Multi-Layer Secret Sharing Overview

• Multi-layer secret sharing is a cryptographic framework that organizes secrets into distinct layers for controlled recovery based on access privileges and protocol stages.
• It employs diverse methods including recursive encodings, hash-based adaptations, and XOR schemes to balance security, efficiency, and protocol complexity.
• The design is applied in secure communications, blockchain, and 5G networks, addressing practical trade-offs between verifiability, overhead, and performance.

Multi-layer secret sharing denotes a family of secret-sharing constructions in which secrecy and recovery are organized across more than one level. In the literature, those levels may be authorization layers, information layers, protocol stages, recursion levels, or communication-network layers. Accordingly, the topic spans layered multi-secret sharing over degraded broadcast channels, generalized-access multi-secret schemes with one long-term share per participant, recursive encodings in which hidden secrets are embedded inside the shares of another secret, image-sharing systems that combine key generation, XOR mixing, and share packing, and two-dimensional XOR schemes for layered multipath communication (Zou et al., 2014, Binu et al., 2014, Parakh et al., 2010, Reddy et al., 2017, Chan et al., 29 Sep 2025). The unifying objective is not merely to split a secret, but to control which entity or coalition can recover which information, at which layer, and under which adversarial or failure model.

1. Formal scope and canonical models

The classical secret-sharing model distributes a secret among participants so that qualified sets reconstruct and unauthorized sets learn nothing. Multi-layer variants refine that model in several directions. One line of work assigns different secrets to different access structures, so that a single participant share supports multiple reconstruction policies through public auxiliary data (Binu et al., 2014). Another line formalizes layering directly: there are $K$ secrets $W_1,\dots,W_K$, and recovery is staged so that the first $k$ participants together recover $W_1,\dots,W_k$, while the newly introduced secret $W_k$ remains secure from the first $k-1$ participants (Zou et al., 2014).

That layered requirement is expressed in communication-theoretic form by coupling layered decoding with layered secrecy. Reliability is written as

$$P_e^n=\Pr\left(\bigcup_{k=1}^K \{(W_1,\ldots,W_k)\neq g_k^n(Y_k^n)\}\right)\to 0,$$

while secrecy is

$$\frac{1}{n}I(W_{k+1},\ldots,W_K;Y_k^n\mid W_1,\ldots,W_k)\to 0.$$

The same paper shows that such layered multi-secret sharing can be reformulated as secure communication over degraded broadcast channels, including degraded Gaussian MIMO broadcast channels with layered decoding and secrecy constraints (Zou et al., 2014).

A distinct but related formalization appears in two-level security schemes. There, recovery is intentionally split into stages: participants first reconstruct a derived value such as $H(s)$, and only after the system verifies that at least $t$ participants are honest does it release the information needed to reconstruct the actual secret $W_1,\dots,W_K$0 (Sharma et al., 2022). This suggests that “multi-layer” is broader than hierarchy alone: the layering may reside in access semantics, in the amount of information disclosed, or in the order of protocol execution.

2. Access structures, information layers, and capacity

Generalized-access multi-secret sharing replaces a single threshold rule with secret-specific authorization families. In "Efficient Multi Secret Sharing with Generalized Access Structures" the dealer shares secrets $W_1,\dots,W_K$1, each with its own access structure $W_1,\dots,W_K$2. Each participant keeps only one private share $W_1,\dots,W_K$3, while the dealer publishes public reconstruction data on a bulletin board; the scheme is computationally efficient, permits share verification and reconstructed-secret verification, and does not need a secure channel (Binu et al., 2014).

Hash-based adaptive-threshold work pushes this further by making the basis shares themselves a separate layer. In "Secret sharing scheme based on hashing" the dealer defines a basis set

$W_1,\dots,W_K$4

orders and concatenates it as

$W_1,\dots,W_K$5

and derives each secret key by

$W_1,\dots,W_K$6

The same construction publishes share-verification hashes $W_1,\dots,W_K$7 and secret-verification hashes $W_1,\dots,W_K$8, and is claimed to be perfect, ideal, verifiable, and proactive (Andrecut, 2023).

