Questions tagged [secret-sharing]

Secret sharing refers to splitting a secret among multiple parties so that together they can reconstruct it. All parties, or just a threshold number of them, can be required for reconstruction. If fewer than the required number of parties participate, no information should be leaked about the secret.

Filter by
Sorted by
Tagged with
1
vote
2answers
183 views

Is there a cryptographic way (a la mental poker) two people can determine if they both Like each other, without revealing their personal preferences?

Specifically: Alice and Bob want to know if they like each other, but won't admit it if the other person doesn't reciprocate. (They're teenagers, or physicists.) They don't trust anyone else, so want ...
1
vote
1answer
382 views

Shamir's Secret Sharing on non-prime GF

I am implementing Shamir's secret sharing scheme on arbitrary binary files. I don't intend to use this; this is a project to help me explore cryptography. In setting up the finite field arithmetic, ...
1
vote
1answer
124 views

Corruption bound of MPC when n>2

In the book titled "Secure Multiparty Computation and Secret Sharing" stated that MPC protocol is not secure when the adversary $t>n/2$. This was proved by using a 2 party protocol, but I can't ...
1
vote
1answer
253 views

Is creating an OTP of a key to some data a secure secret sharing scheme?

Suppose I have some data that has been encrypted with a known, secure algorithm and a key k. I want to distribute "pieces" of the key to n of my colleagues, and only be able to access the data when ...
1
vote
1answer
136 views

FHMQV-C \sigma calculation - Full Dual Exponential Challenge Response (FDCR) signature schemes-

I'm studying the protocol FHMQV - C but I don't understand how two honest parties can reach the same value of $\sigma$. The paper that I'm studying is: https://eprint.iacr.org/2009/408.pdf. If you ...
1
vote
2answers
106 views

Proving that you have $k$ keys out of $n$ without revealing which keys they are

I'm looking for a cryptographic algorithm where Alice can prove that she has at least $k$ private keys out of $n$ to Bob, without revealing which keys she knows.
1
vote
1answer
114 views

Explanation of vector in Visual Cryptography

I'm starting to study about visual cryptography, but I am stuck with the following problem. On paper "Visual Cryptography" by Moni Naor and Adi Shamir, on page 6. How to read/what is the meaning of $...
1
vote
1answer
547 views

Two rounds of SHA-256 HMAC?

In a project we are working on, we have two applications within our datacenter that exchange messages. The messages are protected by an HMAC, and the secret key is stored on a SafeNet device. Update ...
1
vote
1answer
426 views

Roots of polynomial in Shamir secret sharing

I need to know whether one can obtain any roots of the polynomial in Shamir secret sharing if he possesses less than threshold shares. For instance in (t,n) if he has t-1 shares can he obtain any ...
1
vote
1answer
195 views

Secure function evaluation

Consider 3 parties, Alice, Bob and Charlie. Suppose each party has a bit as input, i.e. Alice, Bob and Charlie hold $a, b, c \in \{0, 1\}$ respectively. Show how construct a scheme with which they ...
1
vote
1answer
218 views

Is this a sensible cryptographic protocol intending to reduce the impact of compromised security?

I'm in the process of designing a cryptographic protocol which will reduce the impact an attacker will have if they gained root access to a server storing data. The basic crux of it is that keys ...
1
vote
1answer
185 views

How is the password sent across for verification?

I am familiar with Challenge-Response Authentication scheme. However I would like to know actual message content sent between client and server for 1 way authentication, over an insecure channel. ...
1
vote
1answer
42 views

Shamir's Threshold Scheme (Theory Part, Need some help understanding a term that I can't find online)

What does the max(S, n) part mean, and what am I supposed to do with it? I somewhat understand, but it is still confusing. I don't know what it exactly represents. Can you help me please?
1
vote
2answers
112 views

Secret sharing scheme WITHOUT Shamir Secrete Sharing

I am planning to use the following XOR scheme to divide a secret into only 2 shares (I do not want to use Shamir Secret Sharing for different reasons that are beyond the scope of this post). Here's ...
1
vote
1answer
84 views

Encrypt data. Create 5 keys. Just 3 keys are needed for decryption

I would like to encrypt some data and create 5 keys. These keys are stored in different places. If I want to decrypt the data I just need 3 of these 5 keys. Is there a way to do this?
1
vote
1answer
97 views

What does non-collusion assumption mean in server-aided protocol based on secret sharing?

