Questions tagged [homomorphic-encryption]

Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).

Filter by
Sorted by
Tagged with
1
vote
0answers
282 views

Floating Point Homomorphic Encryption Schemes

Are there any homomorphic schemes that can homomorphically compute addition and/or multiplication of encrypted floating Point data?
3
votes
1answer
171 views

Isn't fully homomorphic encryption trivial with a complex enough decryption function?

Consider the following exchange: Alice has some plaintext $x$. She sends the encrypted version $\mathcal E(x)$ to Bob. Bob returns $(\mathcal E(x), T)$, where $T$ is a turing machine encoding the ...
2
votes
1answer
110 views

How can we add real values using GF field?

In GF($2^4$) usinfg primitive polynomial g(x) = $x^4 + x^3 +1$, 2+3 = 1 since 010 + 011 = 001, 2 + 2 = 0 Is there any encoding to get 2 + 3 = 5 and 2 + 2 = 4 in GF.
2
votes
1answer
137 views

NTRU homomorphic rerandomization

I am currently implementing NTRU, keeping its homomorphic properties. I want to implement rerandomization like this: Encryption: $e = pr * h + m \pmod q$ Rerandomization: $e = e + pr \pmod q$ (...
6
votes
1answer
347 views

Homomorphic Evaluation of Pseudo Random Function

I'm looking for a special Pseudo Random Function (PRF) $F_k()$ which follows the below. For fully homomorphic encryption (FHE), $\mathit{FHE}(F_k(x)) = F_k(\mathit{FHE}(x))$. Or is there any ...
1
vote
1answer
66 views

Semantic security IND-CPA of Affine Hill Cipher

The ciphertext,c corresponding to plaintext,m is given by c= mK + w, K is the invertible matrix and w is the uniformly distributed random vector. If w is changed during every encryption, will this ...
3
votes
1answer
89 views

Sign a plaintext accepted by a secure function without revealing private key

Imagine the following scenario: Alice is a well-respected chef. She is famous for reviewing recipes. Anyone can send her a recipe. If she likes it she'll add her famous line of approval to the end: "...
5
votes
1answer
266 views

Zero knowledge proof for Paillier addition under multiple keys

Suppose $m_0, m_1, m_2 \in \mathbb{N}$ such that $m_0 = m_1 + m_2$, $m_i > 0$ (none of them can be 0 or lower) Under a Paillier cryptosystem, set $e_0 = E(m_0, r_0)$ for a public key $(g_0, n_0)$ ...
3
votes
1answer
120 views

Decrypt (homomorphically and symmetrically) encrypted data using (homomorphically) encrypted key?

Is it possible to do the following? Generate symmetric key $K$ Encrypt data $D$ with the symmetric key : $E_k{(D)}$ Encrypt the symmetric key and the encrypted data using homomorphic encryption ...
0
votes
1answer
287 views

Is there an application of fully homomorphic encryption scheme such that encryption key and evaluation key are different?

I want know if there is an application of FHE contains three kinds of users such that: $A$ is the data owner and she has the secret key. $B$ only has the permissions to encrypt (just like a general ...
6
votes
2answers
951 views

Paillier Homomorphic encryption to calculate the means

Paillier Homomorphic encryption supports addition and multiplication with plaintext value. Can I use these properties to calculate the means of cipher-text values? I try to use the following steps: ...
1
vote
1answer
251 views

Partially Homomorphic Cryptographic Schemes - Deterministic vs Probabilistic

While reading this paper I realized that textbook RSA was the only deterministic PHE scheme mentioned. I did cross-check the ones listed in the Wikipedia article also and, quite on the opposite ...
0
votes
1answer
129 views

In Paillier homomorphic encryption, do we need to take modulo after multiplication of 2 ciphertexts?

The multiplication of 2 ciphertexts generated using Paillier encryption will result in encryption of sum of corresponding plaintexts. I need to do a linear combination operation of N integers in ...
2
votes
0answers
114 views

NTRU-based threshold encryption system?

I want to implement threshold homomorphic encryption for my project. (encrypt a message using one public key, and decrypt a ciphertext using distributed secret keys) I read a paper "Multiparty ...
3
votes
1answer
464 views

How does fully homomorphic encryption compare to partially homomorphic encryption in terms of security?

