Questions tagged [homomorphic-encryption]

Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).

Filter by
Sorted by
Tagged with
2
votes
0answers
128 views

A question about fully homomorphic SIMD operations

I'm going through Gentry, Halevi and Smart's paper "Fully Homomorphic Encryption with Polylog Overhead" and have a question about the permutation operations. Background: The cyclotomic polynomial ...
2
votes
1answer
236 views

Anonymity of Paillier cryptosystem in e-voting system

I'm not an expert so at the moment I'm trying to figure out (at high level) how such cryptosystem would exploit it's homomorphic properties to guarantee anonymity in a e-voting system. As far as i ...
1
vote
1answer
196 views

Homomorphism with subtraction for Pedersen Commitment

I was trying to use Pedersen's homomorphic property for some privacy preserving mechanism, and to the best of my knowledge $Com(x1,r1)\cdot Com(x2,r2)^{-1} = g^{x1-x2}h^{r1-r2}$ That is, if we ...
3
votes
1answer
111 views

Crypto implementations bits and bytes

Reading many papers in the homomorphic encryption domain and in cryptography, a lot of schemes operate on bits as 1 and 0. If I wanted to implement a scheme, for example, Gentry's FHE, would I have ...
1
vote
1answer
173 views

What is an example of elgamal homomorphic double encryption?

I am looking for such an cipher algorithm that is based on assymetric cryptography where the order of encrypting is irrelevant. For example: There is a message "x", Bob encrypt that message with his ...
2
votes
0answers
142 views

Is there any way to prove two numbers that are equal after Paillier encryptions?

I have two numbers $x_1$ and $x_2$, and there are two Paillier homomorphic encryption (public, private) key pairs $(p_1,r_1)$ and $(p_2, r_2)$. I only know $p_1, r_1$ and $p_2$. Suppose $C_1=E_{p_1}(...
3
votes
1answer
108 views

Can any one explain why circuit privacy is needed on homomorphic encryption?

I know some works have been done in the context of cirrcuit privacy on homomorphic encryption, where from an output ciphertext it does not allow someone to distinguish what function is computed. I ...
1
vote
1answer
184 views

Is there any additively homomorphic schemes that can make range proof?

I want to know whether there is any additively homomorphic schemes that can make a non-interactive range proof. For example, I have a pair of public and private key pairs $(K_p,K_v)$ that satisfying ...
3
votes
1answer
113 views

What is the purpose of decomposing ciphertext into digits during relinearization in Brakerski Vaikuntanathan homomorphic encryption?

In Brakerski and Vaikuntanathan's homomorphic encryption scheme, the relinearization function turns a 3-element cipher back to a 2-element cipher by using a set of public homomorphism keys (https://...
2
votes
1answer
193 views

Commutative homomorphic encryption for zero-knowledge transfers

I am trying to design a scheme that would allow the following: Alice has a number $a$ which she wants to keep secret Bob has a number $b$ which he wants to keep secret Alice can "transfer" a number ...
2
votes
1answer
147 views

How can I construct a proof that the decryption of a certain encrypted file matches a hash?

Let's say Alice has file $F$ and she generates key $K$. She widely publishes the $hash(F)$ for identification. She wants to sell the file to Bob. She encrypts the file with $K$ and sends both $E_f = E(...
6
votes
1answer
553 views

What are the leading FHE schemes?

I'm trying to understand the current context for fully homomorphic encryption. What are the most influential papers that are the basis for the most close-to-practical techniques today? Of course ...
1
vote
2answers
164 views

How to define a FHE scheme whose plaintext space is infinite using boolean circuits?

There are many kinds of fully homomorphic encryption scheme by using boolean circuits. And the plaintext space $\mathcal{P} = \{ 0,1 \}$. If there is a -bit FHE scheme, we can construct a FHE scheme ...
0
votes
1answer
62 views

Is it possible to manage an encrypted dataset for face recognition?

Im in my final year of PhD in computer vision and my supervisor has given me a task that I am not very familiar with. So I am teaching myself homomorphic encryption everyday. This question is mostly ...
0
votes
1answer
282 views

Calculating distance between two vectors using Paillier homomorphic encryption [closed]

I am basically trying to perform euclidean distance calculation in the encrypted domain (Paillier encryption). Using the homomorphic properties of Paillier, the squared euclidean distance formula can ...
5
votes
1answer
289 views

How to encode messages in $\Bbb Z_p^*$ to be encrypted with ElGamal scheme?

