower bound for $\mathbfit c(G)$ established so far is logarithmic in the number of vertices [3, 6, 10]; while it is known that $\mathbfit c(G)$ is always $\leq c\cdot n/\log n$ for some small constant $c$ [8, 12].

The only known method for proving lower bounds is the entropy technique, we explain it in more detail in Section 2. On the other hand, every graph based secret sharing scheme yields an upper bound. One fundamental tool in constructing such schemes is Stinson’s decomposition technique. While it is more general, we will use the following special case only.

Theorem 1** (Stinson’s Decomposition Theorem, [13]).**

Suppose that the edges of the graph $G$ can be fractionally covered by the edges of complete multipartite graphs such that every vertex is covered with weight at most $k$. Then $\mathbfit c(G)\leq k$. ∎

Using Stinson’s decomposition theorem for all star (spanned) subgraphs of a graph $G$ with weight 0.5, it follows immediately that the complexity of $G$ is at most $(d+1)/2$ where $d$ is the maximal degree. This upper bound is known as the Stinson’s bound.

To attack the problem whether Stinson’s bound is tight, in [10] van Dijk defined a family of $d$-regular graphs and proved that Stinson’s bound is asymptotically tight for that family. Later Blundo et al [3] showed that the complexity of this family actually matches Stinson’s bound. In Section 4 we generalize their result by showing that Stinson’s bound is tight for an even larger family of $d$-regular graphs.

The graphs in van Dijk’s family have girth 6 and ratio $(d+1)/2$. The complexity of other (sporadic) infinite graph families has been determined as well. Some examples are

• •

the edge graph of the $d$-dimensional hypercube which has complexity $d/2$ and girth $4$ [6];

• •

trees have complexity $<2$ and girth 0, for exact values consult [9];

• •

graphs with girth $>5$ and no adjacent vertices of degree at least three have complexity strictly below $2$ [7].

These results supported the intuition that high complexity requires high connectivity and bounded girth, as the interaction between nodes diminishes exponentially as their distance grows. We show that this intuition was wrong by constructing graphs with arbitrary large complexity and arbitrary large girth at the same time. The result is achieved in two steps. First, a family $\mathcal{G}_{d}$ of $d$-regular graphs is defined which extends the above mentioned van Dijk’s graph family. Using the entropy method, explained in Section 2, we show that all graphs in $\mathcal{G}_{d}$ have the maximal complexity allowed by Stinson’s bound, namely $(d+1)/2$. Second, in Section 5, using purely combinatorial arguments, we show that $\mathcal{G}_{d}$ contains graphs with arbitrary large girth.

Any fractional cover of the edges by spanned stars automatically gives a secret sharing scheme with complexity equal to the maximal cover weight on the vertices. Consequently any fractional edge-cover by stars of a graph from $\mathcal{G}_{d}$ covers some vertex at least $(d+1)/2$ times, even the ones which have large girth. This is in sharp contrast to the easy fact that a tree has a star-cover where each vertex is covered at most twice.

1.3 Organization

The entropy method is a universal, but not complete, tool to establish lower bounds on the information ratio of arbitrary access structures, see [1, 2, 3, 5, 6, 10]. For the convenience of the interested reader, the method is explained in Section 2. Specific lemmas tailored for establishing lower bounds on graph-based access structures are stated and proved in Section 3. Section 4 contains the definition of the family $\mathcal{G}_{d}$ of $d$-regular graphs along with the proof that they have complexity $(d+1)/2$. This graph family extends that of van Dijk from [10] and [3]. The existence of large girth graphs in $\mathcal{G}_{d}$ is proved in Section 5. The construction and the results in this section are purely combinatorial, and may be interesting independently. Finally, Section 6 concludes the paper and lists some open problems.

