Questions tagged [homomorphic-encryption]

Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).

Filter by
Sorted by
Tagged with
13
votes
1answer
2k views

Representing a function as FHE circuit

I am actually trying to study homomorphic encryption (on lattices) but I'm facing a problem. Every paper that I have read so far talk about writing the function to evaluate on ciphertexts as a circuit,...
15
votes
3answers
40k views

Chinese Remainder Theorem and RSA

Wikipedia has a nice section regarding the speedup of the RSA decryption using the Chinese Remainder Theorem here. I need to understand the implementation of a similar speedup for the encryption ...
90
votes
8answers
27k views

How is CipherCloud doing homomorphic encryption?

Much of the literature and latest papers suggest that homomorphic encryption is still not practical yet. How is CipherCloud able to achieve this? Does anyone have an idea? Their website does not ...
11
votes
1answer
7k views

Can Elgamal be made additively homomorphic and how could it be used for E-voting?

Elgamal is a cryptosystem that is homomorphic over multiplication. How can I convert it to an additive homomorphic cryptosystem? How can I use this additive homomorphic Elgamal cryptosystem for E-...
3
votes
5answers
5k views

Approach towards anonymous e-voting

I want to implement an internet-based e-voting system. Voters shall be able to cast their vote for one out of n possible candidates. Each candidate has his own ballot-box kept by and at a trustworthy ...
4
votes
4answers
944 views

Verify product without revealing multipliers

Situation: Several participants contribute encrypted random numbers. These numbers will be used to generate community-agreed random (by simple multiplication). Question: Is there any way to detect ...
12
votes
1answer
2k views

Can a homomorphic encryption scheme be made CCA2 Secure?

Is it possible to modify a homomorphic encryption scheme so that it can be CCA2 secure? From the definition of a homomorphic scheme, it seems that it is malleable, which would result in lack of CCA2 ...
2
votes
2answers
2k views

Can Fully Homomorphic Encryption do comparisons?

I encountered a simple function that even FHE cannot solve. Here's it: int f(a,b,c,d){ if(a+b>c+d) return a+c; else return b+d; } Since FHE is not ...
4
votes
1answer
1k views

Proof of correctness of a homomorphic ElGamal sum

Let's suppose we are using the exponential ElGamal as a public-key encryption scheme, so that we encrypt $g^m$ instead of $m$, for some generator $g$. Let $x$ be the private key, and $h=g^x$ be the ...
0
votes
2answers
1k views

Homomorphic Encryption: how does the equality test on ciphertexts work?

Let's suppose we have a asymmetric crypto-system $H$ which is homomorphic with respect to some function $F$. Alice encrypts a message $m$ with her private key $e$ in the crypto-system $H$ and obtains ...
7
votes
3answers
2k views

Can we proxy-re-encrypt using homomorphic encryption schemes?

Homomorphic encryption schemes are PKE schemes with an additional special method Evaluate. The Evaluate method takes input any function (as boolean circuit) and encrypted inputs of the function and ...
6
votes
2answers
1k views

Paillier Homomorphic encryption to calculate the means

Paillier Homomorphic encryption supports addition and multiplication with plaintext value. Can I use these properties to calculate the means of cipher-text values? I try to use the following steps: ...
9
votes
2answers
783 views

How could Fully Homomorphic Encryption support power operations?

Fully Homomorphic Encryption (FHE) enables arbitrary functions computed on encrypted data, because it supports both addition and multiplication. But I wonder if FHE supports power operations. For ...
7
votes
2answers
705 views

FHE: What is the difference between multiplicative depth and multiplicative level?

I have seen the terms multiplicative depth and multiplicative level while reading Faster homomorphic encryption is not enough: improved heuristic for multiplicative depth minimization of Boolean ...
7
votes
2answers
1k views

How to construct encrypted functions (with either public or private data)?

Homomorphic encryption is often touted for its ability to Compute on encrypted data with public functions Compute an encrypted function on public (or private) data I feel I have a good grasp of #1 ...
3
votes
3answers
3k views

additive ElGamal encryption algorithm

I'm performing ElGamal encryption algorithm and using the additive homomorphic property so the product of two ciphertexts is the encryption of the sum of the plaintexts. The problem is that I need to ...
5
votes
1answer
268 views

“Power of one” as input to functions of a cryptosystem

What does $1^\lambda$ mean when you pass it as a parameter to the functions of a cryptosystem. The cryptosystem in question is this and a picture reference is this. I have been told it signifies the ...
1
vote
2answers
2k views

Why are homomorphic algorithms slow?

