---
title: Threshold-Based Searchable Sharing Primitive
url: https://www.emergentmind.com/topics/threshold-based-searchable-sharing-primitive
type: topic
---

# Threshold-Based Searchable Sharing Primitive

Searching arXiv for recent and foundational papers directly relevant to threshold-based searchable sharing primitives, multilevel threshold function sharing, searchable sharing systems, and threshold-protected searchable search.
A threshold-based searchable sharing primitive is a cryptographic abstraction in which search capabilities, search keys, or secret function parameters are distributed across multiple parties so that only authorized coalitions can execute search-related operations, while coalitions outside the authorized access structure learn no information about the protected secret or the search result. In the literature represented here, the primitive appears in several closely related forms: multilevel threshold secret and function sharing based on the Chinese Remainder Theorem (CRT), patient-driven searchable sharing with Proxy Re-Encryption (PRE) and fully homomorphic search, searchable activation of threshold tracing via Key-Aggregate Searchable Encryption (KASE), traceable over-threshold multi-party private set intersection, and dynamic threshold-searchable vector retrieval for collaborative approximate nearest neighbor search [1605.07988]. Taken together, these works characterize the primitive not as a single fixed syntax, but as a family of constructions that combine threshold access control, searchable or queryable cryptographic state, and controlled reconstruction or evaluation of a secret-dependent function [2404.11372].

## 1. Conceptual scope and defining characteristics

The common objective is to distribute a search-relevant secret so that search, retrieval, tracing, or predicate evaluation becomes possible only when a threshold policy is satisfied. In the multilevel CRT-based setting, the secret may be a function parameter such as an RSA private exponent \(d\), and function sharing means that authorized coalitions can collaboratively evaluate the function without reconstructing or exposing the global secret [1605.07988]. In the patient-centric S3PHER system, the primitive consists of encrypted documents, encrypted searchable indexes, and consent-gated re-encryption for sharing; the system explicitly identifies this combination as a natural foundation for a searchable sharing primitive [2404.11372]. In SP-A\(^2\)NN, the primitive is formalized directly as dynamic searchable sharing threshold, or dynamic SST, whose protocols support setup, search, and update over a collaborative encrypted database represented by secret shares [2507.17199].

Across these formulations, three features recur. First, the protected capability is not necessarily disclosure of a secret; it may instead be evaluation of a function, derivation of a token, identification of over-threshold records, or authorized activation of tracing. Second, access is governed by threshold structure, often with richer policy language than a single \((t,n)\) threshold. Third, public metadata or auxiliary information must not reveal exploitable cross-share relations. The failure mode emphasized in the CRT multilevel work is precisely that linear relations between shares modulo distinct moduli, when published without cryptographic blinding, can leak the entire secret [1605.07988].

A plausible implication is that “searchable sharing” is best understood as a layered construction rather than a monolithic primitive. One layer encodes the access structure and secret distribution; another layer realizes the search or function-evaluation interface; a third layer constrains public information so that the searchable interface does not undermine threshold privacy.

## 2. Access structures and formal models

The most explicit access-structure treatment appears in the multilevel threshold model of Simmons. The global participant set is partitioned into disjoint compartments or levels,
\[
\mathcal{U} = \bigcup_{i=1}^m L_i,\quad L_i \cap L_j = \emptyset,
\]
with \(L_1\) the highest level and \(L_m\) the lowest. Cumulative sets are defined by
\[
U_i = \bigcup_{k=1}^i L_k,\quad |U_i| = \sum_{k=1}^i n_k,
\]
and thresholds satisfy
\[
0 < t_1 < t_2 < \dots < t_m,\quad t_i \leq |U_i|.
\]
A higher-level participant can replace members of lower levels, so the access structure is inherently hierarchical [1605.07988].

Two canonical access structures are distinguished. In a disjunctive multilevel threshold scheme, a coalition is authorized if it satisfies at least one level threshold:
\[
\mathcal{A}_{\text{disj}} = \left\{ A \subseteq \mathcal{U} \;:\; \exists i \in \{1,\dots,m\} \text{ such that }  |A \cap U_i| \ge t_i \right\}.
\]
In a conjunctive multilevel threshold scheme, all level thresholds must hold simultaneously:
\[
\mathcal{A}_{\text{conj}} = \left\{ A \subseteq \mathcal{U} \;:\; \forall i \in \{1,\dots,m\},\  |A \cap U_i| \ge t_i \right\}.
\]
The paper explicitly notes that this supports policies such as “authorization requires any two VPs and any three tellers” [1605.07988].

