Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).

learn more… | top users | synonyms (1)

4
votes
0answers
80 views

How can I implement decryption for NTRU homomorphic encryption scheme?

I have come across this paper On-the-fly multiparty computation via on-the-cloud Multikey from Fully Homomorphic Encryption by Lopez-Alt et al., where authors describe a NTRU-based homomorphic ...
3
votes
2answers
161 views

paradox on fully homomorphic equality checking

Imagine, a client encrypts a corpus of data (say documents of text) with the public key of a Fully Homomorphic Encryption scheme (FHE) and outsources the data to an untrusted server.Now the client ...
1
vote
2answers
83 views

Homomorphic encryption diagram and trouble about a paper

I'm reading a paper based on Homomorphic Encryption: “Fully Homomorphic Encryption over the Integers: From Theory to Practice” (PDF). Now, I need a diagram of this algorithm if possible with all the ...
4
votes
0answers
44 views

Security parameter p =O(n)

In many homomorphic encryption scheme, a security parameter is calculated as p =O(n). How to use the complexity order as values? Is there any specific method with an appropriate example?
1
vote
1answer
52 views

Can homomorphic operations on many different ciphertexts be multiplied by a same constant?

Assume Alice encrypts messages $m_1$,...,$m_n$ using secret keys $k_1$,...,$k_n$ on a homomorphic encryption scheme (BHHO), so she would get $c_1=Enc_{k_1}(m_1)$,...,$c_n=Enc_{k_n}(m_n)$. Then Alice ...
3
votes
1answer
123 views

Can homomorphic decryption of DES be practical?

I was reading this paper Homomorphic evaluation of the AES Circuit by Gentry et al. when I thought if something similar can be done with DES or 3DES, e.g. it is plausible to decrypt DES ...
2
votes
1answer
56 views

How to test an implementation of a homomorphic scheme?

I want to implement the following homomorphic encryption scheme from On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption by Lopez-Alt et al. I use C++ and I want ...
3
votes
2answers
210 views

Proof that a hash matches an encrypted file

Assume that Alice has a file $F$ which she is going to send, in encrypted form to Bob. Alice possesses $F$ and an encryption key $K$. She sends to Bob the encryption of $F$ using $K$, $E(F,K)$ as ...
4
votes
0answers
128 views

Additively homomorphic cryptosystem with non-interactive zero-knowledge proof of non-negativity

I need a cryptosystem that is additively homomorphic. Paillier preferably, but not neccessarily. Also, for every ciphertext the private key holder must be able to prove non-interactively that the ...
1
vote
2answers
366 views

How can I do minus on plaintexts in the Paillier cryptosystem?

We have $E(a)$, $E(b)$ encrypted under the same Paillier key. As we all know, we can get $E(a+b)$ by calculating $E(a)*E(b)$. But can we get $E(a-b)$, by calculating $E(a)/E(b)$? I tried to ...
3
votes
2answers
120 views

Why is Paillier Cryptosystem called probabilistic?

The definition of Paillier Cryptosystem says that it is a probabilistic asymmetric key algorithm for public key cryptography. Can some body explain why it is called "probabilistic"?
3
votes
1answer
63 views

Is that simple additive homomorphic scheme secure?

I am doing a little cryptography research and stuck with question. Suppose $\bar m$ is a vector of 64-bit numbers. And i want to have an additive homomorphic encryption over them. I choose large ...
6
votes
3answers
116 views

Homomorphic OR operations

Is there an encryption scheme that provides efficient homomorphic OR operations at the ciphertext space? Of course any fully homomorphic encryption can be used but I do not require or want additional ...
3
votes
1answer
187 views

Why multiple homomorphic operations on a ciphertext leaks no information about the plaintext?

Scenario: Assume I encrypt message $m$ using Paillier encryption, so I would get $c=E(m)$. I give the identical $c$ to two different parties, parties $D$ and $E$. Party $D$ computes: $c_{D}= ...
0
votes
1answer
69 views

Fully homomorphic encryption arbitrary functions formulation

I am currently studying the interesting field of homomorphic encryption. I read that from a fully homomorphic encryption function that supports both addition and multiplication you can perform any ...
3
votes
1answer
54 views

Truncating ciphertexts on ring-LWE schemes

On the section 5.4 of the paper Improved Security for a Ring-Based Fully Homomorphic Encryption Scheme, the authors explain how to discard some bits of the ciphertexts to get smaller ciphertexts and ...
3
votes
0answers
52 views

How about a homomorphic integer sorting in a MPC context?

