Questions tagged [homomorphic-encryption]
Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).
715
questions
0
votes
0answers
34 views
Is it possible to allow a user to log in if logged out without identifying them?
I have to verify that the user has registered and is currently logged out without identifying the user. Essentially, I am looking for privacy-oriented authorization mechanisms which prevent ...
1
vote
1answer
35 views
SS/HE/GC/OT secure integer comparison
I have been reading some papers to find a 'faster' way to compare two integers without revealing their real values. But I think I'm a bit lost in those papers due to my limited knowledge in ...
0
votes
1answer
20 views
Simple question about BGV scheme
While I'm trying to implement BGV scheme myself, I found that I'm really confusing about the encryption and decryption of the scheme. Here's my understanding:
Let $p$ be a plaintext modulus and $q$ be ...
1
vote
0answers
30 views
Homomorphic encryption key switching
I understand the general idea of key switching, but I would like to know when it is used. Sometimes it is referred to as same thing as relinearisation(after multiplication), but is key switching also ...
0
votes
1answer
29 views
How to know the exact result in Paillier chiper-costant multiplication
The encryption function $E_{k^+}: Z_n \rightarrow Z_{n^2}$.
The decryption function $D_{k^-}: Z_{n^2} \rightarrow Z_n$.
$m_1 = 42, k = 15, n=77$.
After encryption, exponentiation and decryption, I get:...
2
votes
0answers
43 views
RLWE like problem
Assume we have the polynomial space $R_q$ defined as $R_q = Z_q/(X^n + 1)$. Additionally, we define the error distribution $\chi$ as a discrete centred Gaussian bounded by $B$.
Let $s \gets R_q$ be a ...
0
votes
1answer
45 views
An implementation about multi thread TFHE
recently I'm trying to use TFHE library for project(https://tfhe.github.io/tfhe/). In order to accelerate the whole program, I use pthread to make multi thread computation. However, I find that the ...
0
votes
1answer
58 views
Joint distribution of RLWE samples
Assume we have the polynomial space $R_q$ defined as $R_q = Z_q/(X^n + 1)$. We draw samples $s_i \gets R_q$ uniformly at random. Additionally, we define the error distribution $\chi$ as a discrete ...
1
vote
0answers
16 views
Proving the security of the public key BGV scheme
The security proof basically comes down to the following based on this paper.
We want to show that two distributions are statistically indistinguishable.
Say we have that $a,a′,x,x′$ are drawn from an ...
2
votes
2answers
86 views
Role of AND operation in FHE, MPC and ZK
Going through LowMC, one of the main advantage of it seems to be useful in Fully Homomorphic Encryption (FHE), Multi-party Computation (MPC) and Zero Knowledge (ZK) proofs. I have no idea about any of ...
1
vote
0answers
19 views
CKKS : Ciphertext extension
I have a CKKS ciphertext containing [a, b, c, d] and I want to get these 4 ciphertexts : [a, a, a, a]; [b, b, b, b]; [c, c, c, c]; [d, d, d, d].
Is there a more efficient way than repeating the ...
0
votes
0answers
47 views
Rotation with redundant slots in HElib
As described in another question How to get exact number of slots in HElib?, get the exact number of slots with relative small parameters m and ...
0
votes
0answers
25 views
What is the evaluation step in an HE scheme? [duplicate]
I quote:
By homomorphic encryption, we mean the family of encryption schemes
being able to perform homomorphic operations on ciphertexts, without
decrypting them. The first time someone introduced ...
1
vote
0answers
21 views
Palisade: EvalMult between plaintext and ciphertext resulting in tower size mismatch
I hope someone can help me understand an error I get when using Palisades. I want to only use the first 329 slots of a BGV ciphertext, and zero out the rest (which at some point contains some '...
1
vote
1answer
52 views
How to understand why an algorithm uses additive or multiplicative homomorphic
If we take the example of LWE (Learning With Errors) how does one know if it's homomorphic by addition or multiplication?
0
votes
0answers
29 views
A question about HElib again
Sorry but I've got a question about HElib again. I'm applying HElib to make a secure logical calculation and I apply bootstrapping as usual. Paras I selected was from "example". However, ...
1
vote
0answers
51 views
Comparison of SNARK-friendly hash algorithms MiMC7, Poseidon, Pederson?
There are some cryptographically secure hash algorithms designed to be efficient for SNARKs, STARKs and FHE. Some of them already implemented in Zcash, Zokrates and circom. The ones that I know of are:...
