Questions tagged [secret-sharing]

Secret sharing refers to splitting a secret among multiple parties so that together they can reconstruct it. All parties, or just a threshold number of them, can be required for reconstruction. If fewer than the required number of parties participate, no information should be leaked about the secret.

Filter by
Sorted by
Tagged with
1 vote
1 answer
37 views

What is the difference between Shamir secret sharing and additive sharing?

When it comes to applications, such as multiplication or addition, is there any difference between Shamir secret sharing and additive secret sharing?
Gink Lober's user avatar
0 votes
0 answers
41 views

How to calculate inverse of scalar product using secret sharing

Following a question about calculating the inverse value among two parties, I want to ask about the possibility of getting an inverse of the scalar product (|I|. |J|) that is part of the computation ...
ShokofehVS's user avatar
2 votes
2 answers
320 views

Is it possible to create a mix of predefined and generated shares for Shamir's Secret Sharing?

In standard Shamir's Secret Sharing schemes the shares are generated from randomly generated polynomials. I was wandering if it would be possible to create some predefined shares that a user would be ...
Euan's user avatar
  • 21
0 votes
0 answers
52 views

Multiplication of two Shamir Secret Shares

In Shamir Secret Sharing, I'm trying to figure out that how can I multiply a constant and shares with different mods (fields) and obtain the multiplication of this constant and secret? Assume ...
Semiramis's user avatar
6 votes
1 answer
184 views

Secret sharing thresold scheme with small shares

Shamir secret sharing1 is a common method to split an arbitrary secret (login credentials, symmetric or private key) between $n$ persons, so that a threshold of $k$ persons is required to rebuild the ...
fgrieu's user avatar
  • 140k
0 votes
0 answers
31 views

Implementing Secret Sharing Among Multiple Parties

I'm working on a scenario where a safe has a lock code '42', and this code needs to be shared securely among four individuals. The goal is to set up a system where at least two out of these four ...
Iman Mohammadi's user avatar
2 votes
0 answers
25 views

Zero Knowlege/Trust Architecture with shared encryption keys (maybe Shamir's secret sharing?)

I'm working on an idea for a backend data store that stores encrypted data that is zero knowledge/trust, however is shareable to a number of parties. I don't want the backend service to know anything ...
supertodda's user avatar
1 vote
0 answers
35 views

An additive secret sharing-based protocol against malicious adversaries

There is a two-party computation protocol based on 2-out-of-2 additive secret sharing in Figure 1. Party $P_0$ holds secret shares $[a]_0, [b]_0$, and party $P_1$ holds secret shares $[a]_1, [b]_1$ ...
Yang's user avatar
  • 194
1 vote
0 answers
48 views

Detecting Cheaters in a Secret Sharing Scheme with a Fixed Number of Cheaters

I'm working on a secret sharing scheme and facing a challenge in detecting cheaters among the shareholders. Here's the setup: There's a decoder $D$, a set of $2T$ shareholders, and a combiner/...
Kroki's user avatar
  • 111
2 votes
0 answers
61 views

Does the participant-to-participant secret share in FROST distributed key generation need to remain confidential?

In its application of Shamir secret sharing, the FROST paper in Figure 1 Round 2 Step 1 requires each participant $P_i$ to securely send to each other participant $P_\ell$ a secret share $(\ell, f_i(\...
sander's user avatar
  • 63
2 votes
0 answers
31 views

How to distribute share that sums to 0 without a dealer?

I am looking for a protocol where each party generates a share such that $\sum_{i\in [n]} s_i =0$ where the shares should remain secret. The adversary may corrupt n-2 parties, and the parties can be ...
Doron's user avatar
  • 99
0 votes
1 answer
149 views

Additive Secret Sharing of Floating point numbers

Consider a floating point number $f$ in IEEE 754 format with sign, exponent and significand values as $f.s$, $f.e$, and $f.sig$. Given this floating point number $f$, I want to compute the shares of $...
Sumana Bagchi's user avatar
2 votes
0 answers
111 views

Secret sharing scheme which cannot tell fake shares from real ones

I am looking for a secret sharing algorithm which accepts a large array, some elements of which are real shares and the rest are fake. The algorithm should satisfy the following conditions: If all ...
Сергей Макеев's user avatar
0 votes
0 answers
36 views

can ownership proofs be added to circuits to make them zk-snark resistant to quantum proof forgery attacks?

