## 2 Background
### Actively Secure Evaluation Protocol
Computation: Three types of calculations are permitted in the protocol, as follows: Addition: Given two confidential parameters \(\mathbf{g}_{1}\) and \(\mathbf{g}_{2}\), represented by their respective shares \(\llbracket\mathbf{g}_{1}\rrbracket_{T}\) and \(\llbracket\mathbf{g}_{2}\rrbracket_{T}\), participating devices collectively perform computations on these shared values: \[\llbracket\mathbf{g}_{1}\rrbracket_{T}+\llbracket\mathbf{g}_{2}\rrbracket_{T }=\llbracket\mathbf{g}_{1}+\mathbf{g}_{2}\rrbracket_{T}.\] (7) Multiply-by-constant: When provided with a constant \(c\in\mathbb{Z}_{p}\) and the shared secret \(\llbracket\mathbf{g}_{1}\rrbracket_{T}\) corresponding to element \(g_{1}\), all participating devices perform the multiplication operation to scale the threshold-shared value by the given scalar within the prime field: \[c\cdot\llbracket\mathbf{g}_{1}\rrbracket_{T}=\llbracket c\cdot\mathbf{g}_{1} \rrbracket_{T}.\] (8) Multiplication: For confidential parameters \(\mathbf{g}_{1}\) and \(\mathbf{g}_{2}\), represented as shared values \(\llbracket\mathbf{g}_{1}\rrbracket_{T}\) and \(\llbracket\mathbf{g}_{2}\rrbracket_{T}\), combined with precomputed randomized triples \(\llbracket\mathbf{x}\rrbracket_{T}\), \(\llbracket\mathbf{y}\rrbracket_{T}\), \(\llbracket\mathbf{z}\rrbracket_{T}\) (satisfying \(z=x\cdot y\)), the process is initiated by calculating \(\llbracket\mathbf{g}_{1}\rrbracket_{T}-\llbracket\mathbf{x}\rrbracket_{T}= \llbracket\mathbf{g}_{1}-\mathbf{x}\rrbracket_{T}\). Participants then employ a reconstruction protocol to publicly reveal masked values \(e=\mathbf{g}_{1}-x\) and \(d=\mathbf{g}_{2}-y\), which maintain their statistical randomness. Throughalgebraic expansion, the product \(\mathbf{g}_{1}\mathbf{g}_{2}\) equates to \(z+e\mathbf{g}_{2}+d\mathbf{g}_{1}-ed\). This formulation enables distributed computation, where each device independently calculates the combined result using the pre-shared triple components and revealed values. \[\llbracket\mathbf{g}_{1}\mathbf{g}_{2}\rrbracket_{T}=\llbracket z\rrbracket_{T}+ e\llbracket\mathbf{g}_{2}\rrbracket_{T}+d\llbracket\mathbf{g}_{1}\rrbracket_{T}-ed. \tag{9}\]
3. Reconstruction: During the secret reconstruction phase, each participant \(i\) acquires a secret share of \(\mathbf{g}\), denoted as \(\llbracket\mathbf{g}\rrbracket_{T}^{i}\). These shares are subsequently transmitted to the smart contract by all devices, enabling the recovery of \(\mathbf{g}\) through Lagrange interpolation. More precisely, given a polynomial \(f_{\mathbf{g}}(x)\) of degree \(T-1\), the reconstruction employs the Lagrange basis expression \(f_{\mathbf{g}}(x)=\sum_{i\in C}f_{\mathbf{g}}(i)\gamma_{i}(x)\). Here, \(C\in\mathbb{Z}_{p}\) satisfies \(|C|=T\), where \(\gamma_{i}(x)\) represents a polynomial of degree \(T-1\), defined as \(\gamma_{i}(x)=\prod_{j\in C,j\
eq i}\frac{x-j}{i-j}\). The recombination vector may then be straightforwardly determined through the calculation of \(r=\{r_{i}|i\in C\}\), defined by \(r_{i}=\gamma_{i}(0)\). Subsequently, the secret \(\mathbf{g}\) is recovered as follows: \[\mathbf{g}=\sum_{i\in C}r_{i}f_{\mathbf{g}}(i).\] (10)