Space-Efficient Secret Sharing Based on Matrix Normal Forms

Abstract

Secret sharing schemes distribute a secret among participants so that only authorised subsets can reconstruct it. In this paper, we focus on space-efficient secret sharing and show that matrix normal forms can significantly reduce share sizes while achieving computational security properties. Our scheme is implemented within an online secret sharing architecture, where authenticated public data P is maintained and shares of private data Q are issued over a secure channel. We study an existing probabilistic matrix-based approach to share size reduction and prove that the expected number of iterations of the underlying cyclic vector algorithm is small, yielding an expected polynomial runtime. We then design a novel deterministic method based on the Frobenius canonical normal form, avoiding reliance on cyclic vector techniques, and derive its runtime complexity. This yields a space-efficient secret sharing scheme that is computationally secure under a suitably defined adversary model. We have implemented our algorithm in the computer algebra system Maple as an Open Source project and provide an evaluation of its performance. Our results demonstrate that matrix normal forms can provide a suitable mathematical framework for secure and practical secret sharing.

1. Introduction

Secret sharing is a popular cryptographic technique used to protect data (the secret) by splitting it into multiple parts (the shares) and distributing these shares among different parties (the shareholders). Once the shares are distributed, the original data can be deleted. A crucial aspect of this method is that possessing a single share provides no information about the secret. A $(k,n)$ perfect secret sharing scheme is designed to meet the following criteria: The secret is divided into n shares, and any group of k or more shareholders can fully reconstruct the secret. However, any group with fewer than k shareholders cannot obtain any information about the secret [1]. By design, secret sharing can address confidentiality, integrity and availability in various modern security application scenarios. For example, it can protect highly sensitive keys, such as the Certificate Authority root private key. In this scenario, the private key can be split into multiple shares and distributed to several trusted parties. To reconstruct the key, a minimum number of shares must be combined. This ensures that no single entity can compromise the key, enhancing security. For instance, to perform a critical operation such as issuing a new certificate, representatives from different departments must collaborate, ensuring that no single person has full control [2]. Secret sharing is also valuable in emerging areas such as Blockchain and Artificial Intelligence (AI) security. In blockchains, similar techniques can be applied to secure private keys for multi-signature wallets, where multiple parties must collaborate to authorise transactions, thereby reducing the risk of a single point of failure [3]. In AI, secret sharing can protect sensitive training data by distributing it across different servers, ensuring no single server can access the complete dataset. Thus, it can preserve privacy while still allowing collaborative model training [4].

A central practical requirement in secret sharing is to reduce share size, since both storage and communication costs grow with the number of participants. This motivates space-efficient secret sharing, including computational secret sharing approaches such as Krawczyk’s method [5], which builds on Rabin’s information dispersal algorithm [6], as well as the space-efficient scheme of Parakh and Kak [7]. Such reduced share size constructions can naturally be organised within techniques originating from online secret sharing [8], in which secrets are dynamically generated, distributed, and reconstructed over a network in real time. Unlike traditional secret sharing, which typically involves offline distribution, online secret sharing enables flexible, on-demand management of secrets. In addition to the security and reliability properties common to ordinary secret sharing schemes, online secret sharing supports real-time collaboration due to its dynamic nature. Various types of online secret sharing methods, characterised by distinct properties, have been presented in the literature [8,9,10,11]. The fundamental principle in online secret sharing is its reliance on two types of data: public data P, which must be authenticated and available to all participants, and confidential data Q, from which the individual shares are generated and distributed to the shareholders. In a space-efficient online secret sharing scheme, the objective is to keep the confidential data Q substantially smaller than the public data P.

Inspired by the small but mathematically rich body of matrix-based secret sharing work [12,13,14,15,16], this paper extends our research on efficient online secret sharing approaches based on matrix normal forms. Although this is a relatively niche strand of the secret sharing literature, it is particularly interesting because it brings linear-algebraic ideas such as similarity transformations and normal forms directly into the design of short-share schemes. We propose a space-efficient online secret sharing scheme based on matrix similarity transformations. This extends our previous work, a probabilistic algorithm for secret matrix share size reduction [16], referred to as the Matrix Share Size Reduction (MSSR) technique. In the online secret sharing setting described above, this algorithm splits a given secret s into public data P and private data Q. The public data P has the same size as the original secret, $\left|P\right|=\left|s\right|$, where $\left|s\right|$ denotes the size of the original secret s, while the expected size of the private data is $\left|Q\right|=\Theta \left(\sqrt{\left|s\right|}\right)$. The public data P is shared openly, and standard secret sharing methods are then applied to distribute the private data Q securely.

In this paper, we improve previous matrix-based approaches in the following aspects:

• We prove that the expected number of iterations l of the probabilistic algorithm is small, specifically, $l<3$. This yields a probabilistic online secret sharing scheme that, on average, terminates quickly. Our findings are consistent with the experimental results reported in our previous paper, thereby providing theoretical validation of these.
• We then introduce a novel deterministic approach to matrix secret sharing reduction, using the Frobenius canonical normal form, also known as the rational canonical form. Unlike the cyclic vector form, the Frobenius form is guaranteed to exist for any matrix, avoiding a probabilistic algorithm. Our deterministic algorithm runs in time $O\left(t^3\right)$, where $t=\sqrt{\left|s\right|}$.
• To address the security of the scheme, we drop the space-efficient method of [7] used in our previous paper, in view of the vulnerabilities reported in [17]. If one instead accepts share size $\Theta \left(\sqrt{\left|s\right|}\right)$ and works under a suitably defined adversary model, then we show how to obtain computational security by combining the matrix reduction with a random rank-one matrix mask and a perfect secret sharing scheme such as Shamir’s method [1].
• Finally, by working with companion matrix and Frobenius forms, our approach avoids the Jordan normal form used in earlier matrix-based schemes such as [12,13]. This yields a rational algorithm, where all matrix calculations are carried out over the base field without the need to consider field extensions. This makes the algorithm simpler and more efficient in practice.

