Questions tagged [secret-sharing]
Secret sharing refers to splitting a secret among multiple parties so that together they can reconstruct it. All parties, or just a threshold number of them, can be required for reconstruction. If fewer than the required number of parties participate, no information should be leaked about the secret.
337
questions
2
votes
0answers
116 views
How does threshold decryption with secretly shared exponents actually work?
Imagine the case where you have a sufficiently large finite field (or any multiplicative field for that matter) $\mathbb{Z}_{p}$ where p is some large prime.
Now, I have a number $g \in \mathbb{Z}_{p}...
1
vote
1answer
129 views
FHMQV-C \sigma calculation - Full Dual Exponential Challenge Response (FDCR) signature schemes-
I'm studying the protocol FHMQV - C but I don't understand how two honest parties can reach the same value of $\sigma$. The paper that I'm studying is: https://eprint.iacr.org/2009/408.pdf. If you ...
1
vote
0answers
246 views
Shamir's Secret Sharing - Proactive and dealer-free [duplicate]
I recently started studying about cryptography and I tried to search the internet but I can't find much about these subjects. I want to see the proof of Shamir's Secret Sharing being Proactive and ...
5
votes
0answers
189 views
Share Conversion between Different Finite Fields
Let us have any linear secret sharing scheme (LSSS) that works on some field $Z_{p}$, where p is some prime or a power of a prime e.g., Shamir Secret Sharing, Additive secret Sharing.
The problem at ...
4
votes
1answer
431 views
Linear secret-sharing scheme for four players
I got stuck on this question during my exam revision.
Consider the linear secret-sharing scheme for four players $P_1, P_2, P_3$ and $P_4$ based on the matrix
$$
M=
\begin{bmatrix}
1 & 0 &...
4
votes
1answer
207 views
Does Shamir Secret Sharing provide integrity?
Shamir secret sharing splits into t number of shares with a t-threshold. However, I can find no information online if this scheme provide integrity (or authentication for that matter, which I assume ...
1
vote
0answers
179 views
Threshold encryption with threshold on encryption part
For a thought experiment I'm looking for a threshold encryption scheme where $k$ out of $n$ shares are needed to encrypt the data and everybody can decrypt the data. However, I only found schemes ...
1
vote
2answers
204 views
Distributing shares in a particular monotone access structure
Consider 6 people, $A,B,C,D,E,F$ and a secret. Construct a scheme which enables the following subsets of people to retrieve the secret:
three players from the set $\{A,B,C,D\}$
two players from the ...
4
votes
0answers
111 views
Privacy of Multiplication of Shamir Shared Secrets with an Active Adversary Where Final Result is Revealed to a Third Party Over a Secure Channel
I have the following question related to the privacy of multiplication of Shamir Shared Secrets:
Suppose we have two secrets, a and b, shared by a Shamir Secret Sharing Scheme in a (k,n) ...
2
votes
2answers
217 views
Secret Sharing Scheme with variable share size?
Is there a secret sharing scheme construction that allows the shares to have different sizes/lengths?
For example a (3,3) scheme, where shares 1 and 2 have large sizes while share 3 has a very small ...
4
votes
1answer
147 views
Can data stay encrypted unless I'm eliminated?
I work as a spy for a top secret and ruthless government organisation with a three letter acronym. I know all their dirty secrets and where the skeletons are literally buried. In order to protect ...
1
vote
1answer
112 views
What is definition of adversary ? And what they do?
Currently I am writing my last assignment about secret sharing. But I don't get clearly about adversary. I know this seems so basic understanding in secret sharing. But I couldn't get references that ...
5
votes
0answers
39 views
How to create a shared secret S from a subset of existing secrets n, such that k out of n secrets can recreate S? [duplicate]
In traditional secret sharing schemes, like Shamir's Secret Sharing, first a secret S is generated. Then it is divided into n parts, such that a subset k of the n parts are sufficient to reconstruct S....
3
votes
2answers
199 views
Randomizing before Shamir secret sharing?
As I understand, the security of key-sharing depends on the cleartext actually being random.
If I split a secret which contains things like ASCII or even fixed strings (think -----BEGIN PGP PRIVATE ...
3
votes
1answer
136 views
How to generate a permutation of n numbers using secret sharing scheme?
Consider $n$ parties having their private inputs $s_1,\cdots,s_n$. How can they compute a public function $f(s_1,\cdots,s_n)= \pi$, where $\pi$ is a permutation of numbers between $1,\cdots,n$, using ...
6
votes
1answer
86 views
Is there a studied notion of “party independent transfer”?
I've been thinking about the following set-up involving three parties, Alice, Bob and Charlie:
Bob and Charlie decide among themselves who is going to receive a bit from Alice (perhaps by a coin toss)...
