Questions tagged [secret-sharing]

Secret sharing refers to splitting a secret among multiple parties so that together they can reconstruct it. All parties, or just a threshold number of them, can be required for reconstruction. If fewer than the required number of parties participate, no information should be leaked about the secret.

Filter by
Sorted by
Tagged with
2
votes
1answer
335 views

Secure multiparty sum computation corruption bound

In Section 3.4 of the book Secure Multiparty Computation and Secret Sharing, it is claimed that for a secure multiparty computation problem with $n$ parties, the optimal corruption bound (concerning ...
8
votes
1answer
450 views

Do people not care about side channel resistance?

Recently, I have been browsing a lot through libraries that implementing Shamir secret sharing. I see a lot of code that implements this cryptographic algorithm without any side channel (timing/branch/...
4
votes
1answer
971 views

What is the maximum number of shares in Shamir's Secret Sharing?

I am using codahale’s Shamir's Secret Sharing implementation of Shamir's secret sharing from Github. I am using this to generate a 32 byte random key encryption key (KEK) to encrypt a 32 byte data ...
1
vote
2answers
190 views

Is there a cryptographic way (a la mental poker) two people can determine if they both Like each other, without revealing their personal preferences?

Specifically: Alice and Bob want to know if they like each other, but won't admit it if the other person doesn't reciprocate. (They're teenagers, or physicists.) They don't trust anyone else, so want ...
-3
votes
1answer
131 views

Shamir's scheme secret sharing

Shamir's scheme for implementing an $(n, k)$ sharing of a secret $S$ involves a random polynomial $F$ of degree $k-1$ such that $F (0) = S$. Each of the $n$ shares of $S$ is a pair $(x, F (x))$ for $x$...
7
votes
2answers
501 views

Manual secret sharing?

What are feasible options for an equivalent of Shamir Secret Sharing using small tables, preferably usable with pen-and-paper? We want to share a secret $K$ into $n\ge2$ shares, so that $m$ shares ($2\...
1
vote
0answers
97 views

What is a simple way to “2 out of 3”-secure a mnemonic phrase without computers? [closed]

I'm working on a safe way to store a mnemonic key. It's 24 words long. Each word is 11 bits of entropy I want to store it in 3 locations One plate should not allow you to unlock the code Two plates ...
4
votes
1answer
175 views

Shamir Interpolation Problem (Recovering secret with fewer parts than the threshold)

I'm studying about polynomials and interpolation with shamir secret sharing. I have some questions about it. I found that there are always lower-degrees polynomials that intersects with 2 or more ...
0
votes
1answer
56 views

Pre-determined points in Shamir's secret

I have distinct sets of pairs of values $(a_1, b_1), ..., (a_i, b_i)$. This set of pairs is ordered, and each $a_i$ and $b_i$ are related. I want to share the $a_i$ values publicly. I do not want to ...
1
vote
0answers
86 views

relationship between share size and entropy in secret sharing

In an $(s,r,n)$-ramp scheme, we require that any subset of at least $r$ parties can recover the secret, while any subset of size at most $s$ cannot learn anything about the secret. In Bogdanov et al.'...
2
votes
2answers
330 views

What is proactive secret sharing scheme?

In some papers, they just wrote that proactive secret sharing scheme is a secret sharing scheme which its shares are periodically updated. Does it have formal definition ?
1
vote
1answer
436 views

Shamir's Secret Sharing on non-prime GF

I am implementing Shamir's secret sharing scheme on arbitrary binary files. I don't intend to use this; this is a project to help me explore cryptography. In setting up the finite field arithmetic, ...
1
vote
1answer
1k views

Is this a good way of splitting a private key into a 2 of 3 scheme?

Basically the idea is to split a key into three parts ($key_a, key_b, key_c$) of which any 2 of the 3 parts can be used to recreate the original key $key_a$: a random number smaller then our original ...
6
votes
1answer
289 views

Background: Secret Sharing and Multiplication Triples

I know that a nearly identical question was asked in (Secret Sharing and Multiplication Triples), but I am a few points shy of asking follow up questions in the comments, so I understand if this is ...
1
vote
1answer
131 views

Corruption bound of MPC when n>2

In the book titled "Secure Multiparty Computation and Secret Sharing" stated that MPC protocol is not secure when the adversary $t>n/2$. This was proved by using a 2 party protocol, but I can't ...
1
vote
1answer
276 views

Is creating an OTP of a key to some data a secure secret sharing scheme?

Suppose I have some data that has been encrypted with a known, secure algorithm and a key k. I want to distribute "pieces" of the key to n of my colleagues, and only be able to access the data when ...
1
vote
1answer
520 views

Is encrypting a secret key and being able to decrypt plain text with it possible?

Please forgive me if this is a basic question, I'm in high school so I still don't understand very much. Let's say there are two servers, each with a set of public and private keys. These denote ...
4
votes
1answer
545 views

Shamir Secret Sharing - P not prime

I was wondering what will happen if I use the Shamir Secret Sharing scheme with $P$ not being a prime, let's say it is $255$. An adversary which holds $k'$ shares ($k'<$ threshold $k$ ) can attack ...
5
votes
1answer
149 views

Secret sharing where the combination of shares matters

In Shamir's secret sharing scheme, any combination of shares (that pass the threshold) will result in the secret being revealed. Is it possible to have a system where some combinations are invalid? ...
3
votes
1answer
318 views

Shamir secret sharing with two types of parties

Consider the Shamir Secret Sharing scheme based on polynomial interpolation. In this scheme, every part has the same right: one piece of information of same value as the other ones. The idea is to ...
3
votes
2answers
280 views

Shamir Secret Sharing data limitations per share?

Do “Shamir Secret Sharing” schemes have a limitation for the amount of data that can be split up between each share, or a maximum number of data that can be shared within one secret? I believe there ...
2
votes
1answer
185 views

Are Lagrange Multipliers necessary for Shamir's secret sharing?

What is the implication of not using the Lagrange multipliers in Shamir's secret sharing? I mean each update will be $Poly(x_i) \bmod p$ where $p$ is a prime number instead of the original one that ...
2
votes
0answers
146 views

How does threshold decryption with secretly shared exponents actually work?

Imagine the case where you have a sufficiently large finite field (or any multiplicative field for that matter) $\mathbb{Z}_{p}$ where p is some large prime. Now, I have a number $g \in \mathbb{Z}_{p}...
1
vote
1answer
143 views

FHMQV-C \sigma calculation - Full Dual Exponential Challenge Response (FDCR) signature schemes-

I'm studying the protocol FHMQV - C but I don't understand how two honest parties can reach the same value of $\sigma$. The paper that I'm studying is: https://eprint.iacr.org/2009/408.pdf. If you ...
1
vote
0answers
260 views

Shamir's Secret Sharing - Proactive and dealer-free [duplicate]

I recently started studying about cryptography and I tried to search the internet but I can't find much about these subjects. I want to see the proof of Shamir's Secret Sharing being Proactive and ...
8
votes
0answers
284 views

Share Conversion between Different Finite Fields

Let us have any linear secret sharing scheme (LSSS) that works on some field $Z_{p}$, where p is some prime or a power of a prime e.g., Shamir Secret Sharing, Additive secret Sharing. The problem at ...
4
votes
1answer
642 views

Linear secret-sharing scheme for four players

I got stuck on this question during my exam revision. Consider the linear secret-sharing scheme for four players $P_1, P_2, P_3$ and $P_4$ based on the matrix $$ M= \begin{bmatrix} 1 & 0 &...
4
votes
1answer
260 views

Does Shamir Secret Sharing provide integrity?

Shamir secret sharing splits into t number of shares with a t-threshold. However, I can find no information online if this scheme provide integrity (or authentication for that matter, which I assume ...
1
vote
0answers
224 views

Threshold encryption with threshold on encryption part

For a thought experiment I'm looking for a threshold encryption scheme where $k$ out of $n$ shares are needed to encrypt the data and everybody can decrypt the data. However, I only found schemes ...
1
vote
2answers
222 views

Distributing shares in a particular monotone access structure

Consider 6 people, $A,B,C,D,E,F$ and a secret. Construct a scheme which enables the following subsets of people to retrieve the secret: three players from the set $\{A,B,C,D\}$ two players from the ...
4
votes
0answers
139 views

Privacy of Multiplication of Shamir Shared Secrets with an Active Adversary Where Final Result is Revealed to a Third Party Over a Secure Channel

I have the following question related to the privacy of multiplication of Shamir Shared Secrets: Suppose we have two secrets, a and b, shared by a Shamir Secret Sharing Scheme in a (k,n) ...
2
votes
2answers
359 views

Secret Sharing Scheme with variable share size?

Is there a secret sharing scheme construction that allows the shares to have different sizes/lengths? For example a (3,3) scheme, where shares 1 and 2 have large sizes while share 3 has a very small ...
4
votes
1answer
173 views

Can data stay encrypted unless I'm eliminated?

I work as a spy for a top secret and ruthless government organisation with a three letter acronym. I know all their dirty secrets and where the skeletons are literally buried. In order to protect ...
1
vote
1answer
214 views

What is definition of “adversary”? And what do they do?

Currently I am writing my last assignment about secret sharing. But I don't clearly understand adversary. I know this is a fundamental concept in secret sharing. But I couldn't find references that ...
5
votes
0answers
41 views

How to create a shared secret S from a subset of existing secrets n, such that k out of n secrets can recreate S? [duplicate]

In traditional secret sharing schemes, like Shamir's Secret Sharing, first a secret S is generated. Then it is divided into n parts, such that a subset k of the n parts are sufficient to reconstruct S....
3
votes
2answers
225 views

Randomizing before Shamir secret sharing?

As I understand, the security of key-sharing depends on the cleartext actually being random. If I split a secret which contains things like ASCII or even fixed strings (think -----BEGIN PGP PRIVATE ...
3
votes
1answer
209 views

How to generate a permutation of n numbers using secret sharing scheme?

Consider $n$ parties having their private inputs $s_1,\cdots,s_n$. How can they compute a public function $f(s_1,\cdots,s_n)= \pi$, where $\pi$ is a permutation of numbers between $1,\cdots,n$, using ...
6
votes
1answer
94 views

Is there a studied notion of “party independent transfer”?

I've been thinking about the following set-up involving three parties, Alice, Bob and Charlie: Bob and Charlie decide among themselves who is going to receive a bit from Alice (perhaps by a coin toss)...
6
votes
1answer
220 views

Secret Sharing: Is this simplification secure?

I am a mathematician with no background in crypto or security. For work, I had to read up Chap.13 "Secret Sharing Schemes" in Stinson's Cryptography (3rd ed). My question is about a simplification of ...
8
votes
2answers
7k views

Reverse engineering secret key in RSA encryption with the help of signature

Consider the following: $i$th message, $m_i$, in its original state. $i$th message, $M_i$, encrypted message $m_i$ using public key. Public key, $p$, in a $b$-bit RSA encryption setup. We can ...
4
votes
1answer
946 views

Security difference(s) between Shamir's Secret Sharing Scheme and Blakley's Secret Sharing Scheme?

We know that Blakley's scheme is less space-efficient than Shamir's and that they both work based on pretty different aspects (Shamir = polynomial-based; Blakley = hyperplane-based). Looking at how ...
0
votes
1answer
265 views

Private Information Retrieval with no server computations

Is there any way to perform Private Information Retrieval when no computations can be executed on the server-side? I would like to perform the computations on the client, and without having to ...
5
votes
1answer
326 views

Malicious Model and Arbitrary selecting inputs on MPC and PSI

Imagine the following setting: a party considers a secret sharing or multiparty protocol that is secure against semi-honest adversaries. The adversary selectively chooses the inputs such that it could ...
4
votes
1answer
372 views

Proactive secret sharing security flaws

I read a Shamir secret sharing notes where it mentioned the security flaws of PSS(Proactive Security Sharing) when only one server is responsible for generating $h(x)$. To give the question a bit ...
3
votes
1answer
325 views

Secret sharing between a very large number of participants

What can be a method for sharing a secret between a large number of participants? With Shamir's Secret Sharing (k,n), n can be arbitrarily large, but increasing k increases the complexity of the keys ...
0
votes
1answer
139 views

Unleakable shared secret under realistic assumptions?

Can two devices share a common secret in a way that an adversary who compromises one of the two devices after deployment is unable to reconstruct the shared secret, under the following assumptions: ...
1
vote
3answers
174 views

Require x of y possible passwords to decrypt

Is there a way to set up encryption so that a certian number (x) out of a total (y) number of users/passwords are required to do the decryption? Background: This is mostly a thought experiment, and ...
0
votes
1answer
126 views

Generating two secret keys from a physical analog signal: Crypto HASH analogous to time varying signal

Can we generate two secret keys from same source? The idea is we have time varying signal. We capture a window of say few milliseconds,$t$. I can chop values of signals at a rate $N_S$ and get $tN_S/...
15
votes
4answers
6k views

Why is Shamir Secret Sharing not secure against active adversaries out-of-the-box?

This linear secret sharing scheme allows us to share a secret between n parties, such that only an honest majority can reconstruct it. I understand that – because I do not allow the user to certify ...
6
votes
1answer
2k views

What are the ways to generate Beaver triples for multiplication gate?

So to speed up the function evaluation we use beaver trick, to generate raw data in the offline phase and use them in the online phase to get the output share for the multiplication gate. So what are ...

1
3 4
5
6 7
9