Questions tagged [homomorphic-encryption]

Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).

198 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8
votes
0answers
557 views

LT codes with Homomorphic hashing

I have been working on a project implementing LT codes with Homomorphic hashing (inspired from http://blog.notdot.net/2012/08/Damn-Cool-Algorithms-Homomorphic-Hashing and http://blog.notdot.net/2012/...
6
votes
0answers
94 views

Is it possible to derive a homomorphic signature from homomorphic encryption

At the moment I am trying to find a practical way to implement a linearly homomorphic signature. Background: "In a homomorphic signature scheme, a user Alice signs some large dataset x using her ...
6
votes
1answer
449 views

Zero knowledge proof for Paillier addition under multiple keys

Suppose $m_0, m_1, m_2 \in \mathbb{N}$ such that $m_0 = m_1 + m_2$, $m_i > 0$ (none of them can be 0 or lower) Under a Paillier cryptosystem, set $e_0 = E(m_0, r_0)$ for a public key $(g_0, n_0)$ ...
6
votes
0answers
232 views

Additive homomorphic encryption scheme without change in operator

I'm looking for an additive homomorphic encryption that the addition operator (+) in its plaintext space be the same as addition operator in its ciphertext space. (Schemes like Paillier do addition in ...
5
votes
0answers
65 views

Threshold homomorphic

Quite a specific question, but are there any threshold signatures that are also homomorphic? Preferably ones that work in the discrete log setting and don't require any pairings.
5
votes
0answers
339 views

ring-LWE: Minkowski Embedding , the Co-Different Ideal, etc

While (trying) to go over the reductions from approx. SVP on ideal lattices to search ring-LWE, [1] and [2], for $K = \mathbb{Q}(\zeta)$ where $\zeta$ is an abstract root of a cyclotomic polynomial, ...
5
votes
0answers
253 views

How do they avoid Zero Knowledge Proofs in the paper Priced Oblivious Transfer: How to sell Digital Goods?

I don't understand a part of the paper Priced Oblivious Transfer - How to Sell Digital Goods. Particularly, the authors avoid using zero knowledge proofs and in section 3.3 they explain how they do ...
5
votes
0answers
366 views

Homomorphic system that allows Hamming distance computation?

How can I work out Hamming distance between two binary vectors securely? I would like to know how I can apply homomorphic techniques here.
5
votes
0answers
382 views

Additively homomorphic cryptosystem with non-interactive zero-knowledge proof of non-negativity

I need a cryptosystem that is additively homomorphic. Paillier preferably, but not neccessarily. Also, for every ciphertext the private key holder must be able to prove non-interactively that the ...
4
votes
2answers
151 views

Proving the right encrypted message was sent

Total amateur to crypto here but I've searched and searched and am at the extent of my knowledge. I've gone down several avenues to satisfy what I'm looking for but I'm just going to describe what I'd ...
4
votes
1answer
253 views

Is there any way to check hash of homomorphic encrypted data?

I need some algorithm that satisfies: H - hash function Enc - encryption function (using public key) M - secret data $Enc(H(M)) = H(Enc(M))$ Let this system exist: the First person has a secret ...
4
votes
0answers
106 views

What are some of the current relevant fully homomorphic schemes?

As of February 2017, I have the feeling that all information on FHE is currently a bit scattered and finding a good summary/ timeline on the topic is really hard. I'm currently looking into FHE over ...
4
votes
0answers
136 views

An MPC protocol from Elgamal is a good solution a homomorphic multiplication?

I want to compute a multiplication between many secret values and then distribute the result to everyone involved. For this, I thought about an MPC protocol built from Threshold Homomorphic Elgamal. ...
4
votes
0answers
243 views

How can I implement decryption for NTRU homomorphic encryption scheme?

I have come across this paper On-the-fly multiparty computation via on-the-cloud Multikey from Fully Homomorphic Encryption by Lopez-Alt et al., where authors describe a NTRU-based homomorphic ...
4
votes
0answers
112 views

How about a homomorphic integer sorting in a MPC context?

I want to implement the ATV-FHE scheme as described by Adriana López-Alt, Eran Tromer, Vinod Vaikuntanathan: On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption (...
4
votes
1answer
241 views

FHE over the integers - Is that paper's scheme known to be insecure against quantum adversaries?

