Questions tagged [homomorphic-encryption]

Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).

Filter by
Sorted by
Tagged with
8
votes
1answer
582 views

Representing a function as FHE circuit

I am actually trying to study homomorphic encryption (on lattices) but I'm facing a problem. Every paper that I have read so far talk about writing the function to evaluate on ciphertexts as a circuit,...
15
votes
3answers
29k views

Chinese Remainder Theorem and RSA

Wikipedia has a nice section regarding the speedup of the RSA decryption using the Chinese Remainder Theorem here. I need to understand the implementation of a similar speedup for the encryption ...
89
votes
8answers
26k views

How is CipherCloud doing homomorphic encryption?

Much of the literature and latest papers suggest that homomorphic encryption is still not practical yet. How is CipherCloud able to achieve this? Does anyone have an idea? Their website does not ...
11
votes
1answer
5k views

Can Elgamal be made additively homomorphic and how could it be used for E-voting?

Elgamal is a cryptosystem that is homomorphic over multiplication. How can I convert it to an additive homomorphic cryptosystem? How can I use this additive homomorphic Elgamal cryptosystem for E-...
4
votes
4answers
857 views

Verify product without revealing multipliers

Situation: Several participants contribute encrypted random numbers. These numbers will be used to generate community-agreed random (by simple multiplication). Question: Is there any way to detect ...
10
votes
1answer
2k views

Can a homomorphic encryption scheme be made CCA2 Secure?

Is it possible to modify a homomorphic encryption scheme so that it can be CCA2 secure? From the definition of a homomorphic scheme, it seems that it is malleable, which would result in lack of CCA2 ...
4
votes
1answer
878 views

Proof of correctness of a homomorphic ElGamal sum

Let's suppose we are using the exponential ElGamal as a public-key encryption scheme, so that we encrypt $g^m$ instead of $m$, for some generator $g$. Let $x$ be the private key, and $h=g^x$ be the ...
0
votes
2answers
942 views

Homomorphic Encryption: how does the equality test on ciphertexts work?

Let's suppose we have a asymmetric crypto-system $H$ which is homomorphic with respect to some function $F$. Alice encrypts a message $m$ with her private key $e$ in the crypto-system $H$ and obtains ...
6
votes
2answers
959 views

Paillier Homomorphic encryption to calculate the means

Paillier Homomorphic encryption supports addition and multiplication with plaintext value. Can I use these properties to calculate the means of cipher-text values? I try to use the following steps: ...
3
votes
5answers
4k views

Approach towards anonymous e-voting

I want to implement an internet-based e-voting system. Voters shall be able to cast their vote for one out of n possible candidates. Each candidate has his own ballot-box kept by and at a trustworthy ...
8
votes
2answers
666 views

How could Fully Homomorphic Encryption support power operations?

Fully Homomorphic Encryption (FHE) enables arbitrary functions computed on encrypted data, because it supports both addition and multiplication. But I wonder if FHE supports power operations. For ...
7
votes
2answers
1k views

How to construct encrypted functions (with either public or private data)?

Homomorphic encryption is often touted for its ability to Compute on encrypted data with public functions Compute an encrypted function on public (or private) data I feel I have a good grasp of #1 ...
1
vote
2answers
800 views

Can Fully Homomorphic Encryption do comparisons?

I encountered a simple function that even FHE cannot solve. Here's it: int f(a,b,c,d){ if(a+b>c+d) return a+c; else return b+d; } Since FHE is not ...
11
votes
2answers
3k views

What does “circuits” mean in Cryptography?

I am not a hardcore cryptographer so this might be a really stupid question. I am looking through some papers in homomorphic encryption and discovered they describe computation as "circuits", why do ...
7
votes
3answers
2k views

Can we proxy-re-encrypt using homomorphic encryption schemes?

Homomorphic encryption schemes are PKE schemes with an additional special method Evaluate. The Evaluate method takes input any function (as boolean circuit) and encrypted inputs of the function and ...
10
votes
1answer
275 views

IND-CPA secure RSA padding with a partial homomorphic property

A while ago, I asked for an IND-CCA1 secure padding for RSA that still allows for the multiplicative homomorphic property of RSA and got no answers (yet). Now I've seen fgrieu's answer about standard ...
6
votes
1answer
3k views

Why is “semantically secure” important for cryptosystems?

