Questions tagged [secret-sharing]

Secret sharing refers to splitting a secret among multiple parties so that together they can reconstruct it. All parties, or just a threshold number of them, can be required for reconstruction. If fewer than the required number of parties participate, no information should be leaked about the secret.

Filter by
Sorted by
Tagged with
1
vote
1answer
226 views

Interpolation in the Exponent (Shamir Shared PRF)

Trying to implement the Diffie-Hellman distributed PRF mentioned by Cachin : https://cachin.com/cc/papers/abba.pdf. It makes sense to me... just use the same Lagrange coefficient I'm using to combine ...
5
votes
1answer
157 views

A problem in secret sharing and mixed operators over $\mathbb{Z}$

Recently, I studied an article in which it was written that having $(A-B)\oplus C$ and $B\oplus C$, we cannot find $A$. The authors used this result to build a secret sharing scheme, but they did not ...
1
vote
0answers
148 views

What SMPC protocols make use only of additive secret sharing?

In Appendix G of the Hawk paper, where it talks about financially fair SFE, it mentions that it's possible to run a SMPC protocol where, at the end, each party has a share of their own output y, and a ...
2
votes
1answer
105 views

Tampering with Shamir's subshares

Suppose a set of Shamir's redistributable-secret-sharing participants issue a redistribution of subshares. I envision this as a series of points on a line (2 of N, is planar, easy to think about). ...
1
vote
1answer
119 views

Shamir's Secret Sharing - Impersonating the Dealer

I understand that Shamir's Secret sharing has nothing to do with the methods that are used to share and later recover a key. That means then, the secret is only as secure as the methods used in ...
-3
votes
1answer
159 views

Shamir's Secret Sharing Computation time

Hello for my thesis I am making research about SSS computational time. Based on (K,N) threshold scheme Where K is the minimum number of shares to rebuild the secret and N is the number of shares ...
0
votes
1answer
60 views

security of multiplicative secret sharing

I was having a read of this question: "Is multiplicative secret sharing secure?" posted in 2013 which asks if the simple multiplicative scheme is secure. Everyone agreed that it was information ...
0
votes
2answers
140 views

Is it generally considered acceptable for app owners to be able to retrieve private keys from users when their apps offer end-to-end encryption?

E2EE promises that data sending between two endpoints can be decrypted by only those two endpoints. If an app offers E2EE but still has functions to retrieve private keys from users for any purposes ...
2
votes
1answer
87 views

Creating a share of a random shared secret [duplicate]

I am interested to know if there is a solution to the following scenario: Assuming we have $n$ party members, is there a scheme that at the end of it, every party member $i$, holds a shamir's ...
2
votes
0answers
89 views

Are there any information-theoretically secure verifiable secret sharing protocols with t=n?

Disregarding matters such as efficiency and round complexity, can verifiable secret sharing be done in a way such that the secret cannot be decoded unless you have all n shares, and that this ...
2
votes
1answer
188 views

Baek and Zheng’s Threshold Cryptosystem - limit on threshold?

I have just completed an implementation of Simple and Efficient Threshold Cryptosystem from the Gap Diffie-Hellman Group by Baek and Zheng and am hitting a problem with high values of the threshold. ...
0
votes
1answer
542 views

ECIES: key derivation function and symmetric encryption scheme

I am using an elliptic curve library which provided me with a shared secret using my secret key and a foreign public key. Unfortunately an ECIES is not available in the programming language. I would ...
1
vote
3answers
346 views

Combining Shamir's schemes

I am learning about Shamir's secret sharing scheme and I've come across this problem: Let's suppose we have a combination of a (3, 6) and (1, 2) Shamir's schemes, where participants $P_1$ and $P_2$ ...
7
votes
3answers
876 views

How to forge a Shamir secret share?

On this website, we have a lot of questions and answers devoted to Shamir secret sharing. We make it clear that Shamir secret sharing does not guarantee integrity. When we want integrity, we need to ...
3
votes
2answers
481 views

Undetectable cheater in Shamir's Secret Sharing scheme

Consider Shamir's Secret Sharing scheme with $n=5, t=3$ (i.e, there are 5 shares, and when we have 3 of them we can reconstruct our secret $s$). Let $f(x)$ be the dealing function, i.e the secret $s$ ...
3
votes
1answer
265 views

Prove that shares can reveal a seceret key. in a secret sharing scheme

I am trying to build a cryptographic system that has several components and ran into a problem with a secret sharing scheme. Let $v$ be a value we are interested committing to. I generate a ...
4
votes
1answer
293 views

secret sharing with 3 parties under constraint

Suppose we have $3$ parties Alice, Bob and Charlie such that Alice can't talk with Bob. Suppose that Alice has some string $x\in\{0,1\}^n$ and Bob has a string $y\in\{0,1\}^n$. Suppose that Alice ...
0
votes
1answer
143 views

How can I prove that it is impossible to find a cheater in shamir secret sharing?

