The Homomorphic Properties of Shamir Secret Sharing

If I want to get the value of $s_1-s_2$, can I just use the minus operation for the secrets $s_1$ and $s_2$.
No, subtraction is not directly supported by the homomorphic properties of Shamir Secret Sharing. While addition of shares yields the shares of the sum of secrets, simply subtracting shares does not yield the shares of the difference of secrets.

To compute the shares of $s_1-s_2$, you would need to do the following:

1. Reconstruct $s_1$ and $s_2$ from their shares.
2. Compute $s_1-s_2$ to get the actual difference.
3. Share the difference $s_1-s_2$ using the secret sharing scheme to get new shares for the participants.

So subtraction requires reconstructing the original secrets, unlike addition which can be done directly on the shares while keeping the secrets encrypted. The homomorphic properties only support addition and scalar multiplication, not general subtraction.

The reason is that secret sharing schemes like Shamir’s are designed to make it difficult to reconstruct the actual secret values from shares alone. So operations that require knowing the secret values, like subtraction, cannot be done directly on the shares. Only operations that preserve the algebraic structure, like addition and scalar multiplication, are supported homomorphically.

Does this make sense? Let me know if you have any other questions!

How can I achieve the swap operation for two secrets such as $s_1,s_2$ in one vector via its homomorphic properties of Shamir Secret Sharing?
You’re right that the basic homomorphic properties of Shamir secret sharing do not directly support a “swap” operation on two shares. However, there is a technique to achieve this using additive homomorphism. Here is the basic idea:

1. Represent the two secrets $s_1$ and $s_2$ as vectors: $s_1=[s_{11},s_{12},...,s_{1n}]$ and $s_2=[s_{21},s_{22},...,s_{2n}]$ where $s_{ij}$ is the share of secret $s_i$ held by participant $j$.

2. Define a “swapping” vector $w=[w_1,w_2,...,w_n]$ where $w_j=s_{2j}-s_{1j}$ for all $j$. This vector represents the difference between the shares of the two secrets for each participant.

3. Compute the shares of the vector $s_1+w$ using the additivity property. This gives a new set of shares $[s_{11}+w_1,s_{12}+w_2,...,s_{1n}+w_n]$.

4. Distribute the new shares $[s_{11}+w_1,s_{12}+w_2,...,s_{1n}+w_n]$ to the participants.

5. Each participant can now subtract their individual $w_j$ value from their new share to recover the share they should have received for secret $s_2$.

6. The end result is that the shares for $s_1$ have been transformed into the shares for $s_2$, thereby achieving a “swap” of the two secrets in a homomorphic fashion.

The keys are: (1) Representing the secrets as vectors, (2) Defining a “difference” vector that represents swapping the secrets, (3) Using additive homomorphism to compute and distribute new shares, and (4) Having each participant locally subtract the difference to recover the swapped share.

Does this make sense? Let me know if you have any other questions!

The Answer from Perplexity

Shamir’s Secret Sharing scheme is an efficient secret sharing algorithm for distributing private information among a group so that the secret is split into multiple shares, which individually do not give any information about the secret. The shares are of the form $(x_0,f(x_0)),(x_1,f(x_1)),\dots ,(x_{n-1},f(x_{n-1}))$ where the $x_i$ are $n$ distinct nonzero elements of a finite field $\mathbb{F}$, and $f(x)$ is a polynomial of degree $k-1$ with coefficients in $\mathbb{F}$ [1].

To achieve the swap operation for two secrets such as $s_1,s_2$ in one vector via the homomorphic properties of Shamir Secret Sharing, we can use the fact that Shamir’s Secret Sharing is $(+,+)$-homomorphic, which means that the addition of two polynomial secrets equals the Lagrange’s interpolation of the sum-of-shares for the same subset of shares[2].

To swap $s_1$ and $s_2$, we can add $s_1$ and $s_2$ to obtain $s_1+s_2$, and then subtract $s_1$ from $s_2$ to obtain $s_2-s_1$. We can then use Shamir’s Secret Sharing to split $s_1+s_2$ and $s_2-s_1$ into shares and distribute them among the parties. The parties can then locally compute the sum and difference of the shares, respectively, to obtain the shares for $s_2$ and $s_1$, respectively[1].

In summary, we can use Shamir’s Secret Sharing scheme to achieve the swap operation for two secrets such as $s_1,s_2$ in one vector via its homomorphic properties. We can add $s_1$ and $s_2$ to obtain $s_1+s_2$, and then subtract $s_1$ from $s_2$ to obtain $s_2-s_1$. We can then use Shamir’s Secret Sharing to split $s_1+s_2$ and $s_2-s_1$ into shares and distribute them among the parties. The parties can then locally compute the sum and difference of the shares, respectively, to obtain the shares for $s_2$ and $s_1$, respectively[1].

Citations:
[1] https://crypto.stackexchange.com/questions/1483/how-do-you-find-a-single-cheater-in-shamir-secret-sharing
[2] https://crypto.stackexchange.com/questions/102465/shamirs-secret-sharing-homomorphism-for-different-degree-polynomials

By Perplexity at https://www.perplexity.ai/search/a1fda1b1-f078-48cd-93bd-efb478d8cbc0