Questions tagged [secret-sharing]

Secret sharing refers to splitting a secret among multiple parties so that together they can reconstruct it. All parties, or just a threshold number of them, can be required for reconstruction. If fewer than the required number of parties participate, no information should be leaked about the secret.

Filter by
Sorted by
Tagged with
1
vote
1answer
647 views

Shamir Secret Sharing GF(p) or GF(2^8)

I'm implementing Shamir's Secret Sharing Scheme, but I've hit a conceptual roadblock. In Shamir's paper "How To Share A Secret" he creates his shares an a finite field of order p, where p is some ...
1
vote
2answers
574 views

Is splitting AES ecrypted data safe?

Say I have a key, an iv and an AES/GCM/NoPadding encoded string and I want to split this information between three people such that only jointly can they reveal the ...
1
vote
2answers
130 views

Is gfcombinefs - a filesystem for n-of-m Shamir secret sharing - fundamentally read-only?

With a view on using a tool similar to fgcombinefs in cloud situations, I would need a writable n-of-m Shamir secret sharing filesystem. As a matter of routine security, I do not want the cloud ...
1
vote
1answer
348 views

General-purpose non-interactive multi-party computation protocol

Most of general purpose multi-party computation protocols are highly interactive. Especially the ones with Shamir's secret scheme, as there is a degree reduction step in multiplication that needs the ...
1
vote
3answers
2k views

Lagrange Interpolation for finite field GF(2^8), for Secret Reconstruction

I'm using Lagrange's Interpolation technique to reconstruct the secret from a set of point pairs (x,y). Since I only need the secret, not the whole polynomial, I have simplified the reconstruction ...
1
vote
1answer
2k views

How to generate a random polynomial of degree $m$?

I am trying to do a homework in which implement a variation of this paper and I don't know how to generate a polynomial of degree $m-1$. This polynomial is used to generate the $y_0$ and $y_1$ values. ...
1
vote
1answer
69 views

How is Shamir's Secret Sharing better than this simple 2-password technique?

I'm looking for a solution to protect a message, such that both password1 (usually given to trusted person #1) and password2 (...
1
vote
2answers
151 views

Reed Solomon secret sharing and as a one-time symmetric key?

Shamir's Secret Sharing is just a special case of Reed-Solomon where only one coefficient is used to store the secret instead of the entire polynomial. Sarwate however, suggests that the latter can ...
1
vote
2answers
487 views

Multisignature or Multi-password File

I want to create a file that I could give to 3 trusted friends, and allow any two of them to decrypt it when together (or in sequence when not physically in the same place). This is similar to a ...
1
vote
2answers
211 views

Distributing shares in a particular monotone access structure

Consider 6 people, $A,B,C,D,E,F$ and a secret. Construct a scheme which enables the following subsets of people to retrieve the secret: three players from the set $\{A,B,C,D\}$ two players from the ...
1
vote
1answer
59 views

Some terms related to secret sharing: Optimality, What does it mean?

In any secret sharing scheme we have to develop step by step. After constructing such scheme we need to reduce share size. Why? e.g. Robust secret sharing scheme is modified Shamir secret sharing ...
1
vote
1answer
753 views

Shamir secret sharing: calculate rest of shares when you know secret and one share

Using Shamir secret sharing, one is starting with a secret and end up with a number of shares based on a polynomial. For example: INPUT: secret: 123456 Shares:4 ...
1
vote
2answers
880 views

Shamir's Secret Share [duplicate]

I'm not quite sure the benefits of working over a prime modulus in Shamir's secret share- but doesn't limiting the numbers you pull from make the secret easier to guess? Instead of being over the real ...
1
vote
2answers
486 views

Relation between Threshold Cryptosystem and Secure Multiparty Computation ?

Is there any relation between secure multiparty computation and threshold cryptosystem ?
1
vote
2answers
185 views

Does lagrange interpolation work with points in an elliptic curve?

Defining the lagrange interpolation for $x=0$ as $\mathcal{L} = \sum_{i=1}^{t+1} y_{i} \cdot l_{i}$ with $l_{i}$ as the lagrange basis polynomials. Does this hold if we apply the elliptic curve ...
1
vote
1answer
103 views

How can I generate large primes for Pedersen commitment?

