Secret Sharing with Binary Shares

Shamir's celebrated secret sharing scheme provides an efficient method for encoding a secret of arbitrary length $\ell$ among any $N \leq 2^\ell$ players such that for a threshold parameter $t$, (i) the knowledge of any $t$ shares does not reveal any information about the secret and, (ii) any choice of $t+1$ shares fully reveals the secret. It is known that any such threshold secret sharing scheme necessarily requires shares of length $\ell$, and in this sense Shamir's scheme is optimal. The relaxed notion of ramp schemes requires the reconstruction of secret from any $t+1+g$ shares, for a gap parameter $g>0$. Ramp secret sharing is possible with share lengths depending only on the gap ratio $g/N$. In this work, we study secret sharing in the extremal case of bit-long shares, where even ramp secret sharing becomes impossible. We show, however, that a slightly relaxed but equally effective notion of semantic security for the secret, and negligible reconstruction error probability, eliminates the impossibility. Moreover, we provide explicit constructions of such schemes. Our relaxation results in separation of adaptive and non-adaptive adversaries. For non-adaptive adversaries, we explicitly construct secret sharing schemes that provide secrecy against any $\tau$ fraction of observed shares, and reconstruction from any $\kappa$ fraction of shares, for any choices of $0 \leq \tau < \kappa \leq 1$. Our construction achieves secret length $N(\kappa-\tau-o(1))$ which we show to be optimal. Finally, we construct explicit schemes against adaptive adversaries attaining a secret length $\Omega(N(\kappa-\tau))$. Our work makes a new connection between secret sharing and coding theory, this time wiretap codes, that was not known before, and raises new interesting open questions.