REVIEW 3 major objections 6 minor 19 references
Verifiable Weighted Secret Sharing
T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash
Pith's one-line read This paper builds the first verifiable weighted secret sharing scheme based on the Chinese Remainder Theorem: a zero-knowledge 'proof-of-mod' argument catches a malicious dealer, all in a prime-order group with no trusted setup.
desk verdict A genuinely new proof-of-mod technique with a clean writeup, but the base soundness argument has a concrete p=2 counterexample and the prover cost makes the practical claims premature. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing object is the proof-of-mod (PoM) argument — a zero-knowledge argument that two committed values $v$ and $s$ satisfy $v = s \bmod p$ for a known prime $p$ — which later becomes non-interactive through the Fiat-Shamir heuristic. Naive linear algebra cannot prove this relation, because any fixed-size homomorphic commitment wraps around modulo the group order, so the paper instead turns the congruence into a disjunction of two range proofs: with $p_0 = qp + t$, the valid cases are $(0 \le v < p) \wedge (0 \le k < q)$ or $(0 \le v < t) \wedge (0 \le k \le q)$, where $k = (s-v)/p$. The disjunction is proven by committing to binary decompositions of $v$ and $k$, forming polynomials $c'_i(z) = \sum_j c_{i,j} z^{j-1}$ from each branch's failed range equations, and adding one multiplication gate for $c'_1(z) \cdot c'_2(z) = 0$; by the fundamental theorem of algebra the product vanishes for a random $z$ only if one branch truly holds. The extended PoM handles values larger than the group order by prime-order decomposition: with $s = a_0 + a_1 p_0 + \cdots + a_m p_0^m$ and $p_0 > p^2 + p$, the congruence reduces to $m$ base PoM subcircuits plus linear constraints $v'_j = a'_j + t v'_{j+1}$, all aggregated into a single Rank-1 Constraint System (R1CS) circuit. That circuit is proven with the Bulletproofs argument system [5], giving proof size logarithmic in the circuit size, and the whole protocol is made non-interactive with the Fiat-Shamir heuristic.
What would settle it
Instantiate the extended proof-of-mod with a group order $p_0 \approx 2^{255}$ and a single party prime $p_i \approx 2^{130}$, so that $p_i^2 + p_i > p_0$, using shares whose intermediate decomposition value $a'_j + t v'_{j+1}$ reaches or exceeds $p_0$. Because the circuit constraints are enforced in $\mathbb{Z}_{p_0}$, that value wraps around and the proof for $v = s \bmod p_i$ must fail or become unsound; the paper's Section III-B assumption predicts no working proof exists for such a prime, so a valid proof for this instance would refute the claimed dynamic-range limit, and a failure confirms it.
Extended reading notes
Core claim
This paper claims that verifiable weighted secret sharing can be built directly on the Chinese Remainder Theorem in a plain prime-order group: the central step is a zero-knowledge argument that two committed integers $v$, $s$ satisfy $v = s \bmod p$ for a known prime $p$. When $s < p_0$, writing $s = v + kp$ and $p_0 = qp + t$, the relation holds in exactly two cases: either $0 \le v < p$ with $0 \le k < q$, or, for the top $t$ values of the group, $0 \le v < t$ with $0 \le k \le q$. The paper encodes this disjunction of range conditions as an arithmetic circuit and proves the 'either/or' by forming a challenge polynomial from each branch's range constraints and requiring the two polynomials' product to vanish, which a random verifier challenge makes true only when one branch genuinely holds. For secrets larger than the group order, prime-order decomposition writes $s = a_0 + a_1 p_0 + \cdots + a_m p_0^m$ and, assuming $p_0 > p^2 + p$, splits the large congruence into $m$ small proof-of-mod subcircuits joined by linear constraints, keeping the total proof logarithmic in $n$, $m$, and the security parameter. The resulting non-interactive VSS commits to the secret and every share, proves all $n$ congruences in one circuit, and reconstructs by CRT, with security resting on binding and hiding of the commitments, soundness of the circuit argument, and the random-oracle model for Fiat-Shamir.
Load-bearing premise
The construction assumes every party's weight prime $p_i$ satisfies $p_0 > p_i^2 + p_i$, so on a group of order about $2^N$ no weight prime may exceed roughly half of $N$ bits and the whole weight range must fit in about $N/2 - N_{\min}$ bits; a deployment whose weights span more than that cannot use the efficient proof directly and must fall back on pooling or virtualization.
