Questions tagged [homomorphic-encryption]
Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).
525
questions
0
votes
0answers
26 views
Fully homomorphic encryption - modulus switching technique [on hold]
How to implement modulus switching technique to reduce noise in fully homomorphic encryption scheme?
0
votes
1answer
26 views
Whether ramp secret sharing possess additive homomorphism?
Ramp secret sharing replaces the random coefficients in original Shamir secret sharing with original data to be shared. In such a case, all the coefficients in the polynomial evaluation will be ...
0
votes
0answers
18 views
Secure Computation with TTP using Ring-LWE Homomorphic Encryption
I was working with secure outsourced computation for multi-party computation in which security is assured by ring-LWE based asymmetric homomorphic encryption in the semi-honest model. Is it feasible ...
1
vote
0answers
48 views
How can I prove that the plaintext of an elgamal ciphertext is the discrete log of an element?
Is there any (efficient) method to prove that the plaintext of an ElGamal ciphertext is the discrete log of an element?
In the scenario I concerned, I have an El Gamal key pair $(pk, sk) = (g^y, y)$....
1
vote
1answer
27 views
comparison in pallier homomorphic encryption?
For a project I am using homomorphic encryption with the pallier cryptosystem and I have to compare two values...
Can this be done using homomorphic encryption?
...
1
vote
1answer
55 views
Is it possible to change the generator without knowing the private key used?
For example, prover sends P = xG and verifier somehow sends back P = xH without learning x.
Is this possible?
2
votes
0answers
44 views
Gentry-Halevi’s Fully-Homomorphic Encryption and hermite factor
In section 7.2, page 18 in Chen-Nguyen paper regarding BKZ 2.0, they point out different Hermite factors related to Gentry-Halevi FHE.
More precisely, it is said that the critical Hermite factor for ...
0
votes
0answers
61 views
Does such cryptographic scheme exists?
Is there any multi-key additive homomorphic encryption scheme based on elliptic curve cryptography? Meaning adding encrypted values encrypted with different public keys and decrypt the total sum with ...
1
vote
1answer
44 views
how do we calculate set intersection using homomorphic encryption?
I am new to this field. I want to learn how homomorphic encryption can be used for PSI. I am aware of other SMC protocols but I never understood how to use schemes like Paillier for PSI calculation. ...
1
vote
0answers
41 views
Homomorphic modulo
What homomorphic cryptographic scheme should I use to perform modular reduction?
I want an encryption scheme along with an operation $\otimes$ such that
$$c = Enc(m) \otimes Enc(d) \Rightarrow Dec(...
0
votes
1answer
69 views
Homomorphic/Paillier crypto system for use case?: overflow for multiple counter exponent possible? Different cipher factor needed all the time?
Recently I read about homomorphic cryptosystem. They might solve a problem. To do this there need to be some modifications from standard version.
Using Paillier here but a solution for other also ...
2
votes
0answers
39 views
Can binomial distribution be used to sample noise for Ring-LWE-based homomorphic encryption?
Homomorphic encryption schemes based on Ring-LWE need to sample the noise terms from a discrete probability distribution $\chi$ over the integers with support $[-B,B]$. For example, the Fan-...
0
votes
1answer
62 views
Comparison on Gentry's Fully homomorphic Encryption? [duplicate]
This topic is very new to me. Is it possible to do comparison on the encrypted data(data is encrypted using Gentry's FHE)? If so, how can it be done?
3
votes
1answer
83 views
Where can I find open source code for Encryption Switching Protocol?
The concept of Encryption Switching Protocols was introduced in CRYPTO.
I was wondering if there is any pseudo-implementation of the protocol available or can I get some insights on how to implement ...
0
votes
1answer
50 views
How does the 'Flatten' function reduce the coefficients of a vector/matrix?
Seen here, at the bottom of page 5, Flatten() is defined as:
Flatten(a)=BitDecomp(BitDecomp$^1$(a))
For an n-dimensional vector a$=(a_{1,0},...,a_{1,l-1},...,a_{k,0},...,a_{k,l-1})$. Where $a_{i,j}$ ...
3
votes
1answer
92 views
Design a OT-based Private Set Intersection protocol to obtain $A \cap B \cap C$?
This is a tutorial question for a Foundations of Privacy computer science course, I'm unsure on how to tackle it because we haven't talked much about these particular topics in class.
(a) Assume ...
