Skip to main content

Questions tagged [homomorphic-encryption]

Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).

Filter by
Sorted by
Tagged with
0 votes
0 answers
23 views

Questions about aggregate encryption local decryption

Suppose there exists a sender with multiple receivers (one-to-many), the sender and each receiver have their own public and private keys, and the sender generates for each receiver a different message ...
Anja's user avatar
  • 1
0 votes
1 answer
35 views

Can Batch Encode and Bootstrapping Be Used Together

I have referenced some documents stating that "To implement bootstrapping, the plaintext modulus 𝑡 needs to be chosen as a prime power." Meanwhile, the SEAL library documentation on Batch ...
Huy Vu's user avatar
  • 1
1 vote
2 answers
74 views

Real-or-Random Security (IND$-CPA) for Homomorphic Encryption?

I am reading papers about homomorphic encryption recently. To my knowledge, all of them opts for the Left-or-Right security i.e. distinguish between $M_0$ and $M_1$ given $\mathcal{E}_K(M_b)$ for $b \...
gan's user avatar
  • 13
1 vote
1 answer
50 views

Literature on Batching in FHE

From what I understand, the folklore way to batch Ring-LWE style cipher texts is to use the Chinese remainder theorem. I am wondering if there are any different approaches/optimizations to this style ...
woah's user avatar
  • 27
0 votes
0 answers
26 views

Should Homomorphic Encryption Keys Be Generated by a Key Generation Server or the Data Owner?

I'm currently working on a project involving homomorphic encryption and I'm trying to determine the best practices for key generation. Specifically, I'm unsure whether the keys should be generated by ...
snow's user avatar
  • 1
4 votes
2 answers
155 views

Why is division in fully homomorphic encryption impossible?

I am trying to use division in PySyft or tenSeal or anything but the devs still haven't learned how to support division?!?!
David Bower's user avatar
1 vote
1 answer
57 views

How can one model the behaviour of CKKS decryption noise?

I am trying to program a simulator for CKKS. It is a "simulator", in the sense that there is actually no encryption involved, but to a person seeing only the plaintexts (before encryption ...
Michael's user avatar
  • 31
2 votes
2 answers
108 views

Efficient commutative one-way encryption or hashing

Spent two days researching the subject, but so far I haven't come up with a satisfying answer as to whether there is a feasible solution to the following problem: A has a secret $m$ whereby $0 \leq m \...
Andreas P.'s user avatar
1 vote
1 answer
73 views

Decrypting the sum of votes but not the single vote

For educational reasons I am implementing an e-voting platform. The idea is that the voter generates the ballot on client side, the ballot is verified using a zero-knowledge proof protocol. Also, the ...
g3k0's user avatar
  • 13
0 votes
2 answers
80 views

About IND-CPA security of Homomorphic Encryption

I am trying to understand IND-CPA security in (Partially) Homomorphic Encryption schemes. However, the result of the proofs is usually something stating that a ciphertext does not expose anything ...
Daniel Morales's user avatar
0 votes
1 answer
76 views

Plaintext modulus choice for Fully Homomorphic Encryption

For SIMD fully homomorphic encryption scheme like BFV/BGV, and the underlying R-LWE problem parameterized by $n, p, q, \alpha$ (respectively the dimension, the plaintext modulus, the ciphertext ...
ProfCornDog's user avatar
0 votes
0 answers
21 views

Ideal multiplicative depth for a generic Levelled CKKS scheme

If I need to implement a generic hardware accelerator for the Levelled CKKS scheme (no bootstrapping supported), what would be the ideal multiplicative depth I should support? - that can support a ...
Moopan's user avatar
  • 1
0 votes
0 answers
66 views

Difficulty of factoring large semiprime N if given a second value y = (p-1)*r, where r is a random large prime?

Lets say we have 2 public values: N and y $$ N = pq $$ $$ y = r(p-1) $$ Where p, q, and r are large primes, are different, have a large distance between them and are kept secret. I have three ...
block103's user avatar
1 vote
1 answer
75 views

Is it possible to homomorphically evaluate an encryption circuit?

