A Multiple User Cryptography Approach Using a One-Time User Key Model and a (1, n) Threshold Polynomial Secret Sharing

Abstract

Classical approaches to cryptography exhibit several limitations when applied to scenarios involving more than two users. The One-Time User Key (OTUK) meta-cryptographic model addresses these limitations by enabling multi-user encryption that is flexible, applicable to any cryptographic algorithm, and designed for systematic deployment without compromising system security. Each user possesses an individual key from which One-Time keys are derived; these keys feed a secret-sharing function ($\omega$) that establishes the multi-user encrypted channel. In this paper, we present a polynomial-based implementation of the $\omega$ function under a $(1,n)$ threshold model. The generated polynomial has roots at points corresponding to valid user keys and is mapped to the real encryption key. We provide a formal threat model, pseudocode for the complete protocol, and a detailed computational analysis across the numerical domains $\mathbb{N}$, $\mathbb{Z}$, and $\mathbb{R}$. Furthermore, we present experimental benchmarks measuring encryption/decryption speed, scalability up to 30 users, parameter sensitivity, and a comparative evaluation against Shamir’s Secret Sharing scheme. A systematic security analysis examines partial-information attacks, derivative-root distance margins, and brute-force resistance, demonstrating that the effective security margin remains above 245 bits for configurations of up to 30 users with 256-bit keys. The proposed method offers a concrete, efficient, and secure foundation for multi-user encrypted communication in domains such as IoT, public administration, and e-health.

1. Introduction

Current cryptographic models are difficult to scale beyond two users. In symmetric cryptographic mechanisms it is necessary to share a single key between multiple users, while in asymmetric cryptographic mechanisms, which provide two keys per user, it is not possible to define a key for a group of users by binding it to the original keys. One solution for creating a mechanism that operates using standard cryptographic algorithms is to use secret-sharing mechanisms. The literature provides some secret-sharing mechanisms of type $(t,n)$ that allow dividing a secret into n parts in such a way that by owning at least t parts of it, it is possible to reconstruct the original secret. However, these mechanisms are generally designed to handle secrets abstractly, without being tightly coupled to user-specific keys or integrated into standard encrypted communication protocols. There is a lack of systematic solutions for using secret-sharing models while preserving compatibility with individual user identities and keys. In addition, most existing work focuses on generic $(t,n)$ models and does not fully explore the limiting case of $(1,n)$ (often considered insecure) or how this case can be transformed into a model with increased security and practicality when integrated with user key binding. Therefore, the model proposed in this paper represents a mechanism of type $(1,n)$, as it requires that a single user can access the key to the encrypted channel; however, the parts obtained by the mechanism will be tied to the keys of each user, thus making it possible to apply the mechanism systematically. The repeated application and the fact that the whole thing is never untethered from the original user key makes the threshold case $(1,n)$ a valid case (and a non-trivial case of threshold secret sharing) since the user definitely does not need to store encryption keys. A first application has been proposed in [1], in which user keys are bound to the encryption key by a one-way function called One-Time User Key. This allows secure data sharing through multiple users using a temporary key for each. These are generated through a cascading salting and hashing mechanism. The strategy involves using a public key calculated by placing the real key and the user-generated OTUK in XOR. In this way, from the single key, it is possible to trace back to the real key. The One-Time User Key model for multi-user encryption defines different components, including a $\omega$ function that allows implementing the mechanism with threshold $(1,n)$ in the specific case required by the problem of using encrypted channels between multiple users bound to their original user keys. An example of an application of the model is that offered by Winarno and Sari [2] in the field of IoT. This paper provides a possible implementation of the ${\omega }^{\prime }$ function by using polynomial generation to perform the binding between the user keys and the key chosen for the multi-user encrypted channel. This implementation requires the application of the One-Time User Key [1] model to generate secure keys to be used for the single channel for each user. The $(1,n)$ threshold can be redefined for groups of users (extension case of the One-Time User Key model), where each group represents a unique key part, i.e., the group is seen as a single user of the $(1,n)$ threshold, thus requiring the conjunction of the entire group for secret reconstruction.

Thus, the main contributions of this work are as follows:

• Defining a new polynomial-based implementation (${\omega }^{\prime }$) for the $\omega$ function of the multi-user encryption model in a One-Time User Key.
• A formal threat model and precise security assumptions for the $(1,n)$ threshold polynomial scheme.
• Analysis of the numerical domains $\mathbb{N}$, $\mathbb{Z}$, and $\mathbb{R}$ with formal definitions of base transponent functions and their properties.
• Pseudocode descriptions of key generation, polynomial construction, and decryption algorithms.
• Experimental evaluation, including encryption/decryption benchmarks, scalability analysis, parameter sensitivity, and a head-to-head comparison with Shamir’s Secret Sharing.
• Evaluation of the extension to groups of keys and implementation of this extension.
• A systematic security analysis covering partial-information attacks, derivative-root distance, and brute-force resistance bounds.

The elements proposed in this article can be used for the purposes required by the European Union [3] regarding encryption, as multi-user encrypted channels can be generated where one of the users is a government entity, thus allowing bypass of encryption butF without introducing security holes. This approach can be particularly beneficial for sectors such as public administration and e-health, where secure data sharing among multiple actors, often with different levels of access and responsibility, is essential, and where preserving compatibility with individual user identities is crucial. While this work focuses on multi-user encryption for secure data sharing, it is important to note that network traffic analysis in medical contexts, as demonstrated by recent studies [4], [5] is another critical area for cybersecurity. The paper is structured as follows: Section 2 provides the most interesting and relevant analogous approaches; Section 3 references the multi-user cryptography model defined in [1]; Section 4 contains the explanation and implementation details of the polynomial approach, evaluating the strengths and weaknesses of the numerical domains $\mathbb{N}$, $\mathbb{Z}$ and $\mathbb{R}$ in the specific application, the extension to the cases of groups of keys and the security analysis of possible partial attacks; Section 5 provides a complete example of application of the model; Section 6 contains both ecpariments and resulrs’ discussion; and Section 7 contains the conclusions of this work.

2. Related Work

The first secret sharing mechanisms were created by Shamir [6] and Blakely [7] and were followed by many different formulations over the years [8,9,10]. Shamir’s Secret Sharing mechanism [6] uses polynomial, performing a Lagrange polynomial interpolation. Phiri et al. [11] proposed a Polynomial-Based Linear Scheme (PBLS), a new $(t,n)$ threshold linear secret sharing scheme which uses both the mechanisms of Shamir [6] and some elements of ElGamal’s cryptosystem [12], another cryptographic milestone. The mechanism of Phiri et al. [11] uses a polynomial $f\left(x\right)$, where x is is the element that hides the secret, in the secret-sharing phase. This will then be reconstructed using a Lagrange polynomial interpolation. Unlike [6], the scheme is, however, resistant to cheating, since it can be recognized by multiplying the multiplicative inverse of r (a random value used in the computation) by the parameter x. These approaches differ significantly from the one proposed in that they use the polynomial to split the secret into parts. Instead, the one proposed in this paper does not physically split the secret but is replicated on single points of the ordinate axis of the polynomial. The scheme proposed by Asmuth et al. [13], which has become fundamental in cryptography, uses the Chinese Remainder Theorem (CRT) to perform secret sharing through the computation of the reduction modulo and the use of a system of congruences. Herzberg et al. [14] propose the concept of Proactive Secret Sharing (PSS), a mechanism in which distributed keys are updated at intervals of time, to limit the possibility of attack. Meng et al. [15] continued the work of Ning et al. [16], analyzing why in PSS schemes used on integer rings mechanism failure occurs following too many refresh rates. PSS mechanisms also use polynomial interpolation; the reconstruction of the polynomial determines the reconstruction of the secret, unlike the mechanism proposed in this work, which instead arranges the secret at one of the values taken by the polynomial. Kormargodski et al. [17,18] extended the concept of thresholds of type $(t,n)$ to an infinite number of participants, thus obtaining thresholds of type $(t,\infty )$; access structures are then defined as collections not known a priori. Among the most interesting implementations, Soleymani et al. [19] proposed a perfectly secure protocol using Shamir’s scheme and Sperner families to maximize the number of secrets on a graph-based system. However, this system involves excessive memory overhead. Furthermore, it is only possible to succeed in reconstructing the secret if the graph is a complete graph. Okamura et al. [20] instead started from $(2,\infty )$-type solitary secret shares and defined a new evolutionary construct by applying it to more complex positive integer binary codes and then extending the mechanism to D-ary prefix codes. This mechanism was then subsequently engineered by D’Arco et al. [21], using a scheme based on the Chinese reminder theorem, by designing an infinite sequence of finite $(3,N^i)$-threshold schemes where $i=1,2,3,\dots$, for a properly chosen number $N^i$ of participants. Xing et al. [22] proposed new evolutionary schemes based on direct algebraic constructions, using techniques derived from Shamir Secret Sharing and algebraic geometry codes such as a k-threshold scheme with near-optimal shares in size, a scheme with variable threshold $k_t$ and shares of dimension $O\left(t^4\right)$ or even sub-linear as a function of t, depending on the growth of $k_t$, and a ramp scheme $(\alpha t,\beta t)$ with constant dimension shares, which is also multiplicative, making it suitable for secure distributed computations. Tong et al. [23] developed a secure unsigncryption scheme against adaptive corruptions with threshold (t, n). The method develops and combines several cryptographic techniques such as threshold IBE for distributed encryption, strong signature + OTS for authentication, and the CHK + dual-system technique to achieve full security (IND-CCA and UF-CMA) in an adaptive and standard model. Another innovative approach was recently proposed by Boudgoust et al. [24], where the authors introduce an FHE (Fully Homomorphic Encryption) scheme with t-out-of-n threshold decryption that allows the use of a polynomial module and makes use of Rényi divergence as a measure of proximity between distributions. This allows for greater theoretical flexibility than statistical distance. This approach represents a significant contribution to the field, as it introduces new techniques for reconciling cryptographic efficiency, modularity, and distributed security. In the field of client-server communications, Iwamura et al. [25] presented a new secure computation scheme based on secret sharing $(k,n)$, in which the requirement $n<2k-1$ is exceeded and all necessary communication is confined to the preprocessing phase. During the online phase, even in the presence of multiplications, no communication between servers is necessary, a property that represents an important step forward compared to existing protocols. This approach not only improves efficiency in terms of latency and scalability, but also allows for more effective parallel execution.