I found some questions and answers about the performance of Fully and Partially homomorphic encryption. I am interested in a comparison in terms of security guarantees (of any kind, formal or informal)...
0
votes
1answer
84 views

Taking $p$ and $q$ to be the same value in paillier cryptosystem

I was implementing Paillier cryptosystem when I came across the fact that as soon as I take the primes $p$ = $q$, I start getting incorrect decryption results. As far as I can understand, when I take $...
1
vote
1answer
193 views

Can McEliece cryptosystem be used as an additively homomorphic encryption scheme?

Since McElice cryptosystem is linear, if matrix G is kept constant for different plaintexts, it can be used for linearly combining the corresponding ciphertexts. In that case, what are the advantages ...
2
votes
2answers
265 views

Tracking the noise growth of Homomorphic encryption

So I'm a bit of a cryptography/HE noob, and I was wondering if it is possible to keep track of the noise growth that happens when you do some kind of mathematical operation on your encrypted data, and ...
2
votes
1answer
109 views

Are there encryption systems that are both homomorphic and commutative?

If so, which ones are? If not, is it known whether or not these are mutually exclusive? Is there a page that exhaustively lists encryption systems and properties such as these? I could not find a ...
2
votes
0answers
90 views

Distinguishing advantage in terms of $\Omega(\omega)$

I was going through this paper ("Fully Homomophic Encryption over the Integers Revisited") and the statement written in the first paragraph on page 5 stating $\DeclareMathOperator{\agcd}{AGCD}$ We ...
1
vote
1answer
84 views

Does FHE's longer key bring more security than traditional encryption algorithm?

I check some key size which FHE libraries generated, for example, HElib's key size will be more than 300M, while tfhe's is also ...
3
votes
0answers
237 views

ring-LWE: Minkowski Embedding , the Co-Different Ideal, etc

While (trying) to go over the reductions from approx. SVP on ideal lattices to search ring-LWE, [1] and [2], for $K = \mathbb{Q}(\zeta)$ where $\zeta$ is an abstract root of a cyclotomic polynomial, ...
0
votes
1answer
116 views

Non partial homomorphic encryption

It seems that AES is non homomorphic. I am seeking a public key non homomorphic encryption that has been proved to be such or at least is accepted as non homomorphic. The internet search leads to ...
-1
votes
1answer
241 views

Encrypting AES cipher text with fully homomorphic encryption

Suppose I run a fully homomorphic encryption scheme (FHE) on a cipher text c, generated by running AES on plain text m and get c' as the output. What would the output be if decryption of AES is run ...
0
votes
0answers
89 views

How is the security of a plaintext of Ring-LWE without an error term?

I think until public key $\mathsf{pk}=(b=-[as + e]_q,a) $ is broken, Ring-LWE is secure where $a$ is uniformaly random polynomial, $e$ is an error sampled from gaussian distribution with std=$\sigma$ ...
1
vote
1answer
353 views

Are zkSNARKS practical?

I'm considering using zkSNARKS for a project i'm building. I have some questions about the practicality of such algorithms: Does a standard secure implementation exists? What is the complexity for ...
1
vote
0answers
111 views

Verification of homomorphically encrypted computations [closed]

Is there a way to prove the accuracy of computations performed on homomorphically encrypted cypher text?
0
votes
1answer
54 views

Adding identical homomorphically encrypted inputs

What would happen if you added two inputs, one known and one unknown, both encrypted with a fully homomorphic encryption scheme, and then checked the result by dividing it by two? Wouldn’t this tell ...
3
votes
1answer
233 views

Yao's Millionaires' Problem without knowledge of plaintext

I have two integers $x,y$ which are encrypted using a homomorphic cryptosystem, probably Paillier. I am looking for a (one-party) protocol that, given $enc(x)$ and $enc(y)$, returns a bit $b = 1 \iff ...
2
votes
1answer
98 views

Size of bitwise OR between vectors represented as polynomials

I am using polynomials to represent bit vectors, such that the value of the d-th coefficient is $1$ if the d-th bit in the vector is $1$, and $0$ otherwise. For example, the vector $A = [1, 1, 0, 1, 0]...
1
vote
1answer
438 views

What is the intuition of canonical-embedding in homomorphic encryption based on RingLWE?

In the cryptosystem based on Ring-LWE, the noise amount is measured by canonical-embedding norm. What is the intuition behind canonical-embedding?
9
votes
2answers
439 views

What math makes it safe to offer a stolen-password check service?

The database provider HIBP has 4 billion stolen passwords, and wishes to offer an API for websites to use during new-user signup (and password change) operations, so they can refuse to allow users to ...
1
vote
1answer
453 views

Is encrypting a secret key and being able to decrypt plain text with it possible?