I know that it is possible to homomorphically evaluate a decryption circuit as it is the main idea behind bootstrapping, but I was wondering if it was possible to evaluate an encryption circuit ...
ProfCornDog's user avatar
1 vote
1 answer
65 views

Implement reciprocal of a floating point number using Chebyshev approximation in CKKS

I am trying to obtain the reciprocal of a floating point value $x$ using the Chebyshev approximation, where $x$ is mostly in the order of $10^3$ to $10^5$. Subsequently, I am trying to implement that ...
Sumana Bagchi's user avatar
2 votes
1 answer
83 views

The cost of the additive homomorphic encryption of McEliece cryptosystem

Let's have two integer-vectors $v_1$ and $v_2$ that are encrypted by McEliece public key. An intermediate node between the sender and receiver receives the two encrypted vectors $\text{E}(v_1)$ and $\...
Anas Ahmad's user avatar
0 votes
0 answers
32 views

Interactive Zero-Knowledge Proof for the Multiplication Gate

Refer to an interesting article (link) on Medium on the subject matter. To understand more about pRandomValue and vRandomValue. The article mentioned, "pRandomValue, on the other hand, is used to ...
user60588's user avatar
  • 297
0 votes
0 answers
125 views

Homomorphic Decryption with the Encryption (ciphertext) of Secret key for Bootstrapping purpose

The section 3.1 of the GHS11 mentions that: Given the $q_L$-ciphertext $c = (c_0, c_1)$ (that encrypts a polynomial $a \in F_2[X]/F(X)$), we postprocess it to get $c^\prime = (c_0 + c^*, c_1) \text{ ...
kindi's user avatar
  • 11
2 votes
1 answer
54 views

Initial approximation in CKKS Bootstrapping

In this CKKS bootstrapping paper https://eprint.iacr.org/2018/153 the authors use a Taylor expansion to approximate the complex exponential function within a small range. More precisely, for the input ...
opag's user avatar
  • 63
1 vote
1 answer
149 views

How to write zk-snark arithmetic circuits

Paper: "Dispute-free Scalable Open Vote Network using zk-SNARKs" by Muhammad ElSheikh Available at: https://arxiv.org/pdf/2203.03363.pdf In this paper, the author has mentioned some pre-...
user60588's user avatar
  • 297
1 vote
0 answers
37 views

Is it possible to verify and prove the decryption of an FHE cyphertext without the verifier knowing the key with zkProof?

Suppose Bob encrypts a plaintext($p$) with an FHE scheme and a key($k$), then sends the $c$ to Alice. Alice wants to know the plaintext but can't trust that Bob won't send a different string. Can Bob ...
Vasily Sobolev's user avatar
0 votes
2 answers
138 views

Are security assumptions based on quantum computers too strict? Causing cryptographers to tie their own hands

Have security assumptions based on quantum computers de facto constrained the emergence and application of many new cryptographic schemes (e.g., fully homomorphic encryption)? It seems to me that, in ...
WAN Lipeng's user avatar
1 vote
1 answer
122 views

Find two hard to reverse functions f and h such that f ∘ h ∘ g = h (f and h injective, no constraints on g)

I am looking from 3 functions $f,g,h$ from $\mathbb N \to \mathbb N$ (they can be bijections, they need to be injective at least), such that: $$f \circ h \circ g = h $$ and $f$ is hard to reverse ...
Mathematical_Noob's user avatar
2 votes
1 answer
102 views

Bootstrapping in TFHE

I've read the series of blog posts explaining TFHE scheme on zama.ai's website (four parts), and some things are not clear to me. I would appreciate if someone can shed some light on those topics. I ...
Pier's user avatar
  • 23
1 vote
2 answers
82 views

Private set intersection using homomorphic encryption

I have a question regarding the scheme below. PSI using homomorphic encryption appears to subtract the plaintext into the ciphertext. I understand that homomorphism is maintained in operations between ...
shs's user avatar
  • 13
0 votes
0 answers
52 views

