I'm using Shamir's secret sharing in a 2:3 system.
Thus a secret
Key is split in 3 subkeys
I've 3 entities at play here,
Tag, each one storing one subkey.
In my protocol,
KeyT from the
Tag and combine it with its own
KeyC or query
Srv over a secure channel.
I assume I trust the
Client since its code is verified and I trust the
Srv as well. I don't trust the
Tag and the communication between
Tag is not encrypted.
Tag can be programmed with the
Key so that some sort of 3 step authentication between the
Client and the
Tag must be run before a secret area can be read from the
Tag (this authentication does not reveal the secret
Key on the wire).
So, do I need verifiable share here ?
As far as I understand it, if the
Tag is under attacker control, and it provides a wrong
KeyT then the wrong derived
Key computed in the
Client will not be known to the attacker, since it never leaves the
Client (even during authentication). Later authentication will then fail, since the
Tag can not know the
KeyC from the
Client then the wrong computed
Also, if an attacker is able to copy the
Tag (without the secure area, since she can't know the
Key beforehand to access it), the
Client will compute a correct
Key but this will fail at the authentication step with the
Tag not knowing this
Key and thus, unable to provide a proof it does.
The only drawback here would be for the attacker to record the complete
Tag programming where the
Client is programming the
Key in the tag.
I don't think I can do anything against this but the advantage gained by the hacker is kind of useless since such
Key is random and specific for this