Questions tagged [secret-sharing]

Secret sharing refers to splitting a secret among multiple parties so that together they can reconstruct it. All parties, or just a threshold number of them, can be required for reconstruction. If fewer than the required number of parties participate, no information should be leaked about the secret.

Filter by
Sorted by
Tagged with
2
votes
3answers
4k views

Implementing secret reconstruction in Shamir's Secret Sharing

I am trying to implement Shamir's secret sharing in C++. I have got the generation of shares working. However, I am very confused with the reconstruction of shares. I get the part on how three users ...
2
votes
2answers
95 views

Shamir's secret sharing for vectors

How would we go about building a scheme for Shamir secret sharing for vectors? I have already tried to use a vector of secrets and random distribution of the secrets to $n$ parties and then use $t$ of ...
2
votes
2answers
69 views

Can I prove my app uses randomness right way?

We are developing an iOS app which employs Shamir Secret Sharing algorithm. We made all possible steps users can trust us. We can't remember their secrets nor we can save encoded fragments. But they ...
2
votes
2answers
536 views

regular expression matching on encrypted data using secure multiparty computation

Lets consider Secure Multiparty Computation based on Secret Sharing schemes (rather than Garbled Circuits approach). If we have to do regular expression matching on secret shares of words of texts. ...
2
votes
1answer
101 views

What is this encryption system called?

Let's say you want to break down a message, for simplicity it is just a bit $0$ or $1$, $m$ into two messages $(m_1, m_2)$ as follows: If $m =0$, then $(m_1, m_2) = (0, 0)$ with probability $1/2$ and ...
2
votes
1answer
1k views

Any reason to use Shamir given faster XOR threshold secret sharing algos?

TL;DR: Is the Kurihara algorithm really what it purports to be (dramatically faster but equally secure replacement for Shamir Secret Sharing)? https://scholar.google.com/scholar?q=kurihara+secret+...
2
votes
4answers
701 views

Requiring a “supervisor” key pair and a “user” key pair to decrypt multiple-recipient messages

I've been toying with some encryption scenarios recently. One of the hard ones I came across is a multi-party system. So we have Bob -- The person who sends the message (and knows it's recipients) ...
2
votes
1answer
239 views

Is GMW different from Secret Sharing?

Is GMW (How to play ANY mental game) protocol different from Secret Sharing?? If so, how is it different from Secret sharing?
2
votes
2answers
55 views

Why is Blakley secret sharing in finite space?

The paper says it requires a finite space. I wonder what the reason is, since from my understanding it should be perfectly fine to use the "normal" infinite space. So why does Blakley use a finite ...
2
votes
2answers
98 views

Multiparty secret generation protocol

The goal is to create a secret S on a trusted server by having users A, B and C each send a private seed to the server, in such a way that any 2 of them can later recover S by resubmitting their ...
2
votes
1answer
125 views

Having access to multiple servers, would additional usage of “Secret Sharing” for password storage enhance security?

I am currently learning about secret sharing and I’ve started wondering why larger companies that have access to whole server networks (like – for example – Google, Facebook, etc.) don't use “Secret ...
2
votes
1answer
791 views

How secure is Shamir's Secret Sharing for password sharing when attacker has t-1 shares?

I am designing protocol to share a random generated n long password between k parties using Shamir's Secret Sharing. I know that share alone does not reveal much information about the original ...
2
votes
1answer
279 views

What is the difference between any secret sharing scheme and arithmetic secret sharing scheme

It looks like that only difference between two of them the variables. But it does not make sense for me and I could not find exact definition of arithmetic secret sharing scheme. I mean what exactly ...
2
votes
1answer
2k views

Shamir Secret Sharing - Threshold decryption implementation

I'm implementing Shamir secret sharing in C using OpenSSL. I've split up the private key and I'm ready to start decrypting the original message using some of the shares. I set $n = 5$ (5 shares total)...
2
votes
1answer
58 views

ECDSA Private Key from SSS

I have all of the Shamir's secret shares required to Lagrange-interpolate f(0), which represents an ECDSA private key. The field of this object is ...
2
votes
1answer
82 views

Cheating in (2,6)-Shamir Sharing Scheme

We consider a $(2, 6)$ Shamir secret sharing scheme over $Z_{11}$. Four players $A,B,C,D$ cooperate to find the secret, but one of them is cheating (so the share he claims to have might not be an ...
2
votes
1answer
95 views

Tampering with Shamir's subshares

Suppose a set of Shamir's redistributable-secret-sharing participants issue a redistribution of subshares. I envision this as a series of points on a line (2 of N, is planar, easy to think about). ...
2
votes
1answer
77 views

Is it safe to derive secret from alice's private key and alice's public key?

