# What is the difference between homomorphic encryption and homomorphic signature? [closed]

I want to apply homomorphic signature instead of homomorphic encryption in Provable data possession. So I want to know about homomorphic signature and homomorphic encryption.

• Your question is way too broad and will likely be closed. I did my best, but you need to be more specific in what you are looking for. A general introduction (like I gave), example crypto systems, implementations, how to apply it to your problem, or something else. Your question as stated is like saying, "I want to ride a scooter instead of a motorcycle. So tell me about scooters and motorcycles." – mikeazo Jan 14 '14 at 17:42

However, its application is quite specific, and I have no idea if it fits your scenario/requirements. The homomorphic property has direct consequences for the signatures: It can not achieve existential unforgeability, because this contradicts the homomorphic property (with signature $S(m)$ you can create signature $S(m+m)$, in additive notation). Furthermore, common signatures use cryptographic hash functions to reduce the size of the signature to a fixed length. For homomorphic signatures you can not do this, because the cryptographic hash function does not preserve any structure.
Additionally, the proposed scheme on the wiki page is really not practical: At first, you need to fix the input size at key generation and you need a pairing friendly group (okay, we can do that). The signing algorithm is quite fast (just normal elliptic curve operations). But the signature verification is REALLY slow since it requires $D$ pairing operations, and $D$ can be quite large (The "hash" input is a vector space with $D$ dimensions). Even though the signature itself is relatively short, the verification key is also quite large ($2D+1$ points on the elliptic curve).
First start with some notation. Say we have a plaintext space $P$ which forms a group. And an encryption function which goes from the plaintext space to the ciphertext space, say $E : P\to C$.
$E$ is homomorphic if $E$ forms a group homomorphism, i.e. given $E(x)$ and $E(y)$ for $x,y\in P$ we can efficiently construct $E(x\cdot y)$ without the private key, where $\cdot$ is the group operation in $P$. That would be homomorphic encryption.
Homomorphic signatures are very close, but instead we have a signature function, $S$. Then, given two valid signatures $S(x)$ and $S(y)$, we should be able to construct a signature of $S(x\cdot y)$ efficiently without the private key.