2

I'm working through an exam paper for a cryptography exam and I've come across a question I'm unsure on.

Six users have been given the partial keys below

$P(x) = (k + \sum_{i=1}^2 c_ix^i)\bmod{503}$

User X Y

1   10 25
2   20 405
3   30 272
4   40 129
5   50 479
6   60 316

Reconstruct the secret key K to verify it is 138.

I've tried using Newtons Divided Difference to skip using the formula but that didn't work. I also tried using the Chinese Remainder Theorem on the data but that did not work either. I've tried filling into the equation but I don't think I've been doing it right so any help on how to go about this question would be appreciated

mikeazo
  • 38,563
  • 8
  • 112
  • 180
JNMN
  • 71
  • 5
  • 1
    I edited to try to improve formatting, but it feels like some information is missing. Is $X$ the same thing as $x$? What are the $c_i$ values? – mikeazo Jan 08 '18 at 13:47
  • @mikeazo Perfect thanks. Wasn't sure how to format. And that's the problem I'm not 100% sure. In the question there's a small x and big X so i presume they're different. Also I'm not sure about the ci's i've tried using the ci's to be y's but that didn't work – JNMN Jan 08 '18 at 14:05
  • I'd guess that $Y = P(x)$. $c_i$ is probably the user ID. No, that doesn't make sense either. Stupid question anyway if this is all the info given. It may rely on some theory we've not been shown. – Maarten Bodewes Jan 08 '18 at 14:07

1 Answers1

3

Apart from the slightly unusual nomenclature, this is Shamir's secret-sharing scheme with $n=6$ and $k=3$ (i.e., the secret is shared into six pieces, any three of which can be combined to retrieve the secret).

In this case, the pieces are as follows:

$$\begin{align}(x_0, y_0) &= (10, 25) \\ (x_1, y_1) &= (20, 405) \\ (x_2, y_2) &= (30, 272) \\ (x_3, y_3) &= (40, 129) \\ (x_4, y_4) &= (50, 479) \\ (x_5, y_5) &= (60, 316)\end{align}$$

Only three of these are needed to retrieve the secret. As described in the Wikipedia article, this is done by calculating a set of Lagrange basis polynomials:

$$\begin{align}\ell_0 &= \frac{x - x_1}{x_0 - x_1} \cdot \frac{x - x_2}{x_0 - x_2} = \frac{x - 20}{10 - 20} \cdot \frac{x - 30}{10 - 30} = \frac{x^2}{200} - \frac{x}{4} + 3 \\ \ell_1 &= \frac{x - x_0}{x_1 - x_0} \cdot \frac{x - x_2}{x_1 - x_2} = \frac{x - 10}{20 - 10} \cdot \frac{x - 30}{20 - 30} = \frac{-x^2}{100} + \frac{2x}{5} - 3 \\ \ell_2 &= \frac{x - x_0}{x_2 - x_0} \cdot \frac{x - x_1}{x_2 - x_1} = \frac{x - 10}{30 - 10} \cdot \frac{x - 20}{30 - 20} = \frac{x^2}{200} - \frac{3x}{20} + 1 \end{align}$$

All you need from these polynomials are the constant terms, which are multiplied by the corresponding $y$ terms to give you the secret value:

$$\begin{align}s &= (3 \cdot 25 - 3 \cdot 405 + 1 \cdot 272) \pmod{503} \\ &= 138 \end{align}$$

r3mainer
  • 2,063
  • 15
  • 15