Suppose $m$ clients split their own input into $n$ shares using additive secret sharing scheme (mod something). Then, each of the clients sends each share to each of $n$ external servers. After ...
1
vote
1answer
70 views

How can one prove correctness of shared secrets in secret sharing schemes?

Assume we are in a centralized secret sharing setting, where one party generates the shares, and distributes them to other parties. How can the distributor who creates the shares prove to the parties ...
1
vote
1answer
106 views

Security of (2,2) Shamir's visual secret sharing scheme : How are the 2 shares random?

From the Visual Cryptography by Shamir and Noar. Let us take the pixel expansion as 2. Therefore, each pixel will be represented by 2 pixels (also called as subpixels) in a share. Since this is a (2,...
1
vote
1answer
132 views

How to apply lagrange interpolation on bilinear pairings?

I have seen in some places applications of Shamir secret sharing and lagrange interpolation mixed with bilinear pairings, however I fail to understand how this works. For instance, here I find the ...
1
vote
1answer
95 views

Is my proof of Asmuth-Bloom scheme's perfection correct?

I am trying to understand how Asmuth-Bloom's secret sharing is perfect. My "proof" so far (in a 3 out of 4 scheme): $y=s + a * m_0 \bmod m_1 * m_2 * m_3$ Having $k-1$ shares, it will yield a valid ...
1
vote
1answer
241 views

Combining secret/public keys

Suppose that we have three authorities which each of them generate one secret/public key for Alice. It means that Alice has three secret keys and three related public keys. Suppose that Alice combines ...
1
vote
1answer
175 views

Mathematics behind the paper “how to leak a secret” for ring signature

I'm reading the paper "How to Leak a Secret" (Rivest, Shamir, Tauman; 2001). On page 8/14, in chapter 3.4, the authors present the following "combining function": $$C_{k,v}(y_1, y_2,\ldots,y_r) = ...
1
vote
1answer
112 views

Pairing-based cryptography VS ZK-proofs: what's more efficient for threshold systems?

In some papers (e.g. 1, 2) the authors approve that pairings are more efficient than classic zk-proofs (e.g. proof of discrete logarithm knowledge) for the described applications (threshold encryption,...
1
vote
1answer
94 views

Why every access structure is a multipartite access structure?

The set of authorized subsets of participants is called an access structure. In a multipartite access structure, the set of participants is divided into several parts and all participants in the ...
1
vote
1answer
139 views

Combining secret keys into a single shared key

Let's say there are $n$ participants each with their own secret key $x_i$. Is it possible for them somehow to build a shared key which is an arithmetic sum of all their secret keys ($x_0 + x_1 + ... + ...
1
vote
1answer
73 views

Eliptic curve verifiable secret sharing

I am implementing the following the algorithm instructions as shown in 1 (section IV, B). When trying to verify the share given the commits, $a_jG$ verifier $i$ checks whether $f(i)G=\sum_{j=0}^{t} (...
1
vote
1answer
132 views

Minimal size of share in Shamir's Sharing Scheme

Why does the combined shared key in Adi Shamir's Sharing Scheme have to be smaller or equal than each secret share?
1
vote
1answer
502 views

Is encrypting a secret key and being able to decrypt plain text with it possible?

Please forgive me if this is a basic question, I'm in high school so I still don't understand very much. Let's say there are two servers, each with a set of public and private keys. These denote ...
1
vote
1answer
550 views

Secret Sharing Encryption

Suppose Alice shares a secret block cipher key, $K_{AB}$ with Bob, and a different secret block cipher key, $K_{AC}$ with Charlie. Describe a method for Alice to encrypt an m block message such that ...
1
vote
1answer
187 views

Does the transposition cipher have a network application?

So I'm reading a chapter in my networking book, and it talks about substitution and transposition ciphers. I know that most network security uses public key or symmetric encryption, but I wonder ...
1
vote
1answer
96 views

Checking the share membership in secret sharing schemes

I was thinking of this since yesterday. Imagine, a secret is split into its respective shares (using any secret sharing scheme) with threshold $t$ and total $n$. Can we find out given any random ...
1
vote
1answer
88 views

Send a symmetric key generated by one user to other users (more than two) using a server

I am developing a software in which I am using AES for encrypting messages shared in a group. The key is generated by one user, the admin of the group and needs to be shared with other members. How ...
1
vote
1answer
312 views

Encrypt HDD with keyfile and password and allow backing up the keyfile with secret sharing

I want to: Encrypt my whole HDD with a keyfile and a password (meaning that both are required to decrypt it), Be able to back up pieces of the keyfile in several distant locations using Secret ...
1
vote
1answer
40 views

Which are the current solutions to the illegal values in the homomorphic secret sharing?

