PaperlayerView exact revision on arXiv

Source-linked AI summary

Physalia: Redistribution-Resistant Content Protection for Decentralized Storage

Giacomo Giuliari, Karl Wüst

arXiv:2609.28277v1cs.CR

TL;DR

Key leakage in decentralized storage can expose publicly stored ciphertext, making content piracy cheaper than redistributing the full data. Physalia secret-shares the data itself and formalizes the resulting redistribution cost, while adding a generic robustness transform. It reports a cost of approximately the data size and demonstrates end-to-end throughput on Walrus.

  • Problem

    Key-based access control can let a leaked decryption key expose publicly stored ciphertext, lowering the effort needed to distribute protected content.

    Source: §1 · p. 1

  • Method

    Physalia secret-shares data across servers and uses Physalia-RCSS, a robustness transform for computational secret sharing, within an end-to-end access-control system.

    Source: §1 · p. 3

  • Results

    ≈|D| redistribution bandwidth is required to leak content in Physalia, and Walrus experiments achieve encoding and reconstruction at multiple tens of Gbps.

    Source: §1 · p. 4

  • Takeaways & Limitations

    Physalia makes leakage require exfiltrating the full content rather than a short key, while its transform adds robustness with constant-size authentication metadata per share.

    Source: §7 · p. 15

    The redistribution-bandwidth analysis assumes the malicious reader does not collude with servers holding share-decryption keys, and the system assumes an honest writer.

    Source: §2.1 · p. 4, §3 · p. 8

Abstract

from arXiv · show

In decentralized storage systems, access control is often implemented by encrypting the data before upload and sharing the decryption key with authorized parties. A leaked key, however, makes the data publicly accessible, which lowers the barrier to content piracy below that of traditional systems, where piracy requires redistributing the full data. We present Physalia, an end-to-end access-control system for decentralized storage that secret-shares the data itself, instead of just the key, across multiple servers. Leaking the data then requires transmitting it in full: We formalize this intuition and introduce the redistribution bandwidth an adversary must pay to leak protected content and show that Physalia raises it to the size of the data. Sharing across untrusted servers requires robustness against corrupted shares. We develop a robustness transform that turns any computational secret sharing scheme into a robust one and which is of independent interest. In contrast to existing schemes that rely on error correction, it uses signatures with ephemeral keys and adds only constant-size metadata per share. We show that this transform is secure and evaluate Physalia end-to-end on the Walrus decentralized storage system with an on-chain access policy.

1 Introduction

Physalia protects content in decentralized storage by secret-sharing the data rather than only its decryption key, making leakage require transmitting substantially more information. The paper formalizes this redistribution cost, develops a generic robustness transform, and reports an end-to-end Walrus implementation.

Motivation

  • A leaked decryption key can make publicly stored ciphertext accessible, unlike data leakage that requires reconstructing and re-hosting the full content.Sharing only the key across servers removes a single point of failure but does not prevent key leakage.Source: §1 · pp. 1–3

End-to-end system

  • Physalia secret-shares the data across servers, with encrypted shares in public storage and a smart contract defining the access policy.The approach raises the effort for an authorized reader to provide access to unauthorized parties.Source: §1 · pp. 2–3

Generic robustness transform

  • Physalia-RCSS turns any computational secret-sharing scheme into a robust one using ephemeral signing keys, preserving secrecy and robust correctness.The transform adds constant overhead per share and tolerates f = min(k −1, n −k) corrupted shares.Source: §1 · pp. 3–4

Redistribution bandwidth

  • Physalia’s redistribution bandwidth is ≈|D|, degrading to (k−j)/k |D| under collusion with j servers, whereas key-based designs require leaking only a key.The transform tolerates f = min(k −1, n −k) corrupted shares and adds constant overhead per share.Source: §1 · p. 4

End-to-end implementation

  • Walrus experiments show encoding and reconstruction at multiple tens of Gbps, modest write-latency overhead, and read latency comparable to—and sometimes lower than—direct Walrus reads.End-to-end store latency is dominated by Walrus storage and on-chain transactions rather than Physalia-RCSS.Source: §1 · p. 4

2 Physalia System Design

Physalia combines a decentralized storage system, servers, and a smart contract with computational secret sharing and a robustness transform. Its design uses compact shares and signed-share verification to support reconstruction despite corrupted shares, under the stated system assumptions.

