I started learning about key sharing and Shamir secret sharing, I'm wondering whether you need someone who knows the key initially and then distributes it, is this step necessary or not?

In my case I have a group of people that run a permission blockchain (they are the consensus nodes) and I want all incoming transaction to be encrypted but the decryption part should be available only if a majority decides to construct the decryption key, but I don't want this decryption key to be known initially by anyone. Is it possible or not?


You can use MPC in order to generate a key that is distributed amongst a set of users, without anyone knowing the key itself. This is a very standard MPC problem, and many different protocols can be used. For example, if you want to generate a key for ECIES encryption, then you can basically have each party $P_i$ choose a random $x_i\in\mathbb{Z}_q$ and send a commitment to $Q_i = x_i\cdot G$ along with a zero knowledge proof of knowledge of $x_i$. Then, after all commitments are received, all parties decommit and ZK proofs are verified. Finally, you define the public key to be $Q=\sum_{i=1}^n Q_i$. This will give you a plain additive sharing. You can use a similar idea to get a Shamir sharing as well.

  • $\begingroup$ Can we remove the decommitment? $\endgroup$ – kelalaka Jul 1 '20 at 14:16
  • 1
    $\begingroup$ @kelalaka, in general no, otherwise an attacker can wait to see everyone else's $Q_i$ and then submit their own based on that. $\endgroup$ – Aman Grewal Jul 1 '20 at 15:29
  • $\begingroup$ Prof. If you have time, could you write a canonical answer to Secret sharing - no dealer, modifiable, verifiable. $\endgroup$ – kelalaka Jul 2 '20 at 13:18
  • $\begingroup$ @kelalaka I tried to give an answer. It is a very general question, so really the answer is - it can be done with MPC. In order to try to answer it directly for Secret Sharing, one would need a full paper. I hope this is what you were looking for, but please let me know if not. $\endgroup$ – Yehuda Lindell Jul 6 '20 at 10:23
  • $\begingroup$ Thanks a lot. Let me read it. FYI, when an answer is given the bounty owner is notified, too. $\endgroup$ – kelalaka Jul 6 '20 at 10:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.