Questions tagged [secret-sharing]
Secret sharing refers to splitting a secret among multiple parties so that together they can reconstruct it. All parties, or just a threshold number of them, can be required for reconstruction. If fewer than the required number of parties participate, no information should be leaked about the secret.
339
questions
0
votes
0answers
30 views
EC threshold private key's multiplicative inverse and derived-key sharing
I have two devices, and each has a private key xPriv-i. Each device computes the corresponding EC public key xPub-i, shares it, and the linear combination of the keys is the "real" public key xPub. ...
0
votes
0answers
42 views
Why does using infinite fields leak secrets in Shamirs Secret Sharing Scheme? [duplicate]
There is a similar question here, but the answers as I understand them basically say (1) you can leak the parity of the secret and (2) you can run into over/underflow issues as well as floating point ...
1
vote
0answers
59 views
How to go about distributed private/public key pair generation?
I'm trying to implement a protocol in which two parties generate a private/public keypair, where both know the public key, but each party has only one part of the private key and cannot derive the ...
1
vote
0answers
28 views
Asymetric encryption, multiple recipients, traitor must share private key
Is there an Asymetric encryption scheme, or public key encryption, where multiple recipients are able to access the data but in order for one of the recipients to leak the key to the data they would ...
1
vote
0answers
59 views
What is the motivation of multipartite secret sharing?
In this thesis chapter 3.1
A multipartite secret sharing scheme is a scheme in which the set of
participants is divided into several parts and all participants in the
same part play an ...
0
votes
0answers
22 views
Question about publication “Efficient (k,n) Threshold Secret Sharing Schemes Secure Against Cheating from n − 1 Cheaters”
In the paper on section "4 Proposed Scheme", I suppose that the scheme does not protect if an adversary has access to the $k - 1$ original shares, am I correct?
If the adversary has $k - 1$ of both ...
0
votes
1answer
36 views
Whether ramp secret sharing possess additive homomorphism?
Ramp secret sharing replaces the random coefficients in original Shamir secret sharing with original data to be shared. In such a case, all the coefficients in the polynomial evaluation will be ...
0
votes
0answers
26 views
Secret sharing with one smaller share [duplicate]
Given a t-out-of-n shared secret scheme with the message space characterized by binary string of length l, why if one share is smaller than l the scheme is insecure?
1
vote
0answers
19 views
Shamir Secret Sharing: Using $a_0 \ldots a_k$ to store secret? [duplicate]
Let's assume I have a truly random secret $s$ that is 256 bits long, and I want to use SSS with e.g. $(k=4,n=8)$. The normal approach is to set $a_0=s$ and choose $a_1 \ldots a_{k-1}$ randomly, ...
0
votes
0answers
35 views
Explain the meaning of “$E_i = g^{F_i} g^{G_i}$ is uniformly distributed in $G_q$”?
In this paper[1] Qiong et al.’s CRT-based VSS}
{Dealer Phase}
To share a secret $ d \epsilon Z_{m_0} $ among a group of $n$ users with
verifiable shares, the dealer does the following:
<...
0
votes
0answers
40 views
Is my analysis regarding $M_3$ and $M_4$ correct?
In this paper authors gave the following equations for $M_3$ and $M_4$ in section $3.2$ of Share distribution phase:
Shares Distribution
To distribute $n$ shares of a secret $K$ among the set of
...
1
vote
1answer
49 views
How can one prove correctness of shared secrets in secret sharing schemes?
Assume we are in a centralized secret sharing setting, where one party generates the shares, and distributes them to other parties. How can the distributor who creates the shares prove to the parties ...
-1
votes
2answers
73 views
Does Shamir's Sharing Scheme make sense if k=2 and n=2?
Given that I have a secret which I want to split into 2 parts (n=2) and require 2 parts to restore it (k=2), does it still make sense to use Shamir's Scheme or would a trivial scheme with XOR (...
2
votes
1answer
62 views
MPC and Secret Sharing in not Fully-Connected Network
I have an interest in applications of MPC and Secret Sharing.
My point of view is from fields of distributed computing and Game Theory.
I want to generalize some results to arbitrary network ...
1
vote
2answers
162 views
Does lagrange interpolation work with points in an elliptic curve?
Defining the lagrange interpolation for $x=0$ as $\mathcal{L} = \sum_{i=1}^{t+1} y_{i} \cdot l_{i}$ with $l_{i}$ as the lagrange basis polynomials. Does this hold if we apply the elliptic curve ...
0
votes
2answers
120 views
Secret sharing - Size of the share
I'm having some hard time understanding why the size of the share must be at least as large as the secret itself, why is this restriction imposed? What would happen if the share is smaller?
