Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are there algorithms for secure secret sharing such that the algorithm depends solely on the value being secured, relying on no randomness in its calculations.

If there aren't, is such an algorithm an impossibility? If there are, what are some examples?

I ask because I've come up with a secret sharing scheme (which is probably littered with flaws ;-)), and I'd like try and prove certain properties about it. If deterministic secret sharing schemes are a no-go, I'd very much appreciate a heads up.

I'm not entirely certain this question is well defined. If it is not, I would greatly appreciate any information on why it is ill defined and how to make it more rigorous if possible.

share|improve this question
up vote 6 down vote accepted

Any deterministic secret sharing scheme as in the question has the property that any participant can run the deterministic algorithm for a guess of the shared secret, and eliminate the guess if the share that the algorithm deterministically assigns him/her does not match his/her share. This implies that some information about the secret is leaked in his/her share, or that his/her share is pointless (in the sense that his/her share can be removed from any set of shares that allows to reconstruct the secret, while keeping that ability).

Likely that's why there is no seldom such beast in the literature. For a counterexample to this assertion, see that other answer.

share|improve this answer

In a short paper "On sharing secrets and Reed-Solomon codes," Communications of the ACM, vol. 24, pp. 583-584, September 1981, Bob McEliece and I described a secret-sharing system that uses no randomness (cf. the second paragraph of the paper). This is most useful for very large secrets (lots of bits) since it divides the secret into $k$ parts, and then constructs $n > k$ shares of length equal to each of the $k$ parts. Protection against $c$ shareholders who knowingly submit maliciously altered shares to the reconstruction process as well as against $c$ careless shareholders who are unaware that their shares have been corrupted inadvertently is possible if more than $k+2c$ shares are available for reconstruction, and in either case, the submitters of altered shares can be identified.

Those who wish to point out that Shamir's original secret-sharing scheme also has $n$ shares of which any $k$ can be used to reconstruct the secret should recall that in Shamir's scheme, the secret together with $k-1$ randomly chosen parts of the same length as the secret constitute the $k$ pieces from which the sharing scheme constructs the $n$ shares. Thus, in Shamir's scheme, each share is as long as the secret, whereas in the Reed-Solomon scheme, each share is only $1/k$ as long as the secret.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.