I am trying to find an implementation or variant of a (k, n) threshold cryptosystem (as described here Shamir's Secret Sharing) where we can fix at least one of the k key parts, i.e., instead of ANY k key parts able to decrypt the ciphertext I want at least one of the k key parts to be a certain/fixed key part. So sort of a joint account cheque where k out of n signatures are required but the signature of the accountant should always be there. Any ideas?
Here's an easy way to do it:
The accountant plus any set of $k-1$ other parties can reconstruct the secret. And, any smaller subset cannot get any information on the secret $S$.
|show 1 more comment|
As pointed out in the comments, this is a poor choice since it does not maintain the security level of the secret sharing on which it is based.
For just one person, you can use Shamir except instead of storing the secret as point $f(0)$ use the point $f(t)$, where you give $t$ to the required person.
So, set up the scheme as $(k-1,n-1)$ for the other players. Then, between $k-1$ of them they can reconstruct the polynomail, but they require person $t$ to know where to evaluate it.