# What is the difference between homomorphic encryption and homomorphic signature? [closed]

I want to apply homomorphic signature instead of homomorphic encryption in Provable data possession. So I want to know about homomorphic signature and homomorphic encryption.

-

## closed as too broad by D.W., rath, e-sushi, figlesquidge, DrLecterJan 16 '14 at 9:16

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

Your question is way too broad and will likely be closed. I did my best, but you need to be more specific in what you are looking for. A general introduction (like I gave), example crypto systems, implementations, how to apply it to your problem, or something else. Your question as stated is like saying, "I want to ride a scooter instead of a motorcycle. So tell me about scooters and motorcycles." – mikeazo Jan 14 '14 at 17:42

First start with some notation. Say we have a plaintext space $P$ which forms a group. And an encryption function which goes from the plaintext space to the ciphertext space, say $E : P\to C$.

$E$ is homomorphic if $E$ forms a group homomorphism, i.e. given $E(x)$ and $E(y)$ for $x,y\in P$ we can efficiently construct $E(x\cdot y)$ without the private key, where $\cdot$ is the group operation in $P$. That would be homomorphic encryption.

Homomorphic signatures are very close, but instead we have a signature function, $S$. Then, given two valid signatures $S(x)$ and $S(y)$, we should be able to construct a signature of $S(x\cdot y)$ efficiently without the private key.

-
What is the advantage and disadvantage of homomorphic encryption and homomorphic signature? – user11236 Jan 17 '14 at 4:04
@user11236 advantage compared to what? to each other? that is like comparing apples and oranges. – mikeazo Jan 17 '14 at 12:44

However, its application is quite specific, and I have no idea if it fits your scenario/requirements. The homomorphic property has direct consequences for the signatures: It can not achieve existential unforgeability, because this contradicts the homomorphic property (with signature $S(m)$ you can create signature $S(m+m)$, in additive notation). Furthermore, common signatures use cryptographic hash functions to reduce the size of the signature to a fixed length. For homomorphic signatures you can not do this, because the cryptographic hash function does not preserve any structure.
Additionally, the proposed scheme on the wiki page is really not practical: At first, you need to fix the input size at key generation and you need a pairing friendly group (okay, we can do that). The signing algorithm is quite fast (just normal elliptic curve operations). But the signature verification is REALLY slow since it requires $D$ pairing operations, and $D$ can be quite large (The "hash" input is a vector space with $D$ dimensions). Even though the signature itself is relatively short, the verification key is also quite large ($2D+1$ points on the elliptic curve).