Secret Sharing

The core mechanism where a secret is divided into n shares, and any t shares are sufficient to reconstruct it, while any t-1 shares reveal absolutely no information. This (t, n)-threshold scheme eliminates single points of failure and enforces group-based authorization. For example, a (3, 5)-threshold scheme requires any 3 of 5 executives to unlock a corporate signing key, protecting against both individual compromise and collusion of fewer than 3 parties.

The most widely implemented scheme, invented by Adi Shamir in 1979, which encodes the secret as the constant term of a random polynomial of degree t-1 over a finite field. Each share is a distinct point on this polynomial. Reconstruction uses Lagrange interpolation to recover the polynomial and thus the secret. This method is information-theoretically secure, meaning even an adversary with unlimited computational power cannot break it without the threshold number of shares.

An extension that protects against malicious dealers who might distribute inconsistent shares. VSS protocols publish cryptographic commitments to each share, allowing participants to independently verify that their share is a valid point on the dealer's committed polynomial. This is critical in adversarial environments like decentralized finance (DeFi) and distributed validator technology, where participants cannot trust a central authority.

A dynamic scheme where shares are periodically refreshed without changing the underlying secret. Old shares are destroyed and new shares of the same secret are generated. This defends against mobile adversaries who slowly compromise nodes over time. An attacker must compromise the threshold number of shares within a single refresh epoch, dramatically raising the security bar for long-lived secrets like certificate authority root keys.

A simpler scheme where a secret s is split into n random shares that sum to s modulo some integer. Reconstruction requires all n shares, making it an (n, n)-threshold scheme. While less flexible than Shamir's, additive sharing is computationally trivial and forms the basis for many secure multi-party computation (SMPC) protocols, where parties perform linear operations directly on their local shares without revealing them.

Unlike computationally secure encryption that relies on hard mathematical problems, perfect secret sharing schemes provide unconditional security. An adversary with fewer than the threshold number of shares gains zero information about the secret, regardless of computational power. This property makes secret sharing ideal for protecting long-lived secrets that must remain secure against future advances in quantum computing and algorithmic breakthroughs.

The classic algorithm invented by Adi Shamir that defines a secret as a point on a polynomial. The secret can only be reconstructed when a threshold number of shares are combined.

• Mechanism: A dealer encodes a secret as the constant term of a random polynomial of degree t-1. Each participant receives one point on the curve. Any t points can reconstruct the polynomial via Lagrange interpolation.
• Application: Splitting a private decryption key for a fraud model into 5 shares, where any 3 compliance officers must be present to authorize a sensitive query.

An extension of standard secret sharing that protects against malicious dealers who might distribute inconsistent shares. VSS allows participants to verify that their shares are valid and will reconstruct the same secret.

• Commitment schemes: The dealer broadcasts cryptographic commitments to all shares. Each participant can check their share against the commitment without learning others' shares.
• Fraud prevention: In a federated fraud detection system, VSS ensures a compromised node cannot sabotage the collaborative model by submitting corrupted secret shares during the aggregation phase.

A system where a cryptographic operation, such as signing a transaction or decrypting a model, requires a minimum number of parties to cooperate. It is built directly on top of secret sharing schemes.

• Distributed key generation: The private key is never assembled in one place. It exists only as distributed shares. Signatures are produced through an interactive protocol between the share-holders.
• Operational security: A bank can require 3 out of 5 security administrators to cryptographically sign off before a frozen account suspected of synthetic identity fraud is unlocked.

A foundational protocol for secure two-party computation where a function is represented as a boolean circuit. The circuit's wires are encrypted, allowing evaluation without revealing the inputs.

• Process: One party (the garbler) encrypts the circuit. The other party (the evaluator) uses oblivious transfer to get keys corresponding to its input and evaluates the circuit gate by gate.
• Relevance: Allows two competing financial institutions to run a shared fraud detection algorithm on their combined data without exposing individual customer transactions to the other party.

A security mechanism that periodically refreshes the shares of a secret without changing the secret itself. This defends against mobile adversaries who slowly compromise nodes over time.

• Share refreshment: Participants generate new random polynomials that encode zero and add these to their existing shares. Old shares become useless to an attacker.
• Long-term protection: A fraud model's master decryption key can be stored in a distributed system for years. PSS ensures that an attacker must compromise the threshold number of nodes within a single epoch, not over the entire lifetime of the system.