In order to reduce the amount of radio communications, wireless sensor networks may perform data aggregation, where relaying nodes perform in-network processing. Guaranteeing security in aggregation schemes is particularly challenging because node compromises in such a scenario are doubly problematic, both in terms data confidentiality (eavesdropping) and availability (denial of service). Indeed, by compromising an aggregator node the attacker would endanger all of the readings that are part of the aggregate the node is in charge of.