Skip to main content

Questions tagged [homomorphic-encryption]

Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).

Filter by
Sorted by
Tagged with
1 vote
2 answers
87 views

Can I use an underlying hash function to build another hash function?

Definitions: The generic hash function $h$ with output size $n$ bytes will be used as the underlying hash function. Suppose a file $F$ that can be divided into chunks of size $n$ bytes $F=f_0+f_1+...+...
Rafael's user avatar
  • 111
1 vote
0 answers
33 views

Difference between TFHE and CKKS?

What are the differences in parameters while implementing CKKS vs TFHE? For example modulus size, ring dimensions, bit security. Any pointers to literature would be appreciated
user118184's user avatar
0 votes
0 answers
12 views

Is there any bound on the size of ring dimension for Torus FHE?

I see that all implementations of TFHE in opensource supports 2^10 to 2^12 size of ring dimensions. Is there any specific reason (crypto) behind choosing the value or can we choose higher dimensions (...
Green Amber's user avatar
0 votes
0 answers
24 views

Does the use of OPRF or OT remove the need of HE in PSI?

I was reading a systematic literature review on Private Set Intersection (PSI) protocols (https://www.sciencedirect.com/science/article/pii/S1574013723000345#sec8), which mentions that the main ...
Jayce's user avatar
  • 1
3 votes
2 answers
511 views

Is ElGamal homomorphic encryption using additive groups works only for Discrete Log ElGamal? What about EC ElGamal?

It is known that in Discrete Log ElGamal encryption, the ciphertext $E$ is encrypted as: $a\ =\ g^k$, where $k$ - random scalar from $[0,\ p)$, $g$ - group generator $b\ =\ (Y^k*m)\mod\ p$, where $Y$ -...
Azii's user avatar
  • 77
0 votes
0 answers
41 views

Can there be fully homomorphic encryption with this property?

Lets say Alice has data D and wants to send this data for Bob to process it with algorithm A. Is it possible to encrypt D so that it can only be used to run algorithm A? Alice and Bob will communicate ...
taha ismet sevgili's user avatar
1 vote
0 answers
64 views

Formal connection between fully homomorphic encryption schemes and field homomorphism

In fully homomorphic encryptions schemes (FHE), we aim to preserve both additional and multiplication operations in the encrypted space such that the operations can be decrypted later. This concept ...
Josh's user avatar
  • 145
2 votes
1 answer
82 views

Question Regarding Idenitities of Gentry's Homomorphic Encryption on LWE

In the paper Homomorphic Encryption from Learning with Errors: Conceptually-Simpler, Asymptotically-Faster, Attribute-Based Gentry introduces the following identity $\mathbf{a} \in \mathbb Z^n,\mathbf{...
Thomas Christopher Davies's user avatar
0 votes
0 answers
33 views

Zero-Knowledge Proof of a number being generated "randomly" (similar to a dice roll)

If party1 asks other parties to give a random number, for simplicity, say in a range from 1 to 6 (like in a dice). Is it possible for party1 to ensure that the number received is in a given range and ...
user60588's user avatar
  • 307
1 vote
0 answers
17 views

Mental Poker: Can the shuffle of the deck be done Publicaly by a single player at the start of the game

Ref: Mental Poker Revisited by Barnett and Smart. I am looking at mental poker problem. Generally, the shuffling process is done by a single player who starts the game and not by all players. But, in ...
user60588's user avatar
  • 307
1 vote
0 answers
47 views

Where are the bad and good lattice basis for LWE's ciphertext: (as+e+Δm, a)?

Letś talk about LWE with 2 dimensions. I've seen somewhere they talking about encrypting with the good basis (public key) and then only the bad basis can decrypt. I assume that the bad basis is the ...
user117450's user avatar
0 votes
1 answer
42 views

Can Batch Encode and Bootstrapping Be Used Together

I have referenced some documents stating that "To implement bootstrapping, the plaintext modulus 𝑡 needs to be chosen as a prime power." Meanwhile, the SEAL library documentation on Batch ...
Huy Vu's user avatar
  • 1
1 vote
2 answers
95 views

Real-or-Random Security (IND$-CPA) for Homomorphic Encryption?

