Additive Secret Sharing Scheme
Updated 26 November 2025
Additive Secret Sharing Schemes are cryptographic primitives that split a secret into shares so that only the complete set reconstructs the original value.
They facilitate secure multiparty computation by enabling participants to perform local linear operations without revealing individual secrets.
Variants using additive codes over GF(4) introduce complex access structures and error detection capabilities, enhancing protocol robustness.
Additive Secret Sharing Schemes (ASS) are cryptographic primitives that enable secure and efficient distribution of a secret value among multiple parties such that only the collective combination of all shares reconstructs the original secret, while individual shares reveal no information. In the canonical (2,2)-threshold version, a value x x x F \mathbb{F} F { r , x − r } \{r, x - r\} { r , x − r } r r r G F ( 4 ) GF(4) GF ( 4 )
Let F \mathbb{F} F R \mathbb{R} R Z p \mathbb{Z}_p Z p ​ Z 2 ℓ \mathbb{Z}_{2^\ell} Z 2 ℓ ​
ASS.Setup( 1 λ ) (1^\lambda) ( 1 λ ) : No setup beyond establishing F \mathbb{F} F ASS.Share( x ∈ F ) (x\in\mathbb{F}) ( x ∈ F ) :
Sample $r \xleftarrow{\$} \mathbb{F}u n i f o r m l y a t r a n d o m . < / l i > < l i > C o m p u t e uniformly at random.</li>
<li>Compute u ni f or m l y a t r an d o m . < / l i >< l i > C o m p u t e , , , . < / l i > < l i > O u t p u t t h e p a i r .</li>
<li>Output the pair . < / l i >< l i > O u tp u tt h e p ai r . < / l i > < / u l > < / l i > < l i > < s t r o n g > A S S . R e c o n .</li>
</ul></li>
<li><strong>ASS.Recon . < / l i >< / u l >< / l i >< l i >< s t ro n g > A SS . R eco n < / s t r o n g > : < u l > < l i > C o m p u t e </strong>:
<ul>
<li>Compute < / s t ro n g >:< u l >< l i > C o m p u t e . < / l i > < / u l > < / l i > < / u l > < p > C o r r e c t n e s s h o l d s s i n c e .</li>
</ul></li>
</ul>
<p>Correctness holds since . < / l i >< / u l >< / l i >< / u l >< p > C orrec t n ess h o l d ss in ce . S e c u r i t y a g a i n s t s e m i − h o n e s t a d v e r s a r i e s f o l l o w s a s e a c h s h a r e i s i n d e p e n d e n t l y a n d u n i f o r m l y d i s t r i b u t e d i n . Security against semi-honest adversaries follows as each share is independently and uniformly distributed in . S ec u r i t y a g ain s t se mi − h o n es t a d v ers a r i es f o ll o w s a se a c h s ha re i s in d e p e n d e n tl y an d u ni f or m l y d i s t r ib u t e d in , s t a t i s t i c a l l y h i d i n g , statistically hiding , s t a t i s t i c a ll y hi d in g . T h e s c h e m e g e n e r a l i z e s d i r e c t l y t o . The scheme generalizes directly to . T h esc h e m e g e n er a l i zes d i rec tl y t o p a r t i e s b y d e c o m p o s i n g parties by decomposing p a r t i es b y d eco m p os in g a s a s u m o f as a sum of a s a s u m o f r a n d o m f i e l d e l e m e n t s s u m m i n g t o random field elements summing to r an d o m f i e l d e l e m e n t ss u mmin g t o ( < a h r e f = " / p a p e r s / 2009.05356 " t i t l e = " " r e l = " n o f o l l o w " d a t a − t u r b o = " f a l s e " c l a s s = " a s s i s t a n t − l i n k " x − d a t a x − t o o l t i p . r a w = " " > X i o n g e t a l . , 2020 < / a > ) . < / p > < h 2 c l a s s = ′ p a p e r − h e a d i n g ′ i d = ′ s e c u r i t y − p r o p e r t i e s − a n d − u n i v e r s a l − c o m p o s a b i l i t y ′ > 2. S e c u r i t y P r o p e r t i e s a n d U n i v e r s a l C o m p o s a b i l i t y < / h 2 > < p > F o r a n y p a r t y (<a href="/papers/2009.05356" title="" rel="nofollow" data-turbo="false" class="assistant-link" x-data x-tooltip.raw="">Xiong et al., 2020</a>).</p>
<h2 class='paper-heading' id='security-properties-and-universal-composability'>2. Security Properties and Universal Composability</h2>
<p>For any party ( < ah re f = "/ p a p ers /2009.05356" t i tl e = "" re l = " n o f o ll o w " d a t a − t u r b o = " f a l se " c l a ss = " a ss i s t an t − l ink " x − d a t a x − t oo lt i p . r a w = "" > X i o n g e t a l . , 2020 < / a > ) . < / p >< h 2 c l a ss = ′ p a p er − h e a d in g ′ i d = ′ sec u r i t y − p ro p er t i es − an d − u ni v ers a l − co m p os abi l i t y ′ > 2. S ec u r i t y P ro p er t i es an d U ni v ers a lC o m p os abi l i t y < / h 2 >< p > F or an y p a r t y , t h e v i e w o f i t s s h a r e , the view of its share , t h e v i e w o f i t ss ha re i s i n d i s t i n g u i s h a b l e f r o m a u n i f o r m l y r a n d o m e l e m e n t o f is indistinguishable from a uniformly random element of i s in d i s t in gu i s hab l e f ro ma u ni f or m l yr an d o m e l e m e n t o f . T h e o r e m 2.1 e s t a b l i s h e s t h a t t h e r e e x i s t s a p e r f e c