Questions tagged [secret-sharing]
Secret sharing refers to splitting a secret among multiple parties so that together they can reconstruct it. All parties, or just a threshold number of them, can be required for reconstruction. If fewer than the required number of parties participate, no information should be leaked about the secret.
354
questions
0
votes
1answer
57 views
$X_ {i_1}, . . . , X_{ i_ k} $ are IID random variables or not?
In this paper
secret
sharing is to distribute information (the secret) over
a set of participants such that the secret can only be reconstructed if certain authorized combinations of participants join ...
3
votes
1answer
105 views
In a shamir secret sharing scheme, why can't the secret be a middle coefficient and only the first or the last?
In the shamir secret sharing scheme, the Secret s is set as the constant in the equation
$ y_p = s+ \sum_{i=0}^{i = t-1} a_i * x_p^i$
s can only be the constant term or the last coefficient or the ...
1
vote
1answer
67 views
Example of the $Ω$−partite
Consider the following definition from section 2.2 of this research paper
We write $\mathcal{P}(𝑃)$ for the power set of the set $𝑃$. An $𝑟-$partition
$Ω=\{𝑃_1,\cdots,𝑃_𝑟\}$ of a set $𝑃$ ...
1
vote
1answer
53 views
Encrypt data. Create 5 keys. Just 3 keys are needed for decryption
I would like to encrypt some data and create 5 keys. These keys are stored in different places. If I want to decrypt the data I just need 3 of these 5 keys.
Is there a way to do this?
0
votes
0answers
23 views
Distributed group signature scheme
Since there is only one group manager in group signature scheme, are there any scheme that have n group managers who pubilish the member private key or member credential together(or like threshold ...
0
votes
0answers
51 views
Which flaws does the following 2 out of 3 threshold secret sharing algorithm have?
Let's say the secret is an ordered set of two 8-bit integers — $\{a, b\}$.
First, we generate additional entropy, another ordered set of random 8-bit integers — $\{c, d\}$.
\begin{gather}
a \oplus c ...
3
votes
0answers
88 views
Literature question on secure multiparty computation
Consider $N$ players and assume that a private channel between each pair of players is available. Player $i \in \{ 1, \ldots,N\}$ holds a secret $S_i$, which is a sequence of $B$ random bits.
The ...
1
vote
1answer
75 views
How is Shamir's Secret Sharing better than this simple 2-password technique?
I'm looking for a solution to protect a message, such that both password1 (usually given to trusted person #1) and password2 (...
0
votes
1answer
75 views
Secret Sharing between $x$ parties
So for an unknown number of parties $x$, I make $x-1$ random $n$-bit strings represented by {$r_1, r_2,...,r_{x-1}$}. Where $s$ is the complete string split up between $x$ parties (yes?).
I then ...
0
votes
1answer
47 views
Shamir Secret Sharing - How to reconstruction secret? Example
I try implement Shamir Secret Sharing.
In this video: https://www.youtube.com/watch?v=j7Ngtl1cCpY is example.
But for another three share holders is can't reconstruction secrete.
For example:
a)
a(...
2
votes
0answers
28 views
Do I need verifiable shares?
I'm using Shamir's secret sharing in a 2:3 system.
Thus a secret Key is split in 3 subkeys (KeyS:KeyC:KeyT)
I've 3 entities at ...
0
votes
1answer
45 views
How can we evaluate a polynomials in a group instead of a field? (verifiable secret sharing on elliptic curves)
I am trying to understand how we can have cryptographic schemes that builds on both secret sharing, which is build on top of a finite field, and bilinear maps, which are built on top of elliptic curve ...
1
vote
0answers
39 views
Key derivation scheme with shared secrets?
I want to derive a list of sub-keys derived[t] from a master key mk by a key derivation function ...
0
votes
0answers
25 views
How to create a generator for a $Q_3$ access structure?
I'm reading about access structures used for multiparty-computation from https://eprint.iacr.org/2004/245 and https://eprint.iacr.org/2000/037. My understand is that to actually use the access ...
1
vote
1answer
46 views
What does non-collusion assumption mean in server-aided protocol based on secret sharing?
Suppose $m$ clients split their own input into $n$ shares using additive secret sharing scheme (mod something).
Then, each of the clients sends each share to each of $n$ external servers.
After ...
1
vote
0answers
43 views
EC threshold private key's multiplicative inverse and derived-key sharing
I have two devices, and each has a private key xPriv-i. Each device computes the corresponding EC public key xPub-i, shares it, and the linear combination of the keys is the "real" public key xPub. ...
