TUTORIAL

How to Use Homomorphic Encryption

Perform computations on encrypted data without decrypting it first, enabling secure outsourced computation and privacy-preserving analytics.

Problem

You need to compute on sensitive data stored or processed by an untrusted server, but decrypting the data would expose it. Homomorphic encryption (HE) allows computation on ciphertexts that, when decrypted, match the result of the same computation on the plaintext.

Prerequisites

Understanding of public-key encryption schemes
Familiarity with polynomial arithmetic and modular arithmetic
Knowledge of the difference between partial, somewhat, and fully homomorphic encryption

Steps

1. Choose the appropriate HE scheme

Select between Partial HE (supports only one operation type, e.g., Paillier for addition), Somewhat HE (supports both operations but limited depth, e.g., BGV/BFV), and Fully HE (supports unlimited operations, e.g., CKKS/BGV with bootstrapping). For integer arithmetic with exact results, use BFV. For approximate real-number arithmetic, use CKKS. For additive-only aggregation, Paillier is simplest and fastest.
Input
```
need: addition on encrypted salary data
```
Output
```
scheme: Paillier (additive HE)
```
2. Generate keys and encrypt the data

Generate the public key, secret key, and (for FHE) evaluation keys. Use the public key to encrypt each plaintext value. For Paillier, encryption is E(m) = g^m * r^n mod n^2 where r is random. The ciphertext space is larger than the plaintext space. Encrypt all sensitive values before sending to the untrusted server. Use the modular exponentiation tool to understand the underlying math.
Input
```
plaintext: [30, 45, 50, 25] (salaries)
```
Output
```
ciphertext: [E(30), E(45), E(50), E(25)]
```
3. Perform computation on ciphertexts

For Paillier (additive HE): homomorphic addition is E(m1) * E(m2) mod n^2 = E(m1 + m2). Scalar multiplication is E(m)^k mod n^2 = E(k * m). Compute the encrypted sum by multiplying all ciphertexts modulo n^2. The server never sees plaintext values. For BFV/CKKS, use the evaluation keys for multiplication operations.
Input
```
E(30) * E(45) * E(50) * E(25) mod n^2
```
Output
```
E(150) = E(30 + 45 + 50 + 25)
```
4. Decrypt the result locally

Retrieve the resulting ciphertext from the server and decrypt it with the secret key. For Paillier, decryption is m = L(c^lambda mod n^2) * mu mod n, where L(x) = (x-1)/n. The decrypted result equals the sum of the original plaintexts. Verify the result matches the expected computation. The server performed the computation without ever knowing the individual values.
Input
```
E(150) + secret_key
```
Output
```
150 (sum of salaries)
```

Expected result

The ability to compute on encrypted data on an untrusted server, with results that decrypt to the correct plaintext computation, preserving data privacy throughout.

Common errors

Using FHE when additive HE suffices: FHE with bootstrapping is 1000x slower than Paillier. If you only need addition or scalar multiplication, use Paillier. Only use FHE when you need both addition and multiplication on encrypted data.
Noise overflow in FHE ciphertexts: Each operation adds noise. After too many operations, noise overwhelms the signal. Use bootstrapping to refresh the ciphertext, or re-encrypt periodically. CKKS manages noise via rescaling.
Plaintext modulus too small for the result: The result must fit within the plaintext modulus. For Paillier, the sum must be less than n. Choose parameters based on the maximum possible result value.

Troubleshooting

If performance is too slow, consider using leveled HE (no bootstrapping) with a pre-computed multiplication depth budget.
For CKKS approximate arithmetic, track the precision loss through each operation — rescaling reduces precision by log(scaling_factor) bits per multiplication level.
If implementing from scratch is too complex, use established libraries (SEAL, OpenFHE, PALISADE, HElib) rather than custom implementations.

Security limits

Homomorphic encryption is computationally expensive — FHE can be 10,000x slower than plaintext computation.
HE protects data confidentiality but not access patterns — the server learns which operations were performed.
All key generation and decryption must happen locally; only ciphertexts and evaluation keys go to the server.