I am reading papers about homomorphic encryption recently. To my knowledge, all of them opts for the Left-or-Right security i.e. distinguish between $M_0$ and $M_1$ given $\mathcal{E}_K(M_b)$ for $b \...
gan's user avatar
  • 13
1 vote
1 answer
55 views

Literature on Batching in FHE

From what I understand, the folklore way to batch Ring-LWE style cipher texts is to use the Chinese remainder theorem. I am wondering if there are any different approaches/optimizations to this style ...
woah's user avatar
  • 27
0 votes
0 answers
28 views

Should Homomorphic Encryption Keys Be Generated by a Key Generation Server or the Data Owner?

I'm currently working on a project involving homomorphic encryption and I'm trying to determine the best practices for key generation. Specifically, I'm unsure whether the keys should be generated by ...
snow's user avatar
  • 1
4 votes
2 answers
163 views

Why is division in fully homomorphic encryption impossible?

I am trying to use division in PySyft or tenSeal or anything but the devs still haven't learned how to support division?!?!
David Bower's user avatar
1 vote
1 answer
66 views

How can one model the behaviour of CKKS decryption noise?

I am trying to program a simulator for CKKS. It is a "simulator", in the sense that there is actually no encryption involved, but to a person seeing only the plaintexts (before encryption ...
Michael's user avatar
  • 31
2 votes
2 answers
110 views

Efficient commutative one-way encryption or hashing

Spent two days researching the subject, but so far I haven't come up with a satisfying answer as to whether there is a feasible solution to the following problem: A has a secret $m$ whereby $0 \leq m \...
Andreas P.'s user avatar
1 vote
1 answer
78 views

Decrypting the sum of votes but not the single vote

For educational reasons I am implementing an e-voting platform. The idea is that the voter generates the ballot on client side, the ballot is verified using a zero-knowledge proof protocol. Also, the ...
g3k0's user avatar
  • 13
0 votes
2 answers
91 views

About IND-CPA security of Homomorphic Encryption

I am trying to understand IND-CPA security in (Partially) Homomorphic Encryption schemes. However, the result of the proofs is usually something stating that a ciphertext does not expose anything ...
Daniel Morales's user avatar
0 votes
1 answer
93 views

Plaintext modulus choice for Fully Homomorphic Encryption

For SIMD fully homomorphic encryption scheme like BFV/BGV, and the underlying R-LWE problem parameterized by $n, p, q, \alpha$ (respectively the dimension, the plaintext modulus, the ciphertext ...
ProfCornDog's user avatar
0 votes
0 answers
25 views

Ideal multiplicative depth for a generic Levelled CKKS scheme

If I need to implement a generic hardware accelerator for the Levelled CKKS scheme (no bootstrapping supported), what would be the ideal multiplicative depth I should support? - that can support a ...
Moopan's user avatar
  • 1
0 votes
0 answers
67 views

Difficulty of factoring large semiprime N if given a second value y = (p-1)*r, where r is a random large prime?

Lets say we have 2 public values: N and y $$ N = pq $$ $$ y = r(p-1) $$ Where p, q, and r are large primes, are different, have a large distance between them and are kept secret. I have three ...
block103's user avatar
1 vote
1 answer
75 views

Is it possible to homomorphically evaluate an encryption circuit?

I know that it is possible to homomorphically evaluate a decryption circuit as it is the main idea behind bootstrapping, but I was wondering if it was possible to evaluate an encryption circuit ...
ProfCornDog's user avatar
1 vote
1 answer
74 views

Implement reciprocal of a floating point number using Chebyshev approximation in CKKS

I am trying to obtain the reciprocal of a floating point value $x$ using the Chebyshev approximation, where $x$ is mostly in the order of $10^3$ to $10^5$. Subsequently, I am trying to implement that ...
Sumana Bagchi's user avatar
2 votes
1 answer
86 views

