Questions tagged [secret-sharing]
Secret sharing refers to splitting a secret among multiple parties so that together they can reconstruct it. All parties, or just a threshold number of them, can be required for reconstruction. If fewer than the required number of parties participate, no information should be leaked about the secret.
571
questions
0
votes
0
answers
24
views
Symmetric encryption that can be 'split'
I'm looking for a cheap symmetric encryption scheme that can basically be used as a signature scheme in zkSNARK.
I need two parties to jointly sign/encrypt to a message and prove to a third party in ...
- 31
1
vote
2
answers
93
views
How robust are the solutions to Socialist Millionaires?
In the socialist millionaire's problem, Alice and Bob, owning respectively values $a$ and $b$, want to check if $a=b$ by communicating publicly. At the end of the exchange between them, Alice and Bob ...
- 173
0
votes
0
answers
20
views
GNU based Shamir Secret Sharing library / utility
I’m looking for a Shamir’s Secret Sharing (SSS) utility or library that is suitable for production use. Are there any GNU implementations or other solutions published by reputable and trusted authors?
0
votes
1
answer
68
views
Best *deterministic* scheme (no SSSS) to turn a secret into 6 shards—with any 2 of these rebuilding the secret
What's the best deterministic scheme (i.e. no Shamir Secret Sharing Scheme) to turn a secret into 6 shards—with any 2 of these shards rebuilding the secret?
- 31
1
vote
0
answers
40
views
Design protocol for logarithm with arithmetic secret sharing
My question is about designing a protocol for logarithm, or any other non-linear function. In arithmetic secret sharing, an input $x$ is split into $x_i$ shares. And all of them are in a finite field $...
- 11
1
vote
0
answers
40
views
Equality Check with FSS
Suppose that we have a condition like checking whether rows and columns ($I, J$) of a matrix $\textbf{A} (\in m \times n)$ have been changed into ($I', J'$) or noting has been added/ removed.
How ...
- 13
0
votes
0
answers
32
views
How to Securely Index Specific Elements from a Secret-Shared Vector Using a Binary Vector?
I am currently exploring a specific problem in secret sharing, which involves securely indexing elements specified by another binary secret-shared vector $\mathbf{s} \in \mathbb{R}^n$ from a secret-...
- 1
2
votes
1
answer
234
views
Shamir secret sharing beats XOR in theory or in practice too?
tldr Shamir secret sharing seems to beat XOR secret sharing when there’s more than 10 participants but practical use cases are usually less than 10 participants. Also XOR secret sharing is easier to ...
2
votes
2
answers
115
views
Efficient commutative one-way encryption or hashing
Spent two days researching the subject, but so far I haven't come up with a satisfying answer as to whether there is a feasible solution to the following problem:
A has a secret $m$ whereby $0 \leq m \...
- 23
0
votes
1
answer
55
views
Beaver Multiplication Triples in Dynamic Indexing
Suppose that we have a series of operations, including matrix multiplication $(A × B)$ where $A$ and $B$ are matrices (will be result of other computations) inside our unsupervised machine learning ...
- 13
0
votes
1
answer
109
views
ZK is not preserved under parallel composition! - Witness Indistinguishability
Referring to an old but very nice paper on Witness Indistinguishability and Witness Hiding (link).
On page 4, in theorem 3.2, the author explained it in three points, but I have few queries.
In point ...
- 307
1
vote
1
answer
105
views
Using Shamir secret sharing algorithm for strings
I want to protect a seed phrase - a list of 24 words.
I know of Shamir's secret sharing algorithm, but this algorithm only works for integers.
Is there any option to use it for strings rather than ...
- 11
1
vote
1
answer
139
views
Is there supposed to be a unique polynomial when given t shares for (t,n) Shamir Secret Sharing scheme?
I always thought that part of the idea behind SSS was that there is only a single $t-1$ degree polynomial through $t$ unique points; that this holds when the polynomial coefficients are over the reals ...
- 45
0
votes
0
answers
42
views
BGW Multiplication with byzantine adversaries
I have recently read about the BGW Multi-party Computation protocol, more specifically the multiplication gate by Gennaro et al (PDF here), however, some concepts raised questions.
Context: From what ...
0
votes
0
answers
40
views
Security of using predefined shares in Shamir's Secret Sharing
This is related to Is it possible to create a mix of predefined and generated shares for Shamir's Secret Sharing?, but I have unfortunately lost access to that question and can't merge accounts ...
- 23
1
vote
1
answer
155
views
What is the difference between Shamir secret sharing and additive sharing?
When it comes to applications, such as multiplication or addition, is there any difference between Shamir secret sharing and additive secret sharing?
- 11
2
votes
2
answers
361
views
Is it possible to create a mix of predefined and generated shares for Shamir's Secret Sharing?
