Shamir's secret sharing scheme - type of channels

Question

• For information theoretic security in Shamir's [m,m] secret sharing scheme, do i need both authentic and confidential channels?
• Another related query is ;is it true that if the channels are only authentic; then the Shamir's [m,m] secret sharing scheme is only computationally secure?
• If confidential channels are build on the basis of public key schemes; then doesn't that make the entire protocol computationally secure?

Answer 1

For information theoretic security in Shamir's [m,m] secret sharing scheme, do i need both authentic and confidential channels?

Regular shamir secret sharing provides no protection against modified shares. So we typically assume an honest dealer with authentic and confidential channels. That means the adversary cannot change the message in transit. If a party that receives a share is dishonest, however, they can change the share and go undetected.

is it true that if the channels are only authentic; then the Shamir's [m,m] secret sharing scheme is only computationally secure?

updated this part of the answer
It appears that without some very non-standard assumptions, using only authentic channels completely breaks the security of the system. While all shares are needed to recover the secret, and one share is kept by each party (not transmitted directly), a function of that share is transmitted which would allow the adversary to recover that share and break privacy.

If confidential channels are build on the basis of public key schemes; then doesn't that make the entire protocol computationally secure?

Assuming the adversary can see the cipertexts, then yes, using a public key scheme (or any computationally secure cipher) to protect confidentiality results in computational security since an adversary breaking the cipher would result in them finding all the shares, thus breaking the secret sharing.

Answer 2

The main misconception is, that Shamir's secret sharing is not a protocol. It states: If you have enough shares, then you can retrieve the information. And it is information theoretic.

Waht does this mean?

• First off, there is no adversarial model in the sense of malicious or honest-but-curious adversary.
• It is out of scope of the protocol how and if these shares are distributed.
• Assuming you change a share somehow, you will not be able to get the correct share again. Basically the interpolation will hand you a different secret.

So regarding your questions:

For information theoretic security in Shamir's $[m,m]$ secret sharing scheme, do i need both authentic and confidential channels?

That depends in which context you want to use the secret sharing, including what your attacker actually controls. If he can just observe the whole network when the trusted party distributes the shares, then you need encrypted channels. If that encryption is just computationally secure, then an unconditional attacker will just ignore that the channels are encrypted.

Another related query is ;is it true that if the channels are only authentic; then the Shamir's [m,m] secret sharing scheme is only computationally secure?

Secret sharing is information theoretic. The distribution of messages is probably not. But what I am actually wondering: What do you mean with "just authentic channels" in contrast to "authentic and confidential"? Messages are signed (for authenticity and integrity) but not encrypted? That's a pretty weird and commonly authenticated channels are also assumed to be encrypted (for confidentiality).

If confidential channels are build on the basis of public key schemes; then doesn't that make the entire protocol computationally secure?

The protocol, yes. That doesn't change the fact that secret sharing itself is information theoretically secure, since it doesn't contain the means of distributing shares.