![](bg2.png)
ally, for every participant i in the threshold scheme
there exists a public key point Q
i
= d
i
· P, where the
integer 0 < d
i
< ord(P) defines the secret key of that
participant.
The general idea of the elliptic curve (n,t)-thres-
hold scheme is based on the fact that with (1) we
can determine f(λ) · P for P and any integer 0 ≤ λ <
q if we know t different points f(x
i
) · P for mod-
ulo q pairwise different integers x
i
6≡ 0 mod ord(P).
Therefore, the trusted third party can set up the sys-
tem by choosing a random polynomial f(x) ∈ K[x]
of degree t − 1, and secretly distributing the shares
(x
i
, f(x
i
) · P),1 ≤ i ≤ n, to the n participants. The n
integers 0 < x
i
< q must be pairwise different, but
as in Shamir’s system they can be made public or
directly computable from the identity of the partici-
pants. Secure distribution of the secret part f (x
i
) · P
of the shares to the participants can be done by en-
crypting it with the ECC public key of the correspond-
ing participant. Then this ciphertext is either commu-
nicated to that participant over an insecure channel,
or it can be published, since only the owner of the
correct ECC secret key can open that partial share.
When at least t participants pool their shares, then
they can determine the point f(0) · P using (1). In
contrast to Shamir’s system, we do not encode the
global secret m as one of the coordinates of a point,
but we use f(0) · P as a secret key for some fixed se-
cret key cryptosystem to encrypt m. More precisely,
we proceed as in the Elliptic Curve Integrated Encryp-
tion Scheme (e.g., (Certicom, 2000)) and apply a se-
cret key cryptosystem ENC, a key derivation function
KDF and a message authentication code MAC to first
find k
E
||k
M
= KDF(x( f(0) · P)) and then publish the
encrypted secret as c||d where c = ENC(k
E
,m) and
d = MAC(k
M
,c). It is obvious that anybody who can
determine the secret point f(0)·P can also easily open
the encrypted global secret by first computing k
E
and
k
M
and then applying the secret key decryption pro-
cedure.
Theorem 1
. Knowledge of t or more shares opens the
g
lobal secret m. On the other hand, knowledge of
less than t shares only yields at least q/2 many pos-
sibilities for the input of the KDF if the order of P is
greater than q.
Proof: The proof is essentially equal to the proof
of Shamir’s system. As described above, the point
f(0) · P can be determined easily with polynomial
interpolation for t or more known shares. On the
other hand, there are q possible constant terms for
polynomials of degree t − 1 given at most t − 1 pairs
(x
i
, f(x
i
)). If the order of P is greater than q, then this
leads to q possibilities for the point f(0) · P. Since
we are using only the x-coordinate of that point to en-
crypt the global secret, there remain at least q/2 many
possible inputs to the KDF.
It should be noted that KDF and ENC should be
chosen with appropriate parameters (especially pro-
viding a sufficiently large key space for ENC) since
otherwise the total system will be insecure. After the
setup of the threshold scheme, the following protocol
can be started by a dedicated participant (with index
1) to open the shared secret with the help of t −1 other
participants:
• Participant 1 chooses a random point H ∈ E(K),
decrypts his encrypted share f (x
1
)·P using his se-
cret ECC key and determines with his share the
result H −
ω(0)
x
1
·ω
′
(x
1
)
·( f(x
1
)·P). Then he sends this
information to the next participant. Note that if all
values x
i
are publicly known, then ω(0) and ω
′
(x
i
)
can be precomputed.
• The second participant decrypts his secret share
f(x
2
) · P with his secret ECC key, subtracts the
point
ω(0)
x
2
·ω
′
(x
2
)
·( f(x
2
)·P) from his input point and
sends the result to the next participant. All other
participants do the same with their shares, respec-
tively. The last participants forwards the result to
participant 1 that started the whole protocol.
• Participant 1 subtracts the randomly chosen initial
point H from his input point and obtains the secret
point f(0) · P. He can then open the global secret.
The proof that this scheme really determines f(0) · P
directly follows from (1). Note that this EC threshold
scheme is neither ideal nor perfect, but nevertheless it
is practical since it does not require knowledge of any
additional secret key.
3 VERIFIABLE SECRET
SHARING VARIANTS
In the last 10 years, bilinear maps for elliptic curves
(also denoted pairings) have been applied to various
cryptographic applications (CL, 2008). We can also
use such maps for the EC (n,t)-threshold scheme to
provide additional properties. Assume that for a given
cryptographically strong elliptic curve E there exists
a some small positive integer s and a bilinear map e
e : E(K) × E(K) −→ K
s
; e(a· P, b· Q) = e(P,Q)
ab
with the additional property that for points P 6= O we
have e(P,P) 6= 1. Such maps are for example given by
the Weil pairing or the Tate pairing (Galbraith et al.,
2002). The importance of these maps for crypto-
graphic applications is the fact that they “link” the
discrete logarithm in the elliptic curve point group to
SECRYPT 2008 - International Conference on Security and Cryptography
360