Questions tagged [homomorphic-encryption]
Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).
689
questions
1
vote
0answers
17 views
How expensive would running a practical application on full homomorphic encryption be?
This is a multidisciplinary question, hopefully I can stay on topic.
It has been published that we can now use (try?) fully homomorphic encryption computation on cipher text inputs. But I'd like to ...
0
votes
0answers
16 views
What distribution is required to ensure the security of the RLWE?
In LWE, the error should be sampled from a discrete Gaussian distribution. Then, in RLWE, the error is a polynomial in $\mathbb{Z}_q[x]/(x^N+1)$, it could be sampled coefficient wise. However, when we ...
0
votes
0answers
27 views
Practicality of dangerous/unsafe content safety proof as follows
Suppose I am building a cloud storage with client side encryption. My policy is that I would not allow anyone to store pornographic, violent or otherwise unsafe content but must ensure full privacy. ...
0
votes
0answers
23 views
PYFHEL - Concatenating two encrypted strings and then decoding them
I'm trying out the PYFHEL (PYthon For Homomorphic Encryption Libraries) library, and was wondering if it was possible to concatenate two strings while encrypted and then decrypt the result.
This ...
1
vote
1answer
88 views
How is R-LWE related to lattice cryptography and homomorphic encryption?
Can someone tie everything together for me? I'm interested in H.E and I have some background in AES, DES, RSA and the like. While reading around I stumbled on Shai Halevi's course on lattice ...
1
vote
2answers
245 views
Why does bootstrapping (R)LWE homomorphic encryption produce small noise?
Why does homomorphic evaluation of the decryption circuit produce a ciphertext with "fresh" or small noise?
Rough description of bootstrapping homomorphic encryption:
Suppose we have a ...
0
votes
0answers
22 views
Could FHE scheme like BGV could be used many times, or fully homomorphic encryption could be used continuously？
Currently I was working with FHE scheme and used HElib to do homomorphic logical operation like the formal question described Homomorphic encryption methods that could support logical XOR, AND?.
But ...
0
votes
0answers
17 views
What does the “scale invariant” mean in some FHE schemes?
In some paper about FHE, the term "scale invariant" often appears. What does it means?
2
votes
0answers
27 views
Why could the error term be sampled coefficient wise?
In SEAL homomorphic encryption library, it implements the BFV and CKKS. We know the error $e\in R_q$ which is a Guassian distribution. When sampling an error term $e = \sum_{i=0}^{n-1} e_ix^i$, it ...
0
votes
1answer
73 views
In Microsoft Password Monitor implementation using HME how do they perform ComputeMatch Function?
https://www.microsoft.com/en-us/research/blog/password-monitor-safeguarding-passwords-in-microsoft-edge/
In this they mention
The server then evaluates a matching function on the encrypted credential,...
0
votes
0answers
33 views
Why are the fully homomorphic encryption algorithms the commitment?
Is there some references about the commitment scheme based on FHE ? Why could the BFV, CKKS, BGV algorithm be convert to commitment? How ?
2
votes
1answer
110 views
Python library that implements additive homomorphism of Elgamal Encryption on the Elliptic curve i.e X25519 or P-256
I'm trying to find a Python library that implements Elgamal Encryption on the Elliptic curve i.e X25519 or P-256.
My purpose is to use the additive homomorphic property of Elgamal.
I'm using https://...
1
vote
2answers
77 views
Homomorphic encryption methods that could support logical XOR, AND?
Recently I'm researching about logical circuit calculation and I hope to use homomorphic encryption to protect the whole process. I've read Gentry's paper and use some websites like https://...
2
votes
0answers
48 views
Why should the smudge noise be used?
Consider a threshold FHE scheme based on RLWE like this:
Refer to this paper
$\textbf{Initialization:}$
Every party generates his own secret key $s_i$, then uses the common polynomial $a$ to generate ...
0
votes
0answers
38 views
FHE Bootstrapping in FV12
I am trying to understand the bootstrapping step in FV12 cipher to obtain the FHE. I know the basic idea of bootstrapping is to homomorphic calculate decryption on ciphertext to obtain new equivalent ...
0
votes
0answers
31 views
Is the BFV homomorphic encryption scheme a commitment scheme?
The BFV scheme can be described as:
Public Key: $(p_0, p_1)$
To encrypt a plaintext $m$, the ciphertext is : $(c_0, c_1) , c_0= up_0+\Delta m + e_0, c_1=up_1 + e_1$
0
votes
0answers
26 views
elliptic curve scalar addition
say there is an homomorphic cryptosystem on elliptic which allows unlimited addition and only one multiplication.
