Cryptanalysis of a Class of Ideal Secret Sharing Schemes Based on the CRT for Polynomial Rings

1

Cryptanalysis of a Class of Ideal Secret Sharing Schemes Based on the CRT for Polynomial Rings

arXiv:2610.06312v1 [cs.CR] 5 Oct 2026

Jian Ding, Zhiyuan Guo, Hongju Li, and Yuying Man

Abstract—Based on the CRT for polynomial rings, Yang, Zhu, Fu and Xia (ISIT 2026) proposed a compartmented secret sharing scheme for the compartmented access structure with lower bounds, claiming it can be ideal. We exhibit three families of unauthorized subsets that reconstruct the secret. The scheme is therefore insecure, except for a degenerate choice of parameters in which the only authorized subset is the whole participant set. The flaw in the security analysis is that it does not take all published polynomials into account. Similar flaws appear in the same first author’s hierarchical schemes (ISIT 2024, 2026). Index Terms—Ideal secret sharing, compartmented secret sharing, hierarchical secret sharing, Chinese Remainder Theorem, cryptanalysis.

I. I NTRODUCTION In a secret sharing scheme (SSS) [1], [2], a dealer splits a secret into shares and distributes them among a set P of n participants, in such a way that the authorized subsets of P can reconstruct the secret while the unauthorized ones cannot. The collection of all authorized subsets forms the access structure. An SSS is perfect if every unauthorized subset obtains no information about the secret, and ideal if it is perfect and has information rate one. The first proposed secret sharing schemes [1], [2] have the (t, n)-threshold access structure: Γ = {A ⊆ P : |A| ≥ t}. In such a scheme, all the participants play exactly the same role, and none of them is more privileged than another. Many applications, however, involve participants with different degree of trust. Compartmented access structures, introduced by Simmons [3], are suitable for this scenario. In a compartmented secret sharing scheme (CSSS), the participant set P is partitioned into compartments γ1 , γ2 , . . . , γq , each equipped with a threshold ti , and a global threshold t is imposed on P; the resulting compartmented access structure with lower bounds (LCAS) is ΓL = {A ⊆ P : ∀1 ≤ i ≤ q, |A ∩ γi | ≥ ti and |A| ≥ t}. This work was supported in part by the National Natural Science Foundation of China (NSFC) Young Scientists Fund (Category C) under Grant No. 126011024, in part by Natural Science Research Project of Anhui Higher Education Institutions under Grants No. 2024AH051324 and No. 2025AHGXZK30056, and in part by Projects of Chaohu University under Grants No. KYQD-202220, No. 2024cxtd147 and No. hxkt20250327. J. Ding, H. Li and Y. Man are with School of Mathematics and Big Data, Chaohu University, Hefei, China (e-mail: dingjian happy@163.com, 058072@chu.edu.cn, yuying.man@aliyun.com). Z. Guo is with School of Mathematics and Statistics, Hefei University, Hefei, China (e-mail: gzy 26105@163.com.)

Many ideal CSSSs for LCASs have been constructed from linear algebra [4], bivariate interpolation [5], polymatroid theory [6], [7], and coding theory [8]. However, some of these constructions have limitations. The construction of [4] requires checking the non-singularity of an exponential number of matrices. That of [5] is probabilistic and only statistically perfect. In contrast, the CRT-based construction over the integers [9] is non-ideal. Recently, Yang, Zhu, Fu and Xia [10] proposed an explicit CSSS for LCAS based on the CRT for polynomial rings. They claimed that it is perfect and can be made ideal by an appropriate choice of the moduli. Our contributions. We point out that the scheme of [10] is insecure, and analyse the root cause of its insecurity. More precisely, we give the following contributions. 1) We exhibit three families of unauthorized subsets that reconstruct the secret (Theorem 1). The scheme is therefore insecure, for every choice of the parameters except the degenerate one in which the only authorized subset is P itself (Corollary 1). 2) We find that the flaw in the security analysis of [10] is its failure to take all the published polynomials into account. Similar flaws also appear in the hierarchical secret sharing schemes by the same first author [11], [12], whose security analysis omits the published polynomials in exactly the same way. The rest of the paper is organised as follows. Section II introduces the basic notions of secret sharing and the CRT for polynomial rings. Section III reviews the scheme of [10]. Section IV presents the cryptanalysis, together with the root cause of the insecurity, and Section V concludes the paper.

