Questions tagged [secret-sharing]

Secret sharing refers to splitting a secret among multiple parties so that together they can reconstruct it. All parties, or just a threshold number of them, can be required for reconstruction. If fewer than the required number of parties participate, no information should be leaked about the secret.

Filter by
Sorted by
Tagged with
1
vote
1answer
58 views

What is the reason for Shamir scheme to use modulo prime?

In Shamir's secret sharing scheme, Dealer performs the following steps Choose a prime number $q$ such that $q > n$ Choose a secret $s$ from finite field $\mathbb{Z}_q$ Choose $t-1$ degree ...
2
votes
0answers
32 views

Product of secrets in multi-secret sharing schemes (aka packed secret sharing schemes)

The question is related to the multi-secret sharing scheme described in the following paper: [FY92] Matthew K. Franklin, Moti Yung: Communication Complexity of Secure Computation (Extended Abstract). ...
1
vote
1answer
32 views

How to create (n, t) secret splitting from (n, n) secret splitting?

Given a secret splitting scheme $(n ,n)$ that creates $n$ shares from secret $s$. In this scheme all shares must be combined to create $s$. How do you create a secret splitting scheme $(n, t)$? Of $n$ ...
3
votes
0answers
52 views

What is the fundamental difference between multipartite and multilevel secret sharing?

According to this paper , Multipartite secret sharing scheme is a scheme in which the set of participants is divided into disjoint parts and all participants in the same part play an equivalent role ...
0
votes
1answer
30 views

The security level of secret share compared to homomorphic encryption

I want to compare additive secret share to Paillier encryption. However, I haven't found out how to set the parameters in such a way that the security level is consistent. Additive secret share (...
1
vote
1answer
225 views

Does the transposition cipher have a network application?

So I'm reading a chapter in my networking book, and it talks about substitution and transposition ciphers. I know that most network security uses public key or symmetric encryption, but I wonder ...
1
vote
1answer
53 views

SS/HE/GC/OT secure integer comparison

I have been reading some papers to find a 'faster' way to compare two integers without revealing their real values. But I think I'm a bit lost in those papers due to my limited knowledge in ...
0
votes
0answers
32 views

What security does the BMR protocol offer against corruption?

I've been conducting some research into general-purpose MPC protocols and have been unable to pinpoint the exact security offered by the BMR protocol. The reference I've been using for the majority of ...
0
votes
1answer
93 views

Publicly verifiable secret sharing scheme

In https://www.win.tue.nl/~berry/papers/crypto99.pdf, Schoenmakers proposes a publicly verifiable secret sharing scheme, that uses a non-interactive DLEQ proof to allow any participant to verify the ...
5
votes
1answer
83 views

Secure Secret Sharing to a Distributed Key

Setup There are two groups, $A$ and $B$. Each group is in a Shamir's secret sharing scheme ($t_A$ of $N_A$ and $t_B$ of $N_B$). Each group has a public key that is associated with the identity of the ...
0
votes
0answers
38 views

Shamir secret sharing in automated verification tools

Can Shamir secret sharing scheme (SSS) be verified using automated verification tools such as AVISPA? I read in the HLPSL manual that we cannot use arithmetic or relative operations such +,-,< ......
0
votes
1answer
62 views

Splitting an AES-256 key into two?

I understand there are already few question here which are similar but mine is a bit different in that I want to split AES 256 bit into two 128 bit key and then use a different AES key of 128bit to ...
0
votes
0answers
13 views

Modular arithmetic does not work in Threshold signature (TSS) implementation [migrated]

I was implementing threshold signatures protocol described in this paper and I run into a case where it fails and I don't understand reasons why. In the end, u and <...
0
votes
2answers
124 views

Secret sharing scheme verifiability

This secret sharing scheme takes place in the polynomial ring over a finite field $F_p[x]$, $p$ being a large prime, in the following simplified way: The dealer chooses a private polynomial $f(x)$. ...
1
vote
1answer
62 views

Gennaro & Goldfeder Key Generation Protocol

As I am going through the “Fast Multiparty Threshold ECDSA with Fast Trustless Setup” paper by Gennaro & Goldfeder, 2018, I am stumbled by the key generation protocol (Sect. 4.1, p.10): In Phase ...
2
votes
2answers
87 views

Identifying the cheater in (3,5)-Shamir's secret sharing

The problem I'm trying to solve: Identifying the cheater in (3,5)-Shamir's secret sharing when we can see only the 3 shares that were given to the system in the secret reconstruction process, and we ...
2
votes
0answers
60 views

