Secret Sharing

The fundamental architecture where a secret is divided into n distinct shares and distributed to n participants. Reconstruction requires any t (the threshold) shares to be combined. Any subset of t-1 or fewer shares reveals absolutely no information about the secret. This is formally expressed as a (t, n)-threshold scheme. In healthcare federated learning, this ensures that a global model update can only be decrypted when a quorum of participating hospitals collaborates, preventing any single compromised node from exposing patient-derived gradients.

Unlike computational security, which relies on the assumed hardness of mathematical problems (e.g., factoring large primes), Shamir's Secret Sharing provides unconditional, information-theoretic security. An adversary with fewer than t shares gains no mathematical advantage in guessing the secret, regardless of their computational power. This property is critical for long-term protection of sensitive medical data against future advances in quantum computing, ensuring that encrypted patient information remains secure indefinitely.

Shares in a Shamir scheme are additively homomorphic. If two secrets are independently shared among the same set of participants, the sum of the secrets can be reconstructed by combining the sums of the corresponding individual shares. No party needs to reveal their private input. This property is the cryptographic backbone of Secure Aggregation in federated learning, allowing a central server to compute the sum of model weight updates from multiple hospitals without ever seeing an individual hospital's contribution in plaintext.

A mechanism to defend against mobile adversaries who can compromise multiple nodes over time. In PSS, shares are periodically refreshed without changing the underlying secret. New, independent shares are generated and distributed, invalidating any shares an attacker may have previously accumulated. This ensures that an adversary must compromise the threshold number of nodes within a single refresh epoch to breach confidentiality. This is vital for long-running federated learning clinical trials that span years.

An extension that protects against malicious dealers who might distribute inconsistent or invalid shares. VSS protocols attach cryptographic commitments to each share, allowing participants to verify that their share is a valid piece of the original secret without revealing the secret itself. This prevents a denial-of-service attack where a rogue hospital in a federated network distributes corrupted shares to sabotage the collaborative model aggregation process.

During the reconstruction phase, a malicious participant might submit a false share to prevent the correct secret from being recovered or to cause a specific, attacker-chosen secret to be reconstructed. Robust secret sharing schemes incorporate error-correcting codes, such as Reed-Solomon decoding, to identify and exclude these fraudulent shares. This ensures the integrity of the final aggregated model in a federated learning round, even if a minority of participating nodes behave adversarially.

The canonical threshold scheme where a secret is encoded as the constant term of a random polynomial of degree t-1 over a finite field. Each participant receives a distinct point (x, f(x)) as their share. Reconstruction requires any t shares to solve for the polynomial via Lagrange interpolation, while t-1 shares reveal absolutely no information about the secret. This scheme provides information-theoretic security, meaning it is secure against adversaries with unlimited computational power.

Extends secret sharing into active cryptographic operations. A private key is split into shares distributed among n parties. A minimum threshold t of parties must collaborate to perform an operation—such as decryption or signing—without ever reconstructing the full key in a single location. This eliminates the single point of compromise inherent in traditional key management. Common instantiations include threshold RSA and threshold ECDSA for securing digital asset custody.

A cryptographic protocol enabling n parties to jointly compute a function f(x_1, x_2, ..., x_n) over their private inputs while ensuring that no party learns anything beyond the designated output. Secret sharing serves as the core encoding mechanism in many SMPC protocols, particularly those based on the SPDZ and BGW frameworks. Each input is secret-shared among all parties, and computation proceeds via interactive share manipulation, ensuring privacy against a coalition of up to t-1 corrupt parties.

An enhancement of standard secret sharing that protects against malicious adversaries—including a dishonest dealer who might distribute inconsistent shares. VSS protocols append cryptographic commitments to each share, allowing participants to verify that their share is a valid point on the dealer's polynomial without revealing the share itself. This guarantees robustness: the secret can be correctly reconstructed even if up to t-1 parties are actively malicious. Feldman's scheme using discrete log commitments is a widely used construction.

Addresses the threat of mobile adversaries who can compromise different parties over time. In PSS, shares are periodically refreshed without changing the underlying secret. Each party generates a new random polynomial with a zero constant term and distributes sub-shares to peers. After combining received sub-shares, old shares are securely deleted. This ensures an adversary must compromise t parties within a single refresh epoch to reconstruct the secret, providing long-term protection for cryptographic keys and data.

A protocol central to federated learning that computes the sum of model updates from multiple clients while keeping individual contributions private. Each client masks its update with pairwise secret-shared random seeds and a self-generated mask. During aggregation, pairwise masks cancel out, and the server reconstructs only the sum of updates after a threshold of clients survive dropout. This ensures the central server learns nothing about any individual client's gradient, protecting against gradient leakage attacks.