# Tagged Questions

Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).

95 views
+50

### Applying machine learning algorithms to homomorphic encrypted data

I have a basic understanding of encryption and I got back to the topic because of an interesting site that encrypts financial data using homomorphic encryption (HE) and I would be happy for any input ...
35 views

### Homomorphic Encryption operation for regression

I must be missing something, and I am sorry if this is a novice question... I have seen in places (eg. https://crypto.stanford.edu/~dwu4/talks/SecurityLunch0214.pdf page 13) that linear regression is ...
65 views

### SEAL Homomorphic multiplication

In SEAL homomorphic encryption library, there is an internal procedure to decompose a polynomial with large coefficients into a vector of polynomials with smaller coefficients. The procedure is ...
113 views

### Designing Secure Multi-Party Computation Sub-Protocols Based on Homomorphic Encryption

When designing SMPC protocols using secret-sharing, it is a common approach to compose a protocol from several sub-protocols (each proven secure under the formal definition of security w.r.t. semi-...
75 views

### Why does Paillier have poor performance?

Can anyone explain to me why Paillier crypto system does not provide good performance? I read here (pdf) that RSA and ElGamal provide better performance than Paillier algorithm.
480 views

### Difference between a circuit and a normal function

I've seen the word circuit used in many crypto contexts (for example, regarding FHE in this pdf). I've always thought of a circuit as another word for a program or function. But is there a difference -...
89 views

### Malleable encryption

What I would like to achieve is the following: Alice sends to Bob the encryption of a datagram that has the following format: ...
253 views

### Zero-knowledge proof for the product of additive Paillier ciphers

Suppose that Alice received the cipher values: $E(x_1), E(x_2), ..., E(x_n)$ that are encrypted using Paillier cryptosystem by $n$ entities with Bob's public key. Alice computes $E(\sum x_i)$ from ...
63 views

### How do they avoid Zero Knowledge Proofs in the paper Priced Oblivious Transfer: How to sell Digital Goods?

I don't understand a part of the paper Priced Oblivious Transfer - How to Sell Digital Goods. Particularly, the authors avoid using zero knowledge proofs and in section 3.3 they explain how they do ...
29 views

### Can homomorphic encryption support the operation of exponentiation where both base and exponent are encrypted?

Does it exist some homomorphic encryption libraries or packages which can support the exponentiation where both base and exponent are encrypted? For example, $y = a^b$, where both $a$ and $b$ are ...
77 views

### Are Paillier and El Gamal encryption schemes secure against quantum attacks?

I was wondering if there is a security difference between Lattice based homomorphic encryption schemes versus an partially homomorphic encryption scheme like Paillier, and El Gamal encryption schemes ...
39 views

### Finding $f^{-1}$ in the YASHE keygen algorithm

In the YASHE (Yet Another Somewhat Homomorphic Encryption) algorithm, the beggining of the key generation step specifies: Sample $\ f',g ← χ_{key}$ and let $\ f = [tf' + 1]_q$. If $\ f$ is ...
115 views

### Generating random vector for Full Homomorphic Cryptography

The site below explains that part of doing homomorphic encryption, you need to generate a vector of random numbers that have the property that its dot product against a randomly generated bit vector ...
78 views

### Comparison on Ciphertext with Helib

Is it possible to do a greater than homomorphic comparison in the form ($c_1 < c_2$) on two ciphertexts using Helib? The equal comparison ($c_1 == c_2$) can be done in modulus 2 by adding both ...
173 views

### Finding sum of two encrypted numbers

Let's consider such process: Two emitents emit two (integer) secret numbers independently They encrypt (encode) these number in such a way that no-one (except emitent) can decode these numbers. ...
242 views

### Sorting over encrypted data with different symmetric keys

I'm working on a security project. I need to perform a sorting on the lists of encrypted integers and strings. The encryption used is symmetric. The clients send the encrypted data in a list to the ...
26 views

### In Paillier homomorphism, how do you deal with bit length? [closed]

I'm trying to figure out homomorphic encryption and would like to multiply two paillier encrypted numbers. Like so: [a].[b]=[a+b] To try this I got this Paillier.java and tried the following: <...
37 views

67 views

### identifying presence of encryption of zero in additive homomorphic encryption

Lets say the server has corpus of ciphertext contains $enc(a),enc(b),enc(c), \dotsc enc(x)$. The encryption function is an additive homomorphic scheme (like Paillier). The server knows only the public ...
217 views

