Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [secret-sharing]

Secret sharing refers to splitting a secret among multiple parties so that together they can reconstruct it. All parties, or just a threshold number of them, can be required for reconstruction. If fewer than the required number of parties participate, no information should be leaked about the secret.

1
vote
0answers
10 views

Asmuth-Bloom Secret Sharing $m_0$ public?

i am trying to figure out how Asmuth-Bloom secret sharing works and followed the example on wikipedia and replaced it with own numbers. Namely, i used: $S=3$ $k=3$ $n=4$ $m_0 = 13, m_1=45, m_2=46, ...
5
votes
1answer
95 views

Why threshold number number of shares is required to construct secret?

In this paper of Asmuth–Bloom threshold SSS, the algorithm is as follows: Shares Distribution To distribute n shares of a secret $K$ among the set of participants $P = \{ p_i : 1 ≤ i ≤ n\}$, the ...
0
votes
0answers
19 views

How to implement NTRU threshold cryptosystem [closed]

I want to implement a basic NTRU threshold encryption/decryption process, I know the basics of NTRU and I implemented a threshold cryptosystem for ElGamal, the next step is to build one for NTRU, but ...
2
votes
2answers
36 views

Why is Blakley secret sharing in finite space?

The paper says it requires a finite space. I wonder what the reason is, since from my understanding it should be perfectly fine to use the "normal" infinite space. So why does Blakley use a finite ...
3
votes
1answer
109 views

How is Blakley's Secret Sharing Scheme perfect?

Currently, I am trying to understand Blakley's secret sharing scheme. However, there seem to be multiple descriptions of it, which are very different from another, but everyone states that the scheme ...
0
votes
1answer
42 views

Two-way secret sharing for authentication?

Secret sharing, using methods such as Shamir's Secret Sharing allows for t out of n shares to recreate a secret. For authentication, the secret can be a user ID. A client with a logged-in user can ...
1
vote
1answer
73 views

How can I generate large primes for Pedersen commitment?

I want to make a commitment on Shamir's Secret Sharing, based on the work of Pedersen, "Non-Interactive and Information-Theoretic Secure Verifiable Secret Sharing". To implement the commitment ...
2
votes
0answers
34 views

What is difference between Unipartite Secret Construction, Bipartite Secret Construction and Multipartite Secret Construction

In this paper authors extend Asmuth–Bloom and Kaya schemes to bipartite access structures and further investigate how SSSs realizing multipartite access structures can be conducted with the CRT. The ...
0
votes
0answers
49 views

Password recovery on Block-chain ( Hyperledger sawtooth in this case)

I am using bip39 specifications for 24-word mnemonic, Whenever user registers with his/her password, A Scrypt key is generated from this password and used to encrypt this mnemonic, The admin of the ...
1
vote
1answer
40 views

Combining secret/public keys

Suppose that we have three authorities which each of them generate one secret/public key for Alice. It means that Alice has three secret keys and three related public keys. Suppose that Alice combines ...
1
vote
1answer
101 views

Mathematics behind the paper “how to leak a secret” for ring signature

I'm reading the paper "How to Leak a Secret" (Rivest, Shamir, Tauman; 2001). On page 8/14, in chapter 3.4, the authors present the following "combining function": $$C_{k,v}(y_1, y_2,\ldots,y_r) = ...
3
votes
1answer
61 views

secret sharing scheme difference

confused about differences between 5 out of 5 threshold secret sharing scheme and 4 out of 5 threshold secret sharing scheme. how would the share and reconstruction schemes be different assuming both ...
1
vote
0answers
31 views

PCI DSS requirement 3.5.3

3.5.3 Store secret and private keys used to encrypt/decrypt cardholder data in one (or more) of the following forms at all times: ............ As at least two full-length key components or key shares, ...
1
vote
1answer
36 views

Shamir Secret Sharing and Diffie-Hellman procedure

Alice needs to share an already generated numeric secret $s$ with Bob and she doe not want the world to see it. The problem is that she has never contacted Bob before. I thought Alice and Bob could ...
1
vote
2answers
139 views

Formal Proof of Shamir's Secret Sharing Scheme Security

Shamir's Secret Sharing scheme is perfectly secure. Could you please suggest where I can read a formal proof of Shamir's Secret Sharing scheme being perfectly secure?
0
votes
1answer
47 views

Secret shared input for garbled circuit?

