Security is defined per epoch for n synchronized parties connected by authenticated broadcast and pairwise secure authenticated channels, with periodic refresh, secure deletion of old shares, and optional recovery after reboot or share loss.

1. threat model

   Mixed mobile adversary

   defined

   A polynomial-time adversary passively reads the state of P* and may actively control A* subseteq P*. Correctness, secrecy, and robustness are parameterized by separate multi-threshold sets rather than by one undifferentiated corruption bound.

   Polynomial-time mixed mobile adversary and multi-threshold security
2. definition

   Threshold accounting

   defined

   For the single-recovery setting the paper states passive bound tp < n - 2, active bound ta < n/2 - 1, and mixed constraint ta + tp < n - 2, where each active corruption is also counted among passive corruptions.

   Polynomial-time mixed mobile adversary and multi-threshold security · Additive-summand blueprint and recovery-dependent degree choices
3. assumption

   Environmental and cryptographic assumptions

   assumed

   The construction assumes synchrony, a global clock, authenticated broadcast, private authenticated channels, erasure of obsolete shares, reboot into a pristine state, and a binding/hiding homomorphic commitment; the concrete Feldman instantiation relies on discrete-log hardness.

   Synchronous network, channels, epochs, deletion, and recovery · Batched sharing, homomorphic commitments, and Feldman-VSS assumption

The four protocols manipulate a vector of additive summands shared by polynomials whose degree profile is chosen to balance secrecy against the number of active faults and simultaneously recovering parties.

1. method

   Additive and polynomial encoding

   specified

   Directly placing s in one polynomial would reveal it after enough passive observations. The construction first splits s into d random summands and then shares each summand with a polynomial of a different degree, so no allowed passive view determines every summand.

   Why conventional polynomial PSS fails under a passive majority · Additive-summand blueprint and recovery-dependent degree choices
2. protocol

   DM-Share and DM-Reconstruct

   specified

   DM-Share commits to and distributes the increasing-degree sharings; DM-Reconstruct opens enough evaluations to recover each additive summand and sums the reconstructed summands to recover s.

   DM-Share and DM-Reconstruct
3. protocol

   DM-Refresh

   specified and analyzed

   Parties verifiably share random polynomials of matching degrees whose free terms sum to zero, add the evaluations to current shares, resolve inconsistent openings by abort and identification, and delete obsolete shares.

   DM-Refresh and its termination, correctness, secrecy, and robustness lemmas
4. protocol

   DM-Recover

   specified and analyzed

   Parties mask current polynomials with random recovery polynomials that vanish at each recovering party's evaluation point. Interpolation gives replacement evaluations at those points without revealing s or other parties' shares.

   DM-Recover and its termination, correctness, secrecy, and robustness lemmas

The paper separates correctness, secrecy, robustness, termination, and communication statements and conditions each one on explicit passive, active, degree, and recovery parameters.

1. claim

   Passive confidentiality

   proved conditional

   In the represented single-recovery configuration, the paper states robust secrecy for fewer than n - 2 passive corruptions and no active corruptions; without recovery the overview gives the larger fewer-than-n passive bound.

   Problem, priority claim, thresholds, and communication · Additive-summand blueprint and recovery-dependent degree choices · DM-Refresh and its termination, correctness, secrecy, and robustness lemmas
2. claim

   Active and mixed-adversary security

   proved non robust

   With one recovering party, the paper states non-robust security with identifiable abort for fewer than n/2 - 1 active corruptions and for mixed corruption sets satisfying the defined multi-threshold constraints.

   Polynomial-time mixed mobile adversary and multi-threshold security · Problem, priority claim, thresholds, and communication · DM-Recover and its termination, correctness, secrecy, and robustness lemmas
3. claim

   Refresh correctness, secrecy, and robustness

   proved conditional

   Lemmas 1-4 argue termination, preservation of the encoded secret, independence of new shares from old shares, and sufficient correct interpolation points under the stated degree and corruption inequalities.

   DM-Refresh and its termination, correctness, secrecy, and robustness lemmas
4. claim

   Recovery correctness, secrecy, and robustness

   proved conditional

   Lemmas 5-8 argue termination, reconstruction of the recovering party's correct evaluations, secrecy of the secret and other shares, and preservation under d < n - k - c for k active corruptions and c recovering parties.

   DM-Recover and its termination, correctness, secrecy, and robustness lemmas
5. claim

   Communication complexity

   asymptotic analysis

   The paper reports O(n^4) communication for the single-secret scheme and an O(n) batching factor that reduces the effective per-secret cost, with O(n^3) communication for recovery of an O(n)-secret batch.

   Problem, priority claim, thresholds, and communication · Batched communication reduction

Evidence consists of explicit syntax and adversary definitions, four concrete protocols, homomorphic-commitment checks, interpolation arguments, and eight proof lemmas. The proofs were read but not mechanically checked or independently reproduced for this map.

1. evidence

   Refresh proof structure

   proof inspected not reproduced

   Binding commitments detect inconsistent distributions; zero-sum constant terms preserve s; one honest random contribution rerandomizes the family; and degree bounds ensure enough correct points remain for interpolation.

   DM-Refresh and its termination, correctness, secrecy, and robustness lemmas
2. evidence

   Recovery proof structure

   proof inspected not reproduced

   Vanishing masks preserve the recovering evaluations, computational hiding protects the random recovery polynomials, and the threshold inequalities guarantee enough correct shares to interpolate them.

   DM-Recover and its termination, correctness, secrecy, and robustness lemmas

Active security is non-robust, recovery consumes resilience, security depends on computational commitments and secure erasure, the network is synchronous, and the fully specified batched protocols are deferred beyond the represented version.

1. limitation

   Asynchrony and communication remain open

   open problem

   The conclusion leaves lower communication and dishonest-majority PSS over asynchronous networks unresolved; the construction itself assumes synchrony.

   Conclusion, non-robust guarantees, communication, and asynchronous open problem