According to my previous question the proofs cannot be broken by quantum computation, you cannot obtain the witness of the generated zk-snark proof. link to my previous question. Now if the concern is ...
dreamer's user avatar
1 vote
1 answer
55 views

The representation of truncation protocol in SecureML

The secure multiparty computation framework SecureML 1 has proposed a truncation protocol for decimal arithmetic in the integer field. As mentioned in this paper, In field $\mathbb{Z}_{2^l}$, $x\in [...
Mia's user avatar
  • 11
0 votes
0 answers
46 views

Open-Source Shamir Secret Sharing Hardware Implementations in GF

Is there any hardware implementation of Shamir's secret-sharing method available? I have only go the following two implementations in the existing literature. Paper 1 Paper 2 Anything more in the ...
Tan007's user avatar
  • 1
5 votes
11 answers
9k views

For Symmetric Cryptography, why is it considered more important to safeguard a key than the function/algorithm for encrypting/decrypting a message?

As stated for the question above here's an analogy: You are a robber looking for a house to rob with two different scenarios that might occur. 1. You have a key that you know belongs to a house and ...
omar7439's user avatar
0 votes
0 answers
23 views

Subkeys of multiple generated sets not combineable Shamir Secret Sharing

I am using a Shamir Secret Sharing implementation in Java and I have the use case, that I may have to generate more Subkeys of the Secret after I already generated some. Generating them works, but if ...
Michael's user avatar
0 votes
1 answer
87 views

Group secret agreement for clients do not have connection to each other

In my idea, $n$ clients will have the connection to a server, and clients will not be able to connect with other clients. Are there any previous design has been published to let $n$ clients agree on a ...
Anh Nguyễn Tuấn's user avatar
0 votes
0 answers
43 views

Transmit a password to inheritors

I am looking for a safe and easy way for my inheritors to get a password after my death. That can be the password of a digital vault, a password manager, or anything else. I could write the password ...
mifrey's user avatar
  • 1
0 votes
1 answer
91 views

Shamir Secret Sharing for API Authentication

I want to implement authentication for an API and thought about using Shamir Secret Sharing to do so. My plan is to generate 1 Master Key which is stored in the Database, we then generate about 1000 ...
Michael's user avatar
1 vote
0 answers
47 views

Function Secret Sharing

Bob has constructed a non-linear function $f: \mathbb{R}^n\rightarrow \mathbb{R}^m$ of moderate complexity (i.e., evaluation takes on the order of seconds on a modern computer). Is it possible to ...
asml's user avatar
  • 11
0 votes
1 answer
117 views

Secret Sharing Floating point numbers in IEEE-754 Format

Various papers in the literature (such as https://eprint.iacr.org/2022/322.pdf, https://eprint.iacr.org/2013/850.pdf) use the sign, exponent, and significand values to additively secret share the ...
Sumana bagchi's user avatar
1 vote
1 answer
100 views

How does the key generation of a homomorphic secret-sharing protocol works?