3. Multiple Users Cryptography

The basis for applying multiple encryption is that offered by the One-Time User Key model [1]. The model proposed in this work is based on choosing a single key, which will be used for the real encryption, called real key and denoted by $k_{*}$. This offers the advantage of being able to apply the model as if it were meta-cryptographic, thus using the model on standard encryption algorithms already tested in security by the scientific community. Each user will have a unique key, called the user key, which will be the only one in the possession of the user. Therefore, the system must allow each authorized user to obtain the real key $k_{*}$ through his/her user key. Let K be the set of possible keys for a certain encryption/decryption algorithm $\mathfrak{C}$. K can be divided into two sets: $K^{+}$, the set of valid keys for decrypting a specific channel, and $K^{-}$, the set of invalid keys; I is the set of users in the system, divided into $I^{+}$, which is the set of authorized users for the specific channel; and $I^{-}$ is the set of unauthorized users. This transformation is done by a $\omega$ function, which receives as input a key (the user key) and produces output according to the following rules:

$$\omega :K\times I\to K$$

(1)

$$\forall k\in K^{+},i\in I^{+}\omega (k,i)=k_{*}$$

(2)

$$\forall k\in K^{-},i\in I^{-}\omega (k,i)\ne k_{*}$$

(3)

All approaches that can guarantee both conditions without exposing flaws due to the application of the individual approach are applicable for the model. The $\omega$ function will be specific to the individual cryptographic channel between users, and the additional information needed by the function to manage the specific channel will have to be serialized and stored within the system. Therefore, this function will have a general operation but will be parametric concerning the users enabled to operate on the specific encrypted channel. Function $\omega$ and its specific implementation will be public, while the elements of $K^{+}$ and the real key $k_{*}$ are secret. The user in possession of the secret (i.e., one of the keys in $K^{+}$) can derive $k_{*}$ through the application of the public function $\omega$ on the key in his/her possession (condition (2)), thus obtaining the decryption key. The model provides a protocol for synchronization between the parties, in which one of the users involved in the encryption channel or a superuser will receive the keys (suitably obfuscated by the One-Time User Key method), choose the real key $k_{*}$ and generate from the information at its disposal the function $\omega$. The model also provides for the generation of One-Time keys from user keys through the application of a multiple cryptographic hashing process with salts. The process of generating One-Time User Keys by multiple hashing and generating salts is done by the individual user, who then provides the obtained key and the set of salts used to the user who is generating the channel, according to the previously expressed protocol. The detail of such a protocol is contained in the original work [1].

3.1. Threat Model and Security Assumptions

To support a rigorous security analysis, we define the threat model and the assumptions underpinning the proposed scheme.

3.1.1. System Model

The system comprises a set of n users $I=I^{+}\cup I^{-}$, where $I^{+}$ denotes authorized users and $I^{-}$ unauthorized users. A designated channel creator (one of the authorized users or a superuser) generates the encrypted channel. The following information is public: the polynomial coefficients of ${\omega }^{\prime }$, the salt sets $S_i$ for each user, the hash function h (SHA-256), and the number of hash rounds. The following information is secret: each user key $u{k}_i$, the objective key $k_{\oplus }$, and the real key $k_{*}=h^{\left(r\right)}\left(k_{\oplus }\right)$.

3.1.2. Adversary Model

We consider a computationally bounded adversary $\mathcal{A}$ with the following capabilities:

1.

Passive access to public data: $\mathcal{A}$ can observe the polynomial coefficients $\{c_0,c_1,\dots ,c_n\}$ and all salt sets.

2.

No access to user keys: $\mathcal{A}$ does not possess any $u{k}_i\in K^{+}$, nor any OTUK derived from a valid user key.

3.

Polynomial-time computation: $\mathcal{A}$ is limited to probabilistic polynomial-time algorithms.

4.

Adaptive queries: $\mathcal{A}$ may evaluate ${\omega }^{\prime }$ at arbitrary points and observe the output.

3.1.3. Security Assumptions

The security of the proposed scheme relies on the following assumptions:

1.

Preimage resistance of SHA-256: Given $k_{*}=h^{\left(r\right)}\left(k_{\oplus }\right)$, it is computationally infeasible to recover $k_{\oplus }$ from $k_{*}$.

2.

One-wayness of the OTUK generation: The cascaded salt-and-hash mechanism ${\mathfrak{H}}_i$ is a one-way function; given ${\mathrm{OTUK}}_i$, it is infeasible to recover $u{k}_i$.

3.

Pseudorandomness of SHA-256 output: The numerical values $bt\left({\mathrm{OTUK}}_i\right)$ are uniformly distributed over the key space, ensuring that the roots of the polynomial are well-separated with overwhelming probability.

4.

Large objective key space: The objective key $k_{\oplus }$ is chosen from a space of size $2^{k_{\oplus }\text{-}\mathrm{bits}}$ (e.g., 2048 bits), which is exponentially larger than the user key space ($2^{256}$), preventing the value-size attack described in Section 4.5.

3.1.4. Security Goals

The scheme aims to satisfy the following criteria:

• Key secrecy: No polynomial-time adversary can recover $k_{*}$ or $k_{\oplus }$ from the public polynomial with probability non-negligibly greater than $2^{-\lambda }$, where $\lambda$ is the security parameter.
• User key privacy: The elements of $K^{+}$ cannot be recovered from the polynomial coefficients without brute-force search over the OTUK space.
• Threshold correctness: Any single authorized user can reconstruct $k_{*}$; no unauthorized user can do so.

4. Proposed Approach

The proposed approach involves generating, for the single encrypted channel, a polynomial that, for input values in $K^{+}$, returns $k_{*}$ as the value.

4.1. Numeric Domain and Cryptographic Domain

This approach, therefore, operates on two different domains: the cryptographic key domain, where the key is understood as a sequence of bits in which the cryptographic functions are applied; and the numeric domain, in which the mathematical operations that transform the value into its corresponding key are computed. This difference must be made explicit since the mathematical operations can be implemented only in the numerical domain, but cryptographic operations (queuing and hashing) make sense only by intending the data as a sequence of bits. It is necessary to maintain a correspondence between data expressed in the numerical domain and its corresponding cryptographic domain, and vice versa, in order to use both mathematical and cryptographic operations on the same semantic data. Therefore, it is necessary to formally provide functions that transpose a sequence of bits into the numeric domain and, vice versa, a number into its corresponding sequence of bits. Let us then define the base transponent function, denoted $bt$, that converts data from the key (cryptographic) domain to the numeric domain $\mathbb{X}$ (e.g., $\mathbb{N}$, $\mathbb{Z}$, $\mathbb{R}$), which works as follows:

$$bt:K\to \mathbb{X}$$

(4)

$$b{t}^{-1}:\mathbb{X}\to K$$

(5)

$\mathbb{X}$ is a placeholder for the chosen numerical set. Consider within the text, for simplicity, that the words “numeric domain $\mathbb{X}$” mean the ring defined by the mathematical set $\mathbb{X}$, over which the base transponent functions $bt$ and $b{t}^{-1}$ are defined.

