We are developing an iOS app which employs Shamir Secret Sharing algorithm. We made all possible steps users can trust us. We can't remember their secrets nor we can save encoded fragments. But they still may not trust us with randomness. Is there any cryptographic method how user can verify we are using random number generator honestly and have no malicious interests?
Nothing you show the user within the app could prove that the numbers were truly generated randomly and that the numbers weren't leaked maliciously or accidentally.
In general, you could make your application (or the module that does the cryptography, assuming it's built into a separate binary like a library or an executable used by the main app) open source and use a reproducible/deterministic build process so that users can compile the source themselves and verify that it matches what they've installed. I'm not sure how feasible or convenient this may be on the iOS ecosystem though. (Users might need a rooted phone to be able to view the app's binary installed from the app store, etc.)
A real-life example that's relevant is Diceware, where users generate strong, uniform random passphrases by rolling dice and looking the results up in a numbered wordlist. Diceware's virtue is precisely that it's understandable and auditable by people who grasp very little beyond the elements of probability theory. But of course it doesn't wholly remove the requirement that the user audit or trust the cryptography because the passphrase still has to be input into some software.
So one thing you could do is offer the users the option to enter random inputs that are under their control, like dice rolls, passphrases, or the old PGP trick of asking them to mash keys "at random" on the keyboard and measure the timings. The program would then apply a key derivation function (salted with values from the system RNG) to these inputs to obtain a master key or seed, and drive the random choices off that. There are some challenges that I think you would need to solve, like:
- User experience. None of this sounds awesome for usability, to say the least.
- Depending on the details of the problem, whether to use a password-based key derivation function or a fast one like HKDF.