3

Are there any Homomorphic Encryption(HE) schemes that result in noisy answers ? By noisy i mean , the answers could be approximately near the actual answers by noise factor $\epsilon$.

For example , we could get $dec_{sk}(eval_{pk}({enc_{pk}(5) + enc_{pk}(10))) = 16}$ where as the real answer is 15. Here $enc,eval,dec$ are functions of an HE scheme and $sk,pk$ are private and public keys. The scheme could be Fully HE or Semi HE or Partial HE

sashank
  • 6,174
  • 4
  • 32
  • 67
  • Presumably you want to avoid assuming the existence of standard homomorphic encryption schemes, since otherwise there's a "Just Do It" construction. $;$ –  Apr 08 '15 at 04:24
  • @RickyDemer sorry i did not get you, can u be more clear ? what is a "just do it" construction ? – sashank Apr 08 '15 at 04:27
  • 2
    If there is a standard homomorphic encryption schemes then there is a noisy homomorphic encryption scheme. $:$ That can be proven by showing how one can directly turn a standard homomorphic encryption scheme into a noisy homomorphic encryption scheme. $:$ (I have given two other "Just Do It" constructions on this site.) $;;;;$ –  Apr 08 '15 at 04:32
  • @RickyDemer got it ! now the question left is whether there are natively noisy algorithms – sashank Apr 08 '15 at 05:13
  • doesn't Regev scheme based on LWE verify this if you set the right parameters for the error distribution? – Florian Bourse Apr 08 '15 at 08:38
  • But, in this case, you will never know what the real value of the message is ? I mean, if you get $m' = dec_{sk}(c)$ then you just know that the real message $m$ belongs to $[m' - \epsilon, m' + \epsilon]$. – Hilder Vitor Lima Pereira Apr 08 '15 at 19:32
  • Yeