如何Use Homomorphic Encryption

问题

你需要计算开 sensitive 数据 stored 或过程通过 untrusted 服务器, 但 decrypting 数据会 expose 它. Homomorphic 加密 (他) allows computation 开 ciphertexts 该, 当 decrypted, 匹配结果的 相同 computation 开 plaintext.

前置条件

• Understanding 的公共-键加密 schemes
• 熟悉多项式 arithmetic 和 modular arithmetic
• Knowledge 的差集之间部分, somewhat, 和 fully homomorphic 加密

步骤

1. 1. Choose the appropriate HE scheme

   Select between Partial HE (supports only one operation type, e.g., Paillier for addition), Somewhat HE (supports both operations but limited depth, e.g., BGV/BFV), and Fully HE (supports unlimited operations, e.g., CKKS/BGV with bootstrapping). For integer arithmetic with exact results, use BFV. For approximate real-number arithmetic, use CKKS. For additive-only aggregation, Paillier is simplest and fastest.

   输入

   need: addition on encrypted salary data

   输出

   scheme: Paillier (additive HE)

2. 2. Generate keys and encrypt the data

   Generate the public key, secret key, and (for FHE) evaluation keys. Use the public key to encrypt each plaintext value. For Paillier, encryption is E(m) = g^m * r^n mod n^2 where r is random. The ciphertext space is larger than the plaintext space. Encrypt all sensitive values before sending to the untrusted server. Use the modular exponentiation tool to understand the underlying math.

   输入

   plaintext: [30, 45, 50, 25] (salaries)

   输出

   ciphertext: [E(30), E(45), E(50), E(25)]

3. 3. Perform computation on ciphertexts

   For Paillier (additive HE): homomorphic addition is E(m1) * E(m2) mod n^2 = E(m1 + m2). Scalar multiplication is E(m)^k mod n^2 = E(k * m). Compute the encrypted sum by multiplying all ciphertexts modulo n^2. The server never sees plaintext values. For BFV/CKKS, use the evaluation keys for multiplication operations.

   输入

   E(30) * E(45) * E(50) * E(25) mod n^2

   输出

   E(150) = E(30 + 45 + 50 + 25)

4. 4. Decrypt the result locally

   Retrieve the resulting ciphertext from the server and decrypt it with the secret key. For Paillier, decryption is m = L(c^lambda mod n^2) * mu mod n, where L(x) = (x-1)/n. The decrypted result equals the sum of the original plaintexts. Verify the result matches the expected computation. The server performed the computation without ever knowing the individual values.

   输入

   E(150) + secret_key

   输出

   150 (sum of salaries)

预期结果

ability 到计算开 encrypted 数据开 untrusted 服务器, 具有结果该 解密到 正确 plaintext computation, preserving 数据隐私遍及.

常见错误

Using FHE when additive HE suffices

FHE with bootstrapping is 1000x slower than Paillier. If you only need addition or scalar multiplication, use Paillier. Only use FHE when you need both addition and multiplication on encrypted data.

Noise overflow in FHE ciphertexts

Each operation adds noise. After too many operations, noise overwhelms the signal. Use bootstrapping to refresh the ciphertext, or re-encrypt periodically. CKKS manages noise via rescaling.

Plaintext modulus too small for the result

The result must fit within the plaintext modulus. For Paillier, the sum must be less than n. Choose parameters based on the maximum possible result value.

排障指引

• If performance is too slow, consider using leveled HE (no bootstrapping) with a pre-computed multiplication depth budget.
• For CKKS approximate arithmetic, track the precision loss through each operation — rescaling reduces precision by log(scaling_factor) bits per multiplication level.
• If implementing from scratch is too complex, use established libraries (SEAL, OpenFHE, PALISADE, HElib) rather than custom implementations.

安全限制

• Homomorphic encryption is computationally expensive — FHE can be 10,000x slower than plaintext computation.
• HE protects data confidentiality but not access patterns — the server learns which operations were performed.
• All key generation and decryption must happen locally; only ciphertexts and evaluation keys go to the server.