2
votes
0answers
61 views
Order of g in Paillier Scheme
I'm trying to understand the Paillier Scheme but there's something I can't understand in the keyGen algorithm :
Ensure ${\displaystyle n}$ divides the order of $g$ by checking the existence of the ...
0
votes
0answers
64 views
How to break fully homomorphic encryption over integer algorithm with known cipher of same integer?
If I do encryption and decryption like this:
Encryption: $\text{E}(m) = (r \times p_1+m) \bmod N$
Decryption: $\text{D}(\text{E}(m)) = ((r \times p_1 + m) \bmod N) \bmod p_1 = m$
where,
$r$ = ...
0
votes
1answer
90 views
SEAL-CKKS max multiplication depth
I am trying to understand how SEAL-CKKS scheme works and I wonder what multiplication level can we achieve using this scheme?
Like 100 possible?
0
votes
0answers
47 views
How can a node establish pairwise shared key with other nodes using its own polynomial share together with other's public values?
A server has a symmetric bivariate polynomial $ F(x, y) = \sum_{{i,j}=0}^{t-1}a_{i,j}x^iy^j$ $\in GF(p)[X, Y] $ of degree $t-1$. For simpliciy, $ F(x, y) = a_{0,0}+a_{1,0} x+a_{0,1}y+ a_{1,1}xy$ mod ...
0
votes
1answer
68 views
Are there any homomorphic first and second preimage resistant (cryptographic) hash functions?
Are there any homomorphic cryptographic hash functions that satisfy $\text{H(A + B)} = \text{H(A)} + \text{H(B)}$ which maintaining pre-image resistance
0
votes
0answers
46 views
Blinding factor SEAL
For a protocol, I need to blind a ciphertext. I am not sure how to choose the blinding factor. How should I choose the range? What should I consider to offer security?
I am using CKKS scheme, the one ...
2
votes
2answers
101 views
Is OTP with homomorphic encryption trivial?
If my key size is as large as the data I'm encoding, is it trivial to devise a theoretically secure homomorphic encryption scheme for integers (or else any finite/infinite group with order) that ...
2
votes
0answers
34 views
Generate unique pair $g^k, E(k^{-1})$ for each group
Let say I have n computers, with some t-threshold encryption scheme.
I want to have n public shares (known to every participant) such that any t of them generates a pair:
$g^k, E(k^{-1})$ that is ...
8
votes
1answer
186 views
Obfuscating functions that are mostly zero
Let $f_k(x)$ be a boolean function of two arguments with two properties:
The function $f$ can be efficiently computed.
The output is always 0 or 1, and for any fixed $k$, if we choose $x$ randomly, $\...
2
votes
1answer
51 views
BGN encryption scheme with unbounded message space
In Evaluating 2-DNF Formulas on Ciphertexts stated that
decryption in this system takes polynomial time in the size of the message space T. Therefore, the system as described above can only be ...
0
votes
0answers
79 views
Division using Fully Homomorphic Encryption
When I am not allowed to do interaction with server, then I use Taylor approximation for division in non-interactive process.
Let's say that I am allowed to do interactions with server.
I have ...
1
vote
1answer
53 views
What is the security model of the FHE system introduced in Fully Homomorphic Encryption Using Ideal Lattices?
How would one construct a security model to play against the adversary, and define the security of the overall scheme? This is in reference to the scheme introduced in "Fully Homomorphic Encryption ...
2
votes
1answer
55 views
Standard deviation of gaussian noise in FHEW scheme
I've got two questions regarding the paper FHEW: Bootstrapping Homomorphic Encryption
in less than a second.
First, the final error of a ciphertext after the refresh procedure is stated as following ...
5
votes
1answer
90 views
What is the shortest ciphertext size output by FHE?
Assume we use batching and modulus switching techniques to reduce the size of ciphertext in fully homomorphic encryption (FHE).
Question: What is the shortest ciphertext bit-size output by the most ...
2
votes
1answer
213 views
Zero Knowledge range proof
I like the idea of a Zero Knowledge range proof. But I read that, to prove my age in a range, a commitment is required by a trusted party (TP) stating my age. How does that work? is the commitment a ...
0
votes
0answers
73 views
homomorphic division with scaling/Paillier
Let's say that I have to use fractions instead of integers and I am using Paillier cryptosystem. So, I use scaling to obtain integers. Assume that I have a secure division protocol. What happens if ...
1
vote
0answers
54 views
SEAL - binary encoded ciphertext
In SEAL, am I able to convert a ciphertext that is encoded with polynomial to a ciphertext that is encoded as binary?