The base transponent $bt$ function will be used when it is necessary to apply a mathematical operation to a data element expressed as a sequence of bits in the cryptographic domain. Instead, its inverse $b{t}^{-1}$ will be used when there is a need to apply a cryptographic operation to data expressed in numerical form, converting it into a sequence of bits. The transponent function $bt$ transforms a value in the cryptographic domain, such as a decryption key, to a different domain. Therefore, the implementation of $bt$ depends on the chosen numeric domain.

Although the framework can be defined generally for any numerical domain $\mathbb{X}$, practical implementations require specific choices. The numerical domain influences both the precision of operations and the injectivity/surjectivity of the base transponent functions. We consider the following main options:

• Domain $\mathbb{N}$ (Unsigned Integers): In $\mathbb{N}$, bit sequences are directly interpreted as positive integers using binary representation. Each bit sequence that makes up the key will then be interpreted as a binary positive integer value, and conversely ($b{t}^{-1}$), with each positive integer interpreted as the bit sequence corresponding to the binary representation of that value. Considering N as the number of bits of the keys in K, $x\left[j\right]$ with $x\in K$ and $j\in [0,N-1]\in \mathbb{N}$ the value of the j-th bit of the key K, starting from the right (i.e., bit 0 is the least significant bit and bit $N-1$ the most significant bit), it will be

  $$b{t}_{\mathbb{N}}\left(k\right):=\sum _{i=0}^{N-1}{2}^i\left(k\left[i\right]\right)$$

  (6)
  The inverse function $b{t}^{-1}$ will be the binary representation of n on N bits.
  Functions $b{t}_{\mathbb{N}}$ and $b{t}_{\mathbb{N}}^{-1}$ are injective and surjective, ensuring a one-to-one mapping between keys and integers. This makes $\mathbb{N}$ suitable for operations where key sizes are fixed and padding with zeros does not affect integrity.
• Domain $\mathbb{Z}$ (Signed Integers): For $\mathbb{Z}$, the two’s complement is used. The base transponent function $bt$ will then be

  $$b{t}_{\mathbb{Z}}\left(k\right):=-\left(k[N-1]\right)2^{N-1}+\sum _{i=0}^{N-2}{2}^i\left(k\left[i\right]\right)$$

  (7)
  Again, the transposition functions are injective and surjective due to the unique two’s complement representation, including zero. The main difference from $\mathbb{N}$ lies in the symmetric range around zero and the need to know the bit size in advance.
  Both $\mathbb{N}$ and $\mathbb{Z}$ provide an integer-only representation that supports mathematical operations without floating-point issues. The polynomial coefficients (e.g., those in function $f_{\oplus }$ or ${\omega }^{\prime }$) are thus integers, which simplifies implementation and improves numerical stability. However, $\mathbb{Z}$ halves the usable key space in terms of absolute values due to its negative range.
• Domain $\mathbb{R}$ (Floating-Point Real Numbers): Set $\mathbb{R}$ corresponds to the real numbers. This set is represented as a sequence of bits using floating-point notation. The octuple-precision floating-point format [26] yields a 256-bit key: the value is stored using 1 bit for the sign, 19 bits for the exponent, and 236 bits for the mantissa. Function $b{t}_{\mathbb{R}}$ is therefore not surjective, since there are numbers that cannot be stored in total due to rounding caused by precision; it is not injective since there are two keys that can represent the same value (i.e., the cases where the floating-point representation corresponds to either Not a Number or $\pm 0$). Function $b{t}_{\mathbb{R}}^{-1}$ is not injective because of the redundancies mentioned above, but it is surjective. The presence of redundancy, with values that block the computation (NaN, $\pm \infty$), makes this strategy difficult to implement. In the case of choosing such a representation, it is also advisable to perform a test calculation of the real key, as the calculations may give slightly different results (due to the approximations of floating-point arithmetic) and thus lead to invalid keys. This representation allows us to directly handle the problem described in Section 4.5, as the problem is more manageable since the values are smaller. Moreover, in such a representation it is possible to choose to validate the parameter a of Equation (19), in particular, it is possible to choose a value $0<a<1$ to reduce the effect of the problem in Section 4.5; however, this choice is unimportant as it does not particularly affect the result. In domain $\mathbb{R}$, if the result of function ${\omega }^{\prime }$ is not compatible with the size of the key the approximation of floating-point arithmetic will be used: if the value is too large, it will be approximated to $\pm \infty$; if instead the problem is on the decimal part, it will be rounded. Finally, where two users use different precision architectures, if the same scheme is not used for handling numbers and mathematical operations, the results may be different, resulting in a non-functional system.

While the model theoretically accommodates any numerical domain, the choice of $\mathbb{N}$ or $\mathbb{Z}$ is generally preferable for deterministic, stable behavior and full bit coverage. The $\mathbb{R}$ domain, although versatile, introduces complexity due to floating-point approximations, redundancy, and platform dependency. The definition and implementation of $bt$ and ${\omega }^{\prime }$ are thus not only mathematical concerns but also practical ones, significantly affecting interoperability, validity, and system reliability.

This formulation of $bt$ and $b{t}^{-1}$ needs to define the equivalent of the real key in the numerical domain. Let this numerical value be called the objective key and denoted by $k_{\oplus }\in \mathbb{R}$:

$$bt\left(k_{*}\right)=k_{\oplus }$$

(8)

$$b{t}^{-1}\left(k_{\oplus }\right)=k_{*}$$

(9)

The numeric objective key $k_{\oplus }$ will then be the counterpart of the real key $k_{*}$ in the numeric domain. This is essential because it allows mathematical operations to be performed on it that otherwise could not be performed on the cryptographic key.

Then define the domain of the keys with their numerical equivalents:

$$K_{\mathbb{R}}:=\{n\mid bt\left(n\right)\in K\}$$

(10)

$$K_{\mathbb{R}}^{+}:=\{n\mid bt\left(n\right)\in K^{+}\}$$

(11)

$$K_{\mathbb{R}}^{-}:=\{n\mid bt\left(n\right)\in K^{-}\}$$

(12)

The problem then returns to finding an implementation of $\omega$ in the numerical domain (${\omega }^{\prime }$), which acts in this way:

$${\omega }^{\prime }:\mathbb{R}\times I\to \mathbb{R}$$

(13)

$$\forall k\in K_{\mathbb{R}}^{+},i\in I^{+}{\omega }^{\prime }(k,i)=k_{\oplus }$$

(14)

$$\forall k\in K_{\mathbb{R}}^{-},i\in I^{-}{\omega }^{\prime }(k,i)\ne k_{\oplus }$$

(15)

Consider $\mathfrak{C}(k,m)$ as the decryption function for the message m using the key k.

Function $\Omega$, which will decrypt a message m using decryption function $\mathfrak{C}$ starting from the user key k, adjusted concerning the steps between the numeric and cryptographic domains, will be

$$\Omega (k,i,m):=\mathfrak{C}(b{t}^{-1}\left({\omega }^{\prime }(bt\left(k\right),i)\right),m)$$

(16)

The mathematical approaches that satisfy conditions expressed by Equations (14) and (15) are valid for the ${\omega }^{\prime }$ implementation problem.

A final consideration concerns the conscious choice not to adopt, as a numerical domain, finite fields such as $\mathrm{GF}\left(2^{256}\right)$ or modular arithmetic. Although these tools are common in cryptography, their adoption was avoided for reasons of generality and flexibility in handling mathematical operations. In particular, modular arithmetic introduces a discontinuity in the ${\omega }^{\prime }$ function that compromises the continuity and progressiveness of the numerical transformations required in this model. Moreover, in finite fields each element has cyclic behavior that makes it more complex to define validity conditions such as those expressed in Equations (14) and (15), where one needs to unambiguously distinguish the correct key from incorrect key. The proposed model, on the other hand, is based on a more direct and interpretable representation of the bit sequence by classical numerical sets such as $\mathbb{N}$, $\mathbb{Z}$ and $\mathbb{R}$, thus maintaining linearity of transformations and semantic transparency between cryptographic and numerical domains.

Table 1. Comparison table between the proposed numerical domains.