II. P RELIMINARIES Definition 1 (Secret sharing scheme). Let P = {P1 , P2 , . . . , Pn } denote the set of all participants. The secret space is denoted by S, while Sθ stands for the share space of the θ-th participant. A secret sharing scheme of n participants generally comprises two procedures: share distribution and secret reconstruction. 1) Share Distribution Phase: For any secret drawn from S and a certain random input selected from R, the dealer invokes the share generation algorithm SHAR : S × R → S1 × S2 × · · · × Sn to allocate shares among the participants in P.

2

2) Secret Reconstruction Phase: Any authorized subset A ⊆ P is capable of reconstructing the secret through the secret reconstruction algorithm Y RECO : Sθ → S, Pθ ∈A

whereas any unauthorized subset is not. All authorized subsets form a set called the access structure. In the sequel, each participant Pθ is frequently identified with its index θ. For a positive integer n we write [n] = {1, 2, . . . , n}, and so that P = [n]. Definition 2 (Compartmented Secret Sharing Scheme, [7]). Let P = {P1 , P2 , . . . , Pn } be the set of all participants, partitioned by the dealer into q disjoint compartments γ1 , γ2 , . . . , γq , i.e., P=

q [

γi , and γi ∩ γj = ∅ for all 1 ≤ i < j ≤ q.

i=1

Denote by | · | the cardinality of a set. Let t1 , t2 , . . . , tq , t be positive integers such that ti ≤ |γi | = ni (1 ≤ i ≤ q), and

q X

ti ≤ t ≤ n.

i=1

The compartmented access structure with lower bounds (LCAS) is ΓL = {A ⊆ P : ∀1 ≤ i ≤ q, |A ∩ γi | ≥ ti and |A| ≥ t}. A Compartmented Secret Sharing Scheme (CSSS) for the LCAS with perfect security is a secret sharing scheme satisfying the following correctness and privacy requirements. 1) Correctness. The secret can be reconstructed from any authorized subset A ∈ ΓL . 2) Privacy. No information about the secret can be obtained from any subset B ∈ / ΓL . Throughout this paper we assume q ≥ 2, the case q = 1 reducing to a threshold access structure. Lemma 1 (CRT for polynomial rings, [10]). Let p be a prime, Fp the finite field with p elements, and Fp [x] the univariate polynomial ring over Fp . Let m1 (x), m2 (x), . . . , mk (x) ∈ Qk Fp [x] be pairwise coprime, let M (x) = i=1 mi (x), −1 Mi (x) = M (x)/mi (x), and λi (x) ≡ Mi (x) (mod mi (x)). Then, for any f1 (x), . . . , fk (x) ∈ Fp [x], the system of congruences f (x) ≡ fi (x) (mod mi (x)), i ∈ [k], has the solution f (x) ≡