Detailed running time analysis for Shamir secret sharing scheme

I am successfully working on Shamir's secret sharing scheme for few months. But the only issue I am facing is the calculation of theoretical time complexity. Since I am from algorithmic background, I ...
0
votes
0answers
61 views

Proof of theoritical security of Shamir's secret sharing

community ! I'm looking for the proof of theoritical security of Shamir's secret sharing. I found some articles saying that it's assimilable to the halting problem, which implies that there is no ...
0
votes
1answer
61 views

Time complexity of a brute force attack on Shamir's Secret Sharing SSS

I have searched everywhere in academic papers about time complexity of a brute force attack on a Shamir's Secret Sharing key. I'm confused between if it is $O(p^k)$ or $O(p)$, such that $p$ is the ...
0
votes
1answer
60 views

Are Shamir shares independent?

Assume we have a secret $s \in Z_p$. We generate the set of secret shares $\{ (x_i, s_i) \}_{i=1}^{N}$ according to a $(N,k)$ Shamir's scheme. The evaluations are generated according to the following ...
2
votes
2answers
775 views

Running time of Shamir's secret sharing scheme

Let $p>n$ be a prime number. The key steps in the $(t,n)$ Shamir's secret sharing is as follows: Steps of dealer: Choosing $s \in \mathbb{Z}_p^*$ Selecting $b_i \in \mathbb{Z}_p^*$ for polynomial ...
1
vote
1answer
257 views

Pseudorandom zero-sharing: how does it work?

TL;DR How can the shares of the PRZS protocol proposed in [CDI05] reconstruct the "secret" $0$? Is the number of shares required to reconstruct $0$ equal to $2t + 1$? Long question The paper "...
0
votes
2answers
105 views

Is the dealer a volunteer in Shamir secret sharing scheme?

In this Paper, Shamir secret sharing scheme there is one dealer and n players. The dealer gives a share of the secret to the players, but only when specific conditions are fulfilled will the players ...
1
vote
2answers
80 views

Transparent Voting and Advance Secret Code

In the book "Introduction to the Theory of Computation", Michael Sipser writes The field of cryptography, as this area is known, now extends well beyond secret codes for private ...
0
votes
1answer
39 views

summation problem?

Let there are two given numbers $x,y$ which is $A=x+y$ and we know just $A$. How we can find this just $x$ and $y$? If you suppose $a$ a random number, then we know $x_1=a$ and $y_1=A-a$ satisfies in $...
2
votes
1answer
50 views

Real-world offline phase implementation in MPC setting

I've been reading up on various basic MPC primitives (multiplication, inversion, exponentiation and so on of secrets shared between multiple parties). One of the problems of implementing MPC in real-...
2
votes
1answer
50 views

How to do unmasked addition on SSS masked shares?

I'm trying to understand how Shamir's Secret Sharing algorithm is applied to AES when doing threshold masking. I understand how the secrets are created and the secret is calculated and I'm now trying ...
1
vote
2answers
77 views

How to generate a random point on an elliptic curve without knowing it's corresponding scalar private key

Given an elliptic curve with generator $G$, is it possible to generate a random point on the curve $Q = a \cdot G$ without knowing the secret value $a$ that generated it? Note that just using an $a$ ...
2
votes
1answer
99 views

Should the field size in Shamir secret sharing scheme be larger than secret?

I'm playing around with implementing Shamir's secret sharing scheme in Kotlin. Here is implementation so far: ...
0
votes
0answers
55 views

Shamir secret sharing scheme only works with certain parameters

im doing a small programming project, where I have to implement shamirs secret sharing scheme. I want to share the secret S = 21426848149916227113669602 I want a k of three, meanng that three shares ...
0
votes
1answer
71 views

Difference between Multi-linear and Multi-Secret Sharing Schemes

I've been reading papers on secret sharing schemes and came to two different terms, namely, multi-linear secret sharing schemes and multi-secret sharing schemes. As an example, the term multi-linear ...
0
votes
0answers
23 views

How to compare the size of two shared secrets?

