# Why only one secret value with Shamir's secret sharing? [duplicate]

Shamir's Secret Sharing works by sharing data points on a curve, whereby when you have the required number of data points, you can find the function of the curve and find out the secret, which is effectively f(0).

In the polynomial form of the function, the constant (the coefficient of $x^0$) is the secret information.

Could you treat the coefficients of the other powers of $x$ as secret values as well?

If so, are they just as secure / secret? Or is there some subtlety going on where you need fewer values to get the other coefficients?

It seems that if you had a cubic curve that you could have 4 secrets $S_i$, instead of 3 random numbers and one secret:

$$f(x) = S_1x^3 + S_2x^2+S_3x+S_4$$

• So, you're looking for using not only $S_4$, but also one or more of the other coefficients as a secret. What would be the point of this? If you're trying to increase the size of the secret, you could just use a larger modulus or run multiple instances in parallel. – Artjom B. Apr 24 '16 at 23:45
• Sure those could work too, but I'm curious if using the other co-efficients can be done, or if it's discouraged for any specific reasons. – Alan Wolfe Apr 25 '16 at 0:03
• What you are looking for is multi-secret sharing. It has been a while since I've read up on it, but there are plenty of papers out there on the topic. – mikeazo Apr 25 '16 at 0:45
• Thanks! I will read up on those. I'm actually just trying to understand why samshir's isn't a multi secret sharing algorithm - or if it is one, that'd be interesting to know too! – Alan Wolfe Apr 25 '16 at 1:00
• @poncho, I'm not sure this is a duplicate. That other question seems to be asking about sharing a single secret but using other coefficients instead of the $x^0$ term of the polynomial. This one is asking about using sharing multiple secrets at once. – mikeazo Apr 25 '16 at 11:44

If you have a polynomial of degree $< d$, with at most $t$ corrupt parties, then you can use a single polynomial to hide $d - t$ secrets. It's not hard to see that you can't hide more secrets than this. To share $k$ secrets, you need $k$ degrees of freedom. The $d$ coefficients induce $d$ degrees of freedom, but each of the $t$ corrupt parties learns one linear constraint.
Note: in what you described in your post you have a polynomial of degree $< 4$ so if you take the standard Shamir setting of $t=3$ corrupt parties you can only hide the one secret value. While it is true that 3 shares together don't reveal any individual secret coefficient, they reveal linear relationships that constrain the secret coefficients to a 1-dimensional subspace.
• Note that, depending on the $d-1$ shares being known, this 'linear relationship' can be "$S_2$ is this specific value". This sort of thing doesn't happen with Shamir's original method. – poncho Apr 25 '16 at 2:25