Editorial extensions
If this is right
- The verifiability machinery is generic: it applies to any CRT-based secret sharing, including the original threshold scheme [1] and the weighted-ramp scheme [9], so one argument system covers multiple sharing families.
- Composing the scheme with verifiable encryption in the style of the publicly verifiable secret sharing framework [16] yields a publicly verifiable variant, removing the interactive quorum round among participants.
- For Ethereum-style staking with a two-thirds reconstruction threshold, the weighted VSS needs about 365 real parties where virtualization would need 4,110, and broadcasts 389 group elements instead of 6,850 — roughly 100× less broadcast bandwidth than the current design, nearly 20× less than the virtualized baseline, and about 5× less private bandwidth.
- Proof size grows logarithmically in the number of parties, the size of the secret, and the security parameter — under 2 KiB for the Ethereum parameters — while prover and verifier time grow linearly in the same parameters.
- Security holds for secrecy against unauthorized weight sets, correct reconstruction, and commitment to one consistent secret, proven from computational binding and perfect hiding of the commitments plus computational soundness and special honest-verifier zero knowledge of the circuit argument, with the Fiat-Shamir transform modeled as a random oracle.
Reading between the lines
- The headline bandwidth savings are conditional on the weight distribution fitting the scheme's dynamic range: since $p_0 > p_i^2 + p_i$ caps every weight prime at roughly half the bit length of the group order, a deployment whose weights span more than about $N/2 - N_{\min}$ bits must virtualize or pool the outliers — exactly the regime in which the claimed advantage over virtualization shrinks.
- Replacing the Bulletproofs circuit engine with a linear-time proving system is the direct path to practicality: the proof-of-mod circuit structure would be unchanged, and the paper's own timings suggest that substitution is the main obstacle between the construction and real deployment.
- The disjunction gadget — proving 'one of two range conditions holds' by making the product of two challenge polynomials vanish — looks transferable to more than two branches, unions of intervals, or congruences modulo composite numbers, each of which would widen proof-of-mod beyond this paper's setting.
- Because the underlying ramp scheme needs a gap between privacy and reconstruction thresholds ($T - t > 2\lambda + O(1)$), applications with tight threshold gaps pay an implicit cost that the paper does not quantify: their weights must be amplified before the VSS reaches a target security level, inflating the effective party count.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes a non-interactive verifiable weighted ramp secret sharing (VSS) scheme based on the Chinese Remainder Theorem, using Pedersen commitments and Bulletproofs-style arithmetic circuit proofs. The technical core is a NIZK ``proof-of-mod'' that a committed value v is congruent to another committed value s modulo a known prime p; this is extended via prime-order decomposition and then bundled into a single R1CS circuit for all parties. The authors claim the first efficient CRT-based VSS without trusted setup or unknown-order groups, with proof size logarithmic in all parameters, and report an Ethereum-based evaluation with a Rust implementation.
Significance. If the soundness issue identified below is repaired, the paper would be a significant contribution: a non-interactive CRT-based VSS from prime-order groups would remove the trusted-setup and unknown-order-group requirements of prior CRT-based VSS, and the logarithmic proof size is a genuine improvement over virtualization-based approaches. The paper also ships a concrete implementation, proof-size measurements, and a detailed Ethereum parameter analysis, which are strengths. However, the central soundness theorem is false for a legal parameter choice (p=2), so the claimed result does not currently hold as stated.
major comments (3)
- [§III-A1 and Fig. 4 (Appendix G)] The base proof-of-mod is not sound for p=2. Take p0=19, p=2, so q=9, t=1, n2=4, and set v=0, s=9. Then v ≠ s mod p, because 9 mod 2 = 1. Let k = (s−v)·p^{−1} mod p0 = 14, and represent k, q−k, and q−k−1 by their residues modulo 19, namely 14, 14, and 13. All binary representations fit in four bits, and the equations of Figure 4 hold by wrap-around: p·k = 28 ≡ 9; k + (q−k) ≡ 14+14 ≡ 9; k + (q−k−1) ≡ 14+13 ≡ 8; and v=0 satisfies both v<2 and v<t=1. Every bit-decomposition equation is satisfied. The verifier therefore accepts a false statement, contradicting the computational soundness claimed in Theorem 1. Since the extended proof-of-mod and the VSS construction rely on the base proof-of-mod, Theorem 2 is also invalid for any parameter set that permits a sharing prime p_i=2, which the paper does not exclude.