	$\mathbb{N}$ Domain	$\mathbb{Z}$ Domain	$\mathbb{R}$ Domain
Implementation of the $bt$ function	Binary notation	Two’s complement	Floating point
Key size	Arbitrarily large	Arbitrarily large	Floating point standard sizes
Properties of the function $b{t}^{-1}$	Injective Surjective	Injective Surjective	Surjective
Codomain of the function ${\omega }^{\prime }$	$\mathbb{Z}$	$\mathbb{Z}$	$\mathbb{R}$
Considerations on a parameter	$a=1$ is always the best choice	$a=1$ is always the best choice	$0<a<1$ might be useful $a=1$ is standard $a>1$ makes the system worse
Specific advantages	There are no approximation problems. Ease of using the functions $bt$ and $b{t}^{-1}$	There are no approximation problems. Ease of using the functions $bt$ and $b{t}^{-1}$. The output values of ${\omega }^{\prime }$ are smaller than $\mathbb{N}$	The output values of ${\omega }^{\prime }$ are the smallest. The polynomial, evaluated in two consecutive values does not vary enormously. Any factorization is unthinkable
Specific disadvantages	The polynomial varies enormously even when evaluated between consecutive values	The polynomial varies enormously even when evaluated between consecutive values	Problems with computation and floating point approximation. Redundancy between some values. There are configurations that block the calculation. Difficulties in applying the function $b{t}^{-1}$. Users using different precision architectures may have different results, making the system non-functional.

summarises the key differences between the three numerical domains.

4.2. Polynomial as Function ${\omega }^{\prime }$

The proposed approach consists of generating a polynomial, a function of the keys in the numerical domain, that returns the value $k_{\oplus }$ for the inputs in $K_{\mathbb{R}}^{+}$. It will then be sufficient to store the coefficients of such a polynomial in order to guarantee the operation of the multiple encryption system, since these represent the implementation of ${\omega }^{\prime }$, which must be public. All formulations of this type involve the generation of a polynomial: this guarantees that such functions will be of type

$$K_{\mathbb{R}}\to \mathbb{R}$$

(17)

The codomain of such a function will always be $\mathbb{R}$, since it is not certain that the polynomial evaluated at some k returns an output compatible with the size of the key; i.e., that it belongs to $K_{\mathbb{R}}$. The resolution of this problem depends on the specific numerical domain chosen, the considerations of which can be found in Section 4.1 and Section 4.5.

A possible approach is to exploit the product cancellation law by generating a polynomial that has zeros in $k_1,k_2\dots \in K_{\mathbb{R}}^{+}$ and then translating it by $k_{\oplus }$. Let us define function $f_{\oplus }$, operating as follows:

$$f_{\oplus }:K_{\mathbb{R}}\to \mathbb{R}$$

(18)

$$f_{\oplus }\left(k\right):=a\prod _{k_i\in K_{\mathbb{R}}^{+}}(bt\left(k\right)-bt\left(k_i\right))$$

(19)

Function ${\omega }^{\prime }$ will then be

$${\omega }^{\prime }\left(k\right):=f_{\oplus }\left(k\right)+k_{\oplus }$$

(20)

where parameter i of ${\omega }^{\prime }(k,i)$ can be omitted as it does not change the result of the function; it will be retained for the decryption function $\Omega$ instead.

The value of $k_{\oplus }$ is hidden, as it is added to the constant term of $f_{\oplus }$. This implementation of ${\omega }^{\prime }$ ensures that both the conditions expressed by Equations (14) and (15) are met:

• The condition expressed by Equation (14) is satisfied since $f_{\oplus }$ is polynomial and has zeros in the elements of $K_{\mathbb{R}}^{+}$, so function ${\omega }^{\prime }(k,i):=f_{\oplus }\left(k\right)+k_{\oplus }$ will return $k_{\oplus }$ in the elements of $K_{\mathbb{R}}^{+}$;
• The condition expressed by Equation (15) is satisfied since the polynomial is generated from such zeros, so it never takes on the value $k_{\oplus }$ at values other than the elements of $K_{\mathbb{R}}^{+}$.

The implementation of the function ${\omega }^{\prime }$ is public (i.e., the coefficients of the polynomial), and the secret information is the keys used to generate the polynomial contained in $K^{+}$. Other secret information is obviously the real key $k_{*}$ and the corresponding objective key $k_{\oplus }$.

4.3. Algorithmic Description

To improve clarity and reproducibility, we provide pseudocode for the three core procedures of the proposed scheme. Algorithm 1 details the channel generation phase, executed by the channel creator.

Algorithm 1 Channel Generation (performed by the channel creator)
Require:  Set of authorized user OTUKs: $\{{\mathrm{OTUK}}_1,\dots ,{\mathrm{OTUK}}_n\}$; hash function h; number of hash rounds r; target key bit-size b
Ensure:  Polynomial coefficients $C=\{c_0,\dots ,c_n\}$; real key $k_{*}$
1: $k_{\oplus }\leftarrow \mathrm{RandomBits}\left(b\right)$	▹ Choose objective key
2: $k_{*}\leftarrow h^{\left(r\right)}\left(k_{\oplus }\right)$	▹ Compute real key by r-fold hashing
3: for $i=1$ to n do
4:     $z_i\leftarrow bt\left({\mathrm{OTUK}}_i\right)$	▹ Convert to numerical domain
5: end for
6: $p\left(x\right)\leftarrow {\prod }_{i=1}^n(x-z_i)$	▹ Build zero-polynomial
7: ${\omega }^{\prime }\left(x\right)\leftarrow p\left(x\right)+k_{\oplus }$	▹ Translate by objective key
8: $C\leftarrow \mathrm{Coefficients}\left({\omega }^{\prime }\right)$	▹ Extract coefficients $c_0,\dots ,c_n$
9: return $C,k_{*}$

Algorithm 2 describes the One-Time User Key generation process, performed independently by each user before channel creation.

Algorithm 2 OTUK Generation (performed by each user i)

Require:  User key $u{k}_i$; salt set $S_i=\{s_1,\dots ,s_m\}$; hash function h Ensure:  One Time User Key ${\mathrm{OTUK}}_i$ 1: $v\leftarrow u{k}_i$ 2: for $j=1$ to m do 3:     $v\leftarrow h(s_j\parallel v)$                                                                                ▹ Cascaded salt-and-hash 4: end for 5: ${\mathrm{OTUK}}_i\leftarrow v$ 6: return ${\mathrm{OTUK}}_i$

Finally, Algorithm 3 presents the decryption procedure carried out by any authorized user to recover the real key and decrypt the message.

Algorithm 3 Decryption (performed by an authorized user i)
Require:  User key $u{k}_i$; salt set $S_i$; polynomial coefficients C; hash function h; hash rounds r; encrypted message m; decryption function $\mathfrak{C}$
Ensure:  Decrypted message $m^{\prime }$
1: ${\mathrm{OTUK}}_i\leftarrow \mathrm{GenerateOTUK}(u{k}_i,S_i)$	▹ Algorithm 2
2: $z_i\leftarrow bt\left({\mathrm{OTUK}}_i\right)$
3: $v\leftarrow \mathrm{EvalPolynomial}(C,z_i)$	▹ Horner’s method
4: $k_{*}\leftarrow h^{\left(r\right)}\left(b{t}^{-1}\left(v\right)\right)$	▹ Recover real key
5: $m^{\prime }\leftarrow \mathfrak{C}(k_{*},m)$	▹ Decrypt with real key
6: return $m^{\prime }$

4.4. Changes to $I^{+}$

Let it be the case that a user is to be added or removed within a specific encrypted channel. Therefore, let $K_{\mathbb{Z}}^{+}$ be the set of keys of the enabled users and $K_{\mathbb{Z}}^{{+}^{\prime }}$ the same set following the addition or removal of the user in question.

Any change to set $I^{+}$ cannot be solved by simply recalculating the polynomial ${\omega }^{\prime }$. Indeed, if this were done it would cause a problem because it is possible to derive both target key $k_{\oplus }$ and the valid keys: it is sufficient to set up a system of equations containing the polynomial ${\omega }^{\prime }$ computed on $K_{\mathbb{Z}}^{+}$ and polynomial ${\omega }^{\prime }$ computed on $K_{\mathbb{Z}}^{{+}^{\prime }}$ (as visible in Figure 1).

Regardless, in the case of removing a user, it would still be necessary to change the encryption key, since the user is no longer authorized to access it and may have the key saved in memory. Similarly, as described in [1] and in Section 3 it is necessary to generate new One-Time User Keys for each authorized user. In conclusion, for each change to the set $I^{+}$, we must generate new encryption with a new real key $k_{*}$, new One-Time User Keys, and generate a new polynomial ${\omega }^{\prime }$ on the new set of authorized users.

