Which are the current solutions to the illegal values in the homomorphic secret sharing?
This is a &quot;known vulnerability&quot; of Shamir's secret scheme. While it is known to be information-theoretically secure, here security means privacy.
Shamir's scheme has no authenticity properties --- a single party can change the output by modifying a single share.
There have been recent suggestions to augment the notion of &quot;secret sharing&quot; to impart it with a notion of authenticity as well. This can be viewed similarly to how the primitive of &quot;Encryption&quot; (which only gives privacy) was augmented to &quot;Authenticated Encryption&quot; (which gives both privacy and authenticity).
I've seen this proposed in the RealWorldCrypto 2020 talk Adept Secret Sharing, presented by Phil Rogaway (Mihir Bellare and Wei Dai are listed as co-authors/co-contributors though). It seems that there hasn't been a paper/slides made public as a result of the talk though.
The talk itself is available here.
I don't remember the entirety of the talk, but the conclusion was something along the lines of a generic transformation to get private + authentic secret sharing, but the privacy becomes computational (rather than information theoretic).
This likely does not work for your purposes though --- such a scheme is likely no longer homomorphic (I cannot remember details from the talk currently though). So what do people do in practice? I believe some combination of &quot;standard&quot; Shamir's secret sharing, and a non-interactive zero knowledge (NIZK) proof that $a_0\in (a,b)$.
This is called a &quot;Range proof&quot; (see for example this).