Questions tagged [secret-sharing]

Secret sharing refers to splitting a secret among multiple parties so that together they can reconstruct it. All parties, or just a threshold number of them, can be required for reconstruction. If fewer than the required number of parties participate, no information should be leaked about the secret.

Filter by
Sorted by
Tagged with
10
votes
2answers
3k views

Why does Shamir's Secret Sharing Scheme need a finite field?

I read ampersand's question "Necessity for finite field arithmetic and the prime number p in Shamir's Secret Sharing Scheme", where he asked why Shamir's Secret Sharing Scheme uses arithmetic in a ...
7
votes
3answers
1k views

Threshold Secret sharing - How to create a shared secret from pre existing secret parts?

In usual $(t, n)$ secret sharing schemes, a secret $S$ is split into $n$ parts so that any $t$ out of $n$ parts reconstruct the original secret. So, suppose that there is a group of $n$ participants ...
16
votes
4answers
2k views

How do you find a cheater in Shamir Secret Sharing?

If there are 4 people involved, and every two of them should be able to know the secret (the polynomial is just a line) and you are given $f(x)$ and $x$ for each of those people, and you know one of ...
8
votes
3answers
3k views

RS Erasure Coding and Shamir's Secret Sharing

So I was trying to understand the basic difference between erasure coding and secret sharing, and I found this paper (that you can find here or here). For what I understand, it states that Shamir's ...
8
votes
2answers
660 views

Secure degree reduction for Shamir's secret sharing

I understand the basic Shamir Secret Sharing protocol, and when two shares are multiplied, the degree of the polynomial increases. I've seen in a number of papers a reference to a degree reduction ...
5
votes
1answer
816 views

Why only one secret value with Shamir's secret sharing? [duplicate]

Shamir's Secret Sharing works by sharing data points on a curve, whereby when you have the required number of data points, you can find the function of the curve and find out the secret, which is ...
9
votes
1answer
812 views

Shamir's Secret Share Over the Reals

What about using Shamir's secret share over the real numbers leaks information? I know there is a problem with random number generation, and someone suggested it leaks the parity of the polynomial, ...
8
votes
2answers
870 views

Is multiplicative secret sharing secure?

I suggested mulitiplicative secret sharing in an answer to another question, but noted that I wasn't sure if it was even secure and was hoping someone would comment on the security. Since no one did, ...
5
votes
3answers
1k views

Can I pre-define the points in Shamir's Secret Sharing algorithm

With Shamir's secret sharing is it possible to pre-define the points returned by the algorithm? For simplicity if I have (k, n) where k=2, and n=4, and I have the points X,Y,Z, and Q. Can I create ...
2
votes
2answers
749 views

Secret sharing scheme with ability to add or update share number

I would like to have a secret sharing scheme with the following properties: Generate secret $S$ a split it to $N$ shares $(s_1, s_2, ..., s_N)$ Require $k$ of $N$ shares in order to reconstruct ...
15
votes
1answer
2k views

Necessity for finite field arithmetic and the prime number p in Shamir's Secret Sharing Scheme

Shamir's original paper (PDF, 197kb) describing a threshold secret sharing scheme states: To make this claim more precise, we use modular arithmetic instead of real arithmetic. The set of ...
11
votes
2answers
1k views

K out of N encryption

A friend just showed me how to combine padlocks to achieve a lock that opens when k out of n people turn their keys. I was ...
3
votes
1answer
950 views

Choosing finite field size in Shamir's Secret Sharing Scheme

The Wikipedia article on Shamir's Secret Sharing says to that to have information theoretical security the splitting algorithm should be evaluated using finite field arithmetic on the field $\rm{GF}(p)...
10
votes
1answer
2k views

Should the secret key of Shamir's secret-sharing algorithm be interpreted byte by byte?

Should the secret message of Shamir's secret-sharing algorithm be interpreted and processed byte by byte? Interpreting it byte by byte makes it easier to process, but in case one of the shareholders ...
7
votes
2answers
398 views

Manual secret sharing?

What are feasible options for an equivalent of Shamir Secret Sharing using small tables, preferably usable with pen-and-paper? We want to share a secret $K$ into $n\ge2$ shares, so that $m$ shares ($2\...
14
votes
1answer
2k views

Coefficients in Shamir's Secret Sharing Scheme

Sorry if this is a stupid question, but: in Shamir's scheme, we construct a polynomial and make our secret $S$ the zero-th coefficient $a_0$. What, if anything, necessitates this - in other words, can ...
4
votes
1answer
211 views

When all shares of a secret are given to adversary as a permuted matrix

Suppose we have a secret $\sigma$. The secret comes from a universe in which the elements are not necessarily distributed uniformly. We split $\sigma$ into $n$ shares $[\sigma_1,...,\sigma_n]$ (...
2
votes
2answers
217 views

Secret Sharing Scheme with variable share size?

