# $t$-out-of-$n$ Secret Sharing over $\Bbb Z_2$?

Is it possible to construct a $t$-out-of-$n$ secret sharing scheme over $\Bbb Z_2$?

Shamir Secret Sharing allows for an arbitrary threshold $t$ and an arbitrary number of participants $n$, but requires the field to have at least $n$ elements. Is there a similar construction that works over $\Bbb Z_2$?

One approach could be to use Shamir SS over the finite field $\Bbb F_{2^{\log n}}$. Then, to share $x\in\Bbb Z_2$, this value is first embedded in this field and then it can be secret shared. However, this has an (apparently) innecessary overhead (even though it could be amortized if we share more than value)

• Just to be clear: You want a $t$-out-of-$n$ threshold secret sharing scheme that shares a single secret bit? – SEJPM Jul 17 '18 at 10:26
• @SEJPM That would be desirable, but I would be surprised if that's possible. – Daniel Jul 17 '18 at 10:27
• There's a natural injection of $\mathbb Z/2\mathbb Z$ into $\mathbb F_{2^n}$ for any $n$. What stops you from using that? – Squeamish Ossifrage Jul 17 '18 at 14:03
• @SqueamishOssifrage That's precisely what I wrote in the addendum, and I also said there why I didn't like that solution. Regarding SEJPM's question and this solution, I don't expect a scheme whose shares are $1$-bit long, but at least with a size independent of the number of shares. – Daniel Jul 17 '18 at 14:05
• Independent is of course impossible; if your shares are $k$ bits, you can't have more than $2^k$ of them. – fkraiem Jul 18 '18 at 16:30

• Very interesting. Can you expand on the answer a bit, for the non-expert readers (article paywalled) since the paper seems to propose a much broader primitive. How small a $q$ is actualy doable? Is $q=2,$ as the OP asked even possible? I also noted that the construction does not really give a threshold scheme, the genus seems to come into it. – kodlu Jul 20 '18 at 12:23
If you are going to use polynomial interpolation you need $\geq n+1$ distinct evaluation points in your field (for the secret plus the individual shares) to make the mapping from the polynomial coordinates to the shares one to one. Otherwise two different set of shares might represent the same polynomial, thus the the same secret.
Thus, a prime or composite field size $q$ such that $q\geq n+1$ is necessary. This will also preserve the "no leakage of information given less than $t$ shares" property.
There is no way to relax this in a significant manner and remain in the Shamir scheme where the size of secret is proportional to the logarithm of the number of users, $n.$