Questions tagged [secret-sharing]
Secret sharing refers to splitting a secret among multiple parties so that together they can reconstruct it. All parties, or just a threshold number of them, can be required for reconstruction. If fewer than the required number of parties participate, no information should be leaked about the secret.
345
questions
1
vote
1answer
114 views
Corruption bound of MPC when n>2
In the book titled "Secure Multiparty Computation and Secret Sharing" stated that MPC protocol is not secure when the adversary $t>n/2$. This was proved by using a 2 party protocol, but I can't ...
1
vote
1answer
237 views
Is creating an OTP of a key to some data a secure secret sharing scheme?
Suppose I have some data that has been encrypted with a known, secure algorithm and a key k. I want to distribute "pieces" of the key to n of my colleagues, and only be able to access the data when ...
1
vote
1answer
421 views
Is encrypting a secret key and being able to decrypt plain text with it possible?
Please forgive me if this is a basic question, I'm in high school so I still don't understand very much.
Let's say there are two servers, each with a set of public and private keys. These denote ...
4
votes
1answer
397 views
Shamir Secret Sharing - P not prime
I was wondering what will happen if I use the Shamir Secret Sharing scheme with $P$ not being a prime, let's say it is $255$. An adversary which holds $k'$ shares ($k'<$ threshold $k$ ) can attack ...
5
votes
1answer
124 views
Secret sharing where the combination of shares matters
In Shamir's secret sharing scheme, any combination of shares (that pass the threshold) will result in the secret being revealed. Is it possible to have a system where some combinations are invalid?
...
3
votes
1answer
242 views
Shamir secret sharing with two types of parties
Consider the Shamir Secret Sharing scheme based on polynomial interpolation.
In this scheme, every part has the same right: one piece of information of same value as the other ones.
The idea is to ...
3
votes
2answers
237 views
Shamir Secret Sharing data limitations per share?
Do “Shamir Secret Sharing” schemes have a limitation for the amount of data that can be split up between each share, or a maximum number of data that can be shared within one secret?
I believe there ...
2
votes
1answer
118 views
Are Lagrange Multipliers necessary for Shamir's secret sharing?
What is the implication of not using the Lagrange multipliers in Shamir's secret sharing?
I mean each update will be $Poly(x_i) \bmod p$ where $p$ is a prime number instead of the original one that ...
2
votes
0answers
121 views
How does threshold decryption with secretly shared exponents actually work?
Imagine the case where you have a sufficiently large finite field (or any multiplicative field for that matter) $\mathbb{Z}_{p}$ where p is some large prime.
Now, I have a number $g \in \mathbb{Z}_{p}...
1
vote
1answer
130 views
FHMQV-C \sigma calculation - Full Dual Exponential Challenge Response (FDCR) signature schemes-
I'm studying the protocol FHMQV - C but I don't understand how two honest parties can reach the same value of $\sigma$. The paper that I'm studying is: https://eprint.iacr.org/2009/408.pdf. If you ...
1
vote
0answers
246 views
Shamir's Secret Sharing - Proactive and dealer-free [duplicate]
I recently started studying about cryptography and I tried to search the internet but I can't find much about these subjects. I want to see the proof of Shamir's Secret Sharing being Proactive and ...
6
votes
0answers
200 views
Share Conversion between Different Finite Fields
Let us have any linear secret sharing scheme (LSSS) that works on some field $Z_{p}$, where p is some prime or a power of a prime e.g., Shamir Secret Sharing, Additive secret Sharing.
The problem at ...
4
votes
1answer
478 views
Linear secret-sharing scheme for four players
I got stuck on this question during my exam revision.
Consider the linear secret-sharing scheme for four players $P_1, P_2, P_3$ and $P_4$ based on the matrix
$$
M=
\begin{bmatrix}
1 & 0 &...
4
votes
1answer
210 views
Does Shamir Secret Sharing provide integrity?
Shamir secret sharing splits into t number of shares with a t-threshold. However, I can find no information online if this scheme provide integrity (or authentication for that matter, which I assume ...
1
vote
0answers
188 views
Threshold encryption with threshold on encryption part
For a thought experiment I'm looking for a threshold encryption scheme where $k$ out of $n$ shares are needed to encrypt the data and everybody can decrypt the data. However, I only found schemes ...
1
vote
2answers
209 views
Distributing shares in a particular monotone access structure
Consider 6 people, $A,B,C,D,E,F$ and a secret. Construct a scheme which enables the following subsets of people to retrieve the secret:
three players from the set $\{A,B,C,D\}$
two players from the ...
