# Splitting Secret Key

If I split a key $$k$$ into three pieces as $$k1, k2$$ and $$k3$$ how should I distribute the keys among three people such that any two of them are able to evaluate PRF, but be secure from any one of them trying to do so. The PRF is defined as

$$F'((k_1,k_2,k_3),x)=F(k_1,x)⊕F(k_2,x)⊕F(k_3,x)$$

It is known that the three people know what pieces they hold so in this case if I split the keys in pair as $$k1, k2$$ for first person, $$(k1, k3)$$ for second and $$(k2, k3)$$ for thrid person and compute

$$F1((k1, k2), x) = F(k1, x) ⊕ F(k2, x)$$

Now if I send this $$F1$$ to the second person and compute $$F1 ⊕ F2$$ where $$F2$$ is given as below then I should be able to recover the PRF $$F'$$. Is that correct?

$$F2(k3, x) = F(k3, x)$$

• Commented Oct 27, 2020 at 3:02
• Thanks @Serpent27. I did review Shamir's secret key sharing before asking the question and just want to ensure if my approach is correct or not!
– Alex
Commented Oct 27, 2020 at 3:07
• Yes, your approach is correct assuming each of $(k_1, k_2, k_3)$ can individually provide the needed security margin Commented Oct 27, 2020 at 3:24

## 1 Answer

The mentioned approach of splitting the keys in pair as $$(k1,k2)$$ for first person, $$(k1,k3)$$ for second and $$(k2,k3)$$ for third person for the given situation is correct! And the PRF can be computed as follows:

First person computes: $$F1((k1,k2),x)=F(k1,x)⊕F(k2,x)$$

Send this F1 to the second person and compute F1⊕F2 where F2 is $$F2(k3,x)=F(k3,x)$$

$$F1⊕F2 = F(k1,x)⊕F(k2,x)⊕F(k3,x) = F'((k1,k2,k3),x)$$