<p>(Almost) Every modern HSM (hardware secure module, for cryptographic applications) uses Shamir secret sharing. So, no, secret sharing use is wide spread.</p>

CC BY-SA 2.5
2010-09-03T13:00:18.180Z
Great... so would it be correct to say cryptographic smart cards use secret sharing schemes?
Douglas S. Stones
CC BY-SA 2.5
2010-09-03T10:49:27.973Z
2010-09-03T10:49:27.973Z
Secret
<p>The DNSSEC root key is shared in a 5-out-of-7 fashion; see, e.g., here: <a href="http://bit.ly/9LcNwj" rel="nofollow">http://bit.ly/9LcNwj</a></p>

CC BY-SA 2.5
2010-09-05T03:08:06.660Z
2010-09-05T03:08:06.660Z
user6584
<p>Passwords are about the only form of authentication human beings can use, but the entropy of passwords remembered by humans is very low. Hence, dictionary attacks against passwords are very effective. Several different PAKE protocols can make network protocols safe against both passive and active attackers, but none of them can protect against server compromise - a dictionary attack can always be mounted against the authentication data the server holds.</p>

<p>Secret sharing is used in building secure authentication protocols with weak passwords where the leakage of a single server's data does not allow for dictionary attacks on the password. A simple form of this is used in the real world by Verisign: <a href="http://www.verisign.com/repository/pubs/server-assisted-password.pdf" rel="nofollow">Server-Assisted Generation of a Strong Secret from a Password</a>. More recent research in to the problem: <a href="http://www.cs.umd.edu/~jkatz/reading_refs/threshold_koy_proc.pdf" rel="nofollow">Provably Secure Threshold Password-Authenticated Key Exchange</a>.</p>

CC BY-SA 2.5
2010-12-19T21:00:22.890Z
2010-12-19T21:00:22.890Z
Nakedible
<p>The concept of a <a href="http://en.wikipedia.org/wiki/Secret_sharing">secret sharing</a> scheme is often attributed to Shamir (A. Shamir, <a href="http://dx.doi.org/10.1145%2F359168.359176">How to share a secret</a>, Comm. ACM, 22 (1979), pp. 612-613.) and Blakey (G. R. Blakey, <a href="http://doi.ieeecomputersociety.org/10.1109/AFIPS.1979.98">Safeguarding cryptographic keys</a>, in Proc. NCC, vol. 48, 1979, pp. 313-317.).</p>

<p>The overall idea is that some secret S is hidden from the participants who instead each receive a share s<sub>i</sub>.  If every participant decides to cooperate, they each submit their share to a combiner, who reconstructs S from the shares s<sub>i</sub>.</p>

<p>Papers on secret sharing schemes often refer to real-world applications (such as bank safes).  But I suspect, these are hypothetical "real-world" applications (i.e. the next floor down in the ivory tower) and very much doubt that they could actually name a bank (or any other company) that actually uses a secret sharing scheme.  Question:  What are some actual real-world examples?</p>

<p>Ideally, I would like an answer to contain:  At company X they use secret sharing scheme Y to safeguard Z (see ABC for more details).</p>

CC BY-SA 2.5
2010-09-04T07:03:18.033Z
Can someone explain if secret sharing is similar to zero knowledge proofs?
Jared Updike
CC BY-SA 2.5
2010-09-19T14:05:31.873Z
@Jared: I think your comment if off-topic, though it is interesting  enough to be asked as a separate question.
Sadeq Dousti
<cr.crypto-security><application-of-theory>
What are some examples of secret sharing schemes actually being used in real-world applications?
Douglas S. Stones
# What are some examples of secret sharing schemes actually being used in real-world applications?

(Asked by: username_0 on 2010-09-03)

The concept of a [secret sharing](http://en.wikipedia.org/wiki/Secret_sharing) scheme is often attributed to Shamir (A. Shamir, [How to share a secret](http://dx.doi.org/10.1145%2F359168.359176), Comm. ACM, 22 (1979), pp. 612-613.) and Blakey (G. R. Blakey, [Safeguarding cryptographic keys](http://doi.ieeecomputersociety.org/10.1109/AFIPS.1979.98), in Proc. NCC, vol. 48, 1979, pp. 313-317.).

The overall idea is that some secret S is hidden from the participants who instead each receive a share si. If every participant decides to cooperate, they each submit their share to a combiner, who reconstructs S from the shares si.

Papers on secret sharing schemes often refer to real-world applications (such as bank safes). But I suspect, these are hypothetical "real-world" applications (i.e. the next floor down in the ivory tower) and very much doubt that they could actually name a bank (or any other company) that actually uses a secret sharing scheme. Question: What are some actual real-world examples?

Ideally, I would like an answer to contain: At company X they use secret sharing scheme Y to safeguard Z (see ABC for more details).

**Tags:** cr.crypto-security, application-of-theory
> **Comments:**
> **username_1**: Can someone explain if secret sharing is similar to zero knowledge proofs?  
> **username_2**: @Jared: I think your comment if off-topic, though it is interesting  enough to be asked as a separate question.  

---

## 3 answers

### Answer by username_3 on 2010-09-03. Score: 5

(Almost) Every modern HSM (hardware secure module, for cryptographic applications) uses Shamir secret sharing. So, no, secret sharing use is wide spread.

> **Comments:**
> **username_0**: Great... so would it be correct to say cryptographic smart cards use secret sharing schemes?  

---

### Answer by username_4 on 2010-09-05. Score: 3

The DNSSEC root key is shared in a 5-out-of-7 fashion; see, e.g., here: <http://bit.ly/9LcNwj>


---

### Answer by username_5 on 2010-12-19. Score: 3

Passwords are about the only form of authentication human beings can use, but the entropy of passwords remembered by humans is very low. Hence, dictionary attacks against passwords are very effective. Several different PAKE protocols can make network protocols safe against both passive and active attackers, but none of them can protect against server compromise - a dictionary attack can always be mounted against the authentication data the server holds.

Secret sharing is used in building secure authentication protocols with weak passwords where the leakage of a single server's data does not allow for dictionary attacks on the password. A simple form of this is used in the real world by Verisign: [Server-Assisted Generation of a Strong Secret from a Password](http://www.verisign.com/repository/pubs/server-assisted-password.pdf). More recent research in to the problem: [Provably Secure Threshold Password-Authenticated Key Exchange](http://www.cs.umd.edu/~jkatz/reading_refs/threshold_koy_proc.pdf).


---

