Threshold Changeable Secret Sharing Scheme and Its Application to Group Authentication

Fuyou Miao; Keju Meng; Wenchao Huang; Yan Xiong; Yue Yu

REVIEW 5 major objections 5 minor 34 references

Threshold Changeable Secret Sharing Scheme and Its Application to Group Authentication

T0 review · 5 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A linear-code secret-sharing scheme raises the threshold from t to the exact number of participants present, with asymptotically perfect security and no computational assumptions.

desk verdict The scheme is a clean repackaging of the zero-addition TCSS trick, but the linear-code masking is broken: an adversary holding m-1 components recovers log n bits of the secret, so the asymptotically-perfect security theorem does not hold. read the letter →

arxiv 1908.02110 v2 pith:VG4SZIWK submitted 2019-08-06 cs.CR

Fuyou Miao , Yue Yu , Keju Meng , Wenchao Huang , Yan Xiong This is my paper · ORCID

classification cs.CR MSC 94A6294A6094B05

keywords thresholdchangeablesecretsharinglinearcodegroupauthenticationillegalparticipantattackasymptoticallyperfectsecurityinformation-theoretic

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that a linear-code secret-sharing scheme can raise its reconstruction threshold from t to the exact number m of participants who show up, without any dealer interaction and without relying on one-way functions, encryption, or other computational assumptions. The motivation is the illegal participant attack: an outsider with no valid share can join a reconstruction, collect valid shares from the honest participants, and recover the secret. The scheme answers this by making every participant send a blinded component, so the secret is recoverable only when all m components are present. The paper then uses the same construction as a one-round group authentication protocol, in which every user checks all other users at once by comparing the recovered secret against a published hash. The security goal is "asymptotically perfect": as the secret field grows, any coalition of fewer than all participants learns essentially nothing.

What carries the argument

The carrying object is the public generator matrix $G = (\vec g_0, \vec g_1, \dots, \vec g_n)$ of an $[n+1,t]$ linear code over $\mathbb{F}_p$: an $[n+1,t]$ linear code is a $t$-dimensional subspace of $\mathbb{F}_p^{n+1}$, represented here by its columns. The dealer picks a private row vector $\vec v \in \mathbb{F}_p^t$ with $s = \vec v \cdot \vec g_0 \bmod p$ and hands shareholder $U_i$ the share $s_i = \vec v \cdot \vec g_i \bmod p$. To reconstruct with $m \ge t$ participants, everyone non-interactively solves for public coefficients $b_i$ such that $\vec g_0 = \sum_{i\in I_m} b_i \vec g_i \bmod p$, then sends the component $c_i = (b_i s_i + r_i q) \bmod p$ with $r_i$ uniformly random in $\mathbb{F}_q$. The additive term $r_i q$ blinds the share, and the parameter condition $p > n q^2$ ensures that $\sum c_i \bmod p$ equals $s + q\sum r_i$ without wraparound, so reducing modulo $q$ extracts the secret. This component-construction step is what raises the threshold from $t$ to $m$.

What would settle it

For a concrete instantiation (e.g., $t = 2$, $n = 3$, $q = 5$, and $p$ just above $n q^2$), enumerate every admissible dealer vector $\vec v \in \mathbb{F}_p^2$ consistent with the public data and compare the true probability that an adversary with one legitimate share guesses the secret with the bound $(\lfloor p/q \rfloor + 1)/p$ used in the proofs; if the true probability is materially larger, the uniformity assumption fails.

Watch

Extended reading notes

Core claim

The paper's central claim is that an adversary who impersonates a legal shareholder, without holding a valid share, cannot recover the secret, because the one component it is forced to forge leaves the sum statistically uniform over the large field, so guessing the secret is no easier than guessing from the small secret field directly. The same mechanism makes the threshold changeable: with m participants, the secret is recoverable from all m components, while any proper subset yields asymptotically no information, so the effective threshold is m rather than t. The underlying identity is simple: each participant sends $c_i = (b_i s_i + r_i q) \bmod p$, with public coefficients $b_i$ satisfying $\vec g_0 = \sum_i b_i \vec g_i$; summing components gives $s + q\sum_i r_i$ modulo $p$, and reducing modulo $q$ returns $s$ because the parameters satisfy $p > n q^2$. The paper also claims that fewer than t original shareholders get asymptotically no information, and applies the construction to group authentication by checking a published hash of the recovered secret.

