準同型暗号を使う方法

问题

信頼できないサーバーに保存・処理される機密データに対して計算する必要がありますが、復号するとデータが露出してしまいます。準同型暗号（HE）を使えば、暗号文に対する計算結果を復号すると、平文に対する同じ計算の結果と一致します。

前提条件

• 公開鍵暗号方式の理解
• 多項式演算と合同算術への習熟
• 部分・準完全・完全準同型暗号の違いに関する知識

ステップ

1. 1. Choose the appropriate HE scheme

   Select between Partial HE (supports only one operation type, e.g., Paillier for addition), Somewhat HE (supports both operations but limited depth, e.g., BGV/BFV), and Fully HE (supports unlimited operations, e.g., CKKS/BGV with bootstrapping). For integer arithmetic with exact results, use BFV. For approximate real-number arithmetic, use CKKS. For additive-only aggregation, Paillier is simplest and fastest.

   入力

   need: addition on encrypted salary data

   输出

   scheme: Paillier (additive HE)

2. 2. Generate keys and encrypt the data

   Generate the public key, secret key, and (for FHE) evaluation keys. Use the public key to encrypt each plaintext value. For Paillier, encryption is E(m) = g^m * r^n mod n^2 where r is random. The ciphertext space is larger than the plaintext space. Encrypt all sensitive values before sending to the untrusted server. Use the modular exponentiation tool to understand the underlying math.

   入力

   plaintext: [30, 45, 50, 25] (salaries)

   输出

   ciphertext: [E(30), E(45), E(50), E(25)]

3. 3. Perform computation on ciphertexts

   For Paillier (additive HE): homomorphic addition is E(m1) * E(m2) mod n^2 = E(m1 + m2). Scalar multiplication is E(m)^k mod n^2 = E(k * m). Compute the encrypted sum by multiplying all ciphertexts modulo n^2. The server never sees plaintext values. For BFV/CKKS, use the evaluation keys for multiplication operations.

   入力

   E(30) * E(45) * E(50) * E(25) mod n^2

   输出

   E(150) = E(30 + 45 + 50 + 25)

4. 4. Decrypt the result locally

   Retrieve the resulting ciphertext from the server and decrypt it with the secret key. For Paillier, decryption is m = L(c^lambda mod n^2) * mu mod n, where L(x) = (x-1)/n. The decrypted result equals the sum of the original plaintexts. Verify the result matches the expected computation. The server performed the computation without ever knowing the individual values.

   入力

   E(150) + secret_key

   输出

   150 (sum of salaries)

期待される結果

信頼できないサーバー上の暗号化されたデータに対して計算を行い、復号すると正しい平文の計算結果が得られる能力。データのプライバシーは全過程で保護されます。

よくあるエラー

Using FHE when additive HE suffices

FHE with bootstrapping is 1000x slower than Paillier. If you only need addition or scalar multiplication, use Paillier. Only use FHE when you need both addition and multiplication on encrypted data.

Noise overflow in FHE ciphertexts

Each operation adds noise. After too many operations, noise overwhelms the signal. Use bootstrapping to refresh the ciphertext, or re-encrypt periodically. CKKS manages noise via rescaling.

Plaintext modulus too small for the result

The result must fit within the plaintext modulus. For Paillier, the sum must be less than n. Choose parameters based on the maximum possible result value.

トラブルシューティング指引

• If performance is too slow, consider using leveled HE (no bootstrapping) with a pre-computed multiplication depth budget.
• For CKKS approximate arithmetic, track the precision loss through each operation — rescaling reduces precision by log(scaling_factor) bits per multiplication level.
• If implementing from scratch is too complex, use established libraries (SEAL, OpenFHE, PALISADE, HElib) rather than custom implementations.

セキュリティ上の制限

• Homomorphic encryption is computationally expensive — FHE can be 10,000x slower than plaintext computation.
• HE protects data confidentiality but not access patterns — the server learns which operations were performed.
• All key generation and decryption must happen locally; only ciphertexts and evaluation keys go to the server.