Shamir's secret sharing scheme is a threshold secret sharing scheme based on polynomial interpolation over a finite field.

learn more… | top users | synonyms

11
votes
4answers
1k views

How do you find a cheater in Shamir Secret Sharing?

If there are 4 people involved, and every two of them should be able to know the secret (the polynomial is just a line) and you are given f(x) and x for each of those people, and you know one of them ...
7
votes
2answers
321 views

Recover from compromised shares with Shamir Secret Sharing

He is a quote from Wikipedia page for Secret Sharing: If the players store their shares on insecure computer servers, an attacker could crack in and steal the shares. If it is not practical to ...
7
votes
1answer
1k views

Coefficients in Shamir's Secret Sharing Scheme

Sorry if this is a stupid question, but: in Shamir's scheme, we construct a polynomial and make our secret $S$ the zero-th coefficient $a_0$. What, if anything, necessitates this - in other words, can ...
6
votes
2answers
277 views

Secure degree reduction for Shamir's secret sharing

I understand the basic Shamir Secret Sharing protocol, and when two shares are multiplied, the degree of the polynomial increases. I've seen in a number of papers a reference to a degree reduction ...
6
votes
2answers
155 views

Shamir's Secret Scheme : Knowing the threshold

If I am decoding a key by applying shares, is it possible to know when the threshold has been reached, and the secret revealed, without having to be told what the threshold is? Also, is it possible ...
5
votes
2answers
295 views

An electronic voting system

This semester I am taking the course Cryptography. I will have a presentation about the topic "Voting Scheme". I am preparing myself by reading from the book “Cryptography : an Introduction” by ...
5
votes
1answer
205 views

Shamir's Secret Share Over the Reals

What about using Shamir's secret share over the real numbers leaks information? I know there is a problem with random number generation, and someone suggested it leaks the parity of the polynomial, ...
5
votes
1answer
115 views

Back up an information as $n$ pieces and require exactly $n-1$ to recover it

Let $X\in \Bbb F_2^p$ be some information. How do I create $Y_1,\dots,Y_n \in \Bbb F_2^q$ so that having less than $n-1$ of the $Y_i$s gives you no information on $X$ but having $n-1$ of them allows ...
5
votes
1answer
438 views

How come Shamir Secret Sharing uses Lagrange interpolation?

I've read that Newton polynomials have better computational complexity, but Shamir's uses Lagrange polynomials instead. Does anyone know if there are particular reason why Newton polynomials aren't ...
5
votes
2answers
87 views

How many polynomials are used in Secure Multiparty Computation?

Secure Multiparty Computation based on Samir Secret sharing methods rely on Polynomials. Imagine corpus of data should be outsourced to bunch of untrusted servers for any computations. Now the data ...
4
votes
4answers
135 views

Shamir Secret Sharing: Why cannot we recover polynomial's root if we have $t-1$ shares?

Imagine we have $t-1$ shares in $(t,n)$ shamir secret sharing. So at least $t$ shares are needed. Question: Why cannot we use $t-1$ shares to find a root of the polynomial and then recover the ...
4
votes
2answers
513 views

Shamir's secret sharing scheme - type of channels

For information theoretic security in Shamir's [m,m] secret sharing scheme, do i need both authentic and confidential channels? Another related query is ;is it true that if the channels are only ...
4
votes
1answer
58 views

Beavers Triple Vs BGW Multiplication on MPC

Typically MPC protocols that are secure against semi-honest adversaries recommend the use of the revised GMW multiplication protocol by Gennaro et al. This is not the case against Active adversaries ...
4
votes
1answer
185 views

When all shares of a secret are given to adversary as a permuted matrix

Suppose we have a secret $\sigma$. The secret comes from a universe in which the elements are not necessarily distributed uniformly. We split $\sigma$ into $n$ shares $[\sigma_1,...,\sigma_n]$ ...
4
votes
2answers
106 views

Threshold cryptosystem with a required share

I am trying to find an implementation or variant of a (k, n) threshold cryptosystem (as described here Shamir's Secret Sharing) where we can fix at least one of the k key parts, i.e., instead of ANY k ...
4
votes
2answers
278 views

How to Distribute the Shares using Secret Sharing for arbitrary Monotone Access Structures

Consider 4 people, $A$,$B$,$C$,$D$, & a secret $s\in\{0,1\}^k$. Construct a scheme which enables the following subsets of people to retrieve the secret $\{A,B\}$, $\{A,C\}$, $\{B,C,D\}$. I know ...
4
votes
3answers
611 views

Is there a way to use Shamir Secret Sharing with updatable data?