4
votes
0answers
113 views
Privacy of Multiplication of Shamir Shared Secrets with an Active Adversary Where Final Result is Revealed to a Third Party Over a Secure Channel
I have the following question related to the privacy of multiplication of Shamir Shared Secrets:
Suppose we have two secrets, a and b, shared by a Shamir Secret Sharing Scheme in a (k,n) ...
2
votes
2answers
217 views
Secret Sharing Scheme with variable share size?
Is there a secret sharing scheme construction that allows the shares to have different sizes/lengths?
For example a (3,3) scheme, where shares 1 and 2 have large sizes while share 3 has a very small ...
4
votes
1answer
148 views
Can data stay encrypted unless I'm eliminated?
I work as a spy for a top secret and ruthless government organisation with a three letter acronym. I know all their dirty secrets and where the skeletons are literally buried. In order to protect ...
1
vote
1answer
116 views
What is definition of adversary ? And what they do?
Currently I am writing my last assignment about secret sharing. But I don't get clearly about adversary. I know this seems so basic understanding in secret sharing. But I couldn't get references that ...
5
votes
0answers
39 views
How to create a shared secret S from a subset of existing secrets n, such that k out of n secrets can recreate S? [duplicate]
In traditional secret sharing schemes, like Shamir's Secret Sharing, first a secret S is generated. Then it is divided into n parts, such that a subset k of the n parts are sufficient to reconstruct S....
3
votes
2answers
201 views
Randomizing before Shamir secret sharing?
As I understand, the security of key-sharing depends on the cleartext actually being random.
If I split a secret which contains things like ASCII or even fixed strings (think -----BEGIN PGP PRIVATE ...
3
votes
1answer
146 views
How to generate a permutation of n numbers using secret sharing scheme?
Consider $n$ parties having their private inputs $s_1,\cdots,s_n$. How can they compute a public function $f(s_1,\cdots,s_n)= \pi$, where $\pi$ is a permutation of numbers between $1,\cdots,n$, using ...
6
votes
1answer
87 views
Is there a studied notion of “party independent transfer”?
I've been thinking about the following set-up involving three parties, Alice, Bob and Charlie:
Bob and Charlie decide among themselves who is going to receive a bit from Alice (perhaps by a coin toss)...
6
votes
1answer
181 views
Secret Sharing: Is this simplification secure?
I am a mathematician with no background in crypto or security. For work, I had to read up Chap.13 "Secret Sharing Schemes" in Stinson's Cryptography (3rd ed). My question is about a simplification of ...
8
votes
2answers
5k views
Reverse engineering secret key in RSA encryption with the help of signature
Consider the following:
$i$th message, $m_i$, in its original state.
$i$th message, $M_i$, encrypted message $m_i$ using public key.
Public key, $p$, in a $b$-bit RSA encryption setup. We can ...
4
votes
1answer
804 views
Security difference(s) between Shamir's Secret Sharing Scheme and Blakley's Secret Sharing Scheme?
We know that Blakley's scheme is less space-efficient than Shamir's and that they both work based on pretty different aspects (Shamir = polynomial-based; Blakley = hyperplane-based).
Looking at how ...
0
votes
1answer
205 views
Private Information Retrieval with no server computations
Is there any way to perform Private Information Retrieval when no computations can be executed on the server-side?
I would like to perform the computations on the client, and without having to ...
5
votes
1answer
247 views
Malicious Model and Arbitrary selecting inputs on MPC and PSI
Imagine the following setting: a party considers a secret sharing or multiparty protocol that is secure against semi-honest adversaries. The adversary selectively chooses the inputs such that it could ...
4
votes
1answer
359 views
Proactive secret sharing security flaws
I read a Shamir secret sharing notes where it mentioned the security flaws of PSS(Proactive Security Sharing) when only one server is responsible for generating $h(x)$.
To give the question a bit ...
3
votes
1answer
303 views
Secret sharing between a very large number of participants
What can be a method for sharing a secret between a large number of participants?
With Shamir's Secret Sharing (k,n), n can be arbitrarily large, but increasing k increases the complexity of the keys ...
0
votes
1answer
134 views
Unleakable shared secret under realistic assumptions?
Can two devices share a common secret in a way that an adversary who compromises one of the two devices after deployment is unable to reconstruct the shared secret, under the following assumptions:
...
1
vote
3answers
157 views
Require x of y possible passwords to decrypt
Is there a way to set up encryption so that a certian number (x) out of a total (y) number of users/passwords are required to do the decryption?
Background: This is mostly a thought experiment, and ...