0
votes
0answers
46 views
Why does using infinite fields leak secrets in Shamirs Secret Sharing Scheme? [duplicate]
There is a similar question here, but the answers as I understand them basically say (1) you can leak the parity of the secret and (2) you can run into over/underflow issues as well as floating point ...
1
vote
0answers
60 views
How to go about distributed private/public key pair generation?
I'm trying to implement a protocol in which two parties generate a private/public keypair, where both know the public key, but each party has only one part of the private key and cannot derive the ...
1
vote
0answers
36 views
Asymetric encryption, multiple recipients, traitor must share private key
Is there an Asymetric encryption scheme, or public key encryption, where multiple recipients are able to access the data but in order for one of the recipients to leak the key to the data they would ...
1
vote
0answers
63 views
What is the motivation of multipartite secret sharing?
In this thesis chapter 3.1
A multipartite secret sharing scheme is a scheme in which the set of
participants is divided into several parts and all participants in the
same part play an ...
0
votes
0answers
23 views
Question about publication “Efficient (k,n) Threshold Secret Sharing Schemes Secure Against Cheating from n − 1 Cheaters”
In the paper on section "4 Proposed Scheme", I suppose that the scheme does not protect if an adversary has access to the $k - 1$ original shares, am I correct?
If the adversary has $k - 1$ of both ...
0
votes
1answer
43 views
Whether ramp secret sharing possess additive homomorphism?
Ramp secret sharing replaces the random coefficients in original Shamir secret sharing with original data to be shared. In such a case, all the coefficients in the polynomial evaluation will be ...
0
votes
0answers
26 views
Secret sharing with one smaller share [duplicate]
Given a t-out-of-n shared secret scheme with the message space characterized by binary string of length l, why if one share is smaller than l the scheme is insecure?
1
vote
0answers
19 views
Shamir Secret Sharing: Using $a_0 \ldots a_k$ to store secret? [duplicate]
Let's assume I have a truly random secret $s$ that is 256 bits long, and I want to use SSS with e.g. $(k=4,n=8)$. The normal approach is to set $a_0=s$ and choose $a_1 \ldots a_{k-1}$ randomly, ...
0
votes
0answers
39 views
Explain the meaning of “$E_i = g^{F_i} g^{G_i}$ is uniformly distributed in $G_q$”?
In this paper[1] Qiong et al.’s CRT-based VSS}
{Dealer Phase}
To share a secret $ d \epsilon Z_{m_0} $ among a group of $n$ users with
verifiable shares, the dealer does the following:
<...
0
votes
0answers
41 views
Is my analysis regarding $M_3$ and $M_4$ correct?
In this paper authors gave the following equations for $M_3$ and $M_4$ in section $3.2$ of Share distribution phase:
Shares Distribution
To distribute $n$ shares of a secret $K$ among the set of
...
1
vote
1answer
53 views
How can one prove correctness of shared secrets in secret sharing schemes?
Assume we are in a centralized secret sharing setting, where one party generates the shares, and distributes them to other parties. How can the distributor who creates the shares prove to the parties ...
-1
votes
2answers
76 views
Does Shamir's Sharing Scheme make sense if k=2 and n=2?
Given that I have a secret which I want to split into 2 parts (n=2) and require 2 parts to restore it (k=2), does it still make sense to use Shamir's Scheme or would a trivial scheme with XOR (...
2
votes
1answer
75 views
MPC and Secret Sharing in not Fully-Connected Network
I have an interest in applications of MPC and Secret Sharing.
My point of view is from fields of distributed computing and Game Theory.
I want to generalize some results to arbitrary network ...
1
vote
3answers
241 views
Does lagrange interpolation work with points in an elliptic curve?
Defining the lagrange interpolation for $x=0$ as $\mathcal{L} = \sum_{i=1}^{t+1} y_{i} \cdot l_{i}$ with $l_{i}$ as the lagrange basis polynomials. Does this hold if we apply the elliptic curve ...
0
votes
2answers
122 views
Secret sharing - Size of the share
I'm having some hard time understanding why the size of the share must be at least as large as the secret itself, why is this restriction imposed? What would happen if the share is smaller?
0
votes
0answers
69 views
When Shamir secret sharing used in one time pad scheme
In the following, all operations are defined over a finite field of prime order. Please note that what I'm explaining below is a part of a bigger protocol, however, to keep things simple I just ...
0
votes
0answers
84 views
Split TOTP/HOTP secret and generate pin without trusted dealer
Many site use time-based one time password (totp) as second factor auth method, such as aws.
So we can split the totp secret and distribute each part to different party to achieve threshold login ( ...
-1
votes
2answers
57 views
Can Shamir's SSS be augmented so that having the secret as well as half the shares necessary to construct the secret is enough to reconstruct the key?