- [Appendix F (Lemma 1) and Theorem 1 proof] The root cause of the counterexample is that the range equations are evaluated in the field Z_{p0}, not over the integers. Lemma 1 asserts an if-and-only-if for an integer v, but in Figure 4 the equality v = Σ a_i 2^{i−1} only determines v modulo p0. Consequently, a negative difference such as q−k is indistinguishable from its positive residue p0+q−k whenever that residue also has a bit decomposition. The proof of Theorem 1 assumes that satisfying the range subcircuits implies the integer inequalities 0≤k≤q and 0≤v<p, which is exactly the step that fails. A correct proof must either exclude p=2 and prove that no modular wrap-around can occur for the remaining legal primes, or replace the range subcircuits with a construction that enforces integer inequalities over the full range; the current text provides neither.
- [Theorem 2, Secrecy proof] The secrecy argument contains an internal inconsistency in the parameter condition. The proof states that for an unauthorized set P_A ≤ P_max < p0^{m+1} and that the statistical distance is at most P_max/p0^{m+1}, then concludes that the distance is negligible if P_max << p0^m. These two statements cannot both be right: with only P_max < p0^{m+1}, the ratio P_max/p0^{m+1} is not necessarily negligible. The correct privacy condition for a lifted secret of the form Σ_{j=0}^m a_j p0^j is P_max << p0^m, with the statistical distance bounded by P_max/p0^m. The proof needs a single, consistent statement of the parameter regime.
minor comments (6)
- [Algorithm 1, line 3] The share definition s_i ← s0 + Σ_{j=0}^m a_j p0^j mod p_i double counts s0 if a0 is intended to equal s0, as the surrounding text and the circuit description indicate; the formula should be s_i ← Σ_{j=0}^m a_j p0^j mod p_i (or the explicit s0 term should be removed).
- [Theorem 1 proof] The soundness proof enumerates Cases 1 through 5 but then says ``the three cases above cover all possibilities''; the case analysis needs to be renumbered and the covering argument stated correctly.
- [Figure 4] The explanatory label on the last range constraint reads ``v≤t−v'' and should read ``v≤t−1''.
- [§III-B.a] The text refers to ``Appendix 15'' for the non-interactive proof-of-mod protocol; the actual non-interactive construction appears in Appendix H, so the cross-reference should be corrected.
- [Table II and §V-a] The claimed ``100× improvement over the current design'' compares the proposed VSS against an aggregate BLS signature broadcast, which is not a VSS protocol and is not an apples-to-apples baseline; the comparison with Feldman VSS is the appropriate one and should be the headline efficiency claim.
- [§II-A and §IV-b] The bit-length convention for weights is ambiguous near the boundary: p=2 has bit length 2, not 1, and the legal parameter set should explicitly state the minimum allowed sharing prime and whether p=2 is excluded; this matters for the soundness issue above.
Circularity Check
No circularity found: the proof-of-mod is derived from range proofs and external Bulletproofs soundness; no fitted parameter is relabeled as prediction and no load-bearing self-citation occurs.
full rationale
The paper's derivation chain is self-contained against external foundations. The CRT weighted secret sharing is taken from the external Garg et al. construction [9], and the VSS layer reduces each share-consistency statement to a proof-of-mod relation v = s mod p. That relation is then reduced (Section III-A) to range constraints on v and on k = (s-v)/p, with a boundary disjunction for the top t residues; these are arithmetic conditions, not restatements of the modular relation. Range proofs are instantiated with the external Bulletproofs R1CS proof system, and Theorem 1 derives soundness from commitment binding and circuit-proof soundness rather than from the target property. The prime-order decomposition (Section III-B) is an explicit recursion on base-p0 digits, with the p0 > p^2 + p condition ensuring intermediate sums stay below p0; each recursive step is again a base proof-of-mod on a smaller value, so the construction does not assume the conclusion. The VSS construction (Section IV) aggregates these proofs and relies on the CRT for reconstruction; Theorem 2 uses the same external primitives. The Ethereum evaluation parameters (m=108, min weight 10) are hand-chosen from the stake distribution and enter only the performance comparison, not the security argument, so there is no fitted input called a prediction. The only self-citations are acknowledgments of external prior work by non-overlapping or partially overlapping authors, and none is load-bearing: soundness rests on Bulletproofs [5] and CRT-WSS [9], which are independently published. A separate, non-circular correctness concern exists: the base proof-of-mod circuit in Appendix G operates over Z_p0, and for p = 2 a wrapped k + (q-k) decomposition can satisfy the circuit for a false congruence (e.g., p0=19, p=2, s=9, v=0); this is a soundness gap, not a circularity, and the Ethereum benchmark avoids it by using a minimum weight of 10. The inserted manuscript note about a long-table bug is a formatting artifact, not a circular step.
