Homomorphic Encryption (HE) which supports any function on ciphertexts is known as Fully Homomorphic Encryption (FHE), while Partially Homomorphic Encryption (PHE) includes encryption schemes that have homomorphic properties, with respect to one operation (e.g., only addition or only multiplication, but not both).

Are symmetric homomorphic encryption schemes (like Domingo-Ferrer, Castelluccia, etc.) also considered to be PHE?

  • $\begingroup$ I added links to what I think are the relevant publications. If they are not correct, please update. $\endgroup$
    – mikeazo
    Jul 10, 2013 at 14:44

1 Answer 1


It will depend on the exact system.

The cryptosystem of Castelluccia is additively homomorphic and is thus a PHE cipher.

The cipher of Domingo-Ferrer was broken by Wagner and others. Thus, I wouldn't classify it as either.

The cipher of Xiao, et al. is fully homomorphic.

To determine if a symmetric scheme is a PHE or FHE, just look at what operations it supports. If it supports a single operation (say addition), then it is PHE. If it supports both operations (addition and multiplication), then it is FHE.

A recent trend in the HE encryption literature has been something called Somewhat Homomorphic Encryption (SHE). These are ciphers which support both addition and multiplication but not unlimited numbers of operations. E.g., BGN is a SHE cipher as it supports unlimited additions and one multiplication. The current FHE ciphers are all built using SHE ciphers plus a bootstrapping operation (or generating the keys such that enough of each operation can be supported to compute the desired function, making bootstrapping unnecessary).

  • $\begingroup$ What about the BGN scheme ? $\endgroup$
    – zof
    Jul 12, 2013 at 15:14
  • $\begingroup$ @user7552, updated to include BGN. $\endgroup$
    – mikeazo
    Jul 12, 2013 at 16:42
  • $\begingroup$ I think these terms are misleding. It depends on the underlying algebraic structure. RSA is fully homomorphic if you consider the monoid $(\mathbb{Z}_n,*)$ but somewhat homomorphic, if you consider the ring $(\mathbb{Z}_n,*,+)$. In the monoid $(\mathbb{Z}_n,*)$ you have only functions, that can be build by multiplication and any such function can be computed on cyphertext in RSA. In any case a fully homomorphic encryption is then an automorphism of the underlying algebraic structure. I.e. monoid automorphis, or ring automorphism or ideal-lattice autom. $\endgroup$ May 16, 2018 at 12:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.