Other works instantiate different threshold semantics. The elliptic-curve threshold multi-secret sharing construction is a classical \((t,n)\)-threshold model in which any subset of size at least \(t\) reconstructs and fewer than \(t\) learn nothing, but a single share supports multiple secrets \(K_1,\dots,K_m\) [1603.09524]. PHF-based shared-key primitives likewise adopt a \((t,n)\) threshold access structure over groups of exactly \(t\) participants, with anonymity analyzed relative to the key used in a symmetric-key operation [1105.5681]. DeTAPS layers two thresholds: a signer threshold \(t\) for signature generation and a notary threshold \(t'\) for tracing activation, while keeping both thresholds private to the public [2304.07937]. T-OT-MP-PSI replaces unanimity by an over-threshold condition \(c(e)\ge t\), where \(c(e)\) is the multiplicity of an element across parties, and reveals holder identities only when that threshold is met [2512.24652]. SP-A\(^2\)NN formalizes dynamic SST through the protocol triple
\[
\Sigma = (\mathsf{Setup}, \mathsf{Search}, \mathsf{Update}),
\]
with threshold enforcement inherited from Shamir’s \(t\)-out-of-\(n\) secret sharing [2507.17199].

These formal models indicate that threshold-based searchable sharing ranges from ordinary threshold control to hierarchical, dual-threshold, and multiplicity-threshold policies. This suggests that the access structure is the primary organizing principle, while the search mechanism is the operational layer built on top of it.

## 3. Secret-sharing and function-sharing substrates

The CRT-based multilevel construction provides a detailed threshold-sharing substrate for searchable or evaluable capabilities. The central device is a refined Asmuth–Bloom condition,
\[
{p_0}^2 \prod_{i=1}^{t-1} p_{n - i + 1} < \prod_{i=1}^t p_i,
\]
which yields a statistical scheme: with fewer than \(t\) shares, every possible secret \(s' \in \mathbb{Z}_{p_0}\) remains nearly equally likely [1605.07988]. To support arbitrary thresholds in a multilevel hierarchy, the paper introduces the anchor Asmuth–Bloom sequence
\[
p_0 < p_1 < \dots < p_n
\]
such that
\[
{p_0}^2 \prod_{i=1}^{\lfloor n/2\rfloor - 1} p_{n-i+1} \;<\; \prod_{i=1}^{\lfloor n/2\rfloor} p_i.
\]
A key lemma states that an anchor sequence satisfies the Asmuth–Bloom condition for every \(1 \le t \le n\), enabling a single global CRT modulus structure to serve all thresholds [1605.07988].

For a secret \(s \in \mathbb{Z}_{p_0}\), the dealer computes per-level values
\[
y_i = s + \alpha_i p_0,\quad 0 \le y_i < M_i,\quad M_i = \prod_{j=1}^{t_i} p_j,
\]
and participant shares
\[
s^i_k = y_i \bmod p_k.
\]
Cross-level usability is achieved through public translation values
\[
\Delta s^j_k = (y_j - h_k(s^i_k, j)) \bmod p_k,
\]
with per-user hash functions \(h_k : \mathbb{Z}_{p_k} \times \mathbb{Z}_m \to \mathbb{Z}_{p_k}\). Reconstruction uses CRT on effective shares \(\widetilde{s}^i_k\), then recovers
\[
s = y_i \bmod p_0.
\]
The paper’s security theorem states that, under the random oracle assumption for the hash functions, any unauthorized coalition learns no information about \(s\), and the scheme is statistical with respect to the secret distribution [1605.07988].

The same paper generalizes secret sharing to function sharing. In threshold RSA, the secret is the private exponent \(d\), shared with secret space modulus
\[
p_0 = \phi(N) = 4p' q',
\]
where \(p = 2p' + 1\) and \(q = 2q' + 1\) are strong primes. Participants compute partial exponents
\[
\nu_k = \overline{s^i_k} \, P_k \, I_k \bmod M_{A_i},
\]
and partial signatures
\[
\mathbf{sgn}_k = \mathbf{msg}^{\nu_k} \bmod N.
\]
The server combines them multiplicatively and performs a small exponent search to align the result to \(d\) modulo \(\phi(N)\) [1605.07988]. The paper explicitly states that the same pattern can be used for “multilevel function sharing,” and its discussion of searchable primitives proposes treating a search secret \(K_{\text{search}}\) as the shared secret or as a function parameter in an RSA-like or exponentiation-based construction [1605.07988].