2 The entropy method

We focus on the special case of graph based structures. The method can be summarized as follows. Consider any function $f$ assigning non-negative real numbers to subsets of the vertices of $G$ (the normalized entropy function) with the following properties:

$f$ is monotone and submodular; moreover $f(\emptyset)=0$; 2. 2.

if $A\subset B$, $A$ is independent and $B$ is not, then $f(A)+1\leq f(B)$ (strict monotonicity) 3. 3.

if $C$ is empty or independent, $AC$ and $BC$ are not independent (qualified), then $f(AC)+f(AB)\geq f(C)+f(ABC)+1$ (strict submodularity).

If for any such function $f$ we have $f(v)\geq\alpha$ for some vertex $v$ of $G$, then the complexity of $G$ is at least $\alpha$.

As in the formula above, throughout the paper we drop the $\cup$ sign when denoting a union of subsets, and make no distinction between a vertex and the one-element subset containing that vertex. In particular, $aAB$ denotes the subset $\{a\}\cup A\cup B$. Lower case letters $a$, $b$, etc will denote vertices of $G$, and capital letters $A$, $B$, etc denote subsets of vertices.

The correctness of the method follows from the observation that any secret sharing scheme is a collection of random variables, and $f(A)$ can be chosen to be the total entropy of the shares given to the vertices in $A$ divided by the entropy of the secret. Thus the relative size of participant $v$’s share is just $f(v)$. The above properties of $f$ are the translations of basic Shannon inequalities and the fact that the distributed secret is independent from any independent set, and is determined by any non-independent subset of $G$. Consequently every secret sharing scheme assigns a share of relative size $\alpha$ to some participant.

Following the entropy notation, we will use the following abbreviations:

[TABLE]

The submodularity property gives that both expressions are non-negative, moreover strict submodularity is equivalent to $\mathbfit I_{f}(A;B{\,{|}\,}C)\geq 1$ whenever $C$ is either unqualified or empty, and $AC$ and $BC$ are qualified subsets.

In the formulas we frequently omit the function $f$, and any vertex, or subset of vertices stand for its $f$ value as well. In particular, we use $\mathbfit I(A;B)$ and $\mathbfit I(A;B{\,{|}\,}C)$ instead of $\mathbfit I_{f}(A;B)$ and $\mathbfit I_{f}(A;B{\,{|}\,}C)$ whenever $f$ is clear from the context.

3 Some general lemmas

We start by stating and proving some general lemmas which resemble to information theoretic arguments. Fix a function $f$ satisfying properties 1–3 defined in Section 2.

Lemma 2**.**

If $C$ is independent, $AC$ and $BC$ are not, then $\mathbfit I(A;B{\,{|}\,}C)\geq 1$.

Proof.

This is just the restatement of the strong submodularity requirement. ∎

Let $A$ and $B$ be disjoint subsets of the vertices. We say that there is a 1-factor from $B$ to $A$ if $B=\{b_{1},\dots,b_{t}\}$, and there are $t$ different elements $a_{1},\dots,a_{t}$ in $A$ such that $a_{i}b_{j}$ is an edge if and only if $i=j$.

Lemma 3**.**

Let $A$ and $B$ be disjoint subsets of the vertices, $B$ is independent, $A$ is not independent such that there is a 1-factor from $B$ to $A$. Then $\mathbfit I(A;B)\geq|B|$.

Proof.

The proof goes by induction on the number of elements in $B$. When $B$ is empty, then $|B|=0$ and there is nothing to prove. Otherwise let $ab$ be an edge in the 1-factor, and let the two sets be $A=aA^{*}$ and $B=bB^{*}$. Then $aB^{*}$ is independent, $abB^{*}$ and $aA^{*}B^{*}$ are not, thus we get $\mathbfit I(b;A^{*}{\,{|}\,}aB^{*})\geq 1$ by Lemma 2. Then

[TABLE]

From here the induction hypothesis gives the claim. ∎

Lemma 4**.**

With the same assumptions as in Lemma 3, $f(A)\geq|B|+1$.

Proof.

