# Can I use Shamir's secret sharing scheme for multiplicative homomorphism for secure multiparty computation?

I would like to perform a dot product operation among $m$ parties using Shamir's $(m,m)$ secret sharing that is used for Secure Multiparty Computation.

I am aware that Shamir's $(m,m)$ scheme is additively homomorphic, but can someone please provide an example of how I can use it for multiplicative homomorphism for SMC?

-

## migrated from mathoverflow.netApr 4 '14 at 15:00

This question came from our site for professional mathematicians.

Welcome to Crypto.SE :) Remember to sign up on this site and link your accounts to reclaim ownership of your question. – figlesquidge Apr 4 '14 at 15:03
Sorry for the edit clash DrL – figlesquidge Apr 4 '14 at 15:05
@figlesquidge no problem ;) – DrLecter Apr 4 '14 at 15:07
This might help: research.cyber.ee/~peeter/teaching/seminar07k/bogdanov.pdf – rphv Apr 4 '14 at 19:15
Thanks. This paper does explain multiplicative homomorphism using Shamir's scheme. However what i want to do is multiplication e.g. using 3 parties and each of them has a secret and acts as a dealer. Can someone provide an example for this. – nie_11 Apr 7 '14 at 2:32

As far as I know, you can not do multiplication with (m,m) shamir secret sharing. The typical method to do multiplication on shamir secret shares increases the degree of the sharing polynomial, which is why the parties run an additional protocol to reduce the degree. That is why the degree of the sharing polynomial must be less than $m/2$ if there are $m$ parties.
If you indeed need (m,m) (or $m$ out of $m$ parties must be present to do reconstruction and multiplication), and the only operation you need to compute is multiplication (which I'm not sure about since your comments state you want to do multiplication, but your question mentions dot product), then I'd suggest using multiplicative secret sharing.
If instead you need $m$ out of $m$ computation/reconstruction, but need to do both addition and multiplication operations, you'll have to go with some of the newer MPC constructions which achieve full-threshold security (SPDZ and some of it's references or subsequent works which cite it).
@nie_11 I was never able to find a paper on multiplicative secret sharing which is why I asked about it here. In some sense, multiplicative secret sharing is just additive secret sharing in a multiplicative group. Which leads us to 0 (and something I hadn't thought about previously). If we consider the multiplicative group of integers modulo some $n$, 0 is not in that group. So it makes sense 0 won't work. – mikeazo Apr 11 '14 at 11:53