I’m curious about what the secret shared input for a garbled circuit is. Essentially, a garbled circuit is a two party computation framework where each of two players has each input as bit string. In ...
1
vote
1answer
64 views

Pairing-based cryptography VS ZK-proofs: what's more efficient for threshold systems?

In some papers (e.g. 1, 2) the authors approve that pairings are more efficient than classic zk-proofs (e.g. proof of discrete logarithm knowledge) for the described applications (threshold encryption,...
3
votes
1answer
96 views

Difference between Asmuth-Bloom and Shamir's Secret Sharing

Both Asmuth and Shamir are threshold based secret sharing schemes and perfectly secure. In which point of view Asmuth bloom secret sharing scheme is better than Shamir secret sharing scheme. Could ...
1
vote
1answer
77 views

Secret sharing over reals - Difficulty with Computer implementation

I asked a question recently regarding the paper "Secret Sharing Over Infinite Domains" - B. Chor and E. Kushilevitz which describes a secret sharing scheme for real numbers in the interval $[0,1]$. I ...
3
votes
1answer
67 views

Change a secret key in an embedded device

There is a device that uses a secret key Sk to encrypt data. Assume this Sk is compromised. Could the following scheme be considered safe, in case we want to change the compromised Sk: We store some ...
4
votes
1answer
58 views

Under what conditions is broadcast possible? (Cryptographically, and in the model of Maurer 2006)

In this paper, Ueli Maurer uses a very cool model to generalize a number of results about broadcast, secret sharing and secure multiparty computation. Rather than talking about an adversary being ...
0
votes
1answer
43 views

Shamir Scheme: Whats the problem of not using random x-coordinates?

i would like to know why there is a problem of not using random x-coordinates in shamir secret sharing schemes. I consider that after evaluating the points in a polynomial $f(x)$, the share is ...
2
votes
0answers
56 views

Verifiable secret sharing - Benaloh scheme; some doubts not answered earlier

I reviewed the paper "Secret sharing homomorphisms: keeping shares of a secret secret" by J.C. Benaloh yesterday and I had some difficulty understanding his version of verifiable secret sharing to ...
5
votes
1answer
120 views

Secret sharing over reals - constructing a (k,n) threshold scheme

After following a discussion that Shamir's Secret Sharing scheme cannot be used to share a real number as secret, I came across the paper "Secret Sharing Over Infinite Domains" - B. Chor and E. ...
1
vote
2answers
68 views

Multi-secret sharing (Packed secret sharing) - Some questions

In the publication - "Communication complexity of secure computation", I have encountered a small problem - on page 5 of the literature under the heading "Theorem 1" they have described a $(c,d; k,n)$ ...
2
votes
2answers
111 views

Shamir Secret Sharing Scheme - leak of information

After going through some literature, I've convinced myself that to recover the exact secret using Shamirs Secret Sharing scheme, we must have S(the secret converted into a number) < p (choice of ...
1
vote
1answer
44 views

Shamir Secret Sharing Scheme - some doubts not answered earlier

my first question on here. I've gone through some examples of Shamirs Secret Sharing Scheme, but I have 2 rather pressing doubts - i. Why do we choose the co-efficients of the polynomial from the ...
1
vote
0answers
69 views

Private Key Sharding - How is it Secure in a Distributed Network?

In a Distributed Network in order for a private key not to be compromised sharding will have to take place off the network, correct? If so: Why is it when a Distributed Network shards private keys ...
2
votes
1answer
147 views

How to perform Shamir Secret Sharing with a Tabula Recta?

In this post, a couple comments suggested that a tabula recta could be used to perform Shamir Secret Sharing. I'm specifically interested in this statement: you could just have a table of all 100 ...
1
vote
0answers
31 views

Is recursive secret sharing of practical value?

This paper describes recursive secret sharing. In one of their illustrations, a binary secret of length L, along with 3 other binary secrets of lengths shorter ...
0
votes
2answers
114 views

How to compute secure sum using secure multparty computation?

Suppose there are three voters $P$, $Q$ and $R$, and each will vote only on one candidate out of $X$, $Y$ or $Z$, with a 6 bit vote vector corresponding to $X $, $Y$ and $Z$ respectively (with 2 bits ...
1
vote
1answer
140 views

How does one construct a 27x27 tabula recta for 2-of-3 secret sharing?

In the answer to this post at security.stackexchange, someone describes how, using pencil and paper, one can do 2-of-3 secret sharing with a tabula recta. But I don't understand how he created his ...
1
vote
1answer
58 views

Why every access structure is a multipartite access structure?

