Homomorphic encryption

Homomorphic encryption is a form of encryption where a specific algebraic operation performed on the plaintext is equivalent to another (possibly different) algebraic operation performed on the ciphertext. Depending on one's viewpoint, this can be seen as either a positive or negative attribute of the cryptosystem. Homomorphic encryption schemes are malleable by design. The homomorphic property of various cryptosystems can be used to create secure voting systems, collision-resistant hash functions, private information retrieval schemes and enable widespread use of cloud computing by ensuring the confidentiality of processed data.

There are several efficient, partially homomorphic cryptosystems, and two fully homomorphic, but less efficient cryptosystems.

Partially homomorphic cryptosystems

In the following examples, the notation ${\mathcal {E}}(x)$ is used to denote the encryption of the message x.

Unpadded RSA

If the RSA public key is modulus $m$ and exponent $e$, then the encryption of a message $x$ is given by ${\mathcal {E}}(x)=x^{e}\mod m$. The homomorphic property is then

${\mathcal {E}}(x_{1})\cdot {\mathcal {E}}(x_{2})=x_{1}^{e}x_{2}^{e}\mod m=(x_{1}x_{2})^{e}\mod m={\mathcal {E}}(x_{1}\cdot x_{2})$

ElGamal

In the ElGamal cryptosystem, in a group $G$, if the public key is $(G,q,g,h)$, where $h=g^{x}$, and $x$ is the secret key, then the encryption of a message $m$ is ${\mathcal {E}}(m)=(g^{r},m\cdot h^{r})$, for some $r\in \{0,\ldots ,q-1\}$. The homomorphic property is then

${\mathcal {E}}(x_{1})\cdot {\mathcal {E}}(x_{2})=(g^{r_{1}},x_{1}\cdot h^{r_{1}})(g^{r_{2}},x_{2}\cdot h^{r_{2}})=(g^{r_{1}+r_{2}},(x_{1}\cdot x_{2})h^{r_{1}+r_{2}})={\mathcal {E}}(x_{1}\cdot x_{2})$

Goldwasser-Micali

In the Goldwasser-Micali cryptosystem, if the public key is the modulus m and quadratic non-residue x, then the encryption of a bit b is ${\mathcal {E}}(b)=r^{2}x^{b}\mod m$. The homomorphic property is then

${\mathcal {E}}(b_{1})\cdot {\mathcal {E}}(b_{2})=r_{1}^{2}x^{b_{1}}r_{2}^{2}x^{b_{2}}=(r_{1}r_{2})^{2}x^{b_{1}+b_{2}}={\mathcal {E}}(b_{1}\oplus b_{2})$

where $\oplus$ denotes addition modulo 2, (i.e. exclusive-or).

Benaloh

In the Benaloh cryptosystem, if the public key is the modulus m and the base g with a blocksize of r, then the encryption of a message x is $g^{x}u^{r}\mod m$. The homomorphic property is then

${\mathcal {E}}(x_{1})\cdot {\mathcal {E}}(x_{2})=(g^{x_{1}}u_{1}^{r})(g^{x_{2}}u_{2}^{r})=g^{x_{1}+x_{2}}(u_{1}u_{2})^{r}={\mathcal {E}}(x_{1}+x_{2}\mod r)$

Paillier

In the Paillier cryptosystem, if the public key is the modulus m and the base g, then the encryption of a message x is ${\mathcal {E}}(x)=g^{x}r^{m}\mod m^{2}$. The homomorphic property is then

${\mathcal {E}}(x_{1})\cdot {\mathcal {E}}(x_{2})=(g^{x_{1}}r_{1}^{m})(g^{x_{2}}r_{2}^{m})=g^{x_{1}+x_{2}}(r_{1}r_{2})^{m}={\mathcal {E}}(x_{1}+x_{2}\mod m)$

Other partially homomorphic cryptosystems

• Okamoto–Uchiyama cryptosystem
• Naccache–Stern cryptosystem
• Damgård–Jurik cryptosystem
• Boneh–Goh–Nissim cryptosystem

Fully homomorphic encryption

Each of the examples listed above allows homomorphic computation of only one operation (either addition or multiplication) on plaintexts. A cryptosystem which supports both addition and multiplication (thereby preserving the ring structure of the plaintexts) is known as fully homomorphic encryption (FHE) and is far more powerful. Using such a scheme, any circuit can be homomorphically evaluated, effectively allowing the construction of programs which may be run on encryptions of their inputs to produce an encryption of their output. Since such a program never decrypts its input, it can be run by an untrusted party without revealing its inputs and internal state. The existence of an efficient and fully homomorphic cryptosystem would have great practical implications in the outsourcing of private computations, for instance, in the context of cloud computing.

