Questions tagged [secret-sharing]

Secret sharing refers to splitting a secret among multiple parties so that together they can reconstruct it. All parties, or just a threshold number of them, can be required for reconstruction. If fewer than the required number of parties participate, no information should be leaked about the secret.

Filter by
Sorted by
Tagged with
1
vote
0answers
51 views

Preserving location privacy

What are cryptographic techniques that could be used so that if I wanna to enable a server to send message to certain nodes in a network with preserving the privacy location for them ??
1
vote
1answer
81 views

Eliptic curve verifiable secret sharing

I am implementing the following the algorithm instructions as shown in 1 (section IV, B). When trying to verify the share given the commits, $a_jG$ verifier $i$ checks whether $f(i)G=\sum_{j=0}^{t} (...
1
vote
1answer
632 views

AES encryption using MPC SPDZ protocol

I'm reading the article about SPDZ protocol for secure multiparty computation (and also improvements for offline phase like MASCOT). However I'm thinking about practical application of SPDZ for AES ...
1
vote
1answer
616 views

Reverse Shamir's Secret Sharing Algorithm?

Shamir's Secret Sharing algorithm works by breaking a single secret to multiple parts. While it is trivial to implement the reverse in a $n$-out-of-$n$ scheme, how would one implement an $m$-out-of-$n$...
5
votes
1answer
157 views

A problem in secret sharing and mixed operators over $\mathbb{Z}$

Recently, I studied an article in which it was written that having $(A-B)\oplus C$ and $B\oplus C$, we cannot find $A$. The authors used this result to build a secret sharing scheme, but they did not ...
5
votes
2answers
196 views

$t$-out-of-$n$ Secret Sharing over $\Bbb Z_2$?

Is it possible to construct a $t$-out-of-$n$ secret sharing scheme over $\Bbb Z_2$? Shamir Secret Sharing allows for an arbitrary threshold $t$ and an arbitrary number of participants $n$, but ...
1
vote
1answer
131 views

Number of possible access structure with $n$ person

I want to count number of possible access structures in closed form(if possible) as a variable of $n$,the number of share holder. I have tried in several ways. Still no good progress. It is very hard ...
10
votes
2answers
1k views

Shared secret: Generating Random Permutation

-- or: How to Play Poker Without a Dealer I know this question is long but it's a really interesting theoretical problem about shared secrets and multi-party computation. General Problem: "Shared ...
1
vote
0answers
263 views

Shamir's Secret Sharing - Proactive and dealer-free [duplicate]

I recently started studying about cryptography and I tried to search the internet but I can't find much about these subjects. I want to see the proof of Shamir's Secret Sharing being Proactive and ...
1
vote
1answer
644 views

Two rounds of SHA-256 HMAC?

In a project we are working on, we have two applications within our datacenter that exchange messages. The messages are protected by an HMAC, and the secret key is stored on a SafeNet device. Update ...
12
votes
2answers
846 views

How can we distribute Shamir's secret sharing scheme shares without a dealer?

Let's say $k$ users have shares to a $(k,n)$ secret sharing scheme, and they want to issue new shares. How can they do this without collecting the shares together? In particular, no set of $k-1$ ...
2
votes
2answers
106 views

Multiparty secret generation protocol

The goal is to create a secret S on a trusted server by having users A, B and C each send a private seed to the server, in such a way that any 2 of them can later recover S by resubmitting their ...
2
votes
4answers
735 views

Requiring a "supervisor" key pair and a "user" key pair to decrypt multiple-recipient messages

I've been toying with some encryption scenarios recently. One of the hard ones I came across is a multi-party system. So we have Bob -- The person who sends the message (and knows it's recipients) ...
1
vote
1answer
181 views

Minimal size of share in Shamir's Sharing Scheme

Why does the combined shared key in Adi Shamir's Sharing Scheme have to be smaller or equal than each secret share?
1
vote
1answer
226 views

Interpolation in the Exponent (Shamir Shared PRF)

Trying to implement the Diffie-Hellman distributed PRF mentioned by Cachin : https://cachin.com/cc/papers/abba.pdf. It makes sense to me... just use the same Lagrange coefficient I'm using to combine ...
0
votes
1answer
65 views

Enforcing Randomness in Malicious Setting

I was going through some lecture notes where it said that if we have a 2-party protocol that requires both the parties to generate random integers during the course of protocol, then if we migrate the ...
4
votes
3answers
1k views

Distributed Shamir's secret sharing

Wikipedia on its page for Shamir's secret sharing scheme provides a python implementation that applies the idea. This algorithm will generate a (k, n) threshold scheme so for example we could split a ...
2
votes
0answers
318 views

Threshold signatures vs. certificate authority+voting verification

Perhaps a silly question, but I am wondering what the advantages are of threshold signatures. Let's consider the following two signature schemes: $(t,n)$-threshold signature with a trusted dealer, i....
2
votes
1answer
188 views

Baek and Zheng’s Threshold Cryptosystem - limit on threshold?

