I am facing the the following problem: Lets assume i have a secret, $S$, I want to share it to $N$ players so that $K$ of them can cooperate in order to obtain the secret ($K$,$N$ scheme). Is there a scheme that supports the joining of a new player where a set of $K$ players can issue a new key without obtaining the secret itself resulting a $(K,N+1)$ scheme and with no central entity meaning there is no dealer after the first dealership.
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
5
This is a classic problem that can be solved with secure multiparty computation. When a new player joins, the $K$ parties who approve them joining run a secure computation protocol to generate their share. Concretely, if Shamir sharing is used, then the function computed is "reconstruct the polynomial $p$ from the $K$ shares input, and output the share $p(\alpha_{N+1})$, where $\alpha_1,\ldots,\alpha_{N+1}$ are field elements and $\alpha_i$ is associated with party $P_i$.
answered Dec 7, 2017 at 14:17
-
$\begingroup$ Can this be done without changing the existing shares and without having one party member obtaining the secret itself? If the answer is yes, where can i find a reference for such a scheme? $\endgroup$– ShakDec 7, 2017 at 14:20
-
$\begingroup$ @Shak, Yes, that is exactly how it works. Any secure multiparty computation protocol should work. $\endgroup$– mikeazoDec 7, 2017 at 14:50
-
$\begingroup$ The specific protocol you want will depend on the corruption model, number of corrupted parties, and so on. You will need to read up on MPC for this. $\endgroup$ Dec 7, 2017 at 17:54
-
$\begingroup$ What is the major difference between shamir's secret sharing and secure multiparty computation? In order to reconstruct the secret in either case you need multiparty computation to reconstruct the secret, but I don't get the differene... $\endgroup$ Jan 16, 2022 at 14:39
-
$\begingroup$ In MPC, you never reconstruct the secret. You can use it in computations without bringing it together. $\endgroup$ Jan 16, 2022 at 14:49