I was reading the paper Fully Homomorphic Encryption over the Integers, and started wondering if there is a known quantum attack on their main scheme, because There is an efficient quantum attack on ...
4
votes
0answers
275 views

Obfuscating point-like functions

There are standard schemes for obfuscating a point function; I'm wondering if we know how to obfuscate a slight generalization of a point function. I'll elaborate more precisely. Definition 1. A ...
4
votes
1answer
204 views

Generating random vector for Full Homomorphic Cryptography

The site below explains that part of doing homomorphic encryption, you need to generate a vector of random numbers that have the property that its dot product against a randomly generated bit vector ...
3
votes
0answers
64 views

Can the hash of the ciphertext be derived from the hash of the plaintext

Let $C$ be a symmetric cipher $H$ a hash function. Alice uses $C$ with a key $k$ to encrypt plaintext message $m$ yielding ciphertext $c$. She then calculates the hash of the message $h_m = H(m)$ and ...
3
votes
0answers
105 views

Homomorphic Encryption Roadmap

I'm looking for some suggestions on what to read (papers, notes, book chapters?) on homomorphic encryption in order to understand the most recent (more optimal) schemes, as well as optimized use cases ...
3
votes
0answers
64 views

What is labeled program

I've been studying homomorphic encryption. From their instantiations, i read Labeled Homomorphic Encryption (labHE) scheme 1 where it combines the notion of homomorphic encryption with labeled ...
3
votes
1answer
139 views

Gentry-Halevi’s Fully-Homomorphic Encryption and hermite factor

In section 7.2, page 18 in Chen-Nguyen paper regarding BKZ 2.0, they point out different Hermite factors related to Gentry-Halevi FHE. More precisely, it is said that the critical Hermite factor for ...
3
votes
0answers
120 views

Is there a partially homomorphic cryptosystem without an inverse (addition without subtraction, multiplication without division)?

I am learning about partially homomorphic cryptography, and was interested to see if there was a system such that one operation was homomorphic, but its inverse was not. For example, if I have two ...
3
votes
2answers
239 views

How to define a FHE scheme whose plaintext space is infinite using boolean circuits?

There are many kinds of fully homomorphic encryption scheme by using boolean circuits. And the plaintext space $\mathcal{P} = \{ 0,1 \}$. If there is a -bit FHE scheme, we can construct a FHE scheme ...
3
votes
0answers
206 views

Homomorphic encryption over finite fields

I'm curious on the following question: let $\mathbb{F}_{2^n}$ be a finite field which is an extension of $\mathbb{F}_2$ with order of $n$, is there an encoding scheme $e:=\mathbb{F}_{2^n}\rightarrow \...
3
votes
0answers
116 views

How to test a FHE implementation?

I want to implement a FHE scheme based on NTRU, namely the scheme described here https://eprint.iacr.org/2014/039.pdf . How to test the security of my implementation ? Do I have to implement the ...
3
votes
0answers
162 views

Key Recovery Smart-Vercauteren SWHE

In the article (https://eprint.iacr.org/2009/571.pdf, pag 8) of Smart and Vercauteren, it is mentioned that the recovery of the private key is an instance of the small principal ideal problem. But I ...
3
votes
0answers
134 views

Lowest number challenge scheme

Suppose Alice knows a secret number $a$, and Bob knows a secret number $b$. Is there a simple way for Alice and Bob to know who has the lowest number, without Alice & Bob exchanging their numbers ...
3
votes
1answer
158 views

Using error-correcting codes for the bootstrapping procedure of Fully Homomorphic Schemes

In the context of Fully Homomorphic Schemes, we use a technique called "bootstrapping" to refresh the ciphertext, by evaluating homomorphically the decryption circuit with an encrypted version of the ...
3
votes
1answer
262 views

Why gcd(r,(p-1)/r) needs to be 1 in benaloh cryptosystem

I recently discovered the benaloh cryptosystem. I am working with the system as it is discribed in the following link: https://en.wikipedia.org/wiki/Benaloh_cryptosystem However I need some help in ...
2
votes
0answers
45 views

RLWE like problem

Assume we have the polynomial space $R_q$ defined as $R_q = Z_q/(X^n + 1)$. Additionally, we define the error distribution $\chi$ as a discrete centred Gaussian bounded by $B$. Let $s \gets R_q$ be a ...
2
votes
0answers
34 views

Why could the error term be sampled coefficient wise?

In SEAL homomorphic encryption library, it implements the BFV and CKKS. We know the error $e\in R_q$ which is a Guassian distribution. When sampling an error term $e = \sum_{i=0}^{n-1} e_ix^i$, it ...
2
votes
0answers
57 views

Why should the smudge noise be used?