k X

Let P = {P1 , P2 , . . . , Pn } be the set of all participants and let it be partitioned into q ≥ 2 disjoint compartments Pj γ1 , γ2 , . . . , γq , where |γi | = ni for i ∈ [q]. Set Nj = i=1 ni and N0 = 0, so that Nq = n. The compartment thresholds satisfy 0P < ti ≤ ni for all i ∈ [q], and the global threshold q satisfies i=1 ti ≤ t ≤ n. The access structure is ΓL = {A ⊆ P : ∀1 ≤ i ≤ q, |A ∩ γi | ≥ ti and |A| ≥ t}. For u ∈ [q] and v ∈ [nu ], the v-th participant of γu is denoted by Pu,v , which coincides with Pθ for θ = Nu−1 + v. The scheme of [10] consists of the share distribution phase and the secret reconstruction phase. 1) Share Distribution Phase. Step 1. The dealer D chooses a prime p and an integer d0 ≥ 1, and sets m0 (x) = xd0 ∈ Fp [x]. Step 2. D chooses pairwise coprime polynomials mθ (x) ∈ Fp [x], θ ∈ [n], and assigns mθ (x) = mu,v (x) to Pθ = Pu,v with θ = Nu−1 + v. Denote by dθ = deg(mθ (x)) and du,v = deg(mu,v (x)), then these polynomials satisfy (i) m0 (x) and mθ (x) are coprime for all θ ∈ [n]; (ii) d0 ≤ d1 ≤ d2 ≤ · · · ≤ dn , that is, d0 ≤ d1,1 ≤ · · · ≤ d1,n1 ≤ d2,1 ≤ · · · ≤ dq,nq ; ti n P P (iii) d0 + dθ(i) ≤ dθ(i) for all i ∈ [q]; (iv) d0 +

θ (i) =n−ti +2 n P

t P

θ=n−t+2

θ=1

dθ ≤

θ (i) =1

dθ .

Step 3. D publishes m0 (x) and mθ (x) for θ ∈ [n]. Step 4. D chooses the secret s(x) uniformly at random from S = {g(x) ∈ Fp [x] : deg(g(x)) < d0 }. Step 5. D chooses q piece polynomials s1 (x), . . . , sq (x) independently and uniformly from S, and sets sq+1 (x) = (s(x) − s1 (x) − · · · − sq (x)) mod m0 (x). uniformly from Step 6. For each u ∈ [q], D chooses αu′ (x)P t Gu′ = {g(x) ∈ Fp [x] : deg(g(x)) < ( θu(u) =1 dθ(u) )− d0 } and forms the compartment secret polynomial s′u (x) = su (x) + αu′ (x)xd0 . ′ ′ (x) uniformly from Gq+1 = {g(x) ∈ Step 7. D chooses αq+1 Pt Fp [x] : deg(g(x)) < ( θ=1 dθ ) − d0 } and forms the global secret polynomial ′ s′q+1 (x) = sq+1 (x) + αq+1 (x)xd0 .

Step 8. Each participant Pθ = Pu,v receives the share su,v (x) = s′u (x) mod mu,v (x), and D publishes

λi (x)Mi (x)fi (x)

(mod M (x)).

i=1

If deg(f (x)) < deg(M (x)), then the solution is unique, and we denote it by f (x) =

III. R EVIEW OF THE SCHEME OF YANG ET AL .

k X i=1

λi (x)Mi (x)fi (x) mod M (x).

ωu,v (x) = (s′q+1 (x) − su,v (x)) mod mu,v (x). 2) Secret Reconstruction Phase. Let A ∈ ΓL and A(i) = A ∩ γi . For each i ∈ [q] the participants of A(i) pool their private shares and reconstruct X s′i (x) = λθ(i) (x)Mθ(i) (x)cθ(i) (x) mod MA(i) (x), θ (i) ∈A(i)

3

(i) where cθ(i) (x) = su,v (x), mQ = θ (i) (x) = mu,v (x) for θ Nu−1 + v, and MA(i) (x) = θ(i) ∈A(i) mθ(i) (x), Mθ(i) (x) = MA(i) (x)/mθ(i) (x), λθ(i) (x) ≡ Mθ−1 (i) (x) (mod mθ (i) (x)). Next, the participants of A pool their private shares and public shares to reconstruct X s′q+1 (x) = λθ (x)Mθ (x)cθ (x) mod MA (x),