The first question: what is the exact definition of semantically secure? Basically, a cryptosystem is semantically secure if given the public key and the ciphertext, an adversary cannot learn any ...
10
votes
3answers
2k views

Division in paillier cryptosystem

Is division possible in the Paillier Cryptosystem? i.e. given a the cipher-text $C$ of an integer $M$ the plain-text divisor $D$, and only the public key, can one compute the cipher-text of $M/D$ ?
2
votes
2answers
807 views

Homomorphic Encryption with Addition and Exponentiation

Is there any homomorphic encryption scheme which supports addition and power over cipher text ? Paillier is close but it supports addition and multiplication with a constant. I am getting an output ...
7
votes
1answer
3k views

Paillier can add and multiply, why is it only partially homomorphic?

I've seen that it's widely accepted that before Gentry's breakthrough (which is not practical yet) in 2009 there were no known full homomorphic encryption scheme. I've read here in another answer ...
6
votes
2answers
6k views

Homomorphic cryptosystems in RSA

Hopefully, Crypto can help me understand homomorphic cryptosystems. I'm designing a high score server for a game I made, and because of facets in the language I'm using, the player would be able to ...
5
votes
1answer
120 views

Random Masking of Padded RSA Ciphertext through homomorphism

I had asked a question related to this before: Oblivious Decryption: Decrypting with a private key, without knowing the message @rikhavshah has an answer, which I would like to discuss the security ...
5
votes
1answer
494 views

Cipher text only attacks on deterministic fully homomorphic encryption schemes

If we have encryptions of additive and multiplicative identities in the corpus of cipher text of a deterministic fully homomorphic encryption (FHE) scheme, I guess we can break it. If the FHE scheme ...
2
votes
3answers
2k views

additive ElGamal encryption algorithm

I'm performing ElGamal encryption algorithm and using the additive homomorphic property so the product of two ciphertexts is the encryption of the sum of the plaintexts. The problem is that I need to ...
2
votes
1answer
193 views

Commutative homomorphic encryption for zero-knowledge transfers

I am trying to design a scheme that would allow the following: Alice has a number $a$ which she wants to keep secret Bob has a number $b$ which he wants to keep secret Alice can "transfer" a number ...
5
votes
1answer
163 views

“Power of one” as input to functions of a cryptosystem

What does $1^\lambda$ mean when you pass it as a parameter to the functions of a cryptosystem. The cryptosystem in question is this and a picture reference is this. I have been told it signifies the ...
3
votes
1answer
89 views

ElGamal Homomorphic Encryption Formula Question

With Public Key $(G, q, g, h)$ where $G$ is a group, $q$ prime, $g$ a generator of $G$, Am I right in thinking that: $$\mathrm{Enc}(m;r) := (g^r, h^r \cdot g^m)$$
2
votes
1answer
364 views

Is an equality test possible when using paillier crypto?

Given two ciphertexts $c_1=Ek_1(p_1)$ and $c_2=Ek_2(p_2)$ encrpted by two different users with two different keys, i.e. $Ek_1$ and $Ek_2$ using a homomorphic crypto such as Paillier. Can a third party ...
1
vote
1answer
168 views

Addition-only PHE in F#

Using homomorphic encryption, I would like to be able to take an encrypted integer and either add 1 or -1 for a new encrypted value. I do not want the encrypted value to be recoverable - just the ...
1
vote
2answers
863 views

Why are homomorphic algorithms slow?

Why are homomorphic algorithms slower than regular(symmetric and asymmetric) algorithms? For example RSA in regular asymmetric cryptography uses the same algorithm as in RSA homomorphic (partially HE)...
1
vote
1answer
126 views

Where does bootstrapping occur, client side or server side?

In Fully Homomorphic Encryption, where does the bootstrapping procedure performed, in the client-side or the server-side? Also, which side holds the secret key and the public key?
1
vote
1answer
254 views

Partially Homomorphic Cryptographic Schemes - Deterministic vs Probabilistic

While reading this paper I realized that textbook RSA was the only deterministic PHE scheme mentioned. I did cross-check the ones listed in the Wikipedia article also and, quite on the opposite ...
1
vote
1answer
166 views

Paillier subtraction for negative result

I am trying to figure out subtraction on Paillier. From what I read so far, given $m_1$ smaller than $m_2$ ($m_1<m_2$) I can compute $E(m_2-m_1)$ as $E(m_2)\cdot E(m_1)^{-1}$ where $E(m_1)^{-1}$ ...
23
votes
2answers
5k views

What is the most practical fully homomorphic cryptosystem?

