# Questions tagged [homomorphic-encryption]

Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).

720 questions
Filter by
Sorted by
Tagged with
55 views

### Is there some function of $n$ that is a multiple of $\phi(n^2)$?

Not sure which forum to post this question so here is a link to it from MSE. This is to adapt the approach of Fermat's Little Theorem to the Paillier encryption system. I understand that this will ...
74 views

### Does asymmetric order-preserving encryption exist?

As I understand from this post, mapping from plaintext space to ciphertext space is the fundamental point of all order-preserving encryption. So the only way that we let someone encrypt an arbitrary ...
28 views

### For a given security parameter $\kappa$. what does $poly(\kappa)$ mean?

Let ($Gen,Enc,Dec$) be an LHE scheme with security parameter $\kappa$ and message space $M$. Assume that a multiplication operation exists in $M$, i.e., is a finite ring. Let $F : \{0, 1\}^s × L → M$ ...
24 views

### HElib: send sk and pk to another party for decryption and encryption

This question is about the serialization of pk, sk, and context in HElib. In my scenario, ...
18 views

### How to understand the per-gate computation overhead of the FHE scheme?

In BGV12(Fully Homomorphic Encryption without bootstapping), they investigate the efficiency of a FHE scheme by considering the per-gate computation overhead of the FHE scheme, defined as the ratio ...
48 views

### How does bootstrapping work?

I have read FHE lately. In Fully Homomorphic encryption using ideal lattice[Gen09], I noticed his recrypt algorithms: We have a ciphertext $\phi_1$ which is encrypted by public key $pk_1$, and can be ...
33 views

### What's the performance of the HElib and SEAL?

HElib contains the CKKS and BGV, SEAL contains the BFV and CKKS, is there some concrete performance data about these two lib?
38 views

### Is it possible to allow a user to log in if logged out without identifying them?

I have to verify that the user has registered and is currently logged out without identifying the user. Essentially, I am looking for privacy-oriented authorization mechanisms which prevent ...
53 views

### SS/HE/GC/OT secure integer comparison

I have been reading some papers to find a 'faster' way to compare two integers without revealing their real values. But I think I'm a bit lost in those papers due to my limited knowledge in ...
34 views

### Simple question about BGV scheme

While I'm trying to implement BGV scheme myself, I found that I'm really confusing about the encryption and decryption of the scheme. Here's my understanding: Let $p$ be a plaintext modulus and $q$ be ...
35 views

### Homomorphic encryption key switching

I understand the general idea of key switching, but I would like to know when it is used. Sometimes it is referred to as same thing as relinearisation(after multiplication), but is key switching also ...
31 views

### How to know the exact result in Paillier chiper-costant multiplication

The encryption function $E_{k^+}: Z_n \rightarrow Z_{n^2}$. The decryption function $D_{k^-}: Z_{n^2} \rightarrow Z_n$. $m_1 = 42, k = 15, n=77$. After encryption, exponentiation and decryption, I get:...
45 views

### RLWE like problem

Assume we have the polynomial space $R_q$ defined as $R_q = Z_q/(X^n + 1)$. Additionally, we define the error distribution $\chi$ as a discrete centred Gaussian bounded by $B$. Let $s \gets R_q$ be a ...
51 views

recently I'm trying to use TFHE library for project(https://tfhe.github.io/tfhe/). In order to accelerate the whole program, I use pthread to make multi thread computation. However, I find that the ...
61 views

### Joint distribution of RLWE samples

Assume we have the polynomial space $R_q$ defined as $R_q = Z_q/(X^n + 1)$. We draw samples $s_i \gets R_q$ uniformly at random. Additionally, we define the error distribution $\chi$ as a discrete ...
18 views

### Proving the security of the public key BGV scheme

The security proof basically comes down to the following based on this paper. We want to show that two distributions are statistically indistinguishable. Say we have that $a,a′,x,x′$ are drawn from an ...
93 views

