Questions tagged [homomorphic-encryption]

Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).

Filter by
Sorted by
Tagged with
0
votes
1answer
72 views

Difference between function $f$ in eval and dec of homomorphic authenticated encryption

In the homomorphic authenticated encryption, as described 1, there are Eval and Dec PPT algorithms: In Eval, f is the function to be performed on the encrypted data. However, I need to know why it ...
3
votes
1answer
132 views

Gentry-Halevi’s Fully-Homomorphic Encryption and hermite factor

In section 7.2, page 18 in Chen-Nguyen paper regarding BKZ 2.0, they point out different Hermite factors related to Gentry-Halevi FHE. More precisely, it is said that the critical Hermite factor for ...
0
votes
2answers
30 views

Saving cryptoContext to file in Palisade

I have started a project using the Palisade library for FHE. I am using BGV, where multiple plaintext elements are packed and encrypted into a single ciphertext. I am also using rotations a lot, ...
0
votes
0answers
30 views

Rotation with redundant slots in HElib

As described in another question How to get exact number of slots in HElib?, get the exact number of slots with relative small parameters m and ...
0
votes
0answers
23 views

What is the evaluation step in an HE scheme?

I quote: By homomorphic encryption, we mean the family of encryption schemes being able to perform homomorphic operations on ciphertexts, without decrypting them. The first time someone introduced ...
1
vote
0answers
13 views

Palisade: EvalMult between plaintext and ciphertext resulting in tower size mismatch

I hope someone can help me understand an error I get when using Palisades. I want to only use the first 329 slots of a BGV ciphertext, and zero out the rest (which at some point contains some '...
1
vote
1answer
44 views

How to understand why an algorithm uses additive or multiplicative homomorphic

If we take the example of LWE (Learning With Errors) how does one know if it's homomorphic by addition or multiplication?
0
votes
0answers
26 views

A question about HElib again

Sorry but I've got a question about HElib again. I'm applying HElib to make a secure logical calculation and I apply bootstrapping as usual. Paras I selected was from "example". However, ...
1
vote
0answers
36 views

Comparison of SNARK-friendly hash algorithms MiMC7, Poseidon, Pederson?

There are some cryptographically secure hash algorithms designed to be efficient for SNARKs, STARKs and FHE. Some of them already implemented in Zcash, Zokrates and circom. The ones that I know of are:...
1
vote
1answer
24 views

Paillier estimate attack costs on short keys

I was thinking about how to use the homeomorphic property of that cryptosystem to achieve not a "semantic security" but a less ambitous obfuscation of the source code (an ipotetical scenario ...
2
votes
2answers
109 views

How to get exact number of slots in HElib? Such as 256, 4096

In the Homomorphic Encryption Library, HElib (https://github.com/homenc/HElib), we set up a set of parameters before generating the ciphertext. For example: ...
1
vote
1answer
47 views

AES (or otherwise): can you decrypt concatenated encrypted messages as one?

Say I have 20 distinct encrypted messages. Using AES, I am only getting the correct output if I decrypt each of the 20 messages individually. Is it possible using AES or another method to call my ...
1
vote
0answers
19 views

Secret key generation in the BGV scheme in HElib

This question is about secret key generation, based on section 4.7 in the design document: https://homenc.github.io/HElib/documentation/Design_Document/HElib-design.pdf It seems that if $m$ is not a ...
0
votes
0answers
20 views

How to save keys and other paras in HElib

Recently I'm using HElib for project. Here I hope to init a Client-class,which has pub&pri keys. However when I was building class, I found that I don't know how to save Keys and other paras like ...
0
votes
0answers
43 views

Why doesn't HElib support floating point operations?

NB: what I meant is with implementation of the BGV-cryptosystem, not the CKKS cryptosystem which is designed with floating point arithmetic in mind. HElib as I understand it only supports fixed-point ...
0
votes
0answers
17 views

Why is noise growth from relinearisation ignored in the FV crypto scheme?

I'm going through the FV scheme and SEAL and there are a couple of things I'm not understanding with respect to noise growth of relinearisation. On page 8 they say to choose T so that the noise ...
4
votes
1answer
233 views

Is there any way to check hash of homomorphic encrypted data?

I need some algorithm that satisfies: H - hash function Enc - encryption function (using public key) M - secret data $Enc(H(M)) = H(Enc(M))$ Let this system exist: the First person has a secret ...
2
votes
1answer
102 views

What's the difficulty of using elliptic curves to design homomorphic encryption protocols?