Why are homomorphic algorithms slower than regular(symmetric and asymmetric) algorithms? For example RSA in regular asymmetric cryptography uses the same algorithm as in RSA homomorphic (partially HE)...
11
votes
2answers
4k views

What does “circuits” mean in Cryptography?

I am not a hardcore cryptographer so this might be a really stupid question. I am looking through some papers in homomorphic encryption and discovered they describe computation as "circuits", why do ...
6
votes
1answer
5k views

Why is “semantically secure” important for cryptosystems?

The first question: what is the exact definition of semantically secure? Basically, a cryptosystem is semantically secure if given the public key and the ciphertext, an adversary cannot learn any ...
8
votes
1answer
548 views

Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks?

Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks? I have been reading about homomorphic encryption and ...
10
votes
1answer
412 views

IND-CPA secure RSA padding with a partial homomorphic property

A while ago, I asked for an IND-CCA1 secure padding for RSA that still allows for the multiplicative homomorphic property of RSA and got no answers (yet). Now I've seen fgrieu's answer about standard ...
10
votes
3answers
3k views

Division in paillier cryptosystem

Is division possible in the Paillier Cryptosystem? i.e. given a the cipher-text $C$ of an integer $M$ the plain-text divisor $D$, and only the public key, can one compute the cipher-text of $M/D$ ?
7
votes
2answers
8k views

Homomorphic cryptosystems in RSA

Hopefully, Crypto can help me understand homomorphic cryptosystems. I'm designing a high score server for a game I made, and because of facets in the language I'm using, the player would be able to ...
2
votes
2answers
914 views

Homomorphic Encryption with Addition and Exponentiation

Is there any homomorphic encryption scheme which supports addition and power over cipher text ? Paillier is close but it supports addition and multiplication with a constant. I am getting an output ...
5
votes
1answer
602 views

Cipher text only attacks on deterministic fully homomorphic encryption schemes

If we have encryptions of additive and multiplicative identities in the corpus of cipher text of a deterministic fully homomorphic encryption (FHE) scheme, I guess we can break it. If the FHE scheme ...
5
votes
1answer
185 views

Random Masking of Padded RSA Ciphertext through homomorphism

I had asked a question related to this before: Oblivious Decryption: Decrypting with a private key, without knowing the message @rikhavshah has an answer, which I would like to discuss the security ...
2
votes
1answer
261 views

Homomorphic modulo

What homomorphic cryptographic scheme should I use to perform modular reduction? I want an encryption scheme along with an operation $\otimes$ such that $$c = Enc(m) \otimes Enc(d) \Rightarrow Dec(...
2
votes
1answer
269 views

Commutative homomorphic encryption for zero-knowledge transfers

I am trying to design a scheme that would allow the following: Alice has a number $a$ which she wants to keep secret Bob has a number $b$ which he wants to keep secret Alice can "transfer" a number ...
5
votes
2answers
254 views

Does homomorphic encryption hide the algorithm itself?

The question is rather simple, but finding resources and answers quite tricky. Homomorphic encryption should enable us to compute over encrypted data. What if the algorithm for computing should be ...
3
votes
1answer
236 views

ElGamal Homomorphic Encryption Formula Question

With Public Key $(G, q, g, h)$ where $G$ is a group, $q$ prime, $g$ a generator of $G$, Am I right in thinking that: $$\mathrm{Enc}(m;r) := (g^r, h^r \cdot g^m)$$
2
votes
1answer
467 views

Is an equality test possible when using paillier crypto?

Given two ciphertexts $c_1=Ek_1(p_1)$ and $c_2=Ek_2(p_2)$ encrpted by two different users with two different keys, i.e. $Ek_1$ and $Ek_2$ using a homomorphic crypto such as Paillier. Can a third party ...
2
votes
2answers
796 views

What is Homomorphic encryption evaluation key

In some homomorphic encryption schemes (e.g Multi-key fully homomorphic encryption report, Computing Blindfolded: New Developments in Fully Homomorphic Encryption), it defines an encryption key, a ...
1
vote
1answer
293 views

Partially Homomorphic Cryptographic Schemes - Deterministic vs Probabilistic

While reading this paper I realized that textbook RSA was the only deterministic PHE scheme mentioned. I did cross-check the ones listed in the Wikipedia article also and, quite on the opposite ...
1
vote
2answers
4k views

Is it possible to subtract/multiply numbers using homomorphic encryption?