t s i m u l a t o r t h a t , o n i n p u t . Theorem 2.1 establishes that there exists a perfect simulator that, on input . T h eore m 2.1 es t ab l i s h es t ha tt h eree x i s t s a p er f ec t s im u l a t or t ha t , o nin p u t , o u t p u t s a s i m u l a t e d s h a r e d i s t r i b u t e d i d e n t i c a l l y t o , outputs a simulated share distributed identically to , o u tp u t s a s im u l a t e d s ha re d i s t r ib u t e d i d e n t i c a ll y t o . T h u s , i n t h e h o n e s t − b u t − c u r i o u s a d v e r s a r y m o d e l , t h e s c h e m e a c h i e v e s s t r o n g s t a t i s t i c a l s e c r e c y . < / p > < p > P r o t o c o l s b a s e d o n A S S a r e p r o v e n t o b e U n i v e r s a l l y C o m p o s a b l e ( U C ) s e c u r e i n t h i s m o d e l . T h e c o m p o s a b i l i t y a r i s e s s i n c e e v e r y p r o t o c o l s t e p e i t h e r p e r f o r m s o n l y l o c a l l i n e a r o p e r a t i o n s o n s h a r e s o r e x e c u t e s a m a s k e d v a l u e e x c h a n g e u s i n g B e a v e r t r i p l e s , w h i c h l e a k n o i n f o r m a t i o n a b o u t t h e u n d e r l y i n g s e c r e t d u e t o a d d i t i v e o r m u l t i p l i c a t i v e m a s k i n g ( < a h r e f = " / p a p e r s / 2009.05356 " t i t l e = " " r e l = " n o f o l l o w " d a t a − t u r b o = " f a l s e " c l a s s = " a s s i s t a n t − l i n k " x − d a t a x − t o o l t i p . r a w = " " > X i o n g e t a l . , 2020 < / a > ) . < / p > < h 2 c l a s s = ′ p a p e r − h e a d i n g ′ i d = ′ m u l t i p l i c a t i v e − s e c r e t − s h a r i n g − a n d − s h a r e − c o n v e r s i o n ′ > 3. M u l t i p l i c a t i v e S e c r e t S h a r i n g a n d S h a r e C o n v e r s i o n < / h 2 > < p > W h i l e A S S n a t u r a l l y s u p p o r t s a d d i t i o n a n d a f f i n e l i n e a r o p e r a t i o n s , m u l t i p l i c a t i v e h o m o m o r p h i s m r e q u i r e s a d u a l s h a r i n g s c h e m e , t e r m e d M u l t i p l i c a t i v e S e c r e t S h a r i n g ( < a h r e f = " h t t p s : / / w w w . e m e r g e n t m i n d . c o m / t o p i c s / m o d e l − s e t − s e l e c t i o n − m s s " t i t l e = " " r e l = " n o f o l l o w " d a t a − t u r b o = " f a l s e " c l a s s = " a s s i s t a n t − l i n k " x − d a t a x − t o o l t i p . r a w = " " > M S S < / a > ) . T o m u l t i p l i c a t i v e l y s h a r e . Thus, in the honest-but-curious adversary model, the scheme achieves strong statistical secrecy.</p>
<p>Protocols based on ASS are proven to be Universally Composable (UC) secure in this model. The composability arises since every protocol step either performs only local linear operations on shares or executes a masked value exchange using Beaver triples, which leak no information about the underlying secret due to additive or multiplicative masking (<a href="/papers/2009.05356" title="" rel="nofollow" data-turbo="false" class="assistant-link" x-data x-tooltip.raw="">Xiong et al., 2020</a>).</p>
<h2 class='paper-heading' id='multiplicative-secret-sharing-and-share-conversion'>3. Multiplicative Secret Sharing and Share Conversion</h2>
<p>While ASS naturally supports addition and affine linear operations, multiplicative homomorphism requires a dual sharing scheme, termed Multiplicative Secret Sharing (<a href="https://www.emergentmind.com/topics/model-set-selection-mss" title="" rel="nofollow" data-turbo="false" class="assistant-link" x-data x-tooltip.raw="">MSS</a>). To multiplicatively share . T h u s , in t h e h o n es t − b u t − c u r i o u s a d v ers a ry m o d e l , t h esc h e m e a c hi e v ess t ro n g s t a t i s t i c a l secrecy . < / p >< p > P ro t oco l s ba se d o n A SS a re p ro v e n t o b e U ni v ers a ll y C o m p os ab l e ( U C ) sec u re in t hi s m o d e l . T h eco m p os abi l i t y a r i sess in cee v ery p ro t oco l s t e p e i t h er p er f or m so n l y l oc a ll in e a ro p er a t i o n so n s ha resore x ec u t es ama s k e d v a l u ee x c han g e u s in g B e a v er t r i pl es , w hi c h l e akn o in f or ma t i o nab o u tt h e u n d er l y in g secre t d u e t o a dd i t i v eor m u lt i pl i c a t i v e ma s kin g ( < ah re f = "/ p a p ers /2009.05356" t i tl e = "" re l = " n o f o ll o w " d a t a − t u r b o = " f a l se " c l a ss = " a ss i s t an t − l ink " x − d a t a x − t oo lt i p . r a w = "" > X i o n g e t a l . , 2020 < / a > ) . < / p >< h 2 c l a ss = ′ p a p er − h e a d in g ′ i d = ′ m u lt i pl i c a t i v e − secre t − s ha r in g − an d − s ha re − co n v ers i o n ′ > 3. M u lt i pl i c a t i v e S ecre tS ha r in g an d S ha re C o n v ers i o n < / h 2 >< p > Whi l e A SS na t u r a ll ys u pp or t s a dd i t i o nan d a ff in e l in e a ro p er a t i o n s , m u lt i pl i c a t i v e h o m o m or p hi s m re q u i res a d u a l s ha r in g sc h e m e , t er m e d M u lt i pl i c a t i v e S ecre tS ha r in g ( < ah re f = " h ttp s : // www . e m er g e n t min d . co m / t o p i cs / m o d e l − se t − se l ec t i o n − m ss " t i tl e = "" re l = " n o f o ll o w " d a t a − t u r b o = " f a l se " c l a ss = " a ss i s t an t − l ink " x − d a t a x − t oo lt i p . r a w = "" > MSS < / a > ) . T o m u lt i pl i c a t i v e l ys ha re b e t w e e n t w o p a r t i e s : < / p > < u l > < l i > S a m p l e between two parties:</p>