Three participants Quadratic polynomial, one cheater. The Cheater discloses a false (x,y) pair I need to prove that any one of the truth-telling participants can't tell which of the others is the liar....
4
votes
2answers
6k views

What are the weaknesses of Shamir's Secret Sharing?

We just learned about this in school but i don't quite get the weakness of this method. If we let's say have used a 64-bit secret key to encrypt a file and then we split the key into 2 pieces of 32-...
1
vote
2answers
851 views

Multisignature or Multi-password File

I want to create a file that I could give to 3 trusted friends, and allow any two of them to decrypt it when together (or in sequence when not physically in the same place). This is similar to a ...
3
votes
1answer
84 views

Is there a cryptographic scheme that allows joint encryption using a shared secret?

I'm looking for a type of algorithm that could be used to encrypt text with a shared secret $S$. What I would like to have is the secret to be broken up in three pieces, where any combination of two ...
2
votes
1answer
205 views

Secret Sharing Scheme, with joining players, no central entity

I am facing the the following problem: Lets assume i have a secret, $S$, I want to share it to $N$ players so that $K$ of them can cooperate in order to obtain the secret ($K$,$N$ scheme). Is there a ...
3
votes
1answer
82 views

Is it safe to derive secret from alice's private key and alice's public key?

I'm using secp256k1; in normal scenario alice.privateKey and bob.publicKey (or vice versa) is used to derive the same ...
2
votes
0answers
79 views

Ecash - Probability of catching a user using secret splitting who duplicates the coin

For detecting double spending, secret splitting is used. If a user duplicates the coin, then there will be two different transaction items in transaction list. What is the probability of catching a ...
6
votes
2answers
788 views

Determining the Shamir's secret sharing scheme for the following problem

I'm having trouble solving the Shamir's Secret Sharing scheme for the following problem that states: Problem: A certain military office, which is in control of a powerful missile, consists of six ...
3
votes
1answer
393 views

Determining the secret using the Blakley's scheme?

I am solving a example with Blakley's scheme problem. The issue that I am having is using the row operation to determine the secret $x_{0}$. So what I have so far is: Given three planes: $z = 7x + ...
2
votes
1answer
347 views

Secure multiparty sum computation corruption bound

In Section 3.4 of the book Secure Multiparty Computation and Secret Sharing, it is claimed that for a secure multiparty computation problem with $n$ parties, the optimal corruption bound (concerning ...
8
votes
1answer
461 views

Do people not care about side channel resistance?

Recently, I have been browsing a lot through libraries that implementing Shamir secret sharing. I see a lot of code that implements this cryptographic algorithm without any side channel (timing/branch/...
4
votes
1answer
1k views

What is the maximum number of shares in Shamir's Secret Sharing?

I am using codahale’s Shamir's Secret Sharing implementation of Shamir's secret sharing from Github. I am using this to generate a 32 byte random key encryption key (KEK) to encrypt a 32 byte data ...
1
vote
2answers
193 views

Is there a cryptographic way (a la mental poker) two people can determine if they both Like each other, without revealing their personal preferences?

Specifically: Alice and Bob want to know if they like each other, but won't admit it if the other person doesn't reciprocate. (They're teenagers, or physicists.) They don't trust anyone else, so want ...
-3
votes
1answer
133 views

Shamir's scheme secret sharing

Shamir's scheme for implementing an $(n, k)$ sharing of a secret $S$ involves a random polynomial $F$ of degree $k-1$ such that $F (0) = S$. Each of the $n$ shares of $S$ is a pair $(x, F (x))$ for $x$...
7
votes
2answers
541 views

Manual secret sharing?

