What is the difference between the classic secret sharing schemes that are used in the protocols of Ben-or and Rabin, Ben-Or, M., Goldwasser, S., Wigderson (that is the Shamir's secret sharing scheme) with the homomorphic secret sharing schemes? Could anybody provide a paradigm? Can we use a homomorphic secret sharing scheme to design a protocol of communication? I would like some reference for the latter.

  • $\begingroup$ In traditional secret-sharing you distribute a secret among several parties, who can reconstruct it later on. In a homomorphic secret-sharing on the other hand, you want to enable the parties to apply certain local operation to their shares before reconstructing, so that the reconstructed secret is not the original distributed value but rather a function of it. For instance, in a linear secret-sharing scheme (such as Shamir's), each party can multiply their share by a constant $c$ to reconstruct not the secret, but the secret times $c$. Actual HSS papers consider other functions. $\endgroup$
    – Daniel
    Dec 21, 2021 at 18:18
  • $\begingroup$ @Daniel I rephrase my question. Could we use the homomorphic secret sharing scheme to design a secure multiparty protocols of communication like Ben-or and Rabin, or Ben-Or, M., Goldwasser, S., Wigderson protocols? $\endgroup$ Dec 21, 2021 at 21:10
  • $\begingroup$ Homomorphic secret sharing (HSS) for arbitrary functions trivially gives you secure computation for any function: just secret-share the inputs, each party locally applies the required operation, and then the secret is reconstructed to obtain the result of the computation on the inputs. You don't need to involve BGW or any other protocol once you have HSS for arbitrary functionalities. The challenge, however, lies in designing such HSSs. $\endgroup$
    – Daniel
    Dec 21, 2021 at 21:20


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.