Paper 2026/1673

Linearly Homomorphic Secret Sharing and Multi-Party Computation with Unanimously Verifiable Deletion

Abstract

Certified deletion enables a party to prove that it has erased the sensitive information contained in a quantum state. Bartusek and Raizes (CRYPTO 2024) gave the first secret-sharing scheme with privately verifiable deletion. Subsequently, Katz and Sela (EUROCRYPT 2025) constructed secret-sharing schemes with publicly verifiable deletion under computational assumptions. Constructing such a publicly verifiable scheme without cryptographic assumptions remains open. In this work, we introduce an intermediate notion called unanimously verifiable deletion, where deletion certificates are verified jointly by the parties in the protocol. While private verification relies on the dealer and public verification allows any third party to verify deletion, unanimous verification assigns the verification responsibility to the parties in the secret-sharing scheme themselves. We construct an information-theoretically secure linearly homomorphic threshold secret-sharing batch scheme with adaptive unanimously verifiable deletion. In particular, to obtain its linear-homomorphic property, we exploit a linearly homomorphic structure of BB84-type states that enables linear operations on encoded values while preserving certified deletion. More generally, this structure can be used to upgrade certain primitives with certified deletion to their linearly homomorphic counterparts. As another major contribution, we demonstrate an application of this batch scheme by constructing outsourced multi-party computation (MPC) protocols for arbitrary arithmetic circuits. Our outsourced MPC has honest classical clients and quantum servers, and achieves adaptive unanimously verifiable deletion security in the trusted-preprocessing and security-with-abort setting, supports public output reconstruction, and is secure against malicious, rushing quantum server adversaries for any $t<n/2$, provided that throughout the online execution, at most $t$ corrupted servers remain undeleted and at least $t+1$ honest servers remain undeleted. Moreover, after successful finalization, all servers may be corrupted without revealing any information about the clients' inputs beyond the public output.