Suppose there are two secrets x and y which are split as $[[x]]=x_1+x_2+\cdots+x_n$ and $[[y]]=y_1+y_2+\cdots+y_n$. Is there anyway to generate a bit [[x > y]] with additional assumptions?
0
votes
1answer
121 views

Multi-Linear Secret Sharing vs. Shamir Secret Sharing

I hope someone can help me. I read several papers including the original paper, "Multi-linear Secret-sharing Schemes," by Beimel et al., and watched the following video https://www.youtube....
1
vote
1answer
91 views

Proving I can solve an equation without disclosing the solution (zero-knowledge proof)

Given a (potentially multivariable) equation $f(x)=0$, Peggy wants to prove to Victor that she knows a solution $x^\star$ to it without actually disclosing anything information about the value of $x^\...
2
votes
1answer
136 views

How do I multiply two points on an elliptic curve?

Tell me if there is a way to multiply two points on an elliptic curve? For example, as in secp256k1 ...
1
vote
0answers
57 views

Understanding multiplication of Shamir secret sharing during threshold (EC)DSA signing

I have been looking at the threshold (EC)DSA schemes for honest majority by Gennaro et al. https://www.sciencedirect.com/science/article/pii/S0890540100928815. In the scheme, there are steps where we ...
8
votes
5answers
2k views

Computational Complexity Of Breaking Information Theoretic Security

Wikipedia mentions that Shamir's secret sharing(SSS) for example, has information theoretic security. While I understand the concept that the adversary would just not have enough information to break ...
0
votes
1answer
39 views

Generating and distributing a secret without trusting the source

I have multiple entities (servers) that all share a private secret already. Those servers need a rotating secret (TTL a few hours). All servers must have the same set of secrets at all times. I have ...
1
vote
1answer
32 views

Encrypting a broadcast message decryptable by a subset of receivers

I wasn't certain how to title this request/problem, but here goes: I'm A, and I want to send a message that is received by B, C, D. Each receiving entity here is part of some set of domains D1, D2, D3:...
1
vote
1answer
244 views

What is definition of “adversary”? And what do they do?

Currently I am writing my last assignment about secret sharing. But I don't clearly understand adversary. I know this is a fundamental concept in secret sharing. But I couldn't find references that ...
1
vote
1answer
71 views

Inside attack (attack from participants) in secret sharing

I have considered a $(t,n)$ secret sharing scheme with $n$ secret, say $a1,a2....an$. It's third party secure, but it has inside adversaries. While reconstructing secrets, a group of $t$ qualified ...
0
votes
0answers
25 views

Value of Prime P in shamir secret sharing

How the value of prime integer taken in Shamir's Secret sharing scheme. I have taken p which is greater than my secret and the no of shares. When i do calculation without modp then secret reconstruct ...
0
votes
1answer
43 views

Can you use a “power of 2” gate in the BGW protocol

I am learning about the BGW Protocol and I understand that for a MUL gate, you need to follow the degree reduction protocol. I am wondering if it is possible to implement a single input and single ...
2
votes
1answer
67 views

Is linear secret sharing over the addittive group of integers modulo $p$ with $p$ non-prime secure?

In Maurer, Ueli. "Secure multi-party computation made simple." Discrete Applied Mathematics 154.2 (2006): 370-381. I have found the following technique for $k$-out-of-$k$ linear secret ...
-2
votes
2answers
539 views

How do we solve Shammir 2,3 sharring scheme where arithmetic is modulo?

I am trying to get secret S and I have 3 values (2,2)(6,3)(4,9) and know that modulo is 13. I tried using Lagrange basis polynomial and got 8 but I am not sure if that is right and also I cannot find ...
1
vote
1answer
72 views

Secret sharing by using just “private secrets”?

TLS is using 3 way handshake. Isn't that possible to use such 3 way handshake protocol to share a secret without using a public key scheme, for instance as follows: Let A, B be private secrets of ...
0
votes
1answer
93 views

Splitting Secret Key

If I split a key $k$ into three pieces as $k1, k2$ and $k3$ how should I distribute the keys among three people such that any two of them are able to evaluate PRF, but be secure from any one of them ...
0
votes
0answers
42 views

addition of shares from shamirs scheme and additive scheme

Assume we have two secrets $s_1$ and $s_2$. We use Shamir's scheme to produce $\{(x_i,y_i)\}$ as $n$ shares of $s_1$ with a threshold $t$. Then, we use the additive scheme to generate shares for $s_2$,...
0
votes
0answers
20 views

Threshold schemes

I am looking for a reference that lists all major $(n,k)$ secret sharing schemes. Can anyone help me get such a reference?
1
vote
0answers
32 views

Black-box secret sharing schemes

My question is about black box secret sharing schemes (BBSSS). Do these schemes have any advantages over the better known secret sharing schemes like Shamir’s?

1
2 3 4 5
9