Questions tagged [secret-sharing]

Secret sharing refers to splitting a secret among multiple parties so that together they can reconstruct it. All parties, or just a threshold number of them, can be required for reconstruction. If fewer than the required number of parties participate, no information should be leaked about the secret.

Filter by
Sorted by
Tagged with
2
votes
1answer
24 views

Real-world offline phase implementation in MPC setting

I've been reading up on various basic MPC primitives (multiplication, inversion, exponentiation and so on of secrets shared between multiple parties). One of the problems of implementing MPC in real-...
2
votes
1answer
46 views

How to do unmasked addition on SSS masked shares?

I'm trying to understand how Shamir's Secret Sharing algorithm is applied to AES when doing threshold masking. I understand how the secrets are created and the secret is calculated and I'm now trying ...
2
votes
1answer
85 views

Should the field size in Shamir secret sharing scheme be larger than secret?

I'm playing around with implementing Shamir's secret sharing scheme in Kotlin. Here is implementation so far: ...
0
votes
0answers
44 views

Shamir secret sharing scheme only works with certain parameters

im doing a small programming project, where I have to implement shamirs secret sharing scheme. I want to share the secret S = 21426848149916227113669602 I want a k of three, meanng that three shares ...
0
votes
1answer
56 views

Difference between Multi-linear and Multi-Secret Sharing Schemes

I've been reading papers on secret sharing schemes and came to two different terms, namely, multi-linear secret sharing schemes and multi-secret sharing schemes. As an example, the term multi-linear ...
0
votes
0answers
19 views

How to compare the size of two shared secrets?

Suppose there are two secrets x and y which are split as $[[x]]=x_1+x_2+\cdots+x_n$ and $[[y]]=y_1+y_2+\cdots+y_n$. Is there anyway to generate a bit [[x > y]] with additional assumptions?
1
vote
2answers
67 views

How to generate a random point on an elliptic curve without knowing it's corresponding scalar private key

Given an elliptic curve with generator $G$, is it possible to generate a random point on the curve $Q = a \cdot G$ without knowing the secret value $a$ that generated it? Note that just using an $a$ ...
2
votes
1answer
100 views

How do I multiply two points on an elliptic curve?

Tell me if there is a way to multiply two points on an elliptic curve? For example, as in secp256k1 ...
1
vote
1answer
75 views

Proving I can solve an equation without disclosing the solution (zero-knowledge proof)

Given a (potentially multivariable) equation $f(x)=0$, Peggy wants to prove to Victor that she knows a solution $x^\star$ to it without actually disclosing anything information about the value of $x^\...
1
vote
0answers
33 views

Understanding multiplication of Shamir secret sharing during threshold (EC)DSA signing

I have been looking at the threshold (EC)DSA schemes for honest majority by Gennaro et al. https://www.sciencedirect.com/science/article/pii/S0890540100928815. In the scheme, there are steps where we ...
0
votes
1answer
96 views

Multi-Linear Secret Sharing vs. Shamir Secret Sharing

I hope someone can help me. I read several papers including the original paper, "Multi-linear Secret-sharing Schemes," by Beimel et al., and watched the following video https://www.youtube....
5
votes
1answer
66 views

Secure Secret Sharing to a Distributed Key

Setup There are two groups, $A$ and $B$. Each group is in a Shamir's secret sharing scheme ($t_A$ of $N_A$ and $t_B$ of $N_B$). Each group has a public key that is associated with the identity of the ...
8
votes
5answers
2k views

Computational Complexity Of Breaking Information Theoretic Security

Wikipedia mentions that Shamir's secret sharing(SSS) for example, has information theoretic security. While I understand the concept that the adversary would just not have enough information to break ...
0
votes
1answer
36 views

Generating and distributing a secret without trusting the source

I have multiple entities (servers) that all share a private secret already. Those servers need a rotating secret (TTL a few hours). All servers must have the same set of secrets at all times. I have ...
1
vote
1answer
28 views

Encrypting a broadcast message decryptable by a subset of receivers

I wasn't certain how to title this request/problem, but here goes: I'm A, and I want to send a message that is received by B, C, D. Each receiving entity here is part of some set of domains D1, D2, D3:...
0
votes
0answers
22 views

Value of Prime P in shamir secret sharing

How the value of prime integer taken in Shamir's Secret sharing scheme. I have taken p which is greater than my secret and the no of shares. When i do calculation without modp then secret reconstruct ...
2
votes
1answer
63 views

Is linear secret sharing over the addittive group of integers modulo $p$ with $p$ non-prime secure?

