Volume–price trend

Homomorphic encryption is a form of encryption which allows specific types of computations to be carried out on ciphertext and generate an encrypted result which, when decrypted, matches the result of operations performed on the plaintext.

This is a desirable feature in modern communication system architectures. Homomorphic encryption would allow the chaining together of different services without exposing the data to each of those services, for example a chain of different services from different companies could 1) calculate the tax 2) the currency exchange rate 3) shipping, on a transaction without exposing the unencrypted data to each of those services. Homomorphic encryption schemes are malleable by design. The homomorphic property of various cryptosystems can be used to create secure voting systems, collision-resistant hash functions, private information retrieval schemes and enable widespread use of cloud computing by ensuring the confidentiality of processed data.

There are several efficient, partially homomorphic cryptosystems, and a number of fully homomorphic, but less efficient cryptosystems. Although a cryptosystem which is unintentionally homomorphic can be subject to attacks on this basis, if treated carefully homomorphism can also be used to perform computations securely.

Partially homomorphic cryptosystems

In the following examples, the notation $ℰ(x)$ is used to denote the encryption of the message x.

Unpadded RSA

If the RSA public key is modulus $m$ and exponent $e$, then the encryption of a message $x$ is given by $ℰ(x)=x^{e}modm$. The homomorphic property is then

$ℰ(x_1)\cdot ℰ(x_2)=x_1^e{x}_2^{e}modm=(x_1{x}_2{)}^{e}modm=ℰ(x_1\cdot x_2)$

ElGamal

In the ElGamal cryptosystem, in a group $G$, if the public key is $(G,q,g,h)$, where $h=g^x$, and $x$ is the secret key, then the encryption of a message $m$ is $ℰ(m)=(g^r,m\cdot h^r)$, for some random $r\in \{0,\dots ,q-1\}$. The homomorphic property is then

$ℰ(x_1)\cdot ℰ(x_2)=(g^{r_1},x_1\cdot h^{r_1})(g^{r_2},x_2\cdot h^{r_2})=(g^{r_1+r_2},(x_1\cdot x_2)h^{r_1+r_2})=ℰ(x_1\cdot x_2)$

Goldwasser-Micali

In the Goldwasser-Micali cryptosystem, if the public key is the modulus m and quadratic non-residue x, then the encryption of a bit b is $ℰ(b)=x^b{r}^{2}modm$, for some random $r\in \{0,\dots ,m-1\}$. The homomorphic property is then

$ℰ(b_1)\cdot ℰ(b_2)=x^{b_1}{r}_1^2{x}^{b_2}{r}_2^2=x^{b_1+b_2}(r_1{r}_2{)}^2=ℰ(b_1\oplus b_2)$

where $\oplus$ denotes addition modulo 2, (i.e. exclusive-or).

Benaloh

In the Benaloh cryptosystem, if the public key is the modulus m and the base g with a blocksize of c, then the encryption of a message x is $ℰ(x)=g^x{r}^{c}modm$, for some random $r\in \{0,\dots ,m-1\}$. The homomorphic property is then

$ℰ(x_1)\cdot ℰ(x_2)=(g^{x_1}{r}_1^c)(g^{x_2}{r}_2^c)=g^{x_1+x_2}(r_1{r}_2{)}^c=ℰ(x_1+x_{2}modc)$

Paillier

In the Paillier cryptosystem, if the public key is the modulus m and the base g, then the encryption of a message x is $ℰ(x)=g^x{r}^{m}mod{m}^2$, for some random $r\in \{0,\dots ,m-1\}$. The homomorphic property is then

$ℰ(x_1)\cdot ℰ(x_2)=(g^{x_1}{r}_1^m)(g^{x_2}{r}_2^m)=g^{x_1+x_2}(r_1{r}_2{)}^m=ℰ(x_1+x_{2}modm)$

Other partially homomorphic cryptosystems

• Okamoto–Uchiyama cryptosystem
• Naccache–Stern cryptosystem
• Damgård–Jurik cryptosystem
• Boneh–Goh–Nissim cryptosystem

Fully homomorphic encryption

Each of the examples listed above allows homomorphic computation of only one operation (either addition or multiplication) on plaintexts. A cryptosystem which supports both addition and multiplication (thereby preserving the ring structure of the plaintexts) is known as fully homomorphic encryption (FHE) and is far more powerful. Using such a scheme, any circuit can be homomorphically evaluated, effectively allowing the construction of programs which may be run on encryptions of their inputs to produce an encryption of their output. Since such a program never decrypts its input, it can be run by an untrusted party without revealing its inputs and internal state. The existence of an efficient and fully homomorphic cryptosystem would have great practical implications in the outsourcing of private computations, for instance, in the context of cloud computing.

The "homomorphic" part of a fully homomorphic encryption scheme can also be described in terms of category theory. If C is the category whose objects are integers (i.e., finite streams of data) and whose morphisms are computable functions, then (ideally) a fully homomorphic encryption scheme elevates an encryption function to a functor from C to itself.Potter or Ceramic Artist Truman Bedell from Rexton, has interests which include ceramics, best property developers in singapore developers in singapore and scrabble. Was especially enthused after visiting Alejandro de Humboldt National Park.

The utility of fully homomorphic encryption has been long recognized. The problem of constructing such a scheme was first proposed within a year of the development of RSA. A solution proved more elusive; for more than 30 years, it was unclear whether fully homomorphic encryption was even possible. During this period, the best result was the Boneh-Goh-Nissim cryptosystem which supports evaluation of an unlimited number of addition operations but at most one multiplication.

