Linear Secret Sharing Schemes

Updated 15 March 2026

LSSS is defined over a finite field using a linear mapping to distribute shares while ensuring correctness and privacy.
They enable secure multiparty computation via multiplicativity, allowing coordinated reconstruction of product secrets from share products.
Code-theoretic constructions from Reed–Solomon, AG, and toric codes underpin efficient access structures and controlled information leakage.

Linear Secret Sharing Schemes (LSSS) are secret sharing protocols for distributing a secret among multiple parties such that both the sharing and reconstruction processes are linear over a finite field. LSSS form a foundational bridge between information theory, coding theory, cryptography, and combinatorics, enabling fine-grained control of access structures, efficient multiparty computation, and algebraic analysis of scheme parameters. Their algebraic structure facilitates strong theorems on privacy, reconstruction, duality, multiplicativity, and information leakage, with deep consequences for both practical constructions and asymptotic theory.

1. Algebraic Framework and Construction Principles

LSSS are defined over a finite field $\mathbb{F}_q$ and a monotone access structure $\Gamma$ on a set of $n$ participants. Sharing is specified by a linear mapping (often as a matrix or via an underlying linear code) from the secret and randomization space to a vector of $n$ shares, each distributed to a designated participant. The essential requirements are:

Linearity: Both share generation and reconstruction map are $\mathbb{F}_q$ -linear, i.e., for secrets $s, s'$ and randomness $r, r'$ :

$\text{Share}(\alpha s + \beta s'; \alpha r + \beta r') = \alpha \text{Share}(s; r) + \beta \text{Share}(s'; r').$

Correctness: Any authorized set $A \in \Gamma$ can reconstruct the secret via a fixed linear function of the shares in $A$ .
Privacy: Any unauthorized subset $B \notin \Gamma$ learns no information about the secret; the joint distribution of their shares is independent of the secret.

Canonical LSSS instances include those arising from:

Generator or parity-check matrices of linear codes $C \subseteq \mathbb{F}_q^n$ (Massey schemes).
Monotone span programs, which realize arbitrary access structures by linear algebraic conditions on row-labeled matrices.
Evaluation of algebraic functions (polynomials, rational functions, AG functions, toric codes) at public points, often corresponding to schemes with ramp properties or enhanced multiplicativity.

For an $[n,k]$ linear code $C$ over $\mathbb{F}_q$ with generator matrix $G$ , the corresponding LSSS shares a secret vector $s \in \mathbb{F}_q^k$ by outputting the codeword $c = sG$ and distributing $c_i$ to participant $i$ (Csirmaz, 2019).

2. Access Structures, Minimality, and Duality

The access structure of an LSSS encodes which subsets of participants can reconstruct the secret. In the case of a code-based (Massey) LSSS, the relationship to the minimal codewords of the dual code $C^\perp$ is central:

Minimal access sets: Bijection with minimal codewords of $C^\perp$ whose support includes the secret's coordinate; i.e., for participant set $T$ , $T$ is qualified iff $C^\perp$ contains a codeword supported in $T \cup \{0\}$ with a nonzero coefficient at $0$ (Zhu et al., 2022, Sınak, 2020).
Democracy: If $C$ is a minimal code, the resulting LSSS is democratic; every participant appears in the same number of minimal access sets (Sınak, 2020, Aguglia et al., 2021).
Duality: The dual LSSS (defined via the dual code or a dual monotone span program) realizes the dual access structure, and, remarkably for linear schemes, the share/secret size ratio (or "complexity") is preserved under duality (Csirmaz, 2019).

Recent results show that while this equality holds in the linear (and perfect) case, it can fail in the almost-perfect or general information-theoretic settings (Csirmaz, 2019).

3. Multiplicative Properties and Applications

LSSS facilitate secure multiparty computation (MPC) via the property of multiplicativity.

Multiplicativity: An LSSS is multiplicative if the coordinatewise product of sharings corresponds to the sharing of the product secret, up to a fixed recombination vector (0812.2518). This requires existence of linear recombination for the coordinate-wise product of two sharings.
Strong multiplicativity: Required for robustness against unauthorized collusions; the multiplicativity property must hold on the shares held by any qualified set (Hansen, 2014, Hansen, 2017, 0812.2518).
3-multiplicativity: Strengthening the above, 3-multiplicative LSSS exist where a global recombination vector reconstructs the product of three secrets from the coordinatewise triple product of their sharings. Every 3-multiplicative scheme is strongly multiplicative, but not vice versa. Strongly multiplicative schemes can be transformed into 3-multiplicative ones at modest overhead (0812.2518). The use of 3-multiplicative schemes reduces round complexity in unbounded fan-in multiplications (0812.2518).

Multiplicative LSSS are constructed from Reed–Solomon, algebraic geometric, and toric codes, and are essential for verifiable secret sharing and secure arithmetic MPC (Hansen, 2017, Hansen, 2014, 0812.2518, Tjuawinata et al., 2021).

