Questions tagged [homomorphic-encryption]

Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).

Filter by
Sorted by
Tagged with
6
votes
3answers
219 views

How to compute the inner product on encrypted vector by using a third party?

I want to compute the inner product of two vectors on a third party, i.e. $f(x) \cdot f(y) = x \cdot y$ where $x$ and $y$ are two vectors. However, I do not want the third party knows the real value ...
0
votes
1answer
56 views

How re-encryption can be done through RSA

Both RSA and Elgamal have homomorphic properties. So both can re-encrypt the ciphertext. Re-encryption with Elgamal works as seen here. How does re-encryption work using RSA? What modification / ...
2
votes
0answers
27 views

Are there any advantages and disadvantages with what type of model of homomorphic computation is used? [closed]

I am curious about the advantage or disadvantage in using the different models of homomorphic computation (boolean circuits, modular arithmetic, approximate number arithmetic). Are there any specific ...
0
votes
1answer
92 views

How to implement GSW13 using Helib or SEAL?

I want to implement the homomorphic encryption scheme proposed in GSW13, and make some changes to it, but seems that there is no library that has already been implemented it. Since this is a ...
2
votes
1answer
64 views

Do Partially Homomorphic Encryption schemes also suffer from noise overflow?

Do PHE schemes in general also suffer from noise overflow problem?
1
vote
1answer
346 views

Classification of BFV and CKKS scheme?

I would just like to ask what is the classification of both BFV and CKKS scheme are they Somewhat Homomorphic or Fully Homomorphic? Brakerski/Fan-Vercauteren (BFV) [Brakerski12, FV12, BEHZ16, HPS18] ...
0
votes
0answers
46 views

In using Boolean Circuits model of Computation in Homomorphic Encryption why is is considered fast?

I am currently doing some reading on Homomorphic Encryption for research purposes and based on my reading using the Boolean Circuit Model of Computation specifically in regards to Fast Fully ...
2
votes
1answer
80 views

Are there any symmetric Partial Homomorphic Encryption Schemes?

Note that I am asking specifically for Partial Homomorphic Encryption (PHE) schemes and not Somewhat Homomorphic Encryption (SHE) schemes. I believe there are several SHE schemes that are symmetric ...
3
votes
2answers
191 views

Is there FHE (fully homomorphic encrpytion) for string/text processing?

I had a quick look at FHE libraries like SEAL, HeLib, and Palisade and they deal with addition or multiplication of encrypted data. Is there a FHE that deals with string? If no, is that because it is ...
2
votes
0answers
194 views

Simple explanation of CKKS scheme

I'm searching for a (preferably simple) explanation of the Cheon-Kim-Kim-Song scheme for fully homomorphic encryption. All I did find so far is the original paper, which is rather difficult to ...
4
votes
1answer
180 views

How exactly is TFHE secure?

TFHE (Fully Homomorphic Encryption over Torus) seems to be a state-of-the-art form of homomorphic encryption. But, I got a bit confused. I have recently read the paper Fully Homomorphic Encryption ...
1
vote
0answers
41 views

Is it possible to enhance white-box cryptography security by homomorphic encryption?

Background: Let's discussed based on published symmetric white-box crypto only, such as Chow's white-box AES. I only know basic concepts/objectives of homomorphic encryption, such as PHE and FHE. ...
1
vote
1answer
79 views

Can the person who decrypts a homomorphically encrypted value know what operations were run?

I'm looking at the SEAL library but I'm trying to figure out what happens in a certain use case. For example: Alice encrypts the number 123456 homomorphically and sends it to Bob. Bob adds 25 and ...
0
votes
1answer
43 views

Whether ramp secret sharing possess additive homomorphism?

Ramp secret sharing replaces the random coefficients in original Shamir secret sharing with original data to be shared. In such a case, all the coefficients in the polynomial evaluation will be ...
0
votes
0answers
21 views

Secure Computation with TTP using Ring-LWE Homomorphic Encryption

I was working with secure outsourced computation for multi-party computation in which security is assured by ring-LWE based asymmetric homomorphic encryption in the semi-honest model. Is it feasible ...
1
vote
0answers
79 views

How can I prove that the plaintext of an elgamal ciphertext is the discrete log of an element?

Is there any (efficient) method to prove that the plaintext of an ElGamal ciphertext is the discrete log of an element? In the scenario I concerned, I have an El Gamal key pair $(pk, sk) = (g^y, y)$....
1
vote
1answer
121 views

Comparison of values in Paillier homomorphic encryption

For a project, I am using homomorphic encryption with the Paillier cryptosystem, and I have to compare two values... Can this be done using homomorphic encryption? And I know subtraction can be done ...
1
vote
1answer
59 views

Is it possible to change the generator without knowing the private key used?

