Questions tagged [homomorphic-encryption]
Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).
587
questions
1
vote
1answer
52 views
Fully Homomorphic Encryption - state of the art
What are the latest advances in fully homomorphic encryption? First of all, I am interested in cryptosystems based on LWE / RLWE and NTRU problems.
2
votes
1answer
37 views
Security of somewhat homomorphic encryption via LSB encoding?
I'm reading this paper
https://eprint.iacr.org/2011/344.pdf
It says that
"The secret-key encryption scheme whose security is based on the LWE assumption is rather straightforward.
To encrypt a bit, $...
3
votes
1answer
50 views
Proving the right encrypted message was sent
Total amateur to crypto here but I've searched and searched and am at the extent of my knowledge. I've gone down several avenues to satisfy what I'm looking for but I'm just going to describe what I'd ...
2
votes
0answers
32 views
Does the relationship between plaintext and ciphertext moduli affect the security of BGV/BV SwHE?
The SwHE schemes due to Brakerski and Vaikuntanathan (BV) and Brakerski-Gentry-Vaikuntanathan (BGV) have common concept in which the message bit is put in the least significant bit of the ciphertext.
...
1
vote
0answers
58 views
Is there a way to perform a one way function on encrypted data?
Does the following scheme exist?
Let f be a one-way function (say, an encryption scheme). Let $Enc_{sk}(x)$ be an encryption of x. We then have $Eval_{pk}(f, Enc_{sk}(x)) = f(x)$.
Note that this is ...
0
votes
0answers
17 views
Guaranteeing uniqueness of a string, irrespective of its characters position when generating LtHash-like sum [migrated]
I'm trying to accomplish what LtHash offers as functionality, leaving the secure concept alone: compute a sum from a list of items, irrespective of their order to then hash it and use it as an ...
2
votes
0answers
64 views
Multi-party computation with only 1 party?
MPC is $f(E_1(a), E_2(b)) = c$, where $E$ is encryption by different keys $k_1$ and $k_2$.
Homomorphic encryption is $f(E_1(a)) = E_1(c)$, where the input and output are encrypted.
I want $f(E_1(a)) ...
1
vote
1answer
68 views
Paillier's Cryptosystem - Homomorphism
I'm lacking quite some mathematical knowledge here, but could anyone please explain to me why the Paillier cryptosystem is still (additive/multiplicative) homomorphic despite introducing a random ...
1
vote
1answer
65 views
Complexity of computing zk-SNARK Proofs
Disclaimer: I have no background in cryptography, and everything I'm asking about is what I've learnt from last couple of days of frantic reading on this topic. Any help is much appreciated.
Q: What ...
1
vote
1answer
29 views
Range query on array of encrypted data using homomorphic encryption
Given an array or database entries of encrypted data is it possible given a min/mix value to get a range of encrypted entries? The min and max values would also be encrypted.
1
vote
0answers
26 views
What is the current state-of-the-art of function-private functional encryption?
Are there any known constructions of functional encryption with function-privacy for arbitrary functions (e.g. not just inner-product)? If so, are these constructions currently feasible or for now ...
2
votes
1answer
52 views
How the FHE encrypts a k-bit message just with one-bit encryption scheme?
I'm reading "Fully Homomorphic Encryption over the Integers"——the first generation of FHE. However, this paper seems to detail a scheme to encrypt each bit in a message. I'm very confused about how to ...
3
votes
2answers
168 views
Homomorphic Modular Reduction for Secure Storage
My question is quite similar to Homomorphic modulo, but I want to give a context where the operation is carried in an outsourced environment.
Are there any specific homomorphic cryptographic schemes ...
0
votes
0answers
45 views
Question about Gentry's “Computing Arbitrary Functions of Encrypted Data”
I am working through the "Computing Arbitrary Functions of Encrypted Data" by Gentry, trying to understand more about Fully Homomorphic Encryption. I'm stuck trying to understand why his "Somewhat ...
0
votes
1answer
37 views
difference between function f in eval and dec of homomorphic authenticated encryption
In the homomorphic authenticated encryption, as described 1, there are Eval and Dec PPT algorithms:
In Eval, f is the function to be performed on the encrypted data. However, I need to know why it ...
2
votes
1answer
174 views
Do any NIST PQC have “homomorphic” public keys, in the sense that any two pubkeys derive a combination pubkey?
Background:
The MathMesh crypto platform (refs at the bottom) is a newly-proposed technology stack which has been somewhat cheekily called a "Grand Unified Theory of Security on the Internet". Its "...
