Realistic versus Rational Secret Sharing

Arkadii Slinko; Yvo Desmedt

REVIEW 4 major objections 4 minor 29 references

Realistic versus Rational Secret Sharing

T0 review · 4 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper argues that rational secret sharing changes character completely when the secret unlocks a non-rivalrous, non-excludable common good: instead of universal abstention, the stable outcome is exactly a minimal authorized coalition…

desk verdict A conceptually nice economic reframing of secret sharing, but the main theorem as stated has a counterexample that needs a fix before the paper can be trusted. read the letter →

arxiv 1908.07581 v1 pith:L7QR5FYH submitted 2019-08-20 cs.CR econ.TH

Yvo Desmedt , Arkadii Slinko This is my paper · ORCID

classification cs.CRecon.TH MSC 91A1094A62

keywords secretsharingrationalcommongoodnon-rivalrousgoodsNashequilibriumgametheorythresholdcryptographyaccessstructure

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that Halpern and Teague's pessimistic conclusion about rational secret sharing — that rational players refuse to reveal their shares — is a consequence of modelling the secret as a rivalrous and excludable good, such as a treasure map. The authors propose a utility model for secrets that open access to a non-rivalrous and non-excludable common good, such as authorizing a council project or signing on behalf of an organization. In that model, the reconstruction game has natural pure-strategy Nash equilibria: exactly a minimal authorized coalition whose members each value the secret more than the participation cost reveals its shares, and everyone else free-rides. If no participant values the secret above the cost, nobody reveals. The paper concludes that in many realistic applications the secret should be used rather than recovered, and that non-reconstruction can be socially beneficial.

What carries the argument

The load-bearing object is the pair of utility axioms V1 and V2, which encode the secret as a non-rivalrous, non-excludable common good, together with the access structure $\Gamma$ and its minimal authorized coalitions. A characteristic vector $v_X$ records which players reveal their shares, with 1 for members of $X$. The proof works because a player's expected utility is linear in her own probability of participating, so in any equilibrium where her action matters she plays a pure strategy; once all strategies are pure, a non-minimal authorized coalition is unstable because a redundant participant can drop out and save $c$, and an unauthorized coalition cannot recover anything. The condition $N_i>c$ ensures that the revealed participants gain from the recovery despite the cost.

What would settle it

In a three-player, two-out-of-three reconstruction game with utilities V1 and V2, compute all Nash equilibria directly. The theorem predicts, up to permutation, only profiles with exactly two players revealing when all $N_i>c$, plus possibly the zero vector when no player is self-sufficient; finding any other pure equilibrium, or a mixed essential equilibrium, would falsify the theorem.

Watch

Extended reading notes

Core claim

The paper's central result, Theorem 3, classifies all Nash equilibria of the reconstruction game under utility axioms V1 and V2. These axioms say that if the secret is recovered, participant $i$ receives a fixed value $N_i$ no matter who else learns the secret, and pays participation cost $c>0$ only if she took part; if the secret is not recovered, she pays $c$ only in the case of participation. For an arbitrary access structure $\Gamma$, every Nash equilibrium in which all players are essential is the characteristic vector $v_X$ of a minimal authorized coalition $X$ with $N_i>c$ for every $i\in X$. If no single participant is self-sufficient, the zero vector is also a Nash equilibrium, so the game may fail to recover the secret even when recovery would be collectively profitable. All these equilibria survive deletion of weakly dominated strategies. The theorem replaces Halpern and Teague's global no-reveal conclusion with a precise positive result for non-rivalrous, non-excludable secrets.

Load-bearing premise

Everything rests on the utility axioms V1 and V2, which assume that once the secret is recovered every participant receives the same fixed value $N_i$ regardless of who else learns the secret, and that a participant pays cost $c$ only if she actively took part. If the good is instead rivalrous or excludable, the conditions fail and Halpern and Teague's negative result returns.

