Do deterministic secret sharing schemes exist?

Question

Are there algorithms for secure secret sharing such that the algorithm depends solely on the value being secured, relying on no randomness in its calculations.

If there aren't, is such an algorithm an impossibility? If there are, what are some examples?

I ask because I've come up with a secret sharing scheme (which is probably littered with flaws ;-)), and I'd like try and prove certain properties about it. If deterministic secret sharing schemes are a no-go, I'd very much appreciate a heads up.

I'm not entirely certain this question is well defined. If it is not, I would greatly appreciate any information on why it is ill defined and how to make it more rigorous if possible.

Answer 1

Any deterministic secret sharing scheme as in the question has the property that any participant can run the deterministic algorithm for a guess of the shared secret, and eliminate the guess if the share that the algorithm deterministically assigns him/her does not match his/her share. This implies that some information about the secret is leaked in his/her share, or that his/her share is pointless (in the sense that his/her share can be removed from any set of shares that allows to reconstruct the secret, while keeping that ability).

Likely that's why there is no seldom such beast in the literature. For a counterexample to this assertion, see that other answer.

Answer 2

In a short paper "On sharing secrets and Reed-Solomon codes," Communications of the ACM, vol. 24, pp. 583-584, September 1981, Bob McEliece and I described a secret-sharing system that uses no randomness (cf. the second paragraph of the paper). This is most useful for very large secrets (lots of bits) since it divides the secret into $k$ parts, and then constructs $n > k$ shares of length equal to each of the $k$ parts. Protection against $c$ shareholders who knowingly submit maliciously altered shares to the reconstruction process as well as against $c$ careless shareholders who are unaware that their shares have been corrupted inadvertently is possible if more than $k+2c$ shares are available for reconstruction, and in either case, the submitters of altered shares can be identified.

Those who wish to point out that Shamir's original secret-sharing scheme also has $n$ shares of which any $k$ can be used to reconstruct the secret should recall that in Shamir's scheme, the secret together with $k-1$ randomly chosen parts of the same length as the secret constitute the $k$ pieces from which the sharing scheme constructs the $n$ shares. Thus, in Shamir's scheme, each share is as long as the secret, whereas in the Reed-Solomon scheme, each share is only $1/k$ as long as the secret.