The Stack Overflow podcast is back! Listen to an interview with our new CEO.

# Tag Info

0

Since the plaintext domain of of the HE scheme FV (https://eprint.iacr.org/2012/144) is $\mathbb{Z}_t$, it will by default return $m \ \text{mod} \ t$. However if your aim is to compute the reduction modulo $Q$ for an arbitrary $Q$, then you need to express your modular reduction as a circuit of additions and multiplications (or other operations supported ...

0

As far as I know, there are many libraries that use lattices and LWE schemes to implement fully homomorphic Encryptions. This is a set, Most of them is in C++ and Only one by MSFT is C#, But in all cases you can port the code to python aftor compiling: HElib in C++ SEAL By MicroSoft C++/C# Palisade C++ FHEW C/C++ TFHE C++ NFLib C++ Note: The set in no ...

0

The answer is simple if you know the answer to this question: Can you use 20 instead of 4 for a plaintext? If you can they will be the same encryption and no problem since 20 and 4 same for yo. If you cannot, therefore, you cannot decide the plaintext after you decrypted. To solve this issue you have to limit your message space into $\pmod{17}$ ...

2

Unless you add further restrictions, it is possible to achieve what you are asking for, using a totally trivial construction. For example, the encrypt algorithm can output ciphertexts of the form "normal ciphertext: $c$". The concat algorithm can output ciphertexts of the form "concatenation of $c_1$ and $c_2$". To be clear, I am proposing that ciphertexts ...

0

This would appear to be impossible. You require that $|x_1 - x_2| < \epsilon$ implies that $|f(f(x_a, k_a), k_b) - f(f(x_b, k_b), k_a)|<\delta$ ; this implies that $f(f(x_a, k_a), k_b)$ is continuous over $x_a$. Now Charlie knows $k_a, k_b$ and can compute the target value $f(f(x_a, k_a), k_b)$; a simple bisection search over the function $f(f(x, k_a)... 2 You should visit the Homomorphic Encryption Standardization web page. There you can find Homomorphic Encryption Standardization. Also, there is a workshop The Second Homomorphic Encryption Standardization Workshop there you can find this document Homomorphic Encryption Standard see section 2.0.3 I hope, all this will help in your research. 1 Since BFV scheme is IND-CPA secure, its valid fresh ciphertexts should be indistinguishable from malformed ones (i.e., drawn from uniform distribution). IND-CPA says that someone who doesn't know the secret key cannot distinguish those two distributions. However, the experiment result shows that a uniformly-distributed ciphertext does not form a valid ... 1 In short It can be secure, but it will be very inefficient. In detail Those bit strings 0001, 0010, 0100, 1000, etc are just powers of two if you look them as integers (i.e.,$2^0, 2^1, 2^2, 2^3$, etc) and applying logical bitwise or to some of them is equivalent to adding up some of the powers of two. Therefore, what you have proposed is a scenario ... 0 You can find the folowing information in the book Katz, Lindell "Introduction to modern cryptography". PROPOSITION 13.6 Let$N=p q$, where$p, q$are distinct odd primes of equal length. Then:$\operatorname{gcd}(N, \phi(N))=1.$For any integer$a \geq 0,$we have$(1+N)^{a}=(1+a N) \bmod N^{2}.$As a consequence, the order of$(1+N)$... 0 It depends on what you mean by "symmetric". As mentioned in the comments, you could use an asymmetric scheme and let$\mathsf{k} = (\mathsf{sk},\mathsf{pk})\$. This seems unsatisfying though. If you want symmetric to exclude this definition, a natural way to restate your question is "Are there any partially homomorphic encryption schemes in Minicrypt", in ...

7

TLDR: The scheme is symmetric only, its "provable security" argument is flawed, and it is practically insecure when even a modest amount of plaintext is available to attackers. I'm commenting on the scheme in: Josep Domingo-Ferrer, A Provably Secure Additive and Multiplicative Privacy Homomorphism, published in proceedings of ISC 2002. I ignore the 1996 ...

Top 50 recent answers are included