I want to divide a system that maintains these properties, based on Shamir's Secret Sharing: A secret key is split up to N pieces, where T of them are enough to reconstruct the key. The original key ...
4
votes
1answer
62 views

Information theoretical security of an inefficient Shamir based access structure

I have studied Sharmir's scheme as well as the multiple assignment scheme proposed by M. Ito. My question is if anyone can tell me if the following scheme is theoretically secure: Terms: P = set of ...
3
votes
2answers
147 views

How does secret sharing solve the partial exposure problem?

I have been trying to understand how secret sharing methods like Shamir's secret sharing solve the problem of a share revealing information about the secret. I guess there are some random numbers ...
3
votes
3answers
372 views

Third-party security issues with Shamir's secret sharing scheme

In Shamir's secret sharing scheme, we are trusting a third party who generates the secret polynomial. How can we ensure security here when we are involving a third party?
3
votes
1answer
159 views

Does Runge phenomenon affect Shamir's secret sharing scheme?

Lagrange interpolation seems to be affected by the so-called Runge phenomenon when one tries to interpolate polynomials of high degree from a set of equidistant points. Lagrange interpolation is ...
3
votes
2answers
1k views

Why does Shamir's Secret Sharing Scheme need a finite field?

I read ampersand's question "Necessity for finite field arithmetic and the prime number p in Shamir's Secret Sharing Scheme", where he asked why Shamir's Secret Sharing Scheme uses arithmetic in a ...
3
votes
1answer
106 views

Why only one secret value with Shamir's secret sharing? [duplicate]

Shamir's Secret Sharing works by sharing data points on a curve, whereby when you have the required number of data points, you can find the function of the curve and find out the secret, which is ...
3
votes
1answer
62 views

Multi-Party Encryption for a Shared Document

Is there an encryption algorithm/protocol where any of a pre-defined set of keys/passwords will succeed in decrypting a document? The number of keys can be fixed, say, 10 or 20 possible passwords. ...
3
votes
1answer
401 views

Addition with Shamir secret sharing

When performing Shamir secret sharing I'm trying to find $z_i$, such that $z = x + y$. Where $n = 6$ and $t = 3$. I believe this would be the correct solution (correct me if I'm wrong): Each party ...
3
votes
1answer
513 views

Can I use Shamir's secret sharing scheme for multiplicative homomorphism for secure multiparty computation?

I would like to perform a dot product operation among $m$ parties using Shamir's $(m,m)$ secret sharing that is used for Secure Multiparty Computation. I am aware that Shamir's $(m,m)$ scheme is ...
2
votes
2answers
55 views

Shamir's Secret Sharing vs. Asmuth-Bloom scheme

I need to make use of a secret sharing scheme and I don't really know how to decide which one to use, Shamir's or Asmuth-Bloom (using CRT). The complexity for recovering the secret seems to be linear ...
2
votes
2answers
80 views

regular expression matching on encrypted data using secure multiparty computation

Lets consider Secure Multiparty Computation based on Secret Sharing schemes (rather than Garbled Circuits approach). If we have to do regular expression matching on secret shares of words of texts. ...
2
votes
1answer
207 views

Any reason to use Shamir given faster XOR threshold secret sharing algos?

TL;DR: Is the Kurihara algorithm really what it purports to be (dramatically faster but equally secure replacement for Shamir Secret Sharing)? ...
2
votes
1answer
90 views

How secure is Shamir's Secret Sharing for password sharing when attacker has t-1 shares?

I am designing protocol to share a random generated n long password between k parties using Shamir's Secret Sharing. I know that share alone does not reveal much information about the original ...
2
votes
1answer
205 views

Shamir Secret Sharing Modular Reduction

Say players use Shamir's secret sharing to share a value $k$ such that each player now holds $k_i$, a share of $k$. How can they securely compute $k \bmod m$ for some $m$. Of course they can ...
2
votes
1answer
303 views

Shamir's secret sharing with passwords

I'm trying to design an extension to Shamir's Secret Sharing that would allow the participant to specify a password instead of remembering/storing a large integer or binary data. So far, I have two ...
2
votes
1answer
76 views

Secret only known on consensus

Does a method exist where a secret is generated so that is is unknown until 3 or more people (predetermined) reach consensus that it should be revealed?
2
votes
1answer
128 views

Shamir's Secret Sharing of modular inverse

Given a secret $K \bmod q$ which is shared among entities $E_1,…,E_n$ using polynomial Shamir's Secret Sharing, how can the inverse of $k$ be shared without revealing $k$ and $k^{-1}$?
2
votes
1answer
233 views

Elliptic Curve Verifiable Secret Sharing

I'm reading this paper, which on page 3(Section IV.C) presents a Jointly Random Verifiable Secret Sharing Scheme for Elliptic curves. The algorithm makes sense to me save for this part: "Each ...
2
votes
2answers
42 views

Can you update a (k,n) scheme to a (k+t, n+t) scheme (assuming old keys can be deleted)?