5
votes
2answers
147 views
Does homomorphic encryption hide the algorithm itself?
The question is rather simple, but finding resources and answers quite tricky. Homomorphic encryption should enable us to compute over encrypted data. What if the algorithm for computing should be ...
1
vote
2answers
61 views
Meaning of “integers modulo 4 ” in “Fully homomorphic encryption modulo Fermat numbers” scheme
My question refers to the paper "Fully homomorphic encryption modulo
Fermat numbers" by Antoine Joux. On page 3, the author describes a basic concept of the system:
As many FHE systems, we deal ...
0
votes
0answers
22 views
Is there any implementation of threshold BGN homomorphic encryption?
The BGN paper (Evaluating 2-DNF Formulas on Ciphertexts) used a threshold variant of BGN. I also want to use this cryptosystem, however, I cannot find any open-source implementation. Is there any such ...
1
vote
0answers
37 views
Key derivation scheme with shared secrets?
I want to derive a list of sub-keys derived[t] from a master key mk by a key derivation function ...
1
vote
1answer
40 views
Retrieving correct ciphertext from additive ElGamal
I have been studying additive ElGamal and I think I have the hang of it except the part where the message $M$ must be retrieved by computing the discrete log of $g^M$.
From what I've read, the ...
2
votes
1answer
84 views
Is there a cryptosystem which allows slicing and concatenating strings without decryption?
I want a cryptosystem with the following four functions:
...
0
votes
1answer
45 views
One-way Functions for Floating Points
Are there any commutative one-way functions for floating points?
I tried to explain why I need these functions.
First, I describe the problem on a high level and then I further formalize it;
There ...
1
vote
1answer
65 views
Sum vector elements homorphically
I'm looking for the homomorphic version of the following (I'm using Python here):
$ a = [1,2,3]
$ s = sum(a)
$ print(s)
6
Is there an open source fully ...
2
votes
1answer
40 views
Reference for the Security Analysis of Ring-LWE
Can someone please share a link of any research paper or web-page analyzing the security of Ring-LWE? Essentially, how should I choose my parameters to get security equivalent to 128-bit or 256-bit?
1
vote
0answers
57 views
Homomorphic Public/Private Key Encryption Scheme for Floating Numbers
Is there any public/private homomorphic encryption scheme that directly works on floating numbers or vectors of floating numbers?
In our application, we want to find out if
$$v_1 \approx v_2, \qquad\...
3
votes
1answer
47 views
Is it possible to sample HE ciphertexts using pseudo-random generator?
I'm trying to sample HE ciphertexts which serve as ciphertexts encrypting some random values. I have realized a example program using Microsoft SEAL, which implements a variant of BFV scheme. ...
0
votes
0answers
47 views
Hash function over numbers that preserve addition and multiplication
I wonder if there is a known hash function that for any $x$, $y$ which are numbers in a certain range with certain accuracy (I guess one can think of them as integers?), you can define two functions ...
1
vote
1answer
91 views
Can homomorphic encryption be used to exchange keys?
Fully Homomorphic Encryption (FHE) allows computations be done on ciphertexts. Can this technique be used to exchange keys?
For example, Alice and Bob need to agree on a 4-bit secret key. Alice sends ...
0
votes
0answers
47 views
Why is the Paillier cryptosystem not considered fully homomorphic encryption? [duplicate]
Paillier is an additive homomorphic encryption system that can achieve the encrypted version of its sums.
However, we can calculate the encrypted version of their multiplications by raising an ...
1
vote
0answers
36 views
Is there a standard benchmark data set for “Homomorphic Encryption” implementations?
Both in terms of statistical analysis (mean/variance, histograms, contingency tables, etc) and machine learning data sets. The question has also been asked here.
3
votes
1answer
129 views
Why is the Domingo-Ferrer cryptosystem not used in practice?
The Domingo-Ferrer cryptosystem is a fully homomorphic cryptosystem. It works fast enough. I have only seen known-plaintext attacks. Is this a reason not to use it in practice? Or are there more ...
1
vote
0answers
38 views
Are biases narrowed towards the provenance of hard NP complete problems relevant?
I hear of randomized reduction, deterministic reduction and non-deterministic reduction of complexity from A to B problems. This could make things impossible for polynomial time adversary prying into ...
0
votes
0answers
30 views
Do I need to use a matrix of size N x n for the public key in the BGV scheme when using Ring-LWE?
