Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).

learn more… | top users | synonyms (1)

1
vote
1answer
53 views

Can homomorphic operations on many different ciphertexts be multiplied by a same constant?

Assume Alice encrypts messages $m_1$,...,$m_n$ using secret keys $k_1$,...,$k_n$ on a homomorphic encryption scheme (BHHO), so she would get $c_1=Enc_{k_1}(m_1)$,...,$c_n=Enc_{k_n}(m_n)$. Then Alice ...
2
votes
1answer
59 views

How to test an implementation of a homomorphic scheme?

I want to implement the following homomorphic encryption scheme from On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption by Lopez-Alt et al. I use C++ and I want ...
3
votes
2answers
260 views

Proof that a hash matches an encrypted file

Assume that Alice has a file $F$ which she is going to send, in encrypted form to Bob. Alice possesses $F$ and an encryption key $K$. She sends to Bob the encryption of $F$ using $K$, $E(F,K)$ as ...
4
votes
0answers
167 views

Additively homomorphic cryptosystem with non-interactive zero-knowledge proof of non-negativity

I need a cryptosystem that is additively homomorphic. Paillier preferably, but not neccessarily. Also, for every ciphertext the private key holder must be able to prove non-interactively that the ...
3
votes
2answers
132 views

Why is Paillier Cryptosystem called probabilistic?

The definition of Paillier Cryptosystem says that it is a probabilistic asymmetric key algorithm for public key cryptography. Can some body explain why it is called "probabilistic"?
3
votes
1answer
65 views

Is that simple additive homomorphic scheme secure?

I am doing a little cryptography research and stuck with question. Suppose $\bar m$ is a vector of 64-bit numbers. And i want to have an additive homomorphic encryption over them. I choose large ...
6
votes
3answers
118 views

Homomorphic OR operations

Is there an encryption scheme that provides efficient homomorphic OR operations at the ciphertext space? Of course any fully homomorphic encryption can be used but I do not require or want additional ...
3
votes
1answer
190 views

Why multiple homomorphic operations on a ciphertext leaks no information about the plaintext?

Scenario: Assume I encrypt message $m$ using Paillier encryption, so I would get $c=E(m)$. I give the identical $c$ to two different parties, parties $D$ and $E$. Party $D$ computes: $c_{D}= ...
1
vote
1answer
179 views

Sorting over encrypted data with different symmetric keys

I'm working on a security project. I need to perform a sorting on the lists of encrypted integers and strings. The encryption used is symmetric. The clients send the encrypted data in a list to the ...
3
votes
2answers
165 views

paradox on fully homomorphic equality checking

Imagine, a client encrypts a corpus of data (say documents of text) with the public key of a Fully Homomorphic Encryption scheme (FHE) and outsources the data to an untrusted server.Now the client ...
0
votes
1answer
69 views

Fully homomorphic encryption arbitrary functions formulation

I am currently studying the interesting field of homomorphic encryption. I read that from a fully homomorphic encryption function that supports both addition and multiplication you can perform any ...
3
votes
0answers
52 views

How about a homomorphic integer sorting in a MPC context?

I want to implement the ATV-FHE scheme as described by Adriana López-Alt, Eran Tromer, Vinod Vaikuntanathan: On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption ...
3
votes
1answer
55 views

Truncating ciphertexts on ring-LWE schemes

On the section 5.4 of the paper Improved Security for a Ring-Based Fully Homomorphic Encryption Scheme, the authors explain how to discard some bits of the ciphertexts to get smaller ciphertexts and ...
1
vote
0answers
53 views

Upper bound on r* on page 7 in the Scale Invariant Fully Homomorphic Encryption over the Integers paper

I was hoping to get some clarification on how the bound on r* was calculated (bottom of page #7). I'm trying to reproduce the results that have been shown, however I keep getting a slightly smaller ...
2
votes
0answers
40 views

Are there any FHE-MPC schemes implemented?

I want to know if there are any publicly available multiparty computation schemes derived from fully homomorphic encryption schemes. An example would be the implementation of this scheme ...
7
votes
2answers
197 views

Can the Smart-Vercauteren Homomorphic Encryption be implemented as a practical fully homomorphic encryption scheme?

Smart and Vercauteren proposed a homomorphic encryption scheme (PKC 2010) following Gentry's principles. ​ Though their scheme can achieve fully homomorphism theoretically, they admitted that "for ...
1
vote
0answers
51 views

Grouping in BGN

The below equation is mentioned in Homomorphic Encryption and the BGN Cryptosystem (pdf, page 4): Mult(pk, $C_1$, $C_2$): Choose $u \xleftarrow{R} [1, n]$ and output $D = \hat{e}(C_1, C_2) \cdot ...
0
votes
0answers
27 views

How do I check if the secret key polynomial of the ATV-FHE (NTRU based) scheme is invertible?

