Questions tagged [homomorphic-encryption]

Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).

123 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8
votes
0answers
502 views

LT codes with Homomorphic hashing

I have been working on a project implementing LT codes with Homomorphic hashing (inspired from http://blog.notdot.net/2012/08/Damn-Cool-Algorithms-Homomorphic-Hashing and http://blog.notdot.net/2012/...
7
votes
1answer
147 views

Two plaintexts map to the same ciphertext in fully homomorphic encryption?

In standard symmetric encryption, we can create an encryption scheme, in which two plaintexts $x_1, x_2$ map to the same ciphertext $y$, by choosing appropriate keys $k_1,k_2$ (!). The most simple ...
6
votes
0answers
208 views

Additive homomorphic encryption scheme without change in operator

I'm looking for an additive homomorphic encryption that the addition operator (+) in its plaintext space be the same as addition operator in its ciphertext space. (Schemes like Paillier do addition in ...
5
votes
0answers
290 views

Homomorphic system that allows Hamming distance computation?

How can I work out Hamming distance between two binary vectors securely? I would like to know how I can apply homomorphic techniques here.
4
votes
1answer
155 views

Is there any way to check hash of homomorphic encrypted data?

I need some algorithm that satisfies: H - hash function Enc - encryption function (using public key) M - secret data $Enc(H(M)) = H(Enc(M))$ Let this system exist: the First person has a secret ...
4
votes
0answers
53 views

Threshold homomorphic

Quite a specific question, but are there any threshold signatures that are also homomorphic? Preferably ones that work in the discrete log setting and don't require any pairings.
4
votes
1answer
246 views

Zero knowledge proof for Paillier addition under multiple keys

Suppose $m_0, m_1, m_2 \in \mathbb{N}$ such that $m_0 = m_1 + m_2$, $m_i > 0$ (none of them can be 0 or lower) Under a Paillier cryptosystem, set $e_0 = E(m_0, r_0)$ for a public key $(g_0, n_0)$ ...
4
votes
0answers
99 views

What are some of the current relevant fully homomorphic schemes?

As of February 2017, I have the feeling that all information on FHE is currently a bit scattered and finding a good summary/ timeline on the topic is really hard. I'm currently looking into FHE over ...
4
votes
1answer
128 views

Noise of ciphertexts in LWE/RLWE based FHE

Often times $[\langle \textbf{c}, \textbf{s} \rangle]_q$ is referred to as the noise associated to the ciphertext $\textbf{c}$, and that decryption is correct when the norm of the noise is $< q/2$. ...
4
votes
0answers
249 views

How do they avoid Zero Knowledge Proofs in the paper Priced Oblivious Transfer: How to sell Digital Goods?

I don't understand a part of the paper Priced Oblivious Transfer - How to Sell Digital Goods. Particularly, the authors avoid using zero knowledge proofs and in section 3.3 they explain how they do ...
4
votes
0answers
111 views

An MPC protocol from Elgamal is a good solution a homomorphic multiplication?

I want to compute a multiplication between many secret values and then distribute the result to everyone involved. For this, I thought about an MPC protocol built from Threshold Homomorphic Elgamal. ...
4
votes
0answers
220 views

How can I implement decryption for NTRU homomorphic encryption scheme?

I have come across this paper On-the-fly multiparty computation via on-the-cloud Multikey from Fully Homomorphic Encryption by Lopez-Alt et al., where authors describe a NTRU-based homomorphic ...
4
votes
0answers
342 views

Additively homomorphic cryptosystem with non-interactive zero-knowledge proof of non-negativity

I need a cryptosystem that is additively homomorphic. Paillier preferably, but not neccessarily. Also, for every ciphertext the private key holder must be able to prove non-interactively that the ...
4
votes
0answers
102 views

How about a homomorphic integer sorting in a MPC context?

I want to implement the ATV-FHE scheme as described by Adriana López-Alt, Eran Tromer, Vinod Vaikuntanathan: On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption (...
4
votes
0answers
244 views

Obfuscating point-like functions

There are standard schemes for obfuscating a point function; I'm wondering if we know how to obfuscate a slight generalization of a point function. I'll elaborate more precisely. Definition 1. A ...
4
votes
1answer
182 views

Generating random vector for Full Homomorphic Cryptography

The site below explains that part of doing homomorphic encryption, you need to generate a vector of random numbers that have the property that its dot product against a randomly generated bit vector ...
3
votes
0answers
84 views

Is there a partially homomorphic cryptosystem without an inverse (addition without subtraction, multiplication without division)?