I'm using secp256k1; in normal scenario alice.privateKey and bob.publicKey (or vice versa) is used to derive the same ...
2
votes
3answers
224 views

Security guarantees of Shamir's secret sharing when some co-efficients are zero

Shamir secret sharing techniques rely on polynomials for splitting and reconstructing. It's security properties are very good, i.e. it is impossible to reconstruct the secret when $t-1$ shares are ...
2
votes
1answer
463 views

Shamir Secret Sharing Modular Reduction

Say players use Shamir's secret sharing to share a value $k$ such that each player now holds $k_i$, a share of $k$. How can they securely compute $k \bmod m$ for some $m$. Of course they can ...
2
votes
1answer
44 views

Is there a way of sharing a key without anyone knowing what the key is initially?

I started learning about key sharing and Shamir secret sharing, I'm wondering whether you need someone who knows the key initially and then distributes it, is this step necessary or not? In my case I ...
2
votes
1answer
293 views

Secure multi-party computation for digital signature

Is there any practical algorithm that will allow to use public key cryptography (RSA or ECC) in the following way There are N parties. Up to M are malicious adversaries (were trusted, but got taken ...
2
votes
1answer
80 views

Creating a share of a random shared secret [duplicate]

I am interested to know if there is a solution to the following scenario: Assuming we have $n$ party members, is there a scheme that at the end of it, every party member $i$, holds a shamir's ...
2
votes
1answer
198 views

Secret Sharing Scheme, with joining players, no central entity

I am facing the the following problem: Lets assume i have a secret, $S$, I want to share it to $N$ players so that $K$ of them can cooperate in order to obtain the secret ($K$,$N$ scheme). Is there a ...
2
votes
1answer
310 views

Secure multiparty sum computation corruption bound

In Section 3.4 of the book Secure Multiparty Computation and Secret Sharing, it is claimed that for a secure multiparty computation problem with $n$ parties, the optimal corruption bound (concerning ...
2
votes
1answer
169 views

Are Lagrange Multipliers necessary for Shamir's secret sharing?

What is the implication of not using the Lagrange multipliers in Shamir's secret sharing? I mean each update will be $Poly(x_i) \bmod p$ where $p$ is a prime number instead of the original one that ...
2
votes
1answer
104 views

Is there an algorithm to derive a 1-of-N shared secret from a set of N private keys?

This is different from Shamir's Secret Sharing in that we are starting with the keys and deriving a shared secret, rather than the other way around. Let me be more precise: We are given keys $k_1, \...
2
votes
1answer
135 views

Secret only known on consensus

Does a method exist where a secret is generated so that is is unknown until 3 or more people (predetermined) reach consensus that it should be revealed?
2
votes
1answer
173 views

Does pseudorandom secret sharing require a central dealer?

I'm trying to figure out whether pseudorandom secret sharing (as described in this paper) requires a central dealer, i.e. one party who doles out keys to the other players and thus who would be able ...
2
votes
1answer
199 views

Secure MultiParty Computation with secret inputs for secret outputs

I want to know if it’s possible to use a SMPC (Secure Multi-Party Computation) to have $N$ entities compute the outcome of a known mathematical operation with two or more secret inputs, where each ...
2
votes
1answer
280 views

secret sharing of product of 2 numbers

Does evaluating the products of shares $a_jb_j$ give a secret sharing of $ab$? I think it's a no, but I am not sure on how to prove it.
2
votes
3answers
109 views

Impact of a non-uniform distribution in a secret sharing scheme

When it comes to the secret sharing schemes, it seems that the random numbers need to be drawn uniformly. Is there any difference between the random numbers from uniform distribution and the non-...
2
votes
1answer
88 views

Secure scheme to share symmetric key using asymmetric keys and certificates with N parties

I need to distribute symmetric AES key into number of end points which will use it to decrypt data. The AES key will be the same on all end points, it is not possible to generate unique on every end ...
2
votes
2answers
277 views

What is proactive secret sharing scheme?

In some papers, they just wrote that proactive secret sharing scheme is a secret sharing scheme which its shares are periodically updated. Does it have formal definition ?
2
votes
1answer
335 views

Dividing a secret into multiple nodes in a blockchain kind of system with time-release?