In ElGamal encryption scheme, in order to achieve IND-CPA security, one must use a group where the DDH problem is assumed to be hard. As this answer suggests, one way to achieve that is the following: ...
0
votes
1answer
72 views

Perform calculation on encrypted numbers

What i am trying to achieve ? I am developing a carpooling solution powered by Blockchain and IOT. This one is supposed to be technically convenient and without compromising on the privacy part. ...
1
vote
1answer
156 views

Paillier subtraction for negative result

I am trying to figure out subtraction on Paillier. From what I read so far, given $m_1$ smaller than $m_2$ ($m_1<m_2$) I can compute $E(m_2-m_1)$ as $E(m_2)\cdot E(m_1)^{-1}$ where $E(m_1)^{-1}$ ...
1
vote
0answers
58 views

Security of certain homomorphic encryption scheme

Is the following homomorphic encryption scheme: Ahmed El-Yahyaoui and Mohamed Dafir Ech-Chrif El Kettani, A Verifiable Fully Homomorphic Encryption Scheme for Cloud Computing Security (April 2018, at ...
2
votes
1answer
137 views

Is Paillier secure from known plaintext attack for single character message?

Assuming I have three messages m1,m2,m3 where m1=m2=m3=1 and I compute c1,c2 and c3. Does that mean that c1=c2=c3 in cipher-text from ? If not, how many times can I encrypt a message m=1 and still ...
0
votes
1answer
158 views

Non interactive ZKP that encrypted additive elgamal message is in set of valid messages

This is taken from Anonymous voting by two-round public discussion by F. Hao P.Y.A. Ryan P. Zielinski Votes are encrypted using the additive variant of ElGamal. I am also using ECElgamal. The idea is ...
0
votes
1answer
179 views

Paillier Homomoprhic addition overflows after a certain value

I'm new to encryption and am trying to implement Paillier encryption from the wikipedia page here: https://en.wikipedia.org/wiki/Paillier_cryptosystem I managed to implement the encryption and am ...
1
vote
1answer
172 views

Explanation of Proof-of-Encryption

Regarding the question Provable Encryption, I'm trying to understand how a 'proof of encryption' might actually work. What I can deduce from the answers is this: we need a cryptographic scheme that ...
2
votes
1answer
92 views

I'm getting a non-integer (float) private key in Paillier encryption

I'm trying to implement the Paillier cryptosystem in Matlab using the key generation guidance available here: https://en.wikipedia.org/wiki/Paillier_cryptosystem#Key_generation, but the problem is ...
2
votes
1answer
36 views

Dividing elements in $R_q$ by $z$ in Grag-Gentry-Halevi (GGH) Graded Encoding Scheme

I'm trying to understand the GGH graded encoding scheme, but something there leaves me very confused and I can not figure out how to explain it: Let $R := \mathbb{Z}[X]/(X^n+1)$, where $n$ is a power ...
0
votes
1answer
141 views

Why is Ring-LWE based homomorphic encryption secure with one sample?

Suppose $R=\mathbb{Z}[X]/f(X)$ is a polynomial ring. Decisional Ring-LWE is hard if one cannot distinguish the following samples: $(a_i, b_i) \in R^2$ for $i\in [0,k-1]$ (completely random) $(a_i, ...
3
votes
1answer
165 views

Homomorphic cryptosystem with respect to concatenation

Are there cryptosystems that are homomorphic with respect to the concatenation operation? those. there are data q1 and q2, where q3 = q1q2. then the encrypted data f(q1) = c1 and f(q2) = c2 and f(q3) ...
5
votes
1answer
119 views

Why FHE takes modulo space $\Bbb Z_p$ as $[−p/2,p/2)$ rather than $[0,p)$?

Why doesn't FHE scheme see a modulus space $\Bbb Z_p$ as $[0,p)$ ? Instead, it consider $\Bbb Z_p$ as $\left[-\frac{p}{2},\frac{p}{2}\right)$. What's the concrete reason? What happens if I use $[0,p)$...
1
vote
0answers
327 views

Additive homomorphic secret sharing

I am new to cryptography esp, homomorphic encryption. I would like to know if the following is possible using something similiar to additive homomorphic secret sharing. Please apologize me if its too ...
2
votes
0answers
56 views

Dimension involved by tensor product on Ring-LWE based homomorphic encryption

As far as I know, given two $n$-dimensional vectors $\mathbf{a},\mathbf{b} $, tensor product $\mathbf{a} \otimes \mathbf{b} $ produces $n\times n$ matrix. However in Ring-LWE based homomorphic ...
1
vote
2answers
87 views

Constraint about encrypted values

Let V = $[x_1,\ldots ,x_n]$ be a binary vector of length $n$, and let $E(V)$ be the entrywise encryption of this vector. Suppose I want to give to another player, $E(V)$, but also let him have the ...
1
vote
0answers
165 views

Homomorphic encryption - addition for more than two parties

I have just found out about the homomorphic encryption and I was wondering how is it possible to perform an addition for more than two parties? More concretely, I want to have several parties $P_i$, ...
2
votes
1answer
259 views

How do I compare three cryptographic schemes with respect to security?

