Questions tagged [threshold-cryptography]
Threshold cryptography is the art of chopping a secret into little bits, so that the secret can only be learned by possessing more than a threshold number of those bits.
110 questions
2
votes
0
answers
36
views
About The Threshold Signature Scheme in the Paper "Threshold Cryptosystems from Threshold Fully Homomorphic Encryption"
I have read the paper "Threshold Cryptosystems from Threshold Fully Homomorphic Encryption" [BGG+17] and would like to ask about the threshold signature scheme construction in Section 8.2.
...
- 41
2
votes
0
answers
39
views
About NIZK with Preprocessing
This is the first time I ask a question on StackExchange, so please forgive me for any mistake. I am trying to understand the paper "Threshold Cryptosystems from Threshold Fully Homomorphic ...
- 41
1
vote
1
answer
48
views
Does FROST threshold signing go well with BIP340?
FROST is a popular threshold signing protocol for Schnorr-style signatures.
BIP340 is a specification for an instantiation of a Schnorr-style signature scheme for Bitcoin Taproot. Specifically, they ...
- 697
0
votes
1
answer
70
views
Can parties in an MPC protocol establish a shared secret with an external party?
Creating a shared secret(ECDH) with a single private key is easy:
a·B = b·A
Does the same apply to MPC? and if so how?
Based on Gennaro and Goldfeder CCS 2018
2
votes
0
answers
66
views
what is exactly the meaning of fairness in MPC?
According to this paper ,
Gordon, D., Hazay, C., Katz, J., Lindell, Y.: Complete fairness in
secure two-party computation. In: Proc. 40th Annual ACM Symposium on
Theory of Computing (STOC) (2008)
...
- 71
0
votes
0
answers
46
views
BGW Multiplication with byzantine adversaries
I have recently read about the BGW Multi-party Computation protocol, more specifically the multiplication gate by Gennaro et al (PDF here), however, some concepts raised questions.
Context: From what ...
2
votes
0
answers
81
views
threshold signature scheme that allows adding and removing members
Is there a threshold signature scheme (TSS) that a quorum in a group can sign, where members can dynamically join and leave, without changing the shared group public key? ECDSA, BLS, and Schnorr based ...
- 185
0
votes
1
answer
113
views
Threshold ed25519: How to export keys?
Consider ed25519 signing (RFC 8032).
There, the private key is a 32-byte random value, and for signature generation, the 32-byte private key is first hashed and then the secret scalar and nonce are ...
- 697
0
votes
1
answer
47
views
Threshold signature scheme for centralized group broadcast
I am looking for a threshold signature scheme (or similar proposals are happily accepted) that suits the following scenario:
One Base Station is transmitting signed broadcast message to all members in ...
- 101
2
votes
0
answers
66
views
Does the participant-to-participant secret share in FROST distributed key generation need to remain confidential?
In its application of Shamir secret sharing, the FROST paper in Figure 1 Round 2 Step 1 requires each participant $P_i$ to securely send to each other participant $P_\ell$ a secret share $(\ell, f_i(\...
- 63
0
votes
1
answer
114
views
Threshold encryption
Is there any (k,n)-threshold encryption scheme, such that the decryption process is non-interactive, i.e., the decryption can be processed "in a line" where each party "in the middle of ...
- 99
1
vote
0
answers
81
views
Impact of New Secret Sharing Paper with $O(n)$ additions for recovery
I hope this question is not too speculative.
Applebaum, Nir and Pinkas have a new paper which has an $n-$party secret sharing scheme with:
reconstruction complexity of $O(n)$ additions
constant share ...
- 23.7k
1
vote
1
answer
103
views
Threshold Paillier encryption key generation time
I have used the threshold version of Paillier encryption without a trusted dealer in an application. I have tested the key generation phase with different security key sizes such as 80, 512, 1024, and ...
- 11
2
votes
2
answers
284
views
Can you re-encrypt data without knowing what the data is or using PRE?
I'm currently working on a distributed consensus-based system. I currently give the system a private key through a threshold encryption model, and I want to be able to take some data encrypted with ...
- 21
2
votes
1
answer
133
views
Question about Threshold signature scheme "GG18"
I recently read the article on the threshold signature scheme “Fast Multiparty Threshold ECDSA with Fast Trustless Setup” and I have a question.
In the key generation section, each player $P_i$ ...
0
votes
0
answers
56
views
order of Lagrange interpolation in reconstruction of secret key
Does the order of Lagrange interpolation have any role in reconstructing the secret key in Shamir's secret share?
2
votes
0
answers
24
views
Which channel protocol should I use to broadcast the message between parties?
I am building the Threshold Signature Scheme (TSS) based wallet. I would like to run the each party's node separately with different host. And these nodes should be able to send the messages through ...
