{"id":"e98646df-d460-44b0-b3cb-b935a3a9a658","arxiv_id":"1908.02110","paper_version":2,"verdict":"REJECT","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"A linear-code threshold changeable secret sharing scheme that masks shares with random multiples of q is claimed to be asymptotically perfect, but the security proofs ignore the reduced entropy of the dealer's randomness and the scheme leaks the secret.","lead":"The paper proposes a secret sharing scheme that claims to raise the reconstruction threshold by masking shares with random multiples of a small prime. It also builds a group authentication protocol on top, but the security proof is flawed and an adversary can recover the secret from fewer components.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Load-bearing flaw: Theorem 4's Eq. 7 assumes the sum of m components is uniform over F_p, but it is confined to s+qR; an m-1 component set leaks Ω(1) bits, so the asymptotically perfect claim fails.","rationale":"The reader's rejection is correct. I would state the core failure as a false uniformity assertion rather than solely as reduced entropy of v: even if v were drawn uniformly from F_p^t subject to s=v·g0∈F_q, the sum Σ c_i is exactly s+qΣr_i and is confined to at most m q^2 values, so Eq. 7's 'left side is uniformly distributed over F_p' cannot hold. The sieve attack is a direct consequence: for t=2,m=3 the adversary reduces the posterior support of s from F_q to about 1+q^3/p values, which for fixed n is a constant-bit leak and contradicts lim I=0. The t=1 case described by the reader is a special instance of the same structure. The application section inherits the flaw because Theorems 5 and 6 call Theorems 2 and 3. There is no formal verification, and the proof of Corollary 1 is explicitly omitted, so the analytic security argument carries the whole claim. I therefore recommend no change to the reader's REJECT verdict; my attack is a different route to the same conclusion, hence partial agreement with the reader's stated weakest assumption.","tokens_in":14453,"tokens_out":25818,"duration_ms":261818,"concrete_test":"Run a simulation of the t=2, m=3, n=3 case with q=31 and a prime p>3q^2 (e.g., p=2887). Generate 100 random instances of the full scheme; for each, give an adversary the two valid components c1,c2. The adversary enumerates all (r1,r2)∈F_q^2, computes the implied pair of shares (b_i^{-1}(c_i-r_i q) mod p), solves the 2×2 linear system for the dealer vector v, and keeps the resulting secret s'=v·g0 only if s'∈F_q. Record the number of surviving candidate secrets and whether the true secret is among them. If the average number of survivors is about 1+q^3/p (≈11) rather than close to q, and the gap persists when q is increased to 101 with p>3q^2, the uniform-distribution premise behind Eq. 7 is false and the asymptotic-perfect security claim fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is Theorem 3/4: an adversary with fewer than m components learns almost nothing. The proof of Theorem 4 (Eq. 7) requires the quantity (Σ_{i∈Im} c_i mod p - s') to be uniformly distributed over F_p 'according to Lemma 2'. This is false. In the scheme, Σ_{i∈Im} c_i ≡ s + q Σ_{i∈Im} r_i (mod p), with s∈F_q and each r_i∈F_q. Since p>nq^2 and m≤n, the integer s+qΣr_i is below nq^2<p, so the sum's support has size at most m q^2, not p. The same non-uniformity invalidates Theorem 3's assertion that Σ c_i is uniform over F_p. Concretely, take t=2, m=3. An adversary holding c_1,c_2 can enumerate all (r_1,r_2)∈F_q^2, recover the implied dealer vector v from the two adjusted shares, and keep only candidates with s'=v·g_0∈F_q. The true pair survives. A random wrong pair produces s'∈F_q with probability q/p, so the expected number of false candidate secrets is q^3/p, and since p>nq^2 this is < q/n. The posterior support of s is therefore about 1+q/n values rather than q, which gives I(s;C_j)≥log n - o(1), not 0. The group-authentication application inherits the failure because Theorems 5 and 6 rely on Theorems 2 and 3. The proof of Corollary 1 is also explicitly omitted.