The set of authorized subsets of participants is called an access structure. In a multipartite access structure, the set of participants is divided into several parts and all participants in the ...
1
vote
1answer
64 views

Combining secret keys into a single shared key

Let's say there are $n$ participants each with their own secret key $x_i$. Is it possible for them somehow to build a shared key which is an arithmetic sum of all their secret keys ($x_0 + x_1 + ... + ...
3
votes
2answers
62 views

What's the functional difference between fountain codes and polynomial secret sharing?

Fountain codes, as I understand it, allow for the reconstruction of a set of data (e.g. a 64-bit word), by sending (without corruption or failure) chunks of data generated using a probabilistic ...
1
vote
2answers
93 views

Multiparty key exchange for end-to-end encryption

I need to make end-to-end encrypted messaging between 2 and more parties without trusting a server. Each party has it's secret and private keys. The obvious solution is to make ECDH between all of ...
1
vote
2answers
58 views

Security of Shamir secret sharing with regards to the threshold

Consider Shamir Secret Sharing Scheme (SSSS). This is completely unfounded, but my intuition tells me that the threshold k we set (AKA the number of shares required ...
1
vote
0answers
43 views

Preserving location privacy

What are cryptographic techniques that could be used so that if I wanna to enable a server to send message to certain nodes in a network with preserving the privacy location for them ??
1
vote
1answer
72 views

Question regarding reconstruction vector in LSSS

Suppose we have a policy $A \wedge ( D \vee (B \wedge C))$ with attributes ${\{A,B,C,D}\}$. The set of subsets of attributes which satisfy this policy is ${\{{\{A,D}\},{\{A,B,C}\},{\{A,B,D}\},{\{A,C,D}...
1
vote
1answer
92 views

Reconstruction vector in Linear secret sharing schemes

Suppose we have a policy $A \wedge ( D \vee (B \wedge C))$ with attributes ${\{A,B,C,D}\}$. The set of subsets of attributes which satisfy this policy is ${\{{\{A,D}\},{\{A,B,C}\},{\{A,B,D}\},{\{A,C,D}...
1
vote
1answer
53 views

Eliptic curve verifiable secret sharing

I am implementing the following the algorithm instructions as shown in 1 (section IV, B). When trying to verify the share given the commits, $a_jG$ verifier $i$ checks whether $f(i)G=\sum_{j=0}^{t} (...
1
vote
1answer
128 views

Reverse Shamir's Secret Sharing Algorithm?

Shamir's Secret Sharing algorithm works by breaking a single secret to multiple parts. While it is trivial to implement the reverse in a $n$-out-of-$n$ scheme, how would one implement an $m$-out-of-$n$...
1
vote
1answer
167 views

AES encryption using MPC SPDZ protocol

I'm reading the article about SPDZ protocol for secure multiparty computation (and also improvements for offline phase like MASCOT). However I'm thinking about practical application of SPDZ for AES ...
5
votes
2answers
112 views

$t$-out-of-$n$ Secret Sharing over $\Bbb Z_2$?

Is it possible to construct a $t$-out-of-$n$ secret sharing scheme over $\Bbb Z_2$? Shamir Secret Sharing allows for an arbitrary threshold $t$ and an arbitrary number of participants $n$, but ...
1
vote
1answer
83 views

Number of possible access structure with $n$ person

I want to count number of possible access structures in closed form(if possible) as a variable of $n$,the number of share holder. I have tried in several ways. Still no good progress. It is very hard ...
0
votes
0answers
32 views

Can I share a secret among more than two keys in ECC? [duplicate]

Sharing a secret in ECC is easy. Alice calculates $S = aB$ and Bob calculates $S=bA$. They will both arrive at the same secret because $aB=bA=abG$. This does not seem to be easily generalizable to ...
2
votes
2answers
83 views

Multiparty secret generation protocol

The goal is to create a secret S on a trusted server by having users A, B and C each send a private seed to the server, in such a way that any 2 of them can later recover S by resubmitting their ...
0
votes
0answers
24 views

Threshold signature scheme with combiner outside the group

Assume we have a (t,n) threshold signature scheme in which the secret key is shared between the n group users. If at least t users sign a certain message . Can we build the scheme in such away ...
0
votes
0answers
14 views
1
vote
1answer
63 views

Minimal size of share in Shamir's Sharing Scheme

Why does the combined shared key in Adi Shamir's Sharing Scheme have to be smaller or equal than each secret share?