# Secret Sharing: Is this simplification secure?

I am a mathematician with no background in crypto or security. For work, I had to read up Chap.13 "Secret Sharing Schemes" in Stinson's Cryptography (3rd ed). My question is about a simplification of the so-called Monotone Circuit Construction.

In Sect. 13.2 Stinson discusses the case that you have $w$ participants $\mathcal{P} = \{ P_1, \ldots, P_w \}$ and you want to realize the access structure $\Gamma \subseteq 2^{\mathcal{P}}$, which is just an arbitrary set of subsets of $\mathcal{P}$. This means, exactly the subsets in $\Gamma$ should get access to the secret and no other group.

The method he presents was invented by Benaloh & Leichter (CRYPTO '88) and is called (by Stinson) the Monotone Circuit Construction. The idea is simple: You build a monotone Boolean circuit that "recognizes" $\Gamma$ and then compute the shares based on the wiring of the circuit (see Algorithm 13.1).

All this is fine, but it seems a bit overblown. Why not do the following? For each group of $\Gamma$ with $t$ participants you just "split" the secret number randomly among them (meaning, you use a $(t,t)$-Threshold Scheme) -- and you're done. This even should be a special case of the Monotone Circuit Construction.

1. Is the above suggestion secure?
2. What's the advantage of the more general approach as presented by Stinson?
• Your suggestion isn't well defined. What is $t$ for an arbitrary collection of subsets in the powerset? Feb 22, 2017 at 6:08
• @kodlu: It should be well-defined. $t$ depends on the particular group (i.e., subset) in $\Gamma$. Feb 22, 2017 at 6:15
• Your approach is probably secure (in an information theoretic sense) but it blows up the number of shares that a participant needs to store --- it is equal the number of groups it participates in. This renders the secret sharing scheme inefficient. The approach using boolean formulae is in this sense efficient. Feb 22, 2017 at 8:10
• Note that one can extend the result of Benaloh and Leichter to boolean circuits, assuming bounded adversaries, using a folklore technique by Yao (see On the Power of Computational Secret Sharing, by Vinod et al.). Feb 22, 2017 at 8:12
• @Occams_Trimmer: But why are MCCs more efficient? Theorem 13.2 is basically the same bound, right? Or is it possible to prove better bounds? Feb 22, 2017 at 8:18

Sure; for any group that doesn't have a subset that's a group in $\Gamma$, they don't have enough information to reconstruct the shared secret.