Load-bearing premise

Everything rests on the assumption that knowing the secret came from a small range does not make any hidden share look any less random over the large field; if that conditional uniformity fails, the claimed asymptotic bounds do not follow.

Editorial extensions

If this is right

With $m$ participants, the threshold becomes exactly $m$: the secret is recovered from all $m$ components, while any proper subset yields asymptotically no information.
An adversary without a valid share cannot learn the secret by impersonating a shareholder; the probability of a successful guess is bounded by roughly $1/q$, the same as guessing the secret directly.
The scheme is dealer-free after setup and non-interactive: participants compute the same public coefficients locally and exchange one component each.
The group-authentication instantiation lets each user authenticate all other users in one round by checking whether the recovered secret hashes to the published value, with no public-key operations.
Security is asymptotic rather than exact: the mutual-information leakage tends to zero as the secret field grows, so concrete security depends on choosing the field sizes large enough.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Beyond the paper: an immediate extension, noted but not developed, is an authenticated group key agreement, where the same component sum becomes a shared group key once the hash check passes.
Beyond the paper: because the authentication is all-or-nothing, it does not identify which user is a non-member; a follow-up binary-search procedure using overlapping subsets of participants would localize the intruder while preserving the one-round property for each subset.
Beyond the paper: the paper's asymptotic statement leaves open the exact finite-parameter leakage; a tighter accounting of entropy conditioned on the public fact that the secret lies in a small subfield would tell practitioners how large the field ratio must be for a targeted security level.
Beyond the paper: the same linear-code component mechanism could be applied to other group-oriented tasks, such as privacy-preserving polling or threshold signatures, wherever "all present parties must be legitimate" is the required access policy.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: the paper does something sensible with a known trick, but its central security theorem is wrong. The construction—mask each linear-code share with a random multiple of q, then recover s = (sum of components mod p) mod q—is a direct descendant of Nojoumian-Stinson zero-addition, and the paper is honest about that. Correctness (Theorem 1) is fine: because s + qΣr_i < p, the modular reductions compose.

The problem is the uniformity claim underneath Theorems 3 and 4. Lemma 2 and Corollary 1 are not applicable to the actual distribution. The sum in Eq. 7 is not uniform over F_p; it is confined to s + qR, where R is a sum of m bounded random variables and s ∈ F_q. Corollary 1 is simply false in general: one F_q-valued variable times a nonzero coefficient is uniform on a q-element subset of F_p, not on F_p.

Concretely, for t=2, m=3, an adversary with c1,c2 enumerates (r1,r2) ∈ F_q^2, inverts the two adjusted shares to recover v, and keeps those candidates with v·g0 ∈ F_q. The true pair survives; a random wrong pair lands in F_q with probability about q/p, so the expected number of false candidates is q^3/p < q/n. The posterior support of s is about 1 + q/n values, which gives I(s; c1,c2) ≥ log n − o(1) as q grows. That is not asymptotically perfect security, and it contradicts Theorem 4. The same defect invalidates Theorem 3's IPA argument, and Theorems 5 and 6 inherit the failure. Corollary 1's proof is also omitted, which would have been the place to see the F_q support problem.

The group-authentication application is a natural use of TCSS and the paper is clearly written. The performance comparison is mostly fine, though the security column overstates what is proven. The literature coverage is fair; the citation to [24] undercuts the novelty claim but is not an error.

Who is this for? Someone working on TCSS or group authentication might read it as a cautionary example of how masked linear-code shares still leak through the linear relation. But the advertised scheme should not be used, and the paper in current form does not deserve acceptance. I'd still send it to a referee if I were an editor—the flaw is real but subtle, and an expert report would be useful to the authors and the community—but the expected and correct outcome is rejection.

Referee Report

5 major / 5 minor

Summary. This manuscript proposes a threshold changeable secret sharing (TCSS) scheme based on linear codes. The dealer chooses a secret s in F_q and a row vector v in F_p^t satisfying s = v·g0 mod p, computes shares s_i = v·g_i mod p, and distributes them. To reconstruct with a set of m participants, each participant publishes a component c_i = b_i s_i + r_i q mod p, where r_i is chosen uniformly from F_q and b_i are public coefficients satisfying g0 = Σ b_i g_i. The reconstruction formula s = (Σ c_i mod p) mod q is shown to be correct. The paper claims that fewer than m components reveal asymptotically no information about the secret (Theorems 2-4), that the scheme resists illegal participant attacks without any computational assumption, and that it achieves 'asymptotically perfect' security. A group authentication scheme is then built on the TCSS scheme in Section 5, with security inherited from Theorems 2 and 3.

Significance. If the security claims were correct, the paper would present a clean, dealer-free threshold-changeable secret sharing scheme with information-theoretic security, together with a simple group authentication protocol. The construction is easy to understand and the correctness proof (Theorem 1) is sound. However, the central security analysis is invalid: the distributional assumptions underlying Theorems 2-4 are false, and a concrete attack shows that m-1 components leak a non-vanishing amount of information about the secret. Because the group authentication application relies directly on these theorems, the contribution is not established.

major comments (5)

[Theorem 4, Eq. (7)] The proof of Theorem 4 asserts that the left side of Eq. (7), namely (Σ_{i=1}^m c_i mod p) - s', is uniformly distributed over F_p according to Lemma 2. This is false. For an honest component set, Σ_{i∈I_m} c_i ≡ s + q Σ_{i∈I_m} r_i (mod p), with s∈F_q and each r_i∈F_q. Because p>nq^2 and m≤n, the integer s+qΣr_i is strictly below p, so the support of this sum is contained in the set {s+qR : s∈F_q, 0≤R≤m(q-1)}, whose size is at most m q^2, which is strictly less than p. Lemma 2 requires the summands to be mutually independent and uniform over F_p, so it does not apply. Consequently, the bound P(s|C_j) ≤ (⌊p/q⌋+1)/p and the conclusion lim_{q→∞} I(s;C_j)=0 are unsupported.
[Theorem 4, concrete attack] The failure is not merely a proof gap: an adversary with m-1 components obtains a substantial amount of information about s. Consider t=2, m=3, and suppose the adversary holds c_1 and c_2. For each guess (r_1,r_2)∈F_q^2, the adversary computes adjusted shares s_i' = b_i^{-1}(c_i - q r_i) mod p. The two adjusted shares determine the unique dealer vector v∈F_p^2, yielding a candidate secret s'=v·g0 mod p. The true pair (r_1,r_2) always yields the true secret. A uniformly random wrong pair yields s'∈F_q with probability q/p, so the expected number of surviving candidate secrets is 1+q^3/p. Since p>nq^2, q^3/p<q/n, and the posterior support of s has expected size at most 1+q^3/p. Thus I(s;{c_1,c_2}) ≥ log q - log(1+q^3/p), which is approximately log n - o(1) as q grows, not 0. This contradicts the claim of Theorem 4 and extends to general m-1 component sets.
[Theorem 3, Eq. (6)] Theorem 3 contains the same uniformity error. Step 1 claims that each c_i, and therefore Σ_{i=1}^m c_i mod p, is uniformly distributed over F_p. This is false: c_i = b_i s_i + r_i q mod p, and because r_i ranges over F_q, the component c_i is supported on the set b_i s_i + qF_q mod p, which has size q, not p. In Eq. (6), the proof claims the left side s' - (Σ_{i=1}^{m-1} c_i + c'_m) mod p is uniformly distributed over F_p; however, the valid components are not uniform over F_p, so Lemma 2 cannot be applied. The resulting bound P(s'=s) ≤ (⌊p/q⌋+1)/p is therefore not justified, and the IPA-resistance claim in Theorem 3 is not established.
[Theorem 2 and Corollary 1] The proof of Theorem 2 relies on Lemma 2 to assert that the unknown share s_t = v·g_t is uniformly distributed over F_p. This is not justified: the dealer's vector v is chosen subject to s = v·g0 mod p with s∈F_q, so v is not uniform over F_p^t; after conditioning on the observed shares, v takes at most q·p^{t-1-|Ω'|} possible values rather than p^{t-|Ω'|}. The distributional hypothesis of Lemma 2 is therefore not satisfied. The same problem invalidates the use of Corollary 1 when claiming that Σ c_i is uniform over F_p: Corollary 1, whose proof is omitted, does not apply to sums in which the r_i are uniform over F_q rather than F_p. Although the conclusion of Theorem 2 may be true, the proof as written is invalid, and Theorem 6 inherits the gap.
[Section 5, Theorems 5 and 6] The security claims of the group authentication scheme are derived directly from Theorems 2 and 3. Since those theorems are not proven as written, and Theorem 4 fails in the sense that m-1 components leak non-negligible mutual information, the assertions in Theorems 5 and 6 that a non-member cannot forge a valid component and that t-1 members cannot forge a token are unsupported. In particular, the concrete attack on Theorem 4 implies that an adversary holding m-1 valid components can reduce the secret to a small candidate set, which is relevant to the group authentication setting.

