密码算法与协议6_阈值加密算法.pptVIP

* * Pedersen’s VSS There is one caveat for Feldman’s scheme which we have mostly ignored so far. We have tacitly assumed that the a priori distribution of the secret s used by the dealer is the uniform distribution on Zn. In some applications, however, the a priori distribution of s may be very skewed. For example, it may already be known that the secret is actually a bit, hence that Pr[s =x] = 0 for all x ? Zn \ {0, 1}. * * Pedersen’s VSS Pedersen’s VSS scheme allows one to share a secret s in a verifiable way such that the security does not depend on the a priori distribution of s. In fac