Ramp secret sharing makes the information layering explicit. In "Democratic Ramp Secret Sharing" the secret is a vector $W_1,\dots,W_K$9, and participant sets are partitioned into classes $k$0 according to whether they hold $k$1 q-bits of information but not $k$2. The privacy and reconstruction thresholds refine into $k$3 and $k$4, and the paper emphasizes the maximal non-$k$5-qualifying sets of size

$k$6

where $k$7 is a relative generalized Hamming weight (Geil, 2024). Its “second layer of security” is precisely this structural analysis of large sets that still fail to learn a prescribed amount of information.

At the information-theoretic end, layered sharing admits rate-region characterizations rather than only feasibility conditions. For degraded broadcast channels, achievable rate tuples satisfy bounds such as

$k$8

$k$9

and the Gaussian MIMO case yields a secrecy-capacity region in determinant form under a covariance chain $W_1,\dots,W_k$0 (Zou et al., 2014). In that formulation, multi-layer secret sharing becomes a capacity-allocation problem across secrecy layers.

3. Recursive, packed, and two-stage constructions

Recursive constructions encode multiple secrets by reusing the output of one sharing stage as the input of the next. "Recursive Secret Sharing for Distributed Storage and Information Hiding" starts with a main secret $W_1,\dots,W_k$1 of size $W_1,\dots,W_k$2, embeds exactly $W_1,\dots,W_k$3 additional secrets $W_1,\dots,W_k$4, and produces $W_1,\dots,W_k$5 final shares such that any $W_1,\dots,W_k$6 reconstruct $W_1,\dots,W_k$7 as well as all hidden secrets (Parakh et al., 2010). The method builds a chain of polynomials $W_1,\dots,W_k$8, where each hidden secret becomes the constant term of a polynomial whose remaining points are derived from the previous layer’s samples. Reconstruction runs in reverse: first interpolate the degree-$W_1,\dots,W_k$9 polynomial from any $W_k$0 shares to obtain $W_k$1, then descend recursively to recover $W_k$2 (Parakh et al., 2010).

A different type of layering appears in packed image sharing. "High Capacity, Secure $W_k$3 Multi Secret Image Sharing Scheme with Security Key" compresses $W_k$4 secret images into $W_k$5 shared images, so that one transmitted share carries information for eight secret images and the sharing capacity becomes eight times that of an $W_k$6 system (Reddy et al., 2017). Its workflow has three stages: security-key generation, encryption, and decryption. The security key is derived from an unrevealed comparison image by extracting first-row pixels, reducing each modulo $W_k$7, and collecting the eight distinct remainders $W_k$8 in first-appearance order. Encryption then bit-slices the comparison image according to that key, forms linear matrices $W_k$9 and $k-1$0, computes

$k-1$1

and finally packs eight binary images into one grayscale share. Decryption regenerates the key from the same comparison image and reverses the process via

$k-1$2

The paper reports lossless recovery with SSIM = 1.00, PSNR = Inf, and RMSE = 0, assumes padding with null images when the number of secrets is not divisible by eight, and relies on a trusted side channel for the comparison-image identity (Reddy et al., 2017).

Two-level security based on Shamir sharing and a one-way function separates validation from final disclosure. In "Multisecret-sharing scheme with two-level security and its applications in Blockchain" the dealer constructs

$k-1$3

$k-1$4

distributes only $k-1$5 initially, and requires at least $k-1$6 participants to reconstruct $k-1$7 before the system releases the corresponding $k-1$8 values (Sharma et al., 2022). The same two-stage mechanism is extended to a multisecret setting by deriving polynomial coefficients from the components of $k-1$9 (Sharma et al., 2022).

