Questions tagged [threshold-cryptography]

Threshold cryptography is the art of chopping a secret into little bits, so that the secret can only be learned by possessing more than a threshold number of those bits.

Filter by
Sorted by
Tagged with
2 votes
0 answers
48 views

threshold signature scheme that allows adding and removing members

Is there a threshold signature scheme (TSS) that a quorum in a group can sign, where members can dynamically join and leave, without changing the shared group public key? ECDSA, BLS, and Schnorr based ...
sinoTrinity's user avatar
0 votes
1 answer
67 views

Threshold ed25519: How to export keys?

Consider ed25519 signing (RFC 8032). There, the private key is a 32-byte random value, and for signature generation, the 32-byte private key is first hashed and then the secret scalar and nonce are ...
mti's user avatar
  • 609
0 votes
1 answer
31 views

Threshold signature scheme for centralized group broadcast

I am looking for a threshold signature scheme (or similar proposals are happily accepted) that suits the following scenario: One Base Station is transmitting signed broadcast message to all members in ...
Tom's user avatar
  • 101
2 votes
0 answers
61 views

Does the participant-to-participant secret share in FROST distributed key generation need to remain confidential?

In its application of Shamir secret sharing, the FROST paper in Figure 1 Round 2 Step 1 requires each participant $P_i$ to securely send to each other participant $P_\ell$ a secret share $(\ell, f_i(\...
sander's user avatar
  • 63
0 votes
1 answer
81 views

Threshold encryption

Is there any (k,n)-threshold encryption scheme, such that the decryption process is non-interactive, i.e., the decryption can be processed "in a line" where each party "in the middle of ...
Doron's user avatar
  • 99
1 vote
0 answers
73 views

Impact of New Secret Sharing Paper with $O(n)$ additions for recovery

I hope this question is not too speculative. Applebaum, Nir and Pinkas have a new paper which has an $n-$party secret sharing scheme with: reconstruction complexity of $O(n)$ additions constant share ...
kodlu's user avatar
  • 22.1k
0 votes
0 answers
12 views

Statistical effect of inceasing private key shares' bit length in threshold RSA signature

By using additive sharing of the private key over the integers, one can obtain a simple threshold RSA signature scheme. It provides security against a passive adversary. The dealer chooses random $d_{...
user1035648's user avatar
1 vote
1 answer
72 views

Threshold Paillier encryption key generation time

I have used the threshold version of Paillier encryption without a trusted dealer in an application. I have tested the key generation phase with different security key sizes such as 80, 512, 1024, and ...
Tooba's user avatar
  • 11
2 votes
2 answers
157 views

Can you re-encrypt data without knowing what the data is or using PRE?

I'm currently working on a distributed consensus-based system. I currently give the system a private key through a threshold encryption model, and I want to be able to take some data encrypted with ...
Marston's user avatar
  • 21
2 votes
1 answer
117 views

Question about Threshold signature scheme "GG18"

I recently read the article on the threshold signature scheme “Fast Multiparty Threshold ECDSA with Fast Trustless Setup” and I have a question. In the key generation section, each player $P_i$ ...
Leila Shafiee's user avatar
0 votes
0 answers
40 views

order of Lagrange interpolation in reconstruction of secret key

Does the order of Lagrange interpolation have any role in reconstructing the secret key in Shamir's secret share?
user109119's user avatar
2 votes
0 answers
18 views

Which channel protocol should I use to broadcast the message between parties?

I am building the Threshold Signature Scheme (TSS) based wallet. I would like to run the each party's node separately with different host. And these nodes should be able to send the messages through ...
thant zin tun's user avatar
0 votes
1 answer
289 views

Use Shamir's Secret Sharing Scheme to split a key between a client, a server and multiple 3rd parties

I'm trying to design an encryption system for a new mobile app and am thinking of using Shamir's Secret Sharing Scheme in a way which I have not seen before. Does this seem possible or does it violate ...
glesage's user avatar
  • 133
2 votes
1 answer
243 views

Implementing ECDSA threshold using a secret sharing scheme

My question might be a duplicate but I wasn't able to find a similar question. I recently developed a wallet-like app and I am trying to implement some MPC features. I searched a little and even asked ...
misaq saadat's user avatar
2 votes
1 answer
263 views

Shamir's secret sharing homomorphism for different degree polynomials

The $(t,n)$ Shamir’s polynomial based secret sharing scheme is $(+,+)$-homomorphic in which the addition of two polynomials secrets equals the Lagrange’s interpolation of the sum-of-shares for the ...
Mona's user avatar
  • 197
0 votes
1 answer
125 views

Increase encryption key length in Shamir secret sharing

Can Shamir's secret sharing work on any size of key?
CipherNewbie's user avatar
4 votes
1 answer
143 views

Is there any threshold-crypto library that is production-ready?

I am wondering if there is any available threshold crypto library that is well-audited and ready to be used in production. Any pointer is appreciated.
threshold_crypto_library's user avatar
1 vote
0 answers
71 views

What are the uses of shared cipher texts and signatures?

