Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
  • For information theoretic security in Shamir's [m,m] secret sharing scheme, do i need both authentic and confidential channels?
  • Another related query is ;is it true that if the channels are only authentic; then the Shamir's [m,m] secret sharing scheme is only computationally secure?
  • If confidential channels are build on the basis of public key schemes; then doesn't that make the entire protocol computationally secure?
share|improve this question

2 Answers 2

up vote 5 down vote accepted

For information theoretic security in Shamir's [m,m] secret sharing scheme, do i need both authentic and confidential channels?

Regular shamir secret sharing provides no protection against modified shares. So we typically assume an honest dealer with authentic and confidential channels. That means the adversary cannot change the message in transit. If a party that receives a share is dishonest, however, they can change the share and go undetected.

is it true that if the channels are only authentic; then the Shamir's [m,m] secret sharing scheme is only computationally secure?

updated this part of the answer
It appears that without some very non-standard assumptions, using only authentic channels completely breaks the security of the system. While all shares are needed to recover the secret, and one share is kept by each party (not transmitted directly), a function of that share is transmitted which would allow the adversary to recover that share and break privacy.

If confidential channels are build on the basis of public key schemes; then doesn't that make the entire protocol computationally secure?

Assuming the adversary can see the cipertexts, then yes, using a public key scheme (or any computationally secure cipher) to protect confidentiality results in computational security since an adversary breaking the cipher would result in them finding all the shares, thus breaking the secret sharing.

share|improve this answer
    
let us continue this discussion in chat –  nie_11 May 15 at 19:33
    
Cleaned up some comments based on a mistake I had made on the 2nd part of the question –  mikeazo May 16 at 12:43
    
@nie_11 Some asked your question for you: crypto.stackexchange.com/questions/16310/… –  mikeazo May 21 at 18:39

The main misconception is, that Shamir's secret sharing is not a protocol. It states: If you have enough shares, then you can retrieve the information. And it is information theoretic.

Waht does this mean?

  • First off, there is no adversarial model in the sense of malicious or honest-but-curious adversary.
  • It is out of scope of the protocol how and if these shares are distributed.
  • Assuming you change a share somehow, you will not be able to get the correct share again. Basically the interpolation will hand you a different secret.

So regarding your questions:

For information theoretic security in Shamir's $[m,m]$ secret sharing scheme, do i need both authentic and confidential channels?

That depends in which context you want to use the secret sharing, including what your attacker actually controls. If he can just observe the whole network when the trusted party distributes the shares, then you need encrypted channels. If that encryption is just computationally secure, then an unconditional attacker will just ignore that the channels are encrypted.

Another related query is ;is it true that if the channels are only authentic; then the Shamir's [m,m] secret sharing scheme is only computationally secure?

Secret sharing is information theoretic. The distribution of messages is probably not. But what I am actually wondering: What do you mean with "just authentic channels" in contrast to "authentic and confidential"? Messages are signed (for authenticity and integrity) but not encrypted? That's a pretty weird and commonly authenticated channels are also assumed to be encrypted (for confidentiality).

If confidential channels are build on the basis of public key schemes; then doesn't that make the entire protocol computationally secure?

The protocol, yes. That doesn't change the fact that secret sharing itself is information theoretically secure, since it doesn't contain the means of distributing shares.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.