So in order to same the mult operation for a later functionality, I need to add a ...
0
votes
0answers
52 views
Paillier scheme : Encoding floats into integers impact on computations
In Privacy Preserving Processing Over Encrypted Images, I could understand that appropriate encoding of floats into integers (required in Paillier) only incur negligible error in computations.
Any ...
2
votes
2answers
37 views
What is $z_b$ in this introduction to Private Information Retrieval?
I was trying to read this introduction to private information retrieval. On page 12 of the document, a scheme for 1-DB private information retrieval is discussed. I was unable to understand one of the ...
0
votes
0answers
30 views
GSW and homomorphic addition on integers
Is it possible to use the GSW scheme (Gentry, Sahai, Waters) also on integer values and not just single bits? If not, are there any schemes that support integer arithmetic with the same nice property ...
0
votes
0answers
38 views
GSW13 scheme and integer arithmetic
I'm new to lattice-based cryptography and have trouble understanding if the GSW13 (Gentry, Sahai, Waters) scheme works only on single bits. But is it also possible to encrypt integers with this scheme ...
1
vote
0answers
61 views
Efficiently prove the correctness of Paillier encryption in or “outside” a zk-SNARK
I'm working with a zk-SNARK library [1] that allows me to prove the correctness of arbitrary arithmetic circuits, and I now want to use these zk-SNARKs to prove that some Paillier [2] ciphertext $c$ ...
1
vote
1answer
49 views
All fully homomorphic encryptions (FHE) are converted into homomorphic commitments?
The GSW one of the FHE scheme is widely used as a homomorphic commitment scheme to build lattice based ABE, homomorphic signatures and NIZK and so on. But I cannot find other FHE schemes to be ...
0
votes
0answers
31 views
Homomorphic encryption in social networks
I want to gain some experience with homomorphic encryption, specifically possible applications in social networks.
I am thinking about using a HE library (such as Microsoft SEAL) with a graph database ...
2
votes
1answer
60 views
Homomorphic encryption for multiplication (AND) on bits only?
I am reading the Wikipedia article https://en.wikipedia.org/wiki/Homomorphic_encryption
and it lists unpadded RSA, ElGamal, Goldwasser-Micali, Benaloh, Paillier as possible partially homomorphic ...
0
votes
0answers
28 views
Is overflow-ing possible in CKKS FHE scheme?
I'm using the CKKS Fully homomorphic scheme using Microsoft SEAL, and wonder what will be the result of overflowing a certain floating point variable? Is it even possible to do so?
I found a statement ...
3
votes
0answers
60 views
Can the hash of the ciphertext be derived from the hash of the plaintext
Let $C$ be a symmetric cipher $H$ a hash function.
Alice uses $C$ with a key $k$ to encrypt plaintext message $m$ yielding ciphertext $c$. She then calculates the hash of the message $h_m = H(m)$ and ...
0
votes
0answers
19 views
How to count the number of selected element in each slot within the packed ciphertext
Given an encrypted ciphertext (n slots, packed n elements into a single ciphertext), such as 𝑐𝑡={(2,0,1,2),(3,2,1,3),(3,4,0,4),(5,1,4,2)}.
Formally, 𝑛 slots can be expressed as 𝑚 blocks, each ...
1
vote
0answers
34 views
CRT decomposition in NTT for BFV
AS explained in section 4.5, decomposition for relinearization (2nd step of ciphertext multiplication in bfv) can be done using RNS components of ciphertext. In other words, they proposed a way to do ...
2
votes
1answer
91 views
Decrypting message as MSB in regev scheme
I was watching this FHE video and it define Regev encryption scheme as fallow :
kyegen:
sk : choose $t = (1,s)^t \in \mathbb{Z}_q^{n+1}$
pk = $A \in \mathbb{Z}_q^{m*(n+1)}$ random except $[A * t]_q$ ...
1
vote
0answers
33 views
How to generate a collinear point without revealing one of the existed two points?
Assume we have point $A(x_A,y_A)$ and point $B(x_B,y_B)$, and now we want to generate a point $C(x_C,y_C)$ so that $A,B,C$ are on the same straight line. All mod $p$.
If $A$ or $B$ could not be ...
5
votes
2answers
1k views
Can I alter encrypted data without decrypting it?
I didn't find a direct solution for it. Can I modify encrypted data without accessing it?
If there is an example, I would appreciate it.