minor comments (5)

[Section 3.2, Share Generation] The text says the dealer 'allocates s_i to U_i as the share secretly for i = 0,1,...n', but there are only n shareholders and s_0 is the secret, not a share; this should be i=1,...,n.
[Section 4.2, Performance Comparison] The parameter condition q^3 > p > nq^2 appears only in the performance comparison, while the scheme description states only p>nq^2. The relationship between q and p used to derive the share-size bound should be stated explicitly among the scheme parameters.
[Remark 3] The phrase 'non-number' should be 'non-member'.
[Theorem 4 proof] The notation C_j (lowercase j) in the theorem statement is written as C_J (uppercase J) in the proof; please standardize the notation.
[Corollary 1] The proof of Corollary 1 is omitted; since the corollary is used to justify the uniformity of component sums, a full proof or a precise statement of its hypotheses is necessary.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular reasoning: the scheme's security claims fail on a false uniformity assumption, not on a derivation that reduces to its own inputs.

full rationale

I walked the claimed derivation chain. The TCSS scheme is self-contained: the secret is chosen in F_q, the dealer picks v with s = v·g0 mod p, components are c_i = (b_i s_i + r_i q) mod p, and recovery is (sum c_i mod p) mod q. Theorem 1 is a direct algebraic identity. The security arguments invoke only standard finite-field facts (Lemma 1, Lemma 2) and the classical linear-code secret-sharing formulation of McEliece-Sarwate and Massey; these are external results, not self-citations, and no parameter is fitted to any target output. The only self-reference in the bibliography is [21] (Meng et al. 2019), cited in the introduction as an example application and never load-bearing. There is no step where a 'prediction' is equivalent by construction to an input, no fitted parameter renamed as a prediction, and no uniqueness claim imported from the authors' prior work. The serious defect is a mathematical error rather than circularity: Theorem 4's Eq. (7) asserts that (Σ_{i∈I_m} c_i mod p − s') mod p is uniformly distributed over F_p 'according to Lemma 2,' but conditional on fewer than m components the missing share variables are not generally uniform over F_p (with m−1 known components and m−1 ≥ t, the remaining share is determined by at most q^{m−1} possible choices of the r_i's, and q^{m−1} can be much smaller than p; the same non-uniformity affects Theorem 3's claim about Σ c_i). Corollary 1's proof is explicitly omitted ('Omitted'), and the security theorems rest on that unproved corollary. These are proof errors that invalidate the asymptotically perfect security claim, but they are not circular dependencies; hence the circularity score is 0.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The scheme introduces no new physical or mathematical entities. The free parameters p and q are standard cryptographic parameters, not fitted values. The critical axiom is the false uniformity assumption about the dealer's vector v.

assumptions (3)

ad hoc to paper The dealer's row vector v is uniformly distributed over F_p^t from the adversary's perspective, even conditioned on v·g0 mod p being in F_q.
This assumption is invoked implicitly in the proofs of Theorems 2, 3, and 4, but it is false. The constraint s = v·g0 mod p with s in F_q restricts v to a set of size q·p^(t-1), not p^t. This is the root of the security failure.
standard math Corollary 1: (sum a_i x_i + sum b_j y_j) mod p is uniform over F_p for x_i uniform over F_p and y_j uniform over F_q.
This corollary is true when stated correctly, but the proof is omitted and it is misapplied to cases where the x_i are not uniform over F_p because of the secret-space constraint.
domain assumption A generator matrix G with any t columns linearly independent exists (MDS code).
The scheme requires such a matrix, and the Vandermonde matrix is given as an option. This is a standard assumption in linear-code secret sharing.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Threshold Changeable Secret Sharing Scheme and Its Application to Group Authentication." pith.science (2026). https://pith.science/paper/VG4SZIWK