There is a usual example about homomorphic secret sharing, focused on e-voting. Supposing we use Shamir's scheme for the Secret Sharing system, a participant generates a polynomial whose a0 is +1 (yes)...
1
vote
0answers
28 views

Advantage of Asmuth-Bloom secret sharing scheme with polynomial over integers?

Currently, I am studying the Asmuth-Bloom secret sharing scheme and want to learn more about its polynomial version. What are the exact reasons to use polynomials over integers for this scheme?
1
vote
0answers
26 views

Function Secret sharing and sharing a truth table

I was reading a paper (Function Secret Sharing by Boyle, Gilboa and Ishai, PDF) on Function Secret Sharing and in that the author talked about a naive construction of a p party DPF wherein the truth ...
1
vote
0answers
46 views

basic Shamir's secret sharing scheme

I have tried to look online in various sites and texts and tried to use several youtube tutorials but I still cannot grasp it correctly. could someone please help me understand a simple case ...
1
vote
2answers
63 views

GMW Multiplication AND for 2 parties

I am looking into the GMW protocol's evaluation for multiplication in 2 parties. I have referred to different materials on it but I didn't exactly understand how $a_i b_j + a_j b_i$ is calculated in a ...
1
vote
0answers
31 views

Is an implementation of blinded encryption/decryption mechanism exists?

I want to use 2 semi trusted servers, to decrypt a secret for a user but I don't want those servers to have access to the plain text. Those server need to be able to "partially" decrypt and let the ...
1
vote
2answers
69 views

How to backup a secret encrypted by multi parties without revealing the secret?

I'm searching for a way to backup a secret that only the end user knows the information with 2 trusted hosts. But trusted hosts shouldn't have access to secret at any time. First basic version : ...
1
vote
0answers
48 views

Encrypting text with AES and MPC

I'm thinking of implementing text encryption and decryption in my program using AES using key sharing thanks to MPC (the point is that the key should never be provided in full), however, all public ...
1
vote
0answers
44 views

Key derivation scheme with shared secrets?

I want to derive a list of sub-keys derived[t] from a master key mk by a key derivation function ...
1
vote
0answers
50 views

EC threshold private key's multiplicative inverse and derived-key sharing

I have two devices, and each has a private key xPriv-i. Each device computes the corresponding EC public key xPub-i, shares it, and the linear combination of the keys is the "real" public key xPub. ...
1
vote
0answers
66 views

How to go about distributed private/public key pair generation?

I'm trying to implement a protocol in which two parties generate a private/public keypair, where both know the public key, but each party has only one part of the private key and cannot derive the ...
1
vote
0answers
42 views

Asymetric encryption, multiple recipients, traitor must share private key

Is there an Asymetric encryption scheme, or public key encryption, where multiple recipients are able to access the data but in order for one of the recipients to leak the key to the data they would ...
1
vote
0answers
70 views

What is the motivation of multipartite secret sharing?

In this thesis chapter 3.1 A multipartite secret sharing scheme is a scheme in which the set of participants is divided into several parts and all participants in the same part play an equivalent ...
1
vote
0answers
30 views

Question about publication “Efficient (k,n) Threshold Secret Sharing Schemes Secure Against Cheating from n − 1 Cheaters”

In the paper on section "4 Proposed Scheme", I suppose that the scheme does not protect if an adversary has access to the $k - 1$ original shares, am I correct? If the adversary has $k - 1$ of both ...
1
vote
0answers
21 views

Shamir Secret Sharing: Using $a_0 \ldots a_k$ to store secret? [duplicate]

Let's assume I have a truly random secret $s$ that is 256 bits long, and I want to use SSS with e.g. $(k=4,n=8)$. The normal approach is to set $a_0=s$ and choose $a_1 \ldots a_{k-1}$ randomly, ...
1
vote
0answers
111 views

How can I calculate the feasibility of brute-forcing missing secret shares against the secret checksum?

Secret sharing has the problem of player cheating, where a forged share $s'_i$ can be sent to generate a fake secret $m'$ during reconstruction (and the cheaters can even collude to generate the real ...
1
vote
1answer
126 views

Pseudorandom zero-sharing: how does it work?

TL;DR How can the shares of the PRZS protocol proposed in [CDI05] reconstruct the "secret" $0$? Is the number of shares required to reconstruct $0$ equal to $2t + 1$? Long question The paper "...

1
4 5
6
7 8