According to Lemma 3, $\mathbfit I(A;B)=f(A)+f(B)-f(AB)\geq|B|$. Thus

[TABLE]

by strict monotonicity as $B$ is independent and $AB$ is not. ∎

Lemma 5**.**

Let $A$ and $B$ be disjoint subsets of the vertices such that neither $A$ nor $B$ is independent. Suppose $B$ contains an independent subset $B^{\prime}$ and a 1-factor from $B^{\prime}$ to $A$. Then $\mathbfit I(A;B)\geq|B^{\prime}|+1$.

Proof.

Let $B=B^{\prime}B^{\prime\prime}$ where $B^{\prime}$ is the independent set with the 1-factor. Then

[TABLE]

by Lemmas 3 and 2. ∎

4 The graph family $\mathcal{G}_{d}$

Let $n_{2},n_{3},\dots,$ be integers, each one is at least 5, and $n_{2}$ is even. We construct a sequence of bipartite graphs $G_{2}$, $G_{3}$, …as follows. $G_{2}$ is the cycle with $n_{2}$ nodes; $A_{2}$, $B_{2}$ are the two independent sets consisting of the odd and even vertices, respectively.

Suppose $G_{d}$ has been constructed; the equal size partition $(A_{d},B_{d})$ of its vertices shows that $G_{d}$ is bipartite; $A_{d}$ and $B_{d}$ are independent, and all edges of $G_{d}$ go between $A_{d}$ and $B_{d}$. (This property holds for $G_{d}$ by induction.) Take $n_{d+1}$ copies of $G_{d}$ denoted as $G^{i}_{d}$ with $G^{n_{d+1}+1}_{d}=G^{1}_{d}$. The vertex set of $G^{i}_{d}$ is $A^{i}_{d}\cup B^{i}_{d}$ where $A^{i}_{d}$ and $B^{i}_{d}$ are the (equal size) independent subsets of the vertices of $G^{i}_{d}$.

To get $G_{d+1}$ add an (arbitrary) 1-factor between $B^{i}_{d}$ and $A^{i+1}_{d}$ for all $i=1,2,\dots,n_{d+1}$, see Figure 1. The equal size partition of $G_{d+1}$ showing that $G_{d+1}$ is bipartite is the union of vertices in $A^{i}_{d}$ and the union of vertices in $B^{i}_{d}$, respectively. The graph family $\mathcal{G}_{d}$ consists of all graphs $G_{d}$ constructed this way.

Claim 6**.**

$G_{d}$* is a $d$-regular bipartite graph on $n_{2}n_{3}\cdots n_{d}$ vertices.*

Proof.

Immediate from the definition. ∎

According to Stinson’s theorem [13], the information ratio of a $d$-regular graph is at most $(d+1)/2$. The next theorem claims that this bound is tight for graphs in $\mathcal{G}_{d}$. As van Dijk’s graph family is contained properly in $\mathcal{G}_{d}$, this theorem extends the main result of [3].

Theorem 7**.**

For any normalized entropy function $f$ on $G_{d}\in\mathcal{G}_{d}$ the following inequality holds:

[TABLE]

Consequently the information ratio of $G_{d}$ is exactly $(d+1)/2$.

The crux of the proof is the following inequality which will be proved by induction along the construction of the graph $G_{d}$.

Lemma 8**.**

For any normalized entropy function $f$ on $G_{d}$ the following inequality holds:

[TABLE]

Let us first see how to derive Theorem 7 from this lemma.

Proof of Theorem 7 assuming Lemma

8.