0
votes
1answer
93 views
Refreshing Procedure in FHEW: membership test
I am facing an issue regarding the paper FHEW: Bootstrapping Homomorphic Encryption in less than a second. It concerns the MSBextract algorithm during the refresh procedure.
Especially, they ...
1
vote
1answer
79 views
Comparable or partially homomorphic public key derivation for signatures?
Are there any public key signature schemes that can be compared blindly or partially homomorphically based on the private key without knowing the private key?
Example: let's say I derive a public key ...
2
votes
0answers
74 views
What is modulo switching, in a nutshell?
Coupled with the terms bootstrapping and relinearization, the term modulo switching appears a lot in the FHE literature. What is it and how does it relate to the other two?
9
votes
3answers
1k views
Homomorphic encryption - Why does addition not imply multiplication?
As far as I know:
There are some partially homomorphic encryption (PHE) systems that support either addition or multiplication.
A fully homomorphic encryption (FHE) system can do addition as well as ...
0
votes
1answer
185 views
Are there any practical use cases for performing homomorphic operations on encrypted Strings?
Does anybody know which practical use cases there are to operate on encrypted strings? Even niche problems that can be solved using homomorphic encryption on strings are interesting to me, but not ...
2
votes
1answer
112 views
Can I perform a division of two integers homomorphically using ElGamal?
How can I perform a division of two integers homomorphically?
(Simplifying assumptions can be made if needed, that is, I am fine with dividing numbers that are whole and the result will be whole as ...
2
votes
1answer
86 views
Can we use PHE or SWHE instead of bilinear pairings in ZK-SNARKS?
In ZK Snarks bilinear pairings are used to do "encrypted computation". I was wondering if we can use Partial Homomorphic Encryption or Somewhat Homomorphic Encryption instead of bilinear pairings. Can ...
1
vote
1answer
128 views
How does the polynomial modulus work in the Fan-Vercauteren scheme?
I'm reading this introductory blog on the Fan-Vercauteren
scheme and there are a few things I don't understand about polynomial moduli. The author uses practical examples:
Because we are ...
3
votes
1answer
94 views
Using error-correcting codes for the bootstrapping procedure of Fully Homomorphic Schemes
In the context of Fully Homomorphic Schemes, we use a technique called "bootstrapping" to refresh the ciphertext, by evaluating homomorphically the decryption circuit with an encrypted version of the ...
6
votes
1answer
462 views
Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks?
Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks?
I have been reading about homomorphic encryption and ...
4
votes
0answers
103 views
Two plaintexts map to the same ciphertext in fully homomorphic encryption?
In standard symmetric encryption, we can create an encryption scheme, in which two plaintexts $x_1, x_2$ map to the same ciphertext $y$, by choosing appropriate keys $k_1,k_2$ (!).
The most simple ...
3
votes
0answers
71 views
Is there a partially homomorphic cryptosystem without an inverse (addition without subtraction, multiplication without division)?
I am learning about partially homomorphic cryptography, and was interested to see if there was a system such that one operation was homomorphic, but its inverse was not.
For example, if I have two ...
9
votes
3answers
2k views
Re-encrypting a message and proving that the message has not changed
Is there a method that allows for re-encryption of a message in a way that allows observers who only have access to the two cipher texts to prove that the plain text message is the same in each?
More ...
1
vote
1answer
125 views
Interactive Homomorphic Encryption
Let's say that I have a plain computational process that consists of several divisions and I do not want to do it with non-interactive homomorphic encryption.
I would like to ask how can I call this ...
2
votes
2answers
111 views
Homomorphic properties of Paillier
I'm curious about the homomorphic properties of Paillier. So, basically if I have $\textsf{Dec}(\textsf{sk}, \textsf{Enc}(\textsf{pk}, \alpha) \cdot \textsf{Enc}(\textsf{pk}, \alpha^{-1}))$, I will ...
0
votes
1answer
77 views
Binary representation of the inverse of a big number [closed]
In one of the first FHE schemes by Gentry, the KeyGen algorithm is defined as follow:
For a security parameter $\lambda$, set $N = \lambda ^ 2, P = \lambda ^ 2, Q = \lambda ^ 5$.
KeyGen$(\lambda)$: ...
7
votes
1answer
310 views
Representing a function as FHE circuit
I am actually trying to study homomorphic encryption (on lattices) but I'm facing a problem. Every paper that I have read so far talk about writing the function to evaluate on ciphertexts as a circuit,...
