Reducing exponent in modular arithmetic (Distributed ElGamal decryption)

36 Views Asked by At

I'm currently trying to make an ElGamal system decrypt in a distributed fashion, so as to never reveal the secret key in play. To that effect, the secret key is put into a polynomial as the constant term so $f(0) = s$. Now every server in play gets $f(i)$ at the start of execution, and using Lagrange Interpolation we can get that $$ s = \sum_i^t \lambda_if(i)$$ for some easily computable constants $\lambda$. This is all cool, and works fine, the problem is when doing this over a finite field. We have a safe prime p, and the associated prime $q = \frac{p-1}{2}$. S is always chosen from $\mathbb{Z}_q^*$, and all $f(i)$ are computed mod q. In the end, the result from computing s will typically have the form $s = s + k\cdot p mod p$ which isn't really a problem in that case, but in the case of distributed decryption what we're actually going for is to raise some $c$ to the power of each part of s, call them $s_i$, so we get $$ c^{\sum_i s_i} = c^{s + k\cdot p} \mod p$$ But this will give us $c^{s+k}$ which obviously isn't going to work. How can I reduce this to just give me s? If I knew k I could just go $c^{s+k\cdotp - k} = c^{s+k\cdot(p-1)} \mod p = c^s$ but how would I go about doing that?