I am working on a project which compares SEAL, HElib and libScarab in terms of their execution times and security. I have already checked for the execution times. How do I decide which one of them is ...
3
votes
1answer
2k views

Equality check in homomorphic encryption

Considering that we have a homomorphic encryption server working with integers mod p (a large prime number) with access to multiplication, addition and subtraction, is it possible to design an ...
0
votes
1answer
82 views

Why is low-degree polynomial preferred on Ring-LWE based somewhat homomorphic encryption?

I'm wondering why Ring-LWE based homomorphic encryption (somewhat homomorphic encryption, not fully) requires low-degree polynomial in order to avoid decryption error. For example, a plaintext $m$ is ...
0
votes
1answer
155 views

Proof of correctness of Exponential ElGamal

I have an assignment for proving the correctness of both ElGamal and exponential ElGamal homomorphic features (multiplicative and additive respectively). I have managed to prove the former but am ...
2
votes
2answers
1k views

Paillier VS RSA

I was wondering if there are major pros or cons of choosing the Paillier algorithm over RSA except for Pailliers being additively homomorphic and RSA multiplicative?
6
votes
1answer
1k views

What is the link, if any, between Zero Knowledge Proof (ZKP) and Homomorphic encryption?

What is the link/relation, if any, between Zero Knowledge Proof (ZKP) and Homomorphic encryption?
1
vote
1answer
149 views

Is it secure using LWE-based cryptosystem under RLWE-based parameters?

I'm computer guy having trouble with cryptography. I recently read the BGV Homomorphic encryption paper which was constructed under both LWE and RLWE assumptions. I was implementing Threshold ...
1
vote
2answers
795 views

Can Fully Homomorphic Encryption do comparisons?

I encountered a simple function that even FHE cannot solve. Here's it: int f(a,b,c,d){ if(a+b>c+d) return a+c; else return b+d; } Since FHE is not ...
2
votes
1answer
120 views

Squaring the coefficients in homomorphic encryption

In homomorphic encryption scheme FV, I can multiply an encrypted polynomial for any integer scalar, obtaining the same effect on the plain polynomial. For example, given the plain polynomial $\...
2
votes
1answer
42 views

How do I choose blind sizes?

I am currently developing a service that calculates statistics (currently only sum/average) on homomorphically encrypted user data, and then gives the results to a third party. Because encryption is ...
2
votes
0answers
37 views

Encryption design for user data with service access

I'm looking to provide users with a way to give a service sensitive information, which the service can freely use up until the user decides otherwise. I want to encrypt the data at rest (and of course,...
3
votes
2answers
115 views

Fully homomorphic encryption with polynomials

I have read some texts concerning fully homomorphic encryption but didn't find the following simple idea. Let $p$ be a prime. We choose secret key $x_0$ in the interval $1\le x_0<p$. Let $\mathrm{...
2
votes
1answer
108 views

homomorphic encryption E(x+y)=E(x) . E(y)?

I'm new to cryptography and I was trying to familiarize myself with ZKsnarks . here is an explanation on this blog : https://blog.z.cash/snark-explain/ in the middle of the page from $E(x) = g^x$ it ...
6
votes
1answer
3k views

Homomorphic Encryption for Deep Learning

I'm interested in two following processes: 1) Perform deep learning on homomorphic encrypted data 2) Perform deep learning predictions with a homomorphic encrypted model on unencrypted data. By ...
2
votes
1answer
99 views

Homomorphic encryption of logical OR/AND

Are there any ways to perform homomorphic encryption of logical OR (or logical AND) without using fully homomorphic encryption?
2
votes
1answer
422 views

Public key homomorphic encryption based on secret key homomorphic

Let $(E,D)$ be a secret-key bit-encryption scheme that is homomorphic to xor, and assume that each bit encryption is of size n (this concerns both fresh encryption and encryptions that have been ...
1
vote
1answer
177 views

Decrypting only message product - is it possible?

Ok, I'm looking for a way to be able to decrypt ONLY message product and not individual messages. The message product can contain an arbitrary number of messages as long as it's greater than some ...
4
votes
3answers
254 views

Is there a way of encryption that allows to check what encrypted values are close to their mean?

I am looking for a way to allow parties to publicize encrypted values that can only be decrypted by one or a select few other parties, but that allow everyone to check how close they are to the mean ...