(iv)Since |γu | = nu ≥ tu , then Dγu ≥ Tu by the above item (ii). ′ (v) Recall that m0 (x)P= xd0 , su (x)
= su (x) mod m0 (x) q and sq+1 (x) = s(x) − u=1 su (x) mod m0 (x). Therefore, ! q X su (x) + sq+1 (x) mod m0 (x) s(x) =

θ∈A

where cθ (x) = ωu,v + su,v (x), m Qθ (x) = mu,v (x) for θ = Nu−1 + v, and MA (x) = θ∈A mθ (x), Mθ (x) = MA (x)/mθ (x), λθ (x) ≡ Mθ−1 (x) (mod mθ (x)). Finally, si (x) = s′i (x) mod m0 (x) for i ∈ [q + 1], and s(x) = (s1 (x) + · · · + sq (x) + sq+1 (x)) mod m0 (x). IV. C RYPTANALYSIS Subsection IV-A points out that the scheme of [10] has a security flaw: some unauthorized subsets are able to reconstruct the secret. Subsection IV-B discusses the flaw in the security analysis of [10]. A. Unauthorized subsets that reconstruct the secret Q For X ⊆ [n] we write MX (x) = mθ (x) and DX = θ∈X P dθ = deg(MX (x)). Denote by θ∈X

Tu =

tu X

dθ (u ∈ [q]), and T =

θ=1

t X

dθ .

θ=1

For B ⊆ [n], we let B \ γu = {θ : θ ∈ B and θ ∈ / γu }. Next, we present basic properties of the scheme of [10] in Lemmas 2 and 3. Based on these properties, we give attacks on their scheme in Theorem 1. We then show in Corollary 1 when these attacks apply to unauthorized subsets. Lemma 2. Let X ⊆ [n], u ∈ [q] and let k be a positive integer. Then the following properties hold in the scheme of [10]. (i) deg(s′u (x)) < Tu and deg(s′q+1 (x)) < T . Pk (ii) DX ≥ θ=1 dθ if |X | ≥ k. (iii) T ≥ Tu . (iv) Dγu ≥ TuP .
q ′ ′ (v) s(x) = u=1 su (x) + sq+1 (x) mod m0 (x). (i) Recall that s′u (x)

Proof. = su (x) + αu′ (x)xd0 (u ∈ [q]) ′ ′ and sq+1 (x) = sq+1 (x) + αq+1 (x)xd0 , where su (x) ∈ S = ′ ′ {g(x) ∈ Fp [x] : deg(g(x)) Ptu < d0 }, αu (x) ∈ Gu = {g(x) ∈ Fp [x] : deg(g(x)) < ( θ(u) =1 dθ(u) ) − d0 = Tu − d0 } for

u ∈ [q], sq+1 (x) = (s(x) − s1 (x) − · · · − sq (x)) mod m0 (x), ′ ′ and αq+1 (x) ∈ Gq+1 = {g(x) ∈ Fp [x] : deg(g(x)) < Pt ( θ=1 dθ ) − d0 = TP− d0 }. Consequently, deg(s′u (x)) ≤ tu deg(αu′ (x)) + d0 < Tu for u ∈ [q], and θ (u) =1 dθ (u) = P t ′ deg(s′q+1 (x)) ≤ deg(αq+1 (x)) + d0 < θ=1 dθ = T . (ii) Since d1 ≤ d2 ≤ · · · ≤ dn , every X ⊆ [n] satisfies P|X | Pk DX ≥ θ=1 dθ . P Therefore, DX ≥ θ=1 dθ if |X | ≥ k. q (iii) Since t ≥ i=1 ti ≥ tu for u ∈ [q], then T =

t X θ=1

dθ ≥

tu X θ=1

dθ = Tu .