In Maurer, Ueli. "Secure multi-party computation made simple." Discrete Applied Mathematics 154.2 (2006): 370-381. I have found the following technique for $k$-out-of-$k$ linear secret ...
0
votes
1answer
39 views

Can you use a “power of 2” gate in the BGW protocol

I am learning about the BGW Protocol and I understand that for a MUL gate, you need to follow the degree reduction protocol. I am wondering if it is possible to implement a single input and single ...
1
vote
1answer
70 views

Secret sharing by using just “private secrets”?

TLS is using 3 way handshake. Isn't that possible to use such 3 way handshake protocol to share a secret without using a public key scheme, for instance as follows: Let A, B be private secrets of ...
0
votes
1answer
80 views

Splitting Secret Key

If I split a key $k$ into three pieces as $k1, k2$ and $k3$ how should I distribute the keys among three people such that any two of them are able to evaluate PRF, but be secure from any one of them ...
0
votes
0answers
32 views

addition of shares from shamirs scheme and additive scheme

Assume we have two secrets $s_1$ and $s_2$. We use Shamir's scheme to produce $\{(x_i,y_i)\}$ as $n$ shares of $s_1$ with a threshold $t$. Then, we use the additive scheme to generate shares for $s_2$,...
0
votes
0answers
19 views

Threshold schemes

I am looking for a reference that lists all major $(n,k)$ secret sharing schemes. Can anyone help me get such a reference?
1
vote
0answers
31 views

Black-box secret sharing schemes

My question is about black box secret sharing schemes (BBSSS). Do these schemes have any advantages over the better known secret sharing schemes like Shamir’s?
0
votes
1answer
82 views

Noisy secret sharing

I am looking for a secret sharing scheme that is robust against noise, the shares are going to be noisy. We do not want to reconstruct the secret perfectly and a noisy reconstruction with a bound on ...
0
votes
0answers
28 views

What are the consequences of Diffie Hellman problem in P?

Computational Diffie Hellman problem wants to know $g^{ab}$ given $g^a$, $g^b$ and $g$ while the discrete logarithm problem wants to know $x$ from $g^x$ and $g$. The latter resolvable in polynomial-...
0
votes
1answer
52 views

Secret Sharing Domain Questions

all, I have a very fundamental question on Secret Sharing schemes such as SPDZ families. As far as I can see for now, SS schemes always assume a certain variable range. For example, suppose the bit ...
0
votes
2answers
124 views

Shamir secret sharing with no dealer

Suppose we have a set of $N$ parties. I am looking for a scheme to generate shares of a random secret $s$ where any subset of the participants with size $k$ can recover the secret similar to Shamir's ...
0
votes
0answers
42 views

Shamir's Secret sharing for Key encryption

I have studied Shamirs Secret Sharing(SSS) scheme. Now my doubt is to how to apply this in real time applications. I have an application which receives encrypted data from server and decrypts the data ...
4
votes
3answers
193 views

Can you have perfect secrecy with countable message/key spaces by dropping countable additivity?

This classic paper by Chor and Kushilevitz shows that if the key space and the message space are both countably infinite, then it is impossible to have a perfectly secure private-key encryption scheme....
2
votes
1answer
55 views

How (generally) do modern schemes deal with an adversary with the capacity to either instantly, or over time, corrupt a majority of parties

I'm curious about the honest minority case and what cryptographers have and are currently using to get around this. My motivation is primarily the MPC space, but I'm sure there are other subfields ...
1
vote
0answers
39 views

Looking for an algorithm to encrypt with a single key and decrypt with a lot of keys without consuming too much space

Is it possible to have an encryption scheme that could be encrypted with a particular key, then decrypted with a large amount of keys without massively inflating the size of the final result? I am ...
6
votes
2answers
256 views

Using XOR to derive a data key for ECIES

I have been thinking about a rather simple enhancement for (EC)IES / RSA-KEM. The scheme would allow you to encrypt data while the calculation of the session / data key can be performed afterwards or ...
3
votes
1answer
79 views

Why does verifiable secret sharing with an honest majority require a broadcast channel?

In the information-theoretic model with active adversaries, it seems to be well-known that no protocols with exact reconstruction of the secret exist for the task of verifiable secret sharing (VSS) ...
1
vote
1answer
52 views

Which are the current solutions to the illegal values in the homomorphic secret sharing?