I'm going through the BGV paper and trying to make a toy implementation, but I just want to focus on Ring-LWE. In the paper, they set $N = \lceil{(2n + 1)\log_2(q)\rceil}$, and generate $A'$ uniformly ...
2
votes
1answer
44 views
Maintaining validity of ZKP throughout re-randomization of homomorphic ciphertext without linkability to previous ciphertext
Question:
How is it possible to adapt a ZKP for a homomorphic ciphertext to still be valid after said ciphertext has been re-randomized?
Context:
In a lot of e-voting systems homomorphic encryption ...
2
votes
0answers
55 views
Compute ln function of a Paillier encrypted value [closed]
If I have an encrypted value $Enc(x)$ with Paillier cryptosystem, is it feasible to compute an encryption form of $\ln(x)$ or its approximation using homomorphic properties? The input $x$ is always ...
1
vote
1answer
60 views
BGV for three multiplication level/depth
Can BGV homomorphic encryption scheme support three multiplication level/depth with the help of key switching and modulus switching?
If Yes, how does one set up the parameter to achieve that?
0
votes
0answers
49 views
homomorphic encryption function representation
As it known, Homomorphic encryption can be used for privacy-preserving outsourced storage and computation. In various constructions, the computations are represented as either Boolean or arithmetic ...
2
votes
1answer
70 views
Why FHE only needs support for addition and multiplication
For example, given $E(m_1)$ and $E(m_2)$ to the cloud. How does it calculate $E(m{_1}^{m_2})$?
Is it related to the claim that any computable function can be represented as a circuit containing or <...
1
vote
2answers
187 views
What is Homomorphic encryption evaluation key
In some homomorphic encryption schemes (e.g Multi-key fully homomorphic encryption report, Computing Blindfolded: New Developments in
Fully Homomorphic Encryption), it defines an encryption key, a ...
2
votes
0answers
58 views
What is labeled program
I've been studying homomorphic encryption. From their instantiations, i read Labeled Homomorphic Encryption (labHE) scheme 1 where it combines the notion of homomorphic encryption with labeled ...
0
votes
0answers
34 views
Implementation of addition in the scheme TFHE
I want to implement the addition operation in a fully homomorphic scheme - TFHE. It contains homomorphic operations on bits: AND, OR, NOT, XOR.
Found addition algorithms include left and right shift. ...
0
votes
0answers
25 views
An example of calculation of BGV encryption
Can anyone give an example RLWE BGV encryption with numbers? like where m=8 (ring dimension), q=ciphertext modulus = 33=3*11 with level=2 What are COEFFICIENT and EVALUATION representation ?
0
votes
0answers
31 views
Can someone explain Relinearisation process in FV scheme for Homomorphic Encryption?
I am trying to understand the relinearisation process in FV scheme for Homomorphic Encryption based on R-LWE. Can one someone explain how the homomorphism keys are generated?
I have worked out an ...
1
vote
0answers
57 views
How to solve a simple case of a RLWE problem
I've been reading up on the Ring Learning with Errors problem and the proposed attacks, in relation to homomorphic encryption. Some of the literature has been quite difficult to understand - what I ...
6
votes
2answers
234 views
FHE: What is the difference between multiplicative depth and multiplicative level?
I have seen the terms multiplicative depth and multiplicative level while reading
Faster homomorphic encryption is not enough: improved heuristic for multiplicative depth minimization of Boolean ...
0
votes
0answers
41 views
What is the main purpose of using Boolean Circuit Model in Homomorphic Encryption?
Why do we use or have Boolean Circuit Model is it because since it uses gates and bits we could adapt it into a hardware model?
1
vote
1answer
69 views
Is there any relationship between Paillier Cryptosystem's random r and other factors
I want to try run an example of Paillier cryptosystem(Algorithm), So i just started with some basic examples, but cannot obtain correct result/decryption.
I just change random factor ...
1
vote
1answer
125 views
Where does bootstrapping occur, client side or server side?
In Fully Homomorphic Encryption, where does the bootstrapping procedure performed, in the client-side or the server-side?
Also, which side holds the secret key and the public key?
4
votes
2answers
107 views
What are the advantages of using Leveled Homomorphic Encryption over Somewhat Homomorphic Encryption?
Is there a point in using LHE over SHE?
From what I understand, SHE is like an extended version of LHE, the only difference is that you limit the depth of circuits that can be evaluated. Therefore, I ...