=

u=1 q X

! s′u (x) + s′q+1 (x)

mod m0 (x).

u=1

Lemma 3. Denote by gu (x) = s′q+1 (x) − s′u (x) for u ∈ [q], then the following properties hold in the scheme of [10]. (i) deg(gu (x)) < T and gu (x) ≡ ωu,v (x) (mod mu,v (x)) for v ∈ [nu ]. (ii) Every participant Pθ = Pu,v can compute cθ (x) = (su,v (x) + ωu,v (x)) mod mθ (x) = s′q+1 (x) mod mθ (x). (iii) If nu ≥ t for some u ∈ [q], then gu (x) is computable from the public polynomials alone. (iv) If s′q+1 (x) is known, then every compartment secret polynomial s′u (x), and hence the secret s(x), is reconstructed from the public polynomials and s′q+1 (x). Proof. (i) According to Lemma 2 item (i) and item (iii), we have deg(s′u (x)) < Tu , deg(s′q+1 (x)) < T , and T ≥ Tu . Consequently, deg(gu (x)) < T . Recall that su,v (x) = s′u (x) mod mu,v (x) for v ∈ [nu ], hence ωu,v (x) = (s′q+1 (x) − su,v (x)) mod mu,v (x) = (s′q+1 (x) − s′u (x)) mod mu,v (x) = gu (x) mod mu,v (x). Namely, gu (x) ≡ ωu,v (x) (mod mu,v (x)) for v ∈ [nu ]. (ii) Since su,v (x) = s′u (x) mod mu,v (x) for v ∈ [nu ], then by the above item (i) we have cθ (x) = (su,v (x) + ωu,v (x)) mod mθ (x) = (s′u (x) + gu (x)) mod mθ (x) = s′q+1 (x) mod mθ (x). Pt (iii) If nu ≥ t for some u ∈ [q], then Dγu ≥ θ=1 dθ = T by Lemma 2 item (ii). According to the above item (i), we have deg(gu (x)) < T ≤ Dγu and gu (x) ≡ ωu,v (x) (mod mu,v (x)) for v ∈ [nu ]. Therefore, gu (x) is computable from the public polynomials alone by Lemma 1. (iv) From the above item (i) we have gu (x) ≡ ωu,v (x) (mod mu,v (x)) for v ∈ [nu ]. This shows that s′u (x) ≡ (s′q+1 (x) − ωu,v (x))

(mod mu,v (x)) for v ∈ [nu ].

By Lemma 2 item (i) and item (iv), it holds that deg(s′u (x)) < Tu ≤ Dγu . Therefore, compartment secret polynomials s′u (x), u ∈ [q] are recovered by Lemma 1 if s′q+1 (x) is known. Consequently, the secret s(x) is reconstructed by Lemma 2 item (v).

4

Lemma 3 item (iv) shows that the q + 1 polynomials s′1 (x), . . . , s′q+1 (x) are not independent, and the secret is a public function of the polynomial s′q+1 (x). Theorem 1. In the scheme of [10], the participants in B can reconstruct the secret s(x) if one of the following conditions holds, where B ⊆ [n] and B (u) = B ∩ γu for u ∈ [q]. (i) |B| ≥ t; (ii) |B (u) | ≥ tu and |B \ γu | + nu ≥ t for some u ∈ [q]; (iii) nu ≥ t and |B| ≥ tu for some u ∈ [q]. Note that every B ∈ ΓL satisfies the conditions (i) and (ii), whereas each of the three conditions may also be satisfied by some unauthorized subset B ∈ / ΓL (see Corollary 1). Such an unauthorized subset can reconstruct the secret, although Yang, Zhu, Fu and Xia [10] claim that no unauthorized subset obtains any information about the secret. Proof. Recall that gu (x) = s′q+1 (x) − s′u (x) and let cθ (x) be as in Lemma 3 item (ii). According to Lemma 3 item (iv), it suffices to prove that the global secret polynomial s′q+1 (x) can be recovered from any one of the conditions. Case (i). By Lemma 3 item (ii), the participants in B establish the system of congruences s′q+1 (x) ≡ cθ (x)

(mod mθ (x)), θ ∈ B.