The remainder of this paper is organised as follows. Section 2 reviews the background and related work on space-efficient, online, and matrix-based secret sharing. Section 3 presents the probabilistic Matrix Share Size Reduction algorithm together with its theoretical runtime analysis. Section 4 introduces the deterministic secret sharing algorithm based on the Frobenius normal form and its security analysis. Section 5 describes the implementation and evaluates the performance of both approaches, while Section 6 concludes the paper. A technical result required for the theoretical analysis of the probabilistic runtime is given in the Appendix A.

The following notations are used throughout the paper: the secret is denoted by s, with $\left|s\right|$ being its size, p being a prime, and ${\mathbb{F}}_p$ being the finite field with p elements. The matrix dimension is written as t, typically of order $\sqrt{\left|s\right|}$. Matrices are denoted by symbols such as A, S, C, and F, while T, V, and W denote invertible transformation matrices in ${\mathrm{GL}}_t\left({\mathbb{F}}_p\right)$ inducing similarity transformations written as expressions such as $C=T^{-1}ST$ and $F=W^{-1}AW$. We write P and Q for the public and private parts of the scheme, respectively; f for characteristic polynomial or invariant factor data; g for the masking vector in the deterministic enhanced construction; and, in threshold settings, n for the number of participants and k for the combining threshold. A small number of additional symbols are used in the literature review section solely for the purposes of illustrating some specific, closely related schemes.

2. Background and Related Work

The secret sharing techniques most relevant to the work presented in this paper are space-efficient secret sharing, online secret sharing, and matrix-based secret sharing. Space-efficient secret sharing is the main research area addressed in this paper; online secret sharing provides the split into public and private data approach used by our method, without being directly improved in general; and matrix-based secret sharing provides the methodology, realised through matrix normal forms. The following sections briefly review the most important papers in these areas and then focus more in detail on the matrix-based approach.

2.1. Space-Efficient Secret Sharing

In a perfect secret sharing scheme, the size of the shares must be at least as large as the size of the secret. We call a scheme space-efficient if each share is strictly shorter than the secret, often by a constant factor. Such schemes are particularly attractive in cryptographic applications where storage or communication overhead is a practical constraint.

Krawczyk [5] introduced a seminal secret sharing method with short shares, improving the bound on share size by using Rabin’s information dispersal algorithm [6]. The size of the shares in these schemes is nearly minimal, consisting of the minimal bound plus a piece of information whose length depends only on the security parameter, not the secret size. Parakh and Kak’s space-efficient scheme [7] also reduces share size. More recently, the related notion of succinct computational secret sharing has been studied for general access structures, showing that share size reduction remains an active research direction [18].

Allowing the shares to be smaller than the secret itself requires resorting to the notion of computational security, which holds against polynomial-time adversaries and is widely accepted in the literature. The notion of computational secret sharing (CSS) was introduced by Krawczyk [5]; schemes based on this model trade information-theoretic guarantees for compact storage. This security distinction is important: the security properties of Parakh and Kak’s construction are unclear, and subsequent analyses report vulnerabilities and attacks on this scheme [17].

2.2. Online Secret Sharing

Online secret sharing as introduced in [8] allows for dynamically adding participants and sharing multiple secrets securely with a publicly accessible location. Various improvements and extensions address multi-secret sharing [9], provable security [10], the general online model [11], further multi-secret variants [19], efficient hash-based updates [20], verification and cheater detection [21], and evolving participant sets [22]. We do not provide a more in-depth exploration of these methods, as  the only aspect relevant for our work is the division of the shared information into public data and confidential data. This split usually supports the online setting by allowing changes such as adding participants to be handled through public information, while the confidential component remains tied to the underlying sharing scheme. In the terminology used throughout this paper, the public data P may be stored openly or made available through a public location, while the confidential data Q is distributed to the shareholders using an underlying secret sharing method. The goal of our construction is not to improve the general online model, but to exploit this split for a space-efficient scheme. Using matrix normal form techniques, we keep the private component Q small.

2.3. Matrix-Based Secret Sharing

Before reviewing individual papers, let us remark that one needs to distinguish two major lines of research on matrix-based secret sharing: with the use of matrix normal forms, or without. The papers by Yang and Liu [12] and Zhao et al. [13] use matrix normal forms as their main mathematical framework, together with a separation of the shared data into a public part and a private part. This is also the underlying principle of our work. By contrast, the papers by Bai [14] and Wang et al. [15] use matrix-based secret sharing with projection-based constructions. Furthermore, with the exception of our earlier paper [16], which will be discussed in more detail below, none of the more recent work appears to continue the investigation of matrix normal forms for the purposes of space-efficient secret sharing.

The canonical Jordan normal form significantly shortens shares in the paper by Yang and Liu [12]. To implement an online $(k,n)$ threshold scheme, the secret s is divided into $t^2$ chunks of the same size, then placed into a matrix A according to some scheme. A similarity transformation T is computed, such that $J=T^{-1}AT$ is in Jordan normal form. This similarity transformation could be viewed as a generalised Hill cipher [23] applied to the plaintext matrix A, using T as the key. This key T is then further protected by encrypting it using a transposition cipher $E_K$ with key K. Here, K is a sequence of t integers corresponding to a permutation of columns of T. The public data are then the protected matrix key $E_K\left(T\right)$ and J; the secret part is the key K. The threshold scheme uses k instances of a perfect secret sharing scheme, such as Shamir’s method, to share K among n users. To reconstruct the secret, a coalition of t players combines their shares to recover K. From this, they can deduce T and $A=TJ{T}^{-1}$, and finally s. This shows the scheme’s correctness. The size of the shares in this scheme is $k(\lfloor {log}_{2}k\rfloor +1)$. As a space-efficient secret sharing method, the emphasis is on share size rather than security.