The graph $G_{d+1}$ consists of $n_{d+1}$ copies of $G_{d}\in\mathcal{G}_{d}$; each copy is connected by a 1-factor to the rest of $G_{d+1}$: half of the edges go to the previous copy, the other half of the edges go to the next copy; and the other endpoints of this 1-factor form an independent set of size $|G_{d}|$, see Figure 1. Thus, by Lemma 4,

[TABLE]

Applying Lemma 8 to each copy $G^{i}_{d}$ separately, we get

[TABLE]

which proves (1) when $d$ is at least 3. For the case $d=2$ let $a$, $b$, $c$, $d$ be four neighbor vertices on the cycle $G_{2}$. Now $f(bc)\geq 3$ by Lemma 4, as $ad$ is independent, $bc$ is not, and there is a 1-factor from $ad$ to $bc$. Consequently

[TABLE]

Here we used $f(b)+f(c)\geq f(bc)$, which is a special case of submodularity. ∎

Now we turn to the proof of Lemma 8. The validity of the following decomposition of an expression similar to the left hand side of (2) follows immediately from the definitions.

Fact 9**.**

Suppose $n\geq 5$ and $E_{i}$ are subsets of the vertices for $i=1,\dots,n$. Then $\sum_{i}f(E_{i})-f(E_{1}\dots E_{n})$ can be written as the following sum of $3+(n-4)$ entropy terms:

[TABLE]

Proof of Lemma 8.

First we prove (2) for the base case $d=2$. The graph $G_{2}$ is the cycle on $n=|G_{2}|\geq 6$ vertices. Let us denote the vertices by $v_{1},\dots,v_{n}$. The edges of $G_{2}$ are $v_{i}v_{i+1}$ and $v_{n}v_{1}$. For this graph inequality (2) rewrites to

[TABLE]

To prove it we use the decomposition in Fact 9 with $E_{i}=\{v_{i}\}$ to rewrite the left hand side as the $3+(n-4)$-term sum

[TABLE]

All the terms here are non-negative. Furthermore, by Lemma 3 we have

[TABLE]

and by Lemma 5, $\mathbfit I(v_{1}v_{2}v_{3};v_{4}\dots v_{n})\geq 3$ witnessed by the independent set $v_{1}v_{3}$. These numbers add up to $n-1$ proving the base case.

Next suppose we know the inequality (2) for the graph $G_{d}$, and want to prove it for $G_{d+1}$. The graph $G_{d+1}$ consists of $n_{d+1}=n\geq 5$ copies of $G_{d}$. The vertex set of the $i$-th copy is $V_{i}=A_{i}\cup B_{i}$, where $A_{i}$ and $B_{i}$ are disjoint independent sets of equal size. The induction hypothesis tells us that

[TABLE]

for every $i$. Since $|G_{d+1}|=n\cdot|G_{d}|$, we are done if we prove that

[TABLE]

Apply the decomposition using $E_{i}=V_{i}$ to get

[TABLE]

as an equivalent form of the left hand side here. By Lemma 5 each of these quantities, except for the third one, have value at least $1+|G_{d}|/2$, as $A_{i}\subset V_{i}$ is an independent set of size $|G_{d}|/2$ connected to the other part by a 1-factor. As $V_{1}V_{2}V_{3}$ has an independent set of size $|G_{d}|$ (the vertex set $A_{1}B_{3}$) connected by a 1-factor to $V_{4}\dots V_{n}$, we have

[TABLE]

The sum of these values is $n|G_{d}|/2+n-1$, as was required. ∎

5 Graphs in $\mathcal{G}_{d}$ with large girth

Graphs in $\mathcal{G}_{2}$ are even length cycles, thus the girth is equal to the number of vertices – which can be arbitrary large. The first challenge is to find large girth graphs in $\mathcal{G}_{3}$ where one can choose the 1-factors between the neighboring independent sets arbitrarily, see Figure 1. However, it is not clear how to control the interaction of those choices in order to avoid introducing short cycles. A natural approach would be choosing these 1-factors randomly. With too many 1-factors the graph will have constant girth with overwhelming probability, but maybe Lovasz Local Lemma [11] can be used to show that the girth is $>g$ with non-zero (while exponentially small) probability. Unfortunately this approach failed as well the attempts to use algebraic construction.

