Assume we have two secrets $$s_1$$ and $$s_2$$. We use Shamir's scheme to produce $$\{(x_i,y_i)\}$$ as $$n$$ shares of $$s_1$$ with a threshold $$t$$. Then, we use the additive scheme to generate shares for $$s_2$$, denoted by $$z_i$$. Is there any way to combine the shares of $$s_1$$ and $$s_2$$ to get shares of $$s_1+s_2$$?

– Mark
Oct 26 '20 at 2:27
• @Mark Thank you for your comment. The post you have referred shares are generated for both secrets using Shamir's scheme. In my problem, Shamir's scheme is used for one secret and the additive scheme is used for the other one. Oct 26 '20 at 2:53
• I can think of ways to combine them for specific additive schemes, but it depends on the form of the underlying additive scheme. Do you have a particular one in mind?
– Mark
Oct 26 '20 at 3:23
• A trivial way to do this would be to let the $i$-th share be $(x_i, y_i, z_i)$. Clearly, combining all $n$ shares allows reconstruction of both $s_1$ and $s_2$, and thus also their sum. But I assume you probably want some additional properties that this trivial scheme doesn't satisfy. (If so, please try to specify them.) Also, if the shareholders can communicate with each other (or with a trusted party), they could just reconstruct the secrets and re-share their sum. But I assume this is also not what you want. Oct 26 '20 at 18:22