I want to make a commitment on Shamir's Secret Sharing, based on the work of Pedersen, "Non-Interactive and Information-Theoretic Secure Verifiable Secret Sharing". To implement the commitment ...
1
vote
1answer
111 views

Secret sharing over reals - Difficulty with Computer implementation

I asked a question recently regarding the paper "Secret Sharing Over Infinite Domains" - B. Chor and E. Kushilevitz which describes a secret sharing scheme for real numbers in the interval $[0,1]$. I ...
1
vote
1answer
58 views

Shamir Secret Sharing Scheme - some doubts not answered earlier

my first question on here. I've gone through some examples of Shamirs Secret Sharing Scheme, but I have 2 rather pressing doubts - i. Why do we choose the co-efficients of the polynomial from the ...
1
vote
1answer
230 views

How does one construct a 27x27 tabula recta for 2-of-3 secret sharing?

In the answer to this post at security.stackexchange, someone describes how, using pencil and paper, one can do 2-of-3 secret sharing with a tabula recta. But I don't understand how he created his ...
1
vote
1answer
146 views

Question regarding reconstruction vector in LSSS

Suppose we have a policy $A \wedge ( D \vee (B \wedge C))$ with attributes ${\{A,B,C,D}\}$. The set of subsets of attributes which satisfy this policy is ${\{{\{A,D}\},{\{A,B,C}\},{\{A,B,D}\},{\{A,C,D}...
1
vote
1answer
309 views

Reverse Shamir's Secret Sharing Algorithm?

Shamir's Secret Sharing algorithm works by breaking a single secret to multiple parts. While it is trivial to implement the reverse in a $n$-out-of-$n$ scheme, how would one implement an $m$-out-of-$n$...
1
vote
1answer
425 views

AES encryption using MPC SPDZ protocol

I'm reading the article about SPDZ protocol for secure multiparty computation (and also improvements for offline phase like MASCOT). However I'm thinking about practical application of SPDZ for AES ...
1
vote
2answers
250 views

Can we use Shamir secret sharing conversely?

In Shamir secret sharing scheme, we have a secret and then the shares are generated based on the secret. The question is can we generate the shares before knowing the 'secret' (which is uniformly ...
1
vote
3answers
252 views

Combining Shamir's schemes

I am learning about Shamir's secret sharing scheme and I've come across this problem: Let's suppose we have a combination of a (3, 6) and (1, 2) Shamir's schemes, where participants $P_1$ and $P_2$ ...
1
vote
3answers
157 views

Require x of y possible passwords to decrypt

Is there a way to set up encryption so that a certian number (x) out of a total (y) number of users/passwords are required to do the decryption? Background: This is mostly a thought experiment, and ...
1
vote
1answer
119 views

Numeric combination of passwords

Pls I need explanation on How i can design a Cryptography that use multiple passwords or passphrase to open a safe(Lock). For example, if i need five people to unlock a secured device whereby all the ...
1
vote
2answers
585 views

Shamir's Simple Sharing Scheme - preventing partial recovery of data

In SSSS, if you recreate the original secret with one of the decoder inputs being slightly damaged (e.g. one or two chars incorrect), you receive a slightly damaged version of the original secret. So ...
1
vote
1answer
78 views

Safety when disclosing hashes of secrets used to calculate other secrets

In my application, I am generating a big random number and publishing a SHA256 hash of it. After the hash it published (but not the secret), anyone can submit any number, and the system will calculate ...
1
vote
1answer
180 views

Trying to find an algorithm to share portions of a key with multiple people

Sorry if this question's a bit basic, but I don't know of any way to ask it concisely enough for a search... What I'm looking for is a proven means of doing the following: Create x number of strings ...
1
vote
1answer
71 views

Cheating in (2,6)-Shamir Sharing Scheme

We consider a $(2, 6)$ Shamir secret sharing scheme over $Z_{11}$. Four players $A,B,C,D$ cooperate to find the secret, but one of them is cheating (so the share he claims to have might not be an ...
1
vote
2answers
123 views

Multi-secret sharing (Packed secret sharing) - Some questions

In the publication - "Communication complexity of secure computation", I have encountered a small problem - on page 5 of the literature under the heading "Theorem 1" they have described a $(c,d; k,n)$ ...
1
vote
2answers
246 views

Multiparty key exchange for end-to-end encryption

I need to make end-to-end encrypted messaging between 2 and more parties without trusting a server. Each party has it's secret and private keys. The obvious solution is to make ECDH between all of ...
1
vote
1answer
164 views

Reconstruction vector in Linear secret sharing schemes

Suppose we have a policy $A \wedge ( D \vee (B \wedge C))$ with attributes ${\{A,B,C,D}\}$. The set of subsets of attributes which satisfy this policy is ${\{{\{A,D}\},{\{A,B,C}\},{\{A,B,D}\},{\{A,C,D}...
1
vote
1answer
108 views