Alternative sharing substrates appear elsewhere. The elliptic-curve and self-pairing TMSS scheme shares a master point
\[
P_0 = a_0 G + b_0 H
\]
through a degree-\((t-1)\) polynomial
\[
f(x) = a_0 + a_1 x^1 + a_2 x^2 + \cdots + a_{t-2} x^{t-2} + b_0 x^{t-1},
\]
and derives per-secret masks via
\[
R_i = K_i - e(P_0, iP_0),\quad K_i = R_i + e(P_0, iP_0).
\]
Because no new shares are needed when new \(R_i\) values are published, the construction is naturally suited to threshold-controlled derivation of multiple indexed secrets [1603.09524]. The PHF/BPHF framework, by contrast, distributes key components combinatorially rather than algebraically, enabling any \(t\)-subset to reconstruct at least one key while smaller sets reconstruct none; the proportional scheme then improves anonymity by selecting groups with probability proportional to the number of keys they can recover [1105.5681].

## 4. Searchable sharing instantiations

A direct searchable-sharing system appears in S3PHER, a patient-centric architecture for sharing and searching health data stored in the cloud. Its principal entities are the Data Owner (patient), the Data User (healthcare practitioner), and a semi-trusted Proxy Server. The Data Owner encrypts documents under symmetric keys, encapsulates those keys using Umbral, and builds a TFHE-encrypted binary keyword-file matrix
\[
M \in \{0,1\}^{m \times n}, \quad M_{i,j} =
\begin{cases}
1 & \text{if keyword } w_i \text{ appears in file } f_j\\
0 & \text{otherwise.}
\end{cases}
\]
The left-most column \(C_w\) stores encrypted keyword encodings, yielding an encrypted index \(\tilde I\) [2404.11372].

For a search query, the practitioner encrypts a bit-vector encoding of \(w^\*\) under the patient’s TFHE public key:
\[
\tilde{q} = (\tilde{q}_1, \dots, \tilde{q}_\ell),\quad
\tilde{q}_i \leftarrow \mathsf{TFHE.Enc}(pk^{\text{HE}}_{\text{DO}}, q_i).
\]
The Proxy Server computes homomorphic equality tests
\[
\tilde{e}_i = \mathsf{Eq}(\tilde{q}, \tilde{w}_i),
\]
selects the matching row,
\[
\tilde{M}'_{i,j} = \tilde{e}_i \land \tilde{M}_{i,j},
\]
and then computes the encrypted result vector
\[
\tilde{R}_j = \bigvee_{i=1}^m \tilde{M}'_{i,j}.
\]
Only the patient decrypts \(\tilde R\), learns the set of matching files, and decides which subset to share by generating a PRE delegation
\[
rk_{\text{DO}\rightarrow \text{DU} \leftarrow \mathsf{ReKeyGen}(sk_{\text{DO}}, pk_{\text{DU}}).
\]
The Proxy Server then re-encrypts the corresponding Umbral capsules [2404.11372]. The paper explicitly states that this system already implements a searchable sharing primitive and that Umbral’s threshold PRE can be used so that re-encryption requires \(t\) cooperating parties. It also proposes threshold HE decryption so that even learning the result set \(S\) requires \(t\) authorities [2404.11372].

DeTAPS presents a different searchable-sharing pattern. Here the searchable component is KASE, used to “awaken” notaries who are authorized to participate in tracing a threshold signature. A combiner enclave generates an ATS signature, encrypts it under Dynamic Threshold Public-Key Encryption for notary set \(\mathcal{N}\), and creates a KASE ciphertext
\[
(c^{gid}_1,c^{gid}_2,\{ind_o\}_{o\in\mathcal{N}})\leftarrow \mathsf{KASE.Enc}(mpk,gid,\mathcal{N}).
\]
A notary with pseudo-identity \(pid_o\) computes
\[
td_o\leftarrow \mathsf{KASE.Trapdoor}(k_a,pid_o),
\]
and an adjusted trapdoor
\[
td^{gid}_o\leftarrow \mathsf{KASE.Adjust}(\mathcal{B},\mathcal{PK},H,gid,\mathcal{G},td_o),
\]
which lets the smart contract test whether the notary belongs to the authorized set for that signature. Once \(t'\) notaries provide valid DTPKE decryption shares, the tracer enclave reconstructs the ATS signature and runs tracing [2304.07937]. The searchable interface thus controls access to a threshold-shared activation capability rather than to a document corpus.

