In the paper on section "4 Proposed Scheme", I suppose that the scheme does not protect if an adversary has access to the $k - 1$ original shares, am I correct?

If the adversary has $k - 1$ of both polynomials then it can obtain the difference: $\sum^{k-1}_{j=1} (g_{j} \cdot l^{'}_{j} - f_{j} \cdot l^{''}_{j}) = (f_{n} \cdot l^{''}_{n} - g_{n} \cdot l^{'}_{n}) = d$ and perform an attack by selecting polynomials and values such that $\sum^{k-1}_{j=1} (g_{j} \cdot l^{'}_{j} - f_{j} \cdot l^{''}_{j})^{'} = d$ to get the forged values for $v_{n}$. Would this be feasible?

I don't see this as part of their threat model, but in practice it is a reasonable assumption.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.