Questions tagged [secret-sharing]

Secret sharing refers to splitting a secret among multiple parties so that together they can reconstruct it. All parties, or just a threshold number of them, can be required for reconstruction. If fewer than the required number of parties participate, no information should be leaked about the secret.

Filter by
Sorted by
Tagged with
1
vote
0answers
217 views

Threshold encryption with threshold on encryption part

For a thought experiment I'm looking for a threshold encryption scheme where $k$ out of $n$ shares are needed to encrypt the data and everybody can decrypt the data. However, I only found schemes ...
1
vote
2answers
218 views

Distributing shares in a particular monotone access structure

Consider 6 people, $A,B,C,D,E,F$ and a secret. Construct a scheme which enables the following subsets of people to retrieve the secret: three players from the set $\{A,B,C,D\}$ two players from the ...
4
votes
0answers
128 views

Privacy of Multiplication of Shamir Shared Secrets with an Active Adversary Where Final Result is Revealed to a Third Party Over a Secure Channel

I have the following question related to the privacy of multiplication of Shamir Shared Secrets: Suppose we have two secrets, a and b, shared by a Shamir Secret Sharing Scheme in a (k,n) ...
2
votes
2answers
316 views

Secret Sharing Scheme with variable share size?

Is there a secret sharing scheme construction that allows the shares to have different sizes/lengths? For example a (3,3) scheme, where shares 1 and 2 have large sizes while share 3 has a very small ...
4
votes
1answer
169 views

Can data stay encrypted unless I'm eliminated?

I work as a spy for a top secret and ruthless government organisation with a three letter acronym. I know all their dirty secrets and where the skeletons are literally buried. In order to protect ...
1
vote
1answer
163 views

What is definition of adversary ? And what they do?

Currently I am writing my last assignment about secret sharing. But I don't get clearly about adversary. I know this seems so basic understanding in secret sharing. But I couldn't get references that ...
5
votes
0answers
40 views

How to create a shared secret S from a subset of existing secrets n, such that k out of n secrets can recreate S? [duplicate]

In traditional secret sharing schemes, like Shamir's Secret Sharing, first a secret S is generated. Then it is divided into n parts, such that a subset k of the n parts are sufficient to reconstruct S....
3
votes
2answers
213 views

Randomizing before Shamir secret sharing?

As I understand, the security of key-sharing depends on the cleartext actually being random. If I split a secret which contains things like ASCII or even fixed strings (think -----BEGIN PGP PRIVATE ...
3
votes
1answer
183 views

How to generate a permutation of n numbers using secret sharing scheme?

Consider $n$ parties having their private inputs $s_1,\cdots,s_n$. How can they compute a public function $f(s_1,\cdots,s_n)= \pi$, where $\pi$ is a permutation of numbers between $1,\cdots,n$, using ...
6
votes
1answer
90 views

Is there a studied notion of “party independent transfer”?

I've been thinking about the following set-up involving three parties, Alice, Bob and Charlie: Bob and Charlie decide among themselves who is going to receive a bit from Alice (perhaps by a coin toss)...
6
votes
1answer
201 views

Secret Sharing: Is this simplification secure?

I am a mathematician with no background in crypto or security. For work, I had to read up Chap.13 "Secret Sharing Schemes" in Stinson's Cryptography (3rd ed). My question is about a simplification of ...
8
votes
2answers
6k views

Reverse engineering secret key in RSA encryption with the help of signature

Consider the following: $i$th message, $m_i$, in its original state. $i$th message, $M_i$, encrypted message $m_i$ using public key. Public key, $p$, in a $b$-bit RSA encryption setup. We can ...
4
votes
1answer
895 views

Security difference(s) between Shamir's Secret Sharing Scheme and Blakley's Secret Sharing Scheme?

We know that Blakley's scheme is less space-efficient than Shamir's and that they both work based on pretty different aspects (Shamir = polynomial-based; Blakley = hyperplane-based). Looking at how ...
0
votes
1answer
243 views

Private Information Retrieval with no server computations

Is there any way to perform Private Information Retrieval when no computations can be executed on the server-side? I would like to perform the computations on the client, and without having to ...
5
votes
1answer
295 views

Malicious Model and Arbitrary selecting inputs on MPC and PSI

Imagine the following setting: a party considers a secret sharing or multiparty protocol that is secure against semi-honest adversaries. The adversary selectively chooses the inputs such that it could ...
4
votes
1answer
364 views

Proactive secret sharing security flaws

I read a Shamir secret sharing notes where it mentioned the security flaws of PSS(Proactive Security Sharing) when only one server is responsible for generating $h(x)$. To give the question a bit ...
3
votes
1answer
313 views

Secret sharing between a very large number of participants

What can be a method for sharing a secret between a large number of participants? With Shamir's Secret Sharing (k,n), n can be arbitrarily large, but increasing k increases the complexity of the keys ...
0
votes
1answer
138 views

Unleakable shared secret under realistic assumptions?

