REVIEW 4 major objections 4 minor 21 references
MULTISS: un protocole de stockage confidentiel {\`a} long terme sur plusieurs r{\'e}seaux QKD
T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash
Pith's one-line read MULTISS claims to keep a stored secret perfectly confidential even if an attacker fully takes over one entire QKD network.
desk verdict Good idea, broken thresholds: the paper's reconstruction formulas are off by two, so the claimed security doesn't follow as written. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing mechanism is two-level Shamir secret sharing combined with Birkhoff interpolation. The top-level polynomial $P$ encodes the secret at $P(0)$; each subnetwork stores shares of a child polynomial $Q_j$ whose value at zero is either an evaluation of $P$ (for the mother network) or of the derivative $P'$ (for daughter networks). Reconstructing the secret uses Birkhoff interpolation to recover $P$ from these mixed value-and-derivative samples. The paper defines the decryption threshold of a polynomial as $T(P)=\deg(P)-1$ and derives the protocol thresholds $t_{\mathrm{networks}}$, $t_{\mathrm{nodes}}$, and $t_{\mathrm{fail}}$ from that convention.
What would settle it
Take a Shamir polynomial of degree 1 with secret $P(0)=S$ and two shares $P(1),P(2)$. The paper's convention $T(P)=\deg(P)-1$ would say zero shares are needed to learn $S$, but Lagrange interpolation requires both shares; running the protocol's reconstruction at the stated threshold on a small finite field will fail to recover $S$.
Extended reading notes
Core claim
The paper argues that a secret can be split across multiple QKD subnetworks in a hierarchy of Shamir shares so that no one subnetwork, even fully compromised, leaks the secret. The dealer generates a polynomial $P$ with $P(0)=S$, then creates a polynomial $Q_0$ with $Q_0(0)=P(1)$ for the mother network and polynomials $Q_j$ with $Q_j(0)=P'(j)$ for daughter networks; the evaluations of each $Q_j$ are the shares stored in that subnetwork. Reconstructing $S$ requires recovering enough $Q_j(0)$ values from a sufficient set of subnetworks and interpolating $P$ from values and derivatives. The paper states and proves that this construction preserves perfect secrecy and that MULTISS is strictly more secure than LINCOS.
Load-bearing premise
The protocol's threshold arithmetic assumes a polynomial of degree $d$ is reconstructed from $d$ shares, whereas the Shamir scheme it builds on requires $d+1$; if that count is wrong, the stated $t_{\mathrm{networks}}$, $t_{\mathrm{nodes}}$, and reconstruction procedure no longer match the protocol description.
Editorial extensions
If this is right
- If MULTISS is right, a long-term secret survives the complete compromise of any one QKD subnetwork, a guarantee LINCOS cannot offer.
- The owner only needs an information-theoretic link to one mother network; daughter networks can be far away and linked by classical cryptography.
- Share renewal can be run per subnetwork without ever reconstructing the secret, so partial leaks can be neutralized over time.
- The three tunable thresholds let a deployer balance availability, confidentiality, and resilience to denial of service.
- Confidentiality is independent of future computing power or cryptanalytic progress, because the scheme is information-theoretic.
Reading between the lines
- If the threshold convention is corrected from $\deg(P)-1$ to $\deg(P)+1$, the stated thresholds and reconstruction conditions would have to be re-derived; the underlying hierarchical construction may still work with different degree choices.
- Using $P'$ at daughter subnetworks means each subnetwork holds derivative information about $P$; this is a natural point to test whether particular subsets of subnetworks leak linear relations among $P$'s coefficients.
- An implementation test with small finite fields, comparing the number of shares actually needed to interpolate $P$ against the paper's formulas, would expose any off-by-one threshold issue directly.
- The paper's own threat-model discussion implies the protocol is not designed to resist an attacker who both fully compromises the mother network and decrypts all recorded classical traffic; deployments must choose which of the two adversaries to defend against.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes MULTISS, a hierarchical secret-sharing protocol for long-term confidential storage over multiple QKD networks, extending the single-network LINCOS protocol. The construction uses a top-level polynomial P with P(0)=S and per-network polynomials Q_i for the mother network (Q_0(0)=P(1)) and daughter networks (Q_i(0)=P'(i)). The paper claims perfect secrecy against an adversary who compromises an entire QKD subnetwork, asserts that MULTISS is strictly more secure than LINCOS, and describes how to refresh shares without reconstructing the secret. Section VI defines three thresholds (t_nodes, t_networks, t_faille) and gives formulas in Eqs. (1)-(4).
