Questions tagged [secret-sharing]

Secret sharing refers to splitting a secret among multiple parties so that together they can reconstruct it. All parties, or just a threshold number of them, can be required for reconstruction. If fewer than the required number of parties participate, no information should be leaked about the secret.

Filter by
Sorted by
Tagged with
0
votes
0answers
30 views

EC threshold private key's multiplicative inverse and derived-key sharing

I have two devices, and each has a private key xPriv-i. Each device computes the corresponding EC public key xPub-i, shares it, and the linear combination of the keys is the "real" public key xPub. ...
0
votes
0answers
42 views

Why does using infinite fields leak secrets in Shamirs Secret Sharing Scheme? [duplicate]

There is a similar question here, but the answers as I understand them basically say (1) you can leak the parity of the secret and (2) you can run into over/underflow issues as well as floating point ...
1
vote
0answers
59 views

How to go about distributed private/public key pair generation?

I'm trying to implement a protocol in which two parties generate a private/public keypair, where both know the public key, but each party has only one part of the private key and cannot derive the ...
1
vote
0answers
28 views

Asymetric encryption, multiple recipients, traitor must share private key

Is there an Asymetric encryption scheme, or public key encryption, where multiple recipients are able to access the data but in order for one of the recipients to leak the key to the data they would ...
1
vote
0answers
59 views

What is the motivation of multipartite secret sharing?

In this thesis chapter 3.1 A multipartite secret sharing scheme is a scheme in which the set of participants is divided into several parts and all participants in the same part play an ...
0
votes
0answers
22 views

Question about publication “Efficient (k,n) Threshold Secret Sharing Schemes Secure Against Cheating from n − 1 Cheaters”

In the paper on section "4 Proposed Scheme", I suppose that the scheme does not protect if an adversary has access to the $k - 1$ original shares, am I correct? If the adversary has $k - 1$ of both ...
0
votes
1answer
36 views

Whether ramp secret sharing possess additive homomorphism?

Ramp secret sharing replaces the random coefficients in original Shamir secret sharing with original data to be shared. In such a case, all the coefficients in the polynomial evaluation will be ...
0
votes
0answers
26 views

Secret sharing with one smaller share [duplicate]

Given a t-out-of-n shared secret scheme with the message space characterized by binary string of length l, why if one share is smaller than l the scheme is insecure?
1
vote
0answers
19 views

Shamir Secret Sharing: Using $a_0 \ldots a_k$ to store secret? [duplicate]

Let's assume I have a truly random secret $s$ that is 256 bits long, and I want to use SSS with e.g. $(k=4,n=8)$. The normal approach is to set $a_0=s$ and choose $a_1 \ldots a_{k-1}$ randomly, ...
0
votes
0answers
35 views

Explain the meaning of “$E_i = g^{F_i} g^{G_i}$ is uniformly distributed in $G_q$”?

In this paper[1] Qiong et al.’s CRT-based VSS} {Dealer Phase} To share a secret $ d \epsilon Z_{m_0} $ among a group of $n$ users with verifiable shares, the dealer does the following: <...
0
votes
0answers
40 views

Is my analysis regarding $M_3$ and $M_4$ correct?

In this paper authors gave the following equations for $M_3$ and $M_4$ in section $3.2$ of Share distribution phase: Shares Distribution To distribute $n$ shares of a secret $K$ among the set of ...
1
vote
1answer
49 views

How can one prove correctness of shared secrets in secret sharing schemes?

Assume we are in a centralized secret sharing setting, where one party generates the shares, and distributes them to other parties. How can the distributor who creates the shares prove to the parties ...
-1
votes
2answers
73 views

Does Shamir's Sharing Scheme make sense if k=2 and n=2?

Given that I have a secret which I want to split into 2 parts (n=2) and require 2 parts to restore it (k=2), does it still make sense to use Shamir's Scheme or would a trivial scheme with XOR (...
2
votes
1answer
62 views

MPC and Secret Sharing in not Fully-Connected Network

I have an interest in applications of MPC and Secret Sharing. My point of view is from fields of distributed computing and Game Theory. I want to generalize some results to arbitrary network ...
1
vote
2answers
162 views

Does lagrange interpolation work with points in an elliptic curve?