Craig Gentry recently gave the first fully homomorphic cryptosystem. Quite a bit of work has been done since extending his work. It seems, however, that no system is practical for real world use. ...
12
votes
1answer
3k views

What exactly is bootstrapping in FHE?

I have been reading about FHE lately, and it seems that bootstrapping is the core concept in order to develop FHE schemes. But, I don't exactly understand the idea behind it. I know that the schemes ...
10
votes
1answer
314 views

Computing Logarithm using homomorphic encryption

Let's say we have $Enc_{pub}(a)$, the encryption of an integer $a \in \mathbb{Z}^*$ under the public key pub with a Homomorphic encryption scheme that supports both ...
10
votes
3answers
1k views

difference between leveled FHE and normal FHE scheme

What is/are difference/s between leveled Fully Homomorphic Encryption and normal Fully Homomorphic Encryption?
10
votes
1answer
4k views

Homomorphic (encrypted) comparison to an integer

When working with an additive homomorphic encryption scheme (say Pallier's), is there an efficient way to get the encrypted value of a comparison test to an integer value (I realise that an ...
8
votes
1answer
3k views

Somewhat Homomorphic Encryption versus Fully Homomorphic Encryption?

Is that correct that Somewhat Homomorphic Encryption is more efficient that “Fully Homomorphic Encryption” (FHE) but less efficient than Partially Homomorphic Encryption (e.g Paillier encryption)? Is ...
3
votes
2answers
604 views

Real life systems that use concepts of crypto computing [closed]

Are there any working cloud/internet solutions/products that operates on encrypted data such as systems using homomorphic encryption, secure multiparty computation, electronic voting, private ...
7
votes
1answer
659 views

Why is Approximate GCD a hard problem?

There are many Fully Homomorphic Encryption over the Integers schemes whose security is based on the intractability of the Approximate GCD (AGCD) problem. The paper Algorithms for the Approximate ...
6
votes
1answer
935 views

Which is/are the strongest known Fully Homomorphic Encryption scheme(s)?

As it is discussed here that the highest security any homomorphic encryption scheme is at most IND-CCA1, Is there any known fully homomorphic encryption scheme that achieves this security level? Out ...
6
votes
2answers
623 views

Is there an encyption scheme that combines additive homomorphism with ability to proxy re-encrypt?

Is there an encyption scheme that combines additive homomorphism with ability to proxy re-encrypt? I've tried digging around on the Internet but haven't found anything conclusive on the topic.
6
votes
1answer
466 views

Homomorphic Encryption and Semantic Security using Lattices?

I've been reading Brakerski and Vaikuntanathan's "Efficient Fully Homomorphic Encryption from (Standard) LWE" and I'm still digesting pieces at a time. Under section 1.1, "Re-Linearization: Somewhat ...
4
votes
1answer
2k views

Homomorphic Encryption

Homomorphic Encryption (HE) which supports any function on ciphertexts is known as Fully Homomorphic Encryption (FHE), while Partially Homomorphic Encryption (PHE) includes encryption schemes that ...
4
votes
0answers
248 views

Obfuscating point-like functions

There are standard schemes for obfuscating a point function; I'm wondering if we know how to obfuscate a slight generalization of a point function. I'll elaborate more precisely. Definition 1. A ...
3
votes
1answer
209 views

Fully Homomorphic Encryption: Going from an integer to bits

I was answering this question Computing Logarithm using homomorphic encryption and I came up with a solution if you had encryptions of the bits of the number that you wanted to take the log of. But ...
1
vote
1answer
440 views

What is the intuition of canonical-embedding in homomorphic encryption based on RingLWE?

In the cryptosystem based on Ring-LWE, the noise amount is measured by canonical-embedding norm. What is the intuition behind canonical-embedding?
10
votes
2answers
707 views

Key Size for Symmetric Homomorphic Encryption Over the Integers

In the paper Fully Homomorphic Encryption over the Integers, it mentions a symmetric key scheme on page 1 and 2. Key Generation: Pick a random odd number $p \epsilon [2^{N-1},2^N)$ Encrypt A Bit m: $...
8
votes
0answers
510 views

LT codes with Homomorphic hashing

I have been working on a project implementing LT codes with Homomorphic hashing (inspired from http://blog.notdot.net/2012/08/Damn-Cool-Algorithms-Homomorphic-Hashing and http://blog.notdot.net/2012/...