Is there a secret sharing scheme construction that allows the shares to have different sizes/lengths? For example a (3,3) scheme, where shares 1 and 2 have large sizes while share 3 has a very small ...
6
votes
2answers
893 views

An electronic voting system

This semester I am taking the course Cryptography. I will have a presentation about the topic "Voting Scheme". I am preparing myself by reading from the book “Cryptography : an Introduction” by N....
7
votes
2answers
228 views

$(k, n)$ threshold secret sharing to $(k+k', n + n')$ without reissuing all shares

Given a $(k,n)$ threshold secret sharing used to back up a secret (meaning that the dealer has access to the secret at all times), is it possible to update it to a $(k+k', n+n')$ threshold secret ...
6
votes
4answers
852 views

Shamir's Secret Sharing vs. Asmuth-Bloom scheme

I need to make use of a secret sharing scheme and I don't really know how to decide which one to use, Shamir's or Asmuth-Bloom (using CRT). The complexity for recovering the secret seems to be linear ...
5
votes
1answer
709 views

Elliptic Curve Verifiable Secret Sharing

I'm reading this paper, which on page 3(Section IV.C) presents a Jointly Random Verifiable Secret Sharing Scheme for Elliptic curves. The algorithm makes sense to me save for this part: "Each $P_{i\...
5
votes
2answers
209 views

How many polynomials are used in Secure Multiparty Computation?

Secure Multiparty Computation based on Samir Secret sharing methods rely on Polynomials. Imagine corpus of data should be outsourced to bunch of untrusted servers for any computations. Now the data ...
2
votes
3answers
3k views

Implementing secret reconstruction in Shamir's Secret Sharing

I am trying to implement Shamir's secret sharing in C++. I have got the generation of shares working. However, I am very confused with the reconstruction of shares. I get the part on how three users ...
11
votes
2answers
512 views

How can we distribute Shamir's secret sharing scheme shares without a dealer?

Let's say $k$ users have shares to a $(k,n)$ secret sharing scheme, and they want to issue new shares. How can they do this without collecting the shares together? In particular, no set of $k-1$ ...
7
votes
1answer
1k views

How come Shamir Secret Sharing uses Lagrange interpolation?

I've read that Newton polynomials have better computational complexity, but Shamir's uses Lagrange polynomials instead. Does anyone know if there are particular reason why Newton polynomials aren't ...
6
votes
2answers
461 views

Determining the Shamir's secret sharing scheme for the following problem

I'm having trouble solving the Shamir's Secret Sharing scheme for the following problem that states: Problem: A certain military office, which is in control of a powerful missile, consists of six ...
6
votes
1answer
1k views

Threshold Signatures for RSA and DSA

I have a few questions relating to threshold signatures: a scheme where $n$ participants hold a key share and any $t$ of them can conduct a protocol using their shares that results in a valid RSA or ...
6
votes
2answers
395 views

Do deterministic secret sharing schemes exist?

Are there algorithms for secure secret sharing such that the algorithm depends solely on the value being secured, relying on no randomness in its calculations. If there aren't, is such an algorithm ...
5
votes
2answers
1k views

Shamir's Secret Sharing Scheme - prime security?

Does the prime (which needs to be larger than the message) have to be chosen randomly for security, or can it just be a huge constant? Also, the Wikipedia article for SSSS states The size of each ...
5
votes
1answer
211 views

Secret sharing over reals - constructing a (k,n) threshold scheme

After following a discussion that Shamir's Secret Sharing scheme cannot be used to share a real number as secret, I came across the paper "Secret Sharing Over Infinite Domains" - B. Chor and E. ...
4
votes
1answer
741 views

What is the maximum number of shares in Shamir's Secret Sharing?

I am using codahale’s Shamir's Secret Sharing implementation of Shamir's secret sharing from Github. I am using this to generate a 32 byte random key encryption key (KEK) to encrypt a 32 byte data ...
4
votes
2answers
612 views

How to Distribute the Shares using Secret Sharing for arbitrary Monotone Access Structures

Consider 4 people, $A$,$B$,$C$,$D$, & a secret $s\in\{0,1\}^k$. Construct a scheme which enables the following subsets of people to retrieve the secret $\{A,B\}$, $\{A,C\}$, $\{B,C,D\}$. I know ...
4
votes
1answer
705 views

How can Shamir's method for secret sharing work in the GF(256)?