Craig Gentry using lattice-based cryptography showed the first fully homomorphic encryption scheme as announced by IBM on June 25, 2009. His scheme supports evaluations of arbitrary depth circuits. His construction starts from a somewhat homomorphic encryption scheme using ideal lattices that is limited to evaluating low-degree polynomials over encrypted data. (It is limited because each ciphertext is noisy in some sense, and this noise grows as one adds and multiplies ciphertexts, until ultimately the noise makes the resulting ciphertext indecipherable.) He then shows how to modify this scheme to make it bootstrappable—in particular, he shows that by modifying the somewhat homomorphic scheme slightly, it can actually evaluate its own decryption circuit, a self-referential property. Finally, he shows that any bootstrappable somewhat homomorphic encryption scheme can be converted into a fully homomorphic encryption through a recursive self-embedding. In the particular case of Gentry's ideal-lattice-based somewhat homomorphic scheme, this bootstrapping procedure effectively "refreshes" the ciphertext by reducing its associated noise so that it can be used thereafter in more additions and multiplications without resulting in an indecipherable ciphertext. Gentry based the security of his scheme on the assumed hardness of two problems: certain worst-case problems over ideal lattices, and the sparse (or low-weight) subset sum problem.

Regarding performance, ciphertexts in Gentry's scheme remain compact insofar as their lengths do not depend at all on the complexity of the function that is evaluated over the encrypted data. The computational time only depends linearly on the number of operations performed. However, the scheme is impractical for many applications, because ciphertext size and computation time increase sharply as one increases the security level. To obtain 2^k security against known attacks, the computation time and ciphertext size are high-degree polynomials in k. Stehle and Steinfeld reduced the dependence on k substantially. They presented optimizations that permit the computation to be only quasi-k^3.5 per boolean gate of the function being evaluated.

Gentry's Ph.D. thesis provides additional details. Gentry also published a high-level overview of the van Dijk et al. construction (described below) in the March 2010 issue of Communications of the ACM.

In 2009, Marten van Dijk, Craig Gentry, Shai Halevi and Vinod Vaikuntanathan presented a second fully homomorphic encryption scheme, which uses many of the tools of Gentry's construction, but which does not require ideal lattices. Instead, they show that the somewhat homomorphic component of Gentry's ideal lattice-based scheme can be replaced with a very simple somewhat homomorphic scheme that uses integers. The scheme is therefore conceptually simpler than Gentry's ideal lattice scheme, but has similar properties with regards to homomorphic operations and efficiency. The somewhat homomorphic component in the work of van Dijk et al. is similar to an encryption scheme proposed by Levieil and Naccache in 2008, and also to one that was proposed by Bram Cohen in 1998. Cohen's method is not even additively homomorphic, however. The Levieil-Naccache scheme is additively homomorphic, and can be modified to support also a small number of multiplications.

Implementations

In 2010, Nigel P. Smart and Frederik Vercauteren presented a refinement of Gentry's scheme giving smaller key and ciphertext sizes, but which is still not fully practical. At the rump session of Eurocrypt 2010, Craig Gentry and Shai Halevi presented a working implementation of fully homomorphic encryption (i.e. the entire bootstrapping procedure) together with performance numbers.

In 2010 Riggio and Sicari presented a practical application of homomorphic encryption to a hybrid wireless sensor/mesh network. The system enables transparent multi-hop wireless backhauls that are able to perform statistical analysis of different kinds of data (temperature, humidity, etc.) coming from a WSN while ensuring both end-to-end encryption and hop-by-hop authentication.

Recently, Coron, Naccache and Tibouchi proposed a technique allowing to reduce the public-key size of the van Dijk et al. scheme to 600 KB. In April 2013 the HElib was released, via GitHub, to the open source community which "implements the Brakerski-Gentry-Vaikuntanathan (BGV) homomorphic encryption scheme, along with many optimizations to make homomorphic evaluation runs faster."

Toward Fully Secure Internet Applications

Homomorphic Encryption is a good basis to enhance the security measures of un-trusted systems/applications that stores and manipulates sensitive data. This strong protection of data results from the capability, allowed through HES, to perform arithmetic operations over encrypted bits. Based on the Fully Homomorphic Scheme, Y. Gahi et al. have developed foundations and design generic circuits, easily customizable, that can effectively preserve the privacy and confidentiality in various applications. The proposed model accepts encrypted inputs and then perform blind processing to satisfy the user query without being aware of its content, whereby the retrieved encrypted data can only be decrypted by the user who initiates the request. Thus, this allows clients to rely on the services offered by remote applications without risking their privacy, even though the integrity of these servers may be questionable.

See also

• Homomorphic Signatures for Network Coding
• Verifiable computing using a fully homomorphic scheme

References

43 year old Petroleum Engineer Harry from Deep River, usually spends time with hobbies and interests like renting movies, property developers in singapore new condominium and vehicle racing. Constantly enjoys going to destinations like Camino Real de Tierra Adentro.

External links

• Homomorphic encryption in Cryptology Pointers
• The Homomorphic Encryption Project
• The Open Source hcrypt Project
• American Scientist article, September 2012
• HElib, open source homomorphic encryption library for C++
• Translucent Database An architecture based on these principles.