Defining the lagrange interpolation for $x=0$ as $\mathcal{L} = \sum_{i=1}^{t+1} y_{i} \cdot l_{i}$ with $l_{i}$ as the lagrange basis polynomials. Does this hold if we apply the elliptic curve ...
0
votes
2answers
120 views

Secret sharing - Size of the share

I'm having some hard time understanding why the size of the share must be at least as large as the secret itself, why is this restriction imposed? What would happen if the share is smaller?
0
votes
0answers
43 views

When Shamir secret sharing used in one time pad scheme

In the following, all operations are defined over a finite field of prime order. Please note that what I'm explaining below is a part of a bigger protocol, however, to keep things simple I just ...
0
votes
0answers
76 views

Split TOTP/HOTP secret and generate pin without trusted dealer

Many site use time-based one time password (totp) as second factor auth method, such as aws. So we can split the totp secret and distribute each part to different party to achieve threshold login ( ...
-1
votes
2answers
56 views

Can Shamir's SSS be augmented so that having the secret as well as half the shares necessary to construct the secret is enough to reconstruct the key?

More generally, is it possible to construct a $(k,n)$ threshold secret sharing scheme (i.e. let than k shares leaks no statistical information about the secret) such that possession of the secret ...
2
votes
2answers
73 views

Shamir's secret sharing for vectors

How would we go about building a scheme for Shamir secret sharing for vectors? I have already tried to use a vector of secrets and random distribution of the secrets to $n$ parties and then use $t$ of ...
1
vote
1answer
67 views

Cheating in (2,6)-Shamir Sharing Scheme

We consider a $(2, 6)$ Shamir secret sharing scheme over $Z_{11}$. Four players $A,B,C,D$ cooperate to find the secret, but one of them is cheating (so the share he claims to have might not be an ...
1
vote
0answers
95 views

How can I calculate the feasibility of brute-forcing missing secret shares against the secret checksum?

Secret sharing has the problem of player cheating, where a forged share $s'_i$ can be sent to generate a fake secret $m'$ during reconstruction (and the cheaters can even collude to generate the real ...
2
votes
1answer
63 views

Share secret non-interactively in a verifiable way

In an application, I need to share a secret (random number) with a Group of known receivers over a public channel (a Blockchain) but each receiver needs to be able to check that the others received ...
2
votes
0answers
70 views

Reference for additive secret sharing

Regarding the secret sharing schemes, I am wondering if there are any academic references for the Additive Secret Sharing and its variations. Is there any textbook or article which has specifically ...
3
votes
1answer
139 views

Can we use fixed Beaver's multiplication triples many times?

In the secure computation based on GMW and SPDZ style approaches, we use multiplication triples to gain efficient online computation time. Can a same triples be used multiple times? Is there any need ...
1
vote
2answers
136 views

Reed Solomon secret sharing and as a one-time symmetric key?

Shamir's Secret Sharing is just a special case of Reed-Solomon where only one coefficient is used to store the secret instead of the entire polynomial. Sarwate however, suggests that the latter can ...
5
votes
2answers
192 views

Is there an efficient 2 out of 3 secret sharing scheme based on XOR?

I want to know if there is an efficient secret sharing scheme based on XOR such that a share of the message is given to three people and at least two must combine their share in order to construct the ...
2
votes
2answers
96 views

Does an encryption algorithm exist where encrypted data can be decrypted by multiple private keys?

Suppose I have Company1 with their own Public/Private Key Pairs and another Company2 with their public/private key pairs and yet ...
0
votes
0answers
50 views

How can a node establish pairwise shared key with other nodes using its own polynomial share together with other's public values?

A server has a symmetric bivariate polynomial $ F(x, y) = \sum_{{i,j}=0}^{t-1}a_{i,j}x^iy^j$ $\in GF(p)[X, Y] $ of degree $t-1$. For simpliciy, $ F(x, y) = a_{0,0}+a_{1,0} x+a_{0,1}y+ a_{1,1}xy$ mod ...
0
votes
1answer
77 views

What is the significance of $\prod \limits_{i=1}^{t}m_i > p \prod \limits_{i=1}^{t-1}m_{n-i+1}$ in Asmuth–Bloom threshold SSS?

In this paper by Asmuth–Bloom on threshold SSS, the algorithm is as follows: Shares Distribution To distribute $n$ shares of a secret $K$ among the set of participants $P = \{ p_i : 1 ≤ i ≤ n\}$, ...
1
vote
1answer
99 views

Security of (2,2) Shamir's visual secret sharing scheme : How are the 2 shares random?

From the Visual Cryptography by Shamir and Noar. Let us take the pixel expansion as 2. Therefore, each pixel will be represented by 2 pixels (also called as subpixels) in a share. Since this is a (2,...
1
vote
0answers
52 views

Pseudorandom zero-sharing: how does it work?

TL;DR How can the shares of the PRZS protocol proposed in [CDI05] reconstruct the "secret" $0$? Is the number of shares required to reconstruct $0$ equal to $2t + 1$? Long question The paper "...
2
votes
1answer
126 views

Secure multi-party computation for digital signature

Is there any practical algorithm that will allow to use public key cryptography (RSA or ECC) in the following way There are N parties. Up to M are malicious adversaries (were trusted, but got taken ...
2
votes
1answer
188 views

Is GMW different from Secret Sharing?

