Application

The union `Democrats '16' has 4 members of the board and 96 other members. The members have an agreement that, whenever a decision should be made, it is sufficient that 16 ordinary members agree with the decision. This agreement is given by means of a key number (one per decision) owned by a notary. If the board has computed the key number, has served it to the notary, and if the notary has established that it is indeed the key number, then all members can trust the fact that 16 members have agreed.

How does this work? The members of Democrats '16 have each a number, let us say the number of order of their accession, which is public. We call this number the serial number of the members. But each member also has a secret number (one per decision). This secret number has been brought about as follows: for the present decision the notary has chosen a polynomial f(X) of degree 15. In fact this is the `key number' (encrypted from polynomial into number, according to a certain procedure, which is not to the point here). Each member now becomes the value f(n), where n is his or her serial number, as a secret number.

If 16 members have sent their secret number (provided with the sender), then the board can apply interpolation and find out the key.

If there are 15 or less members, then there are as many possibilities as there are coefficients --- which leads to the question which coefficient ring to chose.

The choice R = Z/pZ for p a prime of about 20 bits is very adequate: the interpolation computations are in this case still well-feasible, but there are at least 10²⁰ polynomials of degree smaller than 16 satisfying the at most 15 interpolation conditions. It is unfeasible to guess the right one from this.