Significance. If the protocol were correct, MULTISS would be a useful contribution: it leverages Birkhoff interpolation in a hierarchical secret-sharing scheme to tolerate full compromise of one QKD network, and it addresses a real limitation of LINCOS. The motivation is clear, the adversary models are explicitly stated, and Section V-D honestly notes that the two adversarial scenarios are incompatible. However, the paper does not contain a proof of its central 'strictly more secure than LINCOS' claim, and the threshold formulas in Section VI are internally inconsistent with the standard Shamir and Birkhoff interpolation requirements stated in Section III. As written, the central security and reconstruction claims are unsupported. No machine-checked proofs or reproducible code are provided.
major comments (4)
- [Section VI, Eqs. (1)-(2) and reconstruction paragraph] The threshold convention T(P)=deg(P)-1 is inconsistent with Section III.A, where a degree k-1 Shamir polynomial requires k=deg(P)+1 shares, and with Section III.B, where a degree-deg(P) polynomial requires deg(P)+1 Birkhoff conditions. Consequently, the statements 'au moins deg(P)-1 sous-réseaux' and 'deg(Q_j)-1 partages' undercount the required number of shares by two. For a concrete counterexample, take l=3 and deg(P)=deg(Q_0)=deg(Q_1)=deg(Q_2)=2. Eqs. (1)-(2) then give t_networks=1 and t_nodes=1, implying that a single share in one subnetwork reveals the secret. But a degree-2 polynomial P is not determined by one value P(1) (or one derivative P'(1)); three independent conditions are required. The reconstruction procedure therefore does not work as stated.
- [Section VI, Eqs. (3)-(4)] The availability thresholds inherit the same off-by-two error. To make the secret unavailable, an adversary must reduce the number of available shares below the true reconstruction threshold in every qualifying set of subnetworks. Using T(Q_i)=deg(Q_i)-1 instead of deg(Q_i)+1 changes the number of nodes that must be shut down by two for each subnetwork. The formulas t_f0 = n_0 - T(Q_0)+1 and t_f1 must be re-derived with the correct threshold, and the final Eq. (4) is therefore also incorrect as written.
- [Abstract, Introduction, and Conclusion] The abstract, introduction, and conclusion state that MULTISS is 'prouvé strictement plus sécurisé que LINCOS', but no proof or formal security argument appears anywhere in the paper. Section V describes adversary models and Section V-D notes their incompatibility, but that is not a proof of strict security superiority. This is a central advertised claim and must be supported by a rigorous argument or a clear reduction to the security of the underlying primitives.
- [Section VI, definition of polynomial degrees] The protocol lets the user choose thresholds t_networks, t_nodes, and t_faille, but it never specifies how the degrees deg(P) and deg(Q_i) are derived from these thresholds. The sentence 'le propriétaire définira les degrés des différents polynômes' is not a specification. Without an explicit mapping from thresholds to degrees, Eqs. (1)-(4) cannot be evaluated and the protocol is underspecified even after the threshold-counting error is corrected.
minor comments (4)
- [References] Reference [12] has a typo in the title: 'Mutliss' should be 'MULTISS'.
- [Section VI, first paragraph] The text says 'nombre minium de nœuds'; 'minium' should be 'minimum'.
- [Section VI, Eq. (2)] The minimization over I is typeset across a line break and is hard to parse; please reformat the set-builder notation so that the condition |I|=... is clearly part of the minimization.
- [Section III.B] The phrase 'k employés dont 1 manager' is ambiguous; it should be clarified as 'k participants, dont au moins un manager' to indicate that the total number of participants is k.