2.1 System and Threat Model

  • The system assumes an honest writer and non-byzantine servers that enforce access checks; up to f = min(k −1, n −k) servers may be byzantine, while confidentiality holds against coalitions smaller than k.The redistribution-bandwidth analysis additionally assumes a malicious reader does not collude with servers.Source: §2.1 · pp. 4–5

2.2 Architecture and Workflow

  • The writer creates robust shares, encrypts each for its corresponding server, stores them in decentralized storage, and deploys the access policy to a smart contract; authorized readers obtain shares and reconstruct the content.Servers check authorization against the contract before retrieving and decrypting their respective shares.Source: Figure 2 · p. 5, §2.2 · p. 6

2.3 Computational Secret Sharing

  • Physalia uses computational secret sharing to keep shares compact at approximately |D|/k bytes, rather than the |D| bytes per share of information-theoretically secure sharing.Any k indexed shares recover the secret, while fewer than k reveal no information to a computationally bounded adversary.Source: §2.3 · p. 6

2.4 The Robustness Transform

  • Physalia-RCSS signs each indexed CSS share with a fresh per-secret ephemeral key, embeds the public key and signature in each share, and deletes the signing key.The public key is established by agreement among at least k shares, without requiring public-key infrastructure or a long-term dealer identity.Source: §2.4 · pp. 6–7
  • Readers verify shares before CSS recovery; with at most f = min(k −1, n −k) corrupted shares and at least k original shares, robust reconstruction returns the original secret.Invalid shares are discarded, and the reader requests additional shares if fewer than k valid shares remain.Source: §2.4 · pp. 7–8

3 Redistribution Bandwidth

Redistribution bandwidth measures the minimum information a legitimate reader must send to let an unauthorized party access protected data. Physalia makes that cost proportional to the content size, with a gradual reduction under reader–server collusion.

Threat Model and Setup

  • The analysis considers publicly readable storage and assumes the malicious reader does not collude with servers that hold share-decryption keys.The paper treats credential sharing as orthogonal to the low-cost, large-scale distribution addressed by the analysis.Source: §3 · pp. 8–9

Redistribution bandwidth

  • A reader must transmit approximately |D| in Physalia, versus |K| in the key-based deployment, giving a redistribution bandwidth ratio of |D|/|K|.This comparison holds whether the naive design holds, shares, encapsulates, or releases K through threshold key management.Source: §3 · p. 9

Graceful Degradation under Collusion

  • With j < k colluding servers, the outsider still needs (k−j)/k |D| of the data; only k colluding servers eliminate the redistribution cost entirely.The guarantee degrades linearly in the number of colluding servers.Source: §3 · p. 9

4 Security Guarantees

The robustness transform is analyzed for any underlying computational secret-sharing scheme, assuming an honest dealer. It preserves secrecy and provides robust correctness when the signature scheme is secure and the corruption threshold is respected.

Security Guarantees

  • The guarantees apply to any underlying secure CSS scheme and assume an honest dealer.The analysis establishes secrecy preservation and robust correctness.Source: §4 · p. 9

Secrecy Preservation

  • The transform preserves CSS secrecy because its added ephemeral public key is independent of the secret and each signature depends only on its accompanying share.An adversary against the transformed scheme yields an adversary against the underlying scheme with the same advantage.Source: §4 · p. 9

Robust Correctness

  • With an EUF-CMA-secure signature scheme, at most f = min(k −1, n −k) corrupted shares, and at least k original shares, reconstruction outputs the original secret.Under these conditions, defeating reconstruction requires a signature forgery.Source: §4 · p. 10

5 Evaluation

Physalia’s end-to-end evaluation finds modest write overhead and, for some configurations, reads as fast as or faster than direct Walrus reads; its SSMS-based design also reaches higher throughput than AONT-RS in most tested cases. The evaluation measures robustness costs separately and examines how the share layout affects storage and fault tolerance.