I have just completed an implementation of Simple and Efficient Threshold Cryptosystem from the Gap Diffie-Hellman Group by Baek and Zheng and am hitting a problem with high values of the threshold. ...
2
votes
0answers
113 views

Optimized Random-OT Security in Standard Model

I was going through the paper - " Efficient Oblivious Transfer and Extensions for Faster Secure Computation" by Asharov et al. where the authors propose an optimized OT protocol along with a Random-OT ...
2
votes
1answer
121 views

Secure scheme to share symmetric key using asymmetric keys and certificates with N parties

I need to distribute symmetric AES key into number of end points which will use it to decrypt data. The AES key will be the same on all end points, it is not possible to generate unique on every end ...
5
votes
1answer
169 views

Can Secure Multi-party Computation be used to reconstruct secret shares?

When using Shamir's Secret Sharing is it possible to use Secure Multi-Party Computation to reconstruct the original secret without revealing one's secret share? When searching I have found results ...
2
votes
0answers
40 views

Threshold signature without revealing id of signers to the recombiner

I want a threshold signature t out of n algorithm where set of t signers are not known before hand and want to remain anonymous after signing. How is recombination possible if id of signer is not ...
3
votes
1answer
320 views

Does adding a random number to my data make it secure?

Say I have some real valued data that i want to keep secure. Now I have to pass on some modified version of the data to a second party for some computation, but i do not wish to reveal my data to the ...
4
votes
1answer
784 views

Combining multiple cryptographic keys to generate an encryption key

We have a system that has several SecretKeys (for example, one for a user, and one for us). We want to encrypt data in a way that requires all of those keys to be available in order to decrypt. I ...
2
votes
2answers
71 views

Can I prove my app uses randomness right way?

We are developing an iOS app which employs Shamir Secret Sharing algorithm. We made all possible steps users can trust us. We can't remember their secrets nor we can save encoded fragments. But they ...
-4
votes
1answer
102 views

How to reversely compute from hash [closed]

What are practical methodologies to derive the following ciphertext: 1bd0d370b262d748b21c40cc7e5746642b4c06079a224c65e443e429289753c2
1
vote
1answer
85 views

Conditional $k,n$ secret sharing

I would like to know if there is a way to place a condition on $k$-out-of-$n$ secret sharing such that out of $k$ participants who can pool their shares to reconstruct a secret, one of them should ...
1
vote
0answers
411 views

Additive homomorphic secret sharing

I am new to cryptography esp, homomorphic encryption. I would like to know if the following is possible using something similiar to additive homomorphic secret sharing. Please apologize me if its too ...
7
votes
2answers
938 views

post-quantum threshold secret sharing

I am looking for a references for post-quantum threshold secret sharing schemes. I am especially interested in knowing whether any one based on one-way compressor functions or cryptographic hashes ...
1
vote
0answers
148 views

What SMPC protocols make use only of additive secret sharing?

In Appendix G of the Hawk paper, where it talks about financially fair SFE, it mentions that it's possible to run a SMPC protocol where, at the end, each party has a share of their own output y, and a ...
2
votes
1answer
105 views

Tampering with Shamir's subshares

Suppose a set of Shamir's redistributable-secret-sharing participants issue a redistribution of subshares. I envision this as a series of points on a line (2 of N, is planar, easy to think about). ...
1
vote
1answer
119 views

Shamir's Secret Sharing - Impersonating the Dealer

I understand that Shamir's Secret sharing has nothing to do with the methods that are used to share and later recover a key. That means then, the secret is only as secure as the methods used in ...
-3
votes
1answer
159 views

Shamir's Secret Sharing Computation time

Hello for my thesis I am making research about SSS computational time. Based on (K,N) threshold scheme Where K is the minimum number of shares to rebuild the secret and N is the number of shares ...
7
votes
4answers
1k views