I know that $(k,n)$ can increased to $(k+t,n-s)$ one, by generating a random polynomial $p(x)$ of degree $k+t$ with constant term $0$, and then ordering each agent $a$ to add $p(a_x)$ (where $a_x$ is ...
2
votes
1answer
68 views

Recombination thresholds in degree reduction of multiplied Shamir shares

Shamir's secret sharing can be considered multiplicatively homomorphic, if one is aware of the fact that multiplying two shares of a (n,t)-threshold shared secret yields a share of the same secret, ...
2
votes
0answers
218 views

Secure Secret sharing

I'm trying to come up with a new way to do oblivious transfer that is faster and requires less computation than existing methods. The basis of my method is shamir secret sharing. Below is an example ...
2
votes
0answers
123 views

Threshold signatures vs. certificate authority+voting verification

Perhaps a silly question, but I am wondering what the advantages are of threshold signatures. Let's consider the following two signature schemes: $(t,n)$-threshold signature with a trusted dealer, ...
1
vote
1answer
218 views

Choosing finite field size in Shamir's Secret Sharing Scheme

The Wikipedia article on Shamir's Secret Sharing says to that to have information theoretical security the splitting algorithm should be evaluated using finite field arithmetic on the field ...
1
vote
3answers
1k views

Implementing secret reconstruction in Shamir's Secret Sharing

I am trying to implement Shamir's secret sharing in C++. I have got the generation of shares working. However, I am very confused with the reconstruction of shares. I get the part on how three users ...
1
vote
2answers
328 views

Diffusion in Shamir's secret sharing scheme

The popular command line utility ssss implements the classic Shamir's secret sharing scheme over the generic field $GF(2^q)$ with $8 \le q \le 1024$. When $q>=64$, the constant coefficient ($c_0$) ...
1
vote
3answers
991 views

Lagrange Interpolation for finite field GF(2^8), for Secret Reconstruction

I'm using Lagrange's Interpolation technique to reconstruct the secret from a set of point pairs (x,y). Since I only need the secret, not the whole polynomial, I have simplified the reconstruction ...
1
vote
1answer
62 views

Shamir secret sharing: calculate rest of shares when you know secret and one share

Using Shamir secret sharing, one is starting with a secret and end up with a number of shares based on a polynomial. For example: INPUT: secret: 123456 Shares:4 ...
1
vote
1answer
151 views

Benefit of using random key in Shamir's Secret Sharing

I am implementing Shamir's Secret Sharing, and I find that in (t,n)-threshold scheme, the shares are just using 1,2,3...,n as the key to form the shares ...
1
vote
1answer
105 views

Numeric combination of passwords

Pls I need explanation on How i can design a Cryptography that use multiple passwords or passphrase to open a safe(Lock). For example, if i need five people to unlock a secured device whereby all the ...
1
vote
2answers
327 views

Shamir's Simple Sharing Scheme - preventing partial recovery of data

In SSSS, if you recreate the original secret with one of the decoder inputs being slightly damaged (e.g. one or two chars incorrect), you receive a slightly damaged version of the original secret. So ...
1
vote
3answers
66 views

Security guarantees of Shamir's secret sharing when some co-efficients are zero

Shamir secret sharing techniques rely on polynomials for splitting and reconstructing. It's security properties are very good, i.e. it is impossible to reconstruct the secret when $t-1$ shares are ...
1
vote
1answer
192 views

Roots of polynomial in Shamir secret sharing

I need to know whether one can obtain any roots of the polynomial in Shamir secret sharing if he possesses less than threshold shares. For instance in (t,n) if he has t-1 shares can he obtain any ...
1
vote
1answer
73 views

Secret Sharing 1 Required

Devise a scheme so that a message M can be shared among X, Y and Z in such a say that the only way of recovering the message is when X is present with either Y or Z. When X isn't present or each is ...