I want to implement the ATV-FHE scheme as described here https://eprint.iacr.org/2014/039.pdf. To generate the secret key polynomial I compute f = 2*u + 1 , with scheme parameters chosen such that ...
0
votes
0answers
23 views

Which parameters of the ATV-FHE scheme should be kept private?

I try to implement the ATV-FHE scheme as it is described in section 2 of this paper. I also read this paper that says how parameters should be chosen. Are there some parameters that must be kept ...
0
votes
0answers
39 views

In FHE over integers is each bit of the cyphertext encrypted under the new key?

In the paper Fully Homomorphic Encryption over the Integers, a method is shown for doing homomorphic encryption using only integers. The basic idea is that a bit m is encoded as a large integer c. ...
0
votes
2answers
102 views

Homomorphic Encryption with Addition and Exponentiation

Is there any homomorphic encryption scheme which supports addition and power over cipher text ? Paillier is close but it supports addition and multiplication with a constant. I am getting an output ...
4
votes
1answer
124 views

What is scale-invariance notion of a fully homomorphic encryption scheme?

I read this paper https://eprint.iacr.org/2012/078.pdf and I didn't understand what does the author mean with scale-invariance perspective. The perspective in which we view the ciphertext is ...
0
votes
0answers
19 views

What is the bound for the probability distribution for ATV-FHE scheme?

I try to implement the ATV-FHE scheme as described in this paper https://eprint.iacr.org/2014/039.pdf. How do I choose the bound for the probability distribution chi? How do I choose standard ...
0
votes
0answers
17 views

How to choose moduli ladder for ATV-FHE scheme?

I try to implement the ATV-FHE scheme as mentioned in section 2 in this paper https://eprint.iacr.org/2014/039.pdf. In this paper, authors say this "For example, given a 256-bit prime q ..." in ...
1
vote
0answers
31 views

How to generate public key for ATV-FHE scheme?

I want to implement the ATV-FHE scheme as it is described here https://eprint.iacr.org/2014/039.pdf. How to generate the public key? Should I compute it as indicated in section 2 : $h(i) = ...
3
votes
0answers
490 views

Which is/are the strongest known Fully Homomorphic Encryption scheme(s)?

As it is discussed here that the highest security any homomorphic encryption scheme is at most IND-CCA1, Is there any known fully homomorphic encryption scheme that achieves this security level? Out ...
2
votes
0answers
36 views

Can I expand the modular of an encryption scheme?

Take the lifted ElGamal as an example: suppose the original ciphertext is $<g^y ~mod~q,~g^m~mod~q>$. After some calculations, $m$ could be large enough to do modular. But I don't want $m$ to be ...
3
votes
0answers
44 views

How to test a FHE implementation?

I want to implement a FHE scheme based on NTRU, namely the scheme described here https://eprint.iacr.org/2014/039.pdf . How to test the security of my implementation ? Do I have to implement the ...
3
votes
1answer
65 views

What about using only XOR gates in homomorphic encryption?

What if we were substitute the ANDs with XORs in some homomorphic encryption scheme like BGV(https://eprint.iacr.org/2011/277.pdf), LTV ( https://eprint.iacr.org/2013/094.pdf) ? It may be more ...
0
votes
1answer
29 views

How to use this homNAND gate?

I was reading this paper https://eprint.iacr.org/2014/816.pdf "Bootstratpping in less than one second" but I didn't understand it throughly. What's the point to build a cheap NAND gate ? Maybe to ...
0
votes
0answers
30 views

How to toggle a bit homomorphically ?

Suppose I want to use LTV scheme from this paper https://eprint.iacr.org/2013/094.pdf to compute homomorphically a function. But the multiplication operation is more expensive than the additive one. ...
5
votes
1answer
212 views

Why is “semantically secure” important for cryptosystems?

The first question: what is the exact definition of semantically secure? Basically, a cryptosystem is semantically secure if given the public key and the ciphertext, an adversary cannot learn any ...
2
votes
1answer
45 views

How to calculate Enc(-m) from Enc(m) in Paillier cryptosystem?

The encryption in Paillier cryptosystem is like this according to Wikipedia: Let $m$ be a message to be encrypted where $m \in \mathbb{Z}_n$ Select random $r$ where $r \in \mathbb{Z}_n^*$ Compute ...
2
votes
1answer
323 views

Is there an additively homomorphic encryption scheme that supports calculating a square root on the ciphertext?