Circularity Check
No significant circularity: MULTISS derives from external Shamir/Tassa/Birkhoff primitives; the threshold error and unproved LINCOS comparison are correctness/support concerns, not self-referential derivations.
full rationale
The protocol construction is self-contained in the sense that it composes publicly known primitives: Shamir secret sharing [8], Tassa's hierarchical threshold sharing [19], and Birkhoff interpolation [20]. No parameter is fitted to a data subset and then renamed a prediction, and no normalization or calibration step appears anywhere. The only self-citation, [12], is a pointer to the authors' own ePrint for the name MULTISS; it is not used as evidence for any security property, so it is not load-bearing. Section VI's reconstruction thresholds (T(P)=deg(P)-1, and deg(Q_j)-1 shares per subnetwork) conflict with the paper's own Section III.A/B and with standard Shamir/Birkhoff counting, which require deg(P)+1 conditions, and the abstract's claim 'Nous prouvons également que MULTISS est strictement plus sécurisé que LINCOS' is not backed by a proof section. These are genuine correctness and missing-support problems, but neither makes the claimed derivation equivalent to its own inputs by construction. The central security argument is a straightforward composition of external primitives with stated threshold choices, and Section V.D honestly states the limitation that the two adversary models are incompatible, so no circular step is exhibited.
Assumptions & free parameters
free parameters (2)
- deg(P), degree of the top-level polynomial P =
chosen by the owner, determines t_networks via Eq (1)
- deg(Q_i), degrees of per-network polynomials =
chosen by the owner, determines t_nodes via Eq (2)
assumptions (9)
- standard math Arithmetic is performed in a finite field F_q
- standard math A degree k-1 polynomial is uniquely determined by k evaluation points (Lagrange interpolation)
- standard math Birkhoff interpolation recovers a polynomial from a mix of values and derivatives
- standard math Shamir secret sharing is information-theoretically secure
- domain assumption QKD provides information-theoretically secure point-to-point links
- domain assumption Authentication of QKD participants is perfect at the time of exchange
- domain assumption The document owner has an ITS link only to the mother network; daughter networks are reached through classical cryptography
- domain assumption The two adversary classes (network compromise and later classical decryption) are mutually exclusive
- ad hoc to paper T(P)=deg(P)-1 is the decryption threshold of a polynomial
Cite this review
Pith. "Pith review of MULTISS: un protocole de stockage confidentiel {\`a} long terme sur plusieurs r{\'e}seaux QKD." pith.science (2026). https://pith.science/paper/XX274LGJ
@misc{pith2026250604800,
author = {Pith},
title = {Pith review of: MULTISS: un protocole de stockage confidentiel \`a long terme sur plusieurs r\'eseaux QKD},
year = {2026},
howpublished = {\url{https://pith.science/paper/XX274LGJ}},
note = {Machine review of arXiv:2506.04800}
}
read the original abstract
This paper presents MULTISS, a new protocol for long-term storage distributed across multiple Quantum Key Distribution (QKD) networks. This protocol is an extension of LINCOS, a secure storage protocol that uses Shamir secret sharing for secret storage on a single QKD network. Our protocol uses hierarchical secret sharing to distribute a secret across multiple QKD networks while ensuring perfect security. Our protocol further allows for sharing updates without having to reconstruct the entire secret. We also prove that MULTISS is strictly more secure than LINCOS, which remains vulnerable when its QKD network is compromised.
Reference graph
Works this paper leans on
-
[1]
An efficient quantum computing technique for cracking RSA using Shor’s algorithm,
V . Bhatia and K. Ramkumar, “An efficient quantum computing technique for cracking RSA using Shor’s algorithm,” in 2020 IEEE 5th internatio- nal conference on computing communication and automation (ICCCA) . IEEE, 2020, pp. 89–94
work page 2020
-
[2]
Elliptic curve cryptography : Pre and post quan- tum,
J. Wohlwend, “Elliptic curve cryptography : Pre and post quan- tum,” http://math.mit.edu/~apost/courses/18.204-2016/18.204_Jeremy_ Wohlwend_final_paper.pdf, 2016
work page 2016
-
[3]
Attacks on some post-quantum cryptographic proto- cols : The case of the Legendre PRF and SIKE,
N. Kaluderovic, “Attacks on some post-quantum cryptographic proto- cols : The case of the Legendre PRF and SIKE,” EPFL, Tech. Rep., 2022