I want to implement the ATV-FHE scheme as described by Adriana López-Alt, Eran Tromer, Vinod Vaikuntanathan: On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption ...
1
vote
0answers
53 views

Upper bound on r* on page 7 in the Scale Invariant Fully Homomorphic Encryption over the Integers paper

I was hoping to get some clarification on how the bound on r* was calculated (bottom of page #7). I'm trying to reproduce the results that have been shown, however I keep getting a slightly smaller ...
2
votes
0answers
40 views

Are there any FHE-MPC schemes implemented?

I want to know if there are any publicly available multiparty computation schemes derived from fully homomorphic encryption schemes. An example would be the implementation of this scheme ...
1
vote
0answers
50 views

Grouping in BGN

The below equation is mentioned in Homomorphic Encryption and the BGN Cryptosystem (pdf, page 4): Mult(pk, $C_1$, $C_2$): Choose $u \xleftarrow{R} [1, n]$ and output $D = \hat{e}(C_1, C_2) \cdot ...
0
votes
0answers
26 views

How do I check if the secret key polynomial of the ATV-FHE (NTRU based) scheme is invertible?

I want to implement the ATV-FHE scheme as described here https://eprint.iacr.org/2014/039.pdf. To generate the secret key polynomial I compute f = 2*u + 1 , with scheme parameters chosen such that ...
0
votes
0answers
23 views

Which parameters of the ATV-FHE scheme should be kept private?

I try to implement the ATV-FHE scheme as it is described in section 2 of this paper. I also read this paper that says how parameters should be chosen. Are there some parameters that must be kept ...
0
votes
0answers
39 views

In FHE over integers is each bit of the cyphertext encrypted under the new key?

In the paper Fully Homomorphic Encryption over the Integers, a method is shown for doing homomorphic encryption using only integers. The basic idea is that a bit m is encoded as a large integer c. ...
4
votes
1answer
112 views

What is scale-invariance notion of a fully homomorphic encryption scheme?

I read this paper https://eprint.iacr.org/2012/078.pdf and I didn't understand what does the author mean with scale-invariance perspective. The perspective in which we view the ciphertext is ...
0
votes
0answers
19 views

What is the bound for the probability distribution for ATV-FHE scheme?

I try to implement the ATV-FHE scheme as described in this paper https://eprint.iacr.org/2014/039.pdf. How do I choose the bound for the probability distribution chi? How do I choose standard ...
0
votes
0answers
17 views

How to choose moduli ladder for ATV-FHE scheme?

I try to implement the ATV-FHE scheme as mentioned in section 2 in this paper https://eprint.iacr.org/2014/039.pdf. In this paper, authors say this "For example, given a 256-bit prime q ..." in ...
3
votes
0answers
481 views

Which is/are the strongest known Fully Homomorphic Encryption scheme(s)?

As it is discussed here that the highest security any homomorphic encryption scheme is at most IND-CCA1, Is there any known fully homomorphic encryption scheme that achieves this security level? Out ...
1
vote
0answers
31 views

How to generate public key for ATV-FHE scheme?

I want to implement the ATV-FHE scheme as it is described here https://eprint.iacr.org/2014/039.pdf. How to generate the public key? Should I compute it as indicated in section 2 : $h(i) = ...
2
votes
0answers
35 views

Can I expand the modular of an encryption scheme?

Take the lifted ElGamal as an example: suppose the original ciphertext is $<g^y ~mod~q,~g^m~mod~q>$. After some calculations, $m$ could be large enough to do modular. But I don't want $m$ to be ...
3
votes
0answers
39 views

How to test a FHE implementation?

I want to implement a FHE scheme based on NTRU, namely the scheme described here https://eprint.iacr.org/2014/039.pdf . How to test the security of my implementation ? Do I have to implement the ...
3
votes
1answer
63 views

What about using only XOR gates in homomorphic encryption?

What if we were substitute the ANDs with XORs in some homomorphic encryption scheme like BGV(https://eprint.iacr.org/2011/277.pdf), LTV ( https://eprint.iacr.org/2013/094.pdf) ? It may be more ...
0
votes
1answer
28 views

How to use this homNAND gate?

I was reading this paper https://eprint.iacr.org/2014/816.pdf "Bootstratpping in less than one second" but I didn't understand it throughly. What's the point to build a cheap NAND gate ? Maybe to ...
3
votes
1answer
187 views

Why is “semantically secure” important for cryptosystems?

The first question: what is the exact definition of semantically secure? Basically, a cryptosystem is semantically secure if given the public key and the ciphertext, an adversary cannot learn any ...
0
votes
0answers
30 views

How to toggle a bit homomorphically ?

