This is something with which I am struggling to get my head around.
In Feldman's VSSS, I am aware that the Dealer broadcasts exponentials $a_{1},...,a_{t-1}$ of the secret $K$ and the coefficients in the secret polynomial of Shamir's SSS. The users can then combine this information with their knowledge of the public key values $x_{i}$ to verify the consistency of their key share.
What if we are in the presence of a fraudulent Dealer who, in addition to altering the key shares in such a way that the secret cannot be recovered, also attempts to alter the secret in such a way that the participants believe that they are in possession of consistent shares following Feldman's scheme?
In this case the shares of the participant will be Consistent but not Correct.
If $y_{i}$, $x_{i}$, $a_{i}$ and $K$ were the values before the change of values by the Dealer and $y'_{i}$, $x'_{i}$, $a'_{i}$ and $K'$ the values following the change. Then what if:
$g^{y_{i}}$ $\equiv$ $g^{K} (g^{a_{1}})^{x_{i}}\dots(g^{a_{t - 1}})^{x_{i}^{t - 1}}$ $mod$ $p$
and $g^{y'_{i}}$ $\equiv$ $g^{K'} (g^{a'_{1}})^{x'_{i}}\dots(g^{a'_{t - 1}})^{x' \hspace{0.5mm} ^{t - 1}_{i}}$ $mod$ $p$ $\hspace{2mm}$ ?
My question is that in this case, are the participants in the scheme aware that the secret they can collaborate to form is incorrect? If so why?
