2
$\begingroup$

I started learning about key sharing and Shamir secret sharing, I'm wondering whether you need someone who knows the key initially and then distributes it, is this step necessary or not?

In my case I have a group of people that run a permission blockchain (they are the consensus nodes) and I want all incoming transaction to be encrypted but the decryption part should be available only if a majority decides to construct the decryption key, but I don't want this decryption key to be known initially by anyone. Is it possible or not?

Improve this question
$\endgroup$
3

1 Answer 1

Reset to default
2
$\begingroup$

You can use MPC in order to generate a key that is distributed amongst a set of users, without anyone knowing the key itself. This is a very standard MPC problem, and many different protocols can be used. For example, if you want to generate a key for ECIES encryption, then you can basically have each party $P_i$ choose a random $x_i\in\mathbb{Z}_q$ and send a commitment to $Q_i = x_i\cdot G$ along with a zero knowledge proof of knowledge of $x_i$. Then, after all commitments are received, all parties decommit and ZK proofs are verified. Finally, you define the public key to be $Q=\sum_{i=1}^n Q_i$. This will give you a plain additive sharing. You can use a similar idea to get a Shamir sharing as well.

Improve this answer
$\endgroup$
5
  • $\begingroup$ Can we remove the decommitment? $\endgroup$
    – kelalaka
    Jul 1, 2020 at 14:16
  • 1
    $\begingroup$ @kelalaka, in general no, otherwise an attacker can wait to see everyone else's $Q_i$ and then submit their own based on that. $\endgroup$
    – Aman Grewal
    Jul 1, 2020 at 15:29
  • $\begingroup$ Prof. If you have time, could you write a canonical answer to Secret sharing - no dealer, modifiable, verifiable. $\endgroup$
    – kelalaka
    Jul 2, 2020 at 13:18
  • $\begingroup$ @kelalaka I tried to give an answer. It is a very general question, so really the answer is - it can be done with MPC. In order to try to answer it directly for Secret Sharing, one would need a full paper. I hope this is what you were looking for, but please let me know if not. $\endgroup$
    – Yehuda Lindell
    Jul 6, 2020 at 10:23
  • $\begingroup$ Thanks a lot. Let me read it. FYI, when an answer is given the bounty owner is notified, too. $\endgroup$
    – kelalaka
    Jul 6, 2020 at 10:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.