Our method which finds large girth graphs in $\mathcal{G}_{d+1}$ is based on the following idea. We choose all 1-factors between the different copies of the $G_{d}$ graph identically. Then map $G_{d+1}$ to $G_{d}$ so that the image of the vertex $v^{i}$ in the $i$-th copy of $G_{d}$ is just $v$. Then the image of $G_{d+1}$ is $G^{*}_{d}$ which has the same edges as $G_{d}$ plus a (maximal) 1-factor between the two independent sets $A_{d}$ and $B_{d}$ of $G_{d}$. If we know that $G^{*}_{d}$ has no short cycles, then we can conclude that neither does $G_{d+1}$. Lemma 10 shows the existence of such a $G^{*}_{2}$ graph on every large enough vertex number. To ease the description first we introduce the notion of $\pi$-graphs.

Let $\pi$ be a permutation on $1,\dots,n$. A $\pi$-graph is a 3-regular bipartite graph on vertices $a_{i}$, $b_{i}$ for $1\leq i\leq n$ such that $a_{i}$ is connected to $b_{i}$, to $b_{i+1}$ and to $b_{\pi(i)}$, where $b_{n+1}=b_{1}$.

A $\pi$-graph is bipartite, the two independent vertex classes are $\{a_{i}\}$ and $\{b_{i}\}$. The edges $a_{i}$ — $b_{\pi(i)}$ form a (maximal) 1-factor.

Lemma 10**.**

There is a function $N(g)$ such that for $g>3$ and $n>N(g)$ there is a permutation $\pi$ and a $\pi$-graph on $2n$ vertices which has girth $>g$.

Proof.

The distance of two vertices is the length of the shortest path between them. Thus $G$ has girth ${}>g$ if for any edge $uv$ of $G$, after deleting that edge the distance of $u$ and $v$ is at least $g$.

We construct the claimed $\pi$-graph by adding a 1-factor to a large cycle on $2n$ vertices. The initial graph has vertices $a_{i}$, $b_{i}$ for $i=1,\dots,n$ and edges $a_{i}$ — $b_{i}$ and $a_{i}$ — $b_{i+1}$, where indices are understood modulo $n$. A new edge can be added between the 2-degree vertices $a_{i}$ and $b_{j}$ if their distance is at least $g$. For a 2-degree vertex $v$ the number of vertices with distance $<g$ from $v$ is at most

[TABLE]

Consequently one can add the next edge in the 1-factor in a greedy way until the number of (unmatched) 2-degree vertices among the $a_{i}$ vertices goes below $2^{g}$.

At this point the graph has exactly $(2^{g}-1)+(2^{g}-1)$ 2-degree vertices, and girth ${}>g$. Next find (circular) intervals $I_{s}$ of the indices $1,\dots,n$ for $1\leq s<2^{g}$ with the following properties:

$I_{s}$ contains $2^{g}+1$ indices; 2. 2.

if $i\in I_{s}$, then both $a_{i}$ and $b_{i}$ are at distance $\geq g$ from any 2-degree vertex; 3. 3.

if $i\in I_{s}$ and $j\in I_{t}$, $s\not=t$, then $a_{i}$ and $b_{j}$ has distance $\geq g$.

After picking $s$ intervals, the number of indices which cannot be the midpoint of the next interval $I_{s+1}$ is at most

[TABLE]

Consequently, if $n>2^{4g+3}$ then one can find such intervals. From each interval $I_{s}$ pick two indices $u_{s}<\ell_{s}$ such that the distance between the vertices $b_{u_{s}}$ and $a_{\ell_{s}}$ is at least $g$. As the interval has length $2^{g}+1$, such a pair always exists. By construction, all distances between the vertices in the set

[TABLE]

are at least $g$, moreover any of them is at distance $\geq g$ from any 2-degree vertex.