There is a usual example about homomorphic secret sharing, focused on e-voting. Supposing we use Shamir's scheme for the Secret Sharing system, a participant generates a polynomial whose a0 is +1 (yes)...
3
votes
0answers
41 views

What is the fundamental difference between multipartite and multilevel secret sharing?

According to this paper , Multipartite secret sharing scheme is a scheme in which the set of participants is divided into disjoint parts and all participants in the same part play an equivalent role ...
2
votes
1answer
68 views

Is there a way of sharing a key without anyone knowing what the key is initially?

I started learning about key sharing and Shamir secret sharing, I'm wondering whether you need someone who knows the key initially and then distributes it, is this step necessary or not? In my case I ...
0
votes
1answer
82 views

How to convert from small field to large field

If I have number $2$, which is additively shared into $3+4 \bmod 5$. Now I need to change the filed to a large one, like $500$. How to convert the shares, so that I can have a new number or shares $a+...
1
vote
1answer
101 views

Calculate share for a specific value of $x$ in Shamir's Secret Sharing scheme

I am currently reading the book Cryptography: Theory and Practice (4th edition) by Stinson and Paterson and going through the exercises. I have reached the Threshold schemes section and am currently ...
0
votes
1answer
57 views

In a secret image sharing scheme, what are the advantages of Galois field $\mathrm{GF}(p^m)$ over finite field $ F_p$?

Shamir's Secret Sharing Scheme uses arithmetic in a finite field of prime order. In a secret image sharing scheme, what are the advantages of Galois field $\mathrm{GF}(p^m)$ over finite field $ F_p$?
2
votes
1answer
64 views

Non-interactive proof of value in MPC

Does it exist? Specifically using Shamir secret sharing based MPC and looking for a (non-)interactive way to prove that the secret value is valid. A value is valid if it is part of a set for example $[...
5
votes
1answer
199 views

Simplified Lagrange interpolation formula inside Shamir's secret sharing scheme

I originally posted this question in the math stackexchange, but I then thought that it might be more appropriate in this section. I am currently studying Shamir's secret sharing scheme, which uses ...
1
vote
0answers
32 views

Advantage of Asmuth-Bloom secret sharing scheme with polynomial over integers?

Currently, I am studying the Asmuth-Bloom secret sharing scheme and want to learn more about its polynomial version. What are the exact reasons to use polynomials over integers for this scheme?
3
votes
1answer
191 views

Is there a secure multi-party computation (SMPC) scheme that doesn't use secret sharing?

According to the Wikipedia article about SMPC: Secure MPC is closely related and builds on to the problem of secret sharing, and more specifically verifiable secret sharing (VSS), which many ...
1
vote
1answer
63 views

Inside attack (attack from participants) in secret sharing

I have considered a $(t,n)$ secret sharing scheme with $n$ secret, say $a1,a2....an$. It's third party secure, but it has inside adversaries. While reconstructing secrets, a group of $t$ qualified ...
1
vote
1answer
44 views

Shamir's Threshold Scheme (Theory Part, Need some help understanding a term that I can't find online)

What does the max(S, n) part mean, and what am I supposed to do with it? I somewhat understand, but it is still confusing. I don't know what it exactly represents. Can you help me please?
1
vote
2answers
184 views

Secret sharing scheme WITHOUT Shamir Secrete Sharing

I am planning to use the following XOR scheme to divide a secret into only 2 shares (I do not want to use Shamir Secret Sharing for different reasons that are beyond the scope of this post). Here's ...
2
votes
0answers
32 views

What kind of operators should I perform on 4-qubit state $|\psi\rangle_A|GHZ\rangle$ to get expression like $|\Psi\rangle_4$?

I'm reading the paper "Quantum secret sharing" by Hillery, Bužek and Berthiaume (Phys. Rev. A, 1999; preprint on arXiv) and I have a question about it. Let's say Alice wants to send Bob qubit in ...
1
vote
0answers
35 views

Function Secret sharing and sharing a truth table

I was reading a paper (Function Secret Sharing by Boyle, Gilboa and Ishai, PDF) on Function Secret Sharing and in that the author talked about a naive construction of a p party DPF wherein the truth ...
2
votes
1answer
93 views

ECDSA Private Key from SSS

I have all of the Shamir's secret shares required to Lagrange-interpolate f(0), which represents an ECDSA private key. The field of this object is ...
0
votes
0answers
61 views

BGW Multiplication: Linearizing the polynomial

I have some trouble understanding the linearization of the degree 2t polynomial generated by multiplication in BGW. It would be great if someone could decode this ...

1
2 3 4 5
9