I have been reading about Shamir's secret sharing, and maybe i completely misunderstand something, but the field is meant to be a prime. However, when i look at the implementations of this algorithm, ...
4
votes
1answer
114 views

How do you distribute secret shares without knowing who to first distribute them to?

Figure 1 on page 1249 of the “Multiparty Computation Secure Against Continual Memory Leakage” paper shows $m$ committees are elected in step 1 and then later in step 3 are each given a secret share. ...
4
votes
1answer
148 views

Can data stay encrypted unless I'm eliminated?

I work as a spy for a top secret and ruthless government organisation with a three letter acronym. I know all their dirty secrets and where the skeletons are literally buried. In order to protect ...
3
votes
1answer
242 views

Shamir secret sharing with two types of parties

Consider the Shamir Secret Sharing scheme based on polynomial interpolation. In this scheme, every part has the same right: one piece of information of same value as the other ones. The idea is to ...
2
votes
0answers
84 views

Reference for additive secret sharing

Regarding the secret sharing schemes, I am wondering if there are any academic references for the Additive Secret Sharing and its variations. Is there any textbook or article which has specifically ...
2
votes
1answer
245 views

secret sharing of product of 2 numbers

Does evaluating the products of shares $a_jb_j$ give a secret sharing of $ab$? I think it's a no, but I am not sure on how to prove it.
1
vote
1answer
218 views

How does one construct a 27x27 tabula recta for 2-of-3 secret sharing?

In the answer to this post at security.stackexchange, someone describes how, using pencil and paper, one can do 2-of-3 secret sharing with a tabula recta. But I don't understand how he created his ...
5
votes
1answer
203 views

Background: Secret Sharing and Multiplication Triples

I know that a nearly identical question was asked in (Secret Sharing and Multiplication Triples), but I am a few points shy of asking follow up questions in the comments, so I understand if this is ...
5
votes
3answers
2k views

Secret sharing scheme with possibility to change the secret

Here's a scenario I want to handle with a secret sharing scheme: Alice wants to share the secret $S$ with Bob, Charlie and Dave. Alice generates private shares based on $S$ for Bob, Charlie and Dave, ...
4
votes
1answer
210 views

Does Shamir Secret Sharing provide integrity?

Shamir secret sharing splits into t number of shares with a t-threshold. However, I can find no information online if this scheme provide integrity (or authentication for that matter, which I assume ...
3
votes
1answer
148 views

Difference between Asmuth-Bloom and Shamir's Secret Sharing

Both Asmuth and Shamir are threshold based secret sharing schemes and perfectly secure. In which point of view Asmuth bloom secret sharing scheme is better than Shamir secret sharing scheme. Could ...
3
votes
1answer
1k views

Problem in understanding Blakley's Secret Sharing Scheme

I need to implement Blakley's Secret Sharing Scheme. I have read below mentioned two research papers but still unable to understand how to implement it. Safeguarding cryptographic keys Two Matrices ...
2
votes
1answer
141 views

Secure multi-party computation for digital signature

Is there any practical algorithm that will allow to use public key cryptography (RSA or ECC) in the following way There are N parties. Up to M are malicious adversaries (were trusted, but got taken ...
1
vote
1answer
145 views

Reconstruction vector in Linear secret sharing schemes

Suppose we have a policy $A \wedge ( D \vee (B \wedge C))$ with attributes ${\{A,B,C,D}\}$. The set of subsets of attributes which satisfy this policy is ${\{{\{A,D}\},{\{A,B,C}\},{\{A,B,D}\},{\{A,C,D}...
1
vote
1answer
82 views

Is my proof of Asmuth-Bloom scheme's perfection correct?

I am trying to understand how Asmuth-Bloom's secret sharing is perfect. My "proof" so far (in a 3 out of 4 scheme): $y=s + a * m_0 \bmod m_1 * m_2 * m_3$ Having $k-1$ shares, it will yield a valid ...
1
vote
1answer
394 views

Roots of polynomial in Shamir secret sharing

I need to know whether one can obtain any roots of the polynomial in Shamir secret sharing if he possesses less than threshold shares. For instance in (t,n) if he has t-1 shares can he obtain any ...
1
vote
1answer
109 views

Secret sharing over reals - Difficulty with Computer implementation

I asked a question recently regarding the paper "Secret Sharing Over Infinite Domains" - B. Chor and E. Kushilevitz which describes a secret sharing scheme for real numbers in the interval $[0,1]$. I ...