6

If I am decoding a key by applying shares, is it possible to know when the threshold has been reached, and the secret revealed, without having to be told what the threshold is?

Also, is it possible to determine if a share is a "valid" share (ie originally generated by SSS for a given secret)?

Patriot
  • 3,162
  • 3
  • 20
  • 66
jmls
  • 61
  • 1

2 Answers2

5

Yes. If all of the shares you have are valid, you can tell when you have reached the threshold. Reconstructing the secret from $t+1$ shares will yield the same result as reconstructing the secret from $t+2$ shares. Reconstructing it from $t-1$ will however (always) yield a completely different result. Reconstructing the secret from $t-2$ or fewer shares will yield a different result with probability $1-1/q$, provided that all of the coefficients (except order $0$ and order $t-1$) are selected uniformly from $\mathbb{Z_q}$ and the high order coefficient uniformly from $\mathbb{Z_q^*}$. If "weak sharings" are avoided by selecting all coefficients to be non-zero, the probability will be slightly off.

For instance, if you are using Lagrange basis polynomials for reconstructing the original polynomial, adding more shares over the threshold will not increase the degree of the resulting polynomial and the zero degree term will remain constant.

There exist variants of Secret Sharing that will allow you to verify if a share is valid or invalid, such as Pedersen Verifiable Secret Sharing.

Henrick Hellström
  • 10,556
  • 1
  • 32
  • 59
1

No, you don't know when the threshold has been reached unless you encode it into your share's format.

To understand this, I'll quickly revise how SSS works:
The person to share a secret constructs / chooses a random (large) prime and chooses $k$ random numbers (the coefficients), where $k$ is the threshold. From the coefficients he constructs a polynomial. For each share, he picks a random $x$ and evaluates the polynomial of the $x$ to receivce a random $y$ in return. A pure share is just the pair $(x,y)$.

Obviously, you can't learn the degree of the polynomial from a bunch of (random) points so there's no way to recover the threshold (which is the degree + 1). You can however define a format for your shares that includes a) the prime generating the needed field, b) the threshold, c) the $x$ value of your share and d) the $y$ value of your share. In this case you can recover the threshold from your shares.

Is it possible to determine if a share is a "valid" share?

No.
As explained above, a share is (maybe) some general parameters (threshold, prime) and a point. As the x-coordinate of the point should be completely random, the y-coordinate will also be random and so there's always a polynomial going through that point.

SEJPM
  • 46,697
  • 9
  • 103
  • 214