Is it possible to extend the general concept of homomorphic encryption: $$f(m_1)\cdot f(m_2)=f(m_1+m_2)$$ to: $$f(m_1)\cdot g(m_2)=f\cdot g(m_1+m_2)$$ is it further possible to construct the scheme in a way that the key (if compromised) $f\cdot g(\cdot)$ does not allow drawing conclusions on the encryption keys $f$ or $g$. (Under the assumption that an attacker holds messages encrypted with $f$, with $g$ and with $f$ and $g$ as well as the combined key $f\cdot g(\cdot)$. If something like this is impossible - can it be mathematically be proven?
3
-
1$\begingroup$ If the key of $f\cdot g$ is compromised and the attack knows a message encrypted with $f, g$ then he can decrypt messages. It might be possible to hide the keys themselves, but you still get a total break $\endgroup$– Command MasterCommented Nov 3, 2023 at 17:15
-
$\begingroup$ is it provable that there isn't a concept so that $f\cdot g$ (if $f$ and $g$ are still unknown to the attacker) don't allow deriving $f$ or $g$ and therefore messages encrypted solely with $f$ or with $g$ are still secure. $\endgroup$– baxbearCommented Nov 6, 2023 at 9:12
-
$\begingroup$ Could you show us an example of such homomorphic encryption? I am very curious about it. $\endgroup$– X.H. YueCommented Nov 7, 2023 at 7:38
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
0
If an attacker has the key of $f\cdot g$, then assuming he knows some pair $x, f(x)$, he can decrypt messages encrypted with $g$ - he can use the homomorphism to calculate $f(x) \cdot g(y) = f\cdot g(x+y)$, and then decrypt it using $f\cdot g$'s key, get $x + y$, and subtract $x$. In the same way, if he knows some pair $y, g(y)$ he can decrypt messages encrypted with $f$.
It might be possible he couldn't find the key to $f$ and $g$ - the key could be a PRG seed to generate two primes, for example, and then the attacker might only know the two primes, but not the seed used to generate them. However, the attacker can still decrypt messages encrypted with them, which breaks the cryptosystem.
