# Tagged Questions

Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).

112 views

### Performing simple arithmetic operations on compressed, and both compressed and encrypted data

We all know it is possible to perform addition and multiplication operations on encrypted data by means of homomorphic encryption methods. My questions are: Is there any cryptosystem that is able to ...
113 views

### Elliptic curve ElGamal with homomorphic mapping

I am interested in ElGamal due to the fact that you can achieve some degree of homomorphic properties. I became interested in applying ElGamal to elliptic curves, and found this other question with an ...
122 views

### How can comparision like (>=,==) be done using homomorphic encryption?

Since we know that Homomorphic encryption allow computation on encrypted data. Let two n-bit integers $(x,y)$ are encrypted using some LWE public key cryptography. For example - if $x'= HEnc(x,pk)$ ...
42 views

### An MPC protocol from Elgamal is a good solution a homomorphic multiplication?

I want to compute a multiplication between many secret values and then distribute the result to everyone involved. For this, I thought about an MPC protocol built from Threshold Homomorphic Elgamal. ...
215 views

### Zero-knowledge proof for the product of additive Paillier ciphers

Suppose that Alice received the cipher values: $E(x_1), E(x_2), ..., E(x_n)$ that are encrypted using Paillier cryptosystem by $n$ entities with Bob's public key. Alice computes $E(\sum x_i)$ from ...
85 views

### How can I implement decryption for NTRU homomorphic encryption scheme?

I have come across this paper On-the-fly multiparty computation via on-the-cloud Multikey from Fully Homomorphic Encryption by Lopez-Alt et al., where authors describe a NTRU-based homomorphic ...
110 views

### Why gcd(r,(p-1)/r) needs to be 1 in benaloh cryptosystem

I recently discovered the benaloh cryptosystem. I am working with the system as it is discribed in the following link: https://en.wikipedia.org/wiki/Benaloh_cryptosystem However I need some help in ...
113 views

### Example of FHEI scheme?

I am reading this paper Toward Secure Multikeyword Top-k Retrieval over Encrypted Cloud Data. I am trying to work out an example of the FHEI (Fully homomorphic Encryption over Integers) scheme ...
47 views

### Security parameter p =O(n)

In many homomorphic encryption scheme, a security parameter is calculated as p =O(n). How to use the complexity order as values? Is there any specific method with an appropriate example?
91 views

### Homomorphic encryption diagram and trouble about a paper

I'm reading a paper based on Homomorphic Encryption: “Fully Homomorphic Encryption over the Integers: From Theory to Practice” (PDF). Now, I need a diagram of this algorithm if possible with all the ...
54 views

### Can homomorphic operations on many different ciphertexts be multiplied by a same constant?

Assume Alice encrypts messages $m_1$,...,$m_n$ using secret keys $k_1$,...,$k_n$ on a homomorphic encryption scheme (BHHO), so she would get $c_1=Enc_{k_1}(m_1)$,...,$c_n=Enc_{k_n}(m_n)$. Then Alice ...
60 views

### How to test an implementation of a homomorphic scheme?

I want to implement the following homomorphic encryption scheme from On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption by Lopez-Alt et al. I use C++ and I want ...
290 views

### Proof that a hash matches an encrypted file

Assume that Alice has a file $F$ which she is going to send, in encrypted form to Bob. Alice possesses $F$ and an encryption key $K$. She sends to Bob the encryption of $F$ using $K$, $E(F,K)$ as ...
198 views

### Additively homomorphic cryptosystem with non-interactive zero-knowledge proof of non-negativity

I need a cryptosystem that is additively homomorphic. Paillier preferably, but not neccessarily. Also, for every ciphertext the private key holder must be able to prove non-interactively that the ...
135 views

### Why is Paillier Cryptosystem called probabilistic?

The definition of Paillier Cryptosystem says that it is a probabilistic asymmetric key algorithm for public key cryptography. Can some body explain why it is called "probabilistic"?
66 views

### Is that simple additive homomorphic scheme secure?

I am doing a little cryptography research and stuck with question. Suppose $\bar m$ is a vector of 64-bit numbers. And i want to have an additive homomorphic encryption over them. I choose large (...
118 views

### Homomorphic OR operations

Is there an encryption scheme that provides efficient homomorphic OR operations at the ciphertext space? Of course any fully homomorphic encryption can be used but I do not require or want additional ...
190 views

29 views

### How do I check if the secret key polynomial of the ATV-FHE (NTRU based) scheme is invertible?

I want to implement the ATV-FHE scheme as described here https://eprint.iacr.org/2014/039.pdf. To generate the secret key polynomial I compute f = 2*u + 1 , with scheme parameters chosen such that ...
23 views

### Which parameters of the ATV-FHE scheme should be kept private?

I try to implement the ATV-FHE scheme as it is described in section 2 of this paper. I also read this paper that says how parameters should be chosen. Are there some parameters that must be kept ...
43 views

### In FHE over integers is each bit of the cyphertext encrypted under the new key?

In the paper Fully Homomorphic Encryption over the Integers, a method is shown for doing homomorphic encryption using only integers. The basic idea is that a bit m is encoded as a large integer c. ...
109 views

