Prove that shares can reveal a seceret key. in a secret sharing scheme

Question

I am trying to build a cryptographic system that has several components and ran into a problem with a secret sharing scheme.

Let $v$ be a value we are interested committing to. I generate a commitment $P = aG + vH$ where $a\in \mathbb{Z}_q$ , $G$ and $H$ are generators of that group (Pedersen commitment scheme, if given $a$ someone can derive the value $v$).

Now lets assume I want to break $a$ (lets call it the blinding key) to $n$ shares using shamir secret sharing scheme where $k$ shares can produce $a$ ($k,n$ sharing scheme). so if $P$ is publicly known, is there a way where players who received a share can verify that the share they got actually produce $a$ without uncovering $a$? meaning that they know the combined shares can generate the blinding key.

I know that there exist a scheme for verifying that all shares are derived from the same polynomial (Paul Feldman's scheme) but what can prevent the possibility of an adversary calculating and distributing shares derived from some randomly generated and unrelated polynomial (where the secret is $c\neq a$)?

Answer 1

The obvious way to do this is to do a secret derivation on committed values, and have the dealer show that derived committed value is the same as the value he originally committed to.

For this, I'll assume that the secret sharing scheme is over the prime field $GF(q)$.

The dealer publishes the commitment $P$, and remembers the commitment value $v$.

And, when the dealer generates the share $i$ (for participant $i$), it generates the share id (which we'll assume is $i$), actual share value $a_i$ (which is the value of the secret polynomial evaluated at the share id $i$) and a commitment value $v_i$. It then gives the values $a_i, v_i$ to share holder $i$ secretly, and publishes the commitment $P_i = a_iG + v_iH$, as well as the share id $i$. The dealer also remembers all the $v_i$ values. When a shareholder gets his share, he can verify that his public commitment is consistent with the secret values he got.

Then, we select $k$ participants (you've already proved that the shareholders hold a consistent secret, and so it doesn't matter which set we pick).

Then, the actual secret value is $a = f_1a_1 + f_2a_2 + ... + f_ka_k \bmod q$, for some publicly computable values $f_1, f_2, ..., f_k$ (which depends on the actual set of shares). Hence someone, possibly the dealer, computes the value:

$$Q = f_1P_1 + f_2P_2 + ... + f_kP_k - P$$

which everyone can verify, as all the parameters are public.

The dealer can express this as:

$$Q = \sum f_i(a_iG + v_iH) \ - (aG + vH) = (\sum f_ia_i - a)G + (\sum f_iv_i - v)H$$

Where the dealer knows the values $f_i, v_i, v$. Hence, if $a = f_1a_1 + f_2a_2 + ... + f_ka_k$, then the dealer can generate a ZKP that he knows the discrete log of $Q$ to the base $H$; if not, then he cannot generate such a proof (because, if it knew that discrete log, it could (assuming it also remembered $a, a_i$) compute the discrete log of $G$ to the base $H$, which we assume was a hard problem.