Let the 2-degree vertices be $a_{i_{s}}$ and $b_{j_{s}}$ where $s$ runs from $1$ to $2^{g}-1$. Add $2(2^{g}-1)$ new vertices and some new edges to the graph. The new vertices are $a^{*}_{s}$ and $b^{*}_{s}$, and the new edges are $b_{j_{s}}$ — $a^{*}_{s}$, $a^{*}_{s}$ — $b_{u_{s}}$, and $a_{i_{s}}$ — $b^{*}_{s}$, $b^{*}_{s}$ — $a_{\ell_{s}}$, see Figure 2. In this new graph $G$ the new vertices $a^{*}_{s}$ and $b^{*}_{s}$ have degree 2; vertices $b_{u_{s}}$ and $a_{\ell_{s}}$ have degree 4, all other vertices have degree 3. $G$ still has girth $>g$. Indeed, any cycle without the new vertices has length $>g$. As new vertices have degree 2, if a cycle contains $a^{*}_{s}$, then it also contains $b_{j_{s}}$ and $b_{u_{s}}$; similarly for $b^{*}_{s}$. A short cycle cannot contain a single new vertex $a^{*}_{s}$ (or $b^{*}_{s}$) only, as $b_{j_{s}}$ and $b_{u_{s}}$ are far from each other. So the short cycle contains (at least) two new vertices connected by a short path, and this short path can only be $a^{*}_{s}$ — $b_{j_{s}}$–$\,\cdots$– $a_{i_{t}}$ — $b^{*}_{t}$, or $a^{*}_{s}$ — $b_{j_{s}}$–$\,\cdots$–$b_{j_{t}}$ — $a^{*}_{t}$, or $b^{*}_{s}$ — $a_{i_{s}}$–$\,\cdots$–$a_{i_{t}}$ — $b^{*}_{t}$. Any two of the endpoints of these paths are far from each other, thus one cannot merge them into a short cycle.

Now $G$ is bipartite, has girth $>g$, but it is not 3-regular. To make it 3-regular, we make the following changes. Delete the edges between $a_{i}$ and $b_{i}$ for $u_{s}\leq i\leq\ell_{s}$ (after this $a_{\ell_{s}}$ and $b_{u_{s}}$ will have degree 3), and add the edges $a^{*}_{s}$ — $b_{u_{s}+1}$, $a_{\ell_{s}-1}$ — $b^{*}_{s}$, and the edges $a_{i-1}$ — $b_{i+1}$ for $u_{s}<i<\ell_{s}$ as depicted on Figure 2. Denote this new graph by $G^{*}$.

If $G^{*}$ has a cycle, then the newly added (dashed) edges in the cycle can be replaced by three edges of $G$. This way the cycle cannot collapse, and after deleting edges traversed back and forth, the cycle in $G$ has at least as many edges as it had in $G^{*}$, but not more than three times as much. Consequently, the girth of $G^{*}$ is bigger than $g/3$.

Summing up, for any $n>2^{4g+3}$ we have constructed a $\pi$-graph on $2n+2(2^{g}-1)$ vertices which has girth bigger than $g/3$. Thus we have proved the lemma with the function $N(g)=2^{12g+4}$. ∎

Before continuing, let us show how Lemma 10 can be used to find a large girth graph in the family $\mathcal{G}_{3}$. Fix a $\pi$-graph $G$ on $2n$ vertices which has girth $>g$ as given by Lemma 10. Let the vertices of $G$ be labeled as $a_{i}$, $b_{i}$ such that $b_{1}$, $a_{1}$, $b_{2}$, $a_{2}$, …, $b_{n}$, $a_{n}$ is a cycle, and the additional 1-factor is given by the edges $a_{i}$ — $b_{\pi(i)}$.