4. Two-dimensional XOR sharing and layered communication networks

Network-oriented multi-layer secret sharing treats layers as distinct transport dimensions. "Two-Dimensional XOR-Based Secret Sharing for Layered Multipath Communication" studies a minimal $$P_e^n=\Pr\left(\bigcup_{k=1}^K \{(W_1,\ldots,W_k)\neq g_k^n(Y_k^n)\}\right)\to 0,$$0 topology with $$P_e^n=\Pr\left(\bigcup_{k=1}^K \{(W_1,\ldots,W_k)\neq g_k^n(Y_k^n)\}\right)\to 0,$$1 base stations and $$P_e^n=\Pr\left(\bigcup_{k=1}^K \{(W_1,\ldots,W_k)\neq g_k^n(Y_k^n)\}\right)\to 0,$$2 routes, so that each share $$P_e^n=\Pr\left(\bigcup_{k=1}^K \{(W_1,\ldots,W_k)\neq g_k^n(Y_k^n)\}\right)\to 0,$$3 is sent through base station $$P_e^n=\Pr\left(\bigcup_{k=1}^K \{(W_1,\ldots,W_k)\neq g_k^n(Y_k^n)\}\right)\to 0,$$4 in the first layer and route $$P_e^n=\Pr\left(\bigcup_{k=1}^K \{(W_1,\ldots,W_k)\neq g_k^n(Y_k^n)\}\right)\to 0,$$5 in the second (Chan et al., 29 Sep 2025). The secret $$P_e^n=\Pr\left(\bigcup_{k=1}^K \{(W_1,\ldots,W_k)\neq g_k^n(Y_k^n)\}\right)\to 0,$$6 is split into two equal halves $$P_e^n=\Pr\left(\bigcup_{k=1}^K \{(W_1,\ldots,W_k)\neq g_k^n(Y_k^n)\}\right)\to 0,$$7, zero padding is used when $$P_e^n=\Pr\left(\bigcup_{k=1}^K \{(W_1,\ldots,W_k)\neq g_k^n(Y_k^n)\}\right)\to 0,$$8 is odd, and a one-layer XOR scheme is applied twice. The design goals are availability and perfect privacy: $$P_e^n=\Pr\left(\bigcup_{k=1}^K \{(W_1,\ldots,W_k)\neq g_k^n(Y_k^n)\}\right)\to 0,$$9

$$\frac{1}{n}I(W_{k+1},\ldots,W_K;Y_k^n\mid W_1,\ldots,W_k)\to 0.$$0

Thus, removal of one row and one column still leaves a $$\frac{1}{n}I(W_{k+1},\ldots,W_K;Y_k^n\mid W_1,\ldots,W_k)\to 0.$$1 submatrix sufficient for recovery, while observation of one full row and one full column reveals nothing about the secret (Chan et al., 29 Sep 2025).

The construction is explicitly information-theoretic. It uses only bitwise XOR, uniformly random masks, and no computational hardness assumptions, so the paper claims unconditional security, including resistance to future quantum adversaries. Its complexity is $$\frac{1}{n}I(W_{k+1},\ldots,W_K;Y_k^n\mid W_1,\ldots,W_k)\to 0.$$2, contrasted with roughly $$\frac{1}{n}I(W_{k+1},\ldots,W_K;Y_k^n\mid W_1,\ldots,W_k)\to 0.$$3 finite-field cost for Shamir-type polynomial schemes (Chan et al., 29 Sep 2025).

