# Tag Info

This is the correct behavior. Since the degree of the multiplication sharing is $2t$, it will take $2t+1$ shares of either it directly or the subshares. If done on the subshares, the resulting sharing is of degree $t$. Shamir secret sharing is commutative with respect to polynomial evaluation. Let $\sigma_1^t$ be the polynomial for sharing $s$ with degree ...