# Do I need verifiable shares?

I'm using Shamir's secret sharing in a 2:3 system. Thus a secret Key is split in 3 subkeys (KeyS:KeyC:KeyT)

I've 3 entities at play here, Srv, Client, Tag, each one storing one subkey.

In my protocol, Client reads KeyT from the Tag and combine it with its own KeyC or query KeyS from Srv over a secure channel.

I assume I trust the Client since its code is verified and I trust the Srv as well. I don't trust the Tag and the communication between Client and Tag is not encrypted.

However, the Tag can be programmed with the Key so that some sort of 3 step authentication between the Client and the Tag must be run before a secret area can be read from the Tag (this authentication does not reveal the secret Key on the wire).

So, do I need verifiable share here ?

As far as I understand it, if the Tag is under attacker control, and it provides a wrong KeyT then the wrong derived Key computed in the Client will not be known to the attacker, since it never leaves the Client (even during authentication). Later authentication will then fail, since the Tag can not know the KeyC from the Client then the wrong computed Key.

Also, if an attacker is able to copy the Tag (without the secure area, since she can't know the Key beforehand to access it), the Client will compute a correct Key but this will fail at the authentication step with the Tag not knowing this Key and thus, unable to provide a proof it does.

The only drawback here would be for the attacker to record the complete Tag programming where the Client is programming the Key in the tag. I don't think I can do anything against this but the advantage gained by the hacker is kind of useless since such Key is random and specific for this Tag only.