2
$\begingroup$

I am facing the the following problem: Lets assume i have a secret, $S$, I want to share it to $N$ players so that $K$ of them can cooperate in order to obtain the secret ($K$,$N$ scheme). Is there a scheme that supports the joining of a new player where a set of $K$ players can issue a new key without obtaining the secret itself resulting a $(K,N+1)$ scheme and with no central entity meaning there is no dealer after the first dealership.

$\endgroup$
2
$\begingroup$

This is a classic problem that can be solved with secure multiparty computation. When a new player joins, the $K$ parties who approve them joining run a secure computation protocol to generate their share. Concretely, if Shamir sharing is used, then the function computed is "reconstruct the polynomial $p$ from the $K$ shares input, and output the share $p(\alpha_{N+1})$, where $\alpha_1,\ldots,\alpha_{N+1}$ are field elements and $\alpha_i$ is associated with party $P_i$.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Can this be done without changing the existing shares and without having one party member obtaining the secret itself? If the answer is yes, where can i find a reference for such a scheme? $\endgroup$ – Shak Dec 7 '17 at 14:20
  • $\begingroup$ @Shak, Yes, that is exactly how it works. Any secure multiparty computation protocol should work. $\endgroup$ – mikeazo Dec 7 '17 at 14:50
  • $\begingroup$ The specific protocol you want will depend on the corruption model, number of corrupted parties, and so on. You will need to read up on MPC for this. $\endgroup$ – Yehuda Lindell Dec 7 '17 at 17:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.