I have recently been very interested in elliptic curves because they are a powerful tool in crypto, ECC, pairing, etc. However, it seems that elliptic curves are not popular in homomorphic encryption. ...
6
votes
1answer
430 views

Zero knowledge proof for Paillier addition under multiple keys

Suppose $m_0, m_1, m_2 \in \mathbb{N}$ such that $m_0 = m_1 + m_2$, $m_i > 0$ (none of them can be 0 or lower) Under a Paillier cryptosystem, set $e_0 = E(m_0, r_0)$ for a public key $(g_0, n_0)$ ...
5
votes
2answers
1k views

Can I alter encrypted data without decrypting it?

I didn't find a direct solution for it. Can I modify encrypted data without accessing it? If there is an example, I would appreciate it.
1
vote
1answer
36 views

What is the difference between Paillier additive homomorphic property and addition of two paillier ciphers

Paillier has additive homomorphic property that states: if two ciphers c1 and c2, are multiplied, and the result is decrypted, it is equal to addition of the two plaintexts. D(c1*c2)= m1+m2 ...
0
votes
0answers
31 views

How to fix the IND-CPA+ problem in CKKS?

In paper On the Security of Homomorphic Encryption on Approximate Numbers the author gave an attack on CKKS, then how to fix it?
4
votes
1answer
88 views

How expensive would running a practical application on full homomorphic encryption be?

This is a multidisciplinary question, hopefully I can stay on topic. It has been published that we can now use (try?) fully homomorphic encryption computation on cipher text inputs. But I'd like to ...
1
vote
0answers
34 views

Prove Paillier cryptosystem decryption $M=L(c^{\lambda(n)}\bmod n^2)\,\mu\bmod n$

How can we prove mathematically that in Paillier cryptosystem decryption, our message is equal to the right side of $$M=L(c^{\lambda(n)}\bmod n^2)\,\mu\bmod n$$
0
votes
0answers
25 views

What distribution is required to ensure the security of the RLWE?

In LWE, the error should be sampled from a discrete Gaussian distribution. Then, in RLWE, the error is a polynomial in $\mathbb{Z}_q[x]/(x^N+1)$, it could be sampled coefficient wise. However, when we ...
13
votes
2answers
1k views

Why is Approximate GCD a hard problem?

There are many Fully Homomorphic Encryption over the Integers schemes whose security is based on the intractability of the Approximate GCD (AGCD) problem. The paper Algorithms for the Approximate ...
0
votes
0answers
31 views

Practicality of dangerous/unsafe content safety proof as follows

Suppose I am building a cloud storage with client side encryption. My policy is that I would not allow anyone to store pornographic, violent or otherwise unsafe content but must ensure full privacy. ...
0
votes
1answer
75 views

In Microsoft Password Monitor implementation using HME how do they perform ComputeMatch Function?

https://www.microsoft.com/en-us/research/blog/password-monitor-safeguarding-passwords-in-microsoft-edge/ In this they mention The server then evaluates a matching function on the encrypted credential,...
5
votes
1answer
176 views

Noise of ciphertexts in LWE/RLWE based FHE

Often times $[\langle \textbf{c}, \textbf{s} \rangle]_q$ is referred to as the noise associated to the ciphertext $\textbf{c}$, and that decryption is correct when the norm of the noise is $< q/2$. ...
0
votes
0answers
24 views

PYFHEL - Concatenating two encrypted strings and then decoding them

I'm trying out the PYFHEL (PYthon For Homomorphic Encryption Libraries) library, and was wondering if it was possible to concatenate two strings while encrypted and then decrypt the result. This ...
1
vote
1answer
101 views

How is R-LWE related to lattice cryptography and homomorphic encryption?

Can someone tie everything together for me? I'm interested in H.E and I have some background in AES, DES, RSA and the like. While reading around I stumbled on Shai Halevi's course on lattice ...
3
votes
2answers
225 views

How to define a FHE scheme whose plaintext space is infinite using boolean circuits?

There are many kinds of fully homomorphic encryption scheme by using boolean circuits. And the plaintext space $\mathcal{P} = \{ 0,1 \}$. If there is a -bit FHE scheme, we can construct a FHE scheme ...
2
votes
2answers
257 views

Why does bootstrapping (R)LWE homomorphic encryption produce small noise?

