I have the following problem:

A secret $x \in \mathbb{Z}_q$ is secret shared (additive secret sharing) between $n$ parties, now is it possible to compute the secret shares of $y = \lfloor x \rfloor _p $ without reconstructing the secret $x$.

$ y = \lfloor x \cdot \frac{p}{q} \rfloor \in \mathbb{Z}_p \text{ } p < q $. Essentially I need the shares of rounded down version of $x$, is there a way to do that?

  • $\begingroup$ In the simplest $(n,n)$ additive secret sharing scheme, $n-1$ shares $x_1, x_2, \ldots, x_{n-1}$ are randomly chosen nonzero elements of the field while the $n$-th share is $x-x_1-x_2-\cdots -x_{n-1}$ where the difference is calculated in the field, that is, $x$ is equal to the sum $x_1+x_2+\cdots+x_n$ modulo $p$ already and you have reconstructed $x$. So, more details of what you mean by additive secret sharing would help in getting an answer. $\endgroup$ – Dilip Sarwate Feb 29 at 22:23
  • $\begingroup$ The setting is that a dealer $D$ generates the shares of $x$ and distributes among $n$ parties, now the parties need to participate in a multiparty computation to compute shares of $y$ from shares of $x$, the dealer is not (should not be) involved in this step $\endgroup$ – MeV Mar 1 at 6:41
  • $\begingroup$ So the $n$ shareholders can get together and find $x$, then $x \bmod p$, and recompute the values of the shares. Indeed, unless you are insisting that the new shares have values smaller than $p$, $x_i$ can be the same for $i<n$ while $x_n$ gets changed to $y-x_1 -x_2-\cdots -x_{n-1}$. $\endgroup$ – Dilip Sarwate Mar 1 at 16:17
  • $\begingroup$ I do not want them to compute $x$ which lets everyone know $x$. I was wondering if generating the new shares is possible by performing just local computation on the shares. $\endgroup$ – MeV Mar 1 at 23:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.