Can two devices share a common secret in a way that an adversary who compromises one of the two devices after deployment is unable to reconstruct the shared secret, under the following assumptions: ...
1
vote
3answers
162 views

Require x of y possible passwords to decrypt

Is there a way to set up encryption so that a certian number (x) out of a total (y) number of users/passwords are required to do the decryption? Background: This is mostly a thought experiment, and ...
0
votes
1answer
97 views

Generating two secret keys from a physical analog signal: Crypto HASH analogous to time varying signal

Can we generate two secret keys from same source? The idea is we have time varying signal. We capture a window of say few milliseconds,$t$. I can chop values of signals at a rate $N_S$ and get $tN_S/...
15
votes
4answers
5k views

Why is Shamir Secret Sharing not secure against active adversaries out-of-the-box?

This linear secret sharing scheme allows us to share a secret between n parties, such that only an honest majority can reconstruct it. I understand that – because I do not allow the user to certify ...
5
votes
1answer
2k views

What are the ways to generate Beaver triples for multiplication gate?

So to speed up the function evaluation we use beaver trick, to generate raw data in the offline phase and use them in the online phase to get the output share for the multiplication gate. So what are ...
2
votes
1answer
125 views

Having access to multiple servers, would additional usage of “Secret Sharing” for password storage enhance security?

I am currently learning about secret sharing and I’ve started wondering why larger companies that have access to whole server networks (like – for example – Google, Facebook, etc.) don't use “Secret ...
2
votes
1answer
102 views

Is there an algorithm to derive a 1-of-N shared secret from a set of N private keys?

This is different from Shamir's Secret Sharing in that we are starting with the keys and deriving a shared secret, rather than the other way around. Let me be more precise: We are given keys $k_1, \...
1
vote
2answers
143 views

Is gfcombinefs - a filesystem for n-of-m Shamir secret sharing - fundamentally read-only?

With a view on using a tool similar to fgcombinefs in cloud situations, I would need a writable n-of-m Shamir secret sharing filesystem. As a matter of routine security, I do not want the cloud ...
5
votes
2answers
432 views

SPDZ for the 2-party case

There exist protocols for 2-party computation e.g., GMW that use Boolean circuits. I could also use Paillier and arithmetic circuits for a 2 party computation. However after reading about SPDZ is my ...
5
votes
1answer
463 views

Implementing Secure multi-party computation for online website

I need to know if the following is feasible: I want that any two users of my website have a private key such that the private key is divided into three parts one for website owner and one each for the ...
3
votes
1answer
94 views

Is this a novel secret splitting method, or a different view of an existing one?

I did try this on Information Security, but they were happier to see it moved here. The crypto content is quite low. It's more about secret storage and robust recovery of information, for instance ...
5
votes
2answers
2k views

Shamir's Secret Sharing Scheme - prime security?

Does the prime (which needs to be larger than the message) have to be chosen randomly for security, or can it just be a huge constant? Also, the Wikipedia article for SSSS states The size of each ...
5
votes
1answer
869 views

Secret Sharing and Multiplication Triples

I do not understand the multiplication technique using triples and secret shares of the inputs. Could somebody explain me where I'm wrong? It works like this: The inputs are secret shared in XOR ...
1
vote
1answer
740 views

Shamir Secret Sharing GF(p) or GF(2^8)

I'm implementing Shamir's Secret Sharing Scheme, but I've hit a conceptual roadblock. In Shamir's paper "How To Share A Secret" he creates his shares an a finite field of order p, where p is some ...
11
votes
2answers
629 views

How can we distribute Shamir's secret sharing scheme shares without a dealer?

Let's say $k$ users have shares to a $(k,n)$ secret sharing scheme, and they want to issue new shares. How can they do this without collecting the shares together? In particular, no set of $k-1$ ...
3
votes
0answers
246 views

Could the multisignature scheme in bitcoin alternatively also be implemented by means of a Shamir Secret Sharing Scheme?

When I first came across the Bitcoin multisignature scheme, I wondered that it remarkably looked similar to what Shamir Secret Sharing does (SSS), but then by using facilities in the bitcoin scripting ...
2
votes
1answer
335 views

Dividing a secret into multiple nodes in a blockchain kind of system with time-release?

