Shamir secret sharing with no dealer Suppose we have a set of $N$ parties. I am looking for a scheme to generate shares of a random secret $s$ where any subset of the participants with size $k$ can recover the secret similar to Shamir's scheme. Additionally, no party outside of the group, such as a dealer, has access to $s$.
I think this can be done relatively simply with any additive secret sharing scheme (which Shamir's scheme is). The basic idea behind the scheme (to make a $(n, k)$ no-dealer secret sharing scheme) is:

Each party samples a uniformly random value $s_i\in\mathbb{F}_p$
Each party makes $n$ shares of this value (using an additive $(n, k)$ secret sharing scheme), which we will call $\{s_{i, j}\}$ for $j\in[n]$
For all $(i, j)\in[n]^2$, Party $i$ sends $s_{i, j}$ to party $j$.
For all $i\in[n]$, party $i$ sets $s_i' = \sum_{j\in[n]}s_{i, j}$
All parties are left with a sharing of $s' = \sum_{i \in[n]} s_i$

The idea for why this should be secure (up to the threshold $k$) is that there are really three things an adversary can do:

Choose $s_i$ non-uniformly (and among the $k-1$ parties, choose them dependent in some way)
Send out &quot;incorrect&quot; shares of their secret
Compute $s_i'$ incorrectly

The first two points can be seen to be equivalent, as sending out &quot;incorrect&quot; shares is the same as sending out correct shares of an incorrectly sampled secret.
If you know a group of honest parties will reconstruct the secret, these incorrectly sampled secrets will not be an issue (the sum $s' = \sum_{i\in[n]}s_i$ will be uniformly distributed as long as any $s_i$ is individually uniformly distributed, and all other secrets are independent of this value).
I don't know how tolerant the above will be to corruptions during the reconstruction process, but it doesn't seem like this is what you're asking about. I imagine it would be roughly as tolerant as the &quot;base&quot; additive secret sharing scheme is, but don't have a readily available argument (so will omit this, while mentioning that it's an interesting thing to think about).
This also has relatively high communication complexity ($O(n^2)$ in the sharing process --- it feels like $O(nk)$ might be possible, but I don't want to over-optimize it right now), and can only sample secrets on fields $\mathbb{F}_p$ for which Shamir's is secure (so you must take $p$ to be exponentially large, so it is wasteful in the size of communications (instead of just the number of messages) if you only need a &quot;small&quot; secret to be agreed upon), which seem like the major &quot;downsides&quot; of it to me.