@misc{pith2026190802110,
  author       = {Pith},
  title        = {Pith review of: Threshold Changeable Secret Sharing Scheme and Its Application to Group Authentication},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VG4SZIWK}},
  note         = {Machine review of arXiv:1908.02110}
}

abstract

Group oriented applications are getting more and more popular in mobile Internet and call for secure and efficient secret sharing (SS) scheme to meet their requirements. A $(t,n)$ threshold SS scheme divides a secret into $n$ shares such that any $t$ or more than $t$ shares can recover the secret while less than $t$ shares cannot. However, an adversary, even without a valid share, may obtain the secret by impersonating a shareholder to recover the secret with $t$ or more legal shareholders. Therefore, this paper uses linear code to propose a threshold changeable secret sharing (TCSS) scheme, in which threshold should increase from $t$ to the exact number of all participants during secret reconstruction. The scheme does not depend on any computational assumption and realizes asymptotically perfect security. Furthermore, based on the proposed TCSS scheme, a group authentication scheme is constructed, which allows a group user to authenticate whether all users are legal group members at once and thus provides efficient and flexible m-to-m authentication for group oriented applications.

Figures

Figures reproduced from arXiv: 1908.02110 by the authors.

**Figure 1.** Example of IP attack with threshold 3 is threshold changeable (also known as dynamic threshold) secret sharing (TCSS). TCSS allows shareholders to change threshold from t to t 0 where t 0 > t. In this case, t 0 or more than t 0 shareholders can recover the secret while less than t 0 cannot. Therefore, some TCSS schemes can prevent IPA if there are exact t 0 participants with t ≤ t 0 ≤ n and the threshold is also rai… view at source ↗

**Figure 2.** The proposed TCSS scheme 11 [PITH_FULL_IMAGE:figures/full_fig_p011_2.png] view at source ↗

**Figure 3.** Group authentication scheme based on TCSS [PITH_FULL_IMAGE:figures/full_fig_p019_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

34 extracted references · 33 canonical work pages

[24]

On dealer-free dynamic threshold schemes

Mehrdad Nojoumian and Douglas R Stinson. On dealer-free dynamic threshold schemes. Advances in Mathematics of Communications , 7(1), 2013. 24

work page 2013
[1]

Linear subspace crypt- analysis of harn’s secret sharing-based group authentication scheme

Zahra Ahmadian and Sadegh Jamshidpour. Linear subspace crypt- analysis of harn’s secret sharing-based group authentication scheme. IEEE Transactions on Information Forensics and Security , 13(2):502– 510, 2017

work page 2017
[2]

A modular approach to key safeguard- ing

Charles Asmuth and John Bloom. A modular approach to key safeguard- ing. IEEE transactions on information theory , 29(2):208–210, 1983

work page 1983
[3]

Hierarchy-based cheating detection and cheater identiﬁcation in secret sharing schemes

Shalini Banerjee, Daya Sagar Gupta, and GP Biswas. Hierarchy-based cheating detection and cheater identiﬁcation in secret sharing schemes. In 2018 4th International Conference on Recent Advances in Information Technology (RAIT), pages 1–6. IEEE, 2018

work page 2018
[4]

Safeguarding cryptographic keys

George Robert Blakley. Safeguarding cryptographic keys. In 1979 In- ternational Workshop on Managing Requirements Knowledge (MARK) , pages 313–318. IEEE, 1979. 22

work page 1979
[5]

Fully dynamic secret sharing schemes

Carlo Blundo, Antonella Cresti, Alfredo De Santis, and Ugo Vaccaro. Fully dynamic secret sharing schemes. Theoretical Computer Science , 165(2):407–440, 1996

work page 1996
[6]

Foundations of homomorphic secret sharing

Elette Boyle, Niv Gilboa, Yuval Ishai, Huijia Lin, and Stefano Tessaro. Foundations of homomorphic secret sharing. In 9th Innovations in The- oretical Computer Science Conference (ITCS 2018) . Schloss Dagstuhl- Leibniz-Zentrum fuer Informatik, 2018

work page 2018
[7]

Linear codes from perfect nonlinear mappings and their secret sharing schemes

Claude Carlet, Cunsheng Ding, and Jin Yuan. Linear codes from perfect nonlinear mappings and their secret sharing schemes. IEEE Transac- tions on Information Theory , 51(6):2089–2102, 2005

work page 2005

Show all 34 references

[8]

Group authentication

Lein Harn. Group authentication. IEEE Transactions on computers , 62(9):1893–1898, 2012

2012
[9]

Dynamic threshold secret reconstruc- tion and its application to the threshold cryptography

Lein Harn and Ching-Fang Hsu. Dynamic threshold secret reconstruc- tion and its application to the threshold cryptography. Information Processing Letters, 115(11):851–857, 2015