As a second key paper, Zhao et al. [13] study space-efficient secret sharing, focusing on a $(k,n)$-threshold scheme implementing general access and adversary structures. In terms of matrix operations, they use the Jordan normal form by using the similarity relation $J=T^{-1}AT$, so that reconstruction can recover the secret matrix via $A=TJ{T}^{-1}$, where the matrix J is publicly available, and T can be reconstructed from the individual shares, respecting the requirements of the adversary structure. They formalise a participant universe U with $\left|U\right|=n$, the threshold family ${\Gamma }_k=\{X\subseteq U:|X|\ge k\}$, and an adversary structure $\mathcal{A}\subseteq 2^U$, and then require an access structure $\Gamma$ satisfying ${\Gamma }_k\subseteq \Gamma$ and $\Gamma \cap \mathcal{A}=⌀$. The secret sharing scheme allows reconstruction for coalitions $X\in \Gamma$ and secrecy against $Y\in \mathcal{A}$, while the short-share objective is to keep each share length $|q_i|$ below the secret length $\left|s\right|m$, equivalently to achieve a storage ratio $\rho ={max}_i|q_i|/|s|<m$, where m is the number of adversary sets. This provides a mathematically rich framework for combining the challenging requirements of short shares and general adversary structures.

Bai [14] introduces a matrix-projection-based multiple-secret sharing scheme that is a strong ramp scheme. The construction embeds multiple secrets into a secret matrix over ${\mathbb{F}}_p$ and generates a random $m\times k$ matrix A ($m>2(k-1)-1$). It defines the projection matrix $P=A{\left(A^{\prime }A\right)}^{-1}{A}^{\prime }$ modulo p, which is symmetric and idempotent with $\mathrm{tr}\left(P\right)\equiv k(modp)$. Each share is a column vector $v_i=A{x}_i$, where the $x_i$ are linearly independent vectors. Using the invariance of projection, any k shares form a matrix B whose projection equals P. The dealer publishes the remainder matrix $R=(M-P)modp$, where M is the secret matrix; reconstruction computes P from k shares and recovers $M=(R+P)modp$. Because each share is a single length-m vector, the share size is $1/m$ of the secret matrix, but there is no perfect security: fewer than k shares leak partial information about M [24].

Wang, Zou, and Sui [15] extend the matrix-projection approach to multiple secrets with more flexible packing. They point out that Bai’s scheme arranges secrets in a square matrix, so the number of secrets must be a perfect square or padded with dummy secrets. Their scheme removes this restriction by using all matrix entries and claims security comparable to Bai’s construction. They further show how to incorporate proactive share updates, which enlarges the admissible threshold range, and they reduce the share size to a constant equal to a single secret. The scheme remains partially verifiable via properties of projection matrices and includes a brief classification of related secret sharing schemes.

As already mentioned, more recent follow-up work shows that general matrix-based research remains active without focusing on normal form computation. Bai and Zou’s proactive variant refines the share-refreshing property in the projection setting [25], whereas later constructions combine adversary-structure constraints with verifiability for multi-secret sharing [26]. More recent studies apply matrix-based designs to image-oriented settings, including implementations based directly on matrix operations [27] and reversible–authenticable visual secret sharing [28]. Hybrid schemes that combine matrix secret sharing with other cryptographic primitives, such as steganography, further broaden this direction and indicate ongoing practical interest beyond the original threshold-only formulations [29].

2.4. Comparative Discussion

This section compares and contrasts the papers reviewed in the previous section in greater depth. This is presented first through a comparative table of their different characteristics and features, and then through diagrams that illustrate the repartition of data in the closest related schemes.

For ease of comparison,

Table 1. Comparison of closely related matrix-based secret sharing schemes discussed in Section 2.3, together with the proposed scheme.

Source	Matrix Form	Rational?	Det.?	Public	Share	Security	Features
[12]	Jordan	No	Yes	$O\left(k\right(\left|s\right| + a + klogk\left)\right)$	$O(klogk)$	Unclear	Standard
[13]	Jordan	No	Yes	$O\left(\right|s\left|\right)$	$O\left(\right(\left|s\right| + \left|a\right|)(k + m)/k^2)$	Not stated	Access/adversary structure; verifiable
[14]	None	Yes	Yes	$O\left(\right|s\left|\right)$	$O\left(\sqrt{\left|s\right|}\right)$	Ramp	Standard
[25]	None	Yes	Yes	$O\left(\right|s\left|\right)$	$O\left(\sqrt{\left|s\right|}\right)$	Ramp	Proactive
[16]	Cyclic	Yes	No	$O\left(\right|s\left|\right)$	$O\left(\sqrt{\left|s\right|}\right)$	Computational	Standard
This paper	Frobenius	Yes	Yes	$O\left(\right|s\left|\right)$	$O\left(\sqrt{\left|s\right|}\right)$	Computational	Standard

summarises the main structural properties of the most relevant matrix-based secret sharing papers discussed above, highlighting their matrix forms, algebraic setting, share size behaviour, claimed security properties, and additional scheme features. The rows follow the order in which the schemes were reviewed, and the final row positions the present paper relative to this literature.

