# Is the following aggregation scheme private?

Is the following scheme private? By private i mean an untrusted aggregator (UA) cannot reveal anything other then an aggregate function output on plaintext data

Each party holds a secret key $k_i$ and data $d_i$. It sends to the aggregator $d_i H(r)^{k_i}$. $H$ is a hash function that maps elements to a group $N$ in which $H(r)^S \equiv 1 mod {N}$ Lets say a trusted dealer(TD) for two parties sends to the untrusted aggregator $H(r)^{S-k_1}$ and $H(r)^{S-k_2}$ and UA wants to learn the multiplication of the data of those parties. Then UA computes

$$d_1 H(r)^{k_1}d_2 H(r)^{k_2}H(r)^{S-k_1}H(r)^{S-k_2} =d_1d_2H(r)^{2S}=d_1d_2H(r)^{S^2}=d_1d_2$$

• As far as I can see, from your setup UA computes $d_1H(r)^{k_1}H(r)^{S-k_1}=d_1$, which would mean that the UA learns both values. Nov 19, 2013 at 16:54
• There's a formal error in the last formula: $H(r)^{2S}=(H(r)^S)^2$. But $H(r)^{S^2}$ means something else (The expression would be wrong with most other values)
– tylo
Nov 19, 2013 at 18:44

Well, it has the obvious problem that if the UA has both $d_1H(r)^{k_1}$ (from the party) and $H(r)^{S-k_1}$ (from the UA), it can compute $d_1$ directly.
• If somehow the UA never gets encrypted data per single user but always in a pair manner?I.e: Data are first sent to the TD and then it sends to the UA $d_1 H(r)^{k_1}d_2 H(r)^{k_2}$ but this sounds stupid...since now the TD can decrypt but we make the assumption that is trusted Nov 19, 2013 at 17:05
• If you send $H(r)^{S-k_1-k_2}$ to the UA, it cant compute $d_1$ and $d_2$ directly.
• @tylo: actually, if $S << N$, then it's likely that someone could recover $d_1$, $d_2$ directly from $d_1H(r)^{k_1}$, $d_2H(r)^{k_2}$ Nov 21, 2013 at 18:03