Assume we have two secrets $$s_1$$ and $$s_2$$. We use Shamir's scheme to produce $$\{(x_i,y_i)\}$$ as $$n$$ shares of $$s_1$$ with a threshold $$t$$. Then, we use the additive scheme to generate shares for $$s_2$$, denoted by $$z_i$$. Is there any way to combine the shares of $$s_1$$ and $$s_2$$ to get shares of $$s_1+s_2$$?
• A trivial way to do this would be to let the $i$-th share be $(x_i, y_i, z_i)$. Clearly, combining all $n$ shares allows reconstruction of both $s_1$ and $s_2$, and thus also their sum. But I assume you probably want some additional properties that this trivial scheme doesn't satisfy. (If so, please try to specify them.) Also, if the shareholders can communicate with each other (or with a trusted party), they could just reconstruct the secrets and re-share their sum. But I assume this is also not what you want. Oct 26 '20 at 18:22