I would like to have these features and want to ask if it is theoretically possible: a) There is custom software running on nodes in a blockchain style b) A secret is kept in the blockchain that ...
2
votes
1answer
70 views

Does revealing shares of the result reveals shares of the inputs?

Suppose Alive and Bob have shares of two polynomials $P,Q$, say, Alice knows $P_A,Q_A$, Bob knows $P_B,Q_B$ s.t. $P=P_A+P_B$ and $Q=Q_A+Q_B$. They perform some operation $f$ over the shared values, to ...
2
votes
2answers
73 views

Can you update a (k,n) scheme to a (k+t, n+t) scheme (assuming old keys can be deleted)?

I know that $(k,n)$ can increased to $(k+t,n-s)$ one, by generating a random polynomial $p(x)$ of degree $k+t$ with constant term $0$, and then ordering each agent $a$ to add $p(a_x)$ (where $a_x$ is ...
2
votes
1answer
213 views

Recombination thresholds in degree reduction of multiplied Shamir shares

Shamir's secret sharing can be considered multiplicatively homomorphic, if one is aware of the fact that multiplying two shares of a (n,t)-threshold shared secret yields a share of the same secret, ...
2
votes
1answer
115 views

Feldman's VSSS: Showing the Correctness of shares that are Consistent

This is something with which I am struggling to get my head around. In Feldman's VSSS, I am aware that the Dealer broadcasts exponentials $a_{1},...,a_{t-1}$ of the secret $K$ and the coefficients ...
2
votes
1answer
169 views

How to pass an arbitrary signature to a certificate

I am trying to sign certificate (X509) using secret sharing. That is shareholders combine their signatures to produce the final signature which will be in this case the signed certificate. However ...
2
votes
0answers
30 views

What kind of operators should I perform on 4-qubit state $|\psi\rangle_A|GHZ\rangle$ to get expression like $|\Psi\rangle_4$?

I'm reading the paper "Quantum secret sharing" by Hillery, Bužek and Berthiaume (Phys. Rev. A, 1999; preprint on arXiv) and I have a question about it. Let's say Alice wants to send Bob qubit in ...
2
votes
0answers
39 views

Secret-sharing scheme that can be “audited” without auditing code?

I am designing an app that allows (among other things...) users to divide a secret into 2 shards and was planning to use Shamir Secret Sharing (SSS) to do so. However, I want to allow users of my ...
2
votes
0answers
50 views

Faster alternative to shamirs secret sharing algorithm

I recently discovered shamirs secret sharing scheme. Pretty interesting stuff. I noticed that a common case is to split a secret which is used to encrypt/decrypt something else. For example Vault is ...
2
votes
0answers
30 views

Do I need verifiable shares?

I'm using Shamir's secret sharing in a 2:3 system. Thus a secret Key is split in 3 subkeys (KeyS:KeyC:KeyT) I've 3 entities at ...
2
votes
1answer
77 views

Share secret non-interactively in a verifiable way

In an application, I need to share a secret (random number) with a Group of known receivers over a public channel (a Blockchain) but each receiver needs to be able to check that the others received ...
2
votes
0answers
63 views

Adding new share (Shamir Secret Shares ) [duplicate]

I am using this https://github.com/gburca/ssss-js Shamir implementation. I generated 4 shares from secret (threshold of 2). I am wondering if I can recreate (interpolate) original polynomial from ...
2
votes
0answers
79 views

Differential privacy and Shamir's scheme

I have been unable to find any proofs (for my own reference) that demonstrate that Shamir's secret sharing scheme does (or does not) satisfy the definition of $\textbf{differential privacy}$ as ...
2
votes
0answers
60 views

What is difference between Unipartite Secret Construction, Bipartite Secret Construction and Multipartite Secret Construction

In this paper authors extend Asmuth–Bloom and Kaya schemes to bipartite access structures and further investigate how SSSs realizing multipartite access structures can be conducted with the CRT. The ...
2
votes
0answers
119 views

Verifiable secret sharing - Benaloh scheme; some doubts not answered earlier

I reviewed the paper "Secret sharing homomorphisms: keeping shares of a secret secret" by J.C. Benaloh yesterday and I had some difficulty understanding his version of verifiable secret ...
2
votes
0answers
37 views

Threshold signature without revealing id of signers to the recombiner

I want a threshold signature t out of n algorithm where set of t signers are not known before hand and want to remain anonymous after signing. How is recombination possible if id of signer is not ...

1 2 3
4
5
8