This is something with which I am struggling to get my head around.

In Feldman's VSSS, I am aware that the Dealer broadcasts exponentials $a_{1},...,a_{t-1}$ of the secret $K$ and the coefficients in the secret polynomial of Shamir's SSS. The users can then combine this information with their knowledge of the public key values $x_{i}$ to verify the consistency of their key share.

What if we are in the presence of a fraudulent Dealer who, in addition to altering the key shares in such a way that the secret cannot be recovered, also attempts to alter the secret in such a way that the participants believe that they are in possession of consistent shares following Feldman's scheme?

In this case the shares of the participant will be Consistent but not Correct.

If $y_{i}$, $x_{i}$, $a_{i}$ and $K$ were the values before the change of values by the Dealer and $y'_{i}$, $x'_{i}$, $a'_{i}$ and $K'$ the values following the change. Then what if:

$g^{y_{i}}$ $\equiv$ $g^{K} (g^{a_{1}})^{x_{i}}\dots(g^{a_{t - 1}})^{x_{i}^{t - 1}}$ $mod$ $p$

and $g^{y'_{i}}$ $\equiv$ $g^{K'} (g^{a'_{1}})^{x'_{i}}\dots(g^{a'_{t - 1}})^{x' \hspace{0.5mm} ^{t - 1}_{i}}$ $mod$ $p$ $\hspace{2mm}$ ?

My question is that in this case, are the participants in the scheme aware that the secret they can collaborate to form is incorrect? If so why?


1 Answer 1


There is no such thing as an incorrect secret. There is just some secret, that must be uniquely defined by the distribution phase.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.