1
$\begingroup$

When it comes to applications, such as multiplication or addition, is there any difference between Shamir secret sharing and additive secret sharing?

$\endgroup$
1
  • 1
    $\begingroup$ It's unclear what "applications, such as multiplication or addition" means. I've answered the question as in the title. $\endgroup$
    – fgrieu
    Commented Feb 23 at 13:11

1 Answer 1

1
$\begingroup$

Additive secret sharing allows to share a secret into $n$ shares, so that all shares are required to rebuild the secret (or otherwise get any information about it). That reconstruction is by addition in a suitable group: e.g. bitstrings under eXclusive-OR, integers in interval $[0,m)$ under addition modulo $m$. All shares are uniformly random, except one set to the secret minus the sum of the other shares.

Shamir secret sharing1 is more flexible: it has an additional parameter, the threshold of shares (noted $t$ or $k$) that must be present to rebuild the secret. That threshold can be any integer in $[1,n]$.

Shamir secret sharing is the most common threshold secret sharing scheme. These fit some operational use cases that additive secret sharing does not allow, like reconstruction of a secret key if at least two out of three security officers are present, thus allowing operation when one of the officer is off-duty.


1 Adi Shamir: How to share a secret, in CACM, 1979

$\endgroup$
2
  • 1
    $\begingroup$ Is additive secret sharing essentially $(n,t)$ Shamir secret sharing with $t=n$ over a group? With Shamir we need a field (or at least a ring) so we can use interpolation which typically requires multiplicative inverses. $\endgroup$
    – kodlu
    Commented Feb 24 at 13:05
  • 1
    $\begingroup$ @kodlu: functionally, yes additive secret sharing with $n$ shares does the same as Shamir secret sharing $(n,n)$. But the math is not the same. For a start, Shamir secret sharing in field $\mathbb F_q$ requires that $n<q$, and there is no such requirement in additive secret sharing. And of course, additive secret sharing only cares about an additive group (commutative if we don't want to number the shares). $\endgroup$
    – fgrieu
    Commented Feb 24 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.