By reviewing Table 1, one can see more clearly the main contributions of the present paper in relation to the earlier schemes. In particular, our approach combines the use of matrix normal forms with the advantage that no field extension is required, since the Frobenius canonical form is defined over the base field. At the same time, it preserves a small share size of expected order $\Theta \left(\sqrt{\left|s\right|}\right)$.

Figure 1 illustrates the Yang–Liu and the Zhao et al. constructions, making their respective public and private splits easier to compare.

Figure 2 explains our earlier probabilistic MSSR scheme [16]. As in the Yang–Liu scheme, the construction separates openly published data from confidential data, but here, the similarity transformation matrix is public, whereas the characteristic polynomial information extracted from the normal form is kept private.

3. Probabilistic Matrix Share Size Reduction Algorithm

This section recalls the Matrix Share Size Reduction (MSSR) algorithm, the fundamental algorithmic building block introduced in our previous paper [16]. It then explains how this can be used to construct a probabilistic online secret sharing scheme based on matrix similarity transformations. As a novel contribution, we conduct a thorough performance analysis of the algorithm and prove that it is expected to terminate in fewer than three iterations. The section begins with linear algebra concepts that underlie the algorithms discussed.

3.1. Cyclic Vectors

Although the properties discussed in this section are valid for matrices over any field, we will focus on ${\mathbb{F}}_p$, the field of characteristic p. Let $A\in {\mathbb{F}}_p^{t\times t}$ for $t\ge 2$. The matrix A is said to be cyclic if and only if there exists $T\in {\mathrm{GL}}_t\left({\mathbb{F}}_p\right)$ such that $C=T^{-1}AT$ is in companion form, i.e., a matrix of the form

$$C=\left(\begin{array}{ccccc}0& 1& 0& \cdots & 0\\ 0& 0& 1& \ddots & ⋮\\ ⋮& ⋮& \ddots & \ddots & 0\\ 0& 0& \cdots & 0& 1\\ c_0& c_1& \cdots & c_{t-2}& c_{t-1}\end{array}\right).$$

It can be seen that the characteristic polynomial of A is then

$$f\left(\lambda \right)=det(A-\lambda I)=det(C-\lambda I)={\lambda }^t-c_{t-1}{\lambda }^{t-1}-\cdots -c_1\lambda -c_0.$$

For a cyclic matrix, we have that $f\left(\lambda \right)=m\left(\lambda \right)$, where $m\left(\lambda \right)$ is the minimal polynomial of A.

If A is cyclic, we can use standard linear algebra techniques to compute C with an algorithm based on a vector $v_0\in {\mathbb{F}}_p^t$ chosen at random. The algorithm successively calculates

$$v_i:=A{v}_{i-1}(i=1\dots t-1)$$

and if the vectors $v_i$ are linearly independent, we have found a cyclic basis

$$\mathcal{B}=\{v_0,\dots ,v_{t-1}\}$$

and $v_0$ is called a cyclic vector. Forming the matrix V with the vectors $v_i$ as columns, it then holds that V is non-singular, and 

$$C=VA{V}^{-1}$$

(1)

is a matrix in companion form. Otherwise, if V is not invertible, we choose another random vector $v_0$ and repeat the process.

Note that for a given cyclic matrix A, cyclic vectors and hence the matrix V are not unique. On the other hand, the matrix C in companion form given in Equation (1) is unique.

3.2. The MSSR Algorithm

As introduced in [16], the cyclic vector approach can be used to implement a probabilistic algorithm that splits a given secret $s\in \mathbb{Z}$ into a (matrix) public part $P\in {\mathbb{Z}}_p^{t\times t}$ and a shorter (vector) secret part $Q\in {\mathbb{Z}}_p^t$ with a prime p chosen suitably. Here, t is derived from the base-p length of s as $t=⌈\sqrt{{log}_{p}s}⌉$.

The algorithm can be summarised in the following high-level description; for a more detailed technical presentation, we refer to [16].

• Algorithm MSSR

• The algorithm starts with the prime number $p=2$ and performs a conversion of s into a square matrix $S\in {\mathbb{F}}_p^{t\times t}$, based on computing the base-p digits of s and padding with zeros if necessary.
• As the next step, the algorithm attempts to compute a cyclic vector v of the matrix S in the size reduction step, following the steps outlined in the previous section.
• If successful, a similarity transformation $V\in GL\left({\mathbb{F}}_p^{t\times t}\right)$ is constructed such that $C=V^{-1}SV$ is a companion matrix. Otherwise, it carries out a secret conversion to the next prime number and returns to the previous step.
• Finally, the algorithm sets the public part P to be the transformation matrix V and the secret part Q to be the list $[c_0,c_1,\dots ,c_{t-1},p]$, where $c_i$ are the coefficients of the characteristic polynomial f of S read from the bottom-row entries of the companion matrix C and p is the prime that was last used in the matrix conversion process.

The runtime of this algorithm is $O\left(l{t}^3\right)$, where l is the number of iterations required for computing a cyclic vector in Steps 2 and 3. This follows from the fact that constructing V uses t repeated matrix–vector multiplications, each requiring $O\left(t^2\right)$ time, matrix multiplications, and one matrix inversion.

3.3. Algorithm Performance Analysis

In [16], we have shown that the probability of finding a cyclic vector for a random secret matrix $S\in {\mathbb{F}}_p^{n\times n}$, using a prime number p, is relatively high. In this section, we improve this result and give tight bounds for the expected number of iterations needed when using a sequence of increasing prime numbers.

Lemma 1.