Editorial extensions

If this is right

For threshold signatures and secure multiparty computation, the message is concrete: parties should use their shares to produce the output, never reconstruct the secret; the pure-strategy equilibria give a stability argument for that design.
The zero-vector equilibrium shows that when participation costs exceed each participant's valuation, non-recovery is an equilibrium and may be socially preferable; privacy of who participated matters.
The equilibria survive deletion of weakly dominated strategies, so the classification does not depend on a delicate refinement.
For arbitrary access structures, the natural stable outcome is exactly one minimal authorized coalition, which matches power-sharing arrangements like two-of-three approval.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial extension: the model's clean prediction — exactly a minimal authorized coalition reveals and all outsiders free-ride — is observable in a laboratory game that sets $N_i$, $c$, and a threshold access structure; observing all players reveal or all abstain as the unique outcome would contradict the theorem.
Editorial extension: the paper assumes $N_i$ and $c$ are common knowledge. If valuations are private, the equilibrium characterization would likely need a Bayesian analogue; this is not addressed in the paper.
Editorial extension: making participation costly is what creates the free-riding structure; a mechanism that reimburses costs or makes abstention observable could shift the equilibrium set toward larger coalitions, a design consequence the paper leaves implicit.
Editorial extension: when the common good is experienced as a bad — equivalently when $N_i$ is below the participation cost — non-recovery is the stable outcome, which gives a game-theoretic rationale for authorized officers refusing to approve harmful actions.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

The paper is worth a look if you care about rational secret sharing or threshold crypto, but treat its main theorem as a draft. What's new is the economic framing: secret reconstruction games differ depending on whether the secret unlocks a rivalrous/excludable good (Halpern-Teague's treasure) or a non-rivalrous/non-excludable one (a public good). Under their V1/V2 utilities, they show that minimal authorized coalitions where each participant's value Ni exceeds the participation cost c are Nash equilibria, and that non-participation can be socially beneficial. That's a real conceptual contribution, and the applications to threshold signatures and MPC are sensible: sometimes you don't want the secret recovered, just used.

The formal part is thinner. Lemma 1 is fine: with linear expected utility, a mixed strategy only appears when the player is indifferent. But Theorem 3 as printed is false. The stress-test example is right: for a 2-out-of-2 scheme with N1=N2=1 and c=2, the zero vector is a Nash equilibrium in which every player is essential, yet no vX exists because no player has Ni > c. The proof's last paragraph does mention the zero vector, so the intended statement probably is 'every all-essential equilibrium is either a vX or the zero vector when no self-sufficient player exists,' but that disjunct is missing from the theorem. That's a fixable error, but it is an error in the central claim.

There are two more soft spots. The assertion that all Nash equilibria survive deletion of weakly dominated strategies is not proved; it's plausible for Ni>c players (neither pure strategy dominates the other), but the paper just states it. And the V1/V2 utility model is load-bearing and introduced as a modeling choice, not derived from anything deeper—fine for a conceptual paper, but it means the results are conditional on that specification. No code, no machine-checked proofs, no data, and the proof of Theorem 2 is also sketchy.

Who is this for? Game-theoretic cryptographers and protocol designers who want an alternative to Halpern-Teague's pessimistic conclusion. The taxonomy of secrets by rivalrousness/excludability is the most valuable part. I'd send it to a serious referee, but with a clear request to fix the statement of Theorem 3 and prove the survival claim. If those land, the paper becomes a solid short contribution.

Referee Report

4 major / 4 minor

Summary. The paper revisits rational secret sharing by embedding the reconstruction stage in a larger economic game in which the secret is a 'common good'. The authors argue that Halpern and Teague's negative result corresponds to a rivalrous and excludable good, and they introduce two utility conditions, V1 and V2, representing a non-rivalrous and non-excludable good: if the secret is recovered every participant i receives value N_i, and each participant who actively participates pays cost c. Their central formal claim, Theorem 3, states that every Nash equilibrium in which all players are essential is one of the characteristic vectors v_X of a minimal authorized coalition X with N_i > c for all i in X, with an extra zero-vector equilibrium when no self-sufficient participant with N_i > c exists, and that all Nash equilibria survive deletion of weakly dominated strategies. The paper also states an asynchronous impossibility theorem (Theorem 2) under Halpern-Teague utilities and discusses applications to threshold cryptography, MPC, and power-sharing arrangements.