1
vote
0answers
34 views
cascade encryption - If I encrypt my data using many different encryption algorithms
If I encrypt my data using many different encryption algorithms (using different passwords)
how will an adversary be able to decipher the message?
0
votes
0answers
43 views
How is a NAND gate constructed from just addition and (mixed) multiplication in a FHE circuit? [duplicate]
From what I've read I know that FHE requires "circuits" to construct functions and gates to operate on the FHE encrypted data. I've also read that these circuits are constructed from just ...
0
votes
0answers
34 views
Using two or more encryption algorithms together, how do we compute the strength of the final encryption?
If two or more encryption algorithms are used together, how do we compute the strength of the final encryption?
And how would the application perform against quantum computers?
The first two tables ...
0
votes
0answers
26 views
Homomorphic encryption watermarking identity
I've been doing some research on FHE and SWHE schemes, most specifically on watermarking.
As far as I've understood, you take as the merchant, take the buyer information encrypted and his public key ...
1
vote
0answers
28 views
Threshold Encryption Scheme for Multiple Messages
In a threshold encryption scheme, a dealer generates $(PK,SK1,…,SKn)$ and distributes the secret keys to users indexed by $1,…,n$, and if a combiner obtains $t+1$ partially-decrypted ciphertexts, it ...
0
votes
1answer
68 views
CKKS security estimation for Palisade
My question is rather practical and specific. I am trying to setup an efficient CKKS scheme in Palisade. To this end, the automatic choice for secure parameters has to be turned off and I rely on the ...
2
votes
1answer
83 views
What's the difficulty of using elliptic curves to design homomorphic encryption protocols?
I have recently been very interested in elliptic curves because they are a powerful tool in crypto, ECC, pairing, etc. However, it seems that elliptic curves are not popular in homomorphic encryption. ...
1
vote
2answers
83 views
What is batching in homomorphic encryption?
I have been reading journals about FHE schemes and I keep encountering the term "batching". What does it mean to batch in homomorphic encryption in a simple way?
0
votes
0answers
38 views
Autonomous homomorphic encryption
So, my understanding of homomorphic encryption is that Alice has a private key and an algorithm, gives an encrypted copy of the algorithm to Bob, Bob runs the algorithm without understanding it, and ...
0
votes
0answers
38 views
Zero knowledge proof of Paillier cryptosystem
I have read the paper recently and I am curious about part 3. According to part 3, Bob sends a zero-knowledge proof such that $c_B=b\times_{E}c_A+_E E_A(\beta')$. Then Alice should first decrypt the ...
2
votes
0answers
40 views
Predicting with a machine learning model while preserving the privacy
Imagine Alice has trained a machine learning model. She wants to store her model in a blockchain so that everyone can use it; however, she wants her model to be private so that no one can steal her ...
1
vote
1answer
51 views
can we know the sign of a ciphertext (homomorphic)
Is it possible to know the sign (positive or negative) of an homomorphic ciphertext particularly under paillier scheme ?
2
votes
1answer
53 views
What schemes support atomic decryption+reencryption
What encryption schemes support this workflow?
Vendor encrypts and publishes information for the client
Client generates public and private key
Vendor encrypts private information
Vendor publishes ...
3
votes
3answers
129 views
functional encryption over homomorphic encryption
I recently read about "functional encryption" which seems interesting, although I didn't understand yet how it works ... but is it possible to combine it or adapt it with homomorphic ...
1
vote
1answer
114 views
zeroing out slots in SEAL ciphertext
I've been messing around with SEAL library for a few days and I've got a following question.
I've got a bunch of datapoints [x_1, ..., x_n], n < poly_mod_deg of type 'double' and I use batch ...
2
votes
1answer
148 views
Are all homomorphic encryption schemes based on latticed-based schemes?
PALISADE offers a pool of Homomorphic Encryption schemes and it is stated that "PALISADE is a general lattice cryptography library ...". My question is rather simple: are all homomorphic ...
0
votes
0answers
38 views
Security analysis of encrypting a matrix after homomorphic encryption by the random mask
Problem Definition
Alice has two private matrices $M_A$ ($N*M$), $M_a$, where $M_a$ is the binary matrix of $M_A$
Bob has a private matrix $M_B$($N*M$)
Alice and Bob are semi-honest server and ...
0
votes
0answers
46 views
Is there anyone intrested in quantum fully homomorphic encryption?
Recently, I have read a paper named "Classical Homomorphic Encryption for Quantum Circuits". The author claims a quantum scheme that can apply an encrypted (like GSW encryption) bit to ...
