# Homomorphic encryption - addition for more than two parties

I have just found out about the homomorphic encryption and I was wondering how is it possible to perform an addition for more than two parties?

More concretely, I want to have several parties $P_i$, each of which picks a value $p_i$ only known to themselves. Now I want another party $R$ to only learn $r=\sum p_i$, that is the sum of all the private values, but $R$ must not learn any specific $p_i$ and $P_i$ may not learn $p_j$ unless $i=j$.

From my understanding so far, the way the Homomorphic Encryption works is that you have $A=2$ and $B=3$ as values then you get the encrypted values $E(A)$ and $E(B)$. Then $E(A+B)$ it's computed and when you decrypt $E(A+B)$, one gets the correct result which is $5$.

What if you would like to do $A+B+C$, where $C=4$, with the homomorphic encryption? How will the private keys be allocated so that $A,B$ and $C$ can receive the final result ($9$), while they don't know the values of each other?

(P.S.: I am a student and I am asking this only for my academic curiosity. I am not currently taking any crypto course, so that's why I would really appreciate your help!)

• What do you mean by How will the private keys be allocated? Wouldn't you have to be using the same key for this to work? – AndrolGenhald Apr 18 '18 at 15:00
• I think you are confusing the types of A, B and C. Those are values, not stakeholders. Thus, key management doesn't differ between the usage of two, three or n values; the number of stakeholders keep the same. If this is not the root of your confusion, please clarify. – Tobi Nary Apr 19 '18 at 12:47
• You need something called secure multi-party computation to ensure that $A,B,C$ can all provide their own secret value, learn nobody else's input and learn only the aggregated sum. Homomorphic encryption requires you to fix a recipient (ie a public key) - who can also decrypt individual entries - and then the sum can be computed and this works just as well for three values as it does for two, much like $a+b+c$ isn't actually a ternary $+$ operator but rather $(a+b)+c$ which is the same you could do with homomorphic encryption. – SEJPM Apr 19 '18 at 20:28
• @SmokeDispenser In my scenario I would have three or more parties (A,B,C..), each of them having one value. I am interested in obtaining the sum of all the parties and send it to R, without the possibility of A,B,C or R to know the values of each party involved. – Gigi Gigi Apr 20 '18 at 8:18
• In that case, you‘re not looking for only a homomorphic encryption scheme as pointed out by @SEJPM already. I suggest editing your question accordingly. – Tobi Nary Apr 20 '18 at 10:27