{'fraction_non_alphanumeric': 0.03638218293097586, 'fraction_numerical': 0.010076968254458904, 'mean_word_length': 4.411843425894948, 'pattern_counts': {'":': 0, '<': 2, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 3, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Privacy in Distributed Computations based on Real Number Secret Sharing

Privacy preservation in distributed computations is an important subject as digitization and new technologies enable collection and storage of vast amounts of data, including private data belonging to individuals. To this end, there is a need for a privacy preserving computation framework that minimises the leak of private information during computations while being efficient enough for practical usage. This paper presents a step towards such a framework with the proposal of a real number secret sharing scheme that works directly on real numbers without the need for conversion to integers which is the case in related schemes. The scheme offers computations like addition, multiplication, and division to be performed directly on secret shared data (the cipher text version of the data). Simulations show that the scheme is much more efficient in terms of accuracy than its counterpart version based on integers and finite field arithmetic. The drawback with the proposed scheme is that it is not perfectly secure. However, we provide a privacy analysis of the scheme, where we show that the leaked information can be upper bounded and asymptotically goes to zero. To demonstrate the scheme, we use it to perform Kalman filtering directly on secret shared data.


Introduction
In recent years, there has been a rapid development of technologies for digitization and collection and storage of data. Consequently, various distributed algorithms for the efficient processing of the collected data are being developed in many research communities like signal processing, control, machine learning, and optimization. Simultaneously, concerns about privacy and the possible misuse of the data means a sudden big interest in embedding cryptographic methods into the distributed algorithms to achieve privacy preserving data processing, [1,2,3].
So far, efficient data processing and privacy preservation are two terms that seems difficult to combine since the cryptographic methods tend to bring a substantial overhead in either communication, computation or both. Moreover, security of cryptographic methods such as secret sharing and homomorphic encryption relies on modular arithmetic, which entails that all data to be protected must be integers and computations on this data must be translated into equivalent computations using finite field arithmetic, [4,5,6]. The drawbacks of this are, for instance, loss of precision in the solution (because of rounding decimal numbers to integers) and that many operations such as division becomes very intractable.
For some applications, efficient processing, that is not constrained to finite field arithmetic, is crucial. Thus, it becomes relevant to consider a trade-off between privacy and efficiency since after all; limited privacy is better than none.
To this end, we explore distributed computations in the secure multiparty computation [7] setup, where only cipher texts travel between participants and plain texts stay hidden throughout computations. Essentially, what we propose is a real number secret sharing scheme that circumvents the disadvantages of using only integers and modular arithmetic and consequently achieves improved performance compared to state-of-the-art methods. The scheme works directly on real numbers and we show straight forward implementations of addition, multiplication and division performed directly on the secret shared data. The shortcoming to our proposed scheme is that it does not guarantee perfect security like its counterpart version based on integers and modular arithmetic.
However, we carefully control the amount of leaked information and provide information theoretic results to support our claims.
As a motivating example, we demonstrate the use of the proposed scheme to perform privacy preserving Kalman filtering. That is, we consider a linear dynamical system with state-transition matrix A, control input matrix B, control input u k , process noise w k and state vector x k : Observations (or measurements) of the state vector, z k are modeled as where H is the observation matrix and v k is the measurement noise. The objective is to estimate the true state of the system from the noisy observations, which is optimally done using the Kalman filter. The privacy concern emerges from the measurements which could be private data that potentially leaks private information. Scenarios where a problem of this form appears, could for instance be traffic monitoring [8], medical monitoring [9], and consumption forecasting [10]. The problem of privacy preserving Kalman filtering has already been studied for instance in [11] that uses a form of data compression to preserve privacy of measurements, [12] that base the privacy on a combination of homomorphic encryption and secure multiparty computation techniques, and [13] that relies on differential privacy. These existing works all suffer from a degradation in output utility compared to the none-privacy preserving solution due to noise insertion or to the previously mentioned rounding of reals to integers. We will show that a privacy aware Kalman filter based on our real number secret sharing scheme achieves significantly improved output utility. Furthermore, we compare our privacy preserving Kalman filter to the one proposed in [12] and show that ours has a reduction in computation and communication overhead.