2015
[10]

Security analysis of a dy- namic threshold secret sharing scheme using linear subspace method

Sadegh Jamshidpour and Zahra Ahmadian. Security analysis of a dy- namic threshold secret sharing scheme using linear subspace method. IACR Cryptology ePrint Archive , 2017:1099, 2017

2017
[11]

A new threshold changeable secret sharing scheme based on the chinese remainder theorem

Xingxing Jia, Daoshun Wang, Daxin Nie, Xiangyang Luo, and Jonathan Zheng Sun. A new threshold changeable secret sharing scheme based on the chinese remainder theorem. Information Sciences, 473:13– 30, 2019

2019
[12]

Secret sharing made short

Hugo Krawczyk. Secret sharing made short. In Annual International Cryptology Conference, pages 136–146. Springer, 1993

1993
[13]

Linear (k, n) secret sharing scheme with cheating detection

Yanxiao Liu. Linear (k, n) secret sharing scheme with cheating detection. Security and Communication Networks , 9(13):2115–2121, 2016

2016
[14]

A forward-secure threshold signature scheme based on multiplicative secret sharing and strong rsa assumption

Dianjun Lu, Yu Wang, Xiaoqin Zhang, and Lanfen Ji. A forward-secure threshold signature scheme based on multiplicative secret sharing and strong rsa assumption. DEStech Transactions on Computer Science and Engineering, (cimns), 2017. 23

2017
[15]

Thresh- old cryptography-based group authentication (tcga) scheme for the in- ternet of things (iot)

Parikshit N Mahalle, Neeli Rashmi Prasad, and Ramjee Prasad. Thresh- old cryptography-based group authentication (tcga) scheme for the in- ternet of things (iot). In 2014 4th International Conference on Wire- less Communications, Vehicular Technology, Information Theory and Ae...

2014
[16]

Challenging the adversary model in secret sharing schemes

Keith M Martin. Challenging the adversary model in secret sharing schemes. Coding and Cryptography II, Proceedings of the Royal Flemish Academy of Belgium for Science and the Arts , pages 45–63, 2008

2008
[17]

Changing thresholds in the absence of secure channels

Keith M Martin, Josef Pieprzyk, Rei Safavi-Naini, and Huaxiong Wang. Changing thresholds in the absence of secure channels. In Aus- tralasian Conference on Information Security and Privacy , pages 177–
[18]

Minimal codewords and secret sharing

James L Massey. Minimal codewords and secret sharing. In Proceedings of the 6th joint Swedish-Russian international workshop on information theory, pages 276–279. Citeseer, 1993

1993
[19]

Some applications of coding theory in cryptography

James L Massey. Some applications of coding theory in cryptography. Codes and Ciphers: Cryptography and Coding IV , pages 33–47, 1995

1995
[20]

McEliece and Dilip V

Robert J. McEliece and Dilip V. Sarwate. On sharing secrets and reed- solomon codes. Communications of the ACM , 24(9):583–584, 1981

1981
[21]

A secure and eﬃcient on-line/oﬀ- line group key distribution protocol

Keju Meng, Fuyou Miao, and Yue Yu. A secure and eﬃcient on-line/oﬀ- line group key distribution protocol. Designs, Codes and Cryptography, 87(7):1601–1620, 2019

2019
[22]

How to share a secret

Maurice Mignotte. How to share a secret. In Workshop on Cryptography, pages 371–375. Springer, 1982

1982
[23]

Dealer-free threshold changeability in secret sharing schemes

Mehrdad Nojoumian and Douglas R Stinson. Dealer-free threshold changeability in secret sharing schemes. Technical report, Cryptology ePrint Archive, Report 2009, 2009

2009
[25]

A publicly veriﬁable secret sharing scheme based on multilinear diﬃe-hellman assumption

Qiao Peng and Youliang Tian. A publicly veriﬁable secret sharing scheme based on multilinear diﬃe-hellman assumption. IJ Network Se- curity, 18(6):1192–1200, 2016

2016
[26]

A lattice-based changeable threshold multi- secret sharing scheme and its application to threshold cryptography

H Pilaram and T Eghlidos. A lattice-based changeable threshold multi- secret sharing scheme and its application to threshold cryptography. Scientia Iranica, 24(3):1448–1457, 2017

2017
[27]

