Homomorphic Encryption

The fundamental property guaranteeing that decryption of the evaluated ciphertext yields the exact result of applying the intended function to the original plaintext.

• Additive Homomorphism: Dec(Enc(a) ⊕ Enc(b)) = a + b
• Multiplicative Homomorphism: Dec(Enc(a) ⊗ Enc(b)) = a × b
• Fully Homomorphic Encryption (FHE) supports both operations arbitrarily, enabling arbitrary circuit evaluation on encrypted data.
• The scheme must preserve correctness across unbounded circuit depth for FHE, or a limited depth for Somewhat Homomorphic Encryption (SHE).

The standard security notion requiring that a computationally bounded adversary cannot distinguish between encryptions of two chosen plaintexts, even with access to an encryption oracle.

• Guarantees that ciphertexts reveal no partial information about the plaintext.
• HE schemes achieve this through probabilistic encryption: the same plaintext encrypts to different ciphertexts each time due to random noise or nonces.
• This is why HE ciphertexts are inherently non-deterministic and orders of magnitude larger than plaintexts.

All practical HE schemes rely on Learning With Errors (LWE) or Ring-LWE hardness assumptions, embedding a small noise term during encryption that grows with each homomorphic operation.

• Noise Budget: A finite capacity consumed by each multiplication; exceeding it renders decryption incorrect.
• Bootstrapping (Gentry 2009): The breakthrough technique that evaluates the decryption circuit homomorphically, resetting the noise to a baseline level.
• This converts a leveled SHE scheme into an unbounded FHE scheme, at significant computational cost.

A stronger security property ensuring that the evaluated ciphertext reveals no information about the function that was computed, only the final encrypted result.

• Without circuit privacy, an adversary could infer the model architecture or query logic from the evaluated ciphertext structure.
• Achieved through noise flooding or rerandomization techniques that sanitize the output ciphertext distribution.
• Critical for private inference-as-a-service where the model is proprietary intellectual property.

The requirement that the size of the evaluated ciphertext and the decryption time are independent of the complexity of the evaluated function.

• Decrypting the result of a deep neural network inference must be as fast as decrypting a single addition.
• Prevents a trivial "encrypted computation" where the server simply appends the function description to the ciphertext.
• Compactness, combined with correctness and semantic security, formally defines a Fully Homomorphic Encryption scheme.

Extensions enabling computation on ciphertexts encrypted under different public keys, with decryption requiring collaboration among key holders.

• Multi-Key FHE: Allows joint computation across data from multiple parties without a shared key setup.
• Threshold FHE: Distributes the secret key among n parties; decryption requires a threshold t of them to collaborate.
• Essential for secure multi-party training where no single entity holds the decryption capability for the aggregated model.

The most powerful variant of homomorphic encryption that supports arbitrary computation on ciphertexts, including both addition and multiplication, enabling the evaluation of any circuit without decryption. Unlike Partially Homomorphic Encryption (PHE) which supports only one operation type, or Somewhat Homomorphic Encryption (SHE) which limits circuit depth, FHE removes computational constraints entirely. Current schemes like CKKS, BFV, and TFHE make different trade-offs between precision, performance, and ciphertext size. FHE remains computationally intensive, with operations typically 10,000x to 1,000,000x slower than plaintext equivalents, though hardware acceleration and algorithmic improvements are rapidly closing this gap.

A complementary cryptographic paradigm where multiple parties jointly compute a function over their private inputs without revealing those inputs to each other. While homomorphic encryption enables computation on a single party's encrypted data, SMPC distributes trust across participants. Common protocols include Garbled Circuits for boolean operations and Secret Sharing schemes like Shamir's threshold sharing. SMPC typically incurs high communication overhead between parties, making it suitable for scenarios where data must remain distributed, such as cross-institutional medical research or financial fraud detection consortia.

A hardware-based isolation mechanism that creates a secure enclave within the CPU where code and data are protected from the host operating system, hypervisor, and cloud provider. Technologies include Intel SGX, AMD SEV, and ARM TrustZone. Unlike homomorphic encryption's software-based approach, TEEs offer near-native performance but require trust in the hardware manufacturer. They are increasingly used for confidential computing workloads where encrypted data is decrypted only inside the enclave for processing, then re-encrypted before leaving. TEEs and homomorphic encryption are often deployed together in defense-in-depth architectures.

A mathematical definition of privacy that guarantees the output of a computation reveals nothing about any single individual's data, regardless of auxiliary information an adversary may possess. Achieved by injecting calibrated statistical noise into query results or model gradients, controlled by the privacy parameter epsilon (ε). While homomorphic encryption protects data during computation, differential privacy protects the output from inference attacks. The two are frequently combined: homomorphic encryption secures the computation pipeline, while differential privacy ensures the final model or statistics do not leak individual records through membership inference or model inversion attacks.

A cryptographic protocol where a prover convinces a verifier that a statement is true without revealing any information beyond the statement's validity. In the context of homomorphic encryption, ZKPs can prove that computations on ciphertexts were performed correctly without revealing the inputs, outputs, or intermediate values. This enables verifiable computation in untrusted environments. Schemes like zk-SNARKs and zk-STARKs provide succinct proofs with fast verification, making them suitable for blockchain scaling solutions and privacy-preserving identity systems where computational integrity must be publicly verifiable.

An umbrella term for hardware and software mechanisms that protect data in use—the third state beyond data at rest (encryption) and data in transit (TLS). Confidential computing ensures that sensitive data remains encrypted in main memory during processing, accessible only to authorized code within a hardware-rooted TEE. Major cloud providers now offer confidential VMs and containers. When combined with homomorphic encryption, organizations can implement a layered privacy architecture: homomorphic encryption for zero-trust computation across untrusted parties, and confidential computing for high-performance processing within attested enclaves.