In standard Shamir's Secret Sharing schemes the shares are generated from randomly generated polynomials. I was wandering if it would be possible to create some predefined shares that a user would be ...
- 23
6
votes
1
answer
223
views
Secret sharing thresold scheme with small shares
Shamir secret sharing1 is a common method to split an arbitrary secret (login credentials, symmetric or private key) between $n$ persons, so that a threshold of $k$ persons is required to rebuild the ...
- 144k
0
votes
0
answers
37
views
Implementing Secret Sharing Among Multiple Parties
I'm working on a scenario where a safe has a lock code '42', and this code needs to be shared securely among four individuals. The goal is to set up a system where at least two out of these four ...
- 101
2
votes
0
answers
29
views
Zero Knowlege/Trust Architecture with shared encryption keys (maybe Shamir's secret sharing?)
I'm working on an idea for a backend data store that stores encrypted data that is zero knowledge/trust, however is shareable to a number of parties. I don't want the backend service to know anything ...
- 121
1
vote
0
answers
61
views
An additive secret sharing-based protocol against malicious adversaries
There is a two-party computation protocol based on 2-out-of-2 additive secret sharing in Figure 1. Party $P_0$ holds secret shares $[a]_0, [b]_0$, and party $P_1$ holds secret shares $[a]_1, [b]_1$ ...
- 204
1
vote
0
answers
50
views
Detecting Cheaters in a Secret Sharing Scheme with a Fixed Number of Cheaters
I'm working on a secret sharing scheme and facing a challenge in detecting cheaters among the shareholders. Here's the setup:
There's a decoder $D$, a set of $2T$ shareholders, and a combiner/...
- 111
2
votes
0
answers
63
views
Does the participant-to-participant secret share in FROST distributed key generation need to remain confidential?
In its application of Shamir secret sharing, the FROST paper in Figure 1 Round 2 Step 1 requires each participant $P_i$ to securely send to each other participant $P_\ell$ a secret share $(\ell, f_i(\...
- 63
2
votes
0
answers
33
views
How to distribute share that sums to 0 without a dealer?
I am looking for a protocol where each party generates a share such that $\sum_{i\in [n]} s_i =0$ where the shares should remain secret. The adversary may corrupt n-2 parties, and the parties can be ...
- 99
0
votes
1
answer
162
views
Additive Secret Sharing of Floating point numbers
Consider a floating point number $f$ in IEEE 754 format with sign, exponent and significand values as $f.s$, $f.e$, and $f.sig$. Given this floating point number $f$, I want to compute the shares of $...
2
votes
0
answers
120
views
Secret sharing scheme which cannot tell fake shares from real ones
I am looking for a secret sharing algorithm which accepts a large array, some elements of which are real shares and the rest are fake. The algorithm should satisfy the following conditions:
If all ...
- 121
0
votes
0
answers
41
views
can ownership proofs be added to circuits to make them zk-snark resistant to quantum proof forgery attacks?
According to my previous question the proofs cannot be broken by quantum computation, you cannot obtain the witness of the generated zk-snark proof.
link to my previous question.
Now if the concern is ...
- 3
1
vote
1
answer
72
views
The representation of truncation protocol in SecureML
The secure multiparty computation framework SecureML 1 has proposed a truncation protocol for decimal arithmetic in the integer field.
As mentioned in this paper,
In field $\mathbb{Z}_{2^l}$, $x\in [...
- 11
0
votes
0
answers
85
views
Open-Source Shamir Secret Sharing Hardware Implementations in GF
Is there any hardware implementation of Shamir's secret-sharing method available? I have only go the following two implementations in the existing literature.
Paper 1
Paper 2
Anything more in the ...
- 1
4
votes
11
answers
9k
views
For Symmetric Cryptography, why is it considered more important to safeguard a key than the function/algorithm for encrypting/decrypting a message?
As stated for the question above here's an analogy:
You are a robber looking for a house to rob with two different scenarios that might occur.
1. You have a key that you know belongs to a house and ...
- 65
0
votes
0
answers
25
views
Subkeys of multiple generated sets not combineable Shamir Secret Sharing
I am using a Shamir Secret Sharing implementation in Java and I have the use case,
that I may have to generate more Subkeys of the Secret after I already generated some.
Generating them works, but if ...
- 1
0
votes
1
answer
106
views
Group secret agreement for clients do not have connection to each other
In my idea, $n$ clients will have the connection to a server, and clients will not be able to connect with other clients. Are there any previous design has been published to let $n$ clients agree on a ...
0
votes
0
answers
45
views
Transmit a password to inheritors
I am looking for a safe and easy way for my inheritors to get a password after my death. That can be the password of a digital vault, a password manager, or anything else.
I could write the password ...
- 1
0
votes
1
answer
117
views
Shamir Secret Sharing for API Authentication
I want to implement authentication for an API and thought about using Shamir Secret Sharing to do so.
