Is the dealer a volunteer in Shamir secret sharing scheme?

Question

In this Paper, Shamir secret sharing scheme there is one dealer and n players. The dealer gives a share of the secret to the players, but only when specific conditions are fulfilled will the players be able to reconstruct the secret from their shares. The dealer accomplishes this by giving each player a share in such a way that any group of t (for threshold) or more players can together reconstruct the secret but no group of fewer than t players can. Such a system is called a (t, n)-threshold scheme (sometimes it is written as an (n, t)-threshold scheme).

I found that everyone who is participating in the secret sharing scheme has some benefit. For suppose, participants can able to get shares and reconstruct the secret, which they didn't know in prior. But, for a dealer, I feel that there is no benefit or purpose for itself to participate in the whole system since the dealer knows all the things in prior and is just doing its role to make the scheme work.

Is it true? Is the dealer a volunteer in Shamir secret sharing scheme?

If no then what is the purpose for him to involve in the scheme?

Answer 1

If no then what is the purpose for him to involve in the scheme?

This sort of "why would someone perform this protocol" question is something that crypto does not address.

Perhaps the dealer is the author of his own will, and he is delivering shares of it to his inheritors (for them to recombine after his untimely death). Perhaps he is the owner of a cryptocurrency purse, and is distributing shares of his private key to save as backups (so that, even if one of his backups is stolen or lost, he's still safe). Perhaps he is an HSM, and is distributing shares to the key that unlocks the administrator account.

To the protocol, the "why" question doesn't really matter.

Answer 2

Probably the most basic use case for Shamir's secret sharing (or other similar threshold secret sharing schemes) is safely storing a secret key.

For example, let's say you bought some Dogecoin as a joke when it was cheap, and now your coin wallet is suddenly worth millions. Or let's say you're working for a software company and you've been tasked with safely storing the master key to your company's root code signing certificate. Or maybe your social media account has a million followers and you really don't want someone to guess its password and sell it to spammers.

Either way, you have some secret information that:

• you don't want anyone else to be able to gain access to without your permission;
• you really, really don't want to lose access to yourself (at least not permanently); and
• if something happens to you — say, you get hit by a car and die or end up in a coma or suffer amnesia — you'd really like your family or coworkers to be able to recover the secret so that it's not lost forever.

Of course, whatever the secret data is, you could store it in an encrypted file (or e.g. in a password manager that internally stores the passwords in an encrypted file) and make lots of encrypted backup copies of it and generate a strong but easily memorizable master password (e.g. using Diceware) to decrypt the file with. And you probably should. But you'll still have a single point of failure: the master password.

If you only keep the password in your head, you might forget it (or get hit by a car and die). If you write it down on paper, you might lose it or someone else might find it. If you store it on an electronic device, all of those things could happen and the device could get hacked, too. If you write it down and lock it in a safe, it could still be destroyed in a fire, or you might simply forget the combination for the safe. And so on.

Storing multiple copies of the secret in different places would make losing it less likely, but at the same time it'd make it more vulnerable to being leaked. Conversely you could e.g. encrypt the secret with a key, and store the key and the encrypted secret in different places so that leaking either one won't compromise the secret, but then losing either the key or the file would cause the secret to be lost.

So what to do?

Well, secret sharing offers one option: split the secret into shares and give each share to someone you trust — your family members, executives in your company, your lawyer, a reputable escrow service, etc. Maybe store a couple of shares in bank vaults in different places. Maybe keep one in your pocket. By choosing the number of shares you issue and the threshold number needed to reconstruct the secret appropriately, you can ensure that:

1. none of the shareholders alone, or even a small number of colluding shareholders, can reconstruct the secret; but
2. the secret can still be reconstructed by a sufficient number of shareholders even if some of the shares — say, the one in your pocket — are lost.

Basically, a threshold secret sharing scheme like Shamir's lets you pick a tradeoff between how much you trust the shareholders not to abuse their position to compromise the secret and how much you trust them (including, possibly, yourself) not to lose their share of it. And it lets you do it in a particularly efficient (and provably secure) manner: no need to mess around with complex chains of nested encryptions and multiple keys — just one simple share per holder, of which any $k$ together are enough to reconstruct the secret.

The benefit to the dealer (i.e. yourself) here should be obvious: you get to make redundant distributed backups of your valuable secret while not having to trust any single party holding those backups with the secret itself.

What's not necessarily so obvious is what the benefit to the shareholders is. In some cases, it's simple: they might e.g. be employees or shareholders (in the financial sense) in the same company the secret belongs to, and thus have a natural interest in not seeing the company go down because it can't do business any more without the secret. Or they might be your family members who simply like you — or who stand to inherit some of your Dogecoins when you die. Or, in some cases, they might simply be people that you've paid to hold on to something valuable for you, and with a reputation at stake if they fail to uphold their side of the deal.

In any case you, as the dealer, obviously should try to pick shareholders whose interests align as closely as possible with yours. But at the same time you also should try to pick a diverse enough set of shareholders that not too many of them are likely to find a common interest in colluding to obtain the secret illegitimately.