Questions tagged [secret-sharing]

Secret sharing refers to splitting a secret among multiple parties so that together they can reconstruct it. All parties, or just a threshold number of them, can be required for reconstruction. If fewer than the required number of parties participate, no information should be leaked about the secret.

Filter by
Sorted by
Tagged with
1
vote
1answer
143 views

Mathematics behind the paper “how to leak a secret” for ring signature

I'm reading the paper "How to Leak a Secret" (Rivest, Shamir, Tauman; 2001). On page 8/14, in chapter 3.4, the authors present the following "combining function": $$C_{k,v}(y_1, y_2,\ldots,y_r) = ...
1
vote
1answer
100 views

Pairing-based cryptography VS ZK-proofs: what's more efficient for threshold systems?

In some papers (e.g. 1, 2) the authors approve that pairings are more efficient than classic zk-proofs (e.g. proof of discrete logarithm knowledge) for the described applications (threshold encryption,...
1
vote
1answer
83 views

Why every access structure is a multipartite access structure?

The set of authorized subsets of participants is called an access structure. In a multipartite access structure, the set of participants is divided into several parts and all participants in the ...
1
vote
1answer
89 views

Combining secret keys into a single shared key

Let's say there are $n$ participants each with their own secret key $x_i$. Is it possible for them somehow to build a shared key which is an arithmetic sum of all their secret keys ($x_0 + x_1 + ... + ...
1
vote
1answer
65 views

Eliptic curve verifiable secret sharing

I am implementing the following the algorithm instructions as shown in 1 (section IV, B). When trying to verify the share given the commits, $a_jG$ verifier $i$ checks whether $f(i)G=\sum_{j=0}^{t} (...
1
vote
1answer
94 views

Minimal size of share in Shamir's Sharing Scheme

Why does the combined shared key in Adi Shamir's Sharing Scheme have to be smaller or equal than each secret share?
1
vote
1answer
421 views

Is encrypting a secret key and being able to decrypt plain text with it possible?

Please forgive me if this is a basic question, I'm in high school so I still don't understand very much. Let's say there are two servers, each with a set of public and private keys. These denote ...
1
vote
1answer
494 views

Secret Sharing Encryption

Suppose Alice shares a secret block cipher key, $K_{AB}$ with Bob, and a different secret block cipher key, $K_{AC}$ with Charlie. Describe a method for Alice to encrypt an m block message such that ...
1
vote
1answer
91 views

Checking the share membership in secret sharing schemes

I was thinking of this since yesterday. Imagine, a secret is split into its respective shares (using any secret sharing scheme) with threshold $t$ and total $n$. Can we find out given any random ...
1
vote
1answer
87 views

Send a symmetric key generated by one user to other users (more than two) using a server

I am developing a software in which I am using AES for encrypting messages shared in a group. The key is generated by one user, the admin of the group and needs to be shared with other members. How ...
1
vote
1answer
299 views

Encrypt HDD with keyfile and password and allow backing up the keyfile with secret sharing

I want to: Encrypt my whole HDD with a keyfile and a password (meaning that both are required to decrypt it), Be able to back up pieces of the keyfile in several distant locations using Secret ...
1
vote
1answer
2k views

XOR secret sharing scheme

I was wondering how we can get a secret sharing of $a+b$ from the sharing of secrets $a$ and $b$ themselves by using an XOR secret sharing scheme, where $a_1,...,a_n$ and $b_1,...,b_n$ are the shares ...
1
vote
0answers
29 views

Key derivation scheme with shared secrets?

I want to derive a list of sub-keys derived[t] from a master key mk by a key derivation function ...
1
vote
1answer
29 views

What does non-collusion assumption mean in server-aided protocol based on secret sharing?

Suppose $m$ clients split their own input into $n$ shares using additive secret sharing scheme (mod something). Then, each of the clients sends each share to each of $n$ external servers. After ...
1
vote
0answers
59 views

How to go about distributed private/public key pair generation?

I'm trying to implement a protocol in which two parties generate a private/public keypair, where both know the public key, but each party has only one part of the private key and cannot derive the ...
1
vote
0answers
31 views

Asymetric encryption, multiple recipients, traitor must share private key

Is there an Asymetric encryption scheme, or public key encryption, where multiple recipients are able to access the data but in order for one of the recipients to leak the key to the data they would ...
1
vote
0answers
60 views

What is the motivation of multipartite secret sharing?

