Reimagining Secret Sharing: Creating a Safer and More Versatile Primitive by Adding Authenticity, Correcting Errors, and Reducing Randomness Requirements

Abstract

Aiming to strengthen classical secret-sharing to make it a more directly useful primitive for human endusers, we develop definitions, theorems, and efficient constructions for what we call adept secret-sharing. Our primary concerns are the properties we call privacy, authenticity, and error correction. Privacy strengthens the classical requirement by ensuring maximal confidentiality even if the dealer does not employ fresh, uniformly random coins with each sharing. That might happen either intentionally—to enable reproducible secretsharing— or unintentionally, when an entropy source fails. Authenticity is a shareholder’s guarantee that a secret recovered using his or her share will coincide with the value the dealer committed to at the time the secret was shared. Error correction is the guarantee that recovery of a secret will succeed, also identifying the valid shares, exactly when there is a unique explanation as to which shares implicate what secret. These concerns arise organically from a desire to create general-purpose libraries and apps for secret sharing that can withstand both strong adversaries and routine operational errors.

STAR: Secret Sharing for Private Threshold Aggregation Reporting

“…4 We call this property share privacy. Such privacy guarantees are already formalized by Bellare et al [5] for secret sharing approaches based on traditional Shamir secret sharing.…”

“…browser user-agent), the set of applications installed on a device, or any other data. We assume that clients can optionally send arbitrary additional data with their measurement 5 . Further, there is some untrusted coalition of aggregation servers (≥ 1) that may corrupt some subset of clients.…”

“…This assumes that the hidden messages are sampled from distributions of sufficient entropy, though this is common for all secret sharing schemes[5].…”