4.5. Value-Size Problem

As it is formulated so far, the system is attackable because of a problem due to the size of ${\omega }^{\prime }$ output values. This problem mainly afflicts numerical domains $\mathbb{N}$ and $\mathbb{Z}$, but is also perceptible in domain $\mathbb{R}$.

Consider then operating in domain $\mathbb{N}$. The values that can be represented with a 256-bit key are the integers in the range $[0,2^{256}-1]$. These are very large values, as the midpoint between them is ${\displaystyle \frac{2^{256}-1}{2}}\approx 2^{255}\approx 5.7896\times {10}^{76}$. The coefficients of polynomial ${\omega }^{\prime }$ are generated from numbers of about 70 digits, and the function raises to a power up to the degree $\left|K_{\mathbb{N}}^{+}\right|$, so the polynomial reaches enormous values. This implies that the function takes on two very distant output values for consecutive input values; in particular, except in some rare cases, we see that if $x\in K_{\mathbb{N}}^{+}$:

$${\omega }^{\prime }\left(x\right)=k_{\oplus }\in [0,2^{256}-1]$$

(21)

$${\omega }^{\prime }(x+1)\notin [0,2^{256}-1]$$

(22)

$${\omega }^{\prime }(x-1)\notin [0,2^{256}-1]$$

(23)

Function ${\omega }^{\prime }$ assumes values compatible with the size of the key only in the points corresponding to the target key. This is also because the values are only integers, so there are no nuances between two integer values to limit the problem; in fact, the problem is more contained in set $\mathbb{R}$, although still present. The problem is equally present in numerical domain $\mathbb{Z}$, as the range of values is $[-2^{255},2^{255}-1]$, although the presence of negative values and the fact that the maximum absolute value that can be assumed is $2^{255}$ instead of $2^{256}$ allows for a very slight decrease.

Using this flaw, it is then possible to find the objective key starting with ${\omega }^{\prime }$ by using the inequality

$${\omega }^{\prime }\left(k\right)\le 2^{256}-1$$

(24)

i.e.,

$${\omega }^{\prime }\left(k\right)-2^{256}+1\le 0$$

(25)

The values of which can be approximately identified by calculating the roots of the associated equation, i.e.,

$${\omega }^{\prime }\left(k\right)-2^{256}+1=0$$

(26)

This can then be achieved by a variant of the bisection method [27], applied on a calculator with an accuracy at least equal to the number of decimal places of the key:

1.

Set $s=0$

2.

Set $e=2^{256}-1$

3.

Set the threshold $\gamma =2^{256}$ (to search the case of Equation (21))

4.

Loop:

(4.1)

Compute $m={\displaystyle \frac{s+e}{2}}$

(4.2)

If ${\omega }^{\prime }\left(m\right)<\gamma$ ends: m is approximately a valid key

(4.3)

If ${\omega }^{\prime }\left(m\right){\omega }^{\prime }\left(s\right)<0$ set $e=m$

(4.4)

If ${\omega }^{\prime }\left(m\right){\omega }^{\prime }\left(e\right)<0$ set $s=m$

(4.5)

Go back to 4.1

Using such an attack on a system with $\left|K_{\mathbb{N}}^{+}\right|=3$ consisting of 256-bit keys and $k_{\oplus }$ of 256 bits, the identified key $k_{attack}$ differed by at most 10 from the target key:

$$k_{\oplus }-10<k_{attack}<k_{\oplus }+10$$

(27)

The solution to this problem cannot be derived by moving the problem to standard solutions such as finite fields (e.g., Galois fields) or modular algebra, since by the very nature of the attack it would be sufficient to perform the attack on the same system deprived of the elements of modular algebra to succeed. Adding modular operations to the polynomial reduces the search space, making the situation worse; such an addition would be foolish, since the advantage derived from the non-invertibility of modular operations would never be used.

There is a solution to fix the system from this attack scheme: reformulate the system by canceling the condition expressed in Equation (21), using as the target a key of a size much larger than the range of user keys in such a way as to make it impossible to search with any $\gamma$; even assigning to $\gamma$ a threshold equal to the size of the new target key, the attack would lead to values too distant from those of the real keys or to points (not corresponding to the real ones) where the polynomial takes values lower than this threshold.

This modification poses the problem of compatibility between $b{t}^{-1}\left(k_{\oplus }\right)$ and the key size of the encryption algorithm used. It then becomes necessary to add a hash function h with an output of a size compatible with that of the keys of the chosen encryption algorithm. The relationship between the target key and the real key then becomes

$$h\left(k_{\oplus }\right)=k_{*}$$

(28)

So real key $k_{*}$ can no longer be freely chosen, but objective key $k_{\oplus }$ will be freely chosen and the latter’s hash will be considered the real key.

Solving this problem leads to the final formulation of the method, described in the next section.

4.6. The Final Solution

Decryption function $\Omega$ is then rewritten to

$$\Omega (k,i,m):=\mathfrak{C}(h\left({\omega }^{\prime }\left({\mathfrak{H}}_i\left(k\right)\right)\right),m)$$

(29)

The number of hashes applied to the target key can be even greater than 1, slowing down the mechanism to provide advantages against brute-force attacks.

As described in the previous section, the target key $k_{\oplus }$ is arbitrarily chosen, and the actual encryption/decryption key is computed by multiple hashing of that value.

Figure 2 shows the complete operation of the system under the new formulation: users $A,B,C$, and D generate their One-Time User Keys and an objective key $k_{\oplus }$ is chosen, whose hash constitutes the real key $k_{*}$; the polynomial is then generated starting from the OTUKs of the single enabled users, whose coefficients are stored; in the decryption phase the user C generates its OTUK starting from the same salts of the previous phase; and we evaluate function ${\omega }^{\prime }$ in its OTUK and perform a hashing operation on the result, thus obtaining the real key $k_{*}$.

Applying the protocol described in [1], in the channel generation phase users create (by multiple hashing with salts) their own One-Time User Keys from their user key and transmit them, along with each set of salts used to generate the individual keys, to a user who is part of the set of authorized users, or a superuser, who will generate the channel. The user who generates the channel arbitrarily chooses the target key $k_{\oplus }$; calculates by multiple hashing of $k_{\oplus }$ the real key $k_{*}$ and uses the real key to encrypt the channel; then generates the polynomial ${\omega }^{\prime }$ from the received One-Time User Keys and the chosen target key; and finally stores and makes publicly available the coefficients of this polynomial. Whoever wants to access the channel generates, starting from the given salts and from his own user key, a corresponding One-Time User Key, calculates the value of the polynomial in correspondence of the base transponent applied to the One-Time User Key, and finally performs multiple hashing of the result obtained. If the user is authorized, he/she will obtain the real key $k_{*}$, otherwise, he/she will obtain another useless key.

Security Analysis of Possible Attacks

Possible attacks from partial information obtainable from publicly available information will now be evaluated. The constant term of function ${\omega }^{\prime }$ will always expose the first digits of $k_{\oplus }$, since this value will be so significant that the polynomial will only be impacted on the last digits: this is not a problem, since the hash function h to produce the real key $k_{*}$ requires that the precise value of $k_{\oplus }$ be entered. It is sufficient to consider the following in order to understand the minimum dimension for $k_{\oplus }$: the polynomial will have degree $\left|K_{\mathbb{N}}^{+}\right|$, so the input value will be raised to at least $\left|K_{\mathbb{N}}^{+}\right|$; the key with the highest value is $2^{256}$, so it will have $2^{256\left|K_{\mathbb{N}}^{+}\right|}$ as the largest weight term; it can be stated then, given that $keysize$ is the size of the user key, that the target key $k_{\oplus }$ must have at least a size of $2\times \left|K_{\mathbb{N}}^{+}\right|\times keysize$ bits.

The resulting polynomial will have a degree equal to $\left|K^{+}\right|$, which means that the values assumed on the y-axis have an order of magnitude larger than the keys themselves: performing a bruteforce attack on the values assumed by the polynomial is, therefore, more complex than performing a brute-force attack directly on the cryptographic algorithm, also taking advantage of the first exposed digits. This is easily mathematically demonstrated: consider an attack in which an attempt is made to reduce the search field, starting from the estimate of this information. Taking the example in Section 5 as a reference, it can be seen that the first 387 of 616 decimal digits of the target key are exposed; therefore, in order to carry out the attack successfully, it is necessary to find the remaining 229 decimal digits of $k_{\oplus }$, about which no further information is available. Therefore, the corresponding search space is ${10}^{229}$, within which there is one correct solution, that is, the target key $k_{\oplus }$. This space is much larger than the search space of a brute-force attack on the 256-bit real key $k_{*}$: ${log}_2{10}^{229}\approx 760.72153$.