6
votes
1answer
177 views
Secret Sharing: Is this simplification secure?
I am a mathematician with no background in crypto or security. For work, I had to read up Chap.13 "Secret Sharing Schemes" in Stinson's Cryptography (3rd ed). My question is about a simplification of ...
8
votes
2answers
5k views
Reverse engineering secret key in RSA encryption with the help of signature
Consider the following:
$i$th message, $m_i$, in its original state.
$i$th message, $M_i$, encrypted message $m_i$ using public key.
Public key, $p$, in a $b$-bit RSA encryption setup. We can ...
4
votes
1answer
784 views
Security difference(s) between Shamir's Secret Sharing Scheme and Blakley's Secret Sharing Scheme?
We know that Blakley's scheme is less space-efficient than Shamir's and that they both work based on pretty different aspects (Shamir = polynomial-based; Blakley = hyperplane-based).
Looking at how ...
0
votes
1answer
202 views
Private Information Retrieval with no server computations
Is there any way to perform Private Information Retrieval when no computations can be executed on the server-side?
I would like to perform the computations on the client, and without having to ...
5
votes
1answer
242 views
Malicious Model and Arbitrary selecting inputs on MPC and PSI
Imagine the following setting: a party considers a secret sharing or multiparty protocol that is secure against semi-honest adversaries. The adversary selectively chooses the inputs such that it could ...
4
votes
1answer
357 views
Proactive secret sharing security flaws
I read a Shamir secret sharing notes where it mentioned the security flaws of PSS(Proactive Security Sharing) when only one server is responsible for generating $h(x)$.
To give the question a bit ...
3
votes
1answer
301 views
Secret sharing between a very large number of participants
What can be a method for sharing a secret between a large number of participants?
With Shamir's Secret Sharing (k,n), n can be arbitrarily large, but increasing k increases the complexity of the keys ...
0
votes
1answer
131 views
Unleakable shared secret under realistic assumptions?
Can two devices share a common secret in a way that an adversary who compromises one of the two devices after deployment is unable to reconstruct the shared secret, under the following assumptions:
...
1
vote
3answers
148 views
Require x of y possible passwords to decrypt
Is there a way to set up encryption so that a certian number (x) out of a total (y) number of users/passwords are required to do the decryption?
Background: This is mostly a thought experiment, and ...
0
votes
1answer
86 views
Generating two secret keys from a physical analog signal: Crypto HASH analogous to time varying signal
Can we generate two secret keys from same source?
The idea is we have time varying signal. We capture a window of say few milliseconds,$t$. I can chop values of signals at a rate $N_S$ and get $tN_S/...
15
votes
4answers
5k views
Why is Shamir Secret Sharing not secure against active adversaries out-of-the-box?
This linear secret sharing scheme allows us to share a secret between n parties, such that only an honest majority can reconstruct it.
I understand that – because I do not allow the user to certify ...
5
votes
1answer
1k views
What are the ways to generate Beaver triples for multiplication gate?
So to speed up the function evaluation we use beaver trick, to generate raw data in the offline phase and use them in the online phase to get the output share for the multiplication gate. So what are ...
2
votes
1answer
114 views
Having access to multiple servers, would additional usage of “Secret Sharing” for password storage enhance security?
I am currently learning about secret sharing and I’ve started wondering why larger companies that have access to whole server networks (like – for example – Google, Facebook, etc.) don't use “Secret ...
2
votes
1answer
97 views
Is there an algorithm to derive a 1-of-N shared secret from a set of N private keys?
This is different from Shamir's Secret Sharing in that we are starting with the keys and deriving a shared secret, rather than the other way around.
Let me be more precise:
We are given keys $k_1, \...
1
vote
2answers
119 views
Is gfcombinefs - a filesystem for n-of-m Shamir secret sharing - fundamentally read-only?
With a view on using a tool similar to fgcombinefs in cloud situations, I would need a writable n-of-m Shamir secret sharing filesystem.
As a matter of routine security, I do not want the cloud ...
5
votes
2answers
369 views
SPDZ for the 2-party case
There exist protocols for 2-party computation e.g., GMW that use Boolean circuits. I could also use Paillier and arithmetic circuits for a 2 party computation. However after reading about SPDZ is my ...
5
votes
1answer
417 views
Implementing Secure multi-party computation for online website
I need to know if the following is feasible:
I want that any two users of my website have a private key such that the private key is divided into three parts one for website owner and one each for the ...
3
votes
1answer
90 views
Is this a novel secret splitting method, or a different view of an existing one?
I did try this on Information Security, but they were happier to see it moved here. The crypto content is quite low. It's more about secret storage and robust recovery of information, for instance ...
