I need to know if the following is feasible: I want that any two users of my website have a private key such that the private key is divided into three parts one for website owner and one each for the two users.

I understand that the private key can be divided into 3 parts such that two of them can generate the full key using "Shamir's Secret Sharing" , however I want to know if it is possible to independently generate and distribute the key parts to each party, so that the users do not need to fear that the website or other user may have the private key.

I think it may be possible using multi-party computation but could not find any such implementation.


  • 2
    $\begingroup$ So you're actually looking for some multi-party computation where a) everybody learns the public key and b) nobody alone learns the private key during the protocol execution c) any two out of three can recover the private key after the protocol has run and d) the private key is actually generated freshly during the protocol execution? $\endgroup$
    – SEJPM
    Sep 25, 2016 at 15:00
  • $\begingroup$ @SEJPM yes exactly what I need. $\endgroup$
    – lost111in
    Sep 25, 2016 at 15:10
  • $\begingroup$ Who has the private key initially? Anyone, or are you wanting the users to generate it together? $\endgroup$
    – mikeazo
    Sep 26, 2016 at 13:32
  • 2
    $\begingroup$ Also, what do the users need to be able to do? Generate the private key and use it, or just perform certain cryptographic operations together. How about something like threshold cryptography? $\endgroup$
    – mikeazo
    Sep 26, 2016 at 13:35
  • $\begingroup$ @mikeazo I want the private key generated in such a way that no single user has it at any point, only two users together should be able to generate the primary key. Once transaction is done, user 2 will sent his part of primary key to either user 1 or user 3, so that he has the complete private key $\endgroup$
    – lost111in
    Sep 26, 2016 at 14:57

1 Answer 1


What exactly constitutes the "private key"?

If the key is the private part of an asymmetric encryption key pair, such as for RSA, and you'd hence also like all three parties to know the public key, then what you're looking for is called distributed key generation. You can then also use threshold cryptography and let the parties compute private key operations – decryption and signatures – without any single party needing to have access to the full key.

If the key is any random string of bits (e.g. the key for a symmetric block cipher), and you want a secret sharing of this random value, what you want is called correlated randomness (see e.g. this paper by Ishai et al. from 2013 for its uses in multiparty computation). In this 2-out-of-3 case, you can simply let each party $i \in \{1, 2, 3\}$ generate a random $k$-bit string $r_i$ and send their value to the "next" party (i.e. party $i$ sends $r_i$ to party $i+1 \bmod3$). Define $r = r_1 \oplus r_2 \oplus r_3$ to be your random key. Then any single party has only two of the values $r_i$, and hence does not obtain any information about $r$, but any two parties can reconstruct $r$.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.