Sign up ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Homomorphic encryption schemes are PKE schemes with an additional special method Evaluate. Evaluate method takes input any function (as boolean circuit) and encrypted inputs of the function and evaluates the circuit. The results of such function are still encrypted under the public key PK.

Sometimes, it would be too wide of a scope to allow execution of any arbitrary function.
How can one limit FHE schemes to allow only fewer circuits?

share|improve this question
Should your title be parsed as "access [control functionality]" or "access-control functionality"? $\;\;$ –  Ricky Demer Aug 1 '13 at 22:52
it should be "access (control functionality)" i would correct it , the other one would be easy believe , rite ? –  sashank Aug 2 '13 at 3:13

4 Answers 4

up vote 5 down vote accepted

it seems that you are looking for this paper of mine

Here we introduce the concept of a Controlled Homomorphic Encryption Scheme (CHES). In a CHES, for every circuit $C$, it is possible to homomorphically create a ciphertext of $C(m)$ from a ciphertext of $m$ (so far it is like a regular FHE) but only if a special token for circuit C is known (this is similar to functional encryption). The owner of the decryption key can generate tokens for any circuit.

share|improve this answer

This concept is called targeted malleability:

The abstract and introduction of that paper give a good overview of the ideas. In brief, the goal is to ensure that a homomorphic evaluator can only produce a ciphertext by evaluating a function from an "approved" class of functions. It is trivial to achieve this by attaching to the ciphertext a noninteractive proof/argument that it was computed correctly, but this yields a ciphertext whose length is at least linear in the length of the chain of homomorphic operations performed. (This may be acceptable if only a small number of such "hops" are needed.)

The solutions given in the paper instead use succinct noninteractive arguments of correct computation relative to the previous ciphertext in the chain. This keeps the ciphertext length from growing much, because only one proof is attached to the ciphertext. However, the argument system needs a stronger property of "extractability" (of the previous statement in the chain to be proved) to make this work.

share|improve this answer

By itself, no. Though research has been done to add the necessary features to make FHE circuit computation verifiable. These protocols would allow the one party to specify what can be computed on the encrypted data and then verify that the computation has been performed properly.

Thus, it differs from Functional Encryption somewhat. In FE, the worker can only compute the desired functionality. In HE, the worker could still presumably compute any circuit they wanted, but they could not forge a proof to trick the other party into believing that they had computed the correct circuit. Since the output is encrypted and the cipher is semantically secure, being able to compute any circuit on the ciphertexts will not leak any information.

Non-interactive Verifiable Computing: Outsourcing Computation to Untrusted Workers
Delegatable Homomorphic Encryption with Applications to Secure Outsourcing of Computation

share|improve this answer
Mike , VC and Delegatable HE would allow to verify operations are performed or not . But we cannot restrict/narrow down the circuits that can be allowed to run. And yes FE is right choice for limiting functionality am trying to find ways of realizing FE with FHE –  sashank Aug 2 '13 at 16:12
I see your point. What these things do is say "sure you can compute anything, but I'll only accept the value if you computed the desired circuit". That should have the effect of forcing the cloud, for example, to perform exactly the computation you want. I see your point though, but since the cloud never learns anything about the computed value, it doesn't help them to compute unauthorized circuits. –  mikeazo Aug 2 '13 at 16:15
Ok now i see your point too . –  sashank Aug 2 '13 at 19:11

We have recently introduced the notion of controlled functional encryption (it is different from homomorphic encryption and more like functional encryption, but can be helpful) which can provide limited functionality very efficiently. We have a notion of authority and it can limit the functionality as desired. In controlled functional encryption model, any policy can be implemented very efficiently by the authority.

You can look at the paper or slides for more details.



share|improve this answer
the question was about controlled functionality for FHE but not FE –  sashank Nov 7 '14 at 21:31
The scheme can be easily modified to get encrypted output instead of plaintext output, so you would need to send it back to the entity having the secret key. The main point was that if you allow to change your model, you can add more control. –  Muhammad Naveed Nov 7 '14 at 22:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.