5
votes
2answers
1k views
Shamir's Secret Sharing Scheme - prime security?
Does the prime (which needs to be larger than the message) have to be chosen randomly for security, or can it just be a huge constant?
Also, the Wikipedia article for SSSS states
The size of each ...
5
votes
1answer
637 views
Secret Sharing and Multiplication Triples
I do not understand the multiplication technique using triples and secret shares of the inputs. Could somebody explain me where I'm wrong?
It works like this:
The inputs are secret shared in XOR ...
1
vote
1answer
590 views
Shamir Secret Sharing GF(p) or GF(2^8)
I'm implementing Shamir's Secret Sharing Scheme, but I've hit a conceptual roadblock. In Shamir's paper "How To Share A Secret" he creates his shares an a finite field of order p, where p is some ...
11
votes
2answers
487 views
How can we distribute Shamir's secret sharing scheme shares without a dealer?
Let's say $k$ users have shares to a $(k,n)$ secret sharing scheme, and they want to issue new shares. How can they do this without collecting the shares together?
In particular, no set of $k-1$ ...
3
votes
0answers
242 views
Could the multisignature scheme in bitcoin alternatively also be implemented by means of a Shamir Secret Sharing Scheme?
When I first came across the Bitcoin multisignature scheme, I wondered that it remarkably looked similar to what Shamir Secret Sharing does (SSS), but then by using facilities in the bitcoin scripting ...
2
votes
1answer
328 views
Dividing a secret into multiple nodes in a blockchain kind of system with time-release?
I would like to have these features and want to ask if it is theoretically possible:
a) There is custom software running on nodes in a blockchain style
b) A secret is kept in the blockchain that ...
1
vote
2answers
102 views
Proving that you have $k$ keys out of $n$ without revealing which keys they are
I'm looking for a cryptographic algorithm where Alice can prove that she has at least $k$ private keys out of $n$ to Bob, without revealing which keys she knows.
2
votes
2answers
713 views
Secret sharing scheme with ability to add or update share number
I would like to have a secret sharing scheme with the following properties:
Generate secret $S$ a split it to $N$ shares $(s_1, s_2, ..., s_N)$
Require $k$ of $N$ shares in order to reconstruct ...
0
votes
1answer
78 views
Multiplicative sharing of 1
Let R be a ring.
Is there a known/standard way for N parties to perform some exchanges, such that at the end each party holds an element $r_i\in R^\ast$ and $r_1r_2\dots r_N=1$ (and each party $i$ ...
-2
votes
1answer
145 views
In Shamir's (t, n) secret sharing scheme why don't use infinite field? [duplicate]
Well, we use finite fields to select shares. What happened if we use infinite fields.then will the scheme be vulnerable? Easy to break? Or share generation and reconstruction will be difficult?
...
1
vote
1answer
59 views
Some terms related to secret sharing: Optimality, What does it mean?
In any secret sharing scheme we have to develop step by step.
After constructing such scheme we need to reduce share size. Why?
e.g. Robust secret sharing scheme is modified Shamir secret sharing ...
1
vote
0answers
82 views
How share size is reduced in robust secret sharing?
THIS IS ROBUST SECRET SHARING SCHEME
The dealer $\mathcal{D}$ wants to share a secret among the participants $\{P_1, P_2, \ldots, P_n\}$, where at most $t$ participants are malicious and $t<n/2$.
...
4
votes
1answer
56 views
How to distributively compute a secret of that form $\mathsf{s=sk\cdot g^a}$?
Is there a standard way to distributively compute secrets shares such that any $t+1$ combination out of $n$ of them constructs the secret $\mathsf{s=sk\cdot g^a}$, for a generator $\mathsf{g} \in \...
4
votes
1answer
170 views
Multiplying two additively shared values
Alice has $p_a,q_a$ and Bob has $p_b,q_b$, all elements of a ring $R$.
They want to obtain shares of the value $pq$ where $p=p_a+p_b$, $q=q_a+q_b$. How do they do this ? Does revealing their shares of ...
2
votes
1answer
69 views
Does revealing shares of the result reveals shares of the inputs?
Suppose Alive and Bob have shares of two polynomials $P,Q$, say, Alice knows $P_A,Q_A$, Bob knows $P_B,Q_B$ s.t. $P=P_A+P_B$ and $Q=Q_A+Q_B$. They perform some operation $f$ over the shared values, to ...
5
votes
1answer
797 views
Why only one secret value with Shamir's secret sharing? [duplicate]
Shamir's Secret Sharing works by sharing data points on a curve, whereby when you have the required number of data points, you can find the function of the curve and find out the secret, which is ...
