Cryptography

Questions tagged [homomorphic-encryption]

Ask Question

Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).

731 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
1
vote
1answer
15 views

Is there a secure two party protocol that makes P1 (with x as input) gets rx+r' and P2 gets (r,r')

It should be a secure two party protocol against malicious adversary. P1's input is X in Zp* (p is a prime number); P2's input is nothing. P1's output is rX+r'. r,r' are random numbers from Zp* P2' ...
0
votes
0answers
37 views

How to compute a result homomorphically from encrypted inputs, then reveal the result

Can someone point me in the right direction ? I would like to generate a public/private ElGamal key pair, from a random public input and a private blinding factor, such that the private key remains ...
0
votes
1answer
34 views

Chinese remainder theorem in ECDSA for parameters in secp256k1?

It is known that it is possible to apply the Chinese remainder theorem and attack RSA under precise conditions. https://tls.mbed.org/public/WSchindler-...
0
votes
0answers
45 views

Homomorphic sorting of a vector of FHE ciphertexts

Bonjour à tous, Je dispose d'un vecteur contenant 15 nombre réel chiffrés avec les schéma de chiffrement homomorphe CKKS. Mon problème est que je souhaite trier ce vecteur par ordre croissant. Je ne ...
3
votes
1answer
72 views

Functional and security model for SEAL

What's the functional and security model for SEAL? From this I get that it allows additions and multiplications to be performed on encrypted integers or real. But what are the limitation, like range,...
1
vote
1answer
40 views

Security level of FHE constructions for non-standard parameters

homomorphicencryption standards already provide recommended parameters and their corresponding security levels. However, I would like to calculate a security level for nonstandard parameter selection. ...
0
votes
1answer
30 views

Can Alice verify a guess of Bob's number in this Homomorphic Encryption solution to the millionaire problem

I'm looking at https://link.springer.com/content/pdf/10.1007%2F11496137_31.pdf and it seems like in the protocol they propose if Alice can guess Bob's number, she can pretty easily verify that guess. (...
0
votes
2answers
53 views

Pailler cryptosystem safety

I am working on system which can calculate average salary for different positions in large companies I want to use pailler schema to do such calculation. I have 3 fields which I want to encrypt: ...
1
vote
0answers
36 views

Formal Verification for Multiparty Computation and Homomorphic Encryption?

I've recently found some work on the use of Formal Verification Software, like ProVerif for enclaves. I wonder is if its feasible to have something similar for MPC and Homomorphic Encryption and ...
1
vote
0answers
16 views

Is it possible to Publicly Query Privately Held Data with proof of Correctness?

We can secretly query inputs from a public DBs using what we call in the literature PIR. We can secretly query inputs from a privately held DB by means of Private Set Intersection (PSI). We can also ...
0
votes
1answer
52 views

How does batching in FHE work?

Let's say we have a BGV style homomorphic encryption scheme. The message space will be the ring $$R_p = \mathbb Z_p[x]/(x^d + 1)$$ where $p$ is a prime congruent to $1$ modulo $2d$. Now let's say we ...
0
votes
0answers
24 views

Verify encrypted signature using encrypted version of publickey without decrypt them

I try to explain the problem (maybe it's trivial): is there a way to do the following: sign a message with private key, send encrypted version of signature and an encrypted version of publickey to ...
3
votes
1answer
96 views

$n=pq$ and $n=p^2q$. How to take the value of two $n$ is the same in security

For example, Paillier's RSA modulus is $n=pq$, but OU's RSA modulus is $p^2q$. I think when two $n$ are the same, the security of the two cryptographic schemes must be different. So for example, if I ...
1
vote
1answer
49 views

Multi-party Millionaire's variant: how to find the highest number without revealing who holds it?

Let's say that $n$ honest-but-curious parties each hold a value $x_i$. The parties want to learn what is the maximum value across the parties $\{x_1...x_n\}$ without sharing their values (unless they ...
-1
votes
1answer
56 views

Is there some function of $n$ that is a multiple of $\phi(n^2)$?

Not sure which forum to post this question so here is a link to it from MSE. This is to adapt the approach of Fermat's Little Theorem to the Paillier encryption system. I understand that this will ...
2
votes
1answer
82 views

Does asymmetric order-preserving encryption exist?

As I understand from this post, mapping from plaintext space to ciphertext space is the fundamental point of all order-preserving encryption. So the only way that we let someone encrypt an arbitrary ...
0
votes
0answers
29 views

For a given security parameter $\kappa$. what does $poly(\kappa)$ mean?