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This manuscript proposes a threshold changeable secret sharing (TCSS) scheme based on linear codes. The dealer chooses a secret s in F_q and a row vector v in F_p^t satisfying s = v·g0 mod p, computes shares s_i = v·g_i mod p, and distributes them. To reconstruct with a set of m participants, each participant publishes a component c_i = b_i s_i + r_i q mod p, where r_i is chosen uniformly from F_q and b_i are public coefficients satisfying g0 = Σ b_i g_i. The reconstruction formula s = (Σ c_i mod p) mod q is shown to be correct. The paper claims that fewer than m components reveal asymptotically no information about the secret (Theorems 2-4), that the scheme resists illegal participant attacks without any computational assumption, and that it achieves 'asymptotically perfect' security. A group authentication scheme is then built on the TCSS scheme in Section 5, with security inherited from Theorems 2 and 3.","tokens_in":14784,"tokens_out":10460,"duration_ms":102532,"significance":"If the security claims were correct, the paper would present a clean, dealer-free threshold-changeable secret sharing scheme with information-theoretic security, together with a simple group authentication protocol. The construction is easy to understand and the correctness proof (Theorem 1) is sound. However, the central security analysis is invalid: the distributional assumptions underlying Theorems 2-4 are false, and a concrete attack shows that m-1 components leak a non-vanishing amount of information about the secret. Because the group authentication application relies directly on these theorems, the contribution is not established.","major_comments":[{"comment":"The proof of Theorem 4 asserts that the left side of Eq. (7), namely (Σ_{i=1}^m c_i mod p) - s', is uniformly distributed over F_p according to Lemma 2. This is false. For an honest component set, Σ_{i∈I_m} c_i ≡ s + q Σ_{i∈I_m} r_i (mod p), with s∈F_q and each r_i∈F_q. Because p>nq^2 and m≤n, the integer s+qΣr_i is strictly below p, so the support of this sum is contained in the set {s+qR : s∈F_q, 0≤R≤m(q-1)}, whose size is at most m q^2, which is strictly less than p. Lemma 2 requires the summands to be mutually independent and uniform over F_p, so it does not apply. Consequently, the bound P(s|C_j) ≤ (⌊p/q⌋+1)/p and the conclusion lim_{q→∞} I(s;C_j)=0 are unsupported.","section":"Theorem 4, Eq. (7)"},{"comment":"The failure is not merely a proof gap: an adversary with m-1 components obtains a substantial amount of information about s. Consider t=2, m=3, and suppose the adversary holds c_1 and c_2. For each guess (r_1,r_2)∈F_q^2, the adversary computes adjusted shares s_i' = b_i^{-1}(c_i - q r_i) mod p. The two adjusted shares determine the unique dealer vector v∈F_p^2, yielding a candidate secret s'=v·g0 mod p. The true pair (r_1,r_2) always yields the true secret. A uniformly random wrong pair yields s'∈F_q with probability q/p, so the expected number of surviving candidate secrets is 1+q^3/p. Since p>nq^2, q^3/p<q/n, and the posterior support of s has expected size at most 1+q^3/p. Thus I(s;{c_1,c_2}) ≥ log q - log(1+q^3/p), which is approximately log n - o(1) as q grows, not 0. This contradicts the claim of Theorem 4 and extends to general m-1 component sets.","section":"Theorem 4, concrete attack"},{"comment":"Theorem 3 contains the same uniformity error. Step 1 claims that each c_i, and therefore Σ_{i=1}^m c_i mod p, is uniformly distributed over F_p. This is false: c_i = b_i s_i + r_i q mod p, and because r_i ranges over F_q, the component c_i is supported on the set b_i s_i + qF_q mod p, which has size q, not p. In Eq. (6), the proof claims the left side s' - (Σ_{i=1}^{m-1} c_i + c'_m) mod p is uniformly distributed over F_p; however, the valid components are not uniform over F_p, so Lemma 2 cannot be applied. The resulting bound P(s'=s) ≤ (⌊p/q⌋+1)/p is therefore not justified, and the IPA-resistance claim in Theorem 3 is not established.","section":"Theorem 3, Eq. (6)"},{"comment":"The proof of Theorem 2 relies on Lemma 2 to assert that the unknown share s_t = v·g_t is uniformly distributed over F_p. This is not justified: the dealer's vector v is chosen subject to s = v·g0 mod p with s∈F_q, so v is not uniform over F_p^t; after conditioning on the observed shares, v takes at most q·p^{t-1-|Ω'|} possible values rather than p^{t-|Ω'|}. The distributional hypothesis of Lemma 2 is therefore not satisfied. The same problem invalidates the use of Corollary 1 when claiming that Σ c_i is uniform over F_p: Corollary 1, whose proof is omitted, does not apply to sums in which the r_i are uniform over F_q rather than F_p. Although the conclusion of Theorem 2 may be true, the proof as written is invalid, and Theorem 6 inherits the gap.","section":"Theorem 2 and Corollary 1"},{"comment":"The security claims of the group authentication scheme are derived directly from Theorems 2 and 3. Since those theorems are not proven as written, and Theorem 4 fails in the sense that m-1 components leak non-negligible mutual information, the assertions in Theorems 5 and 6 that a non-member cannot forge a valid component and that t-1 members cannot forge a token are unsupported. In particular, the concrete attack on Theorem 4 implies that an adversary holding m-1 valid components can reduce the secret to a small candidate set, which is relevant to the group authentication setting.","section":"Section 