5 Evaluation

  • The evaluation measures encoding and reconstruction throughput and separates base sharing time from robustness overhead, then implements Physalia end to end with Walrus and Sui.The microbenchmarks use SSMS and AONT-RS, compare them with HK1, an HK2-style variant, and RAONT-RS, and test multiple configurations, worker counts, and payload sizes.Source: §5 · p. 10, §5.1 · p. 10

5.1 Microbenchmarks

  • At 1 GB with (10, 6) and 12 workers, Physalia-SSMS reaches 48.3, 77.6, and 33.8 Gbps for encoding, first-k, and last-k reconstruction, versus 29.8, 41.7, and 25.7 Gbps for Physalia-AONT.Across the full matrix, SSMS has higher throughput in 32/32 encoding, 29/32 first-k, and 28/32 last-k cases; encoding throughput is 1.32–1.75 times the AONT-based rate.Source: §5.1 · pp. 11–12, Figure 4 · p. 11
  • AONT-RS typically has lower throughput because it hashes the full ciphertext during encoding and reconstruction, whereas SSMS secret-shares the short encryption key.HK1 and HK2 exceed Physalia-SSMS throughput in 71 and 73 of 96 matched cases, respectively; Physalia’s per-share metadata is constant-sized and shares can be verified independently.Source: §5.1 · p. 12
  • At 1 GB, Physalia-SSMS reconstruction latency is within 4.2% of HK1/HK2, with an 18–19% encoding premium.On the same AONT-RS base, Physalia-AONT has 5% less encoding robustness overhead than RAONT-RS, but 11% and 2% more for first-k and last-k reconstruction.Source: Figure 5 · p. 11, §5.1 · p. 12

5.2 End-to-End Experiments

  • At 1 GB with (10, 6), greedy reads take 10.03 s versus Walrus’s 13.08 s, while stores take 58.48 s versus 36.84 s.Greedy reads also outperform Walrus at 100 MB, but remain slower at 1 GB for (3, 2) and (5, 3); stores are slower at every tested size and configuration.Source: §5.2 · pp. 12–13
  • Walrus storage accounts for 73–78% of 1 GB store latency across all four configurations, while local share generation and encryption take 3.52–5.24 s.Sui creation and finalization take 7.59–11.33 s.Source: §5.2 · p. 13
  • Configuration (10, 9) has the lowest 1 GB store latency and similar greedy-read latency to (10, 6), with expansion of approximately 10/9 rather than 10/6.The lower redundancy tolerates one faulty share rather than four; the layout choice also determines share count and approximate payload size |D|/k.Source: §5.2 · p. 14

6 Related Work

Related work spans secret-sharing schemes, robustness mechanisms, and key-based access control for public storage. Physalia differs by secret-sharing the data and by using a robustness transform designed to avoid several costs of existing approaches.

Secret sharing

  • SSS provides information-theoretic security but has shares as large as the secret and no robustness; ramp schemes reduce share size but allow partial leakage from sets between t and k.AONT-RS and SSMS are computational secret-sharing schemes with share sizes of approximately 1/k of the data, which is optimal for computational secret sharing.Source: §6 · p. 14

Robust secret sharing

  • ECC-based robustness schemes can require authentication overhead linear in n, while Physalia’s per-share overhead is fixed at 96B in the stated even-n, k = n/2 + 1 case.The comparison covers Krawczyk’s fingerprint scheme and its HK1/HK2 variants, and RAONT-RS; Krawczyk’s individual-share signatures instead require an authenticated verification key.Source: §6 · p. 14
  • Physalia establishes an ephemeral verification key through agreement among shares, unlike Krawczyk’s individual-share signatures, which require an authenticated dealer verification key such as through a PKI.Its transform verifies shares before decoding, unlike adept secret sharing’s reconstructed-secret check, which may require inspecting up to 2n subsets after corruption.Source: §6 · pp. 14–15
  • VSS lets parties check share consistency against a commitment and detect a malicious dealer, but typically requires interaction and added communication overhead.The paper distinguishes this from its setting, which assumes an honest dealer.Source: §6 · pp. 14–15

Key-Based Access Control on Public Storage

  • In key-based systems such as Seal, public storage holds ciphertext unlocked by a released key, so redistribution requires about |K| bits; in Physalia, leaking data requires about |D| bits.Seal uses key servers that evaluate an on-chain policy and derive a decryption key from shares of a master secret.Source: §6 · p. 15

Related concepts

  • Big-Key Cryptography studies deliberately large symmetric keys to resist key exfiltration, while the Bounded Storage Model assumes limited adversarial memory for unconditional key-agreement security.Source: §6 · p. 15

7 Conclusion

The conclusion presents Physalia as access control for decentralized storage that raises the cost of leaking protected data to the scale of the data itself. Its robustness transform adds constant-size authentication metadata per share, and its Walrus and Sui implementation demonstrates practical throughput and latency.