0
votes
1answer
86 views
Generating two secret keys from a physical analog signal: Crypto HASH analogous to time varying signal
Can we generate two secret keys from same source?
The idea is we have time varying signal. We capture a window of say few milliseconds,$t$. I can chop values of signals at a rate $N_S$ and get $tN_S/...
15
votes
4answers
5k views
Why is Shamir Secret Sharing not secure against active adversaries out-of-the-box?
This linear secret sharing scheme allows us to share a secret between n parties, such that only an honest majority can reconstruct it.
I understand that – because I do not allow the user to certify ...
5
votes
1answer
1k views
What are the ways to generate Beaver triples for multiplication gate?
So to speed up the function evaluation we use beaver trick, to generate raw data in the offline phase and use them in the online phase to get the output share for the multiplication gate. So what are ...
2
votes
1answer
117 views
Having access to multiple servers, would additional usage of “Secret Sharing” for password storage enhance security?
I am currently learning about secret sharing and I’ve started wondering why larger companies that have access to whole server networks (like – for example – Google, Facebook, etc.) don't use “Secret ...
2
votes
1answer
99 views
Is there an algorithm to derive a 1-of-N shared secret from a set of N private keys?
This is different from Shamir's Secret Sharing in that we are starting with the keys and deriving a shared secret, rather than the other way around.
Let me be more precise:
We are given keys $k_1, \...
1
vote
2answers
121 views
Is gfcombinefs - a filesystem for n-of-m Shamir secret sharing - fundamentally read-only?
With a view on using a tool similar to fgcombinefs in cloud situations, I would need a writable n-of-m Shamir secret sharing filesystem.
As a matter of routine security, I do not want the cloud ...
5
votes
2answers
384 views
SPDZ for the 2-party case
There exist protocols for 2-party computation e.g., GMW that use Boolean circuits. I could also use Paillier and arithmetic circuits for a 2 party computation. However after reading about SPDZ is my ...
5
votes
1answer
436 views
Implementing Secure multi-party computation for online website
I need to know if the following is feasible:
I want that any two users of my website have a private key such that the private key is divided into three parts one for website owner and one each for the ...
3
votes
1answer
91 views
Is this a novel secret splitting method, or a different view of an existing one?
I did try this on Information Security, but they were happier to see it moved here. The crypto content is quite low. It's more about secret storage and robust recovery of information, for instance ...
5
votes
2answers
1k views
Shamir's Secret Sharing Scheme - prime security?
Does the prime (which needs to be larger than the message) have to be chosen randomly for security, or can it just be a huge constant?
Also, the Wikipedia article for SSSS states
The size of each ...
5
votes
1answer
673 views
Secret Sharing and Multiplication Triples
I do not understand the multiplication technique using triples and secret shares of the inputs. Could somebody explain me where I'm wrong?
It works like this:
The inputs are secret shared in XOR ...
1
vote
1answer
611 views
Shamir Secret Sharing GF(p) or GF(2^8)
I'm implementing Shamir's Secret Sharing Scheme, but I've hit a conceptual roadblock. In Shamir's paper "How To Share A Secret" he creates his shares an a finite field of order p, where p is some ...
11
votes
2answers
512 views
How can we distribute Shamir's secret sharing scheme shares without a dealer?
Let's say $k$ users have shares to a $(k,n)$ secret sharing scheme, and they want to issue new shares. How can they do this without collecting the shares together?
In particular, no set of $k-1$ ...
3
votes
0answers
242 views
Could the multisignature scheme in bitcoin alternatively also be implemented by means of a Shamir Secret Sharing Scheme?
When I first came across the Bitcoin multisignature scheme, I wondered that it remarkably looked similar to what Shamir Secret Sharing does (SSS), but then by using facilities in the bitcoin scripting ...
2
votes
1answer
329 views
Dividing a secret into multiple nodes in a blockchain kind of system with time-release?
I would like to have these features and want to ask if it is theoretically possible:
a) There is custom software running on nodes in a blockchain style
b) A secret is kept in the blockchain that ...
1
vote
2answers
102 views
Proving that you have $k$ keys out of $n$ without revealing which keys they are
I'm looking for a cryptographic algorithm where Alice can prove that she has at least $k$ private keys out of $n$ to Bob, without revealing which keys she knows.
2
votes
2answers
749 views
Secret sharing scheme with ability to add or update share number
I would like to have a secret sharing scheme with the following properties:
Generate secret $S$ a split it to $N$ shares $(s_1, s_2, ..., s_N)$
Require $k$ of $N$ shares in order to reconstruct ...