Since |B| ≥ t, from Lemma 2 item (i) and item (ii), we have deg(s′q+1 (x)) < T =

t X

dθ ≤ DB .

compartment, produces a residue of s′u (x) by Lemma 3 item (ii), namely s′u (x) ≡ (s′q+1 (x) − gu (x)) ≡ (cθ (x) − gu (x))

(mod mθ (x))

(mod mθ (x)), θ ∈ B.

Since |B| ≥ tu , we have deg(s′u (x)) < Tu ≤ DB by Lemma 2 item (i) and (ii). Therefore, the compartment secret polynomial s′u (x) is recovered, and hence s′q+1 (x) = s′u (x) + gu (x). Finally, let B ∈ ΓL . Then |B| ≥ t, so the condition (i) holds. Moreover, for every u ∈ [q], |B (u) | ≥ tu together with |B \ γu | + nu ≥ |B \ γu | + |B (u) | = |B| ≥ t shows that the condition (ii) holds as well. Corollary 1. Each of the three conditions of Theorem 1 is satisfied by some unauthorized subset, in the following sense. (i) If n − nu + tu − 1 ≥ t for some u ∈ [q], then the subset consisting of all the participants outside γu together with tu − 1 participants of γu is unauthorized and satisfies Theorem 1 item (i). (ii) If tu < nu for some u ∈ [q], then the subset consisting of tu participants of γu together with max{0, t − nu } participants outside γu is unauthorized and satisfies Theorem 1 item (ii). (iii) If nu ≥ t for some u ∈ [q], then any subset consisting of tu participants of γu is unauthorized and satisfies Theorem 1 item (iii). Consequently, the scheme of [10] is insecure unless tu = nu for all u ∈ [q], in which case t = n and ΓL = {P}.

θ=1

Therefore, s′q+1 (x) is recovered by Lemma 1. Case (ii). For a given u ∈ [q], the participants in B (u) establish the system of congruences su,v (x) = s′u (x) mod mu,v (x) for Pu,v ∈ B (u) . Since |B (u) | ≥ tu , from Lemma 2 item (i) and item (ii), we have tu X dθ ≤ DB(u) . deg(s′u (x)) < Tu = θ=1

Therefore, s′u (x) is recovered by Lemma 1. Based on this, the set B can determine gu (x) ≡ ωu,v (x) (mod mu,v (x)) (v ∈ [nu ]) and gu (x) ≡ (cθ (x)−s′u (x)) (mod mθ (x)) (θ ∈ B\γu ), where the first family of congruences is publicly known by Lemma 3 item (i), and the second family uses cθ (x), θ ∈ B\γu in Lemma 3 item (ii) and the recovered s′u (x). Since γu and B \ γu are disjoint and |B \ γu | + nu ≥ t, these nu + |B \ γu | pairwise coprime moduli have total degree, by Lemma 2 item (ii), t X dθ = T > deg(gu (x)). Dγu + DB\γu ≥ θ=1

Consequently, the polynomial gu (x) is recovered by Lemma 1, and hence s′q+1 (x) = s′u (x) + gu (x). Case (iii). Since nu ≥ t for some u ∈ [q], the polynomial gu (x) is publicly known by Lemma 3 item (iii). Recall that gu (x) = s′q+1 (x) − s′u (x). Hence every θ ∈ B, of whatever

