I am looking for a protocol where each party generates a share such that $\sum_{i\in [n]} s_i =0$ where the shares should remain secret. The adversary may corrupt n-2 parties, and the parties can be malicious. However, it should be verifiable if the sum is not 0. Is there an efficient protocol that achieves this in a distributed way?

  • $\begingroup$ I'm not sure if I should add homomorphic encryption or zkp to this question as the protocol is entirely left open. If somebody can tell then please add the relevant tags. $\endgroup$
    – Maarten Bodewes
    Dec 6, 2023 at 19:26


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.