<ul>
<li>Sample b e tw ee n tw o p a r t i es :< / p >< u l >< l i > S am pl e \times. < / s u p > < / l i > < l i > S e t .</sup></li>
<li>Set . < / s u p >< / l i >< l i > S e t , , , . < / l i > < l i > T h e r e c o n s t r u c t i o n i s .</li>
<li>The reconstruction is . < / l i >< l i > T h ereco n s t r u c t i o ni s . < / l i > < / u l > < p > E f f i c i e n t , c o n s t a n t − r o u n d , U C − s e c u r e p r o t o c o l s c o n v e r t b e t w e e n A S S a n d M S S r e p r e s e n t a t i o n s : < / p > < u l > < l i > < s t r o n g > S e c M u l R e s < / s t r o n g > ( M S S → A S S ) : W i t h a s h a r e d B e a v e r t r i p l e .</li>
</ul>
<p>Efficient, constant-round, UC-secure protocols convert between ASS and MSS representations:</p>
<ul>
<li><strong>SecMulRes</strong> (MSS → ASS): With a shared Beaver triple . < / l i >< / u l >< p > E ff i c i e n t , co n s t an t − ro u n d , U C − sec u re p ro t oco l sco n v er t b e tw ee n A SS an d MSS re p rese n t a t i o n s :< / p >< u l >< l i >< s t ro n g > S ec M u lR es < / s t ro n g > ( MSS → A SS ) : Wi t ha s ha re d B e a v er t r i pl e ( ( ( ) , t h e p a r t i e s m a n i p u l a t e t h e i r M S S s h a r e s a n d e x c h a n g e m a s k e d d e l t a s t o p r o d u c e a n A S S s h a r i n g o f t h e p r o d u c t ( < a h r e f = " / p a p e r s / 2009.05356 " t i t l e = " " r e l = " n o f o l l o w " d a t a − t u r b o = " f a l s e " c l a s s = " a s s i s t a n t − l i n k " x − d a t a x − t o o l t i p . r a w = " " > X i o n g e t a l . , 2020 < / a > ) . < / l i > < l i > < s t r o n g > S e c A d d R e s < / s t r o n g > ( A S S → M S S ) : U s i n g s i m i l a r B e a v e r t r i p l e r e s o u r c e s , t w o c o m m u n i c a t i o n r o u n d s s u f f i c e t o o b t a i n a n M S S s h a r i n g f r o m a n A S S s h a r i n g . < / l i > < / u l > < p > T h e c o r r e c t n e s s a n d U C s e c u r i t y o f t h e s e r e s h a r i n g p r o t o c o l s a r e f o r m a l l y e s t a b l i s h e d i n [ ( < a h r e f = " / p a p e r s / 2009.05356 " t i t l e = " " r e l = " n o f o l l o w " d a t a − t u r b o = " f a l s e " c l a s s = " a s s i s t a n t − l i n k " x − d a t a x − t o o l t i p . r a w = " " > X i o n g e t a l . , 2020 < / a > ) , T h m s . 3.2 – 3.3 ] . < / p > < h 2 c l a s s = ′ p a p e r − h e a d i n g ′ i d = ′ a r i t h m e t i c − p r o t o c o l s − a n d − f u n c t i o n a l i t y ′ > 4. A r i t h m e t i c P r o t o c o l s a n d F u n c t i o n a l i t y < / h 2 > < p > A S S s e r v e s a s t h e f o u n d a t i o n f o r a n e x t e n s i v e s u i t e o f s e c u r e t w o − p a r t y a r i t h m e t i c p r o t o c o l s . C o r e f u n c t i o n a l i t i e s i n c l u d e : < / p > < u l > < l i > < s t r o n g > S e c u r e A d d i t i o n ( S e c L i n e a r ) : < / s t r o n g > L o c a l l y c o m p u t e s h a r e − w i s e s u m s . N o c o m m u n i c a t i o n i s r e q u i r e d . < / l i > < l i > < s t r o n g > S e c u r e M u l t i p l i c a t i o n ( S e c M u l ) : < / s t r o n g > R e q u i r e s a s i n g l e r o u n d a n d 4 f i e l d e l e m e n t s e x c h a n g e d b y u t i l i z i n g B e a v e r t r i p l e s , t h u s s e c u r e l y e v a l u a t i n g t h e p r o d u c t o f t w o A S S − s h a r e d s e c r e t s . < / l i > < l i > < s t r o n g > S e c u r e C o m p a r i s o n ( S e c C o m ) : < / s t r o n g > I n v o l v e s t h r e e p r o t o c o l r o u n d s a n d ), the parties manipulate their MSS shares and exchange masked deltas to produce an ASS sharing of the product (<a href="/papers/2009.05356" title="" rel="nofollow" data-turbo="false" class="assistant-link" x-data x-tooltip.raw="">Xiong et al., 2020</a>).</li>
<li><strong>SecAddRes</strong> (ASS → MSS): Using similar Beaver triple resources, two communication rounds suffice to obtain an MSS sharing from an ASS sharing.</li>
</ul>
<p>The correctness and UC security of these resharing protocols are formally established in [(<a href="/papers/2009.05356" title="" rel="nofollow" data-turbo="false" class="assistant-link" x-data x-tooltip.raw="">Xiong et al., 2020</a>), Thms. 3.2–3.3].</p>