That model is implemented in "Multi-Layer Secret Sharing for Cross-Layer Attack Defense in 5G Networks: a COTS UE Demonstration". The demo distributes shares across 3 mobile operators and 3 relays, with columns corresponding to operators and rows to relays, and states that any $$\frac{1}{n}I(W_{k+1},\ldots,W_K;Y_k^n\mid W_1,\ldots,W_k)\to 0.$$4 submatrix suffices for full recovery while any combination of one complete row and one complete column reveals no information about $$\frac{1}{n}I(W_{k+1},\ldots,W_K;Y_k^n\mid W_1,\ldots,W_k)\to 0.$$5 (Chan et al., 29 Sep 2025). The system operates without infrastructure modifications or pre-shared keys, uses Wi-Fi Direct among UEs and UDP for 5G transmission, and reports confidentiality entropy 0.9979 for both secret sharing schemes tested. Under 50% DoS, the reported recovery rates are 100% for two-layer codes, 31% for one-layer codes, and 100% for repetition codes, with latencies 153 ms, 143 ms, and 93 ms, respectively (Chan et al., 29 Sep 2025). The paper also notes that a single COTS UE cannot simultaneously connect to multiple mobile operators because of eSIM switching latency and restricted dual-SIM control permissions, so the demonstration uses three UEs (Chan et al., 29 Sep 2025).

5. Verifiability, reuse, and dynamic reconfiguration

A major branch of multi-layer secret sharing introduces verification layers and public recovery layers on top of ordinary threshold sharing. In "Threshold Multi Secret Sharing Using Elliptic Curve and Pairing" the dealer constructs a Shamir-style polynomial

$$\frac{1}{n}I(W_{k+1},\ldots,W_K;Y_k^n\mid W_1,\ldots,W_k)\to 0.$$6

uses the recovered point $$\frac{1}{n}I(W_{k+1},\ldots,W_K;Y_k^n\mid W_1,\ldots,W_k)\to 0.$$7 to unlock all secrets through public recovery codes

$$\frac{1}{n}I(W_{k+1},\ldots,W_K;Y_k^n\mid W_1,\ldots,W_k)\to 0.$$8

and adds pairing-based verification via published $$\frac{1}{n}I(W_{k+1},\ldots,W_K;Y_k^n\mid W_1,\ldots,W_k)\to 0.$$9 and $H(s)$0 (Binu et al., 2016). The paper emphasizes single-stage recovery of multiple secrets, share verification, consistency checking, cheater detection, cheater identification, and the ability to modify or add secrets by changing public parameters (Binu et al., 2016).

Hash-based general-access schemes pursue similar goals with cheaper operations. "An efficient multi-use multi-secret sharing scheme based on hash function" lets each participant hold one fixed share $H(s)$1 and derive secret- and subset-specific pseudo-secret shares

$H(s)$2

so that the same long-term share can be reused across many secrets without enabling cross-secret recombination by the combiner (Das et al., 2011). "Multi-Use Multi-Secret Sharing Scheme for General Access Structure" combines that idea with Lagrange interpolation: the dealer publishes masked polynomial evaluations $H(s)$3, the combiner verifies each submitted pseudo-share through $H(s)$4, and participants verify the reconstructed secret through $H(s)$5 (Roy et al., 2014). Both schemes are designed to be renewable: new secrets, participants, or qualified sets can be added without altering the long-term shares of existing participants (Das et al., 2011, Roy et al., 2014).

Verifiable multi-secret sharing with explicit dealer-consistency checks appears in recursion-based public-key constructions. "New dynamic and verifiable multi-secret sharing schemes based on LFSR public key cryptosystem" uses nonhomogeneous linear recursion to generate subshadows $H(s)$6, masks secrets as $H(s)$7, and publishes commitments $H(s)$8 so that participants can check both their own subshadows and the dealer’s consistency with the recurrence (Yang et al., 2019). "New $H(s)$9-verifiable multi-secret sharing schemes based on XTR public key system" follows the same layered pattern with XTR-based public data $t$0 and $t$1, claims resistance to malicious dealers and participants, and states that a 170-bit XTR key can match the security of a 340-bit LFSR public-key cryptosystem or a 1024-bit RSA system (Yang et al., 2020). In both cases, the reconstruction process first recovers the recursive subshadow layer and only then the masked secret layer (Yang et al., 2019, Yang et al., 2020).