Consider a threshold FHE scheme based on RLWE like this: Refer to this paper $\textbf{Initialization:}$ Every party generates his own secret key $s_i$, then uses the common polynomial $a$ to generate ...
2
votes
0answers
87 views

Efficiently prove the correctness of Paillier encryption in or “outside” a zk-SNARK

I'm working with a zk-SNARK library [1] that allows me to prove the correctness of arbitrary arithmetic circuits, and I now want to use these zk-SNARKs to prove that some Paillier [2] ciphertext $c$ ...
2
votes
1answer
125 views

What's the difficulty of using elliptic curves to design homomorphic encryption protocols?

I have recently been very interested in elliptic curves because they are a powerful tool in crypto, ECC, pairing, etc. However, it seems that elliptic curves are not popular in homomorphic encryption. ...
2
votes
0answers
43 views

Predicting with a machine learning model while preserving the privacy

Imagine Alice has trained a machine learning model. She wants to store her model in a blockchain so that everyone can use it; however, she wants her model to be private so that no one can steal her ...
2
votes
0answers
60 views

How can I use two different public keys with the same private key for fully homomorphic encryption?

I am pretty new to cryptography. Recently I run into this question where I have two different public keys with the same private key, and I need them for fully homomorphic encryption. Let's say ...
2
votes
0answers
187 views

Can I use RSA as hash function?

My end goal is to have an encryption function $e$ and a hash function $H$ such that for all m we have: $$H(e(m)) = e(H(m))$$ This would work if we use RSA encryption along with RSA "hash", ...
2
votes
0answers
30 views

Homomorphic encryption scheme for modulo reduction

I want to know if there is any Homomorphic encryption scheme that supports modulo reduction, i.e., using $Enc_{pk}(m)$ and a public $w$ to compute $Enc_{pk}(m \mod w)$. Thank you.
2
votes
0answers
65 views

DES decryption of the homomorphic encryption ciphertext

I implemented an application using partial homomorphic encryption for outsourced computations. To get an efficient bandwidth, I am thinking to apply (DES) symmetric algorithm to encrypt the message ...
2
votes
0answers
74 views

Multi-party computation with only 1 party?

MPC is $f(E_1(a), E_2(b)) = c$, where $E$ is encryption by different keys $k_1$ and $k_2$. Homomorphic encryption is $f(E_1(a)) = E_1(c)$, where the input and output are encrypted. I want $f(E_1(a)) ...
2
votes
0answers
63 views

What is the current state-of-the-art of function-private functional encryption?

Are there any known constructions of functional encryption with function-privacy for arbitrary functions (e.g. not just inner-product)? If so, are these constructions currently feasible or for now ...
2
votes
0answers
652 views

Simple explanation of CKKS scheme

I'm searching for a (preferably simple) explanation of the Cheon-Kim-Kim-Song scheme for fully homomorphic encryption. All I did find so far is the original paper, which is rather difficult to ...
2
votes
0answers
84 views

Is it possible to enhance white-box cryptography security by homomorphic encryption?

Background: Let's discussed based on published symmetric white-box crypto only, such as Chow's white-box AES. I only know basic concepts/objectives of homomorphic encryption, such as PHE and FHE. ...
2
votes
0answers
76 views

Can binomial distribution be used to sample noise for Ring-LWE-based homomorphic encryption?

Homomorphic encryption schemes based on Ring-LWE need to sample the noise terms from a discrete probability distribution $\chi$ over the integers with support $[-B,B]$. For example, the Fan-...
2
votes
0answers
36 views

Generate unique pair $g^k, E(k^{-1})$ for each group

Let say I have n computers, with some t-threshold encryption scheme. I want to have n public shares (known to every participant) such that any t of them generates a pair: $g^k, E(k^{-1})$ that is ...
2
votes
0answers
81 views

How HomNAND has been computed in Leo Ducas and Daniele Micciancio's FHEW?

In section 4.1 of Leo Ducas and Daniele Micciancio's paper FHE Bootstrapping in less than a second, HomNAND has been computed as follows: $$ (\textbf{a}, b) = HomNAND((\textbf{a}_0, b_0),(\textbf{a}_1,...
2
votes
0answers
150 views

Verifiable secret sharing - Benaloh scheme; some doubts not answered earlier

I reviewed the paper "Secret sharing homomorphisms: keeping shares of a secret secret" by J.C. Benaloh yesterday and I had some difficulty understanding his version of verifiable secret ...
2
votes
0answers
280 views

Chinese Remainder Theorem and Elgamal

I am studying an encryption scheme which is Elgamal-like where I think CRT can help optimise the encryption and decryption but I am not sure if I am applying CRT the correct way. I have a cyclic ...
2
votes
0answers
230 views

A question about fully homomorphic SIMD operations

I'm going through Gentry, Halevi and Smart's paper "Fully Homomorphic Encryption with Polylog Overhead" and have a question about the permutation operations. Background: The cyclotomic polynomial ...