0
$\begingroup$

If I split a key $k$ into three pieces as $k1, k2$ and $k3$ how should I distribute the keys among three people such that any two of them are able to evaluate PRF, but be secure from any one of them trying to do so. The PRF is defined as

$F'((k_1,k_2,k_3),x)=F(k_1,x)⊕F(k_2,x)⊕F(k_3,x)$

It is known that the three people know what pieces they hold so in this case if I split the keys in pair as $k1, k2$ for first person, $(k1, k3)$ for second and $(k2, k3)$ for thrid person and compute

$F1((k1, k2), x) = F(k1, x) ⊕ F(k2, x)$

Now if I send this $F1$ to the second person and compute $F1 ⊕ F2$ where $F2$ is given as below then I should be able to recover the PRF $F'$. Is that correct?

$F2(k3, x) = F(k3, x)$

Improve this question
$\endgroup$
3
  • $\begingroup$ See en.m.wikipedia.org/wiki/Shamir%27s_Secret_Sharing $\endgroup$
    – Serpent27
    Commented Oct 27, 2020 at 3:02
  • $\begingroup$ Thanks @Serpent27. I did review Shamir's secret key sharing before asking the question and just want to ensure if my approach is correct or not! $\endgroup$
    – Alex
    Commented Oct 27, 2020 at 3:07
  • 1
    $\begingroup$ Yes, your approach is correct assuming each of $(k_1, k_2, k_3)$ can individually provide the needed security margin $\endgroup$
    – Serpent27
    Commented Oct 27, 2020 at 3:24

1 Answer 1

Reset to default
0
$\begingroup$

The mentioned approach of splitting the keys in pair as $(k1,k2)$ for first person, $(k1,k3)$ for second and $(k2,k3)$ for third person for the given situation is correct! And the PRF can be computed as follows:

First person computes: $F1((k1,k2),x)=F(k1,x)⊕F(k2,x)$

Send this F1 to the second person and compute F1⊕F2 where F2 is $F2(k3,x)=F(k3,x)$

$F1⊕F2 = F(k1,x)⊕F(k2,x)⊕F(k3,x) = F'((k1,k2,k3),x)$

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.