7 Conclusion

  • Physalia requires an adversary to exfiltrate the full content rather than a short key, making leak cost scale with the data size.The conclusion characterizes its Walrus and Sui implementation as showing tens of Gbps encoding and reconstruction with modest store and read latency overhead.Source: §7 · p. 15
  • Physalia-RCSS adds robustness to any computational secret-sharing scheme with constant-size authentication metadata per share, without combinatorial trial decoding or a pre-authenticated dealer verification key.Source: §7 · p. 15

A Pseudocode

  • RSS.Share first runs the underlying CSS.Share, then signs each indexed share with an ephemeral key and returns shares containing the public key, signature, index, and share value.RSS.Reconstruct selects a public key represented by at least k shares, verifies shares under that key, and recovers from at least k valid shares.Source: A Pseudocode · pp. 17–18

B Security Games and Proofs

The appendix formalizes computational secret sharing and robust correctness, then defines games for secrecy and corruption resistance. It proves that the robustness transform preserves the underlying scheme’s secrecy.

B.1 Definitions

  • A computational secret-sharing scheme provides indexed shares and recovery, with completeness for any at-least-k subset and secrecy when fewer than k shares are revealed to a computationally bounded adversary.Source: §B.1 · pp. 18–19
  • Robust correctness requires recovery of the original secret when at most f = min(k −1, n −k) shares are corrupted and at least k original shares remain.Source: §B.1 · p. 19

B.2 Security Games

  • The CSS indistinguishability game tests secrecy by letting an adversary choose equal-length secrets, see at most k −1 shares of a randomly selected secret, and guess which was shared.The secret-malleability game tests whether corrupting or dropping up to f shares can cause an incorrect reconstruction or rejection despite at least k original shares remaining.Source: §B.2 · pp. 19–20

B.3 Secrecy Preservation

  • The transform preserves CSS indistinguishability because its ephemeral key is sampled independently of the secret and the proof reduces any transformed-scheme adversary to one against the underlying scheme.The appendix also states that robust correctness follows by reduction to signature unforgeability, under the honest-dealer assumption.Source: B Security Games and Proofs · p. 18, §B.3 · p. 20

B.4 Robust Correctness

The robustness transform provides robust correctness when the underlying CSS scheme is complete and the signature scheme is EUF-CMA-secure. The appendix applies the result to SSMS and AONT-RS, the two CSS schemes used in the evaluation.

B.4 Robust Correctness

  • No computationally bounded adversary wins the secret-malleability game with non-negligible probability when the signature scheme is EUF-CMA-secure.This is the stated robust-correctness guarantee for the transformed scheme.Source: §B.4 · p. 21
  • The proof reduces any successful secret-malleability adversary to a signature forgery, covering both altered reconstructions and incorrect rejection of authentic shares.If the adversary wins, the reduction extracts a message-signature pair not requested from its signing oracle.Source: §B.4 · p. 21

B.5 Instantiations

  • SSMS shares encrypted data with an MDS code and shares its key with Shamir secret sharing; AONT-RS applies an all-or-nothing transform before MDS coding.Both schemes recover from any k shares; their secrecy analyses are inherited from the underlying schemes.Source: §B.5 · p. 22
  • The secrecy of evaluated SSMS and AONT-RS is inherited from prior analyses, rather than newly proved for these instantiations.The cited analysis for AONT-RS excludes its small-secret information-leakage attack here because the secret is padded to at least k blocks.Source: §B.5 · p. 22

C.1 Microbenchmark Methodology

The microbenchmarks compare sharing throughput and robustness costs across schemes, configurations, payload sizes, and worker counts. SSMS generally outperforms RAONT-RS in the measured full matrix, while authentication overhead remains substantial in some cases.

