# Is there a way of sharing a key without anyone knowing what the key is initially?

I started learning about key sharing and Shamir secret sharing, I'm wondering whether you need someone who knows the key initially and then distributes it, is this step necessary or not?

In my case I have a group of people that run a permission blockchain (they are the consensus nodes) and I want all incoming transaction to be encrypted but the decryption part should be available only if a majority decides to construct the decryption key, but I don't want this decryption key to be known initially by anyone. Is it possible or not?

You can use MPC in order to generate a key that is distributed amongst a set of users, without anyone knowing the key itself. This is a very standard MPC problem, and many different protocols can be used. For example, if you want to generate a key for ECIES encryption, then you can basically have each party $$P_i$$ choose a random $$x_i\in\mathbb{Z}_q$$ and send a commitment to $$Q_i = x_i\cdot G$$ along with a zero knowledge proof of knowledge of $$x_i$$. Then, after all commitments are received, all parties decommit and ZK proofs are verified. Finally, you define the public key to be $$Q=\sum_{i=1}^n Q_i$$. This will give you a plain additive sharing. You can use a similar idea to get a Shamir sharing as well.
• @kelalaka, in general no, otherwise an attacker can wait to see everyone else's $Q_i$ and then submit their own based on that. – Aman Grewal Jul 1 '20 at 15:29