Is GMW (How to play ANY mental game) protocol different from Secret Sharing?? If so, how is it different from Secret sharing?
1
vote
1answer
70 views

How to apply lagrange interpolation on bilinear pairings?

I have seen in some places applications of Shamir secret sharing and lagrange interpolation mixed with bilinear pairings, however I fail to understand how this works. For instance, here I find the ...
1
vote
0answers
70 views

Purpose of the ZKPoPK in the original SPDZ protocol

What is the purpose of ZKPoPK in the SPDZ paper? And will the following can detect the active adversaries in 2 party spdz excluding ZKPoPK step? Each party sends a commitment on his MAC key ∆_i ...
0
votes
1answer
92 views

Two parties SPDZ Protocol Input sharing

Assume we have two computing parties for SPDZ protocol. The two parties are also the input parties. How can they share the MACs on their input shares assuming one party is the master who owns the MAC ...
1
vote
0answers
52 views

How does the user check whether $y < M$ without knowing all shares?

CRT-based Verifiable Secret Sharing Scheme In this paper, section 4 Verifiable Secret Sharing Scheme, the dealer phase and the combiner phase are as follows: Dealer Phase To share a secret $d \in ...
2
votes
0answers
50 views

Adding new share (Shamir Secret Shares ) [duplicate]

I am using this https://github.com/gburca/ssss-js Shamir implementation. I generated 4 shares from secret (threshold of 2). I am wondering if I can recreate (interpolate) original polynomial from ...
0
votes
0answers
22 views

How space efficient is the Asmuth-Bloom scheme

This answer to another question states that shares in Asmuth-Bloom scheme are $n$ times larger than the secret. From my understanding of the scheme, the share space is defined by the largest modulo $...
1
vote
0answers
44 views

Confirmation signature - Improved Feldman VSS

I am working through the implementation of A Distributed Private-Key Generator for Identity-Based Cryptography. In the paper (Figure 1, page 8) the validation of a share by a node says that once ...
1
vote
1answer
82 views

Is my proof of Asmuth-Bloom scheme's perfection correct?

I am trying to understand how Asmuth-Bloom's secret sharing is perfect. My "proof" so far (in a 3 out of 4 scheme): $y=s + a * m_0 \bmod m_1 * m_2 * m_3$ Having $k-1$ shares, it will yield a valid ...
2
votes
3answers
77 views

Impact of a non-uniform distribution in a secret sharing scheme

When it comes to the secret sharing schemes, it seems that the random numbers need to be drawn uniformly. Is there any difference between the random numbers from uniform distribution and the non-...
1
vote
1answer
47 views

How is the generator used in Feldman's Verifiable Secret Sharing scheme determined? [duplicate]

According to the Wikipedia description of Feldman's VSS scheme First, a cyclic group G of prime order p, along with a generator g of G, is chosen publicly as a system parameter. (Typically, one ...
1
vote
0answers
62 views

Differential privacy and Shamir's scheme

I have been unable to find any proofs (for my own reference) that demonstrate that Shamir's secret sharing scheme does (or does not) satisfy the definition of $\textbf{differential privacy}$ as ...
2
votes
1answer
59 views

Asmuth-Bloom Secret Sharing $m_0$ public?

i am trying to figure out how Asmuth-Bloom secret sharing works and followed the example on wikipedia and replaced it with own numbers. Namely, i used: $S=3$ $k=3$ $n=4$ $m_0 = 13, m_1=45, m_2=46, ...
6
votes
1answer
234 views

Why is a number of shares that is greater than a threshold required to construct secret?

In this paper of Asmuth–Bloom threshold SSS, the algorithm is as follows: Shares Distribution To distribute n shares of a secret $K$ among the set of participants $P = \{ p_i : 1 ≤ i ≤ n\}$, the ...
2
votes
2answers
48 views

Why is Blakley secret sharing in finite space?

The paper says it requires a finite space. I wonder what the reason is, since from my understanding it should be perfectly fine to use the "normal" infinite space. So why does Blakley use a finite ...
3
votes
1answer
171 views

How is Blakley's Secret Sharing Scheme perfect?

Currently, I am trying to understand Blakley's secret sharing scheme. However, there seem to be multiple descriptions of it, which are very different from another, but everyone states that the scheme ...
0
votes
1answer
63 views

Two-way secret sharing for authentication?

Secret sharing, using methods such as Shamir's Secret Sharing allows for t out of n shares to recreate a secret. For authentication, the secret can be a user ID. A client with a logged-in user can ...