Let $m\geq 5$. The vertices of $H$ are $a_{i,j}$ and $b_{i,j}$ where $1\leq i\leq n$ and $1\leq j\leq m$, the indices are understood modulo $n$ and $m$, respectively. $a_{i,j}$ is connected to $b_{i,j}$, $b_{i+1,j}$ and $b_{\pi(i),j+1}$. For fixed $j$, the vertices $a_{i,j}$ and $b_{i,j}$ form a cycle on $2n$ vertices – thus an instance of $\mathcal{G}_{2}$; and the edges $a_{i,j}$ — $b_{\pi(i),j+1}$ form a 1-factor between the independent sets $A_{j}$ and $B_{j+1}$. Consequently $H$ is a $\mathcal{G}_{3}$-graph. The map $\varphi(a_{i,j})=a_{i}$, $\varphi(b_{i,j})=b_{j}$ is a graph homomorphism from $H$ to $G$, which maps any cycle in $H$ into a cycle in $G$. (As $\varphi$ is onto, and both $H$ and $G$ are 3-regular, in the image no edge is traversed immediately backward.) As $G$ has girth $>g$, $H$ has girth $>g$ as well, as required.

To formalize the above construction, we introduce the following notation. Let $G$ be a graph on even number of vertices, $A$ and $B$ be the equal size partition of the vertices, and $\pi:A\to B$ be a one-to-one mapping. For any $m>1$ the graph $\mathcal{H}(m,G,\pi)$ consists of $m$ disjoint copies of $G$ labeled as $G^{1}$, $G^{2}$, …, $G^{m}$ with $G^{m+1}=G^{1}$. There is an additional 1-factor between $A_{j}$ of $G^{j}$ and $B_{j+1}$ of $G^{j+1}$ determined by the mapping $\pi$: the vertex $a_{j}\in A_{j}$ is connected to $\pi(a)_{j+1}\in B_{j+1}$. The above graph $H$ is just $\mathcal{H}(m,C_{2n},\pi)$, where $\pi$ is the map from Lemma 10.

For handling larger degree $d$ the following stronger claim will be proved by induction of $d$.

Lemma 11**.**

For each $g>3$ there exists a $d$-regular graph $G_{d}\in\mathcal{G}_{d}$ with independent vertex sets $A_{d}$, $B_{d}$, and a one-to-one map $\pi_{d}:A_{d}\to B_{d}$ such that for all $m>1$ the graph $\mathcal{H}(m,G_{d},\pi_{d})$ has girth $>g$.

Proof.

For $d=2$ the graph $G_{2}$ is the cycle on $N_{2}=2n\approx 2\cdot 2^{12g+4}$ vertices, and $\pi_{2}$ is the map given by Lemma 10. It satisfies the claim of the lemma as discussed above.

Suppose we have the graph $G_{d}$ on even number of vertices and the map $\pi_{d}$ as in the Lemma, and want to find $G_{d+1}$ and $\pi_{d+1}$. Let $t=3|G_{d}|$, and apply Lemma 10 to the girth $gt$ to get an $N_{d+1}\geq 5$ which is a multiple of $|G_{d}|$, and the map $\pi$ on $1,\dots,N_{d+1}$, which is a one-to-one map between the odd and even indices. Let $m_{d}=N_{d+1}/|G_{d}|$. This is $\geq 5$, thus $G_{d+1}=\mathcal{H}(m_{d},G_{d},\pi_{d})$ is in $\mathcal{G}_{d+1}$, and has $N_{d+1}$ vertices. These vertices can be labeled as $v_{i}$ for $1\leq i\leq N_{d+1}$ such that

1. a)

the two independent sets of $G_{d+1}$ are the odd-indexed vertices and the even-indexed vertices; 2. b)

if $v_{i}$ — $v_{j}$ is an edge in $G_{d+1}$, then the circular distance between $i$ and $j$ (that is, the smaller of $|i-j|$ and $N_{d+1}-|i-j|)$) is at most $t$.

Indeed, as $t=3|G_{d}|$, enumerate the vertices in the first copy of $G_{d}$ first, then the vertices in the second copy, and so on, making sure that the independent sets get the even and odd indices, respectively. Finally let $\pi_{d+1}$ be the map between the odd and even numbers between $1$ and $N_{d+1}$ as induced by the map $\pi$ of Lemma 10.

