Questions tagged [homomorphic-encryption]

Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).

Filter by
Sorted by
Tagged with
0
votes
0answers
26 views

Fully homomorphic encryption - modulus switching technique [on hold]

How to implement modulus switching technique to reduce noise in fully homomorphic encryption scheme?
0
votes
1answer
26 views

Whether ramp secret sharing possess additive homomorphism?

Ramp secret sharing replaces the random coefficients in original Shamir secret sharing with original data to be shared. In such a case, all the coefficients in the polynomial evaluation will be ...
0
votes
0answers
18 views

Secure Computation with TTP using Ring-LWE Homomorphic Encryption

I was working with secure outsourced computation for multi-party computation in which security is assured by ring-LWE based asymmetric homomorphic encryption in the semi-honest model. Is it feasible ...
1
vote
0answers
48 views

How can I prove that the plaintext of an elgamal ciphertext is the discrete log of an element?

Is there any (efficient) method to prove that the plaintext of an ElGamal ciphertext is the discrete log of an element? In the scenario I concerned, I have an El Gamal key pair $(pk, sk) = (g^y, y)$....
1
vote
1answer
27 views

comparison in pallier homomorphic encryption?

For a project I am using homomorphic encryption with the pallier cryptosystem and I have to compare two values... Can this be done using homomorphic encryption? ...
1
vote
1answer
55 views

Is it possible to change the generator without knowing the private key used?

For example, prover sends P = xG and verifier somehow sends back P = xH without learning x. Is this possible?
2
votes
0answers
44 views

Gentry-Halevi’s Fully-Homomorphic Encryption and hermite factor

In section 7.2, page 18 in Chen-Nguyen paper regarding BKZ 2.0, they point out different Hermite factors related to Gentry-Halevi FHE. More precisely, it is said that the critical Hermite factor for ...
0
votes
0answers
61 views

Does such cryptographic scheme exists?

Is there any multi-key additive homomorphic encryption scheme based on elliptic curve cryptography? Meaning adding encrypted values encrypted with different public keys and decrypt the total sum with ...
1
vote
1answer
44 views

how do we calculate set intersection using homomorphic encryption?

I am new to this field. I want to learn how homomorphic encryption can be used for PSI. I am aware of other SMC protocols but I never understood how to use schemes like Paillier for PSI calculation. ...
1
vote
0answers
41 views

Homomorphic modulo

What homomorphic cryptographic scheme should I use to perform modular reduction? I want an encryption scheme along with an operation $\otimes$ such that $$c = Enc(m) \otimes Enc(d) \Rightarrow Dec(...
0
votes
1answer
69 views

Homomorphic/Paillier crypto system for use case?: overflow for multiple counter exponent possible? Different cipher factor needed all the time?

Recently I read about homomorphic cryptosystem. They might solve a problem. To do this there need to be some modifications from standard version. Using Paillier here but a solution for other also ...
2
votes
0answers
39 views

Can binomial distribution be used to sample noise for Ring-LWE-based homomorphic encryption?

Homomorphic encryption schemes based on Ring-LWE need to sample the noise terms from a discrete probability distribution $\chi$ over the integers with support $[-B,B]$. For example, the Fan-...
0
votes
1answer
62 views

Comparison on Gentry's Fully homomorphic Encryption? [duplicate]

This topic is very new to me. Is it possible to do comparison on the encrypted data(data is encrypted using Gentry's FHE)? If so, how can it be done?
3
votes
1answer
83 views

Where can I find open source code for Encryption Switching Protocol?

The concept of Encryption Switching Protocols was introduced in CRYPTO. I was wondering if there is any pseudo-implementation of the protocol available or can I get some insights on how to implement ...
0
votes
1answer
50 views

How does the 'Flatten' function reduce the coefficients of a vector/matrix?

Seen here, at the bottom of page 5, Flatten() is defined as: Flatten(a)=BitDecomp(BitDecomp$^1$(a)) For an n-dimensional vector a$=(a_{1,0},...,a_{1,l-1},...,a_{k,0},...,a_{k,l-1})$. Where $a_{i,j}$ ...
3
votes
1answer
92 views

Design a OT-based Private Set Intersection protocol to obtain $A \cap B \cap C$?

