Is there a method by which a secret can be split across multiple nodes, such that:

  1. No one node can learn the secret.
  2. An adversary can't learn the secret by bringing up multiple dummy nodes.
  3. Redundancy can be had if one or more nodes in the network fail.
  • 3
    $\begingroup$ read about "Threshold secret sharing" especially "Shamir Secret Sharing" $\endgroup$
    – yacovm
    Commented Nov 5, 2021 at 17:58

1 Answer 1

  1. There are protocols to distributively create a secret, either a key or a random number. Searching for Distributed Key Generation (DKG) should help.

    Depending on what you want to do with the secret determines if you can keep it secret. There are distributed signature schemes. I am not aware of how to do distributed decryption1 or distributed symmetric encryption.

  2. This depends on your secret sharing model. If you require all nodes to participate in any action, then no amount of adversary-controlled nodes will give the adversary the secret. If you require less than all the nodes to participate, say $t$ nodes, then once the adversary has $t$ nodes, he gets access to the secret.

  3. As mentioned in 2., you can choose a threshold, $t$, of nodes that you need to participate.

As mentioned by @yacovm in a comment, Shamir's Secret Sharing is a common threshold secret sharing scheme.

1Not strictly true. I have seen interesting ways to do distributed decryption. Say if the encrypted information is audio, you have multiple audio files such that listening to any one of them doesn't provide any information, but if you set up the speakers correctly and stand in the right spot, you can hear the original message. Of course, this is not general purpose and comes with many caveats.

  • $\begingroup$ "I am not aware of how to do distributed decryption"; actually, it's fairly easy with IES; each share holder has a Shamir share $(x_i, y_i)$ of the private key (where the field is $GF(q)$, where $q$ is the order of the subgroup generator. An IES decryption involves raising a value in the ciphertext to the power of the private key; each participating share holder could raise that value to his power $y_i$; once the result of that is published, the rest of the decryption is straightforward... $\endgroup$
    – poncho
    Commented Nov 6, 2021 at 14:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.