For example, prover sends P = xG and verifier somehow sends back P = xH without learning x. Is this possible?
2
votes
1answer
76 views

Gentry-Halevi’s Fully-Homomorphic Encryption and hermite factor

In section 7.2, page 18 in Chen-Nguyen paper regarding BKZ 2.0, they point out different Hermite factors related to Gentry-Halevi FHE. More precisely, it is said that the critical Hermite factor for ...
0
votes
0answers
64 views

Does such cryptographic scheme exists?

Is there any multi-key additive homomorphic encryption scheme based on elliptic curve cryptography? Meaning adding encrypted values encrypted with different public keys and decrypt the total sum with ...
2
votes
1answer
88 views

how do we calculate set intersection using homomorphic encryption?

I am new to this field. I want to learn how homomorphic encryption can be used for PSI. I am aware of other SMC protocols but I never understood how to use schemes like Paillier for PSI calculation. ...
2
votes
1answer
90 views

Homomorphic modulo

What homomorphic cryptographic scheme should I use to perform modular reduction? I want an encryption scheme along with an operation $\otimes$ such that $$c = Enc(m) \otimes Enc(d) \Rightarrow Dec(...
0
votes
1answer
85 views

Homomorphic/Paillier crypto system for use case?: overflow for multiple counter exponent possible? Different cipher factor needed all the time?

Recently I read about homomorphic cryptosystem. They might solve a problem. To do this there need to be some modifications from standard version. Using Paillier here but a solution for other also ...
2
votes
0answers
49 views

Can binomial distribution be used to sample noise for Ring-LWE-based homomorphic encryption?

Homomorphic encryption schemes based on Ring-LWE need to sample the noise terms from a discrete probability distribution $\chi$ over the integers with support $[-B,B]$. For example, the Fan-...
1
vote
1answer
93 views

Comparison on Gentry's Fully homomorphic Encryption? [duplicate]

This topic is very new to me. Is it possible to do comparison on the encrypted data(data is encrypted using Gentry's FHE)? If so, how can it be done?
3
votes
1answer
89 views

Where can I find open source code for Encryption Switching Protocol?

The concept of Encryption Switching Protocols was introduced in CRYPTO. I was wondering if there is any pseudo-implementation of the protocol available or can I get some insights on how to implement ...
0
votes
1answer
66 views

How does the 'Flatten' function reduce the coefficients of a vector/matrix?

Seen here, at the bottom of page 5, Flatten() is defined as: Flatten(a)=BitDecomp(BitDecomp$^1$(a)) For an n-dimensional vector a$=(a_{1,0},...,a_{1,l-1},...,a_{k,0},...,a_{k,l-1})$. Where $a_{i,j}$ ...
3
votes
1answer
119 views

Design a OT-based Private Set Intersection protocol to obtain $A \cap B \cap C$?

This is a tutorial question for a Foundations of Privacy computer science course, I'm unsure on how to tackle it because we haven't talked much about these particular topics in class. (a) Assume ...
3
votes
1answer
102 views

Order of g in Paillier Scheme

I'm trying to understand the Paillier Scheme but there's something I can't understand in the keyGen algorithm: Ensure $n$ divides the order of $g$ by checking the existence of the following ...
1
vote
0answers
80 views

How to break fully homomorphic encryption over integer algorithm with known cipher of same integer?

If I do encryption and decryption like this: Encryption: $\text{E}(m) = (r \times p_1+m) \bmod N$ Decryption: $\text{D}(\text{E}(m)) = ((r \times p_1 + m) \bmod N) \bmod p_1 = m$ where, $r$ = ...
0
votes
1answer
154 views

SEAL-CKKS max multiplication depth

I am trying to understand how SEAL-CKKS scheme works and I wonder what multiplication level can we achieve using this scheme? Like 100 possible?
0
votes
0answers
54 views

How can a node establish pairwise shared key with other nodes using its own polynomial share together with other's public values?

A server has a symmetric bivariate polynomial $ F(x, y) = \sum_{{i,j}=0}^{t-1}a_{i,j}x^iy^j$ $\in GF(p)[X, Y] $ of degree $t-1$. For simpliciy, $ F(x, y) = a_{0,0}+a_{1,0} x+a_{0,1}y+ a_{1,1}xy$ mod ...
0
votes
1answer
81 views

Are there any homomorphic first and second preimage resistant (cryptographic) hash functions?