What are feasible options for an equivalent of Shamir Secret Sharing using small tables, preferably usable with pen-and-paper? We want to share a secret $K$ into $n\ge2$ shares, so that $m$ shares ($2\...
1
vote
0answers
102 views

What is a simple way to “2 out of 3”-secure a mnemonic phrase without computers? [closed]

I'm working on a safe way to store a mnemonic key. It's 24 words long. Each word is 11 bits of entropy I want to store it in 3 locations One plate should not allow you to unlock the code Two plates ...
4
votes
1answer
189 views

Shamir Interpolation Problem (Recovering secret with fewer parts than the threshold)

I'm studying about polynomials and interpolation with shamir secret sharing. I have some questions about it. I found that there are always lower-degrees polynomials that intersects with 2 or more ...
0
votes
1answer
57 views

Pre-determined points in Shamir's secret

I have distinct sets of pairs of values $(a_1, b_1), ..., (a_i, b_i)$. This set of pairs is ordered, and each $a_i$ and $b_i$ are related. I want to share the $a_i$ values publicly. I do not want to ...
1
vote
0answers
91 views

relationship between share size and entropy in secret sharing

In an $(s,r,n)$-ramp scheme, we require that any subset of at least $r$ parties can recover the secret, while any subset of size at most $s$ cannot learn anything about the secret. In Bogdanov et al.'...
2
votes
2answers
353 views

What is proactive secret sharing scheme?

In some papers, they just wrote that proactive secret sharing scheme is a secret sharing scheme which its shares are periodically updated. Does it have formal definition ?
1
vote
1answer
473 views

Shamir's Secret Sharing on non-prime GF

I am implementing Shamir's secret sharing scheme on arbitrary binary files. I don't intend to use this; this is a project to help me explore cryptography. In setting up the finite field arithmetic, ...
1
vote
1answer
2k views

Is this a good way of splitting a private key into a 2 of 3 scheme?

Basically the idea is to split a key into three parts ($key_a, key_b, key_c$) of which any 2 of the 3 parts can be used to recreate the original key $key_a$: a random number smaller then our original ...
6
votes
1answer
309 views

Background: Secret Sharing and Multiplication Triples

I know that a nearly identical question was asked in (Secret Sharing and Multiplication Triples), but I am a few points shy of asking follow up questions in the comments, so I understand if this is ...
1
vote
1answer
132 views

Corruption bound of MPC when n>2

In the book titled "Secure Multiparty Computation and Secret Sharing" stated that MPC protocol is not secure when the adversary $t>n/2$. This was proved by using a 2 party protocol, but I can't ...
1
vote
1answer
293 views

Is creating an OTP of a key to some data a secure secret sharing scheme?

Suppose I have some data that has been encrypted with a known, secure algorithm and a key k. I want to distribute "pieces" of the key to n of my colleagues, and only be able to access the data when ...
1
vote
1answer
538 views

Is encrypting a secret key and being able to decrypt plain text with it possible?

Please forgive me if this is a basic question, I'm in high school so I still don't understand very much. Let's say there are two servers, each with a set of public and private keys. These denote ...
4
votes
1answer
598 views

Shamir Secret Sharing - P not prime

I was wondering what will happen if I use the Shamir Secret Sharing scheme with $P$ not being a prime, let's say it is $255$. An adversary which holds $k'$ shares ($k'<$ threshold $k$ ) can attack ...
5
votes
1answer
156 views

Secret sharing where the combination of shares matters

In Shamir's secret sharing scheme, any combination of shares (that pass the threshold) will result in the secret being revealed. Is it possible to have a system where some combinations are invalid? ...
3
votes
1answer
333 views

Shamir secret sharing with two types of parties

Consider the Shamir Secret Sharing scheme based on polynomial interpolation. In this scheme, every part has the same right: one piece of information of same value as the other ones. The idea is to ...
3
votes
2answers
295 views

Shamir Secret Sharing data limitations per share?

Do “Shamir Secret Sharing” schemes have a limitation for the amount of data that can be split up between each share, or a maximum number of data that can be shared within one secret? I believe there ...
2
votes
1answer
203 views

Are Lagrange Multipliers necessary for Shamir's secret sharing?

What is the implication of not using the Lagrange multipliers in Shamir's secret sharing? I mean each update will be $Poly(x_i) \bmod p$ where $p$ is a prime number instead of the original one that ...
2
votes
0answers
153 views

How does threshold decryption with secretly shared exponents actually work?

Imagine the case where you have a sufficiently large finite field (or any multiplicative field for that matter) $\mathbb{Z}_{p}$ where p is some large prime. Now, I have a number $g \in \mathbb{Z}_{p}...
1
vote
1answer
145 views

FHMQV-C \sigma calculation - Full Dual Exponential Challenge Response (FDCR) signature schemes-

I'm studying the protocol FHMQV - C but I don't understand how two honest parties can reach the same value of $\sigma$. The paper that I'm studying is: https://eprint.iacr.org/2009/408.pdf. If you ...

1
3 4
5
6 7
9