We claim that $G_{d+1}$ and $\pi_{d+1}$ satisfies the conditions of the lemma. The only non-trivial case is that $H=\mathcal{H}(m,G_{d+1},\pi_{d+1})$ has girth $>g$ for every $m>1$. Consider a (short) cycle in $H$. If this cycle has vertices from the same copy of $G_{d+1}$ only, then it has length $>g$ as $G_{d+1}$ has girth $>g$ by induction.

Consequently the cycle must have vertices in different copies of $G_{d+1}$. Let $v^{j}_{i_{1}}$ and $v^{j}_{i_{2}}$ be neighbor points in the cycle in the $j$-th copy, where $1\leq i_{1},i_{2}\leq N_{d+1}$. By construction, the circular distance of $i_{1}$ and $i_{2}$ is at most $t$, thus the $v^{j}_{i_{1}}$ — $v^{j}_{i_{2}}$ edge can be replaced by at most $t$ edges now in the cycle $v_{1},v_{2},\dots,v_{N_{d+1}-1},v_{N_{d+1}}$. But it means that the graph returned by Lemma 10 has a cycle of length $\leq gt$, which is a contradiction. ∎

The main theorem of this section is a simple corollary of Lemma 11.

Theorem 12**.**

There are arbitrary large girth graphs in $\mathcal{G}_{d}$.

Proof.

As $H=\mathcal{H}(m,G_{d},\pi_{d})$ has girth $>g$, and $G_{d}$ is a spanned subgraph of $H$, $G_{d}$ must have girth $>g$ as well. ∎

6 Conclusion

Using the entropy method, it was shown that the general upper bound $(d+1)/2$ on the complexity of graph based secret sharing schemes, known as Stinson’s bound, is tight for a large class of inductively defined $d$-regular bipartite graphs. The class $\mathcal{G}_{d}$ contains the graphs defined by van Dijk [10] and proved to be tight by Blundo et al [3].

In Section 5 it was proved that each $\mathcal{G}_{d}$ contains graphs of arbitrary large girth using combinatorial arguments. This result refutes the widely believed conjecture that large girth graphs have bounded complexity – due to the exponentially diminishing interaction between the shares assigned to the vertices.

The construction of the graph family $\mathcal{G}_{d}$ in Section 4 is not the most general one. When connecting instances of $G_{d}$ by 1-factors as indicated on Figure 1, the instances $G^{i}_{d}$ need not be isomorphic. The construction uses that they are of equal size, and the proof uses only that all of them are from $\mathcal{G}_{d}$. Stinson’s bound is tight for graphs in this extended family of bipartite $d$-regular graphs.

While graphs in $\mathcal{G}_{d}$ can have arbitrary large girth, they are highly connected: between any two vertices there are $d$ edge-disjoint paths. High connectivity, however, is compatible with low complexity: the complete graph $K_{n}$ has complexity 1.

The proof of Theorem 12 stating that $\mathcal{G}_{d}$ contains graphs of girth $>g$, can be used to estimate the size of this graph. $N_{2}\approx g$ as $\mathcal{G}_{2}$ contains cycles; $N_{3}\approx 12\cdot 2^{12g+4}$ by Lemma 10; and the inductive construction of Lemma 11 implies $N_{d+1}\approx 12\cdot 2^{36\,g\,N_{d}}$, a really huge number. A $d$-regular graph with girth $>g$ must contain at least $d^{g}$ vertices, and there are such graphs with essentially that many vertices. It seems plausible that the family $\mathcal{G}_{d}$ contains a $>g$ girth graph with about that much vertices. We leave to prove (or refute) this claim as an open problem.

Acknowledgment

This research was partially supported by the Lendület program of the Hungarian Academy of Sciences. The authors thank the members of the Crypto Group of the Rényi Institute, and especially Gábor Tardos, the numerous insightful discussions on the topic of this paper.