# Recover from compromised shares with Shamir Secret Sharing

If the players store their shares on insecure computer servers, an attacker could crack in and steal the shares. If it is not practical to change the secret, the uncompromised (Shamir-style) shares can be renewed. The dealer generates a new random polynomial with constant term zero and calculates for each remaining player a new ordered pair, where the x-coordinates of the old and new pairs are the same. Each player then adds the old and new y-coordinates to each other and keeps the result as the new y-coordinate of the secret.

The idea here is that if you add a polynomial with constant term $0$ to another polynominal, it doesn't change the constant term. But I don't get how this is better than just redistributing new shares.

If you distribute the updates over an insecure channel, then the attacker can intercept them, steal new shares and convert them to old shares by substracting the update. So you have to distribute the updates over a channel as secure as the one originally used to distribute shares. So what's the point of using updates instead of just generating new shares?

-

The point is that the dealer generating the update needn't know what the shared secret is.

If we had a dealer that remembered what the shared secret was (or we asked enough people to contribute their shares so that the dealer could reconstruct it), then yes, the dealer could generate new shares.

However, this would require is a dealer that did know the secret. In contrast, anyone can generate a random polynomial with an constant term $0$; all they would need is the degree of the polynomial (that is, the threshold of the secret sharing scheme), the field the polynomial is in, and the $x$ coordinates of the uncompromised parties; all this can be made public without compromising the security of the system.

Remember, the whole point of the shared secret scheme was that no one knows what the secret is (until it's officially time to reconstruct it).

-
+1. Of course, it's worth noting that the dealer still needs to be trusted; a malicious dealer could construct their polynomial with a non-zero constant term, thereby changing the secret (potentially to one of their choosing, if they can guess the original secret). –  Ilmari Karonen Aug 9 '14 at 14:49
Since I use secret sharing to back up a key that I use daily, I totally missed the fact that you need the secret to issue new shares. Thanks for pointing that out :-) –  xavierm02 Aug 9 '14 at 15:24