Secret reconstruction

When at least \(t\) users re-encrypted their shares with the receiver’s public key, the receiver can reconstruct the secret:

• Decrypt each re-encrypted share:

  \(S_i = b_i \cdot \frac{1}{a_i^{x_r}}\)
• Reconstruct the secret:

  \(S = \prod\limits_i S_i^{\lambda_i},~ \lambda_i = \prod\limits_{i', i' \ne i} \frac{i'}{i' - i}\)

  where \(i, i'\) are the user indices for all re-encrypted shares.