Significance. If the formal claims were correct, the paper would provide a genuinely useful reframing: it identifies a class of realistic secret-sharing scenarios in which participation in reconstruction is rational and non-reconstruction can be socially beneficial, and it derives the equilibria from explicit utility axioms rather than fitting parameters. The modeling distinction between rivalrous/excludable and non-rivalrous/non-excludable secrets is thought-provoking and the examples are relevant. However, the central classification theorem is not correct as stated, and one of its auxiliary claims is demonstrably false. The underlying insight—that minimal authorized coalitions with net positive benefit are Nash equilibria—is defensible, but the manuscript currently overstates and under-proves its main theorem, so a substantial revision is required before the results can be relied upon.

major comments (4)

[Section 5, Theorem 3] The first sentence of Theorem 3 is false as stated. In a 2-out-of-2 access structure with N_1 = N_2 = 1 and c = 2, the zero vector is a Nash equilibrium: if either player deviates to participate while the other abstains, the coalition is unauthorized, the secret is not recovered, and the deviator receives -2 instead of 0. Every player is essential in this equilibrium because each player's payoff changes from 0 to -2 when she switches from abstain to participate. Yet no vector v_X exists, because the only minimal authorized coalition is {1,2}, for which N_i = 1 < c. The theorem must include the zero vector as an explicit disjunct; moreover, the condition 'no self-sufficient participant with N_i > c' is sufficient but not necessary, since a self-sufficient participant with N_i <= c does not make a unilateral deviation to participation profitable.
[Section 5, Theorem 3, final sentence] The claim 'All Nash equilibria survive deletion of weakly dominated strategies' is false. In the same 2-out-of-2 example with N_1 = N_2 = 1 and c = 2, abstaining strictly dominates participating for each player: if the other participates, participating gives -1 and abstaining gives 1; if the other abstains, participating gives -2 and abstaining gives 0. Therefore the zero vector is a Nash equilibrium that is eliminated by iterated deletion of weakly dominated strategies. No proof of the survival claim is given in the proof of Theorem 3, and the claim as written contradicts the example. This sentence should either be removed or replaced with a carefully qualified statement with proof.
[Section 5, proof of Theorem 3] The proof of Theorem 3 is only a sketch and does not establish the stated classification. Lemma 1 allows mixed strategies for inessential players, but the proof does not rule out a mixed Nash equilibrium in which every player is essential; the theorem's hypothesis 'every player is essential' is never used in the proof in a way that excludes mixed equilibria. The proof also ignores the indifference case N_i = c, where participation yields the same payoff as abstention and the vector v_X remains a Nash equilibrium under the definitions of Section 5. The sentence 'If X is not in authorised and somebody is playing a non-zero strategy...' does not handle all cases, such as authorized but non-minimal coalitions with N_i = c. A complete, step-by-step proof of the corrected statement is needed.
[Section 4, Theorem 2] The proof of Theorem 2 is not rigorous. The argument asserts that the player who makes the last move cannot learn the secret and therefore receives a negative payoff, and that disclosing nothing prevents the game from ending; however, it does not compute the payoff of the deviation in the subgame that would result, because the asynchronous game may continue and the deviating player might later learn the secret or influence future moves. The theorem may be true, but the proof as written does not establish it, and the statement that the game 'gets into a non-terminal node' does not by itself show that the deviation is profitable in the subgame-perfect sense. This result needs a complete proof or should be presented as a conjecture.

minor comments (4)

[General] There are several typos: 'Burried treasure' in Section 4, 'sucg' in Section 1, 'responce' in the proof of Lemma 1, and 'an d' in the abstract. These should be corrected.
[Section 5, Theorem 3] The phrase 'the minimal authorised coalition' should be 'a minimal authorised coalition', since an access structure may have several minimal authorized coalitions; the current phrasing suggests uniqueness.
[Section 5] The term 'self-sufficient participant' is used in Theorem 3 without a formal definition. It appears to mean a participant i such that {i} is an authorized coalition, but this should be stated explicitly.
[Section 5, Lemma 1] The proof of Lemma 1 refers to 'best responce' and uses functions f_Gamma and g_Gamma without defining their domains; a precise definition of these functions would improve readability.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: Theorem 3 is a logical consequence of the explicitly stated V1/V2 utility assumptions and standard Nash-equilibrium definitions.

