To my understanding, there are two "approaches" to t out of n threshold encryption. In both of them, n shares are given to different shareholders, and at least t of them must agree to "proceed". "Proceed" can take two different meanings: either the shares are the input to derive a secret that can be used to perform a traditional decryption (e.g. Shamir) or the shareholders produce a partial encryption that can be put together to generate the decryption (e.g. Damgård-Jurik).

I have found the first scenario to be known as secret sharing, but I am looking for a term to describe the second approach unambiguously. Does such term exist?


I believe there is strong enough precedence for using the term threshold decryption for the second.

The abstract of this paper states:

A threshold decryption scheme is a multi-party public key cryptosystem that allows any sufficiently large subset of participants to decrypt a ciphertext, but disallows the decryption otherwise.

Sounds to me like what you are talking about. A search for "threshold decryption" turns up plenty of hits too.

  • $\begingroup$ Perhaps it's more common to call it "Threshold encryption"? See for instance this paper by Boneh et al.. Anyway, I admit that "threshold decryption" is more precise, technically speaking. $\endgroup$ – cygnusv Feb 19 '16 at 15:57
  • $\begingroup$ @cygnusv Yeah, I've seen Threshold Encryption before too. Probably either works just as well. $\endgroup$ – mikeazo Feb 19 '16 at 16:20
  • 4
    $\begingroup$ A scheme supporting this is a "threshold encryption scheme" -- i.e., an encryption scheme of the threshold variety -- or just "threshold encryption" for short. But since the threshold part only comes into play during decryption, it's fine to refer to that process as "threshold decryption" $\endgroup$ – Mikero Feb 19 '16 at 16:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.