I need an additively homomorphic encryption scheme that satisfies: $D(\sqrt{E(m)}) \approx \sqrt{m}$. It seems that the lifted ElGamal satisfies this, but it is hard to do decryption if the message ...
2
votes
0answers
101 views

How can I multiply an additively homomorphic encrypted value by a float number?

As we all know, if $E()$ is an additively homomorphic encryption, we can multiply $E(a)$ by an integer $b$, then we will get $E(ab)$. But what if $a$ is a float number? Can we still get $E(ab)$? Which ...
5
votes
1answer
72 views

Designing Secure Multi-Party Computation Sub-Protocols Based on Homomorphic Encryption

When designing SMPC protocols using secret-sharing, it is a common approach to compose a protocol from several sub-protocols (each proven secure under the formal definition of security w.r.t. ...
4
votes
1answer
94 views

Changing encryption key without revealing the original key

Say that Alice encrypts a $\text{plaintext}$ with $\text{key}_{m}$ and gives the $\text{ciphertext}_m$ to Bob. Alice wants to send several gigabytes of $\text{plaintext}$ to Eve but she is on a mobile ...
2
votes
0answers
71 views

Scale-Invariant DGHV Scheme - Decryption

I have just started reading the Scale-Invariant Fully Homomorphic Encryption over the Integers paper and I'm a bit confused about something: When decrypting the ciphertext: $c = r + (m+2r^*) \cdot ...
3
votes
1answer
124 views

Can homomorphic decryption of DES be practical?

I was reading this paper Homomorphic evaluation of the AES Circuit by Gentry et al. when I thought if something similar can be done with DES or 3DES, e.g. it is plausible to decrypt DES ...
3
votes
2answers
145 views

How to find the value of a vector modulo a basis in lattice-based cryptography

In Gentry's paper on fully homomorphic encryption using ideal lattices, he finds the values of vectors modulo a certain basis. For instance: $\psi \leftarrow \psi' \mod B$ Taken from page 69 of ...
0
votes
1answer
122 views

Performance of Fully homomorphic encryption VS Paillier encryption in Practice

Consider two schemes both have computation complexity linear to the input size (i.e. number of inputs). One scheme is based on Paillier encryption and the other one is based on fully homomorphic ...
1
vote
2answers
65 views

Paillier cryptosystem, small integers and range of values

First, this a different take on my previous question: Pailler encryption of small integers to 32-bit integers I have to encode small integers (range 0-50) using the Paillier cryptosystem. Those ...
1
vote
1answer
186 views

How does the Efficient Fully Homomorphic Encryption from (Standard) LWE work?

I am interesting to learn the low level implementation of Efficient Fully Homomorphic Encryption from (Standard) LWE and I am wondering if anyone can answer the following questions: Does the BV ...
1
vote
0answers
43 views

research on Encryption for master [closed]

I'm tring to choose an way for an Encryption mothod for my research? So,I want to choose one-layer encryption or multilayer encryption,and I want it to be easy to applicable. when I search about it, ...
3
votes
2answers
110 views

Homomorphic Encryption vs. Garbled circuits

I'm currently trying to understand all the differences between homomorphic encryption and garbeled circuits. As I understood the use of homomorphic encryption hides either the data or the computation ...
1
vote
1answer
43 views

In bilinear pairings, is it possible to let someone be only able to decrypt ciphertexts in $G_1$ but not able to decrypt the ciphertexts in $G$?

For example, in Don Boneh et al.'s paper "Evaluating 2-DNF Formulas on Ciphertexts", they gave an encryption system that the cihpertext can be in either $G$ (when only additional homomorphic ...
3
votes
1answer
142 views

Paillier Cryptosystem - Practical applications?

I wonder: are there any real-world practical applications using the Paillier cryptosystem , as introduced in [1], or some derivations of it? I'm aware of quite a few schemes proposed in literature ...
3
votes
1answer
83 views

Is it possible to encrypt data points but still be able to select the ones “near” a given value?

We have an application where we would like to store "encrypted" data points (as in, not being able to know the original - plaintext - data just by looking at the stored - encrypted - version of it) ...
7
votes
2answers
283 views

Key Size for Symmetric Homomorphic Encryption Over the Integers

In the paper Fully Homomorphic Encryption over the Integers, it mentions a symmetric key scheme on page 1 and 2. Key Generation: Pick a random odd number $p \epsilon [2^{N-1},2^N)$ Encrypt A Bit m: ...
1
vote
0answers
68 views

In DGHV FHE, why noise $r$ can be in $(-2^{\rho'}, 0)$?

"Fully Homomorphic Encryption over the Integer" described a simple FHE scheme based on the GACD assumption. Its encryption function (on page 6) has the form $c \leftarrow (m + 2r + 2*\sum_{i \in S} ...