Assumptions & free parameters
free parameters (2)
- lifting length m =
108 (Ethereum example)
- minimum prime length N_min =
10 bits
assumptions (5)
- domain assumption Discrete logarithm problem is hard in the commitment group (e.g. an elliptic curve group of prime order p0).
- domain assumption Random oracle model for the Fiat-Shamir heuristic applied to the circuit proof and to the challenge z in the proof-of-mod.
- domain assumption Security of the Bulletproofs arithmetic circuit proof protocol (Theorem 3, citing [5]).
- domain assumption Security and parameter conditions of the CRT-based weighted ramp secret sharing from Garg et al. [9], including P_max << L < P_min/p0 - 1.
- ad hoc to paper All party primes satisfy p0 > p_i^2 + p_i (group order exceeds the square of each prime).
Cite this review
Pith. "Pith review of Verifiable Weighted Secret Sharing." pith.science (2026). https://pith.science/paper/IMPGIS6Y
@misc{pith2026250524289,
author = {Pith},
title = {Pith review of: Verifiable Weighted Secret Sharing},
year = {2026},
howpublished = {\url{https://pith.science/paper/IMPGIS6Y}},
note = {Machine review of arXiv:2505.24289}
}
abstract
Traditionally, threshold secret sharing (TSS) schemes assume all parties have equal weight, yet emerging systems like blockchains reveal disparities in party trustworthiness, such as stake or reputation. Weighted Secret Sharing (WSS) addresses this by assigning varying weights to parties, ensuring security even if adversaries control parties with total weight at most a threshold $t$. Current WSS schemes assume honest dealers, resulting in security from only honest-but-curious behaviour but not protection from malicious adversaries for downstream applications. \emph{Verifiable} secret sharing (VSS) is a well-known technique to address this, but existing VSS schemes are either tailored to TSS, or require additional trust assumptions. We propose the first efficient verifiable WSS scheme that tolerates malicious dealers and is compatible with the latest CRT-based WSS~\cite{crypto_w_weights}. Our solution uses Bulletproofs for efficient verification and introduces new privacy-preserving techniques for proving relations between committed values, which may be of independent interest. Evaluation on Ethereum show up to a $100\times$ improvement in communication complexity compared to the current design and $20\times$ improvement compared to unweighted VSS schemes.
Figures
Figures from the paper (1 more)
Reference graph
Works this paper leans on
-
[1]
A modular approach to key safeguarding,
C. Asmuth and J. Bloom, “A modular approach to key safeguarding,” IEEE Transactions on Information Theory, vol. 29, no. 2, pp. 208– 210, 1983
work page 1983
-
[2]
Efficient zero-knowledge arguments for arithmetic circuits in the discrete log setting,
J. Bootle, A. Cerulli, P. Chaidos, J. Groth, and C. Petit, “Efficient zero-knowledge arguments for arithmetic circuits in the discrete log setting,” Cryptology ePrint Archive, Paper 2016/263, 2016, https://eprint.iacr.org/2016/263. [Online]. Available: https: //eprint.iacr.org/2016/263
work page 2016
-
[3]
Chainlink 2.0: Next steps in the evolu- tion of decentralized oracle networks,
e. a. Breidenbach, L., “Chainlink 2.0: Next steps in the evolu- tion of decentralized oracle networks,” https://research.chain.link/ whitepaper-v2.pdf, 2021
work page 2021
-
[4]
Sticking to 8192 signatures per slot post- SSF: how and why — ethresear.ch,
V . Buterin, “Sticking to 8192 signatures per slot post- SSF: how and why — ethresear.ch,” https://ethresear.ch/t/ sticking-to-8192-signatures-per-slot-post-ssf-how-and-why/17989, 2023, [Accessed 28-01-2024]
work page 2023
-
[5]
Bulletproofs: Short proofs for confidential transactions and more,
B. Bünz, J. Bootle, D. Boneh, A. Poelstra, P. Wuille, and G. Maxwell, “Bulletproofs: Short proofs for confidential transactions and more,” in 2018 IEEE Symposium on Security and Privacy (SP), 2018, pp. 315– 334