### Homomorphic Encryption with Addition and Exponentiation

Is there any homomorphic encryption scheme which supports addition and power over cipher text ? Paillier is close but it supports addition and multiplication with a constant. I am getting an output ...
126 views

### What is scale-invariance notion of a fully homomorphic encryption scheme?

I read this paper https://eprint.iacr.org/2012/078.pdf and I didn't understand what does the author mean with scale-invariance perspective. The perspective in which we view the ciphertext is ...
19 views

### What is the bound for the probability distribution for ATV-FHE scheme?

I try to implement the ATV-FHE scheme as described in this paper https://eprint.iacr.org/2014/039.pdf. How do I choose the bound for the probability distribution chi? How do I choose standard ...
17 views

### How to choose moduli ladder for ATV-FHE scheme?

I try to implement the ATV-FHE scheme as mentioned in section 2 in this paper https://eprint.iacr.org/2014/039.pdf. In this paper, authors say this "For example, given a 256-bit prime q ..." in ...
31 views

I want to implement the ATV-FHE scheme as it is described here https://eprint.iacr.org/2014/039.pdf. How to generate the public key? Should I compute it as indicated in section 2 : $h(i) = 2g(i)*... 0answers 490 views ### Which is/are the strongest known Fully Homomorphic Encryption scheme(s)? As it is discussed here that the highest security any homomorphic encryption scheme is at most IND-CCA1, Is there any known fully homomorphic encryption scheme that achieves this security level? Out ... 0answers 36 views ### Can I expand the modular of an encryption scheme? Take the lifted ElGamal as an example: suppose the original ciphertext is$<g^y ~mod~q,~g^m~mod~q>$. After some calculations,$m$could be large enough to do modular. But I don't want$m$to be ... 0answers 46 views ### How to test a FHE implementation? I want to implement a FHE scheme based on NTRU, namely the scheme described here https://eprint.iacr.org/2014/039.pdf . How to test the security of my implementation ? Do I have to implement the ... 1answer 67 views ### What about using only XOR gates in homomorphic encryption? What if we were substitute the ANDs with XORs in some homomorphic encryption scheme like BGV(https://eprint.iacr.org/2011/277.pdf), LTV ( https://eprint.iacr.org/2013/094.pdf) ? It may be more ... 1answer 32 views ### How to use this homNAND gate? I was reading this paper https://eprint.iacr.org/2014/816.pdf "Bootstratpping in less than one second" but I didn't understand it throughly. What's the point to build a cheap NAND gate ? Maybe to ... 0answers 30 views ### How to toggle a bit homomorphically ? Suppose I want to use LTV scheme from this paper https://eprint.iacr.org/2013/094.pdf to compute homomorphically a function. But the multiplication operation is more expensive than the additive one. ... 1answer 232 views ### Why is “semantically secure” important for cryptosystems? The first question: what is the exact definition of semantically secure? Basically, a cryptosystem is semantically secure if given the public key and the ciphertext, an adversary cannot learn any ... 1answer 47 views ### How to calculate Enc(-m) from Enc(m) in Paillier cryptosystem? The encryption in Paillier cryptosystem is like this according to Wikipedia: Let$m$be a message to be encrypted where$m \in \mathbb{Z}_n$Select random$r$where$r \in \mathbb{Z}_n^*$Compute ... 1answer 325 views ### Is there an additively homomorphic encryption scheme that supports calculating a square root on the ciphertext? I need an additively homomorphic encryption scheme that satisfies:$D(\sqrt{E(m)}) \approx \sqrt{m}$. It seems that the lifted ElGamal satisfies this, but it is hard to do decryption if the message ... 0answers 108 views ### How can I multiply an additively homomorphic encrypted value by a float number? As we all know, if$E()$is an additively homomorphic encryption, we can multiply$E(a)$by an integer$b$, then we will get$E(ab)$. But what if$a$is a float number? Can we still get$E(ab)$? Which ... 1answer 72 views ### Designing Secure Multi-Party Computation Sub-Protocols Based on Homomorphic Encryption When designing SMPC protocols using secret-sharing, it is a common approach to compose a protocol from several sub-protocols (each proven secure under the formal definition of security w.r.t. semi-... 1answer 95 views ### Changing encryption key without revealing the original key Say that Alice encrypts a$\text{plaintext}$with$\text{key}_{m}$and gives the$\text{ciphertext}_m$to Bob. Alice wants to send several gigabytes of$\text{plaintext}$to Eve but she is on a mobile ... 0answers 73 views ### Scale-Invariant DGHV Scheme - Decryption I have just started reading the Scale-Invariant Fully Homomorphic Encryption over the Integers paper and I'm a bit confused about something: When decrypting the ciphertext:$c = r + (m+2r^*) \cdot \...
In Gentry's paper on fully homomorphic encryption using ideal lattices, he finds the values of vectors modulo a certain basis. For instance: $\psi \leftarrow \psi' \mod B$ Taken from page 69 of ...