The cost of the additive homomorphic encryption of McEliece cryptosystem

Let's have two integer-vectors $v_1$ and $v_2$ that are encrypted by McEliece public key. An intermediate node between the sender and receiver receives the two encrypted vectors $\text{E}(v_1)$ and $\...
Anas Ahmad's user avatar
0 votes
0 answers
34 views

Interactive Zero-Knowledge Proof for the Multiplication Gate

Refer to an interesting article (link) on Medium on the subject matter. To understand more about pRandomValue and vRandomValue. The article mentioned, "pRandomValue, on the other hand, is used to ...
user60588's user avatar
  • 307
0 votes
0 answers
125 views

Homomorphic Decryption with the Encryption (ciphertext) of Secret key for Bootstrapping purpose

The section 3.1 of the GHS11 mentions that: Given the $q_L$-ciphertext $c = (c_0, c_1)$ (that encrypts a polynomial $a \in F_2[X]/F(X)$), we postprocess it to get $c^\prime = (c_0 + c^*, c_1) \text{ ...
kindi's user avatar
  • 11
2 votes
1 answer
58 views

Initial approximation in CKKS Bootstrapping

In this CKKS bootstrapping paper https://eprint.iacr.org/2018/153 the authors use a Taylor expansion to approximate the complex exponential function within a small range. More precisely, for the input ...
opag's user avatar
  • 63
1 vote
1 answer
182 views

How to write zk-snark arithmetic circuits

Paper: "Dispute-free Scalable Open Vote Network using zk-SNARKs" by Muhammad ElSheikh Available at: https://arxiv.org/pdf/2203.03363.pdf In this paper, the author has mentioned some pre-...
user60588's user avatar
  • 307
1 vote
0 answers
39 views

Is it possible to verify and prove the decryption of an FHE cyphertext without the verifier knowing the key with zkProof?

Suppose Bob encrypts a plaintext($p$) with an FHE scheme and a key($k$), then sends the $c$ to Alice. Alice wants to know the plaintext but can't trust that Bob won't send a different string. Can Bob ...
Vasily Sobolev's user avatar
0 votes
2 answers
144 views

Are security assumptions based on quantum computers too strict? Causing cryptographers to tie their own hands

Have security assumptions based on quantum computers de facto constrained the emergence and application of many new cryptographic schemes (e.g., fully homomorphic encryption)? It seems to me that, in ...
WAN Lipeng's user avatar
3 votes
1 answer
146 views

Find two hard to reverse functions f and h such that f ∘ h ∘ g = h (f and h injective, no constraints on g)

I am looking from 3 functions $f,g,h$ from $\mathbb N \to \mathbb N$ (they can be bijections, they need to be injective at least), such that: $$f \circ h \circ g = h $$ and $f$ is hard to reverse ...
Mathematical_Noob's user avatar
2 votes
1 answer
108 views

Bootstrapping in TFHE

I've read the series of blog posts explaining TFHE scheme on zama.ai's website (four parts), and some things are not clear to me. I would appreciate if someone can shed some light on those topics. I ...
Pier's user avatar
  • 23
1 vote
2 answers
93 views

Private set intersection using homomorphic encryption

I have a question regarding the scheme below. PSI using homomorphic encryption appears to subtract the plaintext into the ciphertext. I understand that homomorphism is maintained in operations between ...
shs's user avatar
  • 13
0 votes
0 answers
52 views

Privacy Challenges in Applying Fully Homomorphic Encryption to Find Closest Shops Based on Zipcodes

Context To learn about fully homomorphic encryption (FHE) and a new language I implemented the Paillier cryptosystem in Go, and I thought it would be fun to apply it to the following interaction: A ...
a.t.'s user avatar
  • 101
1 vote
0 answers
81 views

Digit Extraction for HE Bootstrapping

I was wondering if someone could explain the Digit Extraction from HElib in simple words: Apply a homomorphic (non-linear) digit-extraction procedure, computing $r$ ciphertexts that contain the ...
kindi's user avatar
  • 11
1 vote
0 answers
18 views

Non-prime value chosen for u in DGK encryption

In DGK encryption, one of the parameters of public key is value u where it is a small prime with minimum length l+2. It is not obvious for me what is the security compromise if u is not prime. Any ...
Fattaneh's user avatar
2 votes
1 answer
62 views