Most of the libraries I've seen allow you to add encrypted numbers. Is it possible to subtract and multiply them?
1
vote
1answer
190 views

Addition-only PHE in F#

Using homomorphic encryption, I would like to be able to take an encrypted integer and either add 1 or -1 for a new encrypted value. I do not want the encrypted value to be recoverable - just the ...
1
vote
1answer
459 views

Paillier subtraction for negative result

I am trying to figure out subtraction on Paillier. From what I read so far, given $m_1$ smaller than $m_2$ ($m_1<m_2$) I can compute $E(m_2-m_1)$ as $E(m_2)\cdot E(m_1)^{-1}$ where $E(m_1)^{-1}$ ...
1
vote
1answer
243 views

Where does bootstrapping occur, client side or server side?

In Fully Homomorphic Encryption, where does the bootstrapping procedure performed, in the client-side or the server-side? Also, which side holds the secret key and the public key?
23
votes
2answers
5k views

What is the most practical fully homomorphic cryptosystem?

Craig Gentry recently gave the first fully homomorphic cryptosystem. Quite a bit of work has been done since extending his work. It seems, however, that no system is practical for real world use. ...
15
votes
2answers
1k views

Why is Approximate GCD a hard problem?

There are many Fully Homomorphic Encryption over the Integers schemes whose security is based on the intractability of the Approximate GCD (AGCD) problem. The paper Algorithms for the Approximate ...
15
votes
1answer
5k views

What exactly is bootstrapping in FHE?

I have been reading about FHE lately, and it seems that bootstrapping is the core concept in order to develop FHE schemes. But, I don't exactly understand the idea behind it. I know that the schemes ...
11
votes
3answers
2k views

difference between leveled FHE and normal FHE scheme

What is/are difference/s between leveled Fully Homomorphic Encryption and normal Fully Homomorphic Encryption?
10
votes
1answer
4k views

Homomorphic (encrypted) comparison to an integer

When working with an additive homomorphic encryption scheme (say Pallier's), is there an efficient way to get the encrypted value of a comparison test to an integer value (I realise that an ...
10
votes
1answer
407 views

Computing Logarithm using homomorphic encryption

Let's say we have $Enc_{pub}(a)$, the encryption of an integer $a \in \mathbb{Z}^*$ under the public key pub with a Homomorphic encryption scheme that supports both ...
8
votes
1answer
4k views

Somewhat Homomorphic Encryption versus Fully Homomorphic Encryption?

Is that correct that Somewhat Homomorphic Encryption is more efficient that “Fully Homomorphic Encryption” (FHE) but less efficient than Partially Homomorphic Encryption (e.g Paillier encryption)? Is ...
4
votes
2answers
652 views

Real life systems that use concepts of crypto computing [closed]

Are there any working cloud/internet solutions/products that operates on encrypted data such as systems using homomorphic encryption, secure multiparty computation, electronic voting, private ...
7
votes
2answers
2k views

How can we define division operation by using Fully homomorphic encryption

Last fews months, I'm working with homomorphic encryption. Now I am dealing with some computational problems with integers or real-numbers (like arithmetic mean, standard deviation) where division is ...
7
votes
1answer
1k views

Which is/are the strongest known Fully Homomorphic Encryption scheme(s)?

As it is discussed here that the highest security any homomorphic encryption scheme is at most IND-CCA1, Is there any known fully homomorphic encryption scheme that achieves this security level? Out ...
6
votes
2answers
668 views

Is there an encyption scheme that combines additive homomorphism with ability to proxy re-encrypt?

Is there an encyption scheme that combines additive homomorphism with ability to proxy re-encrypt? I've tried digging around on the Internet but haven't found anything conclusive on the topic.
6
votes
1answer
554 views

Homomorphic Encryption and Semantic Security using Lattices?

I've been reading Brakerski and Vaikuntanathan's "Efficient Fully Homomorphic Encryption from (Standard) LWE" and I'm still digesting pieces at a time. Under section 1.1, "Re-Linearization: Somewhat ...