<h2 class='paper-heading' id='arithmetic-protocols-and-functionality'>4. Arithmetic Protocols and Functionality</h2>
<p>ASS serves as the foundation for an extensive suite of secure two-party arithmetic protocols. Core functionalities include:</p>
<ul>
<li><strong>Secure Addition (SecLinear):</strong> Locally compute share-wise sums. No communication is required.</li>
<li><strong>Secure Multiplication (SecMul):</strong> Requires a single round and 4 field elements exchanged by utilizing Beaver triples, thus securely evaluating the product of two ASS-shared secrets.</li>
<li><strong>Secure Comparison (SecCom):</strong> Involves three protocol rounds and ) , t h e p a r t i es mani p u l a t e t h e i r MSS s ha res an d e x c han g e ma s k e dd e lt a s t o p ro d u ce an A SS s ha r in g o f t h e p ro d u c t ( < ah re f = "/ p a p ers /2009.05356" t i tl e = "" re l = " n o f o ll o w " d a t a − t u r b o = " f a l se " c l a ss = " a ss i s t an t − l ink " x − d a t a x − t oo lt i p . r a w = "" > X i o n g e t a l . , 2020 < / a > ) . < / l i >< l i >< s t ro n g > S ec A dd R es < / s t ro n g > ( A SS → MSS ) : U s in g s imi l a r B e a v er t r i pl ereso u rces , tw oco mm u ni c a t i o n ro u n d ss u ff i ce t oo b t ainan MSS s ha r in g f ro man A SS s ha r in g . < / l i >< / u l >< p > T h ecorrec t n ess an d U C sec u r i t yo f t h eseres ha r in g p ro t oco l s a re f or ma ll yes t ab l i s h e d in [( < ah re f = "/ p a p ers /2009.05356" t i tl e = "" re l = " n o f o ll o w " d a t a − t u r b o = " f a l se " c l a ss = " a ss i s t an t − l ink " x − d a t a x − t oo lt i p . r a w = "" > X i o n g e t a l . , 2020 < / a > ) , T hm s .3.2–3.3 ] . < / p >< h 2 c l a ss = ′ p a p er − h e a d in g ′ i d = ′ a r i t hm e t i c − p ro t oco l s − an d − f u n c t i o na l i t y ′ > 4. A r i t hm e t i c P ro t oco l s an d F u n c t i o na l i t y < / h 2 >< p > A SS ser v es a s t h e f o u n d a t i o n f or an e x t e n s i v es u i t eo f sec u re tw o − p a r t y a r i t hm e t i c p ro t oco l s . C ore f u n c t i o na l i t i es in c l u d e :< / p >< u l >< l i >< s t ro n g > S ec u re A dd i t i o n ( S ec L in e a r ) :< / s t ro n g > L oc a ll yco m p u t es ha re − w i ses u m s . N oco mm u ni c a t i o ni sre q u i re d . < / l i >< l i >< s t ro n g > S ec u re M u lt i pl i c a t i o n ( S ec M u l ) :< / s t ro n g > R e q u i res a s in g l ero u n d an d 4 f i e l d e l e m e n t se x c han g e d b y u t i l i z in g B e a v er t r i pl es , t h u ssec u re l ye v a l u a t in g t h e p ro d u c t o f tw o A SS − s ha re d secre t s . < / l i >< l i >< s t ro n g > S ec u re C o m p a r i so n ( S ec C o m ) :< / s t ro n g > I n v o l v es t h ree p ro t oco l ro u n d s an d b i t s o f c o m m u n i c a t i o n f o r bits of communication for bi t so f co mm u ni c a t i o n f or − b i t f i e l d s . < / l i > < l i > < s t r o n g > E l e m e n t − w i s e F u n c t i o n s : < / s t r o n g > S e c u r e e x p o n e n t i a t i o n , l o g a r i t h m s , p o w e r s , a n d t r i g o n o m e t r i c f u n c t i o n s a r e s u p p o r t e d , t y p i c a l l y r e q u i r i n g a c o m b i n a t i o n o f r e s h a r i n g ( b e t w e e n A S S a n d M S S ) , l o c a l c o m p u t a t i o n s , a n d o n e t o t h r e e r o u n d s o f o n l i n e c o m m u n i c a t i o n . < / l i > < / u l > < p > T h e r o u n d c o m p l e x i t y a n d c o m m u n i c a t i o n c o s t s a r e t a b u l a t e d a s f o l l o w s : < / p > < d i v c l a s s = ′ o v e r f l o w − x − a u t o m a x − w − f u l l m y − 4 ′ > < t a b l e c l a s s = ′ t a b l e b o r d e r − c o l l a p s e w − f u l l ′ s t y l e = ′ t a b l e − l a y o u t : f i x e d ′ > < t h e a d > < t r > < t h > P r o t o c o l < / t h > < t h > R o u n d s < / t h > < t h > C o m m u n i c a t i o n < / t h > < / t r > < / t h e a d > < t b o d y > < t r > < t d > S e c M u l < / t d > < t d > 1 < / t d > < t d > 4 -bit fields.</li>
<li><strong>Element-wise Functions:</strong> Secure exponentiation, logarithms, powers, and trigonometric functions are supported, typically requiring a combination of resharing (between ASS and MSS), local computations, and one to three rounds of online communication.</li>
</ul>
<p>The round complexity and communication costs are tabulated as follows:</p>
<div class='overflow-x-auto max-w-full my-4'><table class='table border-collapse w-full' style='table-layout: fixed'><thead><tr>
<th>Protocol</th>
<th>Rounds</th>
<th>Communication</th>
</tr>
</thead><tbody><tr>
<td>SecMul</td>
<td>1</td>