T-OT-MP-PSI instantiates searchable sharing in a set-theoretic rather than index-centric form. Each leader element \(e_k^0\) is embedded into a Shamir polynomial
\[
f_k(x)=S_k + a_1x+\dots+a_{t-1}x^{t-1},
\]
with shares
\[
s_k^{0,i} = f_k(i+1).
\]
OPPRF ensures that another party receives the correct share only if it holds the same element; otherwise it receives a pseudorandom field element. After share-update and collection phases, the leader reconstructs from subsets of \(t\) shares, and once a correct polynomial is found, it identifies holders by testing
\[
f_k(i+1)\stackrel{?}= y_k^i.
\]
The output is
\[
I = \{(e,\,c(e),\,\{P_j: e\in S_j\}) \mid e\in S_0,\ c(e)\ge t\},
\]
which directly realizes threshold-gated searchable disclosure with traceability [2512.24652].

SP-A\(^2\)NN extends the primitive to collaborative vector retrieval. It defines a collaborative encrypted database
\[
C\text{-}EDB = C\text{-}ED + C\text{-}E\mathcal{I},
\]
where vectors and index state are secret-shared across parties. Search and update are carried out over a bitgraph representation of an HNSW-style index, maintaining HNSW compatibility while ensuring that fewer than \(t\) parties learn nothing information-theoretically [2507.17199].

## 5. Security properties, leakage, and anonymity

Security requirements differ across these constructions, but they converge on a small set of recurring concerns: unauthorized reconstruction, leakage through public metadata, leakage through search/index structure, collusion resistance, and in some cases anonymity.

The multilevel CRT paper is notable for first presenting an attack. In the insecure Harn–Fuyou design, public offsets of the form
\[
\Delta s^1_{k,2} = (y_2 - s^1_k) \bmod p^1_{k,2}
\]
expose linear relations between shares modulo distinct moduli. The paper shows that an unauthorized coalition of two level-2 users in a \((t_1,t_2)=(2,3)\) setting can narrow candidates for \(y_2\) until only one remains, thereby revealing the secret \(s\) [1605.07988]. The replacement construction avoids that leakage by hashing the cross-level relation, so that if the adversary does not corrupt \(u_k\), then \(h_k(s^j_k,i)\) is unknown and the public \(\Delta s^i_k\) is indistinguishable from uniform in \(\mathbb{Z}_{p_k}\) under the random oracle assumption [1605.07988].

S3PHER’s security model treats the Proxy Server as semi-honest, practitioners as potentially malicious, and external attackers as network adversaries. TFHE is used to protect index and query confidentiality, Umbral protects document-key confidentiality, and only the patient can decrypt the result vector \(\tilde R\). The paper states that forward/backward privacy is not formally analyzed, because the index is static in the current design, and that a formal end-to-end security model for “threshold searchable PRE+FHE” remains an open research direction [2404.11372].

DeTAPS formalizes unforgeability, accountability, and privacy via experiment-based definitions. Privacy is defined against the public, signers, combiners, and tracers, and its reductions rely on PKE semantic security, strong EUF-CMA signatures, HVZK NIZKs, KASE IND-CKA security, DTPKE IND‑NAA‑NAC‑CPA security, and commitment hiding/binding [2304.07937]. Here the searchable-sharing problem is not secrecy of a stored file but secrecy of the threshold \(t\), signer quorum \(\mathcal S\), notary threshold \(t'\), and notary set \(\mathcal N\), unless tracing is validly activated.

