1
$\begingroup$

Is there any existing work on a 2D variant of a packed Shamir secret shares (see paper here), i.e., the secret shares pack values using a bivariate polynomial (to pack a matrix instead of a vector)?

$\endgroup$
2
  • $\begingroup$ can you explain or give references to what packed shamir secret sharing is? $\endgroup$ Commented Oct 25 at 23:14
  • 1
    $\begingroup$ @kodlu eprint.iacr.org/2023/536.pdf $\endgroup$ Commented Oct 30 at 6:31

1 Answer 1

0
$\begingroup$

The natural generalisation of SSS to a bivariate polynomial ring runs into issues due to the need to sample both variable without repetition. It's also not clear what the advantages of such a scheme might be.

Consider the bivariate polynomial over a finite field $$F(X,Y)=\sum_{i=0}^m\sum_{j=0}^n f_{i,j}X^iY^j$$ this has $mn$ coefficients and we can designate the constant term $f_{0,0}$ to be our secret while sampling the other coefficients uniformly from the field. From an information perspective, to recover all coefficients would require at least $mn$ sample evaluations.

However, due to separability, it is possible to recover some coefficients with fewer samples and for us to be unable to recover full information with arbitrarily large sample sets. For example, if we wish to recover $f_{0,0}$, note that $$F(X,Y)=\sum_{i=0}^m G_i(Y)X^j$$ where $$G_i(Y)=\sum_{j=0}^nf_{i,j}Y^j$$ if we restrict our samples to the set $Y=0$, with $m$ samples with distinct $X$ values, we can recover $G_i(0)$ for all $i$ using the 1-D interpolation. In particular, we recover $G_0(0)=f_{0,0}$ which is our secret. Conversely, if we restrict our samples to $Y=1$, after $m$ samples we recover $G_i(1)$ for all $i$ and taking more samples provides no new information. Clearly $G_i(1)$ for $i\neq 0$ is of no help to finding $f_{0,0}$ and determining $f_{0,0}$ from $G_0(1)$ is like trying to recover a 1-D SSS from a single sample. More generally, if we have fewer than $n$ distinct $Y$ values or fewer than $m$ distinct $X$ values, our method cannot succeed in recovering all coefficients.

$\endgroup$
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.