Questions tagged [homomorphic-encryption]

Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).

Filter by
Sorted by
Tagged with
0
votes
0answers
20 views

Homomorphic encryption:when we use batch technique, how to query batched ciphertext

I read serval papers about batched Homomorphic encryption, but they just describe how to batch, I am curious about how to query batched ciphertext
2
votes
0answers
81 views

How can I use two different public keys with the same private key for fully homomorphic encryption?

I am pretty new to cryptography. Recently I run into this question where I have two different public keys with the same private key, and I need them for fully homomorphic encryption. Let's say ...
2
votes
0answers
44 views

Secure (sub-exponential time) FHE

In Gentry's easy FHE intro, it is stated that Researchers [1, 8] showed that if $\epsilon$ is a deterministic fully homomorphic encryption scheme (or, more broadly, one for which it is easy to tell ...
0
votes
2answers
63 views

Pailler cryptosystem safety

I am working on system which can calculate average salary for different positions in large companies I want to use pailler schema to do such calculation. I have 3 fields which I want to encrypt: ...
2
votes
1answer
161 views

BGV for three multiplication level/depth

Can BGV homomorphic encryption scheme support three multiplication level/depth with the help of key switching and modulus switching? If Yes, how does one set up the parameter to achieve that?
0
votes
1answer
217 views

Bitwise operations in FHE

Im reading about FHE and the libraries implementing it (SEAL, HELib). I saw that SEAL doesn't support bitwise operations but I wondered if its theoretically feasible. For example, bitwise-ing XOR an ...
0
votes
0answers
22 views

Are there any implementations of "More Fun With Funky Plaintext Spaces" from the BGV paper?

Fully Homomorphic Encryption without Bootstrapping describes considerations for large (exponential in the security parameter) integer plaintext spaces in Section 5.4, "More Fun with Funky ...
1
vote
1answer
26 views

Is there a secure two party protocol that makes P1 (with x as input) gets rx+r' and P2 gets (r,r')

It should be a secure two party protocol against malicious adversary. P1's input is X in Zp* (p is a prime number); P2's input is nothing. P1's output is rX+r'. r,r' are random numbers from Zp* P2' ...
0
votes
1answer
54 views

Chinese remainder theorem in ECDSA for parameters in secp256k1?

It is known that it is possible to apply the Chinese remainder theorem and attack RSA under precise conditions. https://tls.mbed.org/public/WSchindler-...
0
votes
0answers
46 views

Homomorphic sorting of a vector of FHE ciphertexts

Bonjour à tous, Je dispose d'un vecteur contenant 15 nombre réel chiffrés avec les schéma de chiffrement homomorphe CKKS. Mon problème est que je souhaite trier ce vecteur par ordre croissant. Je ne ...
0
votes
0answers
41 views

PYFHEL - Concatenating two encrypted strings and then decoding them

I'm trying out the PYFHEL (PYthon For Homomorphic Encryption Libraries) library, and was wondering if it was possible to concatenate two strings while encrypted and then decrypt the result. This ...
3
votes
1answer
75 views

Functional and security model for SEAL

What's the functional and security model for SEAL? From this I get that it allows additions and multiplications to be performed on encrypted integers or real. But what are the limitation, like range,...
1
vote
1answer
41 views

Security level of FHE constructions for non-standard parameters

homomorphicencryption standards already provide recommended parameters and their corresponding security levels. However, I would like to calculate a security level for nonstandard parameter selection. ...
0
votes
1answer
31 views

Can Alice verify a guess of Bob's number in this Homomorphic Encryption solution to the millionaire problem

I'm looking at https://link.springer.com/content/pdf/10.1007%2F11496137_31.pdf and it seems like in the protocol they propose if Alice can guess Bob's number, she can pretty easily verify that guess. (...
0
votes
1answer
94 views

Difference between function $f$ in eval and dec of homomorphic authenticated encryption

In the homomorphic authenticated encryption, as described 1, there are Eval and Dec PPT algorithms: In Eval, f is the function to be performed on the encrypted data. However, I need to know why it ...
3
votes
1answer
145 views

Gentry-Halevi’s Fully-Homomorphic Encryption and hermite factor

In section 7.2, page 18 in Chen-Nguyen paper regarding BKZ 2.0, they point out different Hermite factors related to Gentry-Halevi FHE. More precisely, it is said that the critical Hermite factor for ...
3
votes
1answer
325 views

Is Paillier secure from known plaintext attack for single character message?

