# Splitting Secret Key

If I split a key $$k$$ into three pieces as $$k1, k2$$ and $$k3$$ how should I distribute the keys among three people such that any two of them are able to evaluate PRF, but be secure from any one of them trying to do so. The PRF is defined as

$$F'((k_1,k_2,k_3),x)=F(k_1,x)⊕F(k_2,x)⊕F(k_3,x)$$

It is known that the three people know what pieces they hold so in this case if I split the keys in pair as $$k1, k2$$ for first person, $$(k1, k3)$$ for second and $$(k2, k3)$$ for thrid person and compute

$$F1((k1, k2), x) = F(k1, x) ⊕ F(k2, x)$$

Now if I send this $$F1$$ to the second person and compute $$F1 ⊕ F2$$ where $$F2$$ is given as below then I should be able to recover the PRF $$F'$$. Is that correct?

$$F2(k3, x) = F(k3, x)$$

• – Serpent27 Oct 27 '20 at 3:02
• Thanks @Serpent27. I did review Shamir's secret key sharing before asking the question and just want to ensure if my approach is correct or not! – Alex Oct 27 '20 at 3:07
• Yes, your approach is correct assuming each of $(k_1, k_2, k_3)$ can individually provide the needed security margin – Serpent27 Oct 27 '20 at 3:24

The mentioned approach of splitting the keys in pair as $$(k1,k2)$$ for first person, $$(k1,k3)$$ for second and $$(k2,k3)$$ for third person for the given situation is correct! And the PRF can be computed as follows:
First person computes: $$F1((k1,k2),x)=F(k1,x)⊕F(k2,x)$$
Send this F1 to the second person and compute F1⊕F2 where F2 is $$F2(k3,x)=F(k3,x)$$
$$F1⊕F2 = F(k1,x)⊕F(k2,x)⊕F(k3,x) = F'((k1,k2,k3),x)$$