# Does revealing shares of the result reveals shares of the inputs?

Suppose Alive and Bob have shares of two polynomials $P,Q$, say, Alice knows $P_A,Q_A$, Bob knows $P_B,Q_B$ s.t. $P=P_A+P_B$ and $Q=Q_A+Q_B$. They perform some operation $f$ over the shared values, to obtain shares of $f(P,Q)$.

If they reveal the shares of $f(P,Q)$, will this give hints on their individual shares of $P,Q$?

I am supposing that one cannot deduce $P$ or $Q$ with the knowledge of $f(P,Q)$. I just want Alice and Bob to know $f(P,Q)$ without leaking shares.

• Wouldn't this depend on how the operation $f$ works? Trivial example: if $f(P,Q)=P$, and they generate shares of $f(P,Q)$ just by taking their shares of $P$, then revealing the shares of $f(P,Q)$ will also reveal their shares of $P$. – poncho May 9 '16 at 13:15
• Is $f$ computed using an information-theoretically secure MPC protocol? It shouldn't give any more information than what is provided by having just the output itself. – mikeazo May 9 '16 at 13:45
• @poncho, As the last phrase reads one cannot deduce $P$ or $Q$. – Tal-Botvinnik May 9 '16 at 14:27
• @mike, I don't see how the computation of $f$ affects the result, as soon as the computation does not reveal shares of $P,Q$. Also, note that this is different than the MPC protocol to compute $f(P,Q)$ where A holds $P$ and B holds $Q$. – Tal-Botvinnik May 9 '16 at 14:31
• I'm confused, they have additive shares of polynomials. Are these polynomials over the reals or something else? They compute compute on their shares to get shares of some function of the polynomials. You want to know whether or not given the shares of the output polynomial could reveal information about the shares of the input polynomials. The secret sharing method is additive, but the method for computing the output shares is not-specified and I don't see how it can be answered generically for any method of computing the output shares. – mikeazo May 9 '16 at 15:13

It depends on how you make shares out of a polynomial. Consider for example Shamir secret sharing, using which a party can share a secret $s \in F$ (where $F$ is a finite field) with $n$ parties by doing the following:
• Construct a polynomial $f(x) = s + a_1x+a_2x^2+\dots + a_nx^t$, for some $t$, where $a_i \in_R F$ for all $1 \leq i \leq n$.
• Send the value of $f(i)$ to party $P_i$ for all $1 \leq i \leq n$.