work page 2022
-
[4]
On the transition to post-quantum cryptography in the industrial Internet of things,
S. Paul, “On the transition to post-quantum cryptography in the industrial Internet of things,” 2022
work page 2022
-
[5]
Communication theory of secrecy systems,
C. E. Shannon, “Communication theory of secrecy systems,” The Bell system technical journal , 1949
work page 1949
-
[6]
Quantum cryptography : Public key distribution and coin tossing,
C. H. Bennett and G. Brassard, “Quantum cryptography : Public key distribution and coin tossing,” Theoretical computer science , 2014
work page 2014
-
[7]
Lincos : A storage system providing long- term integrity, authenticity, and confidentiality,
J. Braun, J. Buchmann, D. Demirel, M. Geihs, M. Fujiwara, S. Moriai, M. Sasaki, and A. Waseda, “Lincos : A storage system providing long- term integrity, authenticity, and confidentiality,” in Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, 2017
work page 2017
-
[8]
A. Shamir, “How to share a secret,” Communications of the ACM, 1979
work page 1979
Show all 21 references
-
[9]
An entropy-based demonstration of the security of Shamir’s secret sharing scheme,
C. L. Corniaux and H. Ghodosi, “An entropy-based demonstration of the security of Shamir’s secret sharing scheme,” in 2014 International Conference on Information Science, Electronics and Electrical Enginee- ring. IEEE, 2014
2014
-
[10]
[Online]
(2020, December) Medical data successfully protected by quantum cryptography in Graz. [Online]. Available : https://tinyurl.com/bdzyadu5
2020
-
[11]
Secure secondary utilization system of genomic data using quantum secure cloud,
M. Fujiwara, H. Hashimoto, K. Doi, M. Kujiraoka, Y . Tanizawa, Y . Ishida, M. Sasaki, and M. Nagasaki, “Secure secondary utilization system of genomic data using quantum secure cloud,” Sci Rep, vol. 15, no. 18530, 2022
2022
-
[12]
Mutliss : a protocol for long-term secure distributed storage over multiple remote QKD networks,
T. Prévost, O. Alibart, A. Marin, and M. Kaplan, “Mutliss : a protocol for long-term secure distributed storage over multiple remote QKD networks,” Cryptology ePrint Archive , 2024
2024
-
[13]
No-cloning theorem, quantum tele- portation and spooky correlations,
B. Zygelman and B. Zygelman, “No-cloning theorem, quantum tele- portation and spooky correlations,” A First Introduction to Quantum Computing and Information , 2018
2018
-
[14]
Quantum cryptography : Public-key distribution and coin tossing,
C. Bennett and G. Brassard, “Quantum cryptography : Public-key distribution and coin tossing,” in Proceedings of IEEE International Conference on Computers, Systems and Signal Processing . IEEE Computer Society Press, Los Alamitos, 1984
1984
-
[15]
Quantum cryptography based on bell’s theorem,
A. K. Ekert, “Quantum cryptography based on bell’s theorem,” Physical review letters, 1991
1991
-
[16]
Operational entanglement-based quantum key distribution over 50 km of field-deployed optical fibers,
Y . Pelet, G. Sauder, M. Cohen, L. Labonté, O. Alibart, A. Martin, and S. Tanzilli, “Operational entanglement-based quantum key distribution over 50 km of field-deployed optical fibers,” Phys. Rev. Appl. , vol. 20, p. 044006, Oct 2023. [Online]. Available : https://link.aps.or...
2023 doi
-
[17]
Safeguarding cryptographic keys,
G. R. Blakley, “Safeguarding cryptographic keys,” in Managing require- ments knowledge, international workshop on . IEEE Computer Society, 1979
1979
-
[18]
Vii. problems concerning interpolations,
E. Waring, “Vii. problems concerning interpolations,” Philosophical transactions of the royal society of London , 1779
-
[19]
Hierarchical threshold secret sharing,
T. Tassa, “Hierarchical threshold secret sharing,” in Theory of Crypto- graphy Conference. Springer, 2004
2004
-
[20]
General mean value and remainder theorems with applications to mechanical differentiation and quadrature,
G. D. Birkhoff, “General mean value and remainder theorems with applications to mechanical differentiation and quadrature,” Transactions of the American Mathematical Society , 1906
1906
-
[1979]
Elle permet à une personne, le dealer, de distribuer un secret entre n participants, chaque fraction du secret s’appelant un « partage »
Nous utilisons ici la primitive proposée par Shamir. Elle permet à une personne, le dealer, de distribuer un secret entre n participants, chaque fraction du secret s’appelant un « partage ». Le dealer définit un seuil k de participants qui devraient mettre leurs partages en co...
Reviewed August 7, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.