I am learning about partially homomorphic cryptography, and was interested to see if there was a system such that one operation was homomorphic, but its inverse was not. For example, if I have two ...
3
votes
0answers
214 views

ring-LWE: Minkowski Embedding , the Co-Different Ideal, etc

While (trying) to go over the reductions from approx. SVP on ideal lattices to search ring-LWE, [1] and [2], for $K = \mathbb{Q}(\zeta)$ where $\zeta$ is an abstract root of a cyclotomic polynomial, ...
3
votes
0answers
179 views

Homomorphic encryption over finite fields

I'm curious on the following question: let $\mathbb{F}_{2^n}$ be a finite field which is an extension of $\mathbb{F}_2$ with order of $n$, is there an encoding scheme $e:=\mathbb{F}_{2^n}\rightarrow \...
3
votes
0answers
94 views

Security parameter p =O(n)

In many homomorphic encryption scheme, a security parameter is calculated as p =O(n). How to use the complexity order as values? Is there any specific method with an appropriate example?
3
votes
0answers
108 views

How to test a FHE implementation?

I want to implement a FHE scheme based on NTRU, namely the scheme described here https://eprint.iacr.org/2014/039.pdf . How to test the security of my implementation ? Do I have to implement the ...
3
votes
0answers
161 views

Key Recovery Smart-Vercauteren SWHE

In the article (https://eprint.iacr.org/2009/571.pdf, pag 8) of Smart and Vercauteren, it is mentioned that the recovery of the private key is an instance of the small principal ideal problem. But I ...
3
votes
0answers
133 views

Lowest number challenge scheme

Suppose Alice knows a secret number $a$, and Bob knows a secret number $b$. Is there a simple way for Alice and Bob to know who has the lowest number, without Alice & Bob exchanging their numbers ...
3
votes
0answers
162 views

FHE over the integers - Is that paper's scheme known to be insecure against quantum adversaries?

I was reading the paper Fully Homomorphic Encryption over the Integers, and started wondering if there is a known quantum attack on their main scheme, because There is an efficient quantum attack on ...
3
votes
1answer
100 views

Using error-correcting codes for the bootstrapping procedure of Fully Homomorphic Schemes

In the context of Fully Homomorphic Schemes, we use a technique called "bootstrapping" to refresh the ciphertext, by evaluating homomorphically the decryption circuit with an encrypted version of the ...
3
votes
1answer
232 views

Why gcd(r,(p-1)/r) needs to be 1 in benaloh cryptosystem

I recently discovered the benaloh cryptosystem. I am working with the system as it is discribed in the following link: https://en.wikipedia.org/wiki/Benaloh_cryptosystem However I need some help in ...
2
votes
0answers
56 views

What is labeled program

I've been studying homomorphic encryption. From their instantiations, i read Labeled Homomorphic Encryption (labHE) scheme 1 where it combines the notion of homomorphic encryption with labeled ...
2
votes
0answers
106 views

Simple explanation of CKKS scheme

I'm searching for a (preferably simple) explanation of the Cheon-Kim-Kim-Song scheme for fully homomorphic encryption. All I did find so far is the original paper, which is rather difficult to ...
2
votes
1answer
68 views

Gentry-Halevi’s Fully-Homomorphic Encryption and hermite factor

In section 7.2, page 18 in Chen-Nguyen paper regarding BKZ 2.0, they point out different Hermite factors related to Gentry-Halevi FHE. More precisely, it is said that the critical Hermite factor for ...
2
votes
1answer
62 views

Homomorphic modulo

What homomorphic cryptographic scheme should I use to perform modular reduction? I want an encryption scheme along with an operation $\otimes$ such that $$c = Enc(m) \otimes Enc(d) \Rightarrow Dec(...
2
votes
0answers
43 views

Can binomial distribution be used to sample noise for Ring-LWE-based homomorphic encryption?

Homomorphic encryption schemes based on Ring-LWE need to sample the noise terms from a discrete probability distribution $\chi$ over the integers with support $[-B,B]$. For example, the Fan-...
2
votes
0answers
34 views

Generate unique pair $g^k, E(k^{-1})$ for each group

Let say I have n computers, with some t-threshold encryption scheme. I want to have n public shares (known to every participant) such that any t of them generates a pair: $g^k, E(k^{-1})$ that is ...
2
votes
0answers
101 views

What is modulo switching, in a nutshell?

Coupled with the terms bootstrapping and relinearization, the term modulo switching appears a lot in the FHE literature. What is it and how does it relate to the other two?
2
votes
0answers
63 views

How HomNAND has been computed in Leo Ducas and Daniele Micciancio's FHEW?