Shamir's Secret Sharing vs. Asmuth-Bloom scheme

I need to make use of a secret sharing scheme and I don't really know how to decide which one to use, Shamir's or Asmuth-Bloom (using CRT). The complexity for recovering the secret seems to be linear ...
0
votes
1answer
60 views

security of multiplicative secret sharing

I was having a read of this question: "Is multiplicative secret sharing secure?" posted in 2013 which asks if the simple multiplicative scheme is secure. Everyone agreed that it was information ...
1
vote
3answers
345 views

Combining Shamir's schemes

I am learning about Shamir's secret sharing scheme and I've come across this problem: Let's suppose we have a combination of a (3, 6) and (1, 2) Shamir's schemes, where participants $P_1$ and $P_2$ ...
0
votes
2answers
140 views

Is it generally considered acceptable for app owners to be able to retrieve private keys from users when their apps offer end-to-end encryption?

E2EE promises that data sending between two endpoints can be decrypted by only those two endpoints. If an app offers E2EE but still has functions to retrieve private keys from users for any purposes ...
2
votes
1answer
87 views

Creating a share of a random shared secret [duplicate]

I am interested to know if there is a solution to the following scenario: Assuming we have $n$ party members, is there a scheme that at the end of it, every party member $i$, holds a shamir's ...
2
votes
0answers
89 views

Are there any information-theoretically secure verifiable secret sharing protocols with t=n?

Disregarding matters such as efficiency and round complexity, can verifiable secret sharing be done in a way such that the secret cannot be decoded unless you have all n shares, and that this ...
0
votes
1answer
540 views

ECIES: key derivation function and symmetric encryption scheme

I am using an elliptic curve library which provided me with a shared secret using my secret key and a foreign public key. Unfortunately an ECIES is not available in the programming language. I would ...
0
votes
1answer
143 views

How can I prove that it is impossible to find a cheater in shamir secret sharing?

Three participants Quadratic polynomial, one cheater. The Cheater discloses a false (x,y) pair I need to prove that any one of the truth-telling participants can't tell which of the others is the liar....
6
votes
2answers
788 views

Determining the Shamir's secret sharing scheme for the following problem

I'm having trouble solving the Shamir's Secret Sharing scheme for the following problem that states: Problem: A certain military office, which is in control of a powerful missile, consists of six ...
3
votes
2answers
480 views

Undetectable cheater in Shamir's Secret Sharing scheme

Consider Shamir's Secret Sharing scheme with $n=5, t=3$ (i.e, there are 5 shares, and when we have 3 of them we can reconstruct our secret $s$). Let $f(x)$ be the dealing function, i.e the secret $s$ ...
3
votes
1answer
265 views

Prove that shares can reveal a seceret key. in a secret sharing scheme

I am trying to build a cryptographic system that has several components and ran into a problem with a secret sharing scheme. Let $v$ be a value we are interested committing to. I generate a ...
4
votes
1answer
293 views

secret sharing with 3 parties under constraint

Suppose we have $3$ parties Alice, Bob and Charlie such that Alice can't talk with Bob. Suppose that Alice has some string $x\in\{0,1\}^n$ and Bob has a string $y\in\{0,1\}^n$. Suppose that Alice ...
4
votes
2answers
6k views

What are the weaknesses of Shamir's Secret Sharing?

We just learned about this in school but i don't quite get the weakness of this method. If we let's say have used a 64-bit secret key to encrypt a file and then we split the key into 2 pieces of 32-...
1
vote
2answers
848 views

Multisignature or Multi-password File

I want to create a file that I could give to 3 trusted friends, and allow any two of them to decrypt it when together (or in sequence when not physically in the same place). This is similar to a ...
3
votes
1answer
84 views

Is there a cryptographic scheme that allows joint encryption using a shared secret?

I'm looking for a type of algorithm that could be used to encrypt text with a shared secret $S$. What I would like to have is the secret to be broken up in three pieces, where any combination of two ...
2
votes
1answer
347 views

Secure multiparty sum computation corruption bound

In Section 3.4 of the book Secure Multiparty Computation and Secret Sharing, it is claimed that for a secure multiparty computation problem with $n$ parties, the optimal corruption bound (concerning ...

1
3 4
5
6 7
9