Recently a bank had a costly mistake that resulted in their master private key being exposed.

Through this thread, I learned about multi-party key storage with Adi Shamir's secret sharing scheme as the basis, very cool.

In the naive setup, there's still a person/machine that must do the final decryption which knows the full key.

What scheme(s) allows no central decrypter?

A guess I have is two or more 'groups/keys' separately encrypt/decrypt the message so no one group can ever have the keys to the kingdom.

Or is there a way for the final decrypter to decrypt w/o actually knowing the master key such that only one Adi Shamir scheme is necessary?



I just wanted to give you a hint, but since I cannot write comments under your question, I write it here:

I think you are searching for a scheme that whenever the secret is reconstructed, the participant's keys dont reveal. We have such schemes, please see this Lecture Note Chaper 6.

Lecture Note information: Lecture Notes, Cryptographic Protocols, Version 1.21 September 13, 2016, Berry Schoenmakers

The name of the protocol is: Threshold Elgamal Cryptosystem But the whole chapter that I mentioned is more informative than just this protocol.

| improve this answer | |
  • $\begingroup$ Also for an even better answer, please at least include a sketch of one protocol so one can build some intuition on how they work. $\endgroup$ – SEJPM Jun 18 at 13:30
  • $\begingroup$ My understanding of Section 6.3.1 says each party member (Pi) takes their portion of the private key (Xi) and performs a decryption that does produces an output (Di) where i is just who they are. The beauty of the ElGamal scheme is (Di) is a proper partial decryption that can be passed onto the next party member and they can perform their own partial decryption. Once enough members (t+1) doing partial decryptions, you'll get plain text M. Amazing. $\endgroup$ – nitsujri Jun 22 at 3:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.