The probability that Algorithm MSSR successfully computes a companion matrix for a secret matrix S and a given prime p can be bounded by

$$1-p^{-1}-p^{-2}<{\mathit{Prob}[\mathit{companion}}_p]<1-p^{-1}.$$

Proof. 

This follows directly by revisiting the proofs of Lemma 4.1 and 4.2 in [16], and using the estimate

$$1-p^{-1}-p^{-2}<(1-p^{-1})(1-p^{-2})\cdots (1-p^{-t})<1-p^{-1}$$

which is given in ([30], Lemma 3.5).    □

We define the random variable $X\left(l\right)$ as the probability that the MSSR Algorithm finishes after exactly l iterations. We have

$$X\left(l\right)=\mathrm{Prob}\left[{\mathrm{companion}}_{pl}\right]\prod _{i=1}^{l-1}(1-\mathrm{Prob}\left[{\mathrm{companion}}_{pi}\right])$$

and using Lemma 1 we find the estimate

$$(1-p_l^{-1}-p_l^{-2})·\prod _{i=1}^{l-1}{p}_i^{-1}<X\left(l\right)<(1-p_l^{-1})·\prod _{i=1}^{l-1}\left(p_i^{-1}+p_i^{-2}\right).$$

(2)

The desired average number of iterations is the expected value of $X\left(l\right)$:

$$E\left[X\right]=\sum _{l=1}^{\infty }lX\left(l\right).$$

We require a technical lemma to find an upper and lower bound for $E\left[X\right]$.

Lemma 2.

Let $E_m$ denote the series

$$E_m=\sum _{l=m}^{\infty }lX\left(l\right).$$

Then, for $m\ge 4$, it holds that

$${\displaystyle \frac{(1-p_m^{-1}-p_m^{-2})m(p_m+1)}{p_1{p}_2\cdots p_m}}<E_m<{\displaystyle \frac{1}{{\left(p_{m-1}\right)}^{m-1}}}{\displaystyle \frac{m{p}_{m-1}+1-m}{{(p_{m-1}-1)}^2}}.$$

Proof. 

Let us start with computing the lower bound for $E_m$. According to Equation (2), we have

$$E_m>\sum _{l=m}^{\infty }l(1-p_l^{-1}-p_l^{-2})\prod _{i=1}^{l-1}{p}_i^{-1}>(1-p_m^{-1}-p_m^{-2})\sum _{l=m}^{\infty }l\prod _{i=1}^{l-1}{p}_i^{-1}.$$

(3)

Let us focus on the second factor in the above expression containing the infinite series. We rewrite this as

$$\sum _{l=m}^{\infty }l\prod _{i=1}^{l-1}{p}_i^{-1}={\displaystyle \frac{m}{p_1\cdots p_{m-1}}}\left(1+\sum _{l=m}^{\infty }{\displaystyle \frac{l+1}{m{p}_m\cdots p_l}}\right).$$

(4)

Using

$$\sum _{l=m}^{\infty }{\displaystyle \frac{l+1}{m{p}_m\cdots p_l}}>\sum _{l=m}^{\infty }{\displaystyle \frac{1}{p_m\cdots p_l}}>{\displaystyle \frac{1}{p_m}},$$

we find from Equations (3) and (4)

$$E_m>{\displaystyle \frac{(1-p_m^{-1}-p_m^{-2})m(p_m+1)}{p_1\cdots p_m}}.$$

We now turn to the upper bound estimate for $E_m$. Using the right-hand side of Equation (2), we have that

$$E_m<\sum _{l=m}^{\infty }l(1-p_l^{-1})\prod _{i=1}^{l-1}(p_i+1)p_i^{-2}.$$

(5)

First, we shall find an estimate for the product term in Equation (5). We have $p_i+1<p_{i+1}$ and hence,

$$\prod _{i=1}^{l-1}(p_i+1)p_i^{-2}<\prod _{i=1}^{l-1}{p}_{i+1}{p}_i^{-2}={\displaystyle \frac{p_l}{p_1^2{p}_2\cdots p_{l-1}}}.$$

(6)

To further estimate this product, we require a result from number theory, Bertrand’s Postulate ([31], Chapter 22). Despite its name, this result is a theorem stating that if $n>1$, there is a prime between n and $2n$. We shall use it in the form $p_l<2p_{l-1}$ for $l>1$. Applying this to the product in Equation (6), we find

$${\displaystyle \frac{p_l}{p_1^2{p}_2\cdots p_{l-1}}}<{\displaystyle \frac{2p_{l-1}}{p_1^2{p}_2\cdots p_{l-1}}}={\displaystyle \frac{1}{p_1{p}_2\cdots p_{l-2}}}$$

since $p_1=2$. Furthermore,

$$\begin{array}{cc}\hfill E_m& <\sum _{l=m}^{\infty }{\displaystyle \frac{l(1-p_l^{-1})}{p_1\cdots p_{l-2}}}<\sum _{l=m}^{\infty }{\displaystyle \frac{l}{p_1\cdots p_{l-2}}}<{\displaystyle \frac{1}{p_1\cdots p_{m-2}}}\sum _{l=m}^{\infty }{\displaystyle \frac{l}{{\left(p_{l-1}\right)}^{l-m}}}\hfill \\ \hfill & <{\displaystyle \frac{1}{p_1\cdots p_{m-2}}}\sum _{l=m}^{\infty }{\displaystyle \frac{l}{{\left(p_{m-1}\right)}^{l-m}}}={\displaystyle \frac{{\left(p_{m-1}\right)}^m}{p_1\cdots p_{m-2}}}\sum _{l=m}^{\infty }{\displaystyle \frac{l}{{\left(p_{m-1}\right)}^l}}\hfill \end{array}$$

where, due to the assumption $m\ge 4$, all products of prime numbers in the above expressions are non-trivial, i.e., have at least two factors. The last sum is an arithmetico-geometric series, which can be calculated explicitly, as shown in Appendix A. This yields

$$E_m<{\displaystyle \frac{1}{{\left(p_{m-1}\right)}^{m-1}}}{\displaystyle \frac{m{p}_{m-1}+1-m}{{(p_{m-1}-1)}^2}}$$

which concludes the proof of the lemma.    □

Theorem 1.

