Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I've seen that it's widely accepted that before Gentry's breakthrough (which is not practical yet) in 2009 there were no known full homomorphic encryption scheme.

I've read here in another answer that:

"...there are many known partially homomorphic cryptosystems, each one can either multiply or add numbers."

Now here on some interactive webpage allowing to test Paillier here:


I can do [(A+B)*C], hence doing both addition and multiplication (?).

Why is Paillier not fully homomorphic seen that it can do both addition and multiplication?

share|improve this question
That site is somewhat confusing. C is not encrypted, there is no encrypt button. Paullier can add cithertexts, but only multiply by a plaintext. –  mikeazo Jun 24 '14 at 10:15
You can only homomorphically add two ciphertexts, but you can only homomorphically multiply each ciphertext with a plain integer (this operation can also be seen as a more efficient way than doing a number of successive additions of a ciphertext). Note that the latter is not a homomorphic multiplication of ciphertexts (which you would require for the scheme to be fully homomorphic)! –  DrLecter Jun 24 '14 at 10:18
@mikeazo: oh, ok... Didn't realize that: I've indeed been a bit confused by that little interactive demo. Makes a lot of sense. Thanks to both of you! –  Cedric Martin Jun 24 '14 at 10:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.