full rationale

The derivation chain is self-contained: the paper introduces V1/V2 in Section 5 as explicit primitive utility conditions and proves Lemma 1 and Theorem 3 directly from them, together with the access structure. No quantity used in the conclusion is fitted from data being predicted; the equilibria are characterized rather than constructed to match observations. Citations to the authors' prior threshold-cryptography work appear only in illustrating applications and do not carry the weight of the equilibrium theorem. The Halpern–Teague result is cited as an external benchmark, and the paper contrasts V1/V2 against U1–U3 rather than assuming its conclusion via that citation. One genuine issue is that Theorem 3's first sentence omits the zero-vector disjunct that its own proof later supplies, so the classification as printed is incomplete for cases where no minimal authorized coalition has Ni > c for all i; however, this is a formal correctness flaw, not a circular reduction, because the proof explicitly identifies the zero vector as an additional Nash equilibrium.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The paper's model introduces two utility parameters (N_i and c) and a set of domain assumptions about how secrets relate to common goods. No entities are invented. The assumptions are explicitly stated but not derived from prior literature or data.

free parameters (2)

N_i
Per-participant value of the common good if the secret is recovered. A model parameter, not estimated from data; the equilibrium condition compares it to cost c.
c
Cost of participating in reconstruction. A model parameter; assumed identical for all participants.

assumptions (5)

domain assumption Utility of each participant is N_i if the secret is recovered and 0 otherwise, minus cost c if they participated (conditions V1, V2)
This is the core modeling assumption in Section 5. It encodes non-rivalry (utility independent of how many learn the secret) and non-excludability (non-participants get N_i too).
domain assumption The secret itself has no intrinsic value; only the common good it unlocks matters
Stated in Section 5, observation 2: 'the secret itself is a meaningless combination of zeros and ones and knowledge of it has no value to participants'. Load-bearing for the contrast with Halpern-Teague.
domain assumption The reconstruction game is a one-shot simultaneous-move game where each participant chooses a probability of participating
The Nash equilibrium analysis in Section 5 uses a normal-form game with mixed strategies alpha_i; the extensive form is not specified.
domain assumption Halpern and Teague's Theorem 1 (no deterministic synchronous protocol with U1-U3 gives a Nash equilibrium surviving iterated deletion of weakly dominated strategies in which someone learns the secret)
Used as the baseline contrast in Section 4; cited to [16].
domain assumption Common goods classification by rivalry and excludability applies to secrets
The paper interprets the secret as opening access to a common good and applies Samuelson's taxonomy. This is the framing premise of the whole paper.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Realistic versus Rational Secret Sharing." pith.science (2026). https://pith.science/paper/L7QR5FYH

@misc{pith2026190807581,
  author       = {Pith},
  title        = {Pith review of: Realistic versus Rational Secret Sharing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/L7QR5FYH}},
  note         = {Machine review of arXiv:1908.07581}
}

read the original abstract

The study of Rational Secret Sharing initiated by Halpern and Teague regards the reconstruction of the secret in secret sharing as a game. It was shown that participants (parties) may refuse to reveal their shares and so the reconstruction may fail. Moreover, a refusal to reveal the share may be a dominant strategy of a party. In this paper we consider secret sharing as a sub-action or subgame of a larger action/game where the secret opens a possibility of consumption of a certain common good. We claim that utilities of participants will be dependent on the nature of this common good. In particular, Halpern and Teague scenario corresponds to a rivalrous and excludable common good. We consider the case when this common good is non-rivalrous and non-excludable and find many natural Nash equilibria. We list several applications of secret sharing to demonstrate our claim and give corresponding scenarios. In such circumstances the secret sharing scheme facilitates a power sharing agreement in the society. We also state that non-reconstruction may be beneficial for this society and give several examples.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

29 extracted references · 29 canonical work pages

[1]

Beerliov´ a-Trub ´ ıniov´ a and M

Z. Beerliov´ a-Trub ´ ıniov´ a and M. Hirt. Perfectly-secure MPC with linear communication complexity. In R. Canetti, editor, Theory of Cryptography, Fifth Theory of Cryptography Confe rence, TCC , volume 4948 of Lecture Notes in Computer Science , pp. 213–230. Springer, 2008

work page 2008
[2]

Ben-Or, S

M. Ben-Or, S. Goldwasser, and A. Wigderson. Completeness the orems for non-cryptographic fault- tolerant distributed computation. In Proceedings of the twentieth annual ACM Symposium Theory of Computing, STOC , pp. 1–10, May 2–4, 1988

work page 1988
[3]

G. R. Blakley. Safeguarding cryptographic keys. In Proceedings of the National Computer Confer- ence, pp. 313–317, 1979. vol.48

work page 1979
[4]

C. Boyd. Digital multisignatures. In H. Beker and F. Piper, editor s, Cryptography and coding , pp. 241–246. Clarendon Press, 1989. Royal Agricultural College, Cirencester, December 15–17, 1986

work page 1989
[5]

