Tag Info

Hot answers tagged

6

Simplified SSLv3/TLS from this book Note, $R_{(Alice|Bob)}$ is a random nonce chosen by Alice or Bob respectively, and $\{S\}_{Bob}$ is encryption with Bob's public key. pre-master secret As stated in one of the answer you link to, "The point of a premaster secret is to provide greater consistency between TLS cipher suites." In the figure above, the ...


4

If you perform the distribution digitally (using networks) then you have a problem. Unless you use another one time pad you lose the perfect confidentiality as the distribution itself won't deliver perfect security. But using another one time pad is pointless: you would lose exactly as many key bits as you are distributing, while you are only protecting the ...


4

Actually, you can do Shamir Secret Sharing over any finite field $GF(p^k)$, for any prime $p$ and any integer $k$. If $k=1$, you have the $GF(p)$ field you mentioned; however it works on extension fields as well. We often pick $p=2$ and $k$ a multiple of 8; this makes everything nice even number of bytes (at the cost of doing our calculations in $GF(2^k)$). ...


3

To answer your question, the cryptographic complexity will reduce by $2^{k-n}$ where $k$ is the key length and $n$ is the number of bits known. A slightly better scheme that doesn't use a cryptographic key sharing scheme can be as follows: Generate three random numbers $B_1$, $B_2$, $B_3$ with bit length equal to the size of your key $K_p$. Generate each ...


3

Just use Shamir's Secret sharing: wiki link It's designed by Adi Shamir, who is the "S" in RSA. It's fairly simple to use and there are no known weaknesses in it. While it doesn't split the data, splitting the key may work just as well (unless you absolutely must split the data.)


3

There are no security advantages to evaluating the polynomial at random places instead of sequential. The information theoretic security proof of Shamir secret sharing does not depend on the evaluation points being chosen in any specific manner.


3

There is a one-to-one correspondence between the value of the second share and the value of the secret: each of the $2^8$ possible values of the second share will give a (distinct) value of the secret among the $2^8$ possible values for it, and vice versa. Hence, guessing the second share is exactly the same thing as guessing the secret.


3

Well, first off, unless the updated shares hid a different secret, the problem is impossible (unless $k' = 0$, or you haven't distributed $k$ of the old shares). That's because, since at least $k$ people have the old shares, they can get together and ignore the new shares; instead, they use their old shares to construct the secret. If you need the new ...


2

When a TLS/SSL session starts(after the hellos and cipher decisions) the server gives the client it's cert. The key in the cert could perform different actions depending on the key-agreement algorithm decided on by the client and server. Let's say they agree on RSA key agreement. This means the cert contains the server public RSA key and the server has a ...


2

In secret sharing, one person typically wants to share a secret. Only that one person knows that secret, so they are the dealer. In MPC, which VIFF implements protocols for, you actually have multiple parties, each with a secret input(s). So, each of these parties is the dealer for their individual secret input(s). In this sense, there is no central dealer ...


2

Yes, that is possible -- that's exactly the problem that secure multiparty computation solves. You should start by reading standard references on secure multiparty computation. You might enjoy the following paper, and follow-on work: Secure Multiparty Computations on Bitcoin, Marcin Andrychowicz and Stefan Dziembowski and Daniel Malinowski and Ɓukasz ...


1

There is no such thing as an incorrect secret. There is just some secret, that must be uniquely defined by the distribution phase.


1

A Flaw If you try working through your example concretely then you should see at least one issue with decoding. Consider values mod $8$: $ A = { 3 } \\ B = {7} \\ secret = {5 } $ Using your equations we have: $ Q = 3 + 7 + 5 = 7 \\ U = 3 - 7 + 5 = 1 $ And for decoding: $ B = (U - Q) / 2 \\ B = (1 - 7) / 2 \\ B = -6 / 2 ({\text mod} 8) $ But what ...


1

I'm not sure about your specific system; this only addresses "can a key derived from the password make a good shared secret?" The most common password hashing functions are actually designed for exactly this purpose -- deriving a cryptographic key from a (weak) password. That's actually what PBKDF2 stands for: "password-based key derivation function #2" ...


1

Reform the problem. Instead of each participant picking their givee (which they give to), have them select a giver (which they receive from). Each participant randomly generates a number (appropriately large) and anonymously submits it (e.g., via the tor network) to the site. This number represents them as giver. After all participants have entered, the ...


1

If you have $t-1$ shares of an $(t,n)$ system, you have a chance at learning of the roots of the system... as long as some of your shares have a 0 for the $y$ coordinate. You can't learn any other roots. Demonstration that the possession of a share with a $y$ coordinate of 0 gives you knowledge of a root (and forgive me if this is too obvious): A share ...


1

Just to be specific we are talking about information theoretically secure secret sharing, e.g. Shamir sharing. Lets say a secret $secret$ is shared in $n$ shares $S = \{s_1, \ldots, s_n\}$. Assume further party $P_i$ is given share $s_i$. If I understand your question correctly, you are asking if we give $P_i$ some share $r \ne s_i$ is there anyway for $P_i$ ...


1

Can you use threshold encryption and a mixnet? It might not be the fastest thing in the world but it uses well-understood components. Setup Every player generates an ElGamal keypair and proves knowledge of their secret key. The joint public key is the product of all public keys. (If you're worried about reset attacks, look up "Pedersen threshold key ...



Only top voted, non community-wiki answers of a minimum length are eligible