In this thesis chapter 3.1 A multipartite secret sharing scheme is a scheme in which the set of participants is divided into several parts and all participants in the same part play an ...
1
vote
0answers
19 views

Shamir Secret Sharing: Using $a_0 \ldots a_k$ to store secret? [duplicate]

Let's assume I have a truly random secret $s$ that is 256 bits long, and I want to use SSS with e.g. $(k=4,n=8)$. The normal approach is to set $a_0=s$ and choose $a_1 \ldots a_{k-1}$ randomly, ...
1
vote
0answers
96 views

How can I calculate the feasibility of brute-forcing missing secret shares against the secret checksum?

Secret sharing has the problem of player cheating, where a forged share $s'_i$ can be sent to generate a fake secret $m'$ during reconstruction (and the cheaters can even collude to generate the real ...
1
vote
0answers
54 views

Pseudorandom zero-sharing: how does it work?

TL;DR How can the shares of the PRZS protocol proposed in [CDI05] reconstruct the "secret" $0$? Is the number of shares required to reconstruct $0$ equal to $2t + 1$? Long question The paper "...
1
vote
0answers
70 views

Purpose of the ZKPoPK in the original SPDZ protocol

What is the purpose of ZKPoPK in the SPDZ paper? And will the following can detect the active adversaries in 2 party spdz excluding ZKPoPK step? Each party sends a commitment on his MAC key ∆_i ...
1
vote
0answers
53 views

How does the user check whether $y < M$ without knowing all shares?

CRT-based Verifiable Secret Sharing Scheme In this paper, section 4 Verifiable Secret Sharing Scheme, the dealer phase and the combiner phase are as follows: Dealer Phase To share a secret $d \in ...
1
vote
0answers
44 views

Confirmation signature - Improved Feldman VSS

I am working through the implementation of A Distributed Private-Key Generator for Identity-Based Cryptography. In the paper (Figure 1, page 8) the validation of a share by a node says that once ...
1
vote
1answer
82 views

Is my proof of Asmuth-Bloom scheme's perfection correct?

I am trying to understand how Asmuth-Bloom's secret sharing is perfect. My "proof" so far (in a 3 out of 4 scheme): $y=s + a * m_0 \bmod m_1 * m_2 * m_3$ Having $k-1$ shares, it will yield a valid ...
1
vote
1answer
49 views

How is the generator used in Feldman's Verifiable Secret Sharing scheme determined? [duplicate]

According to the Wikipedia description of Feldman's VSS scheme First, a cyclic group G of prime order p, along with a generator g of G, is chosen publicly as a system parameter. (Typically, one ...
1
vote
0answers
81 views

PCI DSS requirement 3.5.3

3.5.3 Store secret and private keys used to encrypt/decrypt cardholder data in one (or more) of the following forms at all times: ............ As at least two full-length key components or key shares, ...
1
vote
1answer
98 views

Shamir Secret Sharing and Diffie-Hellman procedure

Alice needs to share an already generated numeric secret $s$ with Bob and she doe not want the world to see it. The problem is that she has never contacted Bob before. I thought Alice and Bob could ...
1
vote
0answers
224 views

Private Key Sharding - How is it Secure in a Distributed Network?

In a Distributed Network in order for a private key not to be compromised sharding will have to take place off the network, correct? If so: Why is it when a Distributed Network shards private keys ...
1
vote
0answers
33 views

Is recursive secret sharing of practical value?

This paper describes recursive secret sharing. In one of their illustrations, a binary secret of length L, along with 3 other binary secrets of lengths shorter ...
1
vote
0answers
43 views

Preserving location privacy

What are cryptographic techniques that could be used so that if I wanna to enable a server to send message to certain nodes in a network with preserving the privacy location for them ??
1
vote
0answers
82 views

Optimized Random-OT Security in Standard Model

I was going through the paper - " Efficient Oblivious Transfer and Extensions for Faster Secure Computation" by Asharov et al. where the authors propose an optimized OT protocol along with a Random-OT ...
1
vote
0answers
298 views

Additive homomorphic secret sharing

I am new to cryptography esp, homomorphic encryption. I would like to know if the following is possible using something similiar to additive homomorphic secret sharing. Please apologize me if its too ...
1
vote
0answers
89 views

What SMPC protocols make use only of additive secret sharing?