Number of possible access structure with $n$ person

I want to count number of possible access structures in closed form(if possible) as a variable of $n$,the number of share holder. I have tried in several ways. Still no good progress. It is very hard ...
1
vote
1answer
169 views

Interpolation in the Exponent (Shamir Shared PRF)

Trying to implement the Diffie-Hellman distributed PRF mentioned by Cachin : https://cachin.com/cc/papers/abba.pdf. It makes sense to me... just use the same Lagrange coefficient I'm using to combine ...
1
vote
1answer
78 views

Shamir's Secret Sharing - Impersonating the Dealer

I understand that Shamir's Secret sharing has nothing to do with the methods that are used to share and later recover a key. That means then, the secret is only as secure as the methods used in ...
1
vote
2answers
174 views

Is there a cryptographic way (a la mental poker) two people can determine if they both Like each other, without revealing their personal preferences?

Specifically: Alice and Bob want to know if they like each other, but won't admit it if the other person doesn't reciprocate. (They're teenagers, or physicists.) They don't trust anyone else, so want ...
1
vote
1answer
315 views

Shamir's Secret Sharing on non-prime GF

I am implementing Shamir's secret sharing scheme on arbitrary binary files. I don't intend to use this; this is a project to help me explore cryptography. In setting up the finite field arithmetic, ...
1
vote
1answer
120 views

Corruption bound of MPC when n>2

In the book titled "Secure Multiparty Computation and Secret Sharing" stated that MPC protocol is not secure when the adversary $t>n/2$. This was proved by using a 2 party protocol, but I can't ...
1
vote
1answer
241 views

Is creating an OTP of a key to some data a secure secret sharing scheme?

Suppose I have some data that has been encrypted with a known, secure algorithm and a key k. I want to distribute "pieces" of the key to n of my colleagues, and only be able to access the data when ...
1
vote
1answer
130 views

FHMQV-C \sigma calculation - Full Dual Exponential Challenge Response (FDCR) signature schemes-

I'm studying the protocol FHMQV - C but I don't understand how two honest parties can reach the same value of $\sigma$. The paper that I'm studying is: https://eprint.iacr.org/2009/408.pdf. If you ...
1
vote
2answers
103 views

Proving that you have $k$ keys out of $n$ without revealing which keys they are

I'm looking for a cryptographic algorithm where Alice can prove that she has at least $k$ private keys out of $n$ to Bob, without revealing which keys she knows.
1
vote
1answer
108 views

Explanation of vector in Visual Cryptography

I'm starting to study about visual cryptography, but I am stuck with the following problem. On paper "Visual Cryptography" by Moni Naor and Adi Shamir, on page 6. How to read/what is the meaning of $...
1
vote
1answer
503 views

Two rounds of SHA-256 HMAC?

In a project we are working on, we have two applications within our datacenter that exchange messages. The messages are protected by an HMAC, and the secret key is stored on a SafeNet device. Update ...
1
vote
1answer
406 views

Roots of polynomial in Shamir secret sharing

I need to know whether one can obtain any roots of the polynomial in Shamir secret sharing if he possesses less than threshold shares. For instance in (t,n) if he has t-1 shares can he obtain any ...
1
vote
1answer
194 views

Secure function evaluation

Consider 3 parties, Alice, Bob and Charlie. Suppose each party has a bit as input, i.e. Alice, Bob and Charlie hold $a, b, c \in \{0, 1\}$ respectively. Show how construct a scheme with which they ...
1
vote
1answer
201 views

Is this a sensible cryptographic protocol intending to reduce the impact of compromised security?

I'm in the process of designing a cryptographic protocol which will reduce the impact an attacker will have if they gained root access to a server storing data. The basic crux of it is that keys ...
1
vote
1answer
182 views

How is the password sent across for verification?

I am familiar with Challenge-Response Authentication scheme. However I would like to know actual message content sent between client and server for 1 way authentication, over an insecure channel. ...
1
vote
1answer
50 views

Encrypt data. Create 5 keys. Just 3 keys are needed for decryption

I would like to encrypt some data and create 5 keys. These keys are stored in different places. If I want to decrypt the data I just need 3 of these 5 keys. Is there a way to do this?
1
vote
1answer
53 views

How can one prove correctness of shared secrets in secret sharing schemes?

Assume we are in a centralized secret sharing setting, where one party generates the shares, and distributes them to other parties. How can the distributor who creates the shares prove to the parties ...