Homomorphic Encryption

Supports unlimited operations of a single type—either addition or multiplication, but not both—on ciphertexts. This limitation makes PHE schemes extremely efficient and practical for specific, well-defined use cases.

• RSA Encryption: The original multiplicative homomorphic scheme. Encrypting two messages and multiplying their ciphertexts yields an encryption of the product of the plaintexts.
• Paillier Cryptosystem: A widely used additive homomorphic scheme. The sum of two ciphertexts decrypts to the sum of the plaintexts, making it ideal for encrypted vote tallying and private financial aggregation.
• Use Case: Secure e-voting systems where individual votes are encrypted and the final tally is computed without ever decrypting a single ballot.

Permits both addition and multiplication on ciphertexts, but only for circuits of limited depth. Each operation introduces a small amount of noise into the ciphertext, and once this noise exceeds a threshold, decryption fails.

• Noise Budget: The core constraint in SHE. Every homomorphic multiplication roughly squares the noise, causing it to grow exponentially with circuit depth.
• Bounded Depth: SHE can evaluate low-degree polynomials but cannot handle arbitrary computations requiring deep multiplication chains.
• Historical Significance: Early SHE schemes like BGN (Boneh-Goh-Nissim, 2005) proved that computing on encrypted data was possible, paving the way for fully homomorphic encryption.

A practical variant of FHE that can evaluate circuits up to a pre-determined multiplicative depth without bootstrapping. By setting parameters large enough for the target computation, leveled FHE avoids the massive computational overhead of bootstrapping.

• Parameter Selection: The scheme's parameters are chosen based on the known depth of the circuit to be evaluated. No bootstrapping step is required if the noise budget is sufficient from the start.
• BGV and BFV Schemes: The Brakerski-Gentry-Vaikuntanathan (BGV) and Brakerski-Fan-Vercauteren (BFV) schemes are the dominant leveled FHE constructions, excelling at integer arithmetic and SIMD-style packed operations.
• Efficiency Trade-off: Leveled FHE is significantly faster than pure FHE for computations with a known, fixed depth, making it the preferred choice for many practical deployments like private inference on neural networks.

A property ensuring that the evaluated ciphertext reveals no information about the function that was computed, only the result. Standard homomorphic evaluation leaks the circuit topology; circuit privacy hides it.

• The Problem: In standard FHE, an evaluator can see the sequence of operations applied. If the function itself is proprietary (e.g., a fraud detection model), this leaks intellectual property.
• The Solution: Techniques like noise flooding or re-randomization after evaluation ensure the output ciphertext is statistically indistinguishable from a fresh encryption of the result, regardless of the circuit evaluated.
• Application: Critical for scenarios where a client sends encrypted data to a server holding a proprietary machine learning model. Circuit privacy protects the model's architecture and weights from the client.

Extends FHE to allow computation on ciphertexts encrypted under different public keys. The result is a ciphertext that can only be decrypted through a collaborative protocol involving all parties whose keys were used.

• Threshold Decryption: The final ciphertext requires a joint decryption protocol where all key holders participate. No single party can decrypt the result alone.
• Collaborative Analytics: Enables multiple distrusting organizations to jointly compute on their combined encrypted datasets without revealing individual inputs to each other or to a central third party.
• MK-FHE Schemes: Constructions like the López-Alt, Tromer, and Vaikuntanathan (LTV) scheme and subsequent improvements enable this functionality, though with significant computational overhead compared to single-key FHE.

The most powerful form of homomorphic encryption, supporting arbitrary computation on ciphertexts. FHE schemes can evaluate both addition and multiplication operations an unlimited number of times, enabling any computable function to be executed on encrypted data. This is achieved through a technique called bootstrapping, which refreshes the ciphertext noise to prevent it from growing too large. Current FHE implementations face significant performance overhead, often being millions of times slower than plaintext computation.

A type of homomorphic encryption that supports only one type of operation—either addition or multiplication—but can perform it an unlimited number of times.

• Additive PHE: The Paillier cryptosystem allows encrypted values to be summed, useful for electronic voting and private tallying.
• Multiplicative PHE: The ElGamal and unpadded RSA schemes allow encrypted values to be multiplied.

PHE is computationally efficient and practical for specific, narrow use cases like encrypted aggregation.

A scheme that supports both addition and multiplication but only for a limited number of operations. Each homomorphic operation increases the noise within the ciphertext. Once the noise exceeds a threshold, decryption becomes impossible. SHE is a stepping stone to FHE and can be practical for applications with shallow circuit depths, such as evaluating simple statistical models on encrypted data without the full cost of bootstrapping.

The mathematical foundation underlying most modern homomorphic encryption schemes. Lattice-based cryptography relies on the hardness of problems like Learning With Errors (LWE) and its ring variant Ring-LWE. These problems involve solving linear equations perturbed by small random noise. Lattice-based constructions are a leading candidate for post-quantum cryptography, meaning they are believed to be secure against attacks from large-scale quantum computers, unlike RSA and elliptic curve cryptography.

A complementary privacy-preserving technology where multiple parties jointly compute a function over their private inputs without revealing those inputs to each other. While homomorphic encryption computes on data encrypted under a single key, SMPC distributes trust among participants.

• Secret sharing splits data into meaningless shares.
• Garbled circuits enable two-party boolean computation.

SMPC and homomorphic encryption are often combined in hybrid protocols to optimize for performance and trust assumptions.

A hardware-based approach to confidential computing that creates an isolated enclave within a CPU where code and data are protected from the host operating system. Unlike homomorphic encryption, which is a purely mathematical approach, TEEs like Intel SGX and AMD SEV decrypt data inside the secure hardware boundary for processing. This offers near-native performance but requires trust in the hardware manufacturer and is vulnerable to side-channel attacks.