1
vote
1answer
30 views
Paillier estimate attack costs on short keys
I was thinking about how to use the homeomorphic property of that cryptosystem to achieve not a "semantic security" but a less ambitous obfuscation of the source code (an ipotetical scenario ...
2
votes
2answers
152 views
How to get exact number of slots in HElib? Such as 256, 4096
In the Homomorphic Encryption Library, HElib (https://github.com/homenc/HElib), we set up a set of parameters before generating the ciphertext.
For example:
...
1
vote
1answer
50 views
AES (or otherwise): can you decrypt concatenated encrypted messages as one?
Say I have 20 distinct encrypted messages.
Using AES, I am only getting the correct output if I decrypt each of the 20 messages individually.
Is it possible using AES or another method to call my ...
1
vote
0answers
26 views
Secret key generation in the BGV scheme in HElib
This question is about secret key generation, based on section 4.7 in the design document:
https://homenc.github.io/HElib/documentation/Design_Document/HElib-design.pdf
It seems that if $m$ is not a ...
0
votes
0answers
25 views
How to save keys and other paras in HElib
Recently I'm using HElib for project. Here I hope to init a Client-class,which has pub&pri keys. However when I was building class, I found that I don't know how to save Keys and other paras like ...
0
votes
0answers
53 views
Why doesn't HElib support floating point operations?
NB: what I meant is with implementation of the BGV-cryptosystem, not the CKKS cryptosystem which is designed with floating point arithmetic in mind.
HElib as I understand it only supports fixed-point ...
0
votes
0answers
33 views
Why is noise growth from relinearisation ignored in the FV crypto scheme?
I'm going through the FV scheme and SEAL and there are a couple of things I'm not understanding with respect to noise growth of relinearisation.
On page 8 they say to choose T so that the noise ...
1
vote
1answer
44 views
What is the difference between Paillier additive homomorphic property and addition of two paillier ciphers
Paillier has additive homomorphic property that states:
if two ciphers c1 and c2, are multiplied, and the result is decrypted, it is equal to addition of the two plaintexts.
D(c1*c2)= m1+m2
...
0
votes
0answers
33 views
How to fix the IND-CPA+ problem in CKKS?
In paper On the Security of Homomorphic Encryption on Approximate
Numbers
the author gave an attack on CKKS, then how to fix it?
1
vote
0answers
46 views
Prove Paillier cryptosystem decryption $M=L(c^{\lambda(n)}\bmod n^2)\,\mu\bmod n$
How can we prove mathematically that in Paillier cryptosystem decryption, our message is equal to the right side of
$$M=L(c^{\lambda(n)}\bmod n^2)\,\mu\bmod n$$
4
votes
1answer
99 views
How expensive would running a practical application on full homomorphic encryption be?
This is a multidisciplinary question, hopefully I can stay on topic.
It has been published that we can now use (try?) fully homomorphic encryption computation on cipher text inputs. But I'd like to ...
0
votes
0answers
27 views
What distribution is required to ensure the security of the RLWE?
In LWE, the error should be sampled from a discrete Gaussian distribution. Then, in RLWE, the error is a polynomial in $\mathbb{Z}_q[x]/(x^N+1)$, it could be sampled coefficient wise. However, when we ...
0
votes
0answers
36 views
Practicality of dangerous/unsafe content safety proof as follows
Suppose I am building a cloud storage with client side encryption. My policy is that I would not allow anyone to store pornographic, violent or otherwise unsafe content but must ensure full privacy. ...
0
votes
0answers
26 views
PYFHEL - Concatenating two encrypted strings and then decoding them
I'm trying out the PYFHEL (PYthon For Homomorphic Encryption Libraries) library, and was wondering if it was possible to concatenate two strings while encrypted and then decrypt the result.
This ...
1
vote
1answer
118 views
How is R-LWE related to lattice cryptography and homomorphic encryption?
Can someone tie everything together for me? I'm interested in H.E and I have some background in AES, DES, RSA and the like. While reading around I stumbled on Shai Halevi's course on lattice ...
2
votes
2answers
265 views
Why does bootstrapping (R)LWE homomorphic encryption produce small noise?
Why does homomorphic evaluation of the decryption circuit produce a ciphertext with "fresh" or small noise?
Rough description of bootstrapping homomorphic encryption:
Suppose we have a ...