In Appendix G of the Hawk paper, where it talks about financially fair SFE, it mentions that it's possible to run a SMPC protocol where, at the end, each party has a share of their own output y, and a ...
1
vote
0answers
81 views

What is a simple way to “2 out of 3”-secure a mnemonic phrase without computers? [closed]

I'm working on a safe way to store a mnemonic key. It's 24 words long. Each word is 11 bits of entropy I want to store it in 3 locations One plate should not allow you to unlock the code Two plates ...
1
vote
0answers
71 views

relationship between share size and entropy in secret sharing

In an $(s,r,n)$-ramp scheme, we require that any subset of at least $r$ parties can recover the secret, while any subset of size at most $s$ cannot learn anything about the secret. In Bogdanov et al.'...
1
vote
0answers
246 views

Shamir's Secret Sharing - Proactive and dealer-free [duplicate]

I recently started studying about cryptography and I tried to search the internet but I can't find much about these subjects. I want to see the proof of Shamir's Secret Sharing being Proactive and ...
1
vote
0answers
188 views

Threshold encryption with threshold on encryption part

For a thought experiment I'm looking for a threshold encryption scheme where $k$ out of $n$ shares are needed to encrypt the data and everybody can decrypt the data. However, I only found schemes ...
1
vote
0answers
83 views

How share size is reduced in robust secret sharing?

THIS IS ROBUST SECRET SHARING SCHEME The dealer $\mathcal{D}$ wants to share a secret among the participants $\{P_1, P_2, \ldots, P_n\}$, where at most $t$ participants are malicious and $t<n/2$. ...
1
vote
0answers
118 views

Does using a verifiable secret sharing scheme ensure robustness of a protocol if it is secure under the semi-honest adversarial model

Consider a protocol $\pi$ which uses a linear secret sharing scheme like that of Shamir secret sharing. Further assume that the protocol $\pi$ has been proven to be secure (correctness and privacy) ...
1
vote
0answers
150 views

Weighted secret sharing scheme?

Is there a secret sharing scheme where secrets can be weighted, and that you need a total weight of $1$ to unlock the secret? I know that you could, of course, just figure out every subset that has ...
1
vote
0answers
51 views

Is Shamir's Secret Sharing Scheme insecure for larger field? [duplicate]

According to wikipedia, if you are using shamir's secret sharing scheme with a field of order $p$, "High values of $p$ are risky because Eve knows that the chance for $f(x)\pmod{p}=f(x)$ increases ...
1
vote
0answers
28 views

Shamir SS: To associate shares to the public values $x_i$, when the shares are permuted [duplicate]

Suppose we use $(t,n)$ Shamir secret sharing as follows: We share the secret $\beta$ as $S=[s_1,..., s_n]$, where $X=[x_1,...,x_n]$ are the public values. For the sake of simplicity, lets assume that ...
1
vote
1answer
144 views

Many single-time use keys encryption scheme (not Shamir's Shared Secret)

I'm looking for encryption scheme with the following properties: There's a sequence of keys that can be used to decrypt the message Strictly only one key from the sequence is required to decrypt the ...
1
vote
1answer
167 views

Does the transposition cipher have a network application?

So I'm reading a chapter in my networking book, and it talks about substitution and transposition ciphers. I know that most network security uses public key or symmetric encryption, but I wonder ...
1
vote
0answers
162 views

How to distribute symmetric key between $n$ entities?

If there are $n$ servers for broadcasting a symmetric key in such a manner that following holds: No server alone can find the key $K$ alone. Any two servers can pass $k_i$ and $k_j$ such that $K=f(...
1
vote
0answers
119 views

(n,n) Shamir secret sharing [duplicate]

In (n,n) Shamir secret sharing if n shareholders do not have the public values (X values) can they still obtain the secret with only Y values?
1
vote
0answers
74 views

Is anyone aware of Du atallah multiplicative secret sharing scheme for dot products for > 2 party scenario?

I am working on Du Atallah's multiplicative secret sharing scheme for more than 2 party scenario. Is anyone aware of its multiparty version (more than 2 parties). The paper for 2 party can be found ...
1
vote
0answers
57 views

Algorithm for sharing secret information with redundant keys [duplicate]

I have an information that I would like to encrypt and give it to someone else. I would like to encrypt it using N separate passwords (say 5) and give each password to some other persons. However the ...
0
votes
2answers
120 views

Secret sharing - Size of the share

I'm having some hard time understanding why the size of the share must be at least as large as the secret itself, why is this restriction imposed? What would happen if the share is smaller?
0
votes
2answers
129 views

Is it generally considered acceptable for app owners to be able to retrieve private keys from users when their apps offer end-to-end encryption?

E2EE promises that data sending between two endpoints can be decrypted by only those two endpoints. If an app offers E2EE but still has functions to retrieve private keys from users for any purposes ...