### paradox on fully homomorphic equality checking

Imagine, a client encrypts a corpus of data (say documents of text) with the public key of a Fully Homomorphic Encryption scheme (FHE) and outsources the data to an untrusted server.Now the client ...
74 views

### Equality checking using additive homomorphic encryption

Given two ciphertexts $c_1 = enc(p_1)$ and $c_2= enc(p_2)$ using any additive homomorphic encryption scheme (or specifically Paillier). Can we find out whether the underlying plaintexts $p_1,p_2$ ...
95 views

### How to generate 1000 prime number of 1024-bit with much less time?

I am generating thousand prime number of 1024 bit each. But it takes lots of time. My procedure is as follows. Generate prime number using ...
38 views

### Additive homomorphic encryption over small fields

Are there encryption schemes that are additively homomorphic with respect to small fields such as $\mathbb{F}_{2^4}$ or $\mathbb{F}_{2^8}$?
92 views

### Practical multivariate quadratic FHE – how does it compare to other FHEs?

Came across this startup claiming practical FHE and then their blog post going into some additional details on it. It was my understanding that practical FHE is still years/decades off. They said ...
91 views

54 views

### Homomorphic multiplication by a scalar

Few homomorphic encryption schemes like Paillier , Ring-LWE support homomorphic multiplication operation by a scalar apart from additive homomorphic property. Loosely they could be defined as below ...
870 views

### Additive ElGamal cryptosystem using a finite field

I'm trying to implement a modified version of the ElGamal cryptosystem as specified by Cramer et al. in "A secure and optimally efficient multi-authority election scheme", which possesses additive ...
50 views

### Can we do modulus switching for number theoretic encryption?

Can we do modulus switching for number theoretic encryption such as Paillier or ElGamal?
162 views

### How to find the value of a vector modulo a basis in lattice-based cryptography

In Gentry's paper on fully homomorphic encryption using ideal lattices, he finds the values of vectors modulo a certain basis. For instance: $\psi \leftarrow \psi' \mod B$ Taken from page 69 of ...
38 views

### About BGV Scheme Batching Technique

I am reading BGV12 about BGV homomorphic scheme right now.But I am being stuck to understand Batching technique in this paper. In Pack function (page 32),this paper feeds ciphertext $c_i$ and sk $s_1$...
85 views

### Analysis of DGHV Security

I want to know how security of DGHV can be breached using oracle and Binary GCD. As I study this paper : Fully Homomorphic Encryption over the Integers But I am not able to understand Section 4.1: ...
57 views

### What would be a typical value for the security parameter of the Fully Homomorphic Encryption over the Integers scheme?

The parameters of the Fully Homomorphic Encryption scheme by Dijk et.al are chosen according to the value of the security parameter ${\lambda}$, section 3 of the aforementioned article. What is the ...
103 views

### Are there simpler FHE methods than Craig Gentry's original paper?

Craig Gentry's 2010 paper on FHE is very cool, and I'm planning on implementing a basic proof of concept FHE. I was wondering though, are there any simpler methods that have been discovered since ...
217 views

### Can the Smart-Vercauteren Homomorphic Encryption be implemented as a practical fully homomorphic encryption scheme?

Smart and Vercauteren proposed a homomorphic encryption scheme (PKC 2010) following Gentry's principles. ​ Though their scheme can achieve fully homomorphism theoretically, they admitted that "for ...
44 views

### Quantifying bit security for smart-vercauteren encryption scheme

I am working on project that requires to compare in terms of security between two encryption schemes, one of them is the SV scheme. However, I dont know what are the steps exactly towards quantifying ...
113 views

### How do voters verify a Helios (v3) election result?

So from my understanding of verification specification version 3, a Helios election proceeds as follows: A voter retrieves the system's public key to encrypt their vote & submit it. The voter ...
119 views

### How to Perform Computation on AES Encrypted Data

I have this code that successfully performs symmetric encryption using AES algorithm. How can I go about performing computation on it to achieve somewhat homomorphic encryption? ...
83 views

### How to prove hardness of approximate-GCD problem?

I am trying to prove the security of my system using the hardness assumption of the approximate-GCD problem using contradiction, i.e. If the attacker is able to break in our scheme, then attacker ...
94 views

### Beavers Triple Vs BGW Multiplication on MPC

Typically MPC protocols that are secure against semi-honest adversaries recommend the use of the revised GMW multiplication protocol by Gennaro et al. This is not the case against Active adversaries ...
102 views

### Confusion about definition of homomorphic encryption

I am trying to better understand homomorphic encryption, but I feel like I keep getting inconsistent information in the papers that I am reading. One of the papers I am reading says the following: ...