[deleted]
Ssss: Shamir's Secret Sharing Scheme (2006)
21–30 of 51 posts
Re: Ssss: Shamir's Secret Sharing Scheme (2006)
#22This is a wonderfully simple scheme to split up keys between parties, but this still involves a party (the one that made the key) at some point knowing the key. This scheme implies you trust this distributor not to make copies of the key for himself (queue sauron references...). I've wondered if there's a scheme that does NOT trust the distributor of the key. What if the only time they key was known was when the part…
Plenty. Look into publicly verifiable secret sharing. https://en.wikipedia.org/wiki/Publicly_Verifiable_Secret_Sha...
That doesn't seem to answer the question - the schemes on your link still have a dealer with access to the original secret I think? Is it possible to have each participant contribute an input that forms part of the original secret, such that they get combined to form the secret and then split into shares in a way that doesn't require a dealer?
Re: Ssss: Shamir's Secret Sharing Scheme (2006)
#23This is a wonderfully simple scheme to split up keys between parties, but this still involves a party (the one that made the key) at some point knowing the key. This scheme implies you trust this distributor not to make copies of the key for himself (queue sauron references...). I've wondered if there's a scheme that does NOT trust the distributor of the key. What if the only time they key was known was when the part…
Yes, there are threshold cryptography schemes with "distributed key generation" [1] in which the parties end up holding shares but the full secret is never known to any party. Then, to your point about "the only time they key was known was when the parties reached quorum after the fact": in these schemes, some threshold of the parties can cooperate to compute a function of the secret (e.g. a signature, or a ciphertext) without any of them ever knowing the secret.
FROST is one example of such a threshold scheme, for computing Schnorr signatures: https://eprint.iacr.org/2020/852.pdf
[1] https://en.wikipedia.org/wiki/Distributed_key_generation
Re: Ssss: Shamir's Secret Sharing Scheme (2006)
#24This is a wonderfully simple scheme to split up keys between parties, but this still involves a party (the one that made the key) at some point knowing the key. This scheme implies you trust this distributor not to make copies of the key for himself (queue sauron references...). I've wondered if there's a scheme that does NOT trust the distributor of the key. What if the only time they key was known was when the part…
You can do that using Multi Party Computation. There are a bunch of MPC protocols for generating Eliptic Curve private keys and doing DSA where the whole private key is never assembled. It uses Shamir Sharings as part of the magic, it's quite neat :)
Re: Ssss: Shamir's Secret Sharing Scheme (2006)
#25This is a wonderfully simple scheme to split up keys between parties, but this still involves a party (the one that made the key) at some point knowing the key. This scheme implies you trust this distributor not to make copies of the key for himself (queue sauron references...). I've wondered if there's a scheme that does NOT trust the distributor of the key. What if the only time they key was known was when the part…
Sure.
One example is as follows: each party i generates a random polynomial P_i, and n secret shares of that polynomial (j, P_i(j)) for j in 1..n
Then, party i sends (j, P_i(j)) to party j. Party i similarly receives shares (i, P_j(i)) for j=1..n. Party i stores the share (i, sum(P_j(i))).
Then, parties reveal their shares as usual, the secret is then the sum_i P_i(0).
Of course, if the parties are dishonest, you might want some additional safety mechanisms, which can be dealt with with Kate commitments.
This papers https://eprint.iacr.org/2020/504.pdf goes into details, and much more.
Re: Ssss: Shamir's Secret Sharing Scheme (2006)
#26Re: Ssss: Shamir's Secret Sharing Scheme (2006)
#27Earlier quoted context omitted.
Quoted post unavailable.
iiuc HN flags new accounts by creation time and not activity (e.g. less than N days old)
iiuc it's by activity. The user isn't green because they've posted the link several times, just never stuck around to comment.
This is a one-way relationship, users like these detract from the conversation, they have one thing to say only and every time it only benefits them. Downvote me for being a jerk, I don't care, I'm not wrong. They probably don't mean any harm, and maybe aren't free to speak in a job context on unrelated things, but surely they have to understand how it would make some of us feel a bit used.
Re: Ssss: Shamir's Secret Sharing Scheme (2006)
#28This is a wonderfully simple scheme to split up keys between parties, but this still involves a party (the one that made the key) at some point knowing the key. This scheme implies you trust this distributor not to make copies of the key for himself (queue sauron references...). I've wondered if there's a scheme that does NOT trust the distributor of the key. What if the only time they key was known was when the part…
Re: Ssss: Shamir's Secret Sharing Scheme (2006)
#29This is a wonderfully simple scheme to split up keys between parties, but this still involves a party (the one that made the key) at some point knowing the key. This scheme implies you trust this distributor not to make copies of the key for himself (queue sauron references...). I've wondered if there's a scheme that does NOT trust the distributor of the key. What if the only time they key was known was when the part…
Yes, there are threshold cryptography schemes with "distributed key generation" [1] in which the parties end up holding shares but the full secret is never known to any party. Then, to your point about "the only time they key was known was when the parties reached quorum after the fact": in these schemes, some threshold of the parties can cooperate to compute a function of the secret (e.g. a signature, or a ciphertex…
A similar scheme we use in drand is this: https://www.researchgate.net/publication/225722958_Secure_Di...
Re: Ssss: Shamir's Secret Sharing Scheme (2006)
#30Use MPC instead? Sadly there are not enough mature open source projects around: https://github.com/ZenGo-X/multi-party-ecdsa and you can always take a look at https://github.com/rdragos/awesome-mpc
Sadly companies like Unbound were acquired by Coinbase and the OSS codebase is not longer maintained: https://github.com/unboundsecurity/blockchain-crypto-mpc