Fully Homomorphic Encryption vs Partially Homomorphic Encryption

Fully Homomorphic Encryption (FHE) excels at enabling arbitrary computations on ciphertexts because it supports both addition and multiplication operations without decryption. For example, a government health agency could theoretically run a complex logistic regression model on encrypted patient records from multiple hospitals, receiving only the encrypted result. However, this generality comes at a steep price: current FHE schemes like CKKS or BGV impose a computational overhead of roughly 10,000x to 1,000,000x compared to plaintext operations, making real-time analysis on large-scale census datasets impractical without specialized hardware acceleration.

Partially Homomorphic Encryption (PHE) takes a different approach by limiting operations to a single type—either addition (Paillier) or multiplication (RSA/ElGamal). This results in a dramatic reduction in computational cost, often with overheads closer to 100x to 1,000x. A tax fraud detection unit, for instance, can use Paillier to securely sum encrypted income figures from multiple agencies without ever decrypting individual returns. The trade-off is a loss of computational expressiveness: you cannot chain addition and multiplication to build deep learning models directly on the encrypted data.

The key trade-off: If your priority is performing complex, arbitrary analytics like training a neural network on highly sensitive multi-agency data, choose FHE despite its latency and cost. If you prioritize practical, efficient statistical queries—such as secure sums, averages, or variance calculations for inter-departmental reports—choose PHE. For most current government statistical use cases, the operational maturity and speed of PHE outweigh the theoretical completeness of FHE, but FHE is the strategic choice for future-proofing against more sophisticated analytical demands.

Fully Homomorphic Encryption (FHE) excels at enabling arbitrary computations on ciphertexts because it supports both addition and multiplication operations without decryption. For example, a government health agency could run a complex logistic regression model on encrypted patient records from multiple hospitals, outputting an encrypted risk score without ever exposing the underlying data. However, this comes at a staggering computational cost; current FHE schemes like CKKS can be 1,000 to 1,000,000 times slower than plaintext computation, and the ciphertext expansion can inflate data size by 10x to 100x, making real-time analysis impractical for most high-throughput public services.

Partially Homomorphic Encryption (PHE) takes a different approach by restricting operations to either addition (e.g., Paillier) or multiplication (e.g., ElGamal). This results in a dramatic performance trade-off: PHE operations are typically only 10x to 100x slower than plaintext, with minimal ciphertext expansion. For a census bureau computing the average income across encrypted tax returns, additive PHE is perfectly sufficient and can process millions of records in minutes rather than days. The limitation is clear—you cannot chain operations to build complex models, but you gain a practical, deployable system for specific statistical queries like sums, averages, and variance.

The key trade-off: If your priority is performing deep, multi-variate analysis or training a machine learning model on encrypted data without a trusted curator, choose FHE and budget for specialized hardware acceleration (FPGAs or ASICs) and significant latency. If you prioritize operational efficiency for well-defined aggregate statistics—such as calculating sums, frequencies, or averages across siloed government datasets—choose PHE. For most current public sector applications, a pragmatic hybrid approach often wins: use PHE for the heavy lifting of secure aggregation and reserve FHE for the final, low-volume complex computation that requires it.