Please forgive me if this is a basic question, I'm in high school so I still don't understand very much. Let's say there are two servers, each with a set of public and private keys. These denote ...
1
vote
2answers
716 views

What mathematics do I need to study in order to understand fully homomorphic encryption? [closed]

I am currently working on a project that requires me to use the HElib library that implements the BGV homomorphic encryption scheme described in this paper. I need to be able to tune the parameters ...
3
votes
1answer
208 views

Fully Homomorphic Encryption: Going from an integer to bits

I was answering this question Computing Logarithm using homomorphic encryption and I came up with a solution if you had encryptions of the bits of the number that you wanted to take the log of. But ...
2
votes
0answers
285 views

Homomorphic set hash with membership proof

I'm trying to solve a problem that goes as follow. There is a set of item and that set is very large. Several actors needs to exchange information about this set, such as adding and removing element ...
3
votes
1answer
107 views

Is there a KDF that can be computed in an untrusted environment?

I'm looking for a Key Derivation Function, kind of like PBKDF2 or Scrypt, but which can be computed by a machine you don't trust. Some way to give it a derivative of the source password, such that ...
1
vote
0answers
37 views

Effect of small secret attacks on non homomorphic encryption schemes

The new paper by Albrecht describes a new attack on "unusually" small secrets that are used in homomorphic encryption schemes. In the paper the talk about binary secrets or LWE Normal form i.e $\...
10
votes
1answer
312 views

Computing Logarithm using homomorphic encryption

Let's say we have $Enc_{pub}(a)$, the encryption of an integer $a \in \mathbb{Z}^*$ under the public key pub with a Homomorphic encryption scheme that supports both ...
1
vote
0answers
115 views

What's the advantage of branching program? Why we use branching program to compute the encrypted data?

Branching program is one type of NC1 circuit and can be used to compute encrypted data. So whether there exist other methods in the NC1 circuit to compute encrypted data. What's the advantage of ...
1
vote
0answers
83 views

Why use Phi(m) divide Order(p, m) to get slot number in HElib?

I am reading HElib source code, and have a confusion about FindM function: ...
1
vote
0answers
83 views

Is there a public key encryption for permutations which is homomorphic under permutation composition?

I'm brainstorming an idea for extending our Latin square autotopism secret sharing scheme (proposed here [open access]) to a repairable scheme. I seek a cryptographic method, which may or may not ...
2
votes
0answers
276 views

Is modulus switching feasible for plaintext space larger than $\{ 0, 1 \}$?

I read the proof of modulus switching and realised that it can be extended to integers, but do we actually use it for integer encryption in practice? Consider that we are doing additive and ...
5
votes
3answers
769 views

A practical algorithm for proof of age

I'm new to the list, a layman in cryptography, but a competent programmer. Seeking your help for a practical algorithm that I can implement please. Problem Let a prover ...
0
votes
0answers
90 views

How to authenticate indivisual value after applying homomorphic encryption using Paillier homomorphic

Assuming I have three parties in a system: Alice, Bob, and a Server. Alice and Bob needs to aggregate some messages $m1$ for Alice, and $m2$ for Bob. And send the aggregate $m1+m2$ to the Server. I ...
3
votes
2answers
685 views

Does Paillier Homomorphic Encryption Work only with numbers?

Paillier homomorphic encryption enables us to combine two messages such as $D\left(E(m_1,r_1) \cdot E(m_2,r_2) \mod n^2\right) = m_1+m_2 \mod n$ My question is what are the specification of $m_1$ ...
1
vote
0answers
140 views

How to provide security against malicious adversary in Ring LWE homomorphic encryption scheme?

I was reading Ring LWE homomorphic encryption scheme referred in http://www.wisdom.weizmann.ac.il/~zvikab/localpapers/IdealHom.pdf But this encryption scheme provides security mostly in the semi-...
3
votes
1answer
152 views

Demystifying homomorphic multiplication in RNS FV variant

I am trying to understand a full RNS FV SWHE variant proposed in this paper. My problem is with the homomorphic multiplication. Original ciphertexts are represented in RNS representation using base (...
1
vote
1answer
215 views

Paillier equality test under the same key

I have a similar question to this one: Is an equality test possible when using paillier crypto? However I want to do the following: Given the Paillier Cryptosystem. Given the function $f(input)$, ...
4
votes
1answer
196 views

Only allow specific types of data to be transmitted via an end-to-end encryption service

I have a service that allows multiple parties to share domain-specific textual data. This data is also end-to-end encrypted. How can I be sure the sharing parties don't send non-domain-specific data, ...