<td>4 − bi t f i e l d s . < / l i >< l i >< s t ro n g > El e m e n t − w i se F u n c t i o n s :< / s t ro n g > S ec u ree x p o n e n t ia t i o n , l o g a r i t hm s , p o w ers , an d t r i g o n o m e t r i c f u n c t i o n s a res u pp or t e d , t y p i c a ll yre q u i r in g a co mbina t i o n o f res ha r in g ( b e tw ee n A SS an d MSS ) , l oc a l co m p u t a t i o n s , an d o n e t o t h reero u n d so f o n l in eco mm u ni c a t i o n . < / l i >< / u l >< p > T h ero u n d co m pl e x i t y an d co mm u ni c a t i o n cos t s a re t ab u l a t e d a s f o ll o w s :< / p >< d i v c l a ss = ′ o v er f l o w − x − a u t o ma x − w − f u ll m y − 4 ′ >< t ab l ec l a ss = ′ t ab l e b or d er − co ll a p se w − f u l l ′ s t y l e = ′ t ab l e − l a yo u t : f i x e d ′ >< t h e a d >< t r >< t h > P ro t oco l < / t h >< t h > R o u n d s < / t h >< t h > C o mm u ni c a t i o n < / t h >< / t r >< / t h e a d >< t b o d y >< t r >< t d > S ec M u l < / t d >< t d > 1 < / t d >< t d > 4 < / t d > < / t r > < t r > < t d > S e c M u l R e s < / t d > < t d > 1 < / t d > < t d > 2 </td>
</tr>
<tr>
<td>SecMulRes</td>
<td>1</td>
<td>2 < / t d >< / t r >< t r >< t d > S ec M u lR es < / t d >< t d > 1 < / t d >< t d > 2 < / t d > < / t r > < t r > < t d > S e c A d d R e s < / t d > < t d > 2 < / t d > < t d > 2 </td>
</tr>
<tr>
<td>SecAddRes</td>
<td>2</td>
<td>2 < / t d >< / t r >< t r >< t d > S ec A dd R es < / t d >< t d > 2 < / t d >< t d > 2 < / t d > < / t r > < t r > < t d > S e c C o m < / t d > < t d > 3 < / t d > < t d > 2 </td>
</tr>
<tr>
<td>SecCom</td>
<td>3</td>
<td>2 < / t d >< / t r >< t r >< t d > S ec C o m < / t d >< t d > 3 < / t d >< t d > 2 + 2 < / t d > < / t r > < t r > < t d > S e c E x p < / t d > < t d > 1 < / t d > < t d > 2 + 2</td>
</tr>
<tr>
<td>SecExp</td>
<td>1</td>
<td>2 + 2 < / t d >< / t r >< t r >< t d > S ec E x p < / t d >< t d > 1 < / t d >< t d > 2 < / t d > < / t r > < t r > < t d > S e c L o g < / t d > < t d > 2 < / t d > < t d > 2 </td>
</tr>
<tr>
<td>SecLog</td>
<td>2</td>
<td>2 < / t d >< / t r >< t r >< t d > S ec L o g < / t d >< t d > 2 < / t d >< t d > 2 < / t d > < / t r > < t r > < t d > S e c P o w < / t d > < t d > 3 < / t d > < t d > ( 2 n + 2 ) </td>
</tr>
<tr>
<td>SecPow</td>
<td>3</td>
<td>(2n + 2) < / t d >< / t r >< t r >< t d > S ec P o w < / t d >< t d > 3 < / t d >< t d > ( 2 n + 2 ) < / t d > < / t r > < t r > < t d > S e c S i n / S e c C o s < / t d > < t d > 1 < / t d > < t d > 4 </td>
</tr>
<tr>
<td>SecSin/SecCos</td>
<td>1</td>
<td>4 < / t d >< / t r >< t r >< t d > S ec S in / S ec C os < / t d >< t d > 1 < / t d >< t d > 4 < / t d > < / t r > < t r > < t d > D i v i s i o n < / t d > < t d > 3 < / t d > < t d > 6 </td>
</tr>
<tr>
<td>Division</td>
<td>3</td>
<td>6 < / t d >< / t r >< t r >< t d > D i v i s i o n < / t d >< t d > 3 < / t d >< t d > 6 < / t d > < / t r > < t r > < t d > P r o d u c t < / t d > < t d > m i n ( 3 , </td>
</tr>
<tr>
<td>Product</td>
<td>min(3, < / t d >< / t r >< t r >< t d > P ro d u c t < / t d >< t d > min ( 3 , ) < / t d > < t d > ( 2 n + 2 ) )</td>
<td>(2n+2) ) < / t d >< t d > ( 2 n + 2 ) o r ( 4 n − 4 ) or (4n-4) or ( 4 n − 4 ) < / t d > < / t r > < / t b o d y > < / t a b l e > < / d i v > < p > H e a d − t o − h e a d w i t h p r i o r s c h e m e s , t h e A S S − b a s e d p r o t o c o l s i n ( < a h r e f = " / p a p e r s / 2009.05356 " t i t l e = " " r e l = " n o f o l l o w " d a t a − t u r b o = " f a l s e " c l a s s = " a s s i s t a n t − l i n k " x − d a t a x − t o o l t i p . r a w = " " > X i o n g e t a l . , 2020 < / a > ) a c h i e v e d e m o n s t r a b l y l o w e r r o u n d a n d c o m m u n i c a t i o n c o m p l e x i t y f o r c o m p a r i s o n a n d d i v i s i o n f u n c t i o n a l i t i e s . < / p > < h 2 c l a s s = ′ p a p e r − h e a d i n g ′ i d = ′ a d d i t i v e − s e c r e t − s h a r i n g − o v e r − a d d i t i v e − c o d e s ′ > 5. A d d i t i v e S e c r e t S h a r i n g o v e r A d d i t i v e C o d e s < / h 2 > < p > A S S c a n b e i n s t a n t i a t e d m o r e g e n e r a l l y u s i n g a d d i t i v e c o d e s o v e r </td>
</tr>
</tbody></table></div>
<p>Head-to-head with prior schemes, the ASS-based protocols in (<a href="/papers/2009.05356" title="" rel="nofollow" data-turbo="false" class="assistant-link" x-data x-tooltip.raw="">Xiong et al., 2020</a>) achieve demonstrably lower round and communication complexity for comparison and division functionalities.</p>
<h2 class='paper-heading' id='additive-secret-sharing-over-additive-codes'>5. Additive Secret Sharing over Additive Codes</h2>
