# Implementing Secure multi-party computation for online website

I need to know if the following is feasible: I want that any two users of my website have a private key such that the private key is divided into three parts one for website owner and one each for the two users.

I understand that the private key can be divided into 3 parts such that two of them can generate the full key using "Shamir's Secret Sharing" , however I want to know if it is possible to independently generate and distribute the key parts to each party, so that the users do not need to fear that the website or other user may have the private key.

I think it may be possible using multi-party computation but could not find any such implementation.

Thanks

• So you're actually looking for some multi-party computation where a) everybody learns the public key and b) nobody alone learns the private key during the protocol execution c) any two out of three can recover the private key after the protocol has run and d) the private key is actually generated freshly during the protocol execution? – SEJPM Sep 25 '16 at 15:00
• @SEJPM yes exactly what I need. – lost111in Sep 25 '16 at 15:10
• Who has the private key initially? Anyone, or are you wanting the users to generate it together? – mikeazo Sep 26 '16 at 13:32
• Also, what do the users need to be able to do? Generate the private key and use it, or just perform certain cryptographic operations together. How about something like threshold cryptography? – mikeazo Sep 26 '16 at 13:35
• @mikeazo I want the private key generated in such a way that no single user has it at any point, only two users together should be able to generate the primary key. Once transaction is done, user 2 will sent his part of primary key to either user 1 or user 3, so that he has the complete private key – lost111in Sep 26 '16 at 14:57

If the key is any random string of bits (e.g. the key for a symmetric block cipher), and you want a secret sharing of this random value, what you want is called correlated randomness (see e.g. this paper by Ishai et al. from 2013 for its uses in multiparty computation). In this 2-out-of-3 case, you can simply let each party $i \in \{1, 2, 3\}$ generate a random $k$-bit string $r_i$ and send their value to the "next" party (i.e. party $i$ sends $r_i$ to party $i+1 \bmod3$). Define $r = r_1 \oplus r_2 \oplus r_3$ to be your random key. Then any single party has only two of the values $r_i$, and hence does not obtain any information about $r$, but any two parties can reconstruct $r$.