R. A. Croft and S. P. Harris. Public-key cryptography and re-u sable shared secrets. In H. Beker and F. Piper, editors, Cryptography and coding, pp. 189–201. Clarendon Press, 1989. Royal Agricultural College, Cirencester, December 15–17, 1986

work page 1989
[6]

Y. Desmedt. A high availability internetwork capable of accommoda ting compromised routers. BT Technology Journal, 24(3), pp. 77–83, 2006

work page 2006
[7]

Desmedt and Y

Y. Desmedt and Y. Frankel. Threshold cryptosystems. In G. Br assard, editor, Advances in Cryp- tology — Crypto ’89, Proceedings (Lecture Notes in Computer Science 435), pp. 307–315. Springer- Verlag, 1990. Santa Barbara, California, U.S.A., August 20–24

work page 1990
[8]

Y. G. Desmedt. Threshold cryptography. European Transactions on Telecommunications , 5(4), pp. 449–457, July-August 1994. (Invited paper)

work page 1994

Show all 29 references

[9]

Y. Desmedt. Society and group oriented cryptography: a new c oncept. In C. Pomerance, edi- tor, Advances in Cryptology, Proceedings of Crypto ’87 (Lecture Notes in Computer Science 293) , pp. 120–127. Springer-Verlag, 1988. Santa Barbara, California, U.S.A., August 16–20. 10

1988
[10]

Y. Desmedt. Some recent research aspects of threshold cry ptography. In E. Okamoto, G. Davida, and M. Mambo, editors, Information Security, Proceedings (Lecture Notes in Compu ter Science 1396), pp. 158–173. Springer-Verlag, 1997. Invited lecture, Septemb er 17-19, 1997, Tatsu...

1997
[11]

Y. Desmedt. Unconditionally private and reliable communication in a n untrusted network. In IEEE Information Theory Workshop on Theory and Practice in I nformation-Theoretic Security, Proceedings, pp. 38–41, October 16–19, 2005. Awaji Island, Japan

2005
[12]

Dolev, C

D. Dolev, C. Dwork, O. Waarts, and M. Yung. Perfectly secure message transmission. Journal of the ACM , 40(1), pp. 17–47, January 1993

1993
[13]

Rational protocol design: Cryptography against incentive-driven adversaries

Juan Garay, Jonathan Katz, Ueli Maurer, Bjorn Tackmann, a nd Vassilis Zikas. Rational protocol design: Cryptography against incentive-driven adversaries. In Foundations of Computer Science (FOCS), 2013 IEEE 54th Annual Symposium on , pp. 648–657. IEEE, 2013

2013
[14]

Gennaro, M

R. Gennaro, M. O. Rabin, and T. Rabin. Simpliﬁed VSS and fact-tr ack multiparty computations with applications to threshold cryptography. In Proceedings of the Annual ACM Symposium on Principles of Distributed Computing (PODC) , pp. 101–111, 1998

1998
[15]

Rational secret sharing, re visited

S Dov Gordon and Jonathan Katz. Rational secret sharing, re visited. In SCN, volume 4116, pp. 229–241. Springer, 2006

2006
[16]

Rational secret sharing and multiparty computation: Extended abstract

Joseph Halpern and Vanessa Teague. Rational secret sharing and multiparty computation: Extended abstract. In Proceedings of the Thirty-sixth Annual ACM Symposium on The ory of Computing , STOC ’04, pp. 623–632, New York, NY, USA, 2004. ACM

2004
[17]

General constructions of rational secret sharing with expected constant-round reconst ruction

Akinori Kawachi, Yoshio Okamoto, Keisuke Tanaka, and Kenji Y asunaga. General constructions of rational secret sharing with expected constant-round reconst ruction. The Computer Journal , 60(5), pp. 711–728, 2016

2016
[18]

Cryptography and game theory: Desig ning protocols for exchanging information

Gillat Kol and Moni Naor. Cryptography and game theory: Desig ning protocols for exchanging information. Theory of Cryptography , pp. 320–339, 2008

2008
[19]

Kurosawa and K

K. Kurosawa and K. Suzuki. Truly eﬃcient 2-round perfectly se cure message transmission scheme. IEEE Transactions on Information Theory , 55(11), pp. 5223–5232, 2009

2009
[20]