<p>ASS can be instantiated more generally using additive codes over < / t d >< / t r >< / t b o d y >< / t ab l e >< / d i v >< p > He a d − t o − h e a d w i t h p r i orsc h e m es , t h e A SS − ba se d p ro t oco l s in ( < ah re f = "/ p a p ers /2009.05356" t i tl e = "" re l = " n o f o ll o w " d a t a − t u r b o = " f a l se " c l a ss = " a ss i s t an t − l ink " x − d a t a x − t oo lt i p . r a w = "" > X i o n g e t a l . , 2020 < / a > ) a c hi e v e d e m o n s t r ab l y l o w erro u n d an d co mm u ni c a t i o n co m pl e x i t y f orco m p a r i so nan dd i v i s i o n f u n c t i o na l i t i es . < / p >< h 2 c l a ss = ′ p a p er − h e a d in g ′ i d = ′ a dd i t i v e − secre t − s ha r in g − o v er − a dd i t i v e − co d e s ′ > 5. A dd i t i v e S ecre tS ha r in g o v er A dd i t i v e C o d es < / h 2 >< p > A SS c anb e in s t an t ia t e d m ore g e n er a ll y u s in g a dd i t i v eco d eso v er , a s f o r m a l i z e d b y K i m a n d L e e ( < a h r e f = " / p a p e r s / 1701.04183 " t i t l e = " " r e l = " n o f o l l o w " d a t a − t u r b o = " f a l s e " c l a s s = " a s s i s t a n t − l i n k " x − d a t a x − t o o l t i p . r a w = " " > K i m e t a l . , 2017 < / a > ) . A n a d d i t i v e c o d e , as formalized by Kim and Lee (<a href="/papers/1701.04183" title="" rel="nofollow" data-turbo="false" class="assistant-link" x-data x-tooltip.raw="">Kim et al., 2017</a>). An additive code , a s f or ma l i ze d b yK iman d L ee ( < ah re f = "/ p a p ers /1701.04183" t i tl e = "" re l = " n o f o ll o w " d a t a − t u r b o = " f a l se " c l a ss = " a ss i s t an t − l ink " x − d a t a x − t oo lt i p . r a w = "" > K im e t a l . , 2017 < / a > ) . A na dd i t i v eco d e o f l e n g t h of length o f l e n g t h o v e r over o v er i s a n a d d i t i v e s u b g r o u p o f is an additive subgroup of i s ana dd i t i v es u b g ro u p o f , i n h e r e n t l y a v e c t o r s p a c e o v e r , inherently a vector space over , inh ere n tl y a v ec t ors p a ceo v er w i t h g e n e r a t o r m a t r i x with generator matrix w i t h g e n er a t or ma t r i x o f d i m e n s i o n s of dimensions o fd im e n s i o n s , , , . T h e s e c r e t i s e n c o d e d i n t o t h e f i r s t c o o r d i n a t e . The secret is encoded into the first coordinate . T h esecre t i se n co d e d in t o t h e f i rs t coor d ina t e o f a c o d e w o r d of a codeword o f a co d e w or d , w h e r e , where , w h ere i s a r a n d o m b i n a r y i n f o r m a t i o n v e c t o r c o n s t r a i n e d s o is a random binary information vector constrained so i s a r an d o mbina ry in f or ma t i o n v ec t orco n s t r ain e d so f o r s e c r e t for secret f orsecre t . E a c h p a r t i c i p a n t . Each participant . E a c h p a r t i c i p an t r e c e i v e s s h a r e receives share rece i v ess ha re . < / p > < p > U n i f o r m i t y o f .</p>
<p>Uniformity of . < / p >< p > U ni f or mi t yo f o v e r t h e a f f i n e h y p e r p l a n e g u a r a n t e e s t h a t a l l s h a r e s ( e x c e p t over the affine hyperplane guarantees that all shares (except o v er t h e a ff in e h y p er pl an e gu a r an t ees t ha t a ll s ha res ( e x ce pt ) a r e i n d e p e n d e n t o f ) are independent of ) a re in d e p e n d e n t o f . < / p > < h 2 c l a s s = ′ p a p e r − h e a d i n g ′ i d = ′ r e c o n s t r u c t i o n − a n d − a c c e s s − s t r u c t u r e s − i n − c o d e − b a s e d − s c h e m e s ′ > 6. R e c o n s t r u c t i o n a n d A c c e s s S t r u c t u r e s i n C o d e − B a s e d S c h e m e s < / h 2 > < p > U n l i k e l i n e a r c o d e − b a s e d s c h e m e s , a d d i t i v e c o d e s o v e r .</p>
<h2 class='paper-heading' id='reconstruction-and-access-structures-in-code-based-schemes'>6. Reconstruction and Access Structures in Code-Based Schemes</h2>
<p>Unlike linear code-based schemes, additive codes over . < / p >< h 2 c l a ss = ′ p a p er − h e a d in g ′ i d = ′ reco n s t r u c t i o n − an d − a ccess − s t r u c t u res − in − co d e − ba se d − sc h e m e s ′ > 6. R eco n s t r u c t i o nan d A ccess St r u c t u res in C o d e − B a se d S c h e m es < / h 2 >< p > U n l ik e l in e a rco d e − ba se d sc h e m es , a dd i t i v eco d eso v er r e q u i r e t w o r o u n d s f o r r e c o n s t r u c t i o n . T h e t r a c e − i n n e r p r o d u c t , u s i n g t h e d u a l c o d e require two rounds for reconstruction. The trace-inner product, using the dual code re q u i re tw oro u n d s f orreco n s t r u c t i o n . T h e t r a ce − inn er p ro d u c t , u s in g t h e d u a l co d e , y i e l d s t h r e e c l a s s e s , yields three classes , y i e l d s t h reec l a sses o f d u a l c o d e w o r d s w h o s e f i r s t c o o r d i n a t e i s of dual codewords whose first coordinate is o fd u a l co d e w or d