Let ($Gen,Enc,Dec$) be an LHE scheme with security parameter $\kappa$ and message space $M$. Assume that a multiplication operation exists in $M$, i.e., is a finite ring. Let $F : \{0, 1\}^s × L → M$ ...
0
votes
0answers
25 views

HElib: send sk and pk to another party for decryption and encryption

This question is about the serialization of pk, sk, and context in HElib. In my scenario, ...
0
votes
0answers
18 views

How to understand the per-gate computation overhead of the FHE scheme?

In BGV12(Fully Homomorphic Encryption without bootstapping), they investigate the efficiency of a FHE scheme by considering the per-gate computation overhead of the FHE scheme, defined as the ratio ...
1
vote
0answers
54 views

How does bootstrapping work?

I have read FHE lately. In Fully Homomorphic encryption using ideal lattice[Gen09], I noticed his recrypt algorithms: We have a ciphertext $\phi_1$ which is encrypted by public key $pk_1$, and can be ...
0
votes
0answers
43 views

What's the performance of the HElib and SEAL?

HElib contains the CKKS and BGV, SEAL contains the BFV and CKKS, is there some concrete performance data about these two lib?
0
votes
0answers
38 views

Is it possible to allow a user to log in if logged out without identifying them?

I have to verify that the user has registered and is currently logged out without identifying the user. Essentially, I am looking for privacy-oriented authorization mechanisms which prevent ...
1
vote
1answer
63 views

SS/HE/GC/OT secure integer comparison

I have been reading some papers to find a 'faster' way to compare two integers without revealing their real values. But I think I'm a bit lost in those papers due to my limited knowledge in ...
0
votes
1answer
39 views

Simple question about BGV scheme

While I'm trying to implement BGV scheme myself, I found that I'm really confusing about the encryption and decryption of the scheme. Here's my understanding: Let $p$ be a plaintext modulus and $q$ be ...
1
vote
0answers
42 views

Homomorphic encryption key switching

I understand the general idea of key switching, but I would like to know when it is used. Sometimes it is referred to as same thing as relinearisation(after multiplication), but is key switching also ...
0
votes
1answer
32 views

How to know the exact result in Paillier chiper-costant multiplication

The encryption function $E_{k^+}: Z_n \rightarrow Z_{n^2}$. The decryption function $D_{k^-}: Z_{n^2} \rightarrow Z_n$. $m_1 = 42, k = 15, n=77$. After encryption, exponentiation and decryption, I get:...
2
votes
0answers
45 views

RLWE like problem

Assume we have the polynomial space $R_q$ defined as $R_q = Z_q/(X^n + 1)$. Additionally, we define the error distribution $\chi$ as a discrete centred Gaussian bounded by $B$. Let $s \gets R_q$ be a ...
0
votes
1answer
51 views

An implementation about multi thread TFHE

recently I'm trying to use TFHE library for project(https://tfhe.github.io/tfhe/). In order to accelerate the whole program, I use pthread to make multi thread computation. However, I find that the ...
0
votes
1answer
69 views

Joint distribution of RLWE samples

Assume we have the polynomial space $R_q$ defined as $R_q = Z_q/(X^n + 1)$. We draw samples $s_i \gets R_q$ uniformly at random. Additionally, we define the error distribution $\chi$ as a discrete ...
1
vote
0answers
18 views

Proving the security of the public key BGV scheme

The security proof basically comes down to the following based on this paper. We want to show that two distributions are statistically indistinguishable. Say we have that $a,a′,x,x′$ are drawn from an ...
2
votes
2answers
98 views

Role of AND operation in FHE, MPC and ZK

Going through LowMC, one of the main advantage of it seems to be useful in Fully Homomorphic Encryption (FHE), Multi-party Computation (MPC) and Zero Knowledge (ZK) proofs. I have no idea about any of ...
1
vote
0answers
29 views

CKKS : Ciphertext extension

I have a CKKS ciphertext containing [a, b, c, d] and I want to get these 4 ciphertexts : [a, a, a, a]; [b, b, b, b]; [c, c, c, c]; [d, d, d, d]. Is there a more efficient way than repeating the ...
0
votes
0answers
51 views

Rotation with redundant slots in HElib

As described in another question How to get exact number of slots in HElib?, get the exact number of slots with relative small parameters m and ...
0
votes
0answers
28 views