0
votes
0answers
43 views
When Shamir secret sharing used in one time pad scheme
In the following, all operations are defined over a finite field of prime order. Please note that what I'm explaining below is a part of a bigger protocol, however, to keep things simple I just ...
0
votes
0answers
76 views
Split TOTP/HOTP secret and generate pin without trusted dealer
Many site use time-based one time password (totp) as second factor auth method, such as aws.
So we can split the totp secret and distribute each part to different party to achieve threshold login ( ...
-1
votes
2answers
56 views
Can Shamir's SSS be augmented so that having the secret as well as half the shares necessary to construct the secret is enough to reconstruct the key?
More generally, is it possible to construct a $(k,n)$ threshold secret sharing scheme (i.e. let than k shares leaks no statistical information about the secret) such that possession of the secret ...
2
votes
2answers
73 views
Shamir's secret sharing for vectors
How would we go about building a scheme for Shamir secret sharing for vectors?
I have already tried to use a vector of secrets and random distribution of the secrets to $n$ parties and then use $t$ of ...
1
vote
1answer
67 views
Cheating in (2,6)-Shamir Sharing Scheme
We consider a $(2, 6)$ Shamir secret sharing scheme over $Z_{11}$. Four players $A,B,C,D$ cooperate to find the secret, but one of them is cheating (so the share he claims to have might not be an ...
1
vote
0answers
95 views
How can I calculate the feasibility of brute-forcing missing secret shares against the secret checksum?
Secret sharing has the problem of player cheating, where a forged share $s'_i$ can be sent to generate a fake secret $m'$ during reconstruction (and the cheaters can even collude to generate the real ...
2
votes
1answer
63 views
Share secret non-interactively in a verifiable way
In an application, I need to share a secret (random number) with a Group of known receivers over a public channel (a Blockchain) but each receiver needs to be able to check that the others received ...
2
votes
0answers
70 views
Reference for additive secret sharing
Regarding the secret sharing schemes, I am wondering if there are any academic references for the Additive Secret Sharing and its variations. Is there any textbook or article which has specifically ...
3
votes
1answer
139 views
Can we use fixed Beaver's multiplication triples many times?
In the secure computation based on GMW and SPDZ style approaches, we use multiplication triples to gain efficient online computation time.
Can a same triples be used multiple times?
Is there any need ...
1
vote
2answers
136 views
Reed Solomon secret sharing and as a one-time symmetric key?
Shamir's Secret Sharing is just a special case of Reed-Solomon where only one coefficient is used to store the secret instead of the entire polynomial.
Sarwate however, suggests that the latter can ...
5
votes
2answers
192 views
Is there an efficient 2 out of 3 secret sharing scheme based on XOR?
I want to know if there is an efficient secret sharing scheme based on XOR such that a share of the message is given to three people and at least two must combine their share in order to construct the ...
2
votes
2answers
96 views
Does an encryption algorithm exist where encrypted data can be decrypted by multiple private keys?
Suppose I have Company1 with their own Public/Private Key Pairs and another Company2 with their public/private key pairs and yet ...
0
votes
0answers
50 views
How can a node establish pairwise shared key with other nodes using its own polynomial share together with other's public values?
A server has a symmetric bivariate polynomial $ F(x, y) = \sum_{{i,j}=0}^{t-1}a_{i,j}x^iy^j$ $\in GF(p)[X, Y] $ of degree $t-1$. For simpliciy, $ F(x, y) = a_{0,0}+a_{1,0} x+a_{0,1}y+ a_{1,1}xy$ mod ...
0
votes
1answer
77 views
What is the significance of $\prod \limits_{i=1}^{t}m_i > p \prod \limits_{i=1}^{t-1}m_{n-i+1}$ in Asmuth–Bloom threshold SSS?
In this paper by Asmuth–Bloom on threshold SSS, the algorithm is as follows:
Shares Distribution
To distribute $n$ shares of a secret $K$ among the set of participants
$P = \{ p_i : 1 ≤ i ≤ n\}$, ...
1
vote
1answer
99 views
Security of (2,2) Shamir's visual secret sharing scheme : How are the 2 shares random?
From the Visual Cryptography by Shamir and Noar.
Let us take the pixel expansion as 2. Therefore, each pixel will be represented by 2 pixels (also called as subpixels) in a share. Since this is a (2,...
1
vote
0answers
52 views
Pseudorandom zero-sharing: how does it work?
TL;DR
How can the shares of the PRZS protocol proposed in [CDI05] reconstruct the "secret" $0$?
Is the number of shares required to reconstruct $0$ equal to $2t + 1$?
Long question
The paper "...
2
votes
1answer
126 views
Secure multi-party computation for digital signature
Is there any practical algorithm that will allow to use public key cryptography (RSA or ECC) in the following way
There are N parties. Up to M are malicious adversaries (were trusted, but got taken ...
