Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In Shamir's secret sharing scheme, we are trusting a third party who generates the secret polynomial.

How can we ensure security here when we are involving a third party?

share|improve this question

We simply have to trust this party because this scheme requires a trusted dealer (a party that distributes the shares to the secret to the participants - this can be you or some other party - but if its you you should trust yourself).

We can use verifiable secret sharing, that allows the parties to check whether the shares they have obtained are consistent, i.e. to verify if the dealer behaves honest (but the dealer still knows the secret and thus this is only a partial reduction of trust).

If we do not want to have a trusted dealer who sets up the shares at all, we have to switch to dealer-free secret sharing schemes. See for instance, here.

share|improve this answer

No one is stopping you from running the polynomial setup yourself. Knowledge of the polynomial is equivalent to knowing the actual secret. And knowledge of the complete polynomial is required to evaluate the polynomial at any point.

But this doesn't have to be a third party; it might be the case that your particular context uses a third party for this task, but that's not stated in the basic scheme.

However, there are quite a lot of variations of secret sharing scheme, e.g. without trusted dealer, with verifiable shares or with cheating detection. If you want to use something without trusted party, the protocols exist, but I have no idea if they are actually useable in practice.

share|improve this answer
+1 for questioning who the "third party" actually is :) – DrLecter Jun 18 '14 at 22:56

It depends on the situation. The third party can be a computer in a datacenter with armed guards at the door. Or it can be an employee who doesn't want to screw up and be fired. Or other things. Of course, none of those solutions are 100% foolproof, and it would be better to have a protocol which doesn't use a trusted third party, but if no such protocol is known, the protocol with a trusted third party is better than nothing, and may be workable in many contexts.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.