Comment en Utiliser Homomorphic Chiffrement

Perform computations sur encrypted données sans decrypting it premier, enabling sûr outsourced computation et privacy-preserving analytics.

问题

You besoin en calculer sur sensitive données stored ou processed par un untrusted serveur, mais decrypting le données allait expose it. Homomorphic chiffrement (HE) allows computation sur ciphertexts ce, quand decrypted, correspondre le résultat de le même computation sur le plaintext.

Prérequis

Understanding of public-key encryption schemes
Familiarity with polynomial arithmetic and modular arithmetic
Knowledge of the difference between partial, somewhat, and fully homomorphic encryption

Étapes

1. Choose the appropriate HE scheme

Select between Partial HE (supports only one operation type, e.g., Paillier for addition), Somewhat HE (supports both operations but limited depth, e.g., BGV/BFV), and Fully HE (supports unlimited operations, e.g., CKKS/BGV with bootstrapping). For integer arithmetic with exact results, use BFV. For approximate real-number arithmetic, use CKKS. For additive-only aggregation, Paillier is simplest and fastest.
entrée
```
need: addition on encrypted salary data
```
输出
```
scheme: Paillier (additive HE)
```
2. Generate keys and encrypt the data

Generate the public key, secret key, and (for FHE) evaluation keys. Use the public key to encrypt each plaintext value. For Paillier, encryption is E(m) = g^m * r^n mod n^2 where r is random. The ciphertext space is larger than the plaintext space. Encrypt all sensitive values before sending to the untrusted server. Use the modular exponentiation tool to understand the underlying math.
entrée
```
plaintext: [30, 45, 50, 25] (salaries)
```
输出
```
ciphertext: [E(30), E(45), E(50), E(25)]
```
3. Perform computation on ciphertexts

For Paillier (additive HE): homomorphic addition is E(m1) * E(m2) mod n^2 = E(m1 + m2). Scalar multiplication is E(m)^k mod n^2 = E(k * m). Compute the encrypted sum by multiplying all ciphertexts modulo n^2. The server never sees plaintext values. For BFV/CKKS, use the evaluation keys for multiplication operations.
entrée
```
E(30) * E(45) * E(50) * E(25) mod n^2
```
输出
```
E(150) = E(30 + 45 + 50 + 25)
```
4. Decrypt the result locally

Retrieve the resulting ciphertext from the server and decrypt it with the secret key. For Paillier, decryption is m = L(c^lambda mod n^2) * mu mod n, where L(x) = (x-1)/n. The decrypted result equals the sum of the original plaintexts. Verify the result matches the expected computation. The server performed the computation without ever knowing the individual values.
entrée
```
E(150) + secret_key
```
输出
```
150 (sum of salaries)
```

Résultat attendu

Le ability en calculer sur encrypted données sur un untrusted serveur, avec résultats ce déchiffrer en le correct plaintext computation, preserving données privacy throughout.

Erreurs courantes

Using FHE when additive HE suffices: FHE with bootstrapping is 1000x slower than Paillier. If you only need addition or scalar multiplication, use Paillier. Only use FHE when you need both addition and multiplication on encrypted data.
Noise overflow in FHE ciphertexts: Each operation adds noise. After too many operations, noise overwhelms the signal. Use bootstrapping to refresh the ciphertext, or re-encrypt periodically. CKKS manages noise via rescaling.
Plaintext modulus too small for the result: The result must fit within the plaintext modulus. For Paillier, the sum must be less than n. Choose parameters based on the maximum possible result value.

Dépannage指引

If performance is too slow, consider using leveled HE (no bootstrapping) with a pre-computed multiplication depth budget.
For CKKS approximate arithmetic, track the precision loss through each operation — rescaling reduces precision by log(scaling_factor) bits per multiplication level.
If implementing from scratch is too complex, use established libraries (SEAL, OpenFHE, PALISADE, HElib) rather than custom implementations.

Limites de sécurité

Homomorphic encryption is computationally expensive — FHE can be 10,000x slower than plaintext computation.
HE protects data confidentiality but not access patterns — the server learns which operations were performed.
All key generation and decryption must happen locally; only ciphertexts and evaluation keys go to the server.