Secret sharing consists of recovering a secret S from a set of shares, each containing partial information about the secret. The Chinese remainder theorem (CRT) states that for a given system of simultaneous congruence equations, the solution is unique in some Z/nZ, with n > 0 under some appropriate conditions on the congruences. Secret sharing can thus use the CRT to produce the shares presented in the congruence equations and the secret could be recovered by solving the system of congruences to get the unique solution, which will be the secret to recover.
Secret sharing schemes: several types
There are several types of secret sharing schemes. The most basic types are the so-called threshold schemes, where only the cardinality of the set of shares matters. In other words, given a secret S, and n shares, any set of t shares is a set with the smallest cardinality from which the secret can be recovered, in the sense that any set of t − 1 shares is not enough to give S. This is known as a threshold access structure. We call such schemes (t, n) threshold secret sharing schemes, or t-out-of-n scheme. Threshold secret sharing schemes differ from one another by the method of generating the shares, starting from a certain secret. The first ones are Shamir's threshold secret sharing scheme, which is based on polynomial interpolation in order to find S from a given set of shares, and George Blakley's geometric secret sharing scheme, which uses geometric methods to recover the secret S. Threshold secret sharing schemes based on the CRT are due to Mignotte and Asmuth–Bloom, they use special sequences of integers along with the CRT.
Chinese remainder theorem
Let k ⩾ 2 , m 1 , . . . , m k ⩾ 2 {\displaystyle k\geqslant 2,m_{1},...,m_{k}\geqslant 2} , and b 1 , . . . , b k ∈ Z {\displaystyle b_{1},...,b_{k}\in \mathbf {Z} } . The system of congruences
{ x ≡ b 1 mod m 1 ⋮ x ≡ b k mod m k {\displaystyle {\begin{cases}x\equiv &b_{1}\ {\bmod {\ }}m_{1}\\&\vdots \\x\equiv &b_{k}\ {\bmod {\ }}m_{k}\\\end{cases}}}
has solutions in Z if and only if b i ≡ b j mod ( m i , m j ) {\displaystyle b_{i}\equiv b_{j}{\bmod {(}}m_{i},m_{j})} for all 1 ⩽ i , j ⩽ k {\displaystyle 1\leqslant i,j\leqslant k} , where ( m i , m j ) {\displaystyle (m_{i},m_{j})} denotes the greatest common divisor (GCD) of mi and mj. Furthermore, under these conditions, the system has a unique solution in Z/nZ where n = [ m 1 , . . . , m k ] {\displaystyle n=[m_{1},...,m_{k}]} , which denotes the least common multiple (LCM) of m 1 , . . . , m k {\displaystyle m_{1},...,m_{k}} .
… excerpt ends here. Continue reading the full article.
