Homomorphic Secret Sharing

A secret-sharing primitive in which servers locally evaluate an allowed function on input shares so their output shares reconstruct the function value without revealing the inputs.

Version

v3 · 2026-09-19 · History

Domain-specific #

2016

Domain group

Applied Sciences & Engineering

Origin domain

Computer Science & Software Engineering

Subdomain

Cryptography → Computer Science & Software Engineering

Aliases

HSS, Homomorphic sharing

Core Idea

Homomorphic secret sharing (HSS) lets a dealer encode an input \(x\) into shares \((x_1,\ldots,x_m)\) so each server locally computes an output share from its own input share and a public function \(f\). Combining the output shares reconstructs \(f(x)\), while any forbidden coalition's input shares hide \(x\). Interaction is absent or tightly limited during evaluation.

Unlike ordinary secret sharing, the shares support a declared function class beyond reconstruction. Unlike homomorphic encryption, HSS produces distributed shares rather than one ciphertext and can obtain information-theoretic or computational privacy under different constructions.

How would you explain it like I'm…

Secret Puzzle-Piece Math

Imagine you split a secret number into puzzle pieces and give one piece to each friend. No friend can figure out the secret from their piece. Each friend does the same math trick on their own piece without talking to the others. When you put their answers together, you get the answer to the trick done on your secret number.

Computing on Split-Up Secrets

Homomorphic secret sharing splits a secret input into shares and hands one to each of several computers. Each computer works on its own share using a public rule, with little or no chatting with the others, and makes an answer share. Combining all the answer shares gives the rule's result on the real secret. Meanwhile, groups of computers that aren't allowed to learn the secret can't figure it out from their shares. It only works for the kinds of rules the scheme was designed for.

Locally Evaluable Secret Shares

In homomorphic secret sharing (HSS), a dealer splits an input x into shares and gives one to each server. Each server applies a public function f to its own share locally, with no or very limited communication, to get an output share. Combining the output shares reconstructs f(x), while any forbidden group of servers learns nothing about x from their input shares. Ordinary secret sharing only lets you rebuild x itself; HSS supports computing a declared class of functions on the shares. Unlike homomorphic encryption, which works on one ciphertext, HSS produces distributed shares.

 

Homomorphic secret sharing lets a dealer encode an input x into shares (x_1, ..., x_m) distributed to m servers. Each server runs a local evaluation algorithm on its own share and a public function f, producing an output share, with evaluation requiring no interaction or only tightly limited interaction. A reconstruction step combines the output shares to give f(x). Correctness must hold for every function in a declared function class, and privacy requires that any forbidden coalition's input shares hide x. Compared with ordinary secret sharing, the shares support computation beyond plain reconstruction. Compared with homomorphic encryption, the result is a set of distributed shares rather than a single ciphertext, and depending on the construction privacy can be information-theoretic or computational.

Scope of Application

HSS supports private database analytics, distributed point and interval queries, secure aggregation, low-interaction multiparty computation, private inference, and computation on data replicated across noncolluding servers. Schemes vary sharply by function class—linear functions, low-degree polynomials, branching programs, or richer circuits—and by number of parties and corruption threshold.

Claims must include leakage from output, setup, metadata, aborts, and malicious behavior; input privacy alone is not a deployed-system security proof.

Clarity

Specify algorithms, parties, function family, correctness error, coalition threshold, semi-honest or malicious adversary, setup, computational assumption, share size, output size, and interaction count. Distinguish input shares, function keys, ciphertexts, and output shares. Do not use “homomorphic” without naming the supported operations.

Manages Complexity

HSS separates a global private computation into parallel local maps plus a small recombination step. The abstraction makes a three-way tradeoff explicit: expressiveness, communication/share size, and security assumptions. It also isolates trust: privacy can survive compromise of fewer than the threshold servers without requiring them to communicate about the secret.

Abstract Reasoning

1. Fix the function class and security parameter.
2. Define input sharing and coalition privacy.
3. Define local evaluation using only one share and public data.
4. Define output reconstruction.
5. Prove correctness for every allowed input and function.
6. Prove simulation or indistinguishability for the adversary view.
7. Account for preprocessing, randomness, errors, and leakage.
8. Measure share length, local work, download, and interaction.
9. Compare with FHE, FSS, and MPC under aligned assumptions.

Knowledge Transfer

The portable pattern is decompose protected state so independent local transformations recombine into the transformation of the whole. It transfers to distributed aggregates, coded computation, federated analytics, and privacy-preserving outsourcing. The proposed immediate parent is Decomposition.

Relationships to Other Abstractions

Current abstraction Homomorphic Secret Sharing Domain-specific

Parents (1) — outgoing typed relations

• Homomorphic Secret Sharing is a kind of Decomposition Prime

  Decomposition is the broader abstraction this entry instantiates.

Hierarchy path (1) — routes to 1 parentless root

• Homomorphic Secret Sharing → is a kind of Decomposition

Neighborhood in Abstraction Space

Homomorphic Secret Sharing sits in a sparse region of the domain-specific corpus (93^rd percentile for distinctiveness): few abstractions share its structure, so a faithful description tends to retrieve it precisely.

Family — Unclustered & Miscellaneous (2769 abstractions)

Nearest neighbors

• Dirichlet convolution — 0.78
• Monotonic Function — 0.78
• Real-valued function — 0.78
• Graph of a Function — 0.77
• Pseudo-polynomial transformation — 0.77

Computed from structural-signature embeddings · 2026-10-25