4. Code-Theoretic Constructions and Parameters

A significant class of LSSS arises from coding theory:

From minimal and few-weight codes: Codes with minimal codewords (i.e., no codeword's support contains another's, modulo scalar multiplication) give rise to LSSS with access structures and democracy properties directly inherited from the code's support structure (Sınak, 2020, Aguglia et al., 2021, Zhu et al., 2022).
- For example, a code with minimal distance $d$ gives a $(d-1)$ -threshold scheme; any $d-1$ or fewer shares reveal no information, $n-(d-1)$ suffice to reconstruct (Zhu et al., 2022).
- Minimal codes from weakly regular plateaued balanced functions or hypersurfaces enable explicit constructions of projective LSSS with strong combinatorial and symmetry properties (Sınak, 2020, Aguglia et al., 2021).
Ramp schemes from nested code pairs: A pair of nested codes $C_2 \subset C_1 \subset \mathbb{F}_q^n$ $C_{2} \subset C_{1} \subset F_{q}^{n}$ specifies a ramp LSSS with secret length $l = \dim C_1 - \dim C_2$ $l = dim C_{1} - dim C_{2}$ . Privacy and reconstruction thresholds, as well as intermediate (partial) information thresholds, are governed by the relative generalized Hamming weights $M_m(C_1,C_2)$ $M_{m} (C_{1}, C_{2})$ (Geil et al., 2015, Geil, 2024).
- Full privacy: $t_1 = M_1(C_2, C_1^\perp) -1$ .
- Full reconstruction: $r_\ell = n - M_1(C_1, C_2) + 1$ .
- Rational design of these weights allows fine-tuning of information-theoretic guarantees, partial leakage, and efficiency.
Large player capacity and higher-dimensional varieties: LSSS from toric codes or toric varieties accommodate a super-polynomial number of participants relative to the field size, compared to classical (Reed–Solomon) schemes, while attaining strong multiplication and controlled thresholds via intersection theory (Hansen, 2014, Hansen, 2017).

5. Asymptotics, Information Leakage, and Democratic Ramp Schemes

Ramp LSSS generalize threshold schemes by allowing partial leakage to intermediate-sized coalitions and supporting larger secrets per share.

General information-theoretic bounds: The asymptotic (large $n$ ) behavior of privacy and reconstruction thresholds and partial information leakage are governed by the distribution of relative generalized Hamming weights and can be precisely controlled using algebraic geometry codes or optimal code towers (Geil et al., 2015).
Democratic ramp schemes: Recent advances demonstrate democratic LSSS in the ramp setting, where, for any fixed quantum of information, there exist maximal (often large and structured) non-qualified sets achieving enhanced fairness and resistance to group discrimination. Monomial-Cartesian code constructions provide explicit, combinatorially optimal ramp LSSS with these fairness properties and finely tunable threshold profiles (Geil, 2024).
Leakage-resilience: AG code-based schemes over extension fields enable secret sharing with both constant-size shares and resilience against bounded local leakage, outperforming concatenation-based schemes in both reconstruction and leakage bounds (Tjuawinata et al., 2021).

6. Advanced Access Structures and Compositionality

LSSS can be tailored to complex, non-threshold access structures via coding-theoretic and span-program techniques.

$k$ -uniform and forbidden hypergraph structures: Monotone span program approaches realize efficient LSSS for access structures specified by hypergraphs. Efficient decompositions yield share sizes bounded polynomially in $n$ , with implications for cryptographic usability in sparse and dense families (Kim et al., 2021).
Composition and modularity: Schemes can be composed hierarchically via codeword minimal supports, generalizing iterated-threshold and supporting compartmented or hierarchical systems. All monotone access structures induced by minimal codeword supports therefore admit ideal, vector-space realizable LSSS (Márquez-Corbella et al., 2012).
Characteristic-dependent lower bounds: Secret-sharing inspired constructions yield characteristic-dependent linear rank inequalities, directly impacting lower bounds for LSSS information ratios, especially for matroid-port access structures (Peña-Macias, 2021).

7. Summary Table: Classical and Modern LSSS Constructions

Construction paradigm	Scheme type	Features/Parameters	Reference
Reed–Solomon evaluation	Threshold/isotropic	Ideal, MDS, strong multiplication	(Hansen, 2017, Hansen, 2014)
AG codes over curves	Ramp	Sublinear share size, strong multiplicativity, leakage resilience	(Tjuawinata et al., 2021, Geil et al., 2015, 0812.2518)
Toric codes/varieties	Quasi-threshold	Large number of players, MDS/ramp, explicit thresholds, strong multiplication	(Hansen, 2014, Hansen, 2017)
Minimal linear/few-weight codes	Democratic, threshold/non-threshold	Access structure from minimal supports, democracy, strong regularity	(Sınak, 2020, Zhu et al., 2022, Aguglia et al., 2021)
Span-programs/monotone matrices	Arbitrary access	Efficient for $k$ -uniform, composite, or hypergraph-based structures	(Kim et al., 2021, Márquez-Corbella et al., 2012)
Monomial-Cartesian codes	Democratic ramp	Maximal non-qualified sets, fairness, explicit evaluation	(Geil, 2024)

All substantial classes of LSSS exploit the intimate correspondence with algebraic and combinatorial properties of linear codes, their duals, and their higher-order weight enumerators or support structures. Modern developments focus on expanding the class of ideal or democratic schemes, optimizing leakage and multiplicativity, and algorithmizing explicit access-structure realization. The field continues to be at the intersection of combinatorial geometry, coding theory, cryptographic protocol design, and algebraic complexity.