Privacy Challenges in Applying Fully Homomorphic Encryption to Find Closest Shops Based on Zipcodes

Context To learn about fully homomorphic encryption (FHE) and a new language I implemented the Paillier cryptosystem in Go, and I thought it would be fun to apply it to the following interaction: A ...
a.t.'s user avatar
  • 101
1 vote
0 answers
80 views

Digit Extraction for HE Bootstrapping

I was wondering if someone could explain the Digit Extraction from HElib in simple words: Apply a homomorphic (non-linear) digit-extraction procedure, computing $r$ ciphertexts that contain the ...
kindi's user avatar
  • 11
1 vote
0 answers
18 views

Non-prime value chosen for u in DGK encryption

In DGK encryption, one of the parameters of public key is value u where it is a small prime with minimum length l+2. It is not obvious for me what is the security compromise if u is not prime. Any ...
Fattaneh's user avatar
2 votes
1 answer
59 views

About Naccache-Stern higher residue cryptosystem definition

About the Naccache-Stern cryptosystem, I have found two different encryption algorithms: In the original paper from Naccache and Stern, the encryption step is performed by calculating $c = g^m \...
hectorvr14's user avatar
0 votes
1 answer
64 views

Homomorphic Encryption and Conjugation

In the implementation of HEAAN, they have implemented the conjugate function. It computes conjugate of a polynomial. Effectively they have reverted the positions of the coefficients and negated their ...
kindi's user avatar
  • 11
1 vote
0 answers
73 views

Privacy-Preserving User Tracking Across Systems with Homomorphic Encryption or hashing

I'm working on a project where we have three different software systems—let's call them A, B, and C. Systems A and B handle user data identified by phone numbers and want to send user actions to ...
Mr Alihoseiny's user avatar
1 vote
0 answers
44 views

Dealing with MITM attack in e-voting systems

I've read many e-voting papers that use El-Gamal scheme which I recall is vulnerable to man-in-the-middle attack, yet I find no discussion or even mentioning of it in those papers. -Does anyone knows ...
ShAr's user avatar
  • 160
0 votes
0 answers
42 views

I'm wondering if using the same one public key does not guarantee privacy in the computation of multiple data owners

Participating entity: multiple data owners, computing clouds Protocol: The multiple data owners send their data to the computing clouds, which perform the computation of the data. Privacy protection:...
user2642459's user avatar
1 vote
0 answers
98 views

Understanding Gentry's initial FHE construction based on ideal lattices

I am trying to understand the encryption procedure in Craig Gentry's initial construction for FHE described in Fully Homomorphic Encryption Using Ideal Lattices. Unfortunately after repeated attempts ...
Parham's user avatar
  • 111
0 votes
0 answers
57 views

divide integer to multi by polynomial ring in BFV homomorphic algorithm

The BFV algorithm is one type of fully homomorphic encryption algorithms. How can I encode an integer to polynomial ring by using batch encoder based on $R_t := {Z_t[X] \over ⟨(X^n)+1⟩}$? The ...
Nibras's user avatar
  • 1
0 votes
0 answers
17 views

[error reducing techinique in lattice based commitment]

I am aware there are many techniques to reduce the error of lattice-based homomorphic encryption. But is there any technique to deal with lattice-based homomorphic commitment, e.g., More Efficient ...
js wang's user avatar
  • 327
1 vote
1 answer
63 views

Decryption of Naccache–Stern cryptosystem is not guaranteed for large keys

Naccache-Stern cryptosystem is mainly based on Chinese Remainder Theorem. According to its wiki page and Partially Homomorphic encryption book, I generated following keys. 1- Picked a family of k ...
sefiks's user avatar
  • 229
0 votes
1 answer
69 views

Understanding and Implementing fast base conversion (FastBConv, bconv) in Mathematica