State of the art
The typical way of preserving privacy of real numbers is to simply discard the decimals and keep the integer part which is the suitable representation for most cryptographic methods, [14,15,16] . The induced error bounds caused by the truncation, can be made small by introducing scaling constants prior to truncation. However, the size of the modular field, in which the cryptographic calculations take place, increases according to the size of the scaling factors and thus cannot be made arbitrarily big.
One of the first more direct ways to deal with non-integers in cryptographic computations, was made in 2010 by Catrina et al. in [17]. Their proposed solution builds on a fixed-point representation of real numbers that allows the use of Shamir's secret sharing scheme as the underlying cryptographic technique. In [18] this solution was applied to privacy preserving linear programming. Along this line of research, [19] proposed in 2013 a similar secure floating-point computation scheme also based on a linear secret sharing framework. In 2016, [20] proposed other techniques for representing secure real numbers suitable for a secret sharing framework with their so-called golden-section and logarithmic number formats.
Apart from secret sharing based secure computation frameworks, there has also been several attempts to secure real number computations in homomorphic encryption based frameworks, [21,22,23]. Analog to the approach based on secret sharing, the main idea here is to convert the real number into a multi-bit binary integer to achieve a fixed precision presentation of a real number. The drawback with these approaches is the time consuming computational overhead with homomorphic encryption and also that the proposed schemes only offer addition and in some cases multiplication of cipher-texts. This is in contrast to our scheme that allows addition, multiplication and division to be performed efficiently on the cipher-text data.
Finally, our work is closely related to [24] that considers secret sharing schemes (SSS) over infinite domains, e.g. the real number line. Among others, they propose a scheme very similar to ours which is based on polynomials and Lagrange interpolation. However, they consider a game between a dealer and an adversary, which is for the dealer to chose a scheme and a secret such that the adversary has the least probability of guessing the secret. On the contrary, our work assumes that a group of parties would like to perform computations without exposing data belonging to the individual parties. In this sense, the secret is the data, and not something we can chose to our liking. Also, we provide a quantification of the privacy loss of the scheme and propose how to use the scheme for secure multiparty computation (SMPC), which [24] does not.

Contribution
The paper puts forth a real number secret sharing scheme which bypasses the usual restrictions to integer secrets and finite field computations. This makes the scheme very practical as solutions can be calculated with high precision and without the need for computations being performed with modular arithmetic.
The scheme performs the same or with significant less computation and communication complexity compared to state-of-the-art methods. In Table 1  The main contribution of the paper can be summarized as: • To the best of our knowledge, this is the first attempt for a SMPC scheme that works directly on the real number line and consequently offers a trade-off between privacy and practicality.
• The proposed scheme bypasses the requirements for modular arithmetic and integer secrets which is in contrast to state-of-the-art SMPC techniques.
• The scheme allows addition, multiplication and division to be performed directly on shares (ciphertext version of the data), opposed to related schemes that typically only allow addition and in some cases multiplication.
• The paper provides an in-depth analysis of the privacy guaranties of the scheme as well as a quantification of leaked data.

Outline
The paper proceeds in section 2 by introducing the preliminaries and giving motivation for the work. Section 3 states formally the problem of the paper, while section 4 presents the proposed scheme and the privacy analysis. In section 5 we give a numerical evaluation of the proposed scheme, while section 6 provides simulations of the scheme for Kalman filtering and finally, section 7 concludes the paper.

Preliminaries and Motivation
In this section, we clarify our notation and terminology and afterwards we give a brief introduction to the concept of secret sharing and SMPC, while subsequently discussing their shortcomings which motivates the work in this paper.

Notation and Terminology
Let P be an index set of n > 2 participants. We assume that each participant p ∈ P can communicate privately with each of the other participants j ∈ P or alternatively that there exists a number of computing parties that  In the remaining of the paper we do not make a distinction between these two scenarios, but remark that any presented method can straightforward be used in both.
Concerning notation, let s be a secret value belonging either to a participant or to an external entity providing secret data. and t is an integer threshold, the shares can be deciphered and s recreated.