I am new to cryptography and do not have sufficient background knowledge, and I am sorry for any possible vagueness in my question. I am reading a paper (https://eprint.iacr.org/2019/129.pdf) about ...
zhengyuansu's user avatar
0 votes
0 answers
53 views

Multiplicative inverse protocol for MPC that outputs 0 when input is 0

Setting: Shamir secret-sharing over the field $GF(p)$, $p$ a prime. For $a\in GF(p)$, I would like a protocol that takes a sharing $[a]$ as input, and outputs: $[a^{-1}]$ if $a\neq 0$, and $[0]$ if $a=...
anticommutative's user avatar
1 vote
1 answer
122 views

The state of Shamir's Secret Sharing in 2023

Shamir's Secret Sharing GPL implementation called ssss got removed from Tails OS years back. Is Shamir's secret sharing still secure nowadays? Why was it removed ...
Sir Muffington's user avatar
1 vote
1 answer
111 views

Why don't basically all "clusters" and similar distributed systems use Shamir's secret sharing method?

When I came to the topic of Ansible (Vault), when deploying secrets in Ansible and other passwords up to 128 characters Shamir's Secret Sharing would be an ideal solution I think: The secret is never ...
Sir Muffington's user avatar
2 votes
1 answer
97 views

Alternative definition of secret sharing using entropy

I ame reading the paper "Secret-Sharing schemes: A survey" by Amos Beimel. Here there are two definitions of secret sharing. The first one states:\ A distribution scheme $\langle \Pi,\mu \...
Cristie's user avatar
  • 93
0 votes
2 answers
106 views

Query about arithmetic finite fields

I was working on implementing shamir secret sharing in GF(2^256), According to my knowledge multiplication in a finite field is defined as mul(a,b) = (a*b)%mod, where mod is the irreducible polynomial....
CipherNewbie's user avatar
0 votes
1 answer
52 views

How to maximise compatibility of Shamir's Secret Sharing

I want to create a shared secret from a short string (e.g. a password) which should be easy to decrypt also in the long term. Unfortunately, I have quite a hard time to make the different tools work ...
Wulle's user avatar
  • 101
1 vote
1 answer
104 views

Instead of asymetric encryption, why not use two One-time pad? [duplicate]

Why is the following protocol never used to share a symetric key between two parties ? ⊕ is the XOR operation. Alice has M and wants to send it to Bob. Alice generates K₁ randomly. Bob generates K₂ ...
Pierromer's user avatar
0 votes
1 answer
88 views

Interpolation of Shamir secret in the Exponent

I'm trying to interpolate a Shamir secret in the exponent based on Boneh's and Shoup's book, Section 22.1 and Corollary 22.2. I think I understand how the scheme works, but I'm stuck now with some ...
k13n's user avatar
  • 103
0 votes
0 answers
54 views

Is it posible to generate SNARK of MPC share validity?

Assume we have a central issuing authority that sends each participant a share that reconstructs in key $P_k$. I.e. Shamir Secret Share with $2$ out of $N$ format where $N>3$. This central ...
Peersky's user avatar
1 vote
1 answer
101 views

Is it possible to have a shared secret between an unlimited number of parties asynchronously?

Let's say I encrypt a message with some secret and store it in a database. Later, I want to securely share that secret with someone, so that they can read the message as well. Even later, I want to ...
dodov's user avatar
  • 111
1 vote
1 answer
151 views

Is ($2^{256} + 297$) safe to use as modulus in Shamir Secret Sharing?

The python code example on Wikipedia uses the 12th Mersenne Prime ($2 ^ {127} - 1$) as the modulus. I'd like to share a 32 byte secret. Is it safe to simply change the modulus to p = $2 ^ {256} + 297$?...
robb's user avatar
  • 113
1 vote
2 answers
89 views

How to redistribute shares for Distributed Shamir Secret Sharing?

I'm working on a Distributed Key Generation protocol. The idea is similar to this. TLDR: Aggregated Shamir Secret Sharing, each participant acts as a dealer & distributed the secret shares of its ...
user106458's user avatar
1 vote
0 answers
61 views

Understanding Garbled Circuit Design in Gazelle Protocol

I have been examining the Gazelle paper, which focuses on secure inference protocols. One section constructs a Garbled Circuit using inputs cx, sx, and sy to compute the ReLU function in neural ...
Al A's user avatar
  • 43
1 vote
0 answers
73 views

Impact of New Secret Sharing Paper with $O(n)$ additions for recovery

I hope this question is not too speculative. Applebaum, Nir and Pinkas have a new paper which has an $n-$party secret sharing scheme with: reconstruction complexity of $O(n)$ additions constant share ...
kodlu's user avatar
  • 22.1k
0 votes
0 answers
72 views

How can I have a message signed by other shares of a private key without revealing it?