About Naccache-Stern higher residue cryptosystem definition

About the Naccache-Stern cryptosystem, I have found two different encryption algorithms: In the original paper from Naccache and Stern, the encryption step is performed by calculating $c = g^m \...
hectorvr14's user avatar
0 votes
1 answer
65 views

Homomorphic Encryption and Conjugation

In the implementation of HEAAN, they have implemented the conjugate function. It computes conjugate of a polynomial. Effectively they have reverted the positions of the coefficients and negated their ...
kindi's user avatar
  • 11
1 vote
0 answers
75 views

Privacy-Preserving User Tracking Across Systems with Homomorphic Encryption or hashing

I'm working on a project where we have three different software systems—let's call them A, B, and C. Systems A and B handle user data identified by phone numbers and want to send user actions to ...
Mr Alihoseiny's user avatar
1 vote
0 answers
44 views

Dealing with MITM attack in e-voting systems

I've read many e-voting papers that use El-Gamal scheme which I recall is vulnerable to man-in-the-middle attack, yet I find no discussion or even mentioning of it in those papers. -Does anyone knows ...
ShAr's user avatar
  • 160
0 votes
0 answers
43 views

I'm wondering if using the same one public key does not guarantee privacy in the computation of multiple data owners

Participating entity: multiple data owners, computing clouds Protocol: The multiple data owners send their data to the computing clouds, which perform the computation of the data. Privacy protection:...
user2642459's user avatar
1 vote
0 answers
99 views

Understanding Gentry's initial FHE construction based on ideal lattices

I am trying to understand the encryption procedure in Craig Gentry's initial construction for FHE described in Fully Homomorphic Encryption Using Ideal Lattices. Unfortunately after repeated attempts ...
Parham's user avatar
  • 111
0 votes
0 answers
58 views

divide integer to multi by polynomial ring in BFV homomorphic algorithm

The BFV algorithm is one type of fully homomorphic encryption algorithms. How can I encode an integer to polynomial ring by using batch encoder based on $R_t := {Z_t[X] \over ⟨(X^n)+1⟩}$? The ...
Nibras's user avatar
  • 1
0 votes
0 answers
18 views

[error reducing techinique in lattice based commitment]

I am aware there are many techniques to reduce the error of lattice-based homomorphic encryption. But is there any technique to deal with lattice-based homomorphic commitment, e.g., More Efficient ...
js wang's user avatar
  • 361
1 vote
1 answer
63 views

Decryption of Naccache–Stern cryptosystem is not guaranteed for large keys

Naccache-Stern cryptosystem is mainly based on Chinese Remainder Theorem. According to its wiki page and Partially Homomorphic encryption book, I generated following keys. 1- Picked a family of k ...
sefiks's user avatar
  • 229
0 votes
1 answer
77 views

Understanding and Implementing fast base conversion (FastBConv, bconv) in Mathematica

According to Section 2.3 of Full-RNS CKKS: More precisely, for a basis $ \left\{p_{0}, \ldots, p_{k-1}, q_{0}, \ldots, q_{\ell-1}\right\} $, let $ \mathcal{B}=\left\{p_{0}, \ldots, p_{k-1}\right\} $ ...
Tokubara's user avatar
  • 103
0 votes
0 answers
49 views

merging structured encrypted data

this is a followup of the post I made there: https://stackoverflow.com/questions/77428690/merging-structured-encrypted-data Essentialy, I'd like to know if there is a way to merge bencoded data (or ...
Plop's user avatar
  • 1
1 vote
1 answer
93 views

Homomorphic encryption with multiple keys that is secure under the assumption of a compromise of the combined key

Is it possible to extend the general concept of homomorphic encryption: $$f(m_1)\cdot f(m_2)=f(m_1+m_2)$$ to: $$f(m_1)\cdot g(m_2)=f\cdot g(m_1+m_2)$$ is it further possible to construct the scheme in ...
baxbear's user avatar
  • 125

1
2 3 4 5
19