0
votes
0answers
29 views
Could FHE scheme like BGV could be used many times, or fully homomorphic encryption could be used continuously？
Currently I was working with FHE scheme and used HElib to do homomorphic logical operation like the formal question described Homomorphic encryption methods that could support logical XOR, AND?.
But ...
0
votes
0answers
21 views
What does the “scale invariant” mean in some FHE schemes?
In some paper about FHE, the term "scale invariant" often appears. What does it means?
2
votes
0answers
32 views
Why could the error term be sampled coefficient wise?
In SEAL homomorphic encryption library, it implements the BFV and CKKS. We know the error $e\in R_q$ which is a Guassian distribution. When sampling an error term $e = \sum_{i=0}^{n-1} e_ix^i$, it ...
0
votes
1answer
82 views
In Microsoft Password Monitor implementation using HME how do they perform ComputeMatch Function?
https://www.microsoft.com/en-us/research/blog/password-monitor-safeguarding-passwords-in-microsoft-edge/
In this they mention
The server then evaluates a matching function on the encrypted credential,...
0
votes
0answers
37 views
Why are the fully homomorphic encryption algorithms the commitment?
Is there some references about the commitment scheme based on FHE ? Why could the BFV, CKKS, BGV algorithm be convert to commitment? How ?
2
votes
1answer
209 views
Python library that implements additive homomorphism of Elgamal Encryption on the Elliptic curve i.e X25519 or P-256
I'm trying to find a Python library that implements Elgamal Encryption on the Elliptic curve i.e X25519 or P-256.
My purpose is to use the additive homomorphic property of Elgamal.
I'm using https://...
1
vote
2answers
98 views
Homomorphic encryption methods that could support logical XOR, AND?
Recently I'm researching about logical circuit calculation and I hope to use homomorphic encryption to protect the whole process. I've read Gentry's paper and use some websites like https://...
2
votes
0answers
56 views
Why should the smudge noise be used?
Consider a threshold FHE scheme based on RLWE like this:
Refer to this paper
$\textbf{Initialization:}$
Every party generates his own secret key $s_i$, then uses the common polynomial $a$ to generate ...
0
votes
0answers
43 views
FHE Bootstrapping in FV12
I am trying to understand the bootstrapping step in FV12 cipher to obtain the FHE. I know the basic idea of bootstrapping is to homomorphic calculate decryption on ciphertext to obtain new equivalent ...
0
votes
0answers
35 views
Is the BFV homomorphic encryption scheme a commitment scheme?
The BFV scheme can be described as:
Public Key: $(p_0, p_1)$
To encrypt a plaintext $m$, the ciphertext is : $(c_0, c_1) , c_0= up_0+\Delta m + e_0, c_1=up_1 + e_1$
0
votes
0answers
30 views
elliptic curve scalar addition
say there is an homomorphic cryptosystem on elliptic which allows unlimited addition and only one multiplication.
So in order to same the mult operation for a later functionality, I need to add a ...
0
votes
0answers
61 views
Paillier scheme : Encoding floats into integers impact on computations
In Privacy Preserving Processing Over Encrypted Images, I could understand that appropriate encoding of floats into integers (required in Paillier) only incur negligible error in computations.
Any ...
2
votes
2answers
42 views
What is $z_b$ in this introduction to Private Information Retrieval?
I was trying to read this introduction to private information retrieval. On page 12 of the document, a scheme for 1-DB private information retrieval is discussed. I was unable to understand one of the ...
0
votes
0answers
36 views
GSW and homomorphic addition on integers
Is it possible to use the GSW scheme (Gentry, Sahai, Waters) also on integer values and not just single bits? If not, are there any schemes that support integer arithmetic with the same nice property ...
0
votes
0answers
43 views
GSW13 scheme and integer arithmetic
I'm new to lattice-based cryptography and have trouble understanding if the GSW13 (Gentry, Sahai, Waters) scheme works only on single bits. But is it also possible to encrypt integers with this scheme ...
2
votes
0answers
85 views
Efficiently prove the correctness of Paillier encryption in or “outside” a zk-SNARK
I'm working with a zk-SNARK library [1] that allows me to prove the correctness of arbitrary arithmetic circuits, and I now want to use these zk-SNARKs to prove that some Paillier [2] ciphertext $c$ ...
1
vote
1answer
57 views
All fully homomorphic encryptions (FHE) are converted into homomorphic commitments?
The GSW one of the FHE scheme is widely used as a homomorphic commitment scheme to build lattice based ABE, homomorphic signatures and NIZK and so on. But I cannot find other FHE schemes to be ...