0
votes
1
answer
490
views
Use Shamir's Secret Sharing Scheme to split a key between a client, a server and multiple 3rd parties
I'm trying to design an encryption system for a new mobile app and am thinking of using Shamir's Secret Sharing Scheme in a way which I have not seen before. Does this seem possible or does it violate ...
- 133
2
votes
2
answers
505
views
Implementing ECDSA threshold using a secret sharing scheme
My question might be a duplicate but I wasn't able to find a similar question.
I recently developed a wallet-like app and I am trying to implement some MPC features.
I searched a little and even asked ...
- 21
2
votes
1
answer
341
views
Shamir's secret sharing homomorphism for different degree polynomials
The $(t,n)$ Shamir’s polynomial based secret sharing scheme is $(+,+)$-homomorphic in which the addition of two polynomials secrets equals the Lagrange’s interpolation of the sum-of-shares for the ...
- 327
0
votes
1
answer
201
views
Increase encryption key length in Shamir secret sharing
Can Shamir's secret sharing work on any size of key?
- 33
4
votes
1
answer
173
views
Is there any threshold-crypto library that is production-ready?
I am wondering if there is any available threshold crypto library that is well-audited and ready to be used in production.
Any pointer is appreciated.
1
vote
0
answers
79
views
What are the uses of shared cipher texts and signatures?
In Distributed Key Generation(DKG), why is there a need to actually create a master secret which can then derive into a single public and private keypair(for signatures) and a secret key(encryption)?
...
- 159
2
votes
0
answers
195
views
Is there a Ed25519 threshold signature protocol similar to the Gennaro-Goldfeder schema for ECDSA?
I keep searching online and asking in different cryptographic communities whether there is a similar threshold signature schema (or a close one) to what Gennaro and Goldfeder proposed for ECDSA?
...
- 121
2
votes
1
answer
593
views
Sage code for finding generator matrix of MDS code
Let $L$ be an $[n,k]$ code. A $k\times n$ matrix $G$ whose rows form a basis for $L$ is called a generator matrix for $L$.
A linear $[n,k,d]$ code with largest possible minimum distance is called ...
- 23
4
votes
1
answer
162
views
BGW multiplication by Gennaro et al.: Why does H(x) have exactly degree t and why is $2t + 1 \le n$ necessary?
With this question I am referring to the BGW multiplication by Gennaro et al (PDF here).
The multiplication is described on the 4th page.
(Another source for me was "A pragmatic Introduction to ...
- 43
2
votes
1
answer
98
views
Threshold implementation of ciphers
What is the principle behind threshold implementation of block ciphers and how is this protecting against side channel attacks?
- 1,105
1
vote
1
answer
263
views
Gennaro & Goldfeder Key Generation Protocol
As I am going through the “Fast Multiparty Threshold ECDSA with Fast Trustless Setup” paper by Gennaro & Goldfeder, 2018, I am stumbled by the key generation protocol (Sect. 4.1, p.10):
In Phase ...
- 197
1
vote
1
answer
81
views
Coin tosses in the context of commitment schemes
I was reading the “Fast Multiparty Threshold ECDSA with Fast Trustless Setup” paper by Gennaro & Goldfeder, 2018 and I encountered this portion (Sect. 2.4, p.6):
This excerpt leaves me slightly ...
- 197
0
votes
1
answer
159
views
Are Shamir shares independent?
Assume we have a secret $s \in Z_p$. We generate the set of secret shares $\{ (x_i, s_i) \}_{i=1}^{N}$ according to a $(N,k)$ Shamir's scheme. The evaluations are generated according to the following ...
2
votes
0
answers
52
views
Threshold Signature with Accumulation Scheme?
Is there a threshold signature scheme that can be accumulated? That is, given a message $M$ signed by $k-1$ parties and the $(k-1)$-threshold signature $\sigma_{k-1}$, a party can verify $\sigma_{k-1}$...
- 21
0
votes
1
answer
65
views
summation problem?
Let there are two given numbers $x,y$ which is $A=x+y$ and we know just $A$. How we can find this just $x$ and $y$?
If you suppose $a$ a random number, then we know $x_1=a$ and $y_1=A-a$ satisfies in $...
- 101
1
vote
0
answers
98
views
Distributed Random Oracle with Verifiable Shares
$Setup$:
Let's assume a quorum of $n$ nodes where each have a secret share $y_i$ from a know and safe leaderless DKG protocol.
Define $\mathcal{L}^i(y_i) = y$ as the lagrange interpolation for $x=0$, ...
- 418
2
votes
1
answer
120
views
How to do unmasked addition on SSS masked shares?