SP-A\(^2\)NN provides the most explicit leakage analysis. Rather than a conventional coin-toss indistinguishability game, it introduces a leakage-guessing proof system based on an interactive “chess game,” together with a privacy triplet that measures three interfaces: data-to-index, index-to-index, and index-to-data leakage [2507.17199]. For a vector \(\mathbf e\), the bitgraph-HNSW leakage terms include
\[
\mathcal{L}_I^{\mathcal{I}\text{-}hnsw\text{-}bitg}(\mathbf{e})
= \frac{(L+1)\times (1 + post\_d + par\_b)}{|C\text{-}ED|},
\]
and
\[
\mathcal{L}_{II}^{\mathcal{I}\text{-}hnsw\text{-}bitg}(\{\mathbf{e}_2\})
= \frac{\sum_{|\{\mathbf{e}_2\}|} (L+1)\times (1 + post\_d + par\_b)}{|C\text{-}ED|}.
\]
This makes structural leakage part of the primitive’s formal specification rather than an informal side note [2507.17199].

Anonymity is the dominant criterion in PHF-based shared-key primitives. For the proportional scheme, if \(Q(r\times J)\) is the set of groups that can recover key \(K(r\times J)\), then
\[
\Pr[A\mid K(r\times J)] =
\begin{cases}
1/q(r\times J), & A\in Q(r\times J),\\
0, & \text{otherwise,}
\end{cases}
\]
and if the underlying PHF is balanced, participant anonymity becomes equitable with
\[
p(P_c)=1-m/n.
\]
When \(m=t\), this yields the optimal participant anonymity \(1-t/n\) [1105.5681]. Although this work is about shared symmetric-key operations rather than search specifically, it shows that threshold-based sharing may be required to hide not only data but also which coalition executed the shared operation.

## 6. Applications, limitations, and design implications

The application spectrum is broad. In multilevel threshold function sharing, the intended use is threshold cryptography, exemplified by RSA signing and decryption, but the paper explicitly argues that the same access-control and key/function-splitting mechanisms can serve multilevel threshold searchable encryption, including cases where a search token is derived from a search secret \(K_{\text{search}}\) or where search is implemented as a function evaluation over exponentiation-based structures [1605.07988]. S3PHER places the primitive in regulated healthcare, with patient-driven consent over encrypted search and sharing [2404.11372]. DeTAPS uses searchable sharing to control the activation of tracing in decentralized threshold signatures [2304.07937]. T-OT-MP-PSI targets digital forensics, collaborative threat intelligence, and anti-money-laundering, where only items present in at least \(t\) datasets should be disclosed together with their holders [2512.24652]. SP-A\(^2\)NN targets collaborative RAG, where multiple organizations jointly maintain a privacy-preserving aggregated approximate nearest neighbor index while keeping embeddings locally protected by threshold shares [2507.17199].

Several limitations recur. Random oracle assumptions appear in the CRT multilevel scheme [1605.07988]. S3PHER notes that thresholding at the PRE layer is cheap and practical, whereas threshold FHE decryption adds overhead and the dominant cost remains TFHE evaluation of the search circuit [2404.11372]. SP-A\(^2\)NN explicitly assumes honest-but-curious parties, fully specifies insertion but not deletion, and provides analytic rather than empirical performance evaluation [2507.17199]. T-OT-MP-PSI distinguishes between an efficient protocol secure against up to \(t-2\) colluding semi-honest parties and a security-enhanced protocol secure against up to \(n-1\), with the latter incurring OLE overhead [2512.24652]. DeTAPS, although decentralized, depends operationally on SGX2 enclaves and a consortium blockchain [2304.07937].

From the collected works, a consistent design pattern emerges. A threshold-based searchable sharing primitive is built by combining: a threshold sharing layer for the secret or capability; a search, retrieval, activation, or evaluation layer; and an auxiliary-data discipline that prevents public metadata from re-linking hidden shares. In the CRT hierarchy, that discipline is the hashed translation value; in S3PHER, it is encrypted search plus consent-gated PRE; in DeTAPS, KASE and DTPKE bind searchable authorization to threshold activation; in T-OT-MP-PSI, OPPRF and Shamir shares turn multiplicity testing into threshold-gated disclosure; and in SP-A\(^2\)NN, the bitgraph and privacy-triplet framework make index leakage explicit while preserving threshold protection of vector data [1605.07988]. This suggests that the modern notion of threshold-based searchable sharing is not confined to keyword search: it encompasses any searchable or query-driven capability whose execution, disclosure, or activation must be mediated by a threshold access structure.

Source: https://www.emergentmind.com/topics/threshold-based-searchable-sharing-primitive