Are there any homomorphic cryptographic hash functions that satisfy $\text{H(A + B)} = \text{H(A)} + \text{H(B)}$ which maintaining pre-image resistance
0
votes
0answers
58 views

Blinding factor SEAL

For a protocol, I need to blind a ciphertext. I am not sure how to choose the blinding factor. How should I choose the range? What should I consider to offer security? I am using CKKS scheme, the one ...
2
votes
2answers
131 views

Is OTP with homomorphic encryption trivial?

If my key size is as large as the data I'm encoding, is it trivial to devise a theoretically secure homomorphic encryption scheme for integers (or else any finite/infinite group with order) that ...
2
votes
0answers
34 views

Generate unique pair $g^k, E(k^{-1})$ for each group

Let say I have n computers, with some t-threshold encryption scheme. I want to have n public shares (known to every participant) such that any t of them generates a pair: $g^k, E(k^{-1})$ that is ...
8
votes
1answer
229 views

Obfuscating functions that are mostly zero

Let $f_k(x)$ be a boolean function of two arguments with two properties: The function $f$ can be efficiently computed. The output is always 0 or 1, and for any fixed $k$, if we choose $x$ randomly, $\...
2
votes
1answer
70 views

BGN encryption scheme with unbounded message space

In Evaluating 2-DNF Formulas on Ciphertexts stated that decryption in this system takes polynomial time in the size of the message space T. Therefore, the system as described above can only be ...
1
vote
1answer
73 views

What is the security model of the FHE system introduced in Fully Homomorphic Encryption Using Ideal Lattices?

How would one construct a security model to play against the adversary, and define the security of the overall scheme? This is in reference to the scheme introduced in "Fully Homomorphic Encryption ...
2
votes
1answer
67 views

Standard deviation of gaussian noise in FHEW scheme

I've got two questions regarding the paper FHEW: Bootstrapping Homomorphic Encryption in less than a second. First, the final error of a ciphertext after the refresh procedure is stated as following ...
6
votes
1answer
142 views

What is the shortest ciphertext size output by FHE?

Assume we use batching and modulus switching techniques to reduce the size of ciphertext in fully homomorphic encryption (FHE). Question: What is the shortest ciphertext bit-size output by the most ...
2
votes
1answer
472 views

Zero Knowledge range proof

I like the idea of a Zero Knowledge range proof. But I read that, to prove my age in a range, a commitment is required by a trusted party (TP) stating my age. How does that work? is the commitment a ...
0
votes
0answers
93 views

homomorphic division with scaling/Paillier

Let's say that I have to use fractions instead of integers and I am using Paillier cryptosystem. So, I use scaling to obtain integers. Assume that I have a secure division protocol. What happens if ...
1
vote
0answers
81 views

SEAL - binary encoded ciphertext

In SEAL, am I able to convert a ciphertext that is encoded with polynomial to a ciphertext that is encoded as binary?
0
votes
1answer
111 views

Refreshing Procedure in FHEW: membership test

I am facing an issue regarding the paper FHEW: Bootstrapping Homomorphic Encryption in less than a second. It concerns the MSBextract algorithm during the refresh procedure. Especially, they ...
1
vote
1answer
97 views

Comparable or partially homomorphic public key derivation for signatures?

Are there any public key signature schemes that can be compared blindly or partially homomorphically based on the private key without knowing the private key? Example: let's say I derive a public key ...
2
votes
0answers
113 views

What is modulo switching, in a nutshell?

Coupled with the terms bootstrapping and relinearization, the term modulo switching appears a lot in the FHE literature. What is it and how does it relate to the other two?
10
votes
3answers
1k views

Homomorphic encryption - Why does addition not imply multiplication?

As far as I know: There are some partially homomorphic encryption (PHE) systems that support either addition or multiplication. A fully homomorphic encryption (FHE) system can do addition as well as ...
0
votes
1answer
422 views

Are there any practical use cases for performing homomorphic operations on encrypted Strings?

Does anybody know which practical use cases there are to operate on encrypted strings? Even niche problems that can be solved using homomorphic encryption on strings are interesting to me, but not ...
2
votes
1answer
156 views

Can I perform a division of two integers homomorphically using ElGamal?

How can I perform a division of two integers homomorphically? (Simplifying assumptions can be made if needed, that is, I am fine with dividing numbers that are whole and the result will be whole as ...