# Bitwise homomorphic encryption

I am fairly new to HE and would like a short clarification on how exactly integers are securely encrypted using bits. The main idea is that one encrypts each bit value and represents the n bit number as n ciphertexts like this: $$E(x)=(E(x1),E(x2),...,E(xn))$$ where xi is the bit on position i. Why is that secure, when I have just ciphertexts that correspond to '0' and '1' in a particular order? Example: $$101 -> (E(1), E(0), E(1))$$ Can't I just guess 101 only from the E() values. Why is this not possible? Pointing me out to a good paper or read on that would be greatly appreciated!

• Any HE scheme that will qualify as a reasonable scheme will provide IND-CPA security and hence encryptions of 0 and 1 are indistinguishable. So from simply looking at the ciphertexts there will be no way of deciding whether a ciphertext at some position encrypts 0 or 1. Commented Oct 10, 2018 at 8:47

Yes the adversary can guess the plaintext, and there is some probability $$p$$ his guess is correct. There is no way we can prevent that, and this is not a security flaw of the encryption scheme.
If the homomorphic encryption scheme you use is IND-CPA secure (or equivalently, semantically secure), the ciphertext should be indistinguishable. It entails that any (PPT) adversary cannot gain useful information from the ciphertext about the plaintext, hence the ciphertexts do not give the adversary any advantage in guessing the correct plaintext. So without the ciphertext, the probability of guessing correctly is $$p$$, and with the ciphertext, the probability of guessing correctly is $$p+\epsilon$$ where $$\epsilon$$ is negligible. Thus the ciphertexts, although are produced from the plaintexts, are useless from the adversary's point of view.