The model then generates a polynomial that operates on very large values; the user submits their key, which, transposed into the numerical domain, is provided as input to the polynomial. The resulting value in the ordinate is then hashed several times; the output of this process is the key to be used for decryption. The polynomial has only $\left|K^{+}\right|$ values in the abscissae that are valid for deriving the key, so it is necessary to have precisely one of these points to derive the correct key. The individuation of a range of these points reduces the searching space; however, it is necessary to individuate the precise point (even very close points are not acceptable because they lead to a completely different result); therefore, the model is designed so that even the individuated ranges are sufficiently distant from the real points to make the attack through these modalities really unfruitful and disadvantageous. An example of this is as follows. A possible method of partial attack on the mechanism is to compute the maximum and minimum points of ${\omega }^{\prime }$ function, calculating the roots of the first derivative of the polynomial, obtaining points around which to search for one of the valid keys. This weakness is intrinsic and depends very much on the distance the valid keys are from each other. This distance cannot be predicted in any way, as it depends on the output of the hash function that generates the One-Time User Keys and the salts used. However, this situation does not restrict the search field very much. Here is a practical example:

$K^{+}=\{k_A,k_B,k_C\}$

$k_A=46405281504253902257062298977815151716970807791013070055982935894537329476319$

$k_B=53825675822650852524023876956337209496410552542639412530874894366950779447331$

$k_C=96803149470903114723881982803819783872763105553887423731976039075413239312012$

$k_{\oplus }=7419472389924686217202270324510005977659454805094251739699110663261490097938594843854329598092013249867489273516402369131788209635821319561144321953598870498067119755764819518211518742482917209752070106215689153565604413620831798203371482697998774940744160124967285526980542946689204790783043436803854$

${\omega }^{\prime }\left(k\right)=k_{\oplus }+{\prod }_{k_i\in K^{+}}(bt\left(k\right)-bt\left(k_i\right))=bt{\left(k\right)}^3-197034106797807869504968158737972145086144465887539906318833869336901348235662bt{\left(k\right)}^2+12200467982434898734340088207477767639130571822368261096748058654350142208504764557634295053858078105540269131903229225917318306537963239554875278308138389bt\left(k\right)+12200467982434898734340088207477767639130571822368261096748058654350142208504764557634295053858078105540269131903229225917318306537963239554875278308138389$

whose first derivative is (which does not depend on the value of $k_{\oplus }$)

$3bt{\left(k\right)}^2-394068213595615739009936317475944290172288931775079812637667738673802696471324bt\left(k\right)+12200467982434898734340088207477767639130571822368261096748058654350142208504764557634295053858078105540269131903229225917318306537963239554875278308138389$

whose roots (calculated with numpy.roots) are

$r_1=81387322641247049929238311138604095906356430719527486295917138969468799549440$

$r_2=49968748557291530904837514076454968648847987714011843677205272793136609886208$

The smallest distance is the distance between $r_2$ and $k_A$, equal to

3563467053037628647775215098639816931877179922998773621222336898599280409889,

whose logarithm in base 2 is

${log}_2\left(3563467053037628647775215098639816931877179922998773621222336898599280409889\right)\approx 250.97788870$.

A brute-force attack in these conditions roughly corresponds to performing a brute-force attack on 251-bit keys, with the addition that for each step it is necessary to calculate the value of the polynomial and perform the final multiple hash.

This narrowing of the field is not to be considered dangerous since, it can be solved by increasing the size of the key. The 5-bit advantage obtained by having to carry out the brute-force attack on 251-bit rather than on 256-bit, are balanced, in terms of attack time and computational complexity, by the mathematical and cryptographic operations that must be carried out for each attempt, the calculation of the value of the polynomial (therefore the powers, multiplications and sums over large values) and a multiple hashing of the result. Arbitrarily increasing the number of hashes required to transform $k_{\oplus }$ into $k_{*}$ or the size of the key always makes this attack more disadvantageous than canonical brute force on the real key, therefore canceling the problem due to such distances. Another possible practical solution is to have each user generate several One-Time User Keys and choose which key to use for each user while maintaining an appropriate distance between them based on an arbitrary threshold defined by the system administrator.

In any case, an attack remains possible that allows, starting from the real key $k_{*}$, or the objective key $k_{\oplus }$, or from one of the valid keys in $K^{+}$, derivation of the complete set $K^{+}$ and $k_{*}$ and $k_{\oplus }$. However, such an attack is useless since $k_{*}$ and $k_{\oplus }$ can be derived legitimately by the very nature of the threshold scheme $(1,n)$, while the other keys contained in the set $K^{+}$ can only be used to derive the real or target key, and cannot be used to derive user keys (a one-way function has been applied to generate them), nor are they used in other encrypted channels as they are One-Time keys. By the same principle, cooperative attacks between users are not possible since, being the $(1,n)$ threshold scheme, it is sufficient that there is only one authorized user to derive the secret information.

Therefore, it can be concluded that from the publicly available information, no attacks can be made that would endanger the security of the system.

5. A Practical Example

Below is a complete example of a system application. Salts $S_i$ and keys are expressed in hexadecimal byte notation. User Keys $u{k}_i$, Real Key $k_{*}$ and One-Time User Key $OTU{K}_i$ have sizes of 256 bits and the target key $k_{\oplus }$ has a size of 2048 bits. A quadruple hash converts the target key into the real key; a One-Time User Key will be generated using three salts of 10 bytes for each user key. The hash function used is SHA-256. The chosen numeric domain is $\mathbb{Z}.$

$u{k}_A=$ b818b8539222560a342c788127e369d28fc4c1ced60a0caa190ee4b1606c9727

$u{k}_B=$ 232ab2258cca40d05af19367aedbbb4adbf29cab1371fa5879e1a4344d21e050

$u{k}_C=$ 3954abb21af6f02651f43c51e76a0eaa6f59229bda2b26cde4a666f3981121af

$k_{\oplus }=-2759059427988118751171810084898511378686014316692701054359369907483086960147280927951882360126722662694532184195188961972868362846993251059452650949901671319367766798082867991240470556883884697703956461351638357048853900901041484660324340895644666443265005903256012836852445804681126254511900366735734964733669895941180858016312738723323889399445549153589827729428344030855889173788530004843358994984643024300619095545255239798746747582677062818763226912425784017739349922895488592045839993512783220930251514181388915097549509415745289431875606964791200752011689490523976526192814514388588585141655865174397017987042$

$k_{*}=h\left(h\left(h\left(h\left(k_{\oplus }\right)\right)\right)\right)=$0dea5423bafe6ae8a04b60c645e94aa427d537786a020555764deac666449a7b

Generation of One-Time User Keys from User Keys

$S_A=\{$4b15d808c39b7418d89d, a4145726ede4ad359c45, c569b517e7bb52da1d40}

$OTU{K}_A={\mathfrak{H}}_A\left(u{k}_A\right)=h({S_A}_3\ast h({S_A}_2\ast h({S_A}_1\ast u{k}_A)))=$ 5f85c9ae268265044fa641540786cd4460d5b94f0c526dcf35576f41511acae7

$S_B=\{$6663699fa1a68ca3d954, f0d82d94e2dffaac987d, 7ef5bd1c4652140bac01}

$OTU{K}_B={\mathfrak{H}}_B\left(u{k}_B\right)=h({S_B}_3\ast h({S_B}_2\ast h({S_B}_1\ast u{k}_B)))=$ fcd08b36394e1776e4c259dda9a54af856855a86241a2d2463563ca3ee18b57a

$S_C=\{$9993e8a9c29a4c82cd1f, cd4bc5da5ea61a3bacfb, d9a371f3a65de8bdbd61}

$OTU{K}_C={\mathfrak{H}}_C\left(u{k}_C\right)=h({S_C}_3\ast h({S_C}_2\ast h({S_C}_1\ast u{k}_C)))=$ bd3b0715e135db0be42f3f0de1f6a7c1d58a35157cd5165386435ec0c8f96aff

$b{t}_{\mathbb{Z}}\left(OTU{K}_A\right)=43206103221127765308154960281198322587417943163979147407128815129461853440743$