In Distributed Key Generation(DKG), why is there a need to actually create a master secret which can then derive into a single public and private keypair(for signatures) and a secret key(encryption)? ...
Hern's user avatar
  • 159
2 votes
0 answers
150 views

Is there a Ed25519 threshold signature protocol similar to the Gennaro-Goldfeder schema for ECDSA?

I keep searching online and asking in different cryptographic communities whether there is a similar threshold signature schema (or a close one) to what Gennaro and Goldfeder proposed for ECDSA? ...
Max's user avatar
  • 121
2 votes
1 answer
425 views

Sage code for finding generator matrix of MDS code

Let $L$ be an $[n,k]$ code. A $k\times n$ matrix $G$ whose rows form a basis for $L$ is called a generator matrix for $L$. A linear $[n,k,d]$ code with largest possible minimum distance is called ...
Laba Sa's user avatar
  • 23
4 votes
1 answer
140 views

BGW multiplication by Gennaro et al.: Why does H(x) have exactly degree t and why is $2t + 1 \le n$ necessary?

With this question I am referring to the BGW multiplication by Gennaro et al (PDF here). The multiplication is described on the 4th page. (Another source for me was "A pragmatic Introduction to ...
ht332932's user avatar
2 votes
1 answer
80 views

Threshold implementation of ciphers

What is the principle behind threshold implementation of block ciphers and how is this protecting against side channel attacks?
Evgeni Vaknin's user avatar
1 vote
1 answer
222 views

Gennaro & Goldfeder Key Generation Protocol

As I am going through the “Fast Multiparty Threshold ECDSA with Fast Trustless Setup” paper by Gennaro & Goldfeder, 2018, I am stumbled by the key generation protocol (Sect. 4.1, p.10): In Phase ...
bazzilic's user avatar
  • 197
1 vote
1 answer
74 views

Coin tosses in the context of commitment schemes

I was reading the “Fast Multiparty Threshold ECDSA with Fast Trustless Setup” paper by Gennaro & Goldfeder, 2018 and I encountered this portion (Sect. 2.4, p.6): This excerpt leaves me slightly ...
bazzilic's user avatar
  • 197
0 votes
1 answer
149 views

Are Shamir shares independent?

Assume we have a secret $s \in Z_p$. We generate the set of secret shares $\{ (x_i, s_i) \}_{i=1}^{N}$ according to a $(N,k)$ Shamir's scheme. The evaluations are generated according to the following ...
Erfan Hosseini's user avatar
2 votes
0 answers
51 views

Threshold Signature with Accumulation Scheme?

Is there a threshold signature scheme that can be accumulated? That is, given a message $M$ signed by $k-1$ parties and the $(k-1)$-threshold signature $\sigma_{k-1}$, a party can verify $\sigma_{k-1}$...
xzl's user avatar
  • 21
0 votes
1 answer
60 views

summation problem?

Let there are two given numbers $x,y$ which is $A=x+y$ and we know just $A$. How we can find this just $x$ and $y$? If you suppose $a$ a random number, then we know $x_1=a$ and $y_1=A-a$ satisfies in $...
Ruholla Kh's user avatar
1 vote
0 answers
89 views

Distributed Random Oracle with Verifiable Shares

$Setup$: Let's assume a quorum of $n$ nodes where each have a secret share $y_i$ from a know and safe leaderless DKG protocol. Define $\mathcal{L}^i(y_i) = y$ as the lagrange interpolation for $x=0$, ...
shumy's user avatar
  • 418
2 votes
1 answer
105 views

How to do unmasked addition on SSS masked shares?

I'm trying to understand how Shamir's Secret Sharing algorithm is applied to AES when doing threshold masking. I understand how the secrets are created and the secret is calculated and I'm now trying ...
Tarick Welling's user avatar
1 vote
0 answers
38 views

Threshold signature verified by an equivalent key

I am looking for references for the following problem: Consider we have a DSA with the keypair $(sk, pk)$ and a message $m$, such that its signature is $s = sig(m,sk)$ and the verification result is $...
user87152's user avatar
1 vote
0 answers
268 views

Understanding multiplication of Shamir secret sharing during threshold (EC)DSA signing

I have been looking at the threshold (EC)DSA schemes for honest majority by Gennaro et al. https://www.sciencedirect.com/science/article/pii/S0890540100928815. In the scheme, there are steps where we ...
HelenW's user avatar
  • 93
6 votes
1 answer
186 views

Secure Secret Sharing to a Distributed Key

Setup There are two groups, $A$ and $B$. Each group is in a Shamir's secret sharing scheme ($t_A$ of $N_A$ and $t_B$ of $N_B$). Each group has a public key that is associated with the identity of the ...
Aman Grewal's user avatar
  • 1,411
4 votes
2 answers
322 views

Would EdDSA be broken by replacing H(R, A, M) with H(A, M)?