5, Theorems 5 and 6"}],"minor_comments":[{"comment":"The text says the dealer 'allocates s_i to U_i as the share secretly for i = 0,1,...n', but there are only n shareholders and s_0 is the secret, not a share; this should be i=1,...,n.","section":"Section 3.2, Share Generation"},{"comment":"The parameter condition q^3 > p > nq^2 appears only in the performance comparison, while the scheme description states only p>nq^2. The relationship between q and p used to derive the share-size bound should be stated explicitly among the scheme parameters.","section":"Section 4.2, Performance Comparison"},{"comment":"The phrase 'non-number' should be 'non-member'.","section":"Remark 3"},{"comment":"The notation C_j (lowercase j) in the theorem statement is written as C_J (uppercase J) in the proof; please standardize the notation.","section":"Theorem 4 proof"},{"comment":"The proof of Corollary 1 is omitted; since the corollary is used to justify the uniformity of component sums, a full proof or a precise statement of its hypotheses is necessary.","section":"Corollary 1"}],"recommendation":"reject","confidential_remarks":"The concrete attack described in Major Comment 2 is easily verified and directly contradicts the central claim of asymptotically perfect security. The flaw is load-bearing: it invalidates Theorems 3 and 4 and the group authentication application, and I do not see a local fix within the manuscript's current design. The omission of the proof of Corollary 1 is also concerning. I would not encourage resubmission unless the scheme is substantially redesigned."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the paper does something sensible with a known trick, but its central security theorem is wrong. The construction—mask each linear-code share with a random multiple of q, then recover s = (sum of components mod p) mod q—is a direct descendant of Nojoumian-Stinson zero-addition, and the paper is honest about that. Correctness (Theorem 1) is fine: because s + qΣr_i < p, the modular reductions compose.\n\nThe problem is the uniformity claim underneath Theorems 3 and 4. Lemma 2 and Corollary 1 are not applicable to the actual distribution. The sum in Eq. 7 is not uniform over F_p; it is confined to s + qR, where R is a sum of m bounded random variables and s ∈ F_q. Corollary 1 is simply false in general: one F_q-valued variable times a nonzero coefficient is uniform on a q-element subset of F_p, not on F_p.\n\nConcretely, for t=2, m=3, an adversary with c1,c2 enumerates (r1,r2) ∈ F_q^2, inverts the two adjusted shares to recover v, and keeps those candidates with v·g0 ∈ F_q. The true pair survives; a random wrong pair lands in F_q with probability about q/p, so the expected number of false candidates is q^3/p < q/n. The posterior support of s is about 1 + q/n values, which gives I(s; c1,c2) ≥ log n − o(1) as q grows. That is not asymptotically perfect security, and it contradicts Theorem 4. The same defect invalidates Theorem 3's IPA argument, and Theorems 5 and 6 inherit the failure. Corollary 1's proof is also omitted, which would have been the place to see the F_q support problem.\n\nThe group-authentication application is a natural use of TCSS and the paper is clearly written. The performance comparison is mostly fine, though the security column overstates what is proven. The literature coverage is fair; the citation to [24] undercuts the novelty claim but is not an error.\n\nWho is this for? Someone working on TCSS or group authentication might read it as a cautionary example of how masked linear-code shares still leak through the linear relation. But the advertised scheme should not be used, and the paper in current form does not deserve acceptance. I'd still send it to a referee if I were an editor—the flaw is real but subtle, and an expert report would be useful to the authors and the community—but the expected and correct outcome is rejection.","headline":"The scheme is a clean repackaging of the zero-addition TCSS trick, but the linear-code masking is broken: an adversary holding m-1 components recovers log n bits of the secret, so the asymptotically-perfect security theorem does not hold.","tokens_in":15344,"tokens_out":5925,"would_cite":false,"duration_ms":64035,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["94A62","94A60","94B05"],"pacs":[],"model":"deepseek-v4-flash","headline":"A linear-code secret-sharing scheme raises the threshold from t to the exact number of participants present, with asymptotically perfect security and no computational assumptions.","keywords":["threshold changeable secret sharing","linear code","group authentication","illegal participant attack","asymptotically perfect security","secret sharing","information-theoretic security"],"falsifier":"For