The "homomorphic" part of a fully homomorphic encryption scheme can also be described in terms of category theory. If C is the category whose objects are integers (i.e., finite streams of data) and whose morphisms are computable functions, then (ideally) a fully homomorphic encryption scheme elevates an encryption function to a functor from C to itself.

The utility of fully homomorphic encryption has been long recognized. The problem of constructing such a scheme was first proposed within a year of the development of RSA. A solution proved more elusive; for more than 30 years, it was unclear whether fully homomorphic encryption was even possible. During this period, the best result was the Boneh-Goh-Nissim cryptosystem which supports evaluation of an unlimited number of addition operations but at most one multiplication.

Craig Gentry using lattice-based cryptography showed the first fully homomorphic encryption scheme as announced by IBM on June 25, 2009. His scheme supports evaluations of arbitrary depth circuits. His construction starts from a somewhat homomorphic encryption scheme using ideal lattices that is limited to evaluating low-degree polynomials over encrypted data. (It is limited because each ciphertext is noisy in some sense, and this noise grows as one adds and multiplies ciphertexts, until ultimately the noise makes the resulting ciphertext indecipherable.) He then shows how to modify this scheme to make it bootstrappable—in particular, he shows that by modifying the somewhat homomorphic scheme slightly, it can actually evaluate its own decryption circuit, a self-referential property. Finally, he shows that any bootstrappable somewhat homomorphic encryption scheme can be converted into a fully homomorphic encryption through a recursive self-embedding. In the particular case of Gentry's ideal-lattice-based somewhat homomorphic scheme, this bootstrapping procedure effectively "refreshes" the ciphertext by reducing its associated noise so that it can be used thereafter in more additions and multiplications without resulting in an indecipherable ciphertext. Gentry based the security of his scheme on the assumed hardness of two problems: certain worst-case problems over ideal lattices, and the sparse (or low-weight) subset sum problem.

Regarding performance, ciphertexts in Gentry's scheme remain compact insofar as their lengths do not depend at all on the complexity of the function that is evaluated over the encrypted data. The computational time only depends linearly on the number of operations performed. However, the scheme is impractical for many applications, because ciphertext size and computation time increase sharply as one increases the security level. To obtain 2^k security against known attacks, the computation time and ciphertext size are high-degree polynomials in k. Recently, Stehle and Steinfeld reduced the dependence on k substantially. They presented optimizations that permit the computation to be only quasi-k^3.5 per boolean gate of the function being evaluated.

Gentry's Ph.D. thesis provides additional details. Gentry also published a high-level overview of the van Dijk et al. construction (described below) in the March 2010 issue of Communications of the ACM.

In 2009, Marten van Dijk, Craig Gentry, Shai Halevi and Vinod Vaikuntanathan presented a second fully homomorphic encryption scheme, which uses many of the tools of Gentry's construction, but which does not require ideal lattices. Instead, they show that the somewhat homomorphic component of Gentry's ideal lattice-based scheme can be replaced with a very simple somewhat homomorphic scheme that uses integers. The scheme is therefore conceptually simpler than Gentry's ideal lattice scheme, but has similar properties with regards to homomorphic operations and efficiency. The somewhat homomorphic component in the work of van Dijk et al. is similar to an encryption scheme proposed by Levieil and Naccache in 2008, and also to one that was proposed by Bram Cohen in 1998. Cohen's method is not even additively homomorphic, however. The Levieil-Naccache scheme is additively homomorphic, and can be modified to support also a small number of multiplications.

In 2010, Nigel P. Smart and Frederik Vercauteren presented a refinement of Gentry's scheme giving smaller key and ciphertext sizes, but which is still not fully practical. At the rump session of Eurocrypt 2010, Craig Gentry and Shai Halevi presented a working implementation of fully homomorphic encryption (i.e. the entire bootstrapping procedure) together with performance numbers.

In 2010 Riggio and Sicari presented a practical application of homomorphic encryption to an hybrid wireless sensor/mesh network. The system enables transparent multi-hop wireless backhauls that are able to performs statistical analysis of different kinds of data (temperature, humidity, etc.) coming from a WSN while ensuring both end–to–end encryption and hop–by–hop authentication.

See Also

• Homomorphic Signatures for Network Coding

External links

• Homomorphic encryption in Cryptology Pointers
• The Homomorphic Encryption Project