Homomorphic cryptosystems are cryptsystems in which, given $c_1\mathcal{E}(m_1)$ and $c_2\mathcal{E}(m_2)$, another party can compute some function of $c_1$ and $c_2$. For example, say the other party wants to compute $m_1\cdot m_2$, the cryptosystem allows them to compute $c_1\odot c_2$ such that $\mathcal{D}(c_1\odot c_2) = m_1\cdot m_2$. Not that $\odot$ is not necessarily multiplication (and in fact often is not).

A system is said to be homomorphic with respect to addition if $m_1+m_2$ can be computed from $\mathcal{E}(m_1)$ and $\mathcal{E}(m_2)$. Homomorphic with respect to multiplication is similarly defined. A fully homomorphic cryptosystem would support both addition and multiplication at the same time.

Until 2009, no fully homomorphic cryptosystem existed. This changed with Craig Gentry's PhD Thesis. Much development has taken place since to make fully homomorphic encryption practical.

history | show excerpt | excerpt history