Homomorphic Encryption

Supports a single type of operation—either addition or multiplication—on ciphertexts, but not both. RSA encryption is multiplicatively homomorphic, while Paillier is additively homomorphic. PHE schemes are computationally lightweight and practical for specific use cases like encrypted vote tallying or privacy-preserving aggregation. However, their single-operation limitation prevents general-purpose computation on encrypted data.

Permits both addition and multiplication but only for circuits of limited depth. Each operation introduces noise into the ciphertext, and once the noise exceeds a threshold, decryption fails. SHE schemes like BGV and BFV use modulus switching and relinearization to manage noise growth. They are ideal for evaluating low-degree polynomials, such as inference on shallow neural networks, but cannot handle deep computations without bootstrapping.

Enables arbitrary computation on encrypted data through a technique called bootstrapping, which homomorphically evaluates the decryption circuit itself to reset noise levels. First constructed by Craig Gentry in 2009 using ideal lattices, modern FHE schemes like CKKS support approximate arithmetic on real numbers, making them suitable for encrypted machine learning. FHE remains computationally intensive, with operations running 1,000 to 1,000,000 times slower than plaintext equivalents.

A practical variant of FHE that evaluates circuits up to a pre-determined multiplicative depth without bootstrapping. By setting parameters to accommodate a specific computation, leveled schemes avoid the enormous cost of bootstrapping. BGV and BFV operate in this mode, making them the workhorses for production privacy-preserving applications where the computation graph is known in advance, such as private information retrieval and encrypted database queries.

All modern practical HE schemes derive their security from hard problems on mathematical lattices, specifically the Ring Learning With Errors (RLWE) problem. RLWE is believed to be resistant to attacks by both classical and quantum computers, making HE a post-quantum cryptographic primitive. The NIST Post-Quantum Cryptography Standardization process has validated lattice-based schemes, reinforcing confidence in HE's long-term security posture for protecting sensitive data against future adversaries.

Every homomorphic operation adds a small amount of noise to the ciphertext to maintain semantic security. Without mitigation, this noise accumulates and corrupts the plaintext upon decryption. Bootstrapping is the process of running the decryption circuit homomorphically on an encrypted ciphertext to produce a fresh encryption of the same plaintext with reduced noise. This is the critical innovation that enables FHE but remains the primary performance bottleneck, often consuming over 90% of total computation time.

The strongest form of homomorphic encryption, supporting arbitrary computation (both addition and multiplication) on ciphertexts. FHE schemes, such as those based on the Learning With Errors (LWE) problem, enable unlimited circuit evaluation without decryption. This allows a third party to perform complex analytics or machine learning inference on sensitive data without ever seeing the raw input.

A class of encryption schemes that support only a single type of operation on ciphertexts, either addition or multiplication, but not both.

• Additive PHE (e.g., Paillier): Allows encrypted values to be summed, useful for secure e-voting or private ledger aggregation.
• Multiplicative PHE (e.g., ElGamal): Allows encrypted values to be multiplied, useful for anonymous credential systems.

A scheme that supports a limited number of operations (both addition and multiplication) before the noise in the ciphertext grows too large to permit correct decryption. SHE is often a stepping stone to FHE, using techniques like bootstrapping to refresh the ciphertext and enable deeper computation. It is more efficient than pure FHE for low-depth circuits.

A cryptographic protocol that distributes a computation across multiple parties such that no single party can see the others' private inputs. While homomorphic encryption enables computation on encrypted data by a single server, SMPC allows mutually distrusting parties to jointly compute a function over their private data. Techniques include secret sharing and garbled circuits.

An access control technique where a search query is executed broadly, and the results are subsequently filtered to remove documents the user is not authorized to view. In the context of encrypted indexes, this often requires hybrid architectures where metadata-based access control lists (ACLs) are checked after a homomorphic search operation to ensure the final plaintext result set is compliant with document-level security policies.