# Verifiable Threshold Multi-Party Fully Homomorphic Encryption from Share Resharing
## 4 Verifiable Threshold Multi-Party Fully Homomorphic Encryption
### Distributed Threshold Decryption  
In this section, we will present the complete process of the decryption phase in the VTMFHE scheme. Similarly to the verification mechanism of the VDKeyGen protocol, our scheme's threshold decryption also achieves active security through commitment and NIZK. We will now define the process of the distributed threshold decryption protocol:  
1. After the homomorphic evaluations are completed, query the current set of online parties \(P_{online}\gets Q(Env)\). If \(|P_{online}|<t\), this step is re-executed. Otherwise, each party in \(P_{online}\) locally executes the algorithm \(sk_{i}\leftarrow\text{RS.Combine}\big{(}\mathbf{s}_{i}^{\prime},x_{1},\dots,x_{i} \big{)}\), and uses \(sk_{i}\) as its secret key share for decryption. 2. The parties in \(P_{online}\) execute the algorithm \(p_{i}\leftarrow\text{T.PartDec}\big{(}sk_{i},\hat{c}t\big{)}\) from TMHE. In this process, party \(P_{i}\) needs to sample a smudging noise \(\mathbf{e}_{i}^{sm}\overset{R}{\leftarrow}\left.\left[-B_{smdg},B_{smdg}\right]^{m}\right.\) and add it to the partial decryption result to prevent privacy leakage. Additionally, to achieve verifiability of the decryption result, the party needs to sample random values \(\mathbf{r}_{sk_{i}}\overset{R}{\leftarrow}\mathcal{D}_{r}\) and \(\mathbf{r}_{\mathbf{e}_{i}^{sm}}\overset{R}{\leftarrow}\mathcal{D}_{r}\) to commit to \(sk_{i}\) and \(\mathbf{e}_{i}^{sm}\), resulting in \(com_{sk_{i}}\leftarrow\text{C.Com}\big{(}sk_{i},\mathbf{r}_{sk_{i}}\big{)}\) and \(com_{\mathbf{e}_{i}^{sm}}\leftarrow\text{C.Com}\big{(}\mathbf{e}_{i}^{sm},\mathbf{r}_{\mathbf{e }_{i}^{sm}}\big{)}\). They then compute the proof \(\pi_{p_{i}}\leftarrow\text{N.Prove}(x,w,crs)\) according to the NP relation \(\mathcal{R}_{TDC}\), where \(x=\big{(}p_{i},\hat{c}t,com_{sk_{i}},com_{\mathbf{e}_{i}^{sm}}\big{)}\) and \(w=\big{(}sk_{i},\mathbf{r}_{sk_{i}},\mathbf{e}_{i}^{sm},\mathbf{r}_{\mathbf{e}_{i}^{sm}}\big{)}\). Together with the dimensions and format of the partial decryption results, this information serves as the sole basis for verifying data integrity during the decryption phase. Finally, the partial decryption result \(p_{i}\) and its corresponding proof \(\pi_{p_{i}}\) are output. 3. Given the input ciphertext \(\hat{c}t\), a set of partial decryption results \(D=\{p_{i}\}_{i\in P_{online}}\), and the corresponding proofs \(\big{\{}\pi_{p_{i}}\big{\}}_{i\in P_{online}}\), each proof is first verified against the relation \(\mathcal{R}_{TDC}\): \(\{0,1\}\leftarrow\text{N.Verify}\big{(}x,\pi_{p_{i}},crs\big{)}\). If any proof fails verification, the corresponding party is treated as an abnormal participant, and its partial decryption result is discarded. If the number of remaining valid partial decryption results exceeds \(t\), the algorithm \(\mu\leftarrow\text{T,FinDec}\big{(}D,\hat{c}t\big{)}\)  is executed to combine them and obtain the final decryption result \(\mu\). Otherwise, the decryption process is aborted, and all valid participants are required to re-execute the distributed decryption protocol and submit new partial decryption results. The distributed threshold decryption protocol is secure against malicious adversaries through the combined use of commitments and NIZK proofs. In summary, after reconstructing their decryption key shares, the current online participants perform partial decryption on the evaluated ciphertext and compute a proof \(\pi_{p_{i}}\) based on the \(\mathcal{R}_{TDC}\) relation in the NIZK system, to prove that \(p_{i}\) is a correctly computed partial decryption result obtained by following the protocol steps, using valid parameters and the corresponding secret key share on \(\hat{c}t\). This prevents the final ciphertext from being incorrectly decrypted or leaking sensitive information under malicious attacks.