s w h ose f i rs t coor d ina t e i s , r e s p e c t i v e l y . E a c h s u c h c o d e w o r d p r o d u c e s a t r a c e e q u a t i o n , respectively. Each such codeword produces a trace equation , res p ec t i v e l y . E a c h s u c h co d e w or d p ro d u ces a t r a cee q u a t i o n r e l a t i n g t o t h e s e c r e t , b u t o n l y t h e c o m b i n a t i o n o f t w o i n d e p e n d e n t e q u a t i o n s ( f r o m d i s t i n c t relating to the secret, but only the combination of two independent equations (from distinct re l a t in g t o t h esecre t , b u t o n l y t h eco mbina t i o n o f tw o in d e p e n d e n t e q u a t i o n s ( f ro m d i s t in c t ) s u f f i c e s t o u n i q u e l y r e c o v e r ) suffices to uniquely recover ) s u ff i ces t o u ni q u e l yreco v er . T h i s t w o − s t e p s t r u c t u r e d e f i n e s t h e a c c e s s s t r u c t u r e : < / p > < u l > < l i > < s t r o n g > A u t h o r i z e d S e t s : < / s t r o n g > A n y p a i r . This two-step structure defines the access structure:</p>
<ul>
<li><strong>Authorized Sets:</strong> Any pair . T hi s tw o − s t e p s t r u c t u re d e f in es t h e a ccesss t r u c t u re :< / p >< u l >< l i >< s t ro n g > A u t h or i ze d S e t s :< / s t ro n g > A n y p ai r w i t h with w i t h , , , f o r for f or , w h e r e , where , w h ere i s t h e c o l l e c t i o n o f s u p p o r t s o f c o d e w o r d s i n is the collection of supports of codewords in i s t h eco ll ec t i o n o f s u pp or t so f co d e w or d s in o m i t t i n g t h e s e c r e t h o l d e r . < / l i > < l i > < s t r o n g > M i n i m a l A c c e s s P a i r s : < / s t r o n g > P a i r s w h e r e n e i t h e r c o m p o n e n t s t r i c t l y c o n t a i n s t h e s u p p o r t o f a s m a l l e r d u a l c o d e w o r d i n omitting the secret holder.</li>
<li><strong>Minimal Access Pairs:</strong> Pairs where neither component strictly contains the support of a smaller dual codeword in o mi tt in g t h esecre t h o l d er . < / l i >< l i >< s t ro n g > M inima l A ccess P ai rs :< / s t ro n g > P ai rs w h ere n e i t h erco m p o n e n t s t r i c tl yco n t ain s t h es u pp or t o f a s ma ll er d u a l co d e w or d in . < / l i > < / u l > < p > F o r s e l f − d u a l a d d i t i v e c o d e s , m i n i m a l a c c e s s p a i r s c o r r e s p o n d d i r e c t l y t o p a i r s o f m i n i m a l s u p p o r t s i n d i s t i n c t .</li>
</ul>
<p>For self-dual additive codes, minimal access pairs correspond directly to pairs of minimal supports in distinct . < / l i >< / u l >< p > F orse l f − d u a l a dd i t i v eco d es , minima l a ccess p ai rscorres p o n dd i rec tl y t o p ai rso f minima l s u pp or t s in d i s t in c t − c l a s s e s . < / p > < h 2 c l a s s = ′ p a p e r − h e a d i n g ′ i d = ′ a p p l i c a t i o n s − p e r f o r m a n c e − a n d − e r r o r − d e t e c t i o n ′ > 7. A p p l i c a t i o n s , P e r f o r m a n c e , a n d E r r o r D e t e c t i o n < / h 2 > < p > A S S f o r m s t h e c o r e o f s e c u r e t w o − p a r t y c o m p u t a t i o n p r o t o c o l s w i t h c o n s t a n t r o u n d s a n d m i n i m a l b a n d w i d t h — p r o p e r t i e s d e m o n s t r a t e d i n h i g h − t h r o u g h p u t c l o u d c o m p u t a t i o n a n d o t h e r p r i v a c y − p r e s e r v i n g s e t t i n g s ( < a h r e f = " / p a p e r s / 2009.05356 " t i t l e = " " r e l = " n o f o l l o w " d a t a − t u r b o = " f a l s e " c l a s s = " a s s i s t a n t − l i n k " x − d a t a x − t o o l t i p . r a w = " " > X i o n g e t a l . , 2020 < / a > ) . F o r c o d e − b a s e d v a r i a n t s : < / p > < u l > < l i > < s t r o n g > E x a m p l e s o f A d d i t i v e C o d e s : < / s t r o n g > T h e h e x a c o d e ( -classes.</p>
<h2 class='paper-heading' id='applications-performance-and-error-detection'>7. Applications, Performance, and Error Detection</h2>
<p>ASS forms the core of secure two-party computation protocols with constant rounds and minimal bandwidth—properties demonstrated in high-throughput cloud computation and other privacy-preserving settings (<a href="/papers/2009.05356" title="" rel="nofollow" data-turbo="false" class="assistant-link" x-data x-tooltip.raw="">Xiong et al., 2020</a>). For code-based variants:</p>
<ul>
