Homomorphic Secret Sharing¶

A secret-sharing primitive in which servers locally evaluate an allowed function on input shares so their output shares reconstruct the function value without revealing the inputs.

Version: v2 · 2026-09-06 · History
Domain-specific #: 2016
Origin domain: computer science
Subdomain: cryptography
Aliases: HSS, Homomorphic sharing

Core Idea¶

Homomorphic secret sharing (HSS) lets a dealer encode an input \(x\) into shares \((x_1,\ldots,x_m)\) so each server locally computes an output share from its own input share and a public function \(f\). Combining the output shares reconstructs \(f(x)\), while any forbidden coalition's input shares hide \(x\). Interaction is absent or tightly limited during evaluation.^[1]

Unlike ordinary secret sharing, the shares support a declared function class beyond reconstruction. Unlike homomorphic encryption, HSS produces distributed shares rather than one ciphertext and can obtain information-theoretic or computational privacy under different constructions.^[2]

The recognition invariant is private input sharing + per-server local function evaluation + output-share reconstruction of \(f(x)\) + correctness and coalition privacy for a declared function class.

Structural Signature¶

A secret input domain and output domain.
A sharing algorithm producing multiple correlated input shares.
A public function or function description.
A local evaluation algorithm for each server.
No access by one evaluator to the other shares.
Output shares combined by a reconstruction algorithm.
Correctness: reconstruction yields the intended function value.
Privacy against a declared coalition threshold and adversary model.
A supported function class and parameter regime.
Share length, evaluation time, and download complexity.
Computational assumptions or information-theoretic guarantees stated explicitly.
Optional preprocessing or keys separated from online inputs.

What It Is Not¶

HSS is not simply applying a homomorphism before Shamir secret sharing. Shamir shares are linearly homomorphic for additions and scalar multiplication, but general HSS requires a full local-evaluation and output-reconstruction interface for the claimed functions.

It is not identical to fully homomorphic encryption, generic multiparty computation, or function secret sharing. Function secret sharing splits a function into keys whose outputs combine; HSS typically shares inputs for local evaluation, though the areas are closely connected.^[3]

Scope of Application¶

HSS supports private database analytics, distributed point and interval queries, secure aggregation, low-interaction multiparty computation, private inference, and computation on data replicated across noncolluding servers. Schemes vary sharply by function class—linear functions, low-degree polynomials, branching programs, or richer circuits—and by number of parties and corruption threshold.

Claims must include leakage from output, setup, metadata, aborts, and malicious behavior; input privacy alone is not a deployed-system security proof.

Clarity¶

Specify algorithms, parties, function family, correctness error, coalition threshold, semi-honest or malicious adversary, setup, computational assumption, share size, output size, and interaction count. Distinguish input shares, function keys, ciphertexts, and output shares. Do not use “homomorphic” without naming the supported operations.

Manages Complexity¶

HSS separates a global private computation into parallel local maps plus a small recombination step. The abstraction makes a three-way tradeoff explicit: expressiveness, communication/share size, and security assumptions. It also isolates trust: privacy can survive compromise of fewer than the threshold servers without requiring them to communicate about the secret.

Abstract Reasoning¶

Fix the function class and security parameter.
Define input sharing and coalition privacy.
Define local evaluation using only one share and public data.
Define output reconstruction.
Prove correctness for every allowed input and function.
Prove simulation or indistinguishability for the adversary view.
Account for preprocessing, randomness, errors, and leakage.
Measure share length, local work, download, and interaction.
Compare with FHE, FSS, and MPC under aligned assumptions.

Knowledge Transfer¶

The portable pattern is decompose protected state so independent local transformations recombine into the transformation of the whole. It transfers to distributed aggregates, coded computation, federated analytics, and privacy-preserving outsourcing. The proposed immediate parent is Decomposition.

Examples¶

Additive evaluation. Additively shared inputs permit each server to add its shares locally; reconstructed outputs equal the sum of secrets.

Point-function analytics. Specialized HSS/FSS techniques let noncolluding servers answer private point or interval queries with compact shares.^[2]

Non-example. Encrypting a secret homomorphically, decrypting it, and then splitting the plaintext is not HSS because evaluation did not operate locally on secret shares.

Structural Tensions¶

Function expressiveness versus share size.
Information-theoretic privacy versus computational assumptions.
Local noninteraction versus preprocessing.
Honest-but-curious privacy versus malicious robustness.
Threshold trust versus server efficiency.
Input hiding versus output leakage.

Structural–Framed Character¶

Decomposition, local transformation, recombination, thresholding, and interface correctness are structural. Cryptographic simulation, secret shares, adversaries, function classes, and key sizes provide the constitutive frame.

Structural Core vs. Domain Accent¶

The portable core is commuting global evaluation with split representation and recombination. The domain accent is cryptographic input privacy against coalitions with formally bounded leakage and efficiency.

Decomposition is the proposed immediate parent. Privacy, Aggregation, Distribution, Homomorphism, Threshold, Computation, and Reconstruction are related. Later work studies download rate and the boundary between compact HSS and function classes.^[4]

The prospective queue contains one strict edge to prime:decomposition. No live DAG mutation is authorized.

Relationships to Other Abstractions¶

Current abstraction Homomorphic Secret Sharing Domain-specific

Parents (1) — more general patterns this builds on

Homomorphic Secret Sharing is a kind of Decomposition Prime

Decomposition is the proposed immediate parent.

Hierarchy path (1) — routes to 1 parentless root

Homomorphic Secret Sharing → Decomposition

Neighborhood in Abstraction Space¶

Homomorphic Secret Sharing sits in a sparse region of the domain-specific corpus (92^nd percentile for distinctiveness): few abstractions share its structure, so a faithful description tends to retrieve it precisely.

Family — Unclustered & Miscellaneous (1565 abstractions)

Nearest neighbors

Computed from structural-signature embeddings · 2026-09-08

Not to Be Confused With¶

Ordinary secret sharing.
Shamir sharing by itself.
Homomorphic encryption.
Function secret sharing.
Generic secure multiparty computation.
Threshold decryption.
Secure aggregation without the claimed function interface.

References¶

[1] Elette Boyle, Niv Gilboa, and Yuval Ishai, “Breaking the Circuit Size Barrier for Secure Computation under DDH,” CRYPTO 2016, LNCS 9814, 509–539, introducing homomorphic secret sharing constructions, doi:10.1007/978-3-662-53008-5_18. registry ↩

[2] Elette Boyle, Geoffroy Couteau, Niv Gilboa, Yuval Ishai, and Michele Orrù, “Homomorphic Secret Sharing: Optimizations and Applications,” ACM CCS 2018, 2105–2122, doi:10.1145/3243734.3243807. registry ↩a ↩b

[3] Elette Boyle, Niv Gilboa, and Yuval Ishai, “Function Secret Sharing,” EUROCRYPT 2015, LNCS 9057, 337–367, doi:10.1007/978-3-662-46803-6_12. registry ↩

[4] Ingerid Fosli, Yuval Ishai, Victor I. Kolobov, and Mary Wootters, “On the Download Rate of Homomorphic Secret Sharing,” ITCS 2022, LIPIcs 215, article 71, doi:10.4230/LIPIcs.ITCS.2022.71. registry ↩