Proof. Denote the subsets constructed in items (i)-(iii) be B1 , B2 and B3 , respectively. (i) Since |B1 | = (n − nu ) + (tu − 1) ≥ t, Theorem 1 item (i) holds, while |B1 ∩ γu | = tu − 1 < tu shows that B1 ∈ / ΓL . (ii) Since t ≤ n, we have 0 ≤ max{0, t − nu } ≤ n − nu , which ensures that the subset B2 is well defined. Since |B2 ∩ (u) γu | = |B2 | = tu and |B2 \γu |+nu = max{0, t−nu }+nu ≥ t, Theorem 1 item (ii) holds. Now we show that B2 ∈ / ΓL . If nu ≥ t, then B2 ⊆ γu , and |B2 ∩ γw | = 0 < tw for any w ̸= u (such a w exists since q ≥ 2). If nu < t, then |B2 | = tu + t − nu < t because tu < nu . In both cases B2 ∈ / ΓL . (iii) Since nu ≥ t for some u ∈ [q] and |B3 | = tu , Theorem 1 item (iii) holds. Moreover, B3 ⊆ γu , which implies that |B3 ∩ γw | = 0 < tw for any w ̸= u (such a w exists since q ≥ 2), so B3 ∈ / ΓL . Finally, assume that the scheme isPsecure. By P the above item q q (ii), tP u = nu for all u ∈ [q]. Hence u=1 nu = n, u=1 tu = q and u=1 tu ≤ t ≤ n implies t = n. Since every authorized subset A satisfies |A∩γu | ≥ tu = nu for all u ∈ [q], it follows that A ⊇ γu for all u ∈ [q]. Therefore ΓL = {P}. Remark 1. Theorem 1 item (i) shows that the compartment thresholds play no role at all: any t participants reconstruct the secret, so the family of sets that can reconstruct the secret contains {B ⊆ P : |B| ≥ t}, and the scheme realises at most a (t, n)-threshold access structure. Theorem 1 item (iii) is more damaging still: as soon as one compartment satisfies nu ≥ t, any tu participants reconstruct the secret, and the

5

scheme realises at most the (tu , n)-threshold access structure. Since tu may be as small as 1, the scheme may be broken by a single participant.

[5] T. Tassa and N. Dyn, “Multipartite secret sharing by bivariate interpolation,” J. Cryptology, vol. 22, no. 2, pp. 227–258, 2009. [6] O. Farràs, J. Martı́-Farré and C. Padró, “Ideal multipartite secret sharing schemes,” J. Cryptology, vol. 25, pp. 434–463, 2012. [7] Q. Chen, C. Tang and Z. Lin, “Efficient explicit constructions of multipartite secret sharing schemes,” IEEE Trans. Inf. Theory, vol. 68, no. 1, B. The flaw in the security analysis pp. 601–631, 2022. [8] Q. Chen, C. Tang and Z. Lin, “Compartmented secret sharing schemes In the perfectness argument of [10] (Lemmas III.1, III.2 and locally repairable codes,” IEEE Trans. Commun., vol. 68, no. 10, and Theorem III.3 therein), for an unauthorized subset A1 pp. 5976–5987, 2020. with |A1 ∩ γi | < ti for some i ∈ [q], or with |A1 | < t, the [9] F. L. Ţiplea and C. C. Drăgan, “Asymptotically ideal Chinese remainder theorem-based secret sharing schemes for multilevel and compartmented following sets are introduced: access structures,” IET Inf. Secur., vol. 15, no. 4, pp. 282–296, 2021. J. Yang, H. Zhu, F.-W. Fu and S.-T. Xia, “A new compartmented secret Gi ={g(x) : deg(g(x)) < Ti , g(x) ≡ cθ(i) (x) (mod mθ(i) (x)) [10] sharing scheme based on the CRT for polynomial rings,” in 2026 IEEE (i) (i) International Symposium on Information Theory (ISIT), Guangzhou, for Pθ(i) ∈ A1 = A1 ∩ γi of |A1 | < ti } China, pp. 1–6, IEEE, 2026. [11] J. Yang, S.-T. Xia, X. Wang, J. Yuan, and F.-W. Fu, “A perfect ideal and hierarchical secret sharing scheme based on the CRT for Polynomial Rings,” in 2024 IEEE International Symposium on Information Theory G ={g(x) : deg(g(x)) < T, g(x) ≡ cθ (x) (mod mθ (x)) (ISIT), Athens, Greece, pp.321-326. IEEE, 2024. for Pθ ∈ A1 of |A1 | < t}. [12] J. Yang, H. Zhu, F.-W. Fu, and S.-T. Xia, “A New Hierarchical Secret Sharing Scheme Based on The CRT for Polynomial Rings,” in 2026 IEEE International Symposium on Information Theory (ISIT), Guangzhou, The participants in A1 choose a polynomial se′i (x) randomly China, 2026, pp. 1-6. e′