2
votes
1answer
188 views
Is GMW different from Secret Sharing?
Is GMW (How to play ANY mental game) protocol different from Secret Sharing??
If so, how is it different from Secret sharing?
1
vote
1answer
70 views
How to apply lagrange interpolation on bilinear pairings?
I have seen in some places applications of Shamir secret sharing and lagrange interpolation mixed with bilinear pairings, however I fail to understand how this works. For instance, here I find the ...
1
vote
0answers
70 views
Purpose of the ZKPoPK in the original SPDZ protocol
What is the purpose of ZKPoPK in the SPDZ paper? And will the following can detect the active adversaries in 2 party spdz excluding ZKPoPK step?
Each party sends a commitment on his MAC key ∆_i ...
0
votes
1answer
92 views
Two parties SPDZ Protocol Input sharing
Assume we have two computing parties for SPDZ protocol. The two parties are also the input parties. How can they share the MACs on their input shares assuming one party is the master who owns the MAC ...
1
vote
0answers
52 views
How does the user check whether $y < M$ without knowing all shares?
CRT-based Verifiable Secret Sharing Scheme
In this paper, section 4 Verifiable Secret Sharing Scheme, the dealer phase and the combiner phase are as follows:
Dealer Phase
To share a secret $d \in ...
2
votes
0answers
50 views
Adding new share (Shamir Secret Shares ) [duplicate]
I am using this https://github.com/gburca/ssss-js Shamir implementation. I generated 4 shares from secret (threshold of 2).
I am wondering if I can recreate (interpolate) original polynomial from ...
0
votes
0answers
22 views
How space efficient is the Asmuth-Bloom scheme
This answer to another question states that shares in Asmuth-Bloom scheme are $n$ times larger than the secret.
From my understanding of the scheme, the share space is defined by the largest modulo $...
1
vote
0answers
44 views
Confirmation signature - Improved Feldman VSS
I am working through the implementation of A Distributed Private-Key Generator for Identity-Based Cryptography. In the paper (Figure 1, page 8) the validation of a share by a node says that once ...
1
vote
1answer
82 views
Is my proof of Asmuth-Bloom scheme's perfection correct?
I am trying to understand how Asmuth-Bloom's secret sharing is perfect. My "proof" so far (in a 3 out of 4 scheme):
$y=s + a * m_0 \bmod m_1 * m_2 * m_3$
Having $k-1$ shares, it will yield a valid ...
2
votes
3answers
77 views
Impact of a non-uniform distribution in a secret sharing scheme
When it comes to the secret sharing schemes, it seems that the random numbers need to be drawn uniformly. Is there any difference between the random numbers from uniform distribution and the non-...
1
vote
1answer
47 views
How is the generator used in Feldman's Verifiable Secret Sharing scheme determined? [duplicate]
According to the Wikipedia description of Feldman's VSS scheme
First, a cyclic group G of prime order p, along with a generator g of G, is chosen publicly as a system parameter. (Typically, one ...
1
vote
0answers
62 views
Differential privacy and Shamir's scheme
I have been unable to find any proofs (for my own reference) that demonstrate that Shamir's secret sharing scheme does (or does not) satisfy the definition of $\textbf{differential privacy}$ as ...
2
votes
1answer
59 views
Asmuth-Bloom Secret Sharing $m_0$ public?
i am trying to figure out how Asmuth-Bloom secret sharing works and followed the example on wikipedia and replaced it with own numbers.
Namely, i used:
$S=3$
$k=3$
$n=4$
$m_0 = 13, m_1=45, m_2=46, ...
6
votes
1answer
234 views
Why is a number of shares that is greater than a threshold required to construct secret?
In this paper of Asmuth–Bloom threshold SSS, the algorithm is as follows:
Shares Distribution
To distribute n shares of a secret $K$ among the set of participants
$P = \{ p_i : 1 ≤ i ≤ n\}$, the ...
2
votes
2answers
48 views
Why is Blakley secret sharing in finite space?
The paper says it requires a finite space. I wonder what the reason is, since from my understanding it should be perfectly fine to use the "normal" infinite space.
So why does Blakley use a finite ...
3
votes
1answer
171 views
How is Blakley's Secret Sharing Scheme perfect?
Currently, I am trying to understand Blakley's secret sharing scheme. However, there seem to be multiple descriptions of it, which are very different from another, but everyone states that the scheme ...
0
votes
1answer
63 views
Two-way secret sharing for authentication?
Secret sharing, using methods such as Shamir's Secret Sharing allows for t out of n shares to recreate a secret.
For authentication, the secret can be a user ID. A client with a logged-in user can ...