Secret Sharing, SMPC and their shortcomings
Secret sharing in general lets a party "share" a secret among n participants, such that at least t + 1 ≤ n of the participants must cooperate to learn the secret and opposite; no subset of less than t + 1 participants gets information about the secret. There are many different secret sharing schemes, each tailored to different use cases. Perhaps the most simple (and intuitive) secret sharing scheme is the additive one [7], where t = n meaning that all shares are needed to reconstruct the secret. In this scheme, the shares {s[p]} p∈P of the secret s satisfy that where q is a large prime number. When choosing n − 1 of the shares uniformly on [0, q − 1] and the last share such that (3) holds, the modular arithmetic ensures that all shares are uniformly distributed. This means that the scheme is perfectly secure since the uniform distribution holds no information about the secret. The disadvantage is that s must be an element of F q , where F q is a finite field of q elements.
Many secret sharing schemes, like the additive one and Shamirs scheme [25], are very useful in SMPC protocols. These protocols, lets n participants compute a function, that takes as input a private value from each participant, while keeping the private values secret. For instance, for secrets s 1 , s 2 ∈ F q , the sum s 1 + s 2 can be calculated directly on additive shares of each of the secrets; where The drawback is that q must be bigger than s 1 +s 2 in order to get the correct result and if no information about the secret data is available, it can be difficult to choose q.
More advanced schemes like Shamir's scheme, also allows multiplication of secrets directly on the shares and in principle also division. However, the division will be finite field division [26] and not real number division. As introduced in [14], there are complicated tricks, which usually involve bit-decomposition of the secrets, that will enable the computation of real number division performed on the shares. However, say that the secret to be divided is −3 (which would be represented as q − 3 in F q ), what effectively would happen is the division of q − 3 and not −3, which would lead to incorrect results. This is an example of how finite field arithmetic complicates the computations which leads to part of our motivation to introduce a real number secret sharing scheme that does not depend on finite field arithmetic.

Problem Statement
Upon the discussion in section 2.2, we conclude that the problem of preserving privacy of real numbers without being limited to finite field arithmetic is indeed a relevant topic in privacy preserving computations. To address this problem, we will propose a real number secret sharing scheme. To this end, we start with the following definition.

Definition 1 (Real Number Secret Sharing Scheme). A real number secret
sharing scheme consists of two algorithms; share and recon. share(s, t, P) = {s[p]} p∈P takes a secret s ∈ R, the threshold t ∈ N with t < n and the indices of n participants P and outputs a share s[p] ∈ R for each participant p ∈ P.
The algorithm recon({s[p]} p∈T ) = s outputs the secret s upon inputting at least t + 1 shares from any set of participants p ∈ T , where T ⊆ P with |T | > t.
We have the following requirements for the real number secret sharing scheme.
where h(X) is the entropy of the random variable X and h(X|Y ) is the conditional entropy of X given the random variable Y . The mutual information I(X; Y ) can be interpreted as the reduction in uncertainty about X one has after learning the outcome of Y (and vice versa since mutual information is symmetric). To this end, we use S and S[p] to denote the random variables that has s and s[p] as outcomes, and we require that for where T ⊂ P with |T | ≤ t.
• Computations directly on shares. At least the operations addition, multiplication, and division, should be applicable directly on shares. That is, for any secrets s 1 , s 2 ∈ R and properly defined protocols add, mult, and inv, the following should hold The problem of the paper is to define a real number secret sharing scheme which satisfies the listed requirements assuming that each participant follows the protocol.

Proposed Method
As mentioned already, we take great inspiration from Shamir's SSS [25], when proposing our real number SSS. To give some intuition, we explain the derivation of the proposed scheme in comparison to Shamir's scheme.
The approach in Shamir's scheme is to start by choosing t coefficients {c j } j∈T , where T = {1, . . . , t}, from F q uniformly and afterwards defining the polynomial where s ∈ F q as usual is the secret. The shares of s are then defined as For the real number SSS we want to avoid modular arithmetic and have s ∈ R and therefore one idea is to write each share s[p] as where each c j is Gaussian distributed. We choose the Gaussian distribution because this is the maximum entropy distribution for a random variable on the real number line having a finite mean and variance, [27, p. 413]. Specifically, as seen in (12) the random numbers (the coefficients) are scaled according to p ∈ P. Consequently, less weight are given to the random numbers of the shares constructed with the lower p values. Therefore, the shares tend to be in numerical order as observed in Fig. 2.
We can information theoretically verify that the information leak caused by a share decreases as the numerical value of p ∈ P increases. Consider for instance P = {1, 2, 3} and t = 2, then according to (12), the shares of s are  Then, assuming s, c 1 , and c 2 are independent and Gaussian distributed with mean value zero and variance σ 2 s , σ 2 c1 , and σ 2 c2 , respectively, then ( 14) clearly shows that the mutual information, and hence, information leakage about the secret, decreases as p increases. This does not happen in Shamir's SSS because of the modular arithmetic. We therefore need to adjust the method for it to work in a real number SSS.
To make sure each random number carry the same weight across shares, we propose to construct the shares based on Lagrange interpolation [7] and we briefly state this method in our notation.
Consider the points ( of at most degree t − 1, that passes through the points, can be found by where T = {1, . . . , t} and L k (x) are Lagrange basis polynomials given by To create shares of a secret, we choose t shares at random and interpolate these shares to a degree (at most) t polynomial f s (x), by also using that f s (0) = s. Using Lagrange basis polynomials stated above, f s (x) is written as where we use that x 0 = 0. The shares are then defined as As seen in (17), the random numbers (y j ) are normalized and thus have the same weight across shares. Therefore, the shares are much less predictable (especially as t increase) as observed in Fig. 3.  to any adversary. According to (17), the shares of s are written as Assuming s and y i are independent and Gaussian distributed with mean zero and variance σ 2 s , σ 2 Y1 , and σ 2 Y2 , respectively, the mutual information yields Thus, (19) shows that the information leakage caused by the shares are independent of the numerical value of p, which is of course important from a privacy perspective. More precisely, the difference between (14) and (19)   We perform the following steps with t = 5:  For comparison, we perform the same steps for t = 10, where (x j , y j ) j∈T are seen in Fig. 3b marked with and {s[p]} p∈P are seen in Fig. 3b marked with .
We will now show that the scheme satisfies the requirements listed in section 3. We start by noting that the proof of Lagrange interpolation also proves the correctness of the scheme. Therefore, we immediately analyse the privacy of the scheme in the following section.