$b{t}_{\mathbb{Z}}\left(OTU{K}_B\right)=-1440786400244912028581263661189099379375264430281749025906787003385124440710$

$b{t}_{\mathbb{Z}}\left(OTU{K}_C\right)=-30200667976156195246572602623568403979681159061515561686445995927044882863361$

Generating polynomial ${\omega }^{\prime }$

$K^{+}=\{OTU{K}_A,OTU{K}_B,OTU{K}_C\}$

${\omega }^{\prime }\left(k\right)=k_{\oplus }+{\prod }_{k_i\in K^{+}}(bt\left(k\right)-bt\left(k_i\right))=-2759059427988118751171810084898511378686014316692701054359369907483086960147280927951882360126722662694532184195188961972868362846993251059452650949901671319367766798082867991240470556883884697703956461351638357048853900901041484660324340895644666443265005903256012836852445804681126254511900366735734964733669895941180858016312738723323889399445549153589827729428344030855889173788530004843358994984643024300619095545255239798746747582677062818763226912425784017739349922895488592045839993512783220930251514181388915097549509415745289431875606964791200752011689490523976526192814514388588585141655865174397017987042+(bt\left(k\right)-43206103221127765308154960281198322587417943163979147407128815129461853440743)(bt\left(k\right)+1440786400244912028581263661189099379375264430281749025906787003385124440710)(bt\left(k\right)+30200667976156195246572602623568403979681159061515561686445995927044882863361)=bt{\left(k\right)}^3-11564648844726658033001093996440819228361519672181836694776032199031846136672bt{\left(k\right)}^2-1323591232155033230352307926693285883603302675787776044123456388389822095601768656458263605262615098588335548211086547604981480239312067187176444305338443bt\left(k\right)-2759059427988118751171810084898511378686014316692701054359369907483086960147280927951882360126722662694532184195188961972868362846993251059452650949901671319367766798082867991240470556883884697703956461351638357048853900901041484660324340895644666443265005903256012836852445804681126254511900366735734964733669895941180858016312738723323889399445549153589827729428344030855889173788530006723373708055067099789360576929796082646862349311942652405749286232786918342552004669225258418843253640326096448289253136731298704242490729449215243542871131894631592779530197596871404848216460199788488703091507283562290563335372$

The data to be stored is

Salts: $S=\{S_A,S_B,S_C\}=${{4b15d808c39b7418d89d, a4145726ede4ad359c45, c569b517e7bb52da1d40}, {6663699fa1a68ca3d954, f0d82d94e2dffaac987d, 7ef5bd1c4652140bac01}, {9993e8a9c29a4c82cd1f, cd4bc5da5ea61a3bacfb, d9a371f3a65de8bdbd61}}

Polynomial coefficients: $\{1,-11564648844726658033001093996440819228361519672181836694776032199031846136672,-1323591232155033230352307926693285883603302675787776044123456388389822095601768656458263605262615098588335548211086547604981480239312067187176444305338443,-2759059427988118751171810084898511378686014316692701054359369907483086960147280927951882360126722662694532184195188961972868362846993251059452650949901671319367766798082867991240470556883884697703956461351638357048853900901041484660324340895644666443265005903256012836852445804681126254511900366735734964733669895941180858016312738723323889399445549153589827729428344030855889173788530006723373708055067099789360576929796082646862349311942652405749286232786918342552004669225258418843253640326096448289253136731298704242490729449215243542871131894631592779530197596871404848216460199788488703091507283562290563335372\}$

As discussed in Section 4.5, it can be seen that the constant term of the polynomial exposes the first 387 decimal places of the objective key $k_{\oplus }$, while the remaining 229 differ.

Testing of values

${\omega }^{\prime }\left(OTU{K}_A\right)={\omega }^{\prime }($5f85c9ae268265044fa641540786cd4460d5b94f0c526dcf35576f41511acae7$)=-2759059427988118751171810084898511378686014316692701054359369907483086960147280927951882360126722662694532184195188961972868362846993251059452650949901671319367766798082867991240470556883884697703956461351638357048853900901041484660324340895644666443265005903256012836852445804681126254511900366735734964733669895941180858016312738723323889399445549153589827729428344030855889173788530004843358994984643024300619095545255239798746747582677062818763226912425784017739349922895488592045839993512783220930251514181388915097549509415745289431875606964791200752011689490523976526192814514388588585141655865174397017987042✓$

${\omega }^{\prime }\left(OTU{K}_B\right)={\omega }^{\prime }($fcd08b36394e1776e4c259dda9a54af856855a86241a2d2463563ca3ee18b57a$)=-2759059427988118751171810084898511378686014316692701054359369907483086960147280927951882360126722662694532184195188961972868362846993251059452650949901671319367766798082867991240470556883884697703956461351638357048853900901041484660324340895644666443265005903256012836852445804681126254511900366735734964733669895941180858016312738723323889399445549153589827729428344030855889173788530004843358994984643024300619095545255239798746747582677062818763226912425784017739349922895488592045839993512783220930251514181388915097549509415745289431875606964791200752011689490523976526192814514388588585141655865174397017987042✓$

${\omega }^{\prime }\left(OTU{K}_C\right)={\omega }^{\prime }($bd3b0715e135db0be42f3f0de1f6a7c1d58a35157cd5165386435ec0c8f96aff$)=-2759059427988118751171810084898511378686014316692701054359369907483086960147280927951882360126722662694532184195188961972868362846993251059452650949901671319367766798082867991240470556883884697703956461351638357048853900901041484660324340895644666443265005903256012836852445804681126254511900366735734964733669895941180858016312738723323889399445549153589827729428344030855889173788530004843358994984643024300619095545255239798746747582677062818763226912425784017739349922895488592045839993512783220930251514181388915097549509415745289431875606964791200752011689490523976526192814514388588585141655865174397017987042✓$

${\omega }^{\prime }(min\left(K_{\mathbb{Z}}\right))={\omega }^{\prime }\left(b{t}^{-1}(-2^{255})\right)={\omega }^{\prime }\left(b{t}^{-1}\left(-57896044618658097711785492504343953926634992332820282019728792003956564819968\right)\right)=-2759059427988118751171810084898511378686014316692701054359369907483086960147280927951882360126722662694532184195188961972868362846993251059452650949901671319367766798082867991240470556883884697703956461351638357048853900901041484660324340895644666443265005903256012836852445804681126254511900366735734964733669895941180858016312738723323889399445549153589827729428344030855889173788530162921585833763126402235101742278829347244856084642318922816085087614501681686077533514611867514059722173305014390309928401467206469106291445839398509341691666859179675411964618424390430554443636579265243104320804846026367871304908$ ✗

${\omega }^{\prime }\left(b{t}^{-1}\left(0\right)\right)=-2759059427988118751171810084898511378686014316692701054359369907483086960147280927951882360126722662694532184195188961972868362846993251059452650949901671319367766798082867991240470556883884697703956461351638357048853900901041484660324340895644666443265005903256012836852445804681126254511900366735734964733669895941180858016312738723323889399445549153589827729428344030855889173788530006723373708055067099789360576929796082646862349311942652405749286232786918342552004669225258418843253640326096448289253136731298704242490729449215243542871131894631592779530197596871404848216460199788488703091507283562290563335372$ ✗

${\omega }^{\prime }(max\left(K_{\mathbb{Z}}\right))={\omega }^{\prime }\left(b{t}^{-1}(2^{255}-1)\right)={\omega }^{\prime }\left(b{t}^{-1}\left(57896044618658097711785492504343953926634992332820282019728792003956564819967\right)\right)=-2759059427988118751171810084898511378686014316692701054359369907483086960147280927951882360126722662694532184195188961972868362846993251059452650949901671319367766798082867991240470556883884697703956461351638357048853900901041484660324340895644666443265005903256012836852445804681126254511900366735734964733669895941180858016312738723323889399445549153589827729428344030855889173788529928053456826010797732931148708266188649268128062667982820997318012407518703320095839142577674334656016090153456430609387991000528750827675739987101346277277192829586323116398424407243253765328870573376665174028675811921052221718498$ ✗

6. Experimental Evaluation

To validate the practical viability of the proposed scheme, we conducted a series of experiments measuring computational performance, scalability, parameter sensitivity, and comparative efficiency. All experiments were run on a standard workstation using Python 3.12 with 256-bit user keys, 2048-bit objective keys, SHA-256 as the hash function, three salts of 10 bytes each, and four hash rounds, unless otherwise noted. Each measurement was repeated five times and we report mean ± standard deviation.

