CS 161 Computer Security
Fall 2005 Joseph/Tygar/Vazirani/Wagner Notes 16
In a secret sharing scheme there is a trusted authority TA and nusers U1,...,Un. The TA has a secret value
Kcalled the secret or key. The TA uses a share generation algorithm to split Kinto nshares s1,...,sn. Each
share siis then transmitted to user Uiby a secure channel. The secret sharing protocol guarantees that two
properties hold:
• A reconstruction algorithm can be used to efficiently reconstruct the secret Kfrom any tof the n
shares.
• Any t−1 of the nshares reveal no information about the secret K.
Such a scheme is called an (n,t)threshold scheme.
For example, if the secret Kis an integer between 0 and M−1, then an (n,n)threshold scheme can
be obtained by selecting s1,...,sn−1uniformly at randomly between 0 and M−1, and setting sn=K−
∑n−1
i=isimod M. Now,
•K=∑n
i=1simod M.
• Given all shares except sj,Kcan take on any value modulo M.
To understand how to implement a general (n,t)threshold scheme we need to understand some properties
of polynomials modulo a prime p. While working modulo a prime p, we can add, subtract and multiply
numbers, as well as divide numbers as long as we are not dividing by 0. So we can consider polynomials
whose coefficients are elements modulo p. For example f(x) = x2+2x+4 mod 5. It turns out that such
polynomials have many of the same properties as polynomials with real coefficients:
Polynomials
• A polynomial of degree nover a field Fhas at most nroots (this can be proved by induction).
• A polynomial Pof degree nis uniquely determined by any n+1 distinct pairs (xi,yi)such that P(xi) =
yi(this follows immediately from the previous property).
Suppose that we are given the value of a polynomial P(x)of degree nat n+1 points: P(ai) = bifor
i=1to n +1. How do we reconstruct the unique polynomial P(x)of degree nsatisfying these n+1
constraints?
Consider the following polynomials of degree n:
For i=1,2,...,n+1, define
∆i(x) = ∏
j6=i
(ai−aj)!−1
∏
j6=i
(x−aj).
CS 161, Fall 2005, Notes 16 1