work page 2018
-
[6]
T. D. C. Developers, “Bulletproofs in rust,” https://github.com/ dalek-cryptography/bulletproofs, 2024
work page 2024
-
[7]
A practical scheme for non-interactive verifiable secret sharing,
P. Feldman, “A practical scheme for non-interactive verifiable secret sharing,” in28th Annual Symposium on Foundations of Computer Science (sfcs 1987). IEEE, 1987, pp. 427–438
work page 1987
-
[8]
How to prove yourself: Practical solutions to identification and signature problems,
A. Fiat and A. Shamir, “How to prove yourself: Practical solutions to identification and signature problems,” inAdvances in Cryptology — CRYPTO’ 86, A. M. Odlyzko, Ed. Berlin, Heidelberg: Springer Berlin Heidelberg, 1987, pp. 186–194
work page 1987
Show all 19 references
-
[9]
Cryptography with weights: Mpc, encryption and signatures,
S. Garg, A. Jain, P. Mukherjee, R. Sinha, M. Wang, and Y . Zhang, “Cryptography with weights: Mpc, encryption and signatures,” inAd- vances in Cryptology – CRYPTO 2023, H. Handschuh and A. Lysyan- skaya, Eds. Cham: Springer Nature Switzerland, 2023, pp. 295–327
2023
-
[10]
Ethereum proof- of-stake consensus layer: Participation and decentralization,
D. Grandjean, L. Heimbach, and R. Wattenhofer, “Ethereum proof- of-stake consensus layer: Participation and decentralization,” 2023. [Online]. Available: https://arxiv.org/abs/2306.10777
2023 arXiv
-
[11]
Secret sharing extensions based on the chinese remainder theorem,
K. Kaya and A. A. Selçuk, “Secret sharing extensions based on the chinese remainder theorem,” Cryptology ePrint Archive, Paper 2010/096, 2010, https://eprint.iacr.org/2010/096. [Online]. Available: https://eprint.iacr.org/2010/096
2010
-
[12]
How to share a secret,
M. Mignotte, “How to share a secret,” inCryptography, T. Beth, Ed. Berlin, Heidelberg: Springer Berlin Heidelberg, 1983, pp. 371–375
1983
-
[13]
Schoenmakers,Verifiable Secret Sharing
B. Schoenmakers,Verifiable Secret Sharing. Boston, MA: Springer US, 2005, pp. 645–647. [Online]. Available: https://doi.org/10.1007/ 0-387-23483-7_452
2005
-
[14]
How to share a secret,
A. Shamir, “How to share a secret,”Commun. ACM, vol. 22, no. 11, p. 612–613, Nov. 1979. [Online]. Available: https: //doi.org/10.1145/359168.359176
1979
-
[15]
How to Stake Ethereum — investopedia.com,
M. Sharma, “How to Stake Ethereum — investopedia.com,” https:// www.investopedia.com/how-to-stake-ethereum-7482623, 2023, [Ac- cessed 28-01-2024]
2023
-
[16]
Publicly verifiable secret sharing,
M. Stadler, “Publicly verifiable secret sharing,” inAdvances in Cryp- tology — EUROCRYPT ’96, U. Maurer, Ed. Berlin, Heidelberg: Springer Berlin Heidelberg, 1996, pp. 190–199. APPENDIX A. Commitments We will use the formal definition of commitments as be- low. In general, Pede...
1996
-
[17]
, vn), π), the sharing program takes as input a secret valuesand producesnshares of the secret and a proofπ
Share pp(s)→((v 1, . . . , vn), π), the sharing program takes as input a secret valuesand producesnshares of the secret and a proofπ. The proofπis broadcast to all parties, whilev i is given only to partyi
-
[18]
In practice there will generally also be a verification program for accepting the shares
Reconstruct pp({(i, vi ∈ K)}i∈A, π)→s ′ ∈ K|⊥, the reconstruction programs take a set of shares and reconstructs the secret ass ′ or⊥/∈ K. In practice there will generally also be a verification program for accepting the shares. As this is not needed for the security of our VS...
-
[19]
Applying this to (16): 0≤ nX i=1 ai2i−1 =v≤ nX i=1 2i−1 <2 n G
Forn >0∈N,v∈[0,2 n]if and only If there exists vectors⃗ a,⃗b∈F n such that the following equations hold: nX i=1 ai2i−1 =v(16) ai ·b i = 0 1≤i≤n(17) ai −b i −1 = 0 1≤i≤n(18) Proof.Rearranging (18) and substituting into (17) gives: ai(ai −1) = 0 Thus eithera i = 0ora i = 1. Appl...
Reviewed August 7, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.