A veriﬁable threshold secret sharing scheme based on lattices

Bahman Rajabi and Ziba Eslami. A veriﬁable threshold secret sharing scheme based on lattices. Information Sciences, 501:655–661, 2019

2019
[28]

How to share a secret

Adi Shamir. How to share a secret. Communications of the ACM , 22(11):612–613, 1979

1979
[29]

Lattice-based threshold-changeability for standard crt secret-sharing schemes

Ron Steinfeld, Josef Pieprzyk, and Huaxiong Wang. Lattice-based threshold-changeability for standard crt secret-sharing schemes. Finite Fields and Their Applications , 12(4):653–680, 2006

2006
[30]

Lattice-based threshold changeability for standard shamir secret-sharing schemes

Ron Steinfeld, Josef Pieprzyk, and Huaxiong Wang. Lattice-based threshold changeability for standard shamir secret-sharing schemes. IEEE transactions on information theory , 53(7):2542–2559, 2007

2007
[31]

How to share a secret with cheaters

Martin Tompa and Heather Woll. How to share a secret with cheaters. journal of Cryptology , 1(3):133–138, 1989

1989
[32]

Note on some recent cheater identiﬁable secret sharing schemes

Rui Xu, Kirill Morozov, and Tsuyoshi Takagi. Note on some recent cheater identiﬁable secret sharing schemes. IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences , 98(8):1814–1819, 2015

2015
[33]

Novel threshold changeable secret sharing schemes based on polynomial interpolation

Lifeng Yuan, Mingchu Li, Cheng Guo, Kim-Kwang Raymond Choo, and Yizhi Ren. Novel threshold changeable secret sharing schemes based on polynomial interpolation. PloS one, 11(10), 2016

2016
[34]

Threshold changeable secret sharing schemes revisited

Zhifang Zhang, Yeow Meng Chee, San Ling, Mulan Liu, and Huaxiong Wang. Threshold changeable secret sharing schemes revisited. Theoret- ical Computer Science, 418:106–115, 2012. 25

2012

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [24]

On dealer-free dynamic threshold schemes

Mehrdad Nojoumian and Douglas R Stinson. On dealer-free dynamic threshold schemes. Advances in Mathematics of Communications , 7(1), 2013. 24

work page 2013

[2] [1]

Linear subspace crypt- analysis of harn’s secret sharing-based group authentication scheme

Zahra Ahmadian and Sadegh Jamshidpour. Linear subspace crypt- analysis of harn’s secret sharing-based group authentication scheme. IEEE Transactions on Information Forensics and Security , 13(2):502– 510, 2017

work page 2017

[3] [2]

A modular approach to key safeguard- ing

Charles Asmuth and John Bloom. A modular approach to key safeguard- ing. IEEE transactions on information theory , 29(2):208–210, 1983

work page 1983

[4] [3]

Hierarchy-based cheating detection and cheater identiﬁcation in secret sharing schemes

Shalini Banerjee, Daya Sagar Gupta, and GP Biswas. Hierarchy-based cheating detection and cheater identiﬁcation in secret sharing schemes. In 2018 4th International Conference on Recent Advances in Information Technology (RAIT), pages 1–6. IEEE, 2018

work page 2018

[5] [4]

Safeguarding cryptographic keys

George Robert Blakley. Safeguarding cryptographic keys. In 1979 In- ternational Workshop on Managing Requirements Knowledge (MARK) , pages 313–318. IEEE, 1979. 22

work page 1979

[6] [5]

Fully dynamic secret sharing schemes

Carlo Blundo, Antonella Cresti, Alfredo De Santis, and Ugo Vaccaro. Fully dynamic secret sharing schemes. Theoretical Computer Science , 165(2):407–440, 1996

work page 1996

[7] [6]

Foundations of homomorphic secret sharing

Elette Boyle, Niv Gilboa, Yuval Ishai, Huijia Lin, and Stefano Tessaro. Foundations of homomorphic secret sharing. In 9th Innovations in The- oretical Computer Science Conference (ITCS 2018) . Schloss Dagstuhl- Leibniz-Zentrum fuer Informatik, 2018

work page 2018

[8] [7]

Linear codes from perfect nonlinear mappings and their secret sharing schemes

Claude Carlet, Cunsheng Ding, and Jin Yuan. Linear codes from perfect nonlinear mappings and their secret sharing schemes. IEEE Transac- tions on Information Theory , 51(6):2089–2102, 2005

work page 2005