a concrete instantiation (e.g., $t = 2$, $n = 3$, $q = 5$, and $p$ just above $n q^2$), enumerate every admissible dealer vector $\\vec v \\in \\mathbb{F}_p^2$ consistent with the public data and compare the true probability that an adversary with one legitimate share guesses the secret with the bound $(\\lfloor p/q \\rfloor + 1)/p$ used in the proofs; if the true probability is materially larger, the uniformity assumption fails.","tokens_in":14205,"feed_emoji":"🔐","tokens_out":11852,"duration_ms":117265,"temperature":0.7,"pith_summary":"The paper sets out to show that a linear-code secret-sharing scheme can raise its reconstruction threshold from t to the exact number m of participants who show up, without any dealer interaction and without relying on one-way functions, encryption, or other computational assumptions. The motivation is the illegal participant attack: an outsider with no valid share can join a reconstruction, collect valid shares from the honest participants, and recover the secret. The scheme answers this by making every participant send a blinded component, so the secret is recoverable only when all m components are present. The paper then uses the same construction as a one-round group authentication protocol, in which every user checks all other users at once by comparing the recovered secret against a published hash. The security goal is \"asymptotically perfect\": as the secret field grows, any coalition of fewer than all participants learns essentially nothing.","feed_headline":"Threshold rises to the full group size without the dealer","feed_subtitle":"It blocks share-less impersonators and turns the scheme into one-round group authentication.","key_machinery":"The carrying object is the public generator matrix $G = (\\vec g_0, \\vec g_1, \\dots, \\vec g_n)$ of an $[n+1,t]$ linear code over $\\mathbb{F}_p$: an $[n+1,t]$ linear code is a $t$-dimensional subspace of $\\mathbb{F}_p^{n+1}$, represented here by its columns. The dealer picks a private row vector $\\vec v \\in \\mathbb{F}_p^t$ with $s = \\vec v \\cdot \\vec g_0 \\bmod p$ and hands shareholder $U_i$ the share $s_i = \\vec v \\cdot \\vec g_i \\bmod p$. To reconstruct with $m \\ge t$ participants, everyone non-interactively solves for public coefficients $b_i$ such that $\\vec g_0 = \\sum_{i\\in I_m} b_i \\vec g_i \\bmod p$, then sends the component $c_i = (b_i s_i + r_i q) \\bmod p$ with $r_i$ uniformly random in $\\mathbb{F}_q$. The additive term $r_i q$ blinds the share, and the parameter condition $p > n q^2$ ensures that $\\sum c_i \\bmod p$ equals $s + q\\sum r_i$ without wraparound, so reducing modulo $q$ extracts the secret. This component-construction step is what raises the threshold from $t$ to $m$.","core_discovery":"The paper's central claim is that an adversary who impersonates a legal shareholder, without holding a valid share, cannot recover the secret, because the one component it is forced to forge leaves the sum statistically uniform over the large field, so guessing the secret is no easier than guessing from the small secret field directly. The same mechanism makes the threshold changeable: with m participants, the secret is recoverable from all m components, while any proper subset yields asymptotically no information, so the effective threshold is m rather than t. The underlying identity is simple: each participant sends $c_i = (b_i s_i + r_i q) \\bmod p$, with public coefficients $b_i$ satisfying $\\vec g_0 = \\sum_i b_i \\vec g_i$; summing components gives $s + q\\sum_i r_i$ modulo $p$, and reducing modulo $q$ returns $s$ because the parameters satisfy $p > n q^2$. The paper also claims that fewer than t original shareholders get asymptotically no information, and applies the construction to group authentication by checking a published hash of the recovered secret.","pith_inferences":["Beyond the paper: an immediate extension, noted but not developed, is an authenticated group key agreement, where the same component sum becomes a shared group key once the hash check passes.","Beyond the paper: because the authentication is all-or-nothing, it does not identify which user is a non-member; a follow-up binary-search procedure using overlapping subsets of participants would localize the intruder while preserving the one-round property for each subset.","Beyond the paper: the paper's asymptotic statement leaves open the exact finite-parameter leakage; a tighter accounting of entropy conditioned on the public fact that the secret lies in a small subfield would tell practitioners how large the field ratio must be for a targeted security level.","Beyond the paper: the same linear-code component mechanism could be applied to other group-oriented tasks, such as privacy-preserving polling or