### Role of AND operation in FHE, MPC and ZK

Going through LowMC, one of the main advantage of it seems to be useful in Fully Homomorphic Encryption (FHE), Multi-party Computation (MPC) and Zero Knowledge (ZK) proofs. I have no idea about any of ...
25 views

### CKKS : Ciphertext extension

I have a CKKS ciphertext containing [a, b, c, d] and I want to get these 4 ciphertexts : [a, a, a, a]; [b, b, b, b]; [c, c, c, c]; [d, d, d, d]. Is there a more efficient way than repeating the ...
49 views

### Rotation with redundant slots in HElib

As described in another question How to get exact number of slots in HElib?, get the exact number of slots with relative small parameters m and ...
28 views

### What is the evaluation step in an HE scheme? [duplicate]

I quote: By homomorphic encryption, we mean the family of encryption schemes being able to perform homomorphic operations on ciphertexts, without decrypting them. The first time someone introduced ...
22 views

### Palisade: EvalMult between plaintext and ciphertext resulting in tower size mismatch

I hope someone can help me understand an error I get when using Palisades. I want to only use the first 329 slots of a BGV ciphertext, and zero out the rest (which at some point contains some '...
52 views

### How to understand why an algorithm uses additive or multiplicative homomorphic

If we take the example of LWE (Learning With Errors) how does one know if it's homomorphic by addition or multiplication?
33 views

### A question about HElib again

Sorry but I've got a question about HElib again. I'm applying HElib to make a secure logical calculation and I apply bootstrapping as usual. Paras I selected was from "example". However, ...
70 views

### Comparison of SNARK-friendly hash algorithms MiMC7, Poseidon, Pederson?

There are some cryptographically secure hash algorithms designed to be efficient for SNARKs, STARKs and FHE. Some of them already implemented in Zcash, Zokrates and circom. The ones that I know of are:...
35 views

### Paillier estimate attack costs on short keys

I was thinking about how to use the homeomorphic property of that cryptosystem to achieve not a "semantic security" but a less ambitous obfuscation of the source code (an ipotetical scenario ...
178 views

### How to get exact number of slots in HElib? Such as 256, 4096

In the Homomorphic Encryption Library, HElib (https://github.com/homenc/HElib), we set up a set of parameters before generating the ciphertext. For example: ...
53 views

### AES (or otherwise): can you decrypt concatenated encrypted messages as one?

Say I have 20 distinct encrypted messages. Using AES, I am only getting the correct output if I decrypt each of the 20 messages individually. Is it possible using AES or another method to call my ...
40 views

### Secret key generation in the BGV scheme in HElib

This question is about secret key generation, based on section 4.7 in the design document: https://homenc.github.io/HElib/documentation/Design_Document/HElib-design.pdf It seems that if $m$ is not a ...
26 views

### How to save keys and other paras in HElib

Recently I'm using HElib for project. Here I hope to init a Client-class,which has pub&pri keys. However when I was building class, I found that I don't know how to save Keys and other paras like ...
60 views

### Why doesn't HElib support floating point operations?

NB: what I meant is with implementation of the BGV-cryptosystem, not the CKKS cryptosystem which is designed with floating point arithmetic in mind. HElib as I understand it only supports fixed-point ...
34 views

### Why is noise growth from relinearisation ignored in the FV crypto scheme?

I'm going through the FV scheme and SEAL and there are a couple of things I'm not understanding with respect to noise growth of relinearisation. On page 8 they say to choose T so that the noise ...
48 views

### What is the difference between Paillier additive homomorphic property and addition of two paillier ciphers

Paillier has additive homomorphic property that states: if two ciphers c1 and c2, are multiplied, and the result is decrypted, it is equal to addition of the two plaintexts. D(c1*c2)= m1+m2 ...
35 views

### How to fix the IND-CPA+ problem in CKKS?

In paper On the Security of Homomorphic Encryption on Approximate Numbers the author gave an attack on CKKS, then how to fix it?
46 views