<li><strong>Examples of Additive Codes:</strong> The hexacode ( − c l a sses . < / p >< h 2 c l a ss = ′ p a p er − h e a d in g ′ i d = ′ a ppl i c a t i o n s − p er f or man ce − an d − error − d e t ec t i o n ′ > 7. A ppl i c a t i o n s , P er f or man ce , an d E rrorDe t ec t i o n < / h 2 >< p > A SS f or m s t h ecoreo f sec u re tw o − p a r t yco m p u t a t i o n p ro t oco l s w i t h co n s t an t ro u n d s an d minima l ban d w i d t h — p ro p er t i es d e m o n s t r a t e d inhi g h − t h ro ug h p u t c l o u d co m p u t a t i o nan d o t h er p r i v a cy − p reser v in g se tt in g s ( < ah re f = "/ p a p ers /2009.05356" t i tl e = "" re l = " n o f o ll o w " d a t a − t u r b o = " f a l se " c l a ss = " a ss i s t an t − l ink " x − d a t a x − t oo lt i p . r a w = "" > X i o n g e t a l . , 2020 < / a > ) . F orco d e − ba se d v a r ian t s :< / p >< u l >< l i >< s t ro n g > E x am pl eso f A dd i t i v e C o d es :< / s t ro n g > T h e h e x a co d e ( ) , d o d e c a c o d e Q C ), dodecacode QC ) , d o d ec a co d e QC ( ( ( ) , a n d ), and ) , an d ( ( ( ) i l l u s t r a t e s c h e m e s w i t h e x t r e m a l p a r a m e t e r s a n d a c c e s s s t r u c t u r e s m a t c h i n g t h e p r o p e r t i e s d i s c u s s e d i n ( < a h r e f = " / p a p e r s / 1701.04183 " t i t l e = " " r e l = " n o f o l l o w " d a t a − t u r b o = " f a l s e " c l a s s = " a s s i s t a n t − l i n k " x − d a t a x − t o o l t i p . r a w = " " > K i m e t a l . , 2017 < / a > ) . < / l i > < l i > < s t r o n g > G e n e r a l i z e d 2 − D e s i g n s : < / s t r o n g > T h e a c c e s s s t r u c t u r e s i n t h e s e s c h e m e s a r e c o m b i n a t o r i a l l y u n i f o r m , a s t h e s u p p o r t s o f c o d e w o r d s f o r m g e n e r a l i z e d ) illustrate schemes with extremal parameters and access structures matching the properties discussed in (<a href="/papers/1701.04183" title="" rel="nofollow" data-turbo="false" class="assistant-link" x-data x-tooltip.raw="">Kim et al., 2017</a>).</li>
<li><strong>Generalized 2-Designs:</strong> The access structures in these schemes are combinatorially uniform, as the supports of codewords form generalized ) i ll u s t r a t esc h e m es w i t h e x t re ma lp a r am e t ers an d a ccesss t r u c t u res ma t c hin g t h e p ro p er t i es d i sc u sse d in ( < ah re f = "/ p a p ers /1701.04183" t i tl e = "" re l = " n o f o ll o w " d a t a − t u r b o = " f a l se " c l a ss = " a ss i s t an t − l ink " x − d a t a x − t oo lt i p . r a w = "" > K im e t a l . , 2017 < / a > ) . < / l i >< l i >< s t ro n g > G e n er a l i ze d 2 − Des i g n s :< / s t ro n g > T h e a ccesss t r u c t u res in t h esesc h e m es a reco mbina t or ia ll y u ni f or m , a s t h es u pp or t so f co d e w or d s f or m g e n er a l i ze d − d e s i g n s , e n s u r i n g s y m m e t r i c t r e a t m e n t o f a l l p a r t i c i p a n t s . < / l i > < l i > < s t r o n g > E r r o r D e t e c t i o n : < / s t r o n g > T h e m i n i m u m d i s t a n c e -designs, ensuring symmetric treatment of all participants.</li>
<li><strong>Error Detection:</strong> The minimum distance − d es i g n s , e n s u r in g sy mm e t r i c t re a t m e n t o f a llp a r t i c i p an t s . < / l i >< l i >< s t ro n g > E rrorDe t ec t i o n :< / s t ro n g > T h e minim u m d i s t an ce o f t h e c o d e d e t e r m i n e s t h e t o l e r a n c e f o r c h e a t e r s : u p t o of the code determines the tolerance for cheaters: up to o f t h eco d e d e t er min es t h e t o l er an ce f orc h e a t ers : u pt o e r r o r s c a n b e d e t e c t e d , a n d u p t o errors can be detected, and up to errorsc anb e d e t ec t e d , an d u pt o c o r r e c t e d t h r o u g h s t a n d a r d s y n d r o m e − b a s e d c o r r e c t i o n . < / l i > < l i > < s t r o n g > E f f i c i e n c y : < / s t r o n g > R e c o n s t r u c t i o n r e q u i r e s o n l y t w o r o u n d s o f c o m b i n i n g t r a c e s , w i t h e a c h p a r t i c i p a t i n g s h a r e c o n t r i b u t i n g o n e b i t . T h i s y i e l d s c o m p u t a t i o n a l e f f o r t corrected through standard syndrome-based correction.</li>
<li><strong>Efficiency:</strong> Reconstruction requires only two rounds of combining traces, with each participating share contributing one bit. This yields computational effort correc t e d t h ro ug h s t an d a r d sy n d ro m e − ba se d correc t i o n . < / l i >< l i >< s t ro n g > E ff i c i e n cy :< / s t ro n g > R eco n s t r u c t i o n re q u i reso n l y tw oro u n d so f co mbinin g t r a ces , w i t h e a c h p a r t i c i p a t in g s ha reco n t r ib u t in g o n e bi t . T hi sy i e l d sco m p u t a t i o na l e ff or t
The universality, efficiency, and combinatorial access structures of additive secret sharing ensure its continued relevance in privacy-preserving computation, distributed protocols, and cryptographic design (Xiong et al., 2020 , Kim et al., 2017 ).
Definition Search Book Streamline Icon: https://streamlinehq.com References (2)
