In the following, all operations are defined over a finite field of prime order. Please note that what I'm explaining below is a part of a bigger protocol, however, to keep things simple I just mention the relevant part.

Let's assume we have a secret value: $\beta$ and we want to use a one time pad to mask it as $c= \beta+r$, where $r$ is a uniformly random value.

For some reason (as a part of the bigger protocol), I need to secret share $r$ into shares: $r_1$ and $r_2$, using Shamir secret sharing scheme.

Question: given $c$ and $r_1$ can an adversary learn $r$ and ultimately $\beta$?

  • $\begingroup$ Is $(\beta + r_1 + r_2, r_1)$ independent of $\beta$, if $r_1$, $r_2$, and $\beta$ are all independent, and $r_1$ and $r_2$ are uniformly distributed? (This is not exactly SSSS but it's close.) $\endgroup$ – Squeamish Ossifrage May 15 at 15:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.