Why does homomorphic evaluation of the decryption circuit produce a ciphertext with "fresh" or small noise? Rough description of bootstrapping homomorphic encryption: Suppose we have a ...
0
votes
0answers
22 views

Could FHE scheme like BGV could be used many times, or fully homomorphic encryption could be used continuously?

Currently I was working with FHE scheme and used HElib to do homomorphic logical operation like the formal question described Homomorphic encryption methods that could support logical XOR, AND?. But ...
4
votes
1answer
225 views

FHE over the integers - Is that paper's scheme known to be insecure against quantum adversaries?

I was reading the paper Fully Homomorphic Encryption over the Integers, and started wondering if there is a known quantum attack on their main scheme, because There is an efficient quantum attack on ...
0
votes
0answers
18 views

What does the “scale invariant” mean in some FHE schemes?

In some paper about FHE, the term "scale invariant" often appears. What does it means?
2
votes
0answers
30 views

Why could the error term be sampled coefficient wise?

In SEAL homomorphic encryption library, it implements the BFV and CKKS. We know the error $e\in R_q$ which is a Guassian distribution. When sampling an error term $e = \sum_{i=0}^{n-1} e_ix^i$, it ...
1
vote
1answer
124 views

zeroing out slots in SEAL ciphertext

I've been messing around with SEAL library for a few days and I've got a following question. I've got a bunch of datapoints [x_1, ..., x_n], n < poly_mod_deg of type 'double' and I use batch ...
2
votes
1answer
156 views

Python library that implements additive homomorphism of Elgamal Encryption on the Elliptic curve i.e X25519 or P-256

I'm trying to find a Python library that implements Elgamal Encryption on the Elliptic curve i.e X25519 or P-256. My purpose is to use the additive homomorphic property of Elgamal. I'm using https://...
0
votes
0answers
35 views

Why are the fully homomorphic encryption algorithms the commitment?

Is there some references about the commitment scheme based on FHE ? Why could the BFV, CKKS, BGV algorithm be convert to commitment? How ?
0
votes
1answer
310 views

SEAL-CKKS max multiplication depth

I am trying to understand how SEAL-CKKS scheme works and I wonder what multiplication level can we achieve using this scheme? Like 100 possible?
4
votes
2answers
134 views

Proving the right encrypted message was sent

Total amateur to crypto here but I've searched and searched and am at the extent of my knowledge. I've gone down several avenues to satisfy what I'm looking for but I'm just going to describe what I'd ...
0
votes
1answer
121 views

Verification of data on an untrusted remote storage server

I was looking at tahoe-lafs which accepts a file, encrypts it, does erasure coding on it which generates n shares and then distributes it over the storage servers. The distribution is Share 1 = Server ...
1
vote
2answers
86 views

Homomorphic encryption methods that could support logical XOR, AND?

Recently I'm researching about logical circuit calculation and I hope to use homomorphic encryption to protect the whole process. I've read Gentry's paper and use some websites like https://...
2
votes
0answers
52 views

Why should the smudge noise be used?

Consider a threshold FHE scheme based on RLWE like this: Refer to this paper $\textbf{Initialization:}$ Every party generates his own secret key $s_i$, then uses the common polynomial $a$ to generate ...
1
vote
1answer
51 views

All fully homomorphic encryptions (FHE) are converted into homomorphic commitments?

The GSW one of the FHE scheme is widely used as a homomorphic commitment scheme to build lattice based ABE, homomorphic signatures and NIZK and so on. But I cannot find other FHE schemes to be ...
3
votes
3answers
142 views

functional encryption over homomorphic encryption

I recently read about "functional encryption" which seems interesting, although I didn't understand yet how it works ... but is it possible to combine it or adapt it with homomorphic ...
2
votes
1answer
53 views

What schemes support atomic decryption+reencryption

What encryption schemes support this workflow? Vendor encrypts and publishes information for the client Client generates public and private key Vendor encrypts private information Vendor publishes ...
0
votes
0answers
39 views

FHE Bootstrapping in FV12

I am trying to understand the bootstrapping step in FV12 cipher to obtain the FHE. I know the basic idea of bootstrapping is to homomorphic calculate decryption on ciphertext to obtain new equivalent ...
0
votes
0answers
33 views

Is the BFV homomorphic encryption scheme a commitment scheme?

The BFV scheme can be described as: Public Key: $(p_0, p_1)$ To encrypt a plaintext $m$, the ciphertext is : $(c_0, c_1) , c_0= up_0+\Delta m + e_0, c_1=up_1 + e_1$

1
2 3 4 5
15