I'm trying to understand how Shamir's Secret Sharing algorithm is applied to AES when doing threshold masking.
I understand how the secrets are created and the secret is calculated and I'm now trying ...
- 185
1
vote
0
answers
40
views
Threshold signature verified by an equivalent key
I am looking for references for the following problem:
Consider we have a DSA with the keypair $(sk, pk)$ and a message $m$, such that its signature is $s = sig(m,sk)$ and the verification result is $...
- 11
1
vote
0
answers
315
views
Understanding multiplication of Shamir secret sharing during threshold (EC)DSA signing
I have been looking at the threshold (EC)DSA schemes for honest majority by Gennaro et al. https://www.sciencedirect.com/science/article/pii/S0890540100928815. In the scheme, there are steps where we ...
- 93
6
votes
1
answer
222
views
Secure Secret Sharing to a Distributed Key
Setup
There are two groups, $A$ and $B$. Each group is in a Shamir's secret sharing scheme ($t_A$ of $N_A$ and $t_B$ of $N_B$). Each group has a public key that is associated with the identity of the ...
- 1,421
4
votes
2
answers
348
views
Would EdDSA be broken by replacing H(R, A, M) with H(A, M)?
An EdDSA signature is (R, S) where R = r*B and S = r + H(R, A, M)*s. Notation from Wikipedia en.wikipedia.org/wiki/EdDSA.
Given that the hash function H, is indeed collision-resistant, would using S = ...
- 375
1
vote
0
answers
65
views
Threshold Encryption Scheme for Multiple Messages
In a threshold encryption scheme, a dealer generates $(PK,SK1,…,SKn)$ and distributes the secret keys to users indexed by $1,…,n$, and if a combiner obtains $t+1$ partially-decrypted ciphertexts, it ...
- 31
2
votes
0
answers
62
views
Threshold lower than $\dfrac{n}{2}$ in distributed key generation
While I was studying protocols for distributed key generation with malicious adversaries, Gennaro et al.$^{[1]}$ pointed out that the protocols that provide both secrecy and robustness should have a ...
- 21
2
votes
2
answers
170
views
Black-box secret sharing schemes
Do black box secret sharing schemes [DF90, DF94] have any advantages over the better-known secret sharing schemes like Shamir’s [Sham79]?
[DF90]: Threshold cryptosystems, by Desmedt, Yvo and Frankel, ...
- 310
2
votes
1
answer
102
views
Problems on ANF equation?
I tried to solve SBox as given in this link
I am trying to understand this paper SBox. In this on page no.4 the correct equation of given SBox is mentioned. I am not getting how to design ANF equation ...
1
vote
0
answers
78
views
Generate ANF equation? [duplicate]
Given an SBox, how can I generate its component equations (in ANF)?
given in this link: https://en.wikipedia.org/wiki/Algebraic_normal_form
For example, let's say I have this SBox:
$$\{1, a, 4, c ,6 ,...
0
votes
0
answers
74
views
Privacy preserving aggregation of encrypted data
I have the following problem: I have $t$ servers $S_1, S_2, S_3, \ldots, S_t$, each of them storing some $key : value$ list. They have to upload this data into a big dropbox server $D$, but in such a ...
- 235
0
votes
1
answer
109
views
Practical Threshold Signatures
In Practical Threshold Signature it says that there is a requirement in which the RSA public exponent $e$ must be more than $l$. $l$ in this case is the number of players in the threshold group.
My ...
2
votes
0
answers
61
views
Which groups are secure for DL-Problem?
I was wondering why some groups provide more security to cryptosystems relying on DL-Problem.
- 31
6
votes
1
answer
322
views
Is this distributed random oracle scheme safe?
This question comes from an issue raised in another question: Non interactive threshold signature without bilinear pairing (is it possible)?
Is the proposed random oracle model safe when trying to ...
- 418
1
vote
1
answer
118
views
Derived keys usable by threshold signatures
Suppose there are $n$ members in a $(t,n)$ threshold signature scheme. The global secret key $sk$ is not known to any single party, as the keys are generated distributed. The parties are able to ...
- 161
3
votes
1
answer
893
views
Threshold decryption in multi-key homomorphic encryption
I have a problem understanding the security of threshold decryption in multi-key homomorphic encryption (MKHE) with so called "noise flooding". In particular I think that it is not secure, so probably ...
- 133
4
votes
1
answer
630
views
In a shamir secret sharing scheme, why can't the secret be a middle coefficient and only the first or the last?
In the shamir secret sharing scheme, the Secret s is set as the constant in the equation
$ y_p = s+ \sum_{i=0}^{i = t-1} a_i * x_p^i$
s can only be the constant term or the last coefficient or the ...
- 97