Necessity and Realization of Universally Verifiable Secret Sharing

We argue the necessity of universally veriiable secret sharing for secrets as individual users' cryptographic keys, and propose protocols to realize such secret sharing for two most common public-key cryptosystems: discrete logarithm based and integer factorization based. The universal veriiabil-ity achieves sharing secret with multi third parties as shareholders using two-party protocols in which a single veriier, who can be anybody, can verify the cor-rectness of a secret sharing for the (oo-line) multi shareholders. Several advantages result: (i) drop of the honesty requirement on the veriier and the shareholders , (ii) drop of the on-line availability requirement on the multi shareholders, and (iii) the simplicity of two-party protocols which provides users with freedom and exibility to choose multi shareholders they trust in real time of share distribution. The two-party protocols proposed in this work ooer a practical solution for secure data backup and key recovery services.