threshold signatures, wherever \"all present parties must be legitimate\" is the required access policy."],"forward_implications":["With $m$ participants, the threshold becomes exactly $m$: the secret is recovered from all $m$ components, while any proper subset yields asymptotically no information.","An adversary without a valid share cannot learn the secret by impersonating a shareholder; the probability of a successful guess is bounded by roughly $1/q$, the same as guessing the secret directly.","The scheme is dealer-free after setup and non-interactive: participants compute the same public coefficients locally and exchange one component each.","The group-authentication instantiation lets each user authenticate all other users in one round by checking whether the recovered secret hashes to the published value, with no public-key operations.","Security is asymptotic rather than exact: the mutual-information leakage tends to zero as the secret field grows, so concrete security depends on choosing the field sizes large enough."],"supporting_citations":[{"why":"Supplies the linear-code formulation of threshold secret sharing on which the share-generation step is built.","marker":"[20]"},{"why":"Defines the illegal participant attack model that the scheme is designed to thwart.","marker":"[31]"},{"why":"Introduces the group authentication notion and the one-shot hash-check verification pattern reused in the application.","marker":"[8]"},{"why":"Presents an earlier dynamic-threshold construction that the new component mechanism aims to improve upon.","marker":"[9]"},{"why":"Demonstrates linear-subspace attacks on earlier group-authentication and dynamic-threshold schemes, motivating the new design.","marker":"[1]"}],"fun_headline_variants":["Secret sharing that grows its threshold to fit all present members","Dynamic threshold secret sharing foils impersonators","Adversaries without shares can't fake a secret reconstruction","Group authentication via threshold-changing secret sharing","Reconstruction raises threshold to block share-less cheats"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"Everything rests on the assumption that knowing the secret came from a small range does not make any hidden share look any less random over the large field; if that conditional uniformity fails, the claimed asymptotic bounds do not follow.","fun_headline_variants_meta":{"raw":{"variants":["Secret sharing that grows its threshold to fit all present members","Dynamic threshold secret sharing foils impersonators","Adversaries without shares can't fake a secret reconstruction","Group authentication via threshold-changing secret sharing","Reconstruction raises threshold to block share-less cheats"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000695,"raw_usage":{"total_tokens":3140,"prompt_tokens":940,"completion_tokens":2200,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":556,"completion_tokens_details":{"reasoning_tokens":2127}},"tokens_in":556,"tokens_out":2200,"duration_ms":15374,"temperature":1.0,"reasoning_tokens":2127,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T14:56:48.559622+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"For a concrete instantiation (e.g., $t = 2$, $n = 3$, $q = 5$, and $p$ just above $n q^2$), enumerate every admissible dealer vector $\\vec v \\in \\mathbb{F}_p^2$ consistent with the public data and compare the true probability that an adversary with one legitimate share guesses the secret with the bound $(\\lfloor p/q \\rfloor + 1)/p$ used in the proofs; if the true probability is materially larger, the uniformity assumption fails.","supporting_citations":[{"cited_title":"McEliece and Dilip V","cited_arxiv_id":null,"evidence_quote":"Supplies the linear-code formulation of threshold secret sharing on which the share-generation step is built."},{"cited_title":"How to share a secret with cheaters","cited_arxiv_id":null,"evidence_quote":"Defines the illegal participant attack model that the scheme is designed to thwart."},{"cited_title":"Group authentication","cited_arxiv_id":null,"evidence_quote":"Introduces the group authentication notion and the one-shot hash-check verification pattern reused in the application."},{"cited_title":"Dynamic threshold secret reconstruc- tion and its application to the threshold cryptography","cited_arxiv_id":null,"evidence_quote":"Presents an earlier dynamic-threshold construction that the new component mechanism aims to improve upon."},{"cited_title":"Linear subspace crypt- analysis of harn’s secret sharing-based group authentication scheme","cited_arxiv_id":null,"evidence_quote":"Demonstrates linear-subspace attacks on earlier group-authentication and dynamic-threshold schemes, motivating the new design."}],"review_version":1}