Is a simple stream cipher "partially homomorphic" if no integrity check is applied?

Question

My understanding is that, simply put, a stream cipher is just a CSPRNG such that $R(i,k)$ will produce a deterministic but statistically random sequence, where $i$ is an IV, and $k$ is the session key. The resultant key-stream $K$ is then combined with plaintext (i.e. $C = K \oplus M$).

Now, if we take two messages $m_1$ and $m_2$, and assume $\mathcal{E}(x)$ and $\mathcal{D}(x)$ are functions that encrypt and decrypt a message as described above, surely the following is a partially homomorphic cryptosystem?

$$\mathcal{D}(\mathcal{E}(m_1) \oplus m_2) = m_1 \oplus m_2$$

This seems a really simple and fundamental way to perform unauthenticated homomorphic cryptography, yet the Wikipedia article doesn't mention it at all.

Am I incorrect in saying that this process demonstrates homomorphism?

Answer 1

To answer your question: no this is not homomorphic encryption because one of the plaintexts is used unencrypted. There may be times when it is a useful property, but the only uses I know of it are to demonstrate the malleability of xor ciphers.

To be a homomorphic encryption function, it should be possible to calculate the encryption of some function of the plaintexts from their respective ciphertexts without using the key. That is, given $c_1=e_k(m_1)$, $c_2=e_k(m_2)$ one should be able to calculate $c_3=e_k(f(m_1,m_2))$ by evaluating some $g(c_1,c_2)$.

More generally, a homomorphism is a mathematical function that preserves some operation. For example, if an encryption scheme $e$ would be xor-homomorphic if $$ e(m_1)\oplus e(m_2) = e(m_1\oplus m_2) $$

More complex schemes might commute with other operations. For example the Pallier scheme uses the fact that $$ a^x \cdot a^y = a^{x+y} $$

To construct a scheme that uses multiplication of ciphertexts to calculate the sum of plaintexts.

Answer 2

We typically refer to a homomorphic cipher if we can take two ciphertexts and combine them in a way that has a predictible result on the plaintexts. In your example you have taken one ciphertext and one plaintext.

Using a stream cipher correctly you should never have 2 ciphertexts encrypted with the same portion of a keystream. So, combining two ciphertexts you would have the xor of the two messages encrypted with the xor of the two keys. That is not typically what we think of when we think of homomorphic ciphers.