### Prove Paillier cryptosystem decryption $M=L(c^{\lambda(n)}\bmod n^2)\,\mu\bmod n$

How can we prove mathematically that in Paillier cryptosystem decryption, our message is equal to the right side of $$M=L(c^{\lambda(n)}\bmod n^2)\,\mu\bmod n$$
101 views

### How expensive would running a practical application on full homomorphic encryption be?

This is a multidisciplinary question, hopefully I can stay on topic. It has been published that we can now use (try?) fully homomorphic encryption computation on cipher text inputs. But I'd like to ...
28 views

### What distribution is required to ensure the security of the RLWE?

In LWE, the error should be sampled from a discrete Gaussian distribution. Then, in RLWE, the error is a polynomial in $\mathbb{Z}_q[x]/(x^N+1)$, it could be sampled coefficient wise. However, when we ...
38 views

### Practicality of dangerous/unsafe content safety proof as follows

Suppose I am building a cloud storage with client side encryption. My policy is that I would not allow anyone to store pornographic, violent or otherwise unsafe content but must ensure full privacy. ...
28 views

### PYFHEL - Concatenating two encrypted strings and then decoding them

I'm trying out the PYFHEL (PYthon For Homomorphic Encryption Libraries) library, and was wondering if it was possible to concatenate two strings while encrypted and then decrypt the result. This ...
129 views

### How is R-LWE related to lattice cryptography and homomorphic encryption?

Can someone tie everything together for me? I'm interested in H.E and I have some background in AES, DES, RSA and the like. While reading around I stumbled on Shai Halevi's course on lattice ...
276 views

### Why does bootstrapping (R)LWE homomorphic encryption produce small noise?

Why does homomorphic evaluation of the decryption circuit produce a ciphertext with "fresh" or small noise? Rough description of bootstrapping homomorphic encryption: Suppose we have a ...
30 views

### Could FHE scheme like BGV could be used many times, or fully homomorphic encryption could be used continuously？

Currently I was working with FHE scheme and used HElib to do homomorphic logical operation like the formal question described Homomorphic encryption methods that could support logical XOR, AND?. But ...
21 views

### What does the “scale invariant” mean in some FHE schemes?

In some paper about FHE, the term "scale invariant" often appears. What does it means?
34 views

### Why could the error term be sampled coefficient wise?

In SEAL homomorphic encryption library, it implements the BFV and CKKS. We know the error $e\in R_q$ which is a Guassian distribution. When sampling an error term $e = \sum_{i=0}^{n-1} e_ix^i$, it ...
88 views

### In Microsoft Password Monitor implementation using HME how do they perform ComputeMatch Function?

https://www.microsoft.com/en-us/research/blog/password-monitor-safeguarding-passwords-in-microsoft-edge/ In this they mention The server then evaluates a matching function on the encrypted credential,...
39 views

### Why are the fully homomorphic encryption algorithms the commitment?

Is there some references about the commitment scheme based on FHE ? Why could the BFV, CKKS, BGV algorithm be convert to commitment? How ?
232 views

### Python library that implements additive homomorphism of Elgamal Encryption on the Elliptic curve i.e X25519 or P-256

I'm trying to find a Python library that implements Elgamal Encryption on the Elliptic curve i.e X25519 or P-256. My purpose is to use the additive homomorphic property of Elgamal. I'm using https://...
107 views

### Homomorphic encryption methods that could support logical XOR, AND?

Recently I'm researching about logical circuit calculation and I hope to use homomorphic encryption to protect the whole process. I've read Gentry's paper and use some websites like https://...
57 views

### Why should the smudge noise be used?

Consider a threshold FHE scheme based on RLWE like this: Refer to this paper $\textbf{Initialization:}$ Every party generates his own secret key $s_i$, then uses the common polynomial $a$ to generate ...
The BFV scheme can be described as: Public Key: $(p_0, p_1)$ To encrypt a plaintext $m$, the ciphertext is : $(c_0, c_1) , c_0= up_0+\Delta m + e_0, c_1=up_1 + e_1$