The expected number of iterations E[X] that the algorithm MSSR uses satisfies

$$1.32<E\left[x\right]<2.36.$$

Proof. 

By explicit calculation, using Lemma 1, we find that

$$1.3185<\sum _{l=1}^{5}lX\left(l\right)<2.3593.$$

Furthermore, by using Lemma 2,

$$E_6<3.{710}^{-6}$$

and

$$E_6>2.{510}^{-3};$$

hence, the result is immediate.    □

These results lead to the following space and cost analysis, improving on the preliminary analysis in [16]:

Theorem 2.

Algorithm MSSR is a probabilistic Monte Carlo algorithm with an expected run time of less than three iterations and exponential worst-case run time as a function of the size of the input s. The expected runtime complexity of the algorithm is $O\left(t^3\right)$, where $t=\sqrt{\left|s\right|}$.

Proof. 

The worst-case runtime analysis statement was already proven in [16]. The expected runtime follows from Theorem 1 above, which shows that the expected number of iterations is small. Consequently, the expected size of p will be small, and the expected size of the private data is then $\left|Q\right|=\left|f\right|=\Theta \left(\sqrt{\left|s\right|}\right)$.    □

These conclusions also show that the share size reduction mechanism proposed in [16] remains valid, and the sharper estimate for $E\left[X\right]$ slightly strengthens the corresponding performance guarantees. From a security perspective, however, that earlier space-efficient construction is less satisfactory, because the public transformation matrix T may exhibit reduced min-entropy and thus offer a smaller effective search space than intended. This observation motivates the protected variant studied in the present paper.

4. A Deterministic Secret Sharing Algorithm

This section introduces a novel deterministic MSSR technique, extends it to a deterministic matrix-based space-efficient secret sharing scheme, and evaluates its security.

4.1. Deterministic MSSR

The method utilises the Frobenius canonical normal form, also known as the rational canonical form, which provides a complete classification of matrices up to similarity. As the Frobenius form exists for any matrix, it yields a deterministic method for the MSSR process.

The Frobenius normal form is a block-diagonal matrix:

$$F=\left(\begin{array}{cccc}{C}_1& 0& \cdots & 0\\ 0& C_2& \cdots & 0\\ ⋮& ⋮& \ddots & ⋮\\ 0& 0& \cdots & C_r\end{array}\right)$$

where each $C_i$ is a companion matrix associated with an invariant factor $f_i\left(x\right)\in {\mathbb{F}}_p\left[x\right]$ for $i=1,\cdots ,r$. The invariant factors satisfy $f_1\left(x\right)\mid f_2\left(x\right)\mid \dots \mid f_r\left(x\right)$, and the largest invariant factor is the characteristic polynomial $f\left(x\right)$ of the original matrix. Each companion matrix $C_i$ is given by

$$C_i=\left(\begin{array}{ccccc}0& 1& 0& \cdots & 0\\ 0& 0& 1& \cdots & 0\\ ⋮& ⋮& ⋮& \ddots & 0\\ 0& 0& 0& \cdots & 1\\ c_{i,0}& c_{i,1}& c_{i,2}& \cdots & c_{i,t_i-1}\end{array}\right)\in {\mathbb{F}}_p^{t_i\times t_i}$$

where

$$f_i\left(x\right)=x^{t_i}-c_{i,t_i-1}{x}^{t_i-1}-\cdots -c_{i,0}.$$

The deterministic MSSR algorithm is obtained by a direct application of any algorithm computing a similarity transformation $T\in {\mathrm{GL}}_n\left({\mathbb{F}}_p\right)$ such that

$$F=T^{-1}ST$$

(7)

is a matrix in Frobenius form. The public part is $P=T$, and the secret part is obtained from the individual blocks $C_i$ ($i=1,\dots ,r$) in F as the nested list

$$Q=[[c_{1,0},c_{1,1},\dots ,c_{1,t_1-1}],\dots ,[c_{r,0},c_{r,1},\dots ,c_{r,t_r-1}],p].$$

The above considerations lead to the following theorem.

Theorem 3.

There exists a deterministic algorithm based on computing Frobenius canonical normal forms that reduces the share size as in the probabilistic MSSR algorithm, with a runtime complexity of $O\left(t^3\right)$, where $t=\sqrt{\left|s\right|}$.

Proof. 

Reference [32] gives a deterministic algorithm for computing the Frobenius canonical form using standard linear algebra routines over ${\mathbb{F}}_p$, with runtime $O\left(t^3\right)$ field operations. Applying this algorithm to the secret matrix gives the required similarity transformation and normal form data, so the deterministic MSSR step has overall complexity $O\left(t^3\right)$.    □

There are two practical advantages of the deterministic approach. First, it avoids the cyclic vector method, which does not always exist and therefore leads to a probabilistic algorithm. Second, because the Frobenius normal form is rational, all computations remain in the base field. This improves on the schemes reviewed in the literature review [12,13], where field extensions may have to be considered.