An EdDSA signature is (R, S) where R = r*B and S = r + H(R, A, M)*s. Notation from Wikipedia en.wikipedia.org/wiki/EdDSA. Given that the hash function H, is indeed collision-resistant, would using S = ...
Frans Lundberg's user avatar
1 vote
0 answers
60 views

Threshold Encryption Scheme for Multiple Messages

In a threshold encryption scheme, a dealer generates $(PK,SK1,…,SKn)$ and distributes the secret keys to users indexed by $1,…,n$, and if a combiner obtains $t+1$ partially-decrypted ciphertexts, it ...
hello world's user avatar
2 votes
0 answers
60 views

Threshold lower than $\dfrac{n}{2}$ in distributed key generation

While I was studying protocols for distributed key generation with malicious adversaries, Gennaro et al.$^{[1]}$ pointed out that the protocols that provide both secrecy and robustness should have a ...
yoshi 's user avatar
  • 21
1 vote
1 answer
127 views

Black-box secret sharing schemes

Do black box secret sharing schemes [DF90, DF94] have any advantages over the better-known secret sharing schemes like Shamir’s [Sham79]? [DF90]: Threshold cryptosystems, by Desmedt, Yvo and Frankel, ...
Mathdropout's user avatar
2 votes
1 answer
92 views

Problems on ANF equation?

I tried to solve SBox as given in this link I am trying to understand this paper SBox. In this on page no.4 the correct equation of given SBox is mentioned. I am not getting how to design ANF equation ...
mahima bhatnagar's user avatar
1 vote
0 answers
76 views

Generate ANF equation? [duplicate]

Given an SBox, how can I generate its component equations (in ANF)? given in this link: https://en.wikipedia.org/wiki/Algebraic_normal_form For example, let's say I have this SBox: $$\{1, a, 4, c ,6 ,...
mahima bhatnagar's user avatar
0 votes
0 answers
70 views

Privacy preserving aggregation of encrypted data

I have the following problem: I have $t$ servers $S_1, S_2, S_3, \ldots, S_t$, each of them storing some $key : value$ list. They have to upload this data into a big dropbox server $D$, but in such a ...
Ziva's user avatar
  • 235
0 votes
1 answer
88 views

Practical Threshold Signatures

In Practical Threshold Signature it says that there is a requirement in which the RSA public exponent $e$ must be more than $l$. $l$ in this case is the number of players in the threshold group. My ...
brianinhk's user avatar
2 votes
0 answers
60 views

Which groups are secure for DL-Problem?

I was wondering why some groups provide more security to cryptosystems relying on DL-Problem.
WonderHow20's user avatar
6 votes
1 answer
319 views

Is this distributed random oracle scheme safe?

This question comes from an issue raised in another question: Non interactive threshold signature without bilinear pairing (is it possible)? Is the proposed random oracle model safe when trying to ...
shumy's user avatar
  • 418
1 vote
1 answer
102 views

Derived keys usable by threshold signatures

Suppose there are $n$ members in a $(t,n)$ threshold signature scheme. The global secret key $sk$ is not known to any single party, as the keys are generated distributed. The parties are able to ...
Bernd Strehl's user avatar
3 votes
1 answer
768 views

Threshold decryption in multi-key homomorphic encryption

I have a problem understanding the security of threshold decryption in multi-key homomorphic encryption (MKHE) with so called "noise flooding". In particular I think that it is not secure, so probably ...
Tilen Marc's user avatar
4 votes
1 answer
587 views

In a shamir secret sharing scheme, why can't the secret be a middle coefficient and only the first or the last?

In the shamir secret sharing scheme, the Secret s is set as the constant in the equation $ y_p = s+ \sum_{i=0}^{i = t-1} a_i * x_p^i$ s can only be the constant term or the last coefficient or the ...
ackbar03's user avatar
3 votes
2 answers
318 views

Non interactive threshold signature without bilinear pairing (is it possible)?

All threshold signature schemes that I have seen need bilinear pairings to avoid parameter exchange between parties. These are normally commitment schemes for a certain secret. I believe a 2-round ...
shumy's user avatar
  • 418
0 votes
1 answer
120 views

Is there any implementation of threshold BGN homomorphic encryption? [closed]

The BGN paper (Evaluating 2-DNF Formulas on Ciphertexts) used a threshold variant of BGN. I also want to use this cryptosystem, however, I cannot find any open-source implementation. Is there any such ...
WYC's user avatar
  • 41
2 votes
0 answers
123 views

Distributed key generation (for discrete-log based cryptosystems) with fake shares

Under the definition of Gennaro et al (link), a DKG protocol needs to satisfy “correctness” and “secrecy”. Correctness is divided into three sub-properties: C1. All subsets of $t+1$ shares provided ...
Avilan's user avatar
  • 128
5 votes
2 answers
2k views

Formal Proof of Shamir's Secret Sharing Scheme Security

Shamir's Secret Sharing scheme is perfectly secure. Could you please suggest where I can read a formal proof of Shamir's Secret Sharing scheme being perfectly secure?
Natwar's user avatar
  • 441
1 vote
1 answer
176 views

Pairing-based cryptography VS ZK-proofs: what's more efficient for threshold systems?

In some papers (e.g. 1, 2) the authors approve that pairings are more efficient than classic zk-proofs (e.g. proof of discrete logarithm knowledge) for the described applications (threshold encryption,...
Skomorokh's user avatar