I want know if there is an application of FHE contains three kinds of users such that:

  1. $A$ is the data owner and she has the secret key.
  2. $B$ only has the permissions to encrypt (just like a general user).
  3. $C$ has the permissions to both encrypt and evaluate (just like the cloud or other servers)

Dose this kind of application of FHE make sense? And it is under the condition that encryption key and evaluation key are different. However, I haven't seen the application like this.


On the literature, these are called 'keyed fully homomorphic encryptions', with three keys: $\mathit{pk}$ is the public encryption key, $\mathit{sk}$ is the secret decryption key, and $\mathit{ek}$ is the secret evaluation key.

Yes, the scenario actually makes sense at least for the cloud computing: there, only the 'cloud provider' needs to do homomorphic evaluation, and there's really no need to extend the capability further.

Rather, I think that it is the other way around: of course we can extend the evaluation capability to anybody, but why do we need to do that? One reason might be that if the application is not about cloud computing, perhaps there could be reasons that an arbitrary person needs to evaluate ciphertexts homomorphically. But, there could be many scenarios where the keyed FHE would be fine.

Moreover, for keyed FHE, you can actually define and achieve IND-CCA security: the reason why IND-CCA is impossible for FHE is the malleability, and when the adversary does not have the homomorphic evaluation ability, the attacker can no longer carry out the obvious CCA attack, so to an 'outsider' without $\mathit{ek}$, the scheme can be IND-CCA, but of course to an 'insider' with $\mathit{ek}$, the scheme can be at most IND-CPA.

  • $\begingroup$ Do you know the references about some specific scenario? $\endgroup$ – TeamBright Nov 21 '17 at 11:11
  • $\begingroup$ One example is Lai et al., "CCA-Secure Keyed-Fully Homomorphic Encryption", PKC 2016. Also you can find more by google 'keyed fully homomorphic encryption', or 'keyed homomorphic public-key encryption'(which is keyed HE which is not fully homomorphic). $\endgroup$ – AYun Nov 21 '17 at 14:25
  • $\begingroup$ Thanks, and one more question about the IND-CCA security of keyed-FHE. In the game, the adversary does not know $ek$ as you say, but it seems that it still has the access of the evaluation oracle, right? So the adversary still has a strategy like $Dec_{sk}( Eval_{ek}( +,y, 0))$, I am not understand about the methodology of the construction of keyed-FHE totally. $\endgroup$ – TeamBright Nov 27 '17 at 10:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.