4.2. Deterministic Space-Efficient Scheme

The deterministic MSSR step naturally extends to the online secret sharing architecture studied throughout this paper. Starting from the secret matrix $S\in {\mathbb{F}}_p^{t\times t}$, we compute a similarity transformation T as in Equation (7) and extract f, which represents the concatenated invariant factor coefficients. To additionally protect the transformation matrix, the dealer creates a random vector $g\in {\mathbb{F}}_p^t$ and forms the rank-one mask $g{g}^{\top }$. The public data are then defined as

$$P=T+g{g}^{\top }$$

where addition is in ${\mathbb{F}}_p$, while the private payload becomes

$$Q=f\parallel g.$$

In the implementation, P is kept as authenticated public data, and Q is distributed using a standard secret sharing scheme. The scheme is illustrated in Figure 3.

Reconstruction of the secret proceeds as follows: an authorised coalition first recovers Q, splits it into g and f, reconstructs the Frobenius normal form data F from f, and then removes the mask from the public matrix by computing $T=P+g{g}^{\top }$ over ${\mathbb{F}}_p$. One reconstructs the secret matrix as $S=TF{T}^{-1}$ and finally converts S back to the original secret. The additional vector g increases the private payload only by $O\left(t\right)$ entries, so the asymptotic share size advantage remains unchanged.

4.3. Security Analysis

This section studies the security of the proposed deterministic secret sharing scheme. It will be shown to be computationally secure under an adversary model in which the public data P are known to the adversary, while the private data Q cannot be reconstructed from the number of shares available.

It is clear that we cannot expect perfect security in the information-theoretic sense, as information is leaking through the public information P.

Theorem 4.

Consider an adversarial model in which the adversary knows the public data P but does not have enough shares to recover the private data Q. With respect to this model, the deterministic space-efficient secret sharing scheme is computationally secure.

Proof. 

The adversary knows the public data P but does not have enough shares to reconstruct Q. If Q is distributed by a computationally secure secret sharing scheme, any polynomial-time adversary can recover Q, and hence T or S, only with negligible probability. If Q is distributed by an information-theoretically secure scheme such as Shamir’s, then an unauthorised adversary learns nothing about Q from the shares alone. Even in that case, however, the overall construction remains only computationally secure, because the public data P still expose algebraic structure through the relation $P=T+g{g}^{\top }$. Security of the full scheme therefore depends on the computational hardness of exploiting this public information to recover T and g.    □

Remark 1.

In contrast to the earlier scheme [16], the proposed scheme mitigates low-entropy vulnerabilities of the public data P, caused by a non-uniform random distribution of the transformation matrix T, reducing the search space for an attacker. By publishing the masked data $P=T+g{g}^{\top }$, the scheme avoids the vulnerability through the additional randomness introduced by g.

5. Implementation and Evaluation

In this section, we report on an implementation of the deterministic algorithm and present an evaluation comparing both the probabilistic and deterministic MSSR versions.

5.1. Implementation

This section describes the deterministic sequence of steps that transforms an integer secret into a matrix, computes its Frobenius normal form, and derives short shares. The process has three stages: (i) encode the secret as a matrix S over ${\mathbb{F}}_p$, (ii) compute a similarity transformation W such that $W^{-1}SW$ is in Frobenius form, and (iii) extract invariants from the Frobenius blocks and apply secret sharing to the resulting payload. In the full MSSR protocol, W is published as public data P, while the shares are securely distributed to the participants.

Algorithm 1 converts an integer secret s into a $t\times t$ matrix over ${\mathbb{F}}_p$. The size t is chosen from the base-p length of s, and the base-p digits are arranged into a square matrix to form the algebraic data structure used in the subsequent steps. The inputs are the integer s and a prime $p<s$, and the output is a $t\times t$ matrix over ${\mathbb{F}}_p$.    

Algorithm 1: Convert an integer secret to a base-p matrix

Algorithm 2 computes the Frobenius normal form and the associated similarity transformation matrix W modulo p. This step is the deterministic replacement for the probabilistic cyclic vector approach and is essential for the MSSR reduction. The inputs are a matrix A and a prime p, and the outputs are the Frobenius form F and the similarity transformation W.    

Algorithm 2: Compute Frobenius normal form and similarity matrix W over ${\mathbb{F}}_p$

Algorithm 3 extracts the characteristic polynomial coefficients from each Frobenius block, concatenates them, and applies a space-efficient secret sharing scheme to produce the final shares. The inputs are the Frobenius form F and a prime p, and the output is the list of shares.    

Algorithm 3: Extract Frobenius-block coefficients and generate shares

All algorithms have been implemented in the computer algebra system maple. Our code is publicly available as an Open Source project on GitHub [33].

5.2. Runtime Evaluation of Probabilistic and Deterministic Algorithms

This section evaluates the implementation of the algorithms designed in our previous paper [16] and this work. For secrets of various sizes $10\le \left|s\right|\le 1000$, where $\left|s\right|=logs$ represents the number of decimal digits of s, we have reproduced (using Maple 2025 on an Intel(R) Xeon(R) CPU E5-2690 v4 (2.59 GHz) Windows 11 Virtual Machine with 112 GB RAM) the results from [16]. Reproducing these past results, consistent with our original findings, created a reliable starting point for comparing the runtime behaviour of the probabilistic and the new deterministic algorithm.

Specifically, we generated a sample group comprising 1000 secrets for each size. We ran the algorithm, recording $l_{min}$, $l_{max}$, and $l_{avg}$ as the minimal, maximal, and average number of iterations required to compute a cyclic form, achieving a share size reduction. Additionally, we measured the average execution time per sample of both the probabilistic and the deterministic algorithm, $t_{prob}$ and $t_{det}$, in seconds. From the recorded values of $l_{avg}$, one can derive the largest prime number p used in the algorithm and the achieved share size reduction. The last column reports the timings obtained with the deterministic algorithm with $p=2$ for the finite field conversion.