Assuming I have three messages m1,m2,m3 where m1=m2=m3=1 and I compute c1,c2 and c3. Does that mean that c1=c2=c3 in cipher-text from ? If not, how many times can I encrypt a message m=1 and still ...
4
votes
1answer
278 views

Is there any way to check hash of homomorphic encrypted data?

I need some algorithm that satisfies: H - hash function Enc - encryption function (using public key) M - secret data $Enc(H(M)) = H(Enc(M))$ Let this system exist: the First person has a secret ...
2
votes
1answer
172 views

What's the difficulty of using elliptic curves to design homomorphic encryption protocols?

I have recently been very interested in elliptic curves because they are a powerful tool in crypto, ECC, pairing, etc. However, it seems that elliptic curves are not popular in homomorphic encryption. ...
6
votes
1answer
489 views

Zero knowledge proof for Paillier addition under multiple keys

Suppose $m_0, m_1, m_2 \in \mathbb{N}$ such that $m_0 = m_1 + m_2$, $m_i > 0$ (none of them can be 0 or lower) Under a Paillier cryptosystem, set $e_0 = E(m_0, r_0)$ for a public key $(g_0, n_0)$ ...
1
vote
0answers
39 views

Formal Verification for Multiparty Computation and Homomorphic Encryption?

I've recently found some work on the use of Formal Verification Software, like ProVerif for enclaves. I wonder is if its feasible to have something similar for MPC and Homomorphic Encryption and ...
1
vote
0answers
19 views

Is it possible to Publicly Query Privately Held Data with proof of Correctness?

We can secretly query inputs from a public DBs using what we call in the literature PIR. We can secretly query inputs from a privately held DB by means of Private Set Intersection (PSI). We can also ...
1
vote
1answer
49 views

Multi-party Millionaire's variant: how to find the highest number without revealing who holds it?

Let's say that $n$ honest-but-curious parties each hold a value $x_i$. The parties want to learn what is the maximum value across the parties $\{x_1...x_n\}$ without sharing their values (unless they ...
0
votes
1answer
60 views

How does batching in FHE work?

Let's say we have a BGV style homomorphic encryption scheme. The message space will be the ring $$R_p = \mathbb Z_p[x]/(x^d + 1)$$ where $p$ is a prime congruent to $1$ modulo $2d$. Now let's say we ...
0
votes
0answers
25 views

Verify encrypted signature using encrypted version of publickey without decrypt them

I try to explain the problem (maybe it's trivial): is there a way to do the following: sign a message with private key, send encrypted version of signature and an encrypted version of publickey to ...
3
votes
1answer
97 views

$n=pq$ and $n=p^2q$. How to take the value of two $n$ is the same in security

For example, Paillier's RSA modulus is $n=pq$, but OU's RSA modulus is $p^2q$. I think when two $n$ are the same, the security of the two cryptographic schemes must be different. So for example, if I ...
3
votes
2answers
240 views

How to define a FHE scheme whose plaintext space is infinite using boolean circuits?

There are many kinds of fully homomorphic encryption scheme by using boolean circuits. And the plaintext space $\mathcal{P} = \{ 0,1 \}$. If there is a -bit FHE scheme, we can construct a FHE scheme ...
-1
votes
1answer
56 views

Is there some function of $n$ that is a multiple of $\phi(n^2)$?

Not sure which forum to post this question so here is a link to it from MSE. This is to adapt the approach of Fermat's Little Theorem to the Paillier encryption system. I understand that this will ...
2
votes
1answer
85 views

Does asymmetric order-preserving encryption exist?

As I understand from this post, mapping from plaintext space to ciphertext space is the fundamental point of all order-preserving encryption. So the only way that we let someone encrypt an arbitrary ...
5
votes
1answer
218 views

Advantages of Paillier vs Goldwasser-Micali

It is easy to see that both Paillier and Goldwasser-Micali are homomorphic addition schemes and are secure, but what would be the advantages of choosing one over the other?
1
vote
1answer
77 views

SS/HE/GC/OT secure integer comparison

I have been reading some papers to find a 'faster' way to compare two integers without revealing their real values. But I think I'm a bit lost in those papers due to my limited knowledge in ...
4
votes
1answer
243 views

FHE over the integers - Is that paper's scheme known to be insecure against quantum adversaries?

I was reading the paper Fully Homomorphic Encryption over the Integers, and started wondering if there is a known quantum attack on their main scheme, because There is an efficient quantum attack on ...
0
votes
0answers
29 views

For a given security parameter $\kappa$. what does $poly(\kappa)$ mean?

