Let's suppose that we have two parties, $A$ and $B$ that are using a Shamir Secret Sharing scheme with $k=3$. $A$ holds the points $[x_1, f(x_1)]$ and $[x_2, f(x_2)]$ while $B$ holds $[x_3, f(x_3)]$ and $[x_4, f(x_4))]$.

$A$ sends the point $[x_1, f(x_1)]$ to $B$, and $B$ answers with the point $[x_3, f(x_3)]$, so that both $A$ and $B$ can reconstruct the shared secret to be used in the following part of the protocol.

The messages are sent over an unsecure channel and they are unauthenticated.

I have identified some issues in this part, for example an eavesdropper can intercept several different communications, eg. $A$ and $B$ with $C$ and $D$, obtaining $k = 3$ points and reconstruct the secret, for this I was thinking about defining a minimum security level by properly setting $k$.

Is there any other possible issue when using the Shamir Shared Secret to share critical information in the context of a protocol design?

  • $\begingroup$ I found this really open question, could you ask for a specific protocol instead of arbitrary one? $\endgroup$
    – kelalaka
    Oct 13, 2022 at 10:20

1 Answer 1


The issue you have raised can be addressed by A and B creating unique random points for each separate interlocutor, rather than each creating one single pair of points for use with everyone.

The other man-in-the-middle attack is when X intercepts rather than just eavesdropping. He can then arrange an “A with X” shared secret and an “X with B” shared secret.

There are ways of obviating this attack using hashes, since “the shared secret as seen by A” and “the shared secret as seen by B” are not the same when the attack has taken place, and they ought to be. But some quite careful protocol design is needed, and I only know that it works when Diffie-Hellman is used to set up the shared secret. Shamir may be different.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.