Overall, the probabilistic method exhibits a small number of expected iterations across the tested secret sizes. The data confirm our original results, showing that $l_{avg}$ is largely independent of t, as suggested by Lemma 1. In all cases, $l_{avg}<3$, in accordance with Theorem 1. Furthermore, we observe that for 8 out of the 11 sample groups, $l_{avg}<2.36$, respecting the upper bound proven in the theorem. Each sample group terminates after at most six iterations for all secrets, with at least one instance terminating after one single iteration. The small maximum iteration count implies that the largest required prime p remains small throughout the experiments, with the maximal value used being $p=13$.

Table 2. MSSR evaluation for sample of shares.

$\left|\mathit{s}\right|=log\mathit{s}$	${\mathit{l}}_{\mathit{min}}$	${\mathit{l}}_{\mathit{max}}$	${\mathit{l}}_{\mathit{avg}}$	${\mathit{t}}_{\mathit{prob}}$	${\mathit{t}}_{\mathit{det}}$
10	1	6	2.19	0.407	0.344
20	1	5	2.58	0.750	0.766
30	1	5	2.16	0.625	0.875
40	1	5	2.45	1.015	1.188
50	1	5	2.18	0.969	1.391
100	1	6	2.67	2.109	3.422
200	1	6	2.29	4.828	7.594
300	1	5	2.13	8.125	12.734
400	1	6	2.43	11.547	19.047
500	1	5	2.32	15.937	25.625
1000	1	5	2.07	42.250	67.453

presents the runtime of the deterministic algorithm when using prime numbers of increasing size for the matrix conversion. For smaller prime numbers, we get larger matrix dimensions, which will be bounded by $\sqrt{\left|s\right|}$. As prime numbers increase, the matrix dimension gets smaller. In the extreme scenario, where p is approximately the size of s, we obtain a scalar as a trivial matrix. In our experiment, we explored values for p up to 13, consistent with sizes used in the nondeterministic approach. Upon analysis of the timings, we find that larger values of p lead to better algorithm performance due to the shrinking matrix size. Runtime consistently decreased across each sample group. On the other hand, the share sizes increase.

5.3. Comparative Evaluation

When comparing secret sizes across both tables, the data indicate a cutoff point around $n=20$, beyond which the deterministic approach for the smallest prime $p=2$ becomes slower than the probabilistic method. On the other hand, for the next prime $p=3$, it mostly performs better again and clearly outperforms the probabilistic approach for all other primes $3<p\le 13$.

For realistic parameter settings, the key trade-off is between the secret size $\left|s\right|$, the induced matrix dimension $t=\lceil \sqrt{{log}_{p}s}\rceil$, and the choice of prime p. For a fixed secret, larger primes shorten the base-p expansion and hence reduce t, which improves the runtime of the matrix computations, as seen in

Table 3. Deterministic algorithm running times for matrix conversions with prime numbers of growing sizes.

$\left|\mathit{s}\right|=log\mathit{s}$	$\mathit{p}=2$	$\mathit{p}=3$	$\mathit{p}=5$	$\mathit{p}=7$	$\mathit{p}=11$	$\mathit{p}=13$
10	0.344	0.437	0.219	0.234	0.219	0.203
20	0.766	0.437	0.516	0.281	0.282	0.297
30	0.875	0.656	0.438	0.359	0.516	0.359
40	1.188	0.953	0.531	0.609	0.454	0.327
50	1.391	1.078	0.828	0.719	0.437	0.438
100	3.422	2.187	1.328	1.188	1.016	0.906
200	7.594	4.906	3.234	2.844	2.156	2.110
300	12.734	8.812	5.485	4.375	3.406	3.515
400	19.047	11.797	7.843	6.360	5.109	4.672
500	25.625	17.000	10.984	9.094	6.750	6.953
1000	67.453	41.469	28.375	23.719	17.469	16.093

. The price is that the coefficients in the reduced private data lie in a larger field and therefore carry more bits, so the share size reduction becomes less pronounced. Conversely, very small primes such as $p=2$ maximize compression per field element but produce larger matrices and slower linear algebra. As $\left|s\right|$ grows, the matrix dimension still increases only on the order of $\sqrt{\left|s\right|}$, so the share size level remains sublinear in the secret length, but the cubic dependence on t makes runtime increasingly sensitive to the prime choice. In practice, our data suggest that small to moderate primes offer the best balance, preserving substantial share size reduction while already giving a clear runtime improvement over the smallest-field case.

6. Conclusions

In summary, this work extends the matrix-based MSSR approach in several ways: it proves a small expected iteration count ($k<3$) for the probabilistic approach, introduces a deterministic share size reduction via the Frobenius canonical normal form, clarifies how computational security can be obtained under a suitable adversary model by combining the matrix reduction with standard secret sharing of the private data, and yields a rational algorithm carried out entirely over the base field, thereby avoiding the field extensions that may arise in approaches based on the Jordan canonical form. The provided evaluation supports these results by evidencing stable iteration counts for the probabilistic version and competitive runtimes for the deterministic method. Overall, we conclude that matrix normal forms can provide a linear algebra foundation for space-efficient secret sharing with short shares. Our Maple implementation is publicly available as an Open Source project on GitHub [33], ensuring that other researchers can reproduce our results and build on them.

While these contributions significantly advance the efficiency and security of matrix-based secret sharing techniques, additional work could be carried out. Future research could focus on more specific prime number selection to further improve the runtime of our algorithm. Another direction would be to extend the scheme to richer dynamic access or adversary structures and evaluate it for large-scale distributed system architectures.