6.1. Computational Cost and Scalability

Table 2. Computational cost (ms) of the proposed scheme for varying numbers of users. Mean ± std over 5 runs. Key size: 256-bit, $k_{\oplus }$: 2048-bit, 4 hash rounds.

n	OTUK Gen	Poly Build	Poly Eval	Multi-Hash	Total
2	0.02 ± 0.02	0.00 ± 0.00	0.00 ± 0.00	0.004 ± 0.001	0.03 ± 0.02
3	0.01 ± 0.01	0.00 ± 0.00	0.00 ± 0.00	0.004 ± 0.000	0.02 ± 0.01
5	0.01 ± 0.00	0.01 ± 0.00	0.00 ± 0.00	0.004 ± 0.001	0.03 ± 0.01
8	0.02 ± 0.00	0.02 ± 0.00	0.00 ± 0.00	0.004 ± 0.000	0.05 ± 0.00
10	0.02 ± 0.00	0.03 ± 0.00	0.01 ± 0.00	0.004 ± 0.000	0.06 ± 0.00
15	0.03 ± 0.00	0.08 ± 0.01	0.01 ± 0.00	0.004 ± 0.000	0.13 ± 0.01
20	0.04 ± 0.00	0.18 ± 0.01	0.02 ± 0.00	0.004 ± 0.000	0.25 ± 0.01
30	0.09 ± 0.02	0.54 ± 0.01	0.04 ± 0.00	0.005 ± 0.000	0.67 ± 0.03

reports the computational cost of the four main phases: OTUK generation, polynomial construction, polynomial evaluation, and multi-hash computation. The total cost grows polynomially with n (number of users), as expected from the $O\left(n^2\right)$ polynomial construction via sequential root multiplication. Figure 3 shows these results.

For practical group sizes ($n\le 30$), the total key derivation time remains below 1 ms, making the scheme suitable for real-time applications. The polynomial construction phase dominates for larger n, scaling as $O\left(n^2\right)$ in coefficient-level operations over large integers. The OTUK generation scales linearly in n, while the multi-hash cost is constant and negligible.

6.2. Comparison with Shamir’s Secret Sharing

Table 3. Performance comparison (ms): Proposed scheme vs. Shamir’s Secret Sharing. Proposed scheme includes OTUK generation, polynomial build/eval, and multi-hash.

n	Proposed $(1,\mathit{n})$	Shamir $(1,\mathit{n})$	Shamir $(\mathit{n},\mathit{n})$
2	0.010	0.007	0.017
3	0.013	0.007	0.030
5	0.020	0.009	0.055
8	0.029	0.009	0.096
10	0.073	0.021	0.190
15	0.120	0.016	0.275
20	0.219	0.023	0.486
30	0.604	0.030	1.026

and Figure 4 compare the proposed scheme with Shamir’s Secret Sharing in two configurations: $(1,n)$ (trivial threshold, single share suffices) and $(n,n)$ (all shares required). Shamir’s scheme is implemented over $\mathrm{GF}(2^{521}-1)$ using Lagrange interpolation.

The proposed scheme is faster than Shamir’s $(n,n)$ reconstruction for all tested values of n, with the gap widening as n increases due to the $O\left(n^2\right)$ cost of Lagrange interpolation in Shamir’s scheme. Compared to Shamir’s trivial $(1,n)$ case (which requires only a single share lookup), the proposed scheme incurs a modest overhead due to polynomial evaluation and multi-hashing; however, this overhead provides the critical advantage of binding each share to a user-specific key through the OTUK mechanism, a feature absent in standard Shamir implementations.

6.3. Parameter Sensitivity

Figure 5 shows the effect of two key parameters on decryption time for $n=3$ users.

Hash rounds. Increasing the number of hash rounds from 1 to 32 has a minimal impact on total decryption time (sub-millisecond range), since SHA-256 computation is highly optimized. This parameter can therefore be tuned freely to increase brute-force resistance without measurable performance penalty.

Key size. Larger user key sizes increase the magnitude of the integers involved in polynomial arithmetic, leading to higher computation times. For 1024-bit keys the cost remains practical, but the growth is superlinear due to big-integer multiplication complexity. We recommend 256-bit user keys with 2048-bit objective keys as a balanced configuration.

6.4. Security Margin Analysis

We empirically evaluated the derivative-root distance attack described in Section 4. For each configuration, we generated 20 random instances and computed the minimum distance between a derivative root and the nearest valid OTUK value, expressed as the effective brute-force bit strength.

Table 4. Security margin analysis: effective brute-force bits from derivative-root distance (mean, min, max over 20 trials). 256-bit user keys.

n	Mean (bits)	Min (bits)	Max (bits)
2	254.4	251.8	255.6
3	251.9	248.8	254.3
5	251.1	247.6	253.2
8	248.7	244.8	251.7
10	249.3	243.9	250.5
15	247.8	244.0	249.6
20	246.5	243.0	248.2
30	245.9	243.1	248.0

and Figure 6 show that the effective security margin remains consistently above 245 bits for all tested configurations up to $n=30$, well above the 128-bit security level widely considered sufficient for modern cryptographic applications. The margin decreases slowly with n, as more roots compress the gaps between OTUK values; however, even for $n=30$ the attacker gains fewer than 11 bits of advantage over a direct 256-bit brute-force attack, an advantage that is more than offset by the computational overhead of polynomial evaluation and multi-hashing at each trial.

6.5. Application Scenarios

The proposed scheme is particularly suited to the following application domains:

Internet of Things (IoT). In IoT environments, resource-constrained devices must share encrypted channels with a central gateway or among peer devices. The sub-millisecond key derivation time (Table 2) and the absence of interactive key-exchange protocols make the scheme viable for devices with limited computational budgets. Each device stores only its user key and the public polynomial coefficients; the OTUK mechanism prevents key reuse across channels.

Public Administration and e-Government. The European Union’s regulatory framework [3] requires that government entities be able to access encrypted communications under lawful interception mandates. The proposed $(1,n)$ threshold model naturally accommodates this by including a government entity as one of the authorized users, without introducing backdoors or weakening the cryptographic guarantees for other participants. The polynomial structure ensures that each user, including the government entity, accesses the channel independently through its own key.

e-Health. In healthcare data sharing, multiple actors (physicians, laboratories, insurers, patients) require access to encrypted medical records with different levels of responsibility. The group extension of the OTUK model (Section 4.4) allows defining access policies where, for instance, a consultation requires both a physician and a patient to jointly constitute one “user” of the $(1,n)$ threshold, while the hospital system constitutes another.

Secure Group Messaging. Modern messaging platforms require efficient group key management. The proposed scheme allows a group creator to generate a polynomial-based channel where each participant derives the decryption key from their individual credentials, eliminating the need for pairwise key exchanges or centralized key distribution servers.

7. Conclusions

In this paper, we have presented a polynomial-based implementation of the $\omega$ function for multi-user encryption under the One-Time User Key model, realizing a $(1,n)$ threshold secret-sharing scheme where the secret is replicated at specific points on a polynomial’s ordinate axis.

The main contributions of this revised work are: (i) a formal threat model and precise security assumptions grounding the analysis; (ii) pseudocode descriptions of the channel generation, OTUK generation, and decryption algorithms for reproducibility; (iii) a comprehensive experimental evaluation demonstrating sub-millisecond key derivation for up to 30 users, favorable comparison with Shamir’s Secret Sharing, and parameter sensitivity analysis; (iv) a quantitative security margin analysis showing that the derivative-root attack provides fewer than 11 bits of advantage over direct brute force for 256-bit keys with up to 30 users; and (v) a discussion of concrete application scenarios in IoT, public administration, e-health, and group messaging.

The analysis of numerical domains $\mathbb{N}$, $\mathbb{Z}$, and $\mathbb{R}$ confirms that $\mathbb{Z}$ (two’s complement) provides the best trade-off between implementation simplicity and numerical stability. The value-size problem is resolved by choosing an objective key significantly larger than the user key space and applying multi-hashing to derive the real key.

Limitations of the current work include the absence of a formal proof of indistinguishability under chosen-plaintext attack (IND-CPA) for the overall construction, and reliance on assumed uniform distribution of hash outputs for security margin guarantees. Future work will address these limitations through a reduction-based security proof, investigate the post-quantum resistance of the scheme, and extend the experimental evaluation to embedded platforms representative of IoT deployments.

This work fills a gap in the current literature by formalizing the $(1,n)$ threshold secret-sharing model in the context of multi-user encrypted channels, where each share is inherently tied to user-specific cryptographic material. The proposed mechanism offers a concrete, efficient, and secure basis for multi-user communication systems.