Privacy Analysis
We start out the analysis by considering one participant p ∈ P, who does To this end, we have that We choose to model the L j values as constants even though it can be argued that they are indeed random variables because each x k from step 1. of Algorithm 1 are randomly chosen. However, since t is generally close to n and P is public, there is not an insignificant probability of guessing the x k values. Consider for instance P given in Example 1 and let t = 10. Then we know that x 1 ∈ {0.5, 0.65} because the 9 remaining x k values must also be distinct elements of P. Consequently, for each x k there are generally only a few possible values it can take and thus in our analysis we choose to treat each L j value as a constant.
To this end, B(p) is normally distributed with mean tµ Y and variance

Consider now the mutual information I(S; S[p]) between S and S[p]
; where we use that I(X, Y ) is symmetric, that L 0 is a constant, and that S and B(p) are independent. Before we proceed, we remark that when f s (x) given in step 3. of Algorithm 1, is evaluated in one of the x k values chosen in step 1., y k is outputted. That is, f s (x k ) = y k , see (18). Recall that each y k is Gaussian distributed and since x k ∈ P, we have that exactly t shares are completely independent of the secret s. Thus, in this best case scenario, which is true for t shares, I(S; S[p]) = 0 and there is no leak of information. To analyse the information leakage of the remaining n − t shares, we take the same approach as in [28] and consider again (23). As discussed, B(p) are Gaussian distributed and according to [27, p. 244], the differential entropy of a Gaussian distributed variable X can be written as where e is the Euler number. On the other hand, we do not make an assumption of the distribution of SL 0 (p) + B(p), since this can vary from application to application. Instead, we note that a high entropy of SL 0 (p) + B(p), results in a higher I(S; S[p]) in equation (23). Thus, by using the maximum entropy distribution (which is the Gaussian distribution) as the distribution of SL 0 (p) + B(p), we establish an upper bound on the mutual information.
where we use that since S and B(p) are independent, the variance of S[p] can be written as In conclusion, choosing for instance σ 2 B(p) 100 times larger than the variance of σ 2 SL0(p) , the leaked information is at most 0.0072 bits (no matter the real distribution of SL 0 (p) + B(p)), which is to be read in the way that on the happens with a high probability if t is close to n. However, due to properties of the scheme, which we will explore in the following section, t might be chosen less than n 2 . In this case, we may have that none of the t shares are independent of the secret. This would be the worst case scenario, which we address now by establishing an upper bound for I(S; S [1], . . . , S[t]) by using the same trick as previously. Namely, we choose the t-variate Gaussian distribution for X S = (S[1], . . . , S[t]), which is the maximum entropy distribution. Since the sum of two Gaussian distributions is still Gaussian, we have that X B = (B(1), . . . , B(t)) also follows a t-variate Gaussian distribution. The entropy of a N -variate Gaussian distributed variable X is given as [27, p.249] where C X is the covariance matrix for X. This expression can be used directly in 27, yielding Using (21), we can write the (i, j)'th term of the covariance matrix C X S , as = cov (SL 0 (i); SL 0 (j) + B(j)) + cov (B(i); SL 0 (j) + B(j)) = cov (SL 0 (i); SL 0 (j)) + cov (SL 0 (i); B(j)) + cov (B(i); SL 0 (j)) + cov (B(i); B(j)) = cov (SL 0 (i); SL 0 (j)) + cov (B(i); B(j)) , where we use that SL 0 (i) and B(i) are independent. Therefore, we have where X SL0 = (SL 0 (1), . . . , SL 0 (t)).
Thus, analogue to the previous result, the leaked information is controlled by the relation between the variance of S and the variance of Y . By choosing σ 2 Y large compared to the variance of S, the determinant of C X S will be only slightly larger than the determinant of C X B and we have that asymptotically, the leaked information goes to zero bits.
We can therefore make the following proposition, stating that the scheme fulfills the privacy requirement. Proposition 1. The real number secret sharing scheme comprised of the algorithms share and recon stated in Algorithm 1 and Algorithm 2, respectively, satisfy that for any δ > 0 there exists the covariance matrix C X B such that Proof. We use (29) and (31). For short, we write A = C X SL 0 , and B = C X B .
Since A and B are symmetric, in fact positive semi-definite, they can be simultaneously diagonalizable. We denote the eigenvalues of A by λ i A , and B by λ i B . Let λ A , λ B be the maximal eigenvalue of A, B respectively, and λ B be the minimal eigenvalue of B. Specifically, Hence, by rescaling det(C X B ) by sufficiently large coefficient, the mutual information I(S; S(1), . . . , S(t)) can be made arbitrarily small.
In the next section, we will show that the real number secret sharing scheme also satisfies that final requirement.