Suppose I want to use LTV scheme from this paper https://eprint.iacr.org/2013/094.pdf to compute homomorphically a function. But the multiplication operation is more expensive than the additive one. ...
2
votes
1answer
44 views

How to calculate Enc(-m) from Enc(m) in Paillier cryptosystem?

The encryption in Paillier cryptosystem is like this according to Wikipedia: Let $m$ be a message to be encrypted where $m \in \mathbb{Z}_n$ Select random $r$ where $r \in \mathbb{Z}_n^*$ Compute ...
2
votes
1answer
315 views

Is there an additively homomorphic encryption scheme that supports calculating a square root on the ciphertext?

I need an additively homomorphic encryption scheme that satisfies: $D(\sqrt{E(m)}) \approx \sqrt{m}$. It seems that the lifted ElGamal satisfies this, but it is hard to do decryption if the message ...
2
votes
0answers
82 views

How can I multiply an additively homomorphic encrypted value by a float number?

As we all know, if $E()$ is an additively homomorphic encryption, we can multiply $E(a)$ by an integer $b$, then we will get $E(ab)$. But what if $a$ is a float number? Can we still get $E(ab)$? Which ...
5
votes
1answer
72 views

Designing Secure Multi-Party Computation Sub-Protocols Based on Homomorphic Encryption

When designing SMPC protocols using secret-sharing, it is a common approach to compose a protocol from several sub-protocols (each proven secure under the formal definition of security w.r.t. ...
5
votes
2answers
277 views

Fast attack on approximate GCD problem?

This question is about the approximate GCD problem which is defined as follows: Given any number of the approximate multiples $a_i = p \cdot q_i + r_i$ of $p$, where $p$, $q_i$ and $r_i$ are integers, ...
2
votes
0answers
69 views

Scale-Invariant DGHV Scheme - Decryption

I have just started reading the Scale-Invariant Fully Homomorphic Encryption over the Integers paper and I'm a bit confused about something: When decrypting the ciphertext: $c = r + (m+2r^*) \cdot ...
1
vote
2answers
58 views

Paillier cryptosystem, small integers and range of values

First, this a different take on my previous question: Pailler encryption of small integers to 32-bit integers I have to encode small integers (range 0-50) using the Paillier cryptosystem. Those ...
1
vote
1answer
179 views

How does the Efficient Fully Homomorphic Encryption from (Standard) LWE work?

I am interesting to learn the low level implementation of Efficient Fully Homomorphic Encryption from (Standard) LWE and I am wondering if anyone can answer the following questions: Does the BV ...
4
votes
1answer
69 views

Symmetric key in homomorphic encryption over the integers

Much like this question: Public key in fully homomorphic encryption over the integers I am also reading I'm reading Fully Homomorphic Encryption over the Integers, but I'm working on implementing the ...
1
vote
0answers
43 views

research on Encryption for master [closed]

I'm tring to choose an way for an Encryption mothod for my research? So,I want to choose one-layer encryption or multilayer encryption,and I want it to be easy to applicable. when I search about it, ...
3
votes
2answers
110 views

Homomorphic Encryption vs. Garbled circuits

I'm currently trying to understand all the differences between homomorphic encryption and garbeled circuits. As I understood the use of homomorphic encryption hides either the data or the computation ...
1
vote
1answer
42 views

In bilinear pairings, is it possible to let someone be only able to decrypt ciphertexts in $G_1$ but not able to decrypt the ciphertexts in $G$?

For example, in Don Boneh et al.'s paper "Evaluating 2-DNF Formulas on Ciphertexts", they gave an encryption system that the cihpertext can be in either $G$ (when only additional homomorphic ...
3
votes
1answer
132 views

Paillier Cryptosystem - Practical applications?

I wonder: are there any real-world practical applications using the Paillier cryptosystem , as introduced in [1], or some derivations of it? I'm aware of quite a few schemes proposed in literature ...
1
vote
2answers
743 views

garbled circuit vs fully homomorphic encryption

Consider an outsourced database to an untrusted cloud (think CryptDb), the question is how to compute a function $f(.)$ on the data. I think I understand how (fully or partially) homomorphic ...
2
votes
3answers
387 views

homomorphic encryption special case of multi party computation?

I read that Fully Homomorphic Encryption schemes are special case of Secure MPC in page no 3. Especially , generalization of two party computation problems stated by Yao But is there any additional ...
3
votes
1answer
82 views

Is it possible to encrypt data points but still be able to select the ones “near” a given value?

We have an application where we would like to store "encrypted" data points (as in, not being able to know the original - plaintext - data just by looking at the stored - encrypted - version of it) ...