Aggregation signature and verification I'm not even sure of the appropriate terminology to use to describe my problem so bear with me if the explanation is not exactly formal.

Imagine I have a simple digital calculator, with a screen and some buttons. I bring this calculator into a room full of people. I ask them each one by one to take the calculator and accumulate their age on the calculator, such that after everyone is done the calculator screen reads the combined age of everyone in the room.

The trick is that there is a lot of people in the room, and some of them are liars. I need to solve two problems relating to this:


I need to know if some user(s) has lied about their age
I need to know if some user(s) double counts their age


It's enough for me to recognise and throw away a bad result, not necessarily know who messed with the result.

We can assume that the calculator is rather large (ex. has a 256-digit display), but not arbitrarily large. This means that I can punch in a number that contains some identity information as well as my age, but I don't have enough digits to just have everyone's signature side by side.

Assume I've been given a value to verify.
There is a lot to this question, and I believe some concepts of multiparty computation can be useful in relation with this problem. There's one catch: lying is a very abstract concept, even with a simple and well defined concept as age. 

So, for the sake of the argument, let's define some conditions:


Each participant introduces a valid age value (i.e. within a given range -maybe 0-99, as Maarten proposed).
Each participant provides only one input to the protocol.
The counting entity is reliable.


For certain encryption algorithms (e.g. Lifted ElGamal) it is possible to prove that an encrypted value falls within a range without disclosing the value. Then, each participant $p$ has to generate a set $(p, E(a_p), proof_{a_p})$. When the counting entity has all the sets, it can verify each value of $p$ is unique. Since Lifted ElGamal is also additively homomorphic, the sum of all the ages can be computed without decrypting the values.

DISCLAIMER 1: if the counting entity cannot be trusted, the scheme gets harder, but the general spirit of the communication is similar.

DISCLAIMER 2: this is strongly based on protocols for voting. The verification of identity, adding and the decryption processes can be performed by different entities within the counting authority to keep a higher level of privacy around the encrypted values.



As Maarten suggested, here are some links to the relevant content:


Homomorphic encryption : a property of cryptosystems that enable some operations on the ciphertexts without decrypting the values.
Sigma protocols : a generic approach to Zero Knowledge Honest Verifier Proofs (ZKHVP).
Zero Knowledge : a long lecture on zero knowledge techniques. Set Membership is covered around the slide 144.
Estonian voting process : an example of a critical application based on the principle of division of responsibility within the counting (voting) authority).