from Gi for some i ∈ [q], or a polynomial s (x) randomly from G, and then compute se′i (x) mod m0 (x) or se′ (x) mod m0 (x) to obtain the secret. Yang et al. conclude that, from the adversary’s point of view, the secret is uniformly distributed on S. Note that the congruences defining Gi involve only the shares of A1 ; the published polynomials ωθ (x), θ ∈ [n], do not appear. The congruences defining G involve only the shares of A1 and the partial published polynomials ωθ (x), θ ∈ A1 . However, by any reasonable definition of perfectness for a scheme with public data, the published polynomials are part of the adversary’s view. Therefore, the fact that the sets Gi and G do not involve all the published polynomials is the flaw in the security analysis of [10]. Remark 2. Similar flaws also appear in the hierarchical secret sharing schemes of the same first author [11], [12], whose security analysis omits the published polynomials in exactly the same way.

Jian Ding received the MS degree in applied mathematics from Hefei University of Technology, China in 2010, and the PhD degree in Cyberspace Security from Fujian Normal University, China in 2022. He is currently a Professor at School of Mathematics and Big Data, Chaohu University, China. His research interests are in cryptography and network security, especially in secret sharing and its applications.

Zhiyuan Guo is currently a graduate student at School of Mathematics and Statistics, Hefei University, China. His research interests are in cryptography and network security, especially in secret sharing and its applications.

V. C ONCLUSION We have shown that the compartmented secret sharing scheme of Yang, Zhu, Fu and Xia [10] is not perfect, and therefore not ideal. The scheme is insecure for every choice of the parameters except the trivial one in which the only authorized subset is P itself. Similar flaws also appear in the hierarchical secret sharing schemes of the same first author [11], [12]. It therefore remains an open problem to design an ideal CRT-based CSSS for LCASs and an ideal CRT-based hierarchical secret sharing scheme.

Hongju Li received the MS degree in statistics from Guilin University of Technology, China in 2010. She is currently a Associate Professor at School of Mathematics and Big Data, Chaohu University, China. Her research interests are in algebraic coding and cryptography.

R EFERENCES [1] A. Shamir, “How to share a secret,” Commun. ACM, vol. 22, no. 11, pp. 612–613, 1979. [2] G. R. Blakley, “Safeguarding cryptographic keys,” in 1979 International Workshop on Managing Requirements Knowledge (MARK), New York, NY, USA, 1979, pp. 313–318. [3] G. J. Simmons, “How to (really) share a secret,” in Advances in Cryptology — CRYPTO’88, LNCS 403, pp. 390–448, Springer, 1990. [4] E. F. Brickell, “Some ideal secret sharing schemes,” J. Combin. Math. Combin. Comput., vol. 9, pp. 105–113, 1989.

Yuying Man received the MS degree in applied mathematics from South Central Minzu University, China in 2022, and the PhD degree in Mathematics from Hubei University, China in 2025. She is currently an Assistant Lecturer at School of Mathematics and Big Data, Chaohu University, China. Her research interests are in cryptography, especially in cryptographic functions.

Related documents

• Cryptanalysis of a Class of Ideal Secret Sharing Schemes Based on the CRT for Polynomial Rings#1202731
• On The Cyclicity of Algebraic Lattices#1035142
• Secure Data Transmission in Wireless Sensor Networks: A Comparative Analysis of Encryption Models#374308
• Secret Sharing from Non-Extractable Randomness#1355106
• Secret Sharing from Non-Extractable Randomness#1335917