What is the evaluation step in an HE scheme? [duplicate]

I quote: By homomorphic encryption, we mean the family of encryption schemes being able to perform homomorphic operations on ciphertexts, without decrypting them. The first time someone introduced ...
2
votes
0answers
26 views

Palisade: EvalMult between plaintext and ciphertext resulting in tower size mismatch

I hope someone can help me understand an error I get when using Palisades. I want to only use the first 329 slots of a BGV ciphertext, and zero out the rest (which at some point contains some '...
1
vote
1answer
52 views

How to understand why an algorithm uses additive or multiplicative homomorphic

If we take the example of LWE (Learning With Errors) how does one know if it's homomorphic by addition or multiplication?
0
votes
0answers
39 views

A question about HElib again

Sorry but I've got a question about HElib again. I'm applying HElib to make a secure logical calculation and I apply bootstrapping as usual. Paras I selected was from "example". However, ...
1
vote
0answers
81 views

Comparison of SNARK-friendly hash algorithms MiMC7, Poseidon, Pederson?

There are some cryptographically secure hash algorithms designed to be efficient for SNARKs, STARKs and FHE. Some of them already implemented in Zcash, Zokrates and circom. The ones that I know of are:...
1
vote
1answer
38 views

Paillier estimate attack costs on short keys

I was thinking about how to use the homeomorphic property of that cryptosystem to achieve not a "semantic security" but a less ambitous obfuscation of the source code (an ipotetical scenario ...
2
votes
2answers
200 views

How to get exact number of slots in HElib? Such as 256, 4096

In the Homomorphic Encryption Library, HElib (https://github.com/homenc/HElib), we set up a set of parameters before generating the ciphertext. For example: ...
1
vote
1answer
56 views

AES (or otherwise): can you decrypt concatenated encrypted messages as one?

Say I have 20 distinct encrypted messages. Using AES, I am only getting the correct output if I decrypt each of the 20 messages individually. Is it possible using AES or another method to call my ...
1
vote
0answers
42 views

Secret key generation in the BGV scheme in HElib

This question is about secret key generation, based on section 4.7 in the design document: https://homenc.github.io/HElib/documentation/Design_Document/HElib-design.pdf It seems that if $m$ is not a ...
0
votes
0answers
27 views

How to save keys and other paras in HElib

Recently I'm using HElib for project. Here I hope to init a Client-class,which has pub&pri keys. However when I was building class, I found that I don't know how to save Keys and other paras like ...
0
votes
0answers
65 views

Why doesn't HElib support floating point operations?

NB: what I meant is with implementation of the BGV-cryptosystem, not the CKKS cryptosystem which is designed with floating point arithmetic in mind. HElib as I understand it only supports fixed-point ...
0
votes
0answers
37 views

Why is noise growth from relinearisation ignored in the FV crypto scheme?

I'm going through the FV scheme and SEAL and there are a couple of things I'm not understanding with respect to noise growth of relinearisation. On page 8 they say to choose T so that the noise ...
1
vote
1answer
59 views

What is the difference between Paillier additive homomorphic property and addition of two paillier ciphers

Paillier has additive homomorphic property that states: if two ciphers c1 and c2, are multiplied, and the result is decrypted, it is equal to addition of the two plaintexts. D(c1*c2)= m1+m2 ...
0
votes
0answers
36 views

How to fix the IND-CPA+ problem in CKKS?

In paper On the Security of Homomorphic Encryption on Approximate Numbers the author gave an attack on CKKS, then how to fix it?
1
vote
0answers
48 views

Prove Paillier cryptosystem decryption $M=L(c^{\lambda(n)}\bmod n^2)\,\mu\bmod n$

How can we prove mathematically that in Paillier cryptosystem decryption, our message is equal to the right side of $$M=L(c^{\lambda(n)}\bmod n^2)\,\mu\bmod n$$
4
votes
1answer
127 views

How expensive would running a practical application on full homomorphic encryption be?

This is a multidisciplinary question, hopefully I can stay on topic. It has been published that we can now use (try?) fully homomorphic encryption computation on cipher text inputs. But I'd like to ...
0
votes
0answers
29 views

What distribution is required to ensure the security of the RLWE?

In LWE, the error should be sampled from a discrete Gaussian distribution. Then, in RLWE, the error is a polynomial in $\mathbb{Z}_q[x]/(x^N+1)$, it could be sampled coefficient wise. However, when we ...

1
2 3 4 5
…
15

Your privacy

By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.