This is a tutorial question for a Foundations of Privacy computer science course, I'm unsure on how to tackle it because we haven't talked much about these particular topics in class. (a) Assume ...
2
votes
0answers
61 views

Order of g in Paillier Scheme

I'm trying to understand the Paillier Scheme but there's something I can't understand in the keyGen algorithm : Ensure ${\displaystyle n}$ divides the order of $g$ by checking the existence of the ...
0
votes
0answers
64 views

How to break fully homomorphic encryption over integer algorithm with known cipher of same integer?

If I do encryption and decryption like this: Encryption: $\text{E}(m) = (r \times p_1+m) \bmod N$ Decryption: $\text{D}(\text{E}(m)) = ((r \times p_1 + m) \bmod N) \bmod p_1 = m$ where, $r$ = ...
0
votes
1answer
90 views

SEAL-CKKS max multiplication depth

I am trying to understand how SEAL-CKKS scheme works and I wonder what multiplication level can we achieve using this scheme? Like 100 possible?
0
votes
0answers
47 views

How can a node establish pairwise shared key with other nodes using its own polynomial share together with other's public values?

A server has a symmetric bivariate polynomial $ F(x, y) = \sum_{{i,j}=0}^{t-1}a_{i,j}x^iy^j$ $\in GF(p)[X, Y] $ of degree $t-1$. For simpliciy, $ F(x, y) = a_{0,0}+a_{1,0} x+a_{0,1}y+ a_{1,1}xy$ mod ...
0
votes
1answer
68 views

Are there any homomorphic first and second preimage resistant (cryptographic) hash functions?

Are there any homomorphic cryptographic hash functions that satisfy $\text{H(A + B)} = \text{H(A)} + \text{H(B)}$ which maintaining pre-image resistance
0
votes
0answers
46 views

Blinding factor SEAL

For a protocol, I need to blind a ciphertext. I am not sure how to choose the blinding factor. How should I choose the range? What should I consider to offer security? I am using CKKS scheme, the one ...
2
votes
2answers
101 views

Is OTP with homomorphic encryption trivial?

If my key size is as large as the data I'm encoding, is it trivial to devise a theoretically secure homomorphic encryption scheme for integers (or else any finite/infinite group with order) that ...
2
votes
0answers
34 views

Generate unique pair $g^k, E(k^{-1})$ for each group

Let say I have n computers, with some t-threshold encryption scheme. I want to have n public shares (known to every participant) such that any t of them generates a pair: $g^k, E(k^{-1})$ that is ...
8
votes
1answer
186 views

Obfuscating functions that are mostly zero

Let $f_k(x)$ be a boolean function of two arguments with two properties: The function $f$ can be efficiently computed. The output is always 0 or 1, and for any fixed $k$, if we choose $x$ randomly, $\...
2
votes
1answer
51 views

BGN encryption scheme with unbounded message space

In Evaluating 2-DNF Formulas on Ciphertexts stated that decryption in this system takes polynomial time in the size of the message space T. Therefore, the system as described above can only be ...
0
votes
0answers
79 views

Division using Fully Homomorphic Encryption

When I am not allowed to do interaction with server, then I use Taylor approximation for division in non-interactive process. Let's say that I am allowed to do interactions with server. I have ...
1
vote
1answer
53 views

What is the security model of the FHE system introduced in Fully Homomorphic Encryption Using Ideal Lattices?

How would one construct a security model to play against the adversary, and define the security of the overall scheme? This is in reference to the scheme introduced in "Fully Homomorphic Encryption ...
2
votes
1answer
55 views

Standard deviation of gaussian noise in FHEW scheme

I've got two questions regarding the paper FHEW: Bootstrapping Homomorphic Encryption in less than a second. First, the final error of a ciphertext after the refresh procedure is stated as following ...
5
votes
1answer
90 views

What is the shortest ciphertext size output by FHE?

Assume we use batching and modulus switching techniques to reduce the size of ciphertext in fully homomorphic encryption (FHE). Question: What is the shortest ciphertext bit-size output by the most ...
2
votes
1answer
213 views

Zero Knowledge range proof

I like the idea of a Zero Knowledge range proof. But I read that, to prove my age in a range, a commitment is required by a trusted party (TP) stating my age. How does that work? is the commitment a ...
0
votes
0answers
73 views

homomorphic division with scaling/Paillier

Let's say that I have to use fractions instead of integers and I am using Paillier cryptosystem. So, I use scaling to obtain integers. Assume that I have a secure division protocol. What happens if ...
1
vote
0answers
54 views

SEAL - binary encoded ciphertext

In SEAL, am I able to convert a ciphertext that is encoded with polynomial to a ciphertext that is encoded as binary?
0
votes
1answer
93 views

Refreshing Procedure in FHEW: membership test

I am facing an issue regarding the paper FHEW: Bootstrapping Homomorphic Encryption in less than a second. It concerns the MSBextract algorithm during the refresh procedure. Especially, they ...
1
vote
1answer
79 views

Comparable or partially homomorphic public key derivation for signatures?

