Additive Secret Sharing

Since all shares (except for one) are chosen randomly, every share is indistinguishable from a random
value and no one can learn anything about a by observing at most n − 1 shares.

Shamir Secret Sharing

Drawback of additive secret sharing is that parties can drop out and fail to provide their share.

–

For both sharing methods, holders of the secret shares can compute linear functions on their shares.

PrivaGram

encode index of the chosen image in a bit string using one-hot encoding
XOR

adding robustness

Shamir secret sharing instead of additive secret sharing

• robust against server dropping out, k-out-of-l PIR
• at least t+1 servers are required to reconstruct the secret., t-private-l-server PIR

t-private k-out-of-l PIR protocol

adding homomorphic encryption

collude

final protocol

tbd