  A homomorphic secret sharing (HSS) scheme is a secret sharing scheme that
supports evaluating functions on shared secrets by means of a local mapping
from input shares to output shares. We initiate the study of the download rate
of HSS, namely, the achievable ratio between the length of the output shares
and the output length when amortized over $\ell$ function evaluations. We
obtain the following results.
  * In the case of linear information-theoretic HSS schemes for degree-$d$
multivariate polynomials, we characterize the optimal download rate in terms of
the optimal minimal distance of a linear code with related parameters. We
further show that for sufficiently large $\ell$ (polynomial in all problem
parameters), the optimal rate can be realized using Shamir's scheme, even with
secrets over $\mathbb{F}_2$.
  * We present a general rate-amplification technique for HSS that improves the
download rate at the cost of requiring more shares. As a corollary, we get
high-rate variants of computationally secure HSS schemes and efficient private
information retrieval protocols from the literature.
  * We show that, in some cases, one can beat the best download rate of linear
HSS by allowing nonlinear output reconstruction and $2^{-\Omega(\ell)}$ error
probability.