Let ($Gen,Enc,Dec$) be an LHE scheme with security parameter $\kappa$ and message space $M$. Assume that a multiplication operation exists in $M$, i.e., is a finite ring. Let $F : \{0, 1\}^s × L → M$ ...
1
vote
1answer
188 views

zeroing out slots in SEAL ciphertext

I've been messing around with SEAL library for a few days and I've got a following question. I've got a bunch of datapoints [x_1, ..., x_n], n < poly_mod_deg of type 'double' and I use batch ...
0
votes
1answer
41 views

Simple question about BGV scheme

While I'm trying to implement BGV scheme myself, I found that I'm really confusing about the encryption and decryption of the scheme. Here's my understanding: Let $p$ be a plaintext modulus and $q$ be ...
0
votes
1answer
32 views

How to know the exact result in Paillier chiper-costant multiplication

The encryption function $E_{k^+}: Z_n \rightarrow Z_{n^2}$. The decryption function $D_{k^-}: Z_{n^2} \rightarrow Z_n$. $m_1 = 42, k = 15, n=77$. After encryption, exponentiation and decryption, I get:...
0
votes
0answers
26 views

HElib: send sk and pk to another party for decryption and encryption

This question is about the serialization of pk, sk, and context in HElib. In my scenario, ...
0
votes
0answers
18 views

How to understand the per-gate computation overhead of the FHE scheme?

In BGV12(Fully Homomorphic Encryption without bootstapping), they investigate the efficiency of a FHE scheme by considering the per-gate computation overhead of the FHE scheme, defined as the ratio ...
0
votes
1answer
355 views

SEAL-CKKS max multiplication depth

I am trying to understand how SEAL-CKKS scheme works and I wonder what multiplication level can we achieve using this scheme? Like 100 possible?
4
votes
2answers
153 views

Proving the right encrypted message was sent

Total amateur to crypto here but I've searched and searched and am at the extent of my knowledge. I've gone down several avenues to satisfy what I'm looking for but I'm just going to describe what I'd ...
0
votes
1answer
139 views

Verification of data on an untrusted remote storage server

I was looking at tahoe-lafs which accepts a file, encrypts it, does erasure coding on it which generates n shares and then distributes it over the storage servers. The distribution is Share 1 = Server ...
1
vote
0answers
55 views

How does bootstrapping work?

I have read FHE lately. In Fully Homomorphic encryption using ideal lattice[Gen09], I noticed his recrypt algorithms: We have a ciphertext $\phi_1$ which is encrypted by public key $pk_1$, and can be ...
0
votes
0answers
46 views

What's the performance of the HElib and SEAL?

HElib contains the CKKS and BGV, SEAL contains the BFV and CKKS, is there some concrete performance data about these two lib?
0
votes
0answers
38 views

Is it possible to allow a user to log in if logged out without identifying them?

I have to verify that the user has registered and is currently logged out without identifying the user. Essentially, I am looking for privacy-oriented authorization mechanisms which prevent ...
1
vote
0answers
44 views

Homomorphic encryption key switching

I understand the general idea of key switching, but I would like to know when it is used. Sometimes it is referred to as same thing as relinearisation(after multiplication), but is key switching also ...
2
votes
0answers
45 views

RLWE like problem

Assume we have the polynomial space $R_q$ defined as $R_q = Z_q/(X^n + 1)$. Additionally, we define the error distribution $\chi$ as a discrete centred Gaussian bounded by $B$. Let $s \gets R_q$ be a ...
0
votes
1answer
51 views

An implementation about multi thread TFHE

recently I'm trying to use TFHE library for project(https://tfhe.github.io/tfhe/). In order to accelerate the whole program, I use pthread to make multi thread computation. However, I find that the ...
0
votes
1answer
75 views

Joint distribution of RLWE samples

Assume we have the polynomial space $R_q$ defined as $R_q = Z_q/(X^n + 1)$. We draw samples $s_i \gets R_q$ uniformly at random. Additionally, we define the error distribution $\chi$ as a discrete ...
2
votes
2answers
103 views

Role of AND operation in FHE, MPC and ZK

Going through LowMC, one of the main advantage of it seems to be useful in Fully Homomorphic Encryption (FHE), Multi-party Computation (MPC) and Zero Knowledge (ZK) proofs. I have no idea about any of ...
1
vote
0answers
18 views

Proving the security of the public key BGV scheme

The security proof basically comes down to the following based on this paper. We want to show that two distributions are statistically indistinguishable. Say we have that $a,a′,x,x′$ are drawn from an ...

1
2 3 4 5
15