In section 4.1 of Leo Ducas and Daniele Micciancio's paper FHE Bootstrapping in less than a second, HomNAND has been computed as follows: $$ (\textbf{a}, b) = HomNAND((\textbf{a}_0, b_0),(\textbf{a}_1,...
2
votes
0answers
96 views

Verifiable secret sharing - Benaloh scheme; some doubts not answered earlier

I reviewed the paper "Secret sharing homomorphisms: keeping shares of a secret secret" by J.C. Benaloh yesterday and I had some difficulty understanding his version of verifiable secret sharing to ...
2
votes
0answers
200 views

Chinese Remainder Theorem and Elgamal

I am studying an encryption scheme which is Elgamal-like where I think CRT can help optimise the encryption and decryption but I am not sure if I am applying CRT the correct way. I have a cyclic ...
2
votes
0answers
118 views

A question about fully homomorphic SIMD operations

I'm going through Gentry, Halevi and Smart's paper "Fully Homomorphic Encryption with Polylog Overhead" and have a question about the permutation operations. Background: The cyclotomic polynomial ...
2
votes
0answers
140 views

Is there any way to prove two numbers that are equal after Paillier encryptions?

I have two numbers $x_1$ and $x_2$, and there are two Paillier homomorphic encryption (public, private) key pairs $(p_1,r_1)$ and $(p_2, r_2)$. I only know $p_1, r_1$ and $p_2$. Suppose $C_1=E_{p_1}(...
2
votes
0answers
51 views

Dimension involved by tensor product on Ring-LWE based homomorphic encryption

As far as I know, given two $n$-dimensional vectors $\mathbf{a},\mathbf{b} $, tensor product $\mathbf{a} \otimes \mathbf{b} $ produces $n\times n$ matrix. However in Ring-LWE based homomorphic ...
2
votes
0answers
37 views

Encryption design for user data with service access

I'm looking to provide users with a way to give a service sensitive information, which the service can freely use up until the user decides otherwise. I want to encrypt the data at rest (and of course,...
2
votes
0answers
110 views

NTRU-based threshold encryption system?

I want to implement threshold homomorphic encryption for my project. (encrypt a message using one public key, and decrypt a ciphertext using distributed secret keys) I read a paper "Multiparty ...
2
votes
0answers
89 views

Distinguishing advantage in terms of $\Omega(\omega)$

I was going through this paper ("Fully Homomophic Encryption over the Integers Revisited") and the statement written in the first paragraph on page 5 stating $\DeclareMathOperator{\agcd}{AGCD}$ We ...
2
votes
0answers
273 views

Homomorphic set hash with membership proof

I'm trying to solve a problem that goes as follow. There is a set of item and that set is very large. Several actors needs to exchange information about this set, such as adding and removing element ...
2
votes
0answers
255 views

Is modulus switching feasible for plaintext space larger than $\{ 0, 1 \}$?

I read the proof of modulus switching and realised that it can be extended to integers, but do we actually use it for integer encryption in practice? Consider that we are doing additive and ...
2
votes
0answers
89 views

Homomorphic encryption poll for multiple people

I understand for homomorphic encryption, you can perform operations on the ciphertext such that: $E(x_1)+E(x_2)=E(x_1+x_2)$ which can allow you to work out the sum of the plaintext encryption I have ...
2
votes
0answers
227 views

Evaluate similarity between two “encrypted” time series

Can you think of any way to evaluate the similarity between two time series without revealing any information on the time series ? More precisely, considering two time series $x$ and $y$ of length ...
2
votes
0answers
91 views

Additive homomorphic encryption over small fields

Are there encryption schemes that are additively homomorphic with respect to small fields such as $\mathbb{F}_{2^4}$ or $\mathbb{F}_{2^8}$?
2
votes
0answers
477 views

About BGV Scheme Batching Technique

I am reading BGV12 about BGV homomorphic scheme right now.But I am being stuck to understand Batching technique in this paper. In Pack function (page 32),this paper feeds ciphertext $c_i$ and sk $s_1$...
2
votes
0answers
58 views

Quantifying bit security for smart-vercauteren encryption scheme

I am working on project that requires to compare in terms of security between two encryption schemes, one of them is the SV scheme. However, I dont know what are the steps exactly towards quantifying ...
2
votes
0answers
57 views

Upper bound on r* on page 7 in the Scale Invariant Fully Homomorphic Encryption over the Integers paper

I was hoping to get some clarification on how the bound on r* was calculated (bottom of page #7). I'm trying to reproduce the results that have been shown, however I keep getting a slightly smaller ...