C. L. Liu. Introduction to Combinatorial Mathematics . McGraw-Hill, New York, 1968

1968
[21]

R. J. McEliece and D. V. Sarwate. On sharing secrets and Reed- Solomon codes. Communications of the ACM , 24(9), pp. 583–584, September 1981

1981
[22]

Cloud computing se- curity

Ankur Mishra, Ruchita Mathur, Shishir Jain, and Jitendra Singh R athore. Cloud computing se- curity. International Journal on Recent and Innovation Trends in Co mputing and Communication , 1(1), pp. 36–39, 2013

2013
[23]

Mehrdad Nojoumian and Douglas R. Stinson. Socio-rational sec ret sharing as a new direction in rational cryptography. In Jens Grossklags and Jean Walrand, ed itors, Decision and Game Theory for Security, pp. 18–37, Berlin, Heidelberg, 2012. Springer Berlin Heidelberg. 11

2012
[24]

Samuelson

Paul A. Samuelson. The pure theory of public expenditure. The Review of Economics and Statistics , 36(4), pp. 387–389, 1954

1954
[25]

Samuelson

Paul A. Samuelson. Diagrammatic exposition of a theory of public expenditure. The Review of Economics and Statistics , 37(4), pp. 350–356, 1955

1955
[26]

A. Shamir. How to share a secret. Communications of the ACM , 22, pp. 612–613, November 1979

1979
[27]

Non-cooperative compu tation: Boolean functions with correctness and exclusivity

Yoav Shoham and Moshe Tennenholtz. Non-cooperative compu tation: Boolean functions with correctness and exclusivity. Theoretical Computer Science , 343(1), pp. 97–113, 2005

2005
[28]

A. C. Yao. Protocols for secure computations. In 23rd Annual Symposium on Foundations of Computer Science (FOCS) , pp. 160–164. IEEE Computer Society Press, 1982

1982
[29]

A. C. Yao. How to generate and exchange secrets. In 27th Annual Symposium on Foundations of Computer Science (FOCS) , pp. 162–167. IEEE Computer Society Press, 1986. Toronto, On tario, Canada, October 27–29, 1986. 12

1986

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [1]

Beerliov´ a-Trub ´ ıniov´ a and M

Z. Beerliov´ a-Trub ´ ıniov´ a and M. Hirt. Perfectly-secure MPC with linear communication complexity. In R. Canetti, editor, Theory of Cryptography, Fifth Theory of Cryptography Confe rence, TCC , volume 4948 of Lecture Notes in Computer Science , pp. 213–230. Springer, 2008

work page 2008

[2] [2]

Ben-Or, S

M. Ben-Or, S. Goldwasser, and A. Wigderson. Completeness the orems for non-cryptographic fault- tolerant distributed computation. In Proceedings of the twentieth annual ACM Symposium Theory of Computing, STOC , pp. 1–10, May 2–4, 1988

work page 1988

[3] [3]

G. R. Blakley. Safeguarding cryptographic keys. In Proceedings of the National Computer Confer- ence, pp. 313–317, 1979. vol.48

work page 1979

[4] [4]

C. Boyd. Digital multisignatures. In H. Beker and F. Piper, editor s, Cryptography and coding , pp. 241–246. Clarendon Press, 1989. Royal Agricultural College, Cirencester, December 15–17, 1986

work page 1989

[5] [5]

R. A. Croft and S. P. Harris. Public-key cryptography and re-u sable shared secrets. In H. Beker and F. Piper, editors, Cryptography and coding, pp. 189–201. Clarendon Press, 1989. Royal Agricultural College, Cirencester, December 15–17, 1986

work page 1989

[6] [6]

Y. Desmedt. A high availability internetwork capable of accommoda ting compromised routers. BT Technology Journal, 24(3), pp. 77–83, 2006

work page 2006

[7] [7]

Desmedt and Y

Y. Desmedt and Y. Frankel. Threshold cryptosystems. In G. Br assard, editor, Advances in Cryp- tology — Crypto ’89, Proceedings (Lecture Notes in Computer Science 435), pp. 307–315. Springer- Verlag, 1990. Santa Barbara, California, U.S.A., August 20–24

work page 1990

[8] [8]

Y. G. Desmedt. Threshold cryptography. European Transactions on Telecommunications , 5(4), pp. 449–457, July-August 1994. (Invited paper)

work page 1994