[Cryptography] Elliptic Curve Key Sharing

Nathaniel McCallum npmccallum at redhat.com
Fri Oct 9 17:35:49 EDT 2015


Alice does an independent ECDH (using private key X) with n parties (in
this case 3: A, B, C) such that she has:

k1 = g^(XA)
k2 = g^(XB)
k3 = g^(XC)

She has now discarded X.

She would like to encrypt a secret S such that any combination of r (in
this case 2) keys will allow decryption. Normally, she'd use Shamir's
Secret Sharing. But she doesn't know of any way to apply SSS to
elliptic curve points.

Are there any methods commonly available?

Can the simple "brute-force" method work without revealing any data
about the keys? For example:

c1 = S + g^(XA) + g^(XB)
c2 = S + g^(XA) + g^(XC)
c3 = S + g^(XB) + g^(XC)

Nathaniel


More information about the cryptography mailing list