I am looking for guidance on implementing a protocol where a BLS private key is split into 2 out of 3 shares using Shamir's Secret Sharing, and signatures must be obtained without revealing the ...
xenon's user avatar
  • 225
0 votes
1 answer
81 views

Wrong verification with Pedersen verifiable secret sharing

According to section 4.2 of Pedersen's verifiable secret sharing, given a secret share $(s_i, t_i)$, it is possible to verify that the secret share is valid by using the commitments $E_j$, for $j=0,\...
Morpheus's user avatar
  • 103
0 votes
1 answer
77 views

How to calculate inverse of an element using MPC and secret sharing

Suppose we have multiple parties ${P_i}$ each holding a secret share $(y_i,k_i)$ of the secret $(y,k)$. How can we calculate the inverse value $(y+k)^{-1}$ using multiparty computation such that these ...
Kanchan Bisht's user avatar
1 vote
0 answers
42 views

What are the software tools used for customizing secret sharing and network steganography, which can be used for enhancing secret data transmission? [closed]

My goal is to enhance by bringing some changes to these techniques and schemes so that any improvements can be brought to them. So I tried to find some of the tools and came up with these: Secret ...
Godzilla84's user avatar
3 votes
1 answer
199 views

Reference for basic secret sharing and MPC arithmetic algorithms

I am looking for references for the most basic secret sharing and MPC arithmetic algorithms for generic rings or prime fields. Problem: Suppose there are $m$ parties $P_1, \ldots, P_m$ which wish to ...
Kolja's user avatar
  • 133
1 vote
0 answers
94 views

Feldman Verifiable secret sharing verify [closed]

I recently started to learn about Shamir secret sharing and Feldman's VSS Scheme. I know the concepts But I can't figure out how it works. mostly because many of modulates are with "p" and ...
user109261's user avatar
1 vote
2 answers
97 views

Why does Shamir secret sharing appear to need ordered shares?

The implementation of Shamir secret sharing in this code, only generates the original image if the shares are provided in consecutive order (ex: [2,3,4]) and won't work in any other share order (ex: [...
Nacho Libre's user avatar
0 votes
1 answer
44 views

recovering the original secret of secret sharing [closed]

What is the specific process of recovering the original secret of secret sharing? Is the parties with secret shares communicating with each other and exchanging secret shares, and if the number of ...
sunmu's user avatar
  • 41
5 votes
2 answers
2k views

Is there a way to calculate a hash with two people so that no one knows the pre-image but if they get together they do?

I'm trying to find a way to have multi party hash computation, more specifically for SHA256. I want for two people to be able to compute a hash so that none of them knows the pre-image but when they ...
Dani Vilardell's user avatar
2 votes
1 answer
73 views

Lagrange interpolation in the exponent

I am going over the paper https://verifiable-timed-signatures.github.io/web/assets/paper.pdf and on page 5, it says the following: Suppose I have a t-out-of-n threshold sharing scheme for the secret $\...
sadtroll's user avatar
1 vote
0 answers
79 views

Communication through shared seed in RNG

Given that there are two parties, and a process has been conducted by which both parties are knowledgeable of a shared value p, how could two parties communicate with each other over a public channel ...
Kevin Perez's user avatar
2 votes
0 answers
29 views

Why zero sharings are used to mask secret value to the masked value appears to be a random value?

Some interpretations say "By masking a secret value with a uniformly random zero sharing, the masked value appears to be a random value drawn from a uniform distribution. This randomness helps ...
IRise's user avatar
  • 21

1
2 3 4 5
12