Reconstruction fails at random about secretsharingdotnet

[Helios-vmg]

I think the ultimate source of the issue is that the interface is exposing an implementation detail to the caller. Secret sharing is used to split strings of bits, not integers. If the library internally uses arbitrary precision numbers to implement the secret sharing scheme, and it is important for these numbers to always be positive, the library should only accept raw byte buffers and use whatever method is appropriate to deserialize these buffers into positive integers. It shouldn't be the responsibility of the caller to sanitize its own input.

[shinji-san]

Thank you.

I will try to find time to fix the bug in the next few days.

[shinji-san]

The following solution is not a workaround, only another way to use the library. Pls use it until the bug is fixed:

        static double TestShamir2()
        {
            int ok = 0;
            const int total = 1000;
            var sss = new ShamirsSecretSharing<BigInteger>(new ExtendedEuclideanAlgorithm<BigInteger>());
            var rng = new Random();
            for (int i = 0; i < total; i++)
            {
                var message = new byte[32];
                rng.NextBytes(message);
                const int n = 5;
                var s = Convert.ToBase64String(message);
                var shares = sss.MakeShares((n + 1) / 2, n, s);
                var reconstructed =
                    Convert.FromBase64String(sss.Reconstruction(shares.Take((n + 1) / 2).ToArray())
                        .ToString());
                if (message.SequenceEqual(reconstructed))
                    ok++;
            }
            return (double) ok / total;
        }

[shinji-san]

Bug is fixed and the fix is part of the next release (>v0.5.0).

[shinji-san]

Hi @Helios-vmg ,

Please see the Whitepaper

The coefficients a_1 ..a_k-1 in q(x) are randomly chosen from a uniform distribution over the integers in [0, p)

Further more the modular arithmetic (mathematical) is used. So the secret must be a positive value.

The code below generates randomly negative secrets.

The following function returns a double around 0.5, instead of 1 as would be expected:

static double TestShamir()
{
    int ok = 0;
    const int total = 1000;
    var sss = new ShamirsSecretSharing<BigInteger>(new ExtendedEuclideanAlgorithm<BigInteger>());
    var rng = new Random();
    for (int i = 0; i < total; i++)
    {
        var message = new byte[32];
        rng.NextBytes(message);
        const int n = 5;
        var secret = new Secret<BigInteger>(Convert.ToBase64String(message));
        var shares = sss.MakeShares((n + 1) / 2, n, secret);
        var reconstructed =
            Convert.FromBase64String(sss.Reconstruction(shares.Take((n + 1) / 2).ToArray())
                .ToBase64());
        if (message.SequenceEqual(reconstructed))
            ok++;
    }
    return (double) ok / total;
}

I will fix the message array in the unit test project, because the two's complement representation always interprets the highest-order bit of the last byte in the array (byte at position message.Length - 1) as the sign bit. A negative sign must be avoid.

[shinji-san]

Thank you for your Feedback. Now I have an idea to fix it. However the new version of this library can't be used to reconstruct secrets which are splitted by version 0.6.0 or older. It is a breaking change.