1. How to Collaborate between Threshold Secret Sharing Schemes Daoshun Wang, Ziwei YeXiaobo Li Tsinghua University, ChinaUniversity of Alberta, Canada

2. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion Introduction A Simple Case with Two Secrets Cases with More Than Two Secrets Conclusion Threshold Secret Sharing Scheme (3,5) and (4,6) Scheme Construction General Scheme Construction More General Cases Demonstration of Security in Different Situation Introduction Outline

3. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion Introduction Shamir’s (k, n)-Threshold Secret Sharing Scheme (only one Dealer ) S(a0)S(a0) S(a0)S(a0) Reconstruction Distribution S can be reconstructed by k or more than shares Cannot obtain any information of S for k-1 shares or fewer

4. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusionIntroduction ? Each common participant must keep two or more shares which can be a burden. Each common participant keep only one share. Traditional Method Our Approach

5. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusionA Simple Case with Two Secrets Introduction A Simple Case with Two Secrets Cases with More Than Two Secrets Conclusion Threshold Secret Sharing Scheme (3,5) and (4,6) Scheme Construction General Scheme Construction Outline More General Cases Demonstration of Security in Different Situation

6. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion Bank1 (3, 5) key1 Bank2 (4, 6) key2 Collaborate An Example of Two Secrets

7. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusionA Simple Case with Two Secrets Introduction A Simple Case with Two Secrets Cases with More Than Two Secrets Conclusion Threshold Secret Sharing Scheme (3,5) and (4,6) Scheme Construction General Scheme Construction Outline More General Cases Demonstration of Security in Different Situation

8. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion Curve Construction for (3, 5) and (4, 6) Schemes

9. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion Curve construction for (3, 5) and (4, 6) Schemes

10. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion Curve construction for (3, 5) and (4, 6) Schemes Figure 1 shows the cross points between two curves, f 1 (x) and f 2 (x) Figure 1. The red curve shows polynomial f 1 (x) and the blue curve shows f 2 (x).

11. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusionA Simple Case with Two Secrets Introduction A Simple Case with Two Secrets Cases with More Than Two Secrets Conclusion Threshold Secret Sharing Scheme (3,5) and (4,6) Scheme Construction General Scheme Construction Outline More General Cases Demonstration of Security in Different Situation

12. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion General construction

13. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion General Scheme Construction

14. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusionCases with More Than Two Secrets Introduction A Simple Case with Two Secrets Cases with More Than Two Secrets Conclusion Threshold Secret Sharing Scheme (3,5) and (4,6) Scheme Construction General Scheme Construction Outline More General Cases Demonstration of Security in Different Situation

15. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusionCases with More Than Two Secrets Introduction A Simple Case with Two Secrets Cases with More Than Two Secrets Conclusion Threshold Secret Sharing Scheme (3,5) and (4,6) Scheme Construction General Scheme Construction Outline More General Cases Demonstration Different Situations for common participants

16. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion Demonstration Different Situations for common participants Case1: Consider three schemes, a (3, 5) scheme, a (4, 6) schemeand a (5, 7) scheme. The participants of are and. When and are the common participants involved all three schemes, i.e.,,. It is secure from the point of view of, since none of the other schemes or dealers can reveal the secret of.

17. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion Demonstration Different Situations for common participants Case2:

18. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion Demonstration of Security in Different Situation Case3:

19. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion (3,5), (4,6) and (5,7) Scheme Construction Secret Reconstruction Curve Construction

20. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion Curve Construction Collaboration among a (3, 5) scheme, a (4, 6) scheme and a (5, 7) scheme Suppose a 1,0 =1, a 2,0 =3, a 3,0 =5. Step 1:Dealer 1 constructs a (3, 5) scheme for Secret a 1,0 (integer 1). For p :,where For p 1 :,where This curve produces next six points, respectively: (0, 1), (1, 6), (2, 4), (3, 6), (4, 1), (5, 0) for p (0, 1),(1, 6),(2, 1),(3, 0),(4, 3),(5, 3 ) for p 1

21. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion Curve Construction Step 2: Dealer 2 constructs a (4, 6) scheme for Secret a 2,0 (integer 3). has three points: (0, 3), (1, 6), and (2, 4) with the same prime p ; ( (0, 3), (1, 6) and (2, 1) for p 2. He needs one more point and chooses (3, y ). y ∈ Z. i.e., ((3, f 2 (3)=3). Using Lagrange interpolation, When obtain next points: (0, 3), (1, 6), (2, 4), (3, 3), (4, 9), (5, 6), (6, 0); When q=p 2 =7 Dealer 2 uses the four points (0, 3), (1, 6), (2, 1) and (3, 3) to obtain this curve produces seven points: (0, 3), (1, 6), (2, 1), (3, 3), (4, 6), (5, 4), (6, 5).

22. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion Curve Construction Step 3: Dealer 3 constructs a (5, 7) scheme for Secret a 3,0 (integer 5). With a 3,0 =5, has four points: (0, 5), (1, 6), (2, 4) and (3, 6) with the same prime p (0, 5), (1, 6), (2, 1) and (3, 0) for p 3. He needs one more point and chooses another point, i.e.. we can obtain using Lagrange interpolation : When then obtain (0, 5), (1, 6), (2, 4), (3, 6), (4, 3), (5, 3), (6, 9), (7, 8),. When Dealer 3 gets And has (0, 5), (1, 6), (2, 1), (3, 0), (4, 3), (5, 0), (6, 4), (7, 7).

23. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion Curve Construction Figure 2. the same pFigure 3. different p Figure 2 shows the cross points among three curves with the same p. Figure 3 shows the cross points among three curves with the different p. f 1 (x) (red curve), f 2 (x) (blue curve) and f 3 (x) (green curve)

24. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion (3,5), (4,6) and (5,7) Scheme Construction Secret Reconstruction Curve Construction

25. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion Secret Reconstruction

26. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusionCases with More Than Two Secrets Introduction A Simple Case with Two Secrets Cases with More Than Two Secrets Conclusion Threshold Secret Sharing Scheme (3,5) and (4,6) Scheme Construction General Scheme Construction Outline More General Cases Demonstration Different Situations for common participants

27. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion More General Cases Suggestion: The dealer of a scheme should always try to allow a minimum number of shares to be known to other dealers, in order to minimize the exposure to the outside. When a dealer receives one or more shares from a collaborating scheme to distribute to his participants, he may want to use these very shares as his first choice to give out to other dealers, instead of giving out his own more “private” shares that no other dealers know already.

28. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion More General Cases When there are s (s ≥2) secrets to be protected, multiple threshold schemes{(t 1,n 1 ), (t 2,n 2 ),…, (t s, n s )} can be used. If there are u common participants, we can construct s polynomials f 1 (x), f 2 (x), …, f s (x) with u common crossover points, where u≤min (t 1, t 2, …, t s )-1. Here, the polynomials are The value of p in these s polynomials f 1 (x), f 2 (x), …, f s (x) may not be the same, ， it is possible that when

29. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion Introduction A Simple Case with Two Secrets Cases with More Than Two Secrets Conclusion Threshold Secret Sharing Scheme (3,5) and (4,6) Scheme Construction General Scheme Construction (3,5), (4,6) and (5,7) Scheme Construction Demonstration of Security in Different Situation Outline

30. IntroductionA Simple Case with Two SecretsCases with More Than Two SecretsConclusion This paper proposes a basic collaboration mechanism for two or more threshold schemes to insure that each common participant keeps only one share. The scheme collaboration raises a number of other issues. the security concerns involving dishonest common participants and dealers of different schemes and the situation where other dealers becoming participants of a scheme various combinations and risks exist in this more “open” environment tracing traders could become more difficult than in the traditional single scheme situation