# How does fully homomorphic encryption compare to partially homomorphic encryption in terms of security?

I found some questions and answers about the performance of Fully and Partially homomorphic encryption. I am interested in a comparison in terms of security guarantees (of any kind, formal or informal). I understand that there are various schemes for both and so a comparison between specific schemes is equally useful to me.

Is, for instance, Paillier/Elgamal more/less secure than FHE (both allow additions and multiplications)?

Is DET/OPE/ORE more/less(probably) secure than FHE (both allow equality and order comparisons)?

• Can you precisely define "security"? Otherwise, how are we to answer? – mikeazo Oct 23 '17 at 12:38
• Unfortunately, you're trying to compare apples and oranges here. Security is always defined with a security parameter, which means ElGamal with $\lambda = 12$ is more secure than ElGamal with $\lambda = 10$. To which do you want to compare the FHE construction by Gentry with a securtiy parameter of $\lambda = 15$ now? The values just examples, but they should show the problem. – tylo Oct 23 '17 at 12:43
• If you consider something like "with equal runtime", then almost surely FHE is going to be less secure - usually it's stated the other way around: FHE is really slow compared to semi-homomorphic schemes with similar security parameter. But still, a comparison for that can only benchmark some implementation of the scheme, not the scheme itself. – tylo Oct 23 '17 at 12:50
• I see thanks, I am not very familiar with FHE. Still, for PHE you could say, informally, that Paillier is more secure than DET (security parameters aside) since the latter reveals equality of values or OPE that reveals order. Perhaps amongst probabilistic schemes, such comparison is not meaningful? – savx2 Oct 23 '17 at 12:51
• Apples and oranges. They are different kind of schemes, different security definitions, they achieve different goals. Considerng such a comparison as "not meaningful" is only partially right - it makes no sense, honestly. – tylo Oct 23 '17 at 12:52

Taking a step back, usually the security of a cryptosystem is defined with a security parameter $\lambda$, and the security then is described as "... is less than a negligible function $f(\lambda)$ ...", so we can say that e.g. ElGamal with $\lambda = 10$ is less secure than ElGamal with $\lambda = 12$.
But as soon as looking at different constructions, this gets tricky, because they don't compare to the same negligible function any more. Also, they are just upper bounds and there is no statement possible like "it has exactly security $23$".