I would like to have these features and want to ask if it is theoretically possible: a) There is custom software running on nodes in a blockchain style b) A secret is kept in the blockchain that ...
1
vote
2answers
105 views

Proving that you have $k$ keys out of $n$ without revealing which keys they are

I'm looking for a cryptographic algorithm where Alice can prove that she has at least $k$ private keys out of $n$ to Bob, without revealing which keys she knows.
2
votes
2answers
897 views

Secret sharing scheme with ability to add or update share number

I would like to have a secret sharing scheme with the following properties: Generate secret $S$ a split it to $N$ shares $(s_1, s_2, ..., s_N)$ Require $k$ of $N$ shares in order to reconstruct ...
0
votes
1answer
80 views

Multiplicative sharing of 1

Let R be a ring. Is there a known/standard way for N parties to perform some exchanges, such that at the end each party holds an element $r_i\in R^\ast$ and $r_1r_2\dots r_N=1$ (and each party $i$ ...
-2
votes
1answer
167 views

In Shamir's (t, n) secret sharing scheme why don't use infinite field? [duplicate]

Well, we use finite fields to select shares. What happened if we use infinite fields.then will the scheme be vulnerable? Easy to break? Or share generation and reconstruction will be difficult? ...
1
vote
1answer
60 views

Some terms related to secret sharing: Optimality, What does it mean?

In any secret sharing scheme we have to develop step by step. After constructing such scheme we need to reduce share size. Why? e.g. Robust secret sharing scheme is modified Shamir secret sharing ...
1
vote
0answers
84 views

How share size is reduced in robust secret sharing?

THIS IS ROBUST SECRET SHARING SCHEME The dealer $\mathcal{D}$ wants to share a secret among the participants $\{P_1, P_2, \ldots, P_n\}$, where at most $t$ participants are malicious and $t<n/2$. ...
4
votes
1answer
56 views

How to distributively compute a secret of that form $\mathsf{s=sk\cdot g^a}$?

Is there a standard way to distributively compute secrets shares such that any $t+1$ combination out of $n$ of them constructs the secret $\mathsf{s=sk\cdot g^a}$, for a generator $\mathsf{g} \in \...
4
votes
1answer
212 views

Multiplying two additively shared values

Alice has $p_a,q_a$ and Bob has $p_b,q_b$, all elements of a ring $R$. They want to obtain shares of the value $pq$ where $p=p_a+p_b$, $q=q_a+q_b$. How do they do this ? Does revealing their shares of ...
2
votes
1answer
70 views

Does revealing shares of the result reveals shares of the inputs?

Suppose Alive and Bob have shares of two polynomials $P,Q$, say, Alice knows $P_A,Q_A$, Bob knows $P_B,Q_B$ s.t. $P=P_A+P_B$ and $Q=Q_A+Q_B$. They perform some operation $f$ over the shared values, to ...
5
votes
1answer
915 views

Why only one secret value with Shamir's secret sharing? [duplicate]

Shamir's Secret Sharing works by sharing data points on a curve, whereby when you have the required number of data points, you can find the function of the curve and find out the secret, which is ...
1
vote
0answers
122 views

Does using a verifiable secret sharing scheme ensure robustness of a protocol if it is secure under the semi-honest adversarial model

Consider a protocol $\pi$ which uses a linear secret sharing scheme like that of Shamir secret sharing. Further assume that the protocol $\pi$ has been proven to be secure (correctness and privacy) ...
3
votes
1answer
99 views

The role of the dealer in visual cryptography

In visual cryptography schemes (VCS), there is special person called dealer. The dealer sets up the system, and the only one who knows about secret image. After encryption, the dealer distributes the ...
4
votes
1answer
2k views

Beavers Triple Vs BGW Multiplication on MPC

Typically MPC protocols that are secure against semi-honest adversaries recommend the use of the revised GMW multiplication protocol by Gennaro et al. This is not the case against Active adversaries ...
3
votes
0answers
192 views

Majority encryption algorithm?

Assume that I want to leave an encrypted message to a group of $n$ people in a way that they can only decrypt it if they work together in the following sense: For some fixed $k < n$ every sub-...
4
votes
0answers
113 views

Committing to a secret shared value

Suppose I run a multiparty protocol. At the output stage, I have the function output in a secret shared manner among all parties. Now I want all the parties to commit to their value of the secret ...
7
votes
4answers
930 views

Shamir's Secret Sharing vs. Asmuth-Bloom scheme

I need to make use of a secret sharing scheme and I don't really know how to decide which one to use, Shamir's or Asmuth-Bloom (using CRT). The complexity for recovering the secret seems to be linear ...

1
4
5
6 7 8