More generally, is it possible to construct a $(k,n)$ threshold secret sharing scheme (i.e. let than k shares leaks no statistical information about the secret) such that possession of the secret ...
2
votes
2answers
88 views
Shamir's secret sharing for vectors
How would we go about building a scheme for Shamir secret sharing for vectors?
I have already tried to use a vector of secrets and random distribution of the secrets to $n$ parties and then use $t$ of ...
1
vote
1answer
73 views
Cheating in (2,6)-Shamir Sharing Scheme
We consider a $(2, 6)$ Shamir secret sharing scheme over $Z_{11}$. Four players $A,B,C,D$ cooperate to find the secret, but one of them is cheating (so the share he claims to have might not be an ...
1
vote
0answers
103 views
How can I calculate the feasibility of brute-forcing missing secret shares against the secret checksum?
Secret sharing has the problem of player cheating, where a forged share $s'_i$ can be sent to generate a fake secret $m'$ during reconstruction (and the cheaters can even collude to generate the real ...
2
votes
1answer
66 views
Share secret non-interactively in a verifiable way
In an application, I need to share a secret (random number) with a Group of known receivers over a public channel (a Blockchain) but each receiver needs to be able to check that the others received ...
2
votes
0answers
169 views
Reference for additive secret sharing
Regarding the secret sharing schemes, I am wondering if there are any academic references for the Additive Secret Sharing and its variations. Is there any textbook or article which has specifically ...
4
votes
1answer
311 views
Can we use fixed Beaver's multiplication triples many times?
In the secure computation based on GMW and SPDZ style approaches, we use multiplication triples to gain efficient online computation time.
Can a same triples be used multiple times?
Is there any need ...
1
vote
2answers
158 views
Reed Solomon secret sharing and as a one-time symmetric key?
Shamir's Secret Sharing is just a special case of Reed-Solomon where only one coefficient is used to store the secret instead of the entire polynomial.
Sarwate however, suggests that the latter can ...
5
votes
2answers
319 views
Is there an efficient 2 out of 3 secret sharing scheme based on XOR?
I want to know if there is an efficient secret sharing scheme based on XOR such that a share of the message is given to three people and at least two must combine their share in order to construct the ...
2
votes
2answers
103 views
Does an encryption algorithm exist where encrypted data can be decrypted by multiple private keys?
Suppose I have Company1 with their own Public/Private Key Pairs and another Company2 with their public/private key pairs and yet ...
0
votes
0answers
54 views
How can a node establish pairwise shared key with other nodes using its own polynomial share together with other's public values?
A server has a symmetric bivariate polynomial $ F(x, y) = \sum_{{i,j}=0}^{t-1}a_{i,j}x^iy^j$ $\in GF(p)[X, Y] $ of degree $t-1$. For simpliciy, $ F(x, y) = a_{0,0}+a_{1,0} x+a_{0,1}y+ a_{1,1}xy$ mod ...
0
votes
1answer
83 views
What is the significance of $\prod \limits_{i=1}^{t}m_i > p \prod \limits_{i=1}^{t-1}m_{n-i+1}$ in Asmuth–Bloom threshold SSS?
In this paper by Asmuth–Bloom on threshold SSS, the algorithm is as follows:
Shares Distribution
To distribute $n$ shares of a secret $K$ among the set of participants
$P = \{ p_i : 1 ≤ i ≤ n\}$, ...
1
vote
1answer
104 views
Security of (2,2) Shamir's visual secret sharing scheme : How are the 2 shares random?
From the Visual Cryptography by Shamir and Noar.
Let us take the pixel expansion as 2. Therefore, each pixel will be represented by 2 pixels (also called as subpixels) in a share. Since this is a (2,...
1
vote
1answer
90 views
Pseudorandom zero-sharing: how does it work?
TL;DR
How can the shares of the PRZS protocol proposed in [CDI05] reconstruct the "secret" $0$?
Is the number of shares required to reconstruct $0$ equal to $2t + 1$?
Long question
The paper "...
2
votes
1answer
191 views
Secure multi-party computation for digital signature
Is there any practical algorithm that will allow to use public key cryptography (RSA or ECC) in the following way
There are N parties. Up to M are malicious adversaries (were trusted, but got taken ...
2
votes
1answer
209 views
Is GMW different from Secret Sharing?
Is GMW (How to play ANY mental game) protocol different from Secret Sharing??
If so, how is it different from Secret sharing?
1
vote
1answer
107 views
How to apply lagrange interpolation on bilinear pairings?
I have seen in some places applications of Shamir secret sharing and lagrange interpolation mixed with bilinear pairings, however I fail to understand how this works. For instance, here I find the ...