Code-based work supplies yet another interpretation. "Linear complementary dual code-based Multi-secret sharing scheme" takes the secret as a vector $t$2, distributes shares $t$3, and reconstructs by solving a full-rank linear system

$t$4

The paper describes the resulting scheme as perfect and almost ideal, with a large secret space over a finite commutative local ring (Ghosh et al., 2021).

6. Applications, assumptions, and recurring trade-offs

Multi-layer secret sharing has been proposed for secure image and video transmission, Web-based storage systems, sensor networks, information dispersal over parallel channels, consortium blockchain, wireless broadcast, and cross-layer attack defense in 5G networks (Reddy et al., 2017, Parakh et al., 2010, Sharma et al., 2022, Zou et al., 2014, Chan et al., 29 Sep 2025). In the blockchain setting, the two-level scheme maps transaction-related data into a secret, distributes shares to anonymous active nodes through a smart-contract-enabled consortium network, and requires threshold recovery before block formation (Sharma et al., 2022). In distributed storage and multi-user settings, adjacent work studies storage nodes, user-specific access sets, and rate or overhead trade-offs rather than protocol layering per se; the maximum-number-of-users, communication-complexity, storage-overhead, and capacity-region results in distributed multi-user secret sharing are representative of that neighboring direction (Soleymani et al., 2018, Khalesi et al., 2021).

The literature also reveals several persistent assumptions. Many generalized-access and verifiable schemes assume a trusted dealer, public bulletin-board availability, or both (Binu et al., 2014, Das et al., 2011, Roy et al., 2014). Image-based packing schemes may rely on an unrevealed comparison image obtained through a separate channel, which is an operational assumption rather than a cryptographic guarantee (Reddy et al., 2017). Public-key and pairing constructions derive security from discrete logarithm, XTR-DL, LFSR, or related hardness assumptions, whereas the degraded-channel and XOR-based layered-network constructions are explicitly information-theoretic (Binu et al., 2016, Yang et al., 2020, Zou et al., 2014, Chan et al., 29 Sep 2025).

A recurring misconception is that multi-layer secret sharing is equivalent to a fixed $t$5 threshold. The cited work shows otherwise. Some schemes are threshold-based but stage recovery through a hash layer (Sharma et al., 2022); some are defined by arbitrary monotone access structures with one private share and extensive public helper data (Binu et al., 2014, Roy et al., 2014); some are ramp schemes in which subsets learn intermediate amounts of information rather than all-or-nothing disclosure (Geil, 2024); and some are network codes whose “layers” are transport strata such as base stations and routes (Chan et al., 29 Sep 2025, Chan et al., 29 Sep 2025). This suggests that the most precise interpretation of the topic is structural: multi-layer secret sharing studies secret-distribution systems in which secrecy, recoverability, or verification is intentionally decomposed into multiple coordinated levels.

A second recurring trade-off concerns overhead. Survey work on multi-secret sharing for general access structures repeatedly compares schemes by share reusability, participant enrollment and dis-enrollment, renewal, public-value growth, and whether shares must be modified during updates (Binu et al., 2014). Hash- and XOR-based constructions reduce arithmetic cost, but public bulletin-board data may scale with the number of minimal authorized sets (Das et al., 2011, Roy et al., 2014, Binu et al., 2014). Information-theoretic formulations provide clean secrecy guarantees, but often under more specialized channel or topology assumptions (Zou et al., 2014, Chan et al., 29 Sep 2025). Verifiable and dynamic schemes add cheater detection and policy agility, but introduce extra public commitments, recursion checks, or pairing/XTR/LFSR infrastructure (Binu et al., 2016, Yang et al., 2019, Yang et al., 2020).

Taken together, the literature presents multi-layer secret sharing not as a single construction family but as a design space. Its common theme is layered control over disclosure: who can recover which secret, how much information a non-qualifying set can still infer, which auxiliary layer must be decoded or verified before final release, and how secrecy survives failures or adversarial observations across multiple operational strata.