Are there any public key signature schemes that can be compared blindly or partially homomorphically based on the private key without knowing the private key? Example: let's say I derive a public key ...
2
votes
0answers
74 views

What is modulo switching, in a nutshell?

Coupled with the terms bootstrapping and relinearization, the term modulo switching appears a lot in the FHE literature. What is it and how does it relate to the other two?
9
votes
3answers
1k views

Homomorphic encryption - Why does addition not imply multiplication?

As far as I know: There are some partially homomorphic encryption (PHE) systems that support either addition or multiplication. A fully homomorphic encryption (FHE) system can do addition as well as ...
0
votes
1answer
185 views

Are there any practical use cases for performing homomorphic operations on encrypted Strings?

Does anybody know which practical use cases there are to operate on encrypted strings? Even niche problems that can be solved using homomorphic encryption on strings are interesting to me, but not ...
2
votes
1answer
112 views

Can I perform a division of two integers homomorphically using ElGamal?

How can I perform a division of two integers homomorphically? (Simplifying assumptions can be made if needed, that is, I am fine with dividing numbers that are whole and the result will be whole as ...
2
votes
1answer
86 views

Can we use PHE or SWHE instead of bilinear pairings in ZK-SNARKS?

In ZK Snarks bilinear pairings are used to do "encrypted computation". I was wondering if we can use Partial Homomorphic Encryption or Somewhat Homomorphic Encryption instead of bilinear pairings. Can ...
1
vote
1answer
128 views

How does the polynomial modulus work in the Fan-Vercauteren scheme?

I'm reading this introductory blog on the Fan-Vercauteren scheme and there are a few things I don't understand about polynomial moduli. The author uses practical examples: Because we are ...
3
votes
1answer
94 views

Using error-correcting codes for the bootstrapping procedure of Fully Homomorphic Schemes

In the context of Fully Homomorphic Schemes, we use a technique called "bootstrapping" to refresh the ciphertext, by evaluating homomorphically the decryption circuit with an encrypted version of the ...
6
votes
1answer
462 views

Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks?

Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks? I have been reading about homomorphic encryption and ...
4
votes
0answers
103 views

Two plaintexts map to the same ciphertext in fully homomorphic encryption?

In standard symmetric encryption, we can create an encryption scheme, in which two plaintexts $x_1, x_2$ map to the same ciphertext $y$, by choosing appropriate keys $k_1,k_2$ (!). The most simple ...
3
votes
0answers
71 views

Is there a partially homomorphic cryptosystem without an inverse (addition without subtraction, multiplication without division)?

I am learning about partially homomorphic cryptography, and was interested to see if there was a system such that one operation was homomorphic, but its inverse was not. For example, if I have two ...
9
votes
3answers
2k views

Re-encrypting a message and proving that the message has not changed

Is there a method that allows for re-encryption of a message in a way that allows observers who only have access to the two cipher texts to prove that the plain text message is the same in each? More ...
1
vote
1answer
125 views

Interactive Homomorphic Encryption

Let's say that I have a plain computational process that consists of several divisions and I do not want to do it with non-interactive homomorphic encryption. I would like to ask how can I call this ...
2
votes
2answers
111 views

Homomorphic properties of Paillier

I'm curious about the homomorphic properties of Paillier. So, basically if I have $\textsf{Dec}(\textsf{sk}, \textsf{Enc}(\textsf{pk}, \alpha) \cdot \textsf{Enc}(\textsf{pk}, \alpha^{-1}))$, I will ...
0
votes
1answer
77 views

Binary representation of the inverse of a big number [closed]

In one of the first FHE schemes by Gentry, the KeyGen algorithm is defined as follow: For a security parameter $\lambda$, set $N = \lambda ^ 2, P = \lambda ^ 2, Q = \lambda ^ 5$. KeyGen$(\lambda)$: ...
7
votes
1answer
310 views

Representing a function as FHE circuit

I am actually trying to study homomorphic encryption (on lattices) but I'm facing a problem. Every paper that I have read so far talk about writing the function to evaluate on ciphertexts as a circuit,...