My plan is to generate 1 Master Key which is stored in the Database, we then generate about 1000 ...
- 1
1
vote
0
answers
56
views
Function Secret Sharing
Bob has constructed a non-linear function $f: \mathbb{R}^n\rightarrow \mathbb{R}^m$ of moderate complexity (i.e., evaluation takes on the order of seconds on a modern computer). Is it possible to ...
- 11
0
votes
1
answer
181
views
Secret Sharing Floating point numbers in IEEE-754 Format
Various papers in the literature (such as https://eprint.iacr.org/2022/322.pdf, https://eprint.iacr.org/2013/850.pdf) use the sign, exponent, and significand values to additively secret share the ...
1
vote
1
answer
134
views
How does the key generation of a homomorphic secret-sharing protocol works?
I am new to cryptography and do not have sufficient background knowledge, and I am sorry for any possible vagueness in my question.
I am reading a paper (https://eprint.iacr.org/2019/129.pdf) about ...
- 13
0
votes
0
answers
63
views
Multiplicative inverse protocol for MPC that outputs 0 when input is 0
Setting: Shamir secret-sharing over the field $GF(p)$, $p$ a prime.
For $a\in GF(p)$, I would like a protocol that takes a sharing $[a]$ as input, and outputs: $[a^{-1}]$ if $a\neq 0$, and $[0]$ if $a=...
1
vote
1
answer
142
views
The state of Shamir's Secret Sharing in 2023
Shamir's Secret Sharing GPL implementation called ssss got removed from Tails OS years back.
Is Shamir's secret sharing still secure nowadays? Why was it removed ...
- 173
1
vote
1
answer
122
views
Why don't basically all "clusters" and similar distributed systems use Shamir's secret sharing method?
When I came to the topic of Ansible (Vault), when deploying secrets in Ansible and other passwords up to 128 characters Shamir's Secret Sharing would be an ideal solution I think:
The secret is never ...
- 173
2
votes
1
answer
123
views
Alternative definition of secret sharing using entropy
I ame reading the paper "Secret-Sharing schemes: A survey" by Amos Beimel. Here there are two definitions of secret sharing.
The first one states:\
A distribution scheme $\langle \Pi,\mu \...
- 93
0
votes
2
answers
117
views
Query about arithmetic finite fields
I was working on implementing shamir secret sharing in GF(2^256), According to my knowledge multiplication in a finite field is defined as mul(a,b) = (a*b)%mod, where mod is the irreducible polynomial....
- 33
0
votes
1
answer
63
views
How to maximise compatibility of Shamir's Secret Sharing
I want to create a shared secret from a short string (e.g. a password) which should be easy to decrypt also in the long term. Unfortunately, I have quite a hard time to make the different tools work ...
- 101
1
vote
1
answer
109
views
Instead of asymetric encryption, why not use two One-time pad? [duplicate]
Why is the following protocol never used to share a symetric key between two parties ?
⊕ is the XOR operation.
Alice has M and wants to send it to Bob.
Alice generates K₁ randomly.
Bob generates K₂ ...
- 13
0
votes
1
answer
128
views
Interpolation of Shamir secret in the Exponent
I'm trying to interpolate a Shamir secret in the exponent based on Boneh's and Shoup's book, Section 22.1 and Corollary 22.2. I think I understand how the scheme works, but I'm stuck now with some ...
- 103
0
votes
0
answers
63
views
Is it posible to generate SNARK of MPC share validity?
Assume we have a central issuing authority that sends each participant a share that reconstructs in key $P_k$. I.e. Shamir Secret Share with $2$ out of $N$ format where $N>3$.
This central ...
- 1
1
vote
1
answer
148
views
Is it possible to have a shared secret between an unlimited number of parties asynchronously?
Let's say I encrypt a message with some secret and store it in a database. Later, I want to securely share that secret with someone, so that they can read the message as well. Even later, I want to ...
- 111
1
vote
1
answer
175
views
Is ($2^{256} + 297$) safe to use as modulus in Shamir Secret Sharing?
The python code example on Wikipedia uses the 12th Mersenne Prime ($2 ^ {127} - 1$) as the modulus. I'd like to share a 32 byte secret. Is it safe to simply change the modulus to p = $2 ^ {256} + 297$?...
- 113
1
vote
2
answers
183
views
How to redistribute shares for Distributed Shamir Secret Sharing?
I'm working on a Distributed Key Generation protocol. The idea is similar to this.
TLDR: Aggregated Shamir Secret Sharing, each participant acts as a dealer & distributed the secret shares of its ...
- 111
1
vote
0
answers
68
views
Understanding Garbled Circuit Design in Gazelle Protocol
I have been examining the Gazelle paper, which focuses on secure inference protocols. One section constructs a Garbled Circuit using inputs cx, sx, and sy to compute the ReLU function in neural ...
- 43