C.1 Microbenchmark Methodology

  • Throughput tests cover four (n, k) layouts, 1 and 12 workers, four payload sizes, and encoding, first-k, and last-k reconstruction.Timing includes algorithm-internal allocations, randomness, and authentication, but excludes networking, serialization, and per-server encryption.Source: §C.1 · p. 23
  • 38.8–84.0% of SSMS first-k time and 11.8–51.2% of last-k time is robustness overhead across the measured cases.Constant-size authentication metadata does not make authentication time constant, because hashing still processes share payloads.Source: §C.1 · p. 23
  • Across the full matrix, SSMS throughput exceeded RAONT-RS in all 32 encoding cases and in 28 of 32 cases for each reconstruction operation.Source: §C.1 · p. 23

C.2 Microbenchmarks Across All Configurations

  • Figures 8–11 show throughput above 1 GB cost breakdowns for four layouts, with columns for encoding, first-k, and last-k reconstruction.Their plots use 12 workers; the two Physalia bars show SSMS- and AONT-RS-based variants, with upper breakdown segments denoting robustness overhead.Source: §C.2 · p. 24, Figure 8 · p. 25, Figure 9 · p. 26

C.3 End-to-End Methodology

The end-to-end evaluation measures Physalia on Walrus and Sui testnets against plaintext Walrus storage, using greedy and lazy reads. At 100 MB, mean greedy-read latency is slightly below the Walrus baseline; the appendix extends latency plots across all four layouts.

C.3 End-to-End Methodology

  • The comparison uses Physalia’s balanced Walrus SDK profile and the baseline’s aggressive profile, each selected because it performed better than the alternative profile.Thus, the comparison reflects both system design and resource allocation, not an isolated SDK-profile effect.Source: §C.3 · p. 29
  • Each size and layout has ten stores, ten greedy reads, and ten lazy reads; the same stored object is reused for reads of each strategy.These are repeated accesses to fixed objects, not independent trials on newly stored content.Source: §C.3 · p. 29
  • Reported times are client-side wall-clock times for successful attempts, and the sequential testnet measurements do not evaluate concurrent throughput or injected failures.Physalia store timing includes share generation, per-server encryption, Walrus storage, and Sui content-object creation and finalization.Source: §C.3 · p. 29
  • 3.17 s versus 3.33 s is the mean greedy-read latency versus Walrus at 100 MB.Across layouts at 1 GB, Sui creation and finalization take 7.59–11.33 s, compared with 3.52–5.24 s for share generation and encryption.Source: §C.3 · p. 30

C.4 Latency Across All Layouts

  • Figures 12 and 13 show read latency by layout and store latency by data size; read plots include means and individual observations, including first reads.Both axes in the read-latency figure are logarithmic; the store figure uses a logarithmic data-size axis.Source: Figure 12 · p. 31, Figure 13 · p. 32

D Robustness Metadata Overhead

The metadata comparison finds that Physalia’s relative overhead depends on the threshold regime. Its crossover against the hash-based baselines occurs at different even n values for high-threshold and near-majority layouts.

D Robustness Metadata Overhead

  • The reported hash-based commitment sizes are not sizes for formal HK2’s statistically hiding primitive; Physalia stores an Ed25519 signature and verification key.The comparison therefore describes the stated hash-based variant rather than formal HK2’s primitive.Source: D Robustness Metadata Overhead · p. 33
  • The plotted matched-tolerance comparison distinguishes optimized per-hash costs from ideal packing without local omission and marks Physalia’s first strict even-n wins.The plotted labels identify those first wins; the figure caption does not provide additional numerical cell values.Source: Figure 14 · p. 33, D Robustness Metadata Overhead · p. 33
  • At k = n −1, optimized costs are n−1 and n+15 bytes, with first strict even-n wins at n = 98 and n = 82, respectively.The passage attributes the difference to a padding artifact; ideal packing without local omission costs 32n/(n −2) bytes, plus 16 for openings.Source: D Robustness Metadata Overhead · p. 33
  • At k = n/2 + 1, Physalia is strictly smaller from even n = 8; HK1 costs 16(n −1) bytes and HK2-style/RAONT-RS cost 16n.The comparison ties against HK2-style/RAONT-RS at n = 6, and both costs grow linearly.Source: D Robustness Metadata Overhead · p. 33
Loading 2609.28277v1…