According to Section 2.3 of Full-RNS CKKS: More precisely, for a basis $ \left\{p_{0}, \ldots, p_{k-1}, q_{0}, \ldots, q_{\ell-1}\right\} $, let $ \mathcal{B}=\left\{p_{0}, \ldots, p_{k-1}\right\} $ ...
Tokubara's user avatar
  • 103
0 votes
0 answers
48 views

merging structured encrypted data

this is a followup of the post I made there: https://stackoverflow.com/questions/77428690/merging-structured-encrypted-data Essentialy, I'd like to know if there is a way to merge bencoded data (or ...
Plop's user avatar
  • 1
1 vote
1 answer
83 views

Homomorphic encryption with multiple keys that is secure under the assumption of a compromise of the combined key

Is it possible to extend the general concept of homomorphic encryption: $$f(m_1)\cdot f(m_2)=f(m_1+m_2)$$ to: $$f(m_1)\cdot g(m_2)=f\cdot g(m_1+m_2)$$ is it further possible to construct the scheme in ...
baxbear's user avatar
  • 125
1 vote
1 answer
78 views

Why the refresh (modulus and key switching) is required in BGV after addition?

I am reading the BGV paper. On page 18, after addition, the protocol will also refresh (modulus and key switching), may I ask why is this required? It seems to me that I can still use the same secret ...
js wang's user avatar
  • 327
1 vote
1 answer
60 views

in Homomorphic Encryption Standard, why in the LWE increasing security level yields smaller ciphertext?

I am currently reading Homomorphic Encryption Standard. May I ask that for table 1 in the link, why increasing the security level will yield a smaller ciphertext size (log q)? I attach a screenshot ...
js wang's user avatar
  • 327
0 votes
0 answers
67 views

[About choosing params in BGV like ciphertexts]

I am new to lattice-based cryptography, so sorry that this question might seems stupid May I ask that how can I choose the BGV parameter of ciphertext with plain text in mod 128, and error in ...
js wang's user avatar
  • 327
0 votes
0 answers
66 views

Question about the bootstrap of BFV

The description of bootstrapping in Section 5 of the BFV paper (https://eprint.iacr.org/2012/144) is somewhat challenging to grasp, and I have two specific questions: The author mentions that if the ...
纪老猴子's user avatar
0 votes
0 answers
50 views

Approximate-GCD problem in polynomials

I am trying to understand the two main hard problems that have been explored in the context of homomorphic encryption: Learning with Errors Problem (LWE) and the Approximate-GCD (AGCD) problem. I have ...
Anisha's user avatar
  • 11
1 vote
2 answers
143 views

About multiply by constant of LWE

I am new to lattice-based cryptography May I ask that for a lattice-based encryption $$enc(m) = A^{T}R+m \bmod q$$ If I set the $q$ to be able to decrypt to $m$ (and suppose the bound of $q$ is tight ...
js wang's user avatar
  • 327
0 votes
0 answers
21 views

Metrics for difference/error of output and ideally output

I'm working in some homomorphic encryption for my Ph.D. but I'm not of the field... So I'm possible going to ask a really simple question that I'm struggling to find an answer on the internet. ...
mmazz's user avatar
  • 21
0 votes
0 answers
43 views

question for lemma 4 of the BGV paper

I would like to ask a question that arose when reading the proof of lemma 4 on page 10 of this BGV paper: The assumption is: And the inequality: So it seems that $$ \sum_{j=1}^{n} \parallel c'[j]-(p/...
js wang's user avatar
  • 327
0 votes
1 answer
207 views

Is there any cheaper way for multiplying a plaintext scalar to a vector?

Assume I am using the SIMD encryption of homomorphic encryption. Performing plaintext-ciphertext multiplication between two vectors $\mathbf{a}$ and $\mathbf{x}$ means $Dec(\mathbf{a} \times Enc(\...
Zhengyi Li's user avatar
1 vote
1 answer
127 views

Could Yao's Millionaires' problem be used as a problem of binary search?

I recently started reading about Yao's Millionaires' problem. If the Yao's Millionaires' problem is capable of finding if one party has less money / more or equal money than the other party, then is ...
bd55's user avatar
  • 33

1
2 3 4 5
19