New answers tagged

4

Suppose that computations are done in $\mathbb{F}_p^*$ for some prime $p$. Let $c = g^m g^{kr} \bmod p$. If $r$ is even then $g^{kr}$ is a square modulo $p$. As a consequence, assuming that $g$ is a non-square modulo $p$, the Legendre symbol of $c$ modulo $p$ will leak the least significant bit of $m$: if $c^{(p-1)/2} \equiv 1 \bmod p$ then $m \bmod 2 = ...


1

The main advantage I have heard is reducing the amount of data the client has to send to the cloud. As said in A Comparison of the Homomorphic Encryption Schemes FV and YASHE: [...] ciphertext expansion (i.e. the ciphertext size divided by the plaintext size) of current FHE schemes is prohibitive (thousands to millions). For example using ...


6

The noise is usually a small term added into the ciphertext while encrypting. This term may be a small integer (if the scheme is based on integers) or a small polynomial (if the scheme is based on polynomials), etc. How to decide if a term is small or not depends on the security and correctness properties of each system (for instance, a polynomial is ...


2

If we encrypt $m_1$, and send it to the server, can the server "somehow" find $E(m_1)$ and remove it? Nope; FHE allows a server that knows $E(m_1)$ and $E(m_2)$ to produce a ciphertext which is a representation of the value $E(m_1 \odot m_2)$ (for pretty much arbitrary functions $\odot$); what it doesn't allow a server to do is determine whether $m_1 = ...


2

I'm not sure I completely understand the point of your question. First of all, the property Additive implies the property MultiByScalar. Indeed, to multiply a ciphertext $E(a)$ by a scalar $b$, you can simply use a square and multiply algorithm, adding a ciphertext to itself to multiply its plaintext by two, which allows to multiply in polynomial time $E(a)$ ...


1

Security goals like confidentiality is the reason to ask for encryption. Modulus is chosen (for particular group types) on the grounds of hard problems associated with that groups; encryption strength is defined by level of hardness of that problems. It would be nice to discover a hard problem related to some change of modulus, comparable to ...



Top 50 recent answers are included