Computations on Shares
In this section, we will define the algorithms add, mult, and inv, which perform addition, multiplication and inverse of secrets directly on the shares and, thus, does not leak any secrets. To improve readability and intuition, we present the operations using scalars, however the methods are easily extendable to matrices as well. To this end, we start by defining what we mean by shares of a matrix (and equivalent; a vector).
Definition 2 (Secret shared matrix). Let A ∈ R m1×m2 be a matrix and let each entry of A be secret shared using share. To this end, A[p] denotes the matrix consisting of the p'th share of each element in A, respectively.
For the rest of this section, assume that s, a ∈ R are secrets and that each participant p ∈ P holds the shares s[p] and a[p], respectively.

Addition
We start out with the simplest operation, which is addition. The output of the addition algorithm is that each participant p holds a share c[p], where c = s + a. Note that since each share is a point on a polynomial, it can be written as and where α j , β j ∈ R are coefficients. Adding the above expressions yields . Note that subtraction is performed on the shares equivalently, which we simply denote by '−'.

Multiplication
Multiplying shares is somewhat more complicated. If we attempted to simply multiply the polynomials like we added them previously, we would find that the degree of the resulting polynomial is 2t. In this case we need 2t + 1 shares to reconstruct the secret. To avoid the growing degree of the polynomial, we use a well-know trick called Beavers' trick, [29]. It uses so-called triplets, , r 1 r 2 [p]} p∈P of shares of (unknown) random numbers r 1 and r 2 , and their product r 1 r 2 . To create the triplets, it is typically required that t < n 2 , however there are ongoing research in efficient methods of generating Beaver triplets for larger values of t, [30].
We state formally mult in Algorithm 3.

Algorithm 3 mult(s[p], a[p]) = sa[p]
Input 2: To see that the multiplication protocol in Algorithm 3 is correct, perform the following rewrite to see that Note that a public constant (like e and d in this case) can be directly multiplied on the shares by each participant. This can easily be verified by using the same approach as showing that the add protocol is correct.
We also remark that d = s + r 1 and e = a + r 2 are revealed in plain text in Algorithm 3. Since r 1 and r 2 are Gaussian distributed, d and e does not leak more than a share of the secrets. However, we give here the upper bound of the information leak of knowing both t shares of s and also d.
where C X SR 1 , C X BR 1 are the covariance matrices of X SR1 and X BR1 , respectively. As seen, the result in (42) is very similar to the one obtained in (29). To demonstrate the (at most) revealed data using mult, Example 2 demonstrates the multiplication of two secrets. Note that in section 5 we numerically estimate the leak of information caused by the multiplication protocol.  B ∈ R m2×m3 . In this case the Beavers triplet is also matrices; R 1 ∈ R m1×m2 , R 2 ∈ R m2×m3 and R 1 R 2 is the matrix-matrix product. The rest of algorithm 3 remains unchanged.

Division
We consider the inversion s −1 and note that one could afterwards use mult to compute a secret divided by another secret. We propose to compute this operation efficiently on the shares, by noting that where r ∈ R is a random number. To this end, we propose to use a normally   We remark that the plain text sr does reveal some information about s.
However, this information leak can be upper bounded. We here compute the maximal information leak about s from a set of t shares of s joint with sr.
which is a very similar result to the one obtained in (29).
We denote the computation of s −1 [p] as inv(s[p]) = s −1 [p] and note that also inv can take a matrix as input. In this case the random value r is simply a random matrix of suitable dimension and the rest of the algorithm remains the same.

Numerical Evaluation
In this section we evaluate the numerical performance of the proposed real Fig. 5 depicts the RSE between v andv as a function of σ 2 Y , for all four algorithms. As seen, as σ 2 Y is increased, the accuracy slowly decreases. This is purely due to numerical errors, because as the y j values in Algorithm 1 increases, the shares grow exponentially large and consequently loose precision due to the floating point representation. The reason why inv achieves such high precision, is because the outputted shares are relatively small due to the reciprocal operation of the algorithm.  We simulate in each case the secret S ∼ N (0, 1) and the remaining variables are computed based on the secret. Fig. 6 depicts all three estimations and as expected, one share of the secret leaks very little information while t shares clearly has a greater leak. As seen, these numerical results validate the theoretical results.

Application to Kalman filtering
To demonstrate our proposed privacy preserving computation framework, we use the Kalman filter [31] to estimatex k of (1) when given only real number secret shared versions of the observations in (2). The Kalman filter consists of the following 5 equations, where P is the covariance matrix of the estimate, K is the Kalman gain and Q and R are covariance matrices of the process and measurement noise respectively, We consider the following scenario. Assume that n none-colluding entities are used as computing units, hereafter referred to as computing parties. That is, the computing parties perform all computations given only shares of the data.
Each time the computing parties receive shares of a new measurement, they compute a new update of the state estimate. We do not specify who delivers these measurements, but it could likely be from a collection of nodes or from a set of other participants. The computing parties are not allowed to learn any clear text data and they only output shares (which can afterwards be reconstruct to the clear text output).
In Algorithm 5, we state a privacy preserving Kalman filter based on the proposed real number secret sharing scheme, from the view of computing party p ∈ P.

Algorithm 5 privKalman()
Input: u k [p] for all k, are shares of the observations, P 0 and K 0 can be initialized as identity matrices.
Output:x k [p]; the estimate of the k'th state of the system.

Simulation
We have simulated Algorithm 5 and compared its estimation performance to the algorithm in (46) which does not provide any privacy. Thus, we want to evaluate the sacrifice in output utility when using the privacy preserving algorithm. We thus simulate both algorithms solving the same problem and compare the results. We conduct the simulation on a laptop PC based on a Python implementation of the algorithms. We use n = 3 computing parties and t = 1. For the sharing algorithm we use mean value zero and variance 1000 for the Gaussian distributed shares.
We use the RSE between the result from Algorithm 5,x  In Fig. 7 it is seen that the difference in result from the privacy preserving solution and the non-private solution lies around the third decimal. In comparison, the difference for the solution in [12] lies before the decimal point.
Regarding the complexities, as seen, Algorithm 5 uses 12 multiplications and one inversion, which amounts to 27 interactive operations, independent of the dimension of the matrices. [12] does not provide the complexity for their solution, thus, we provide here an underestimation of the number of interactive operations which lies around 10M + l + 1, where M is the dimension of the matrix R in (46) and l is the number of bits used to represent the numbers (which in the simulations by [12] is at least 24 bits).

Conclusion
The paper presents a real number secret sharing scheme that bypasses the requirements on integer shares and modular arithmetic which is used in state-ofthe-art secure multiparty computation schemes. That the scheme does not use modular arithmetic, makes it very useful for computations directly on shares including division. The trade-off is that the proposed scheme is not perfectly secure, however, we show that the information leak can be upper bounded and demonstrate with examples how small the leak is. We see the proposed scheme with its high level accuracy and privacy properties and its low communication complexity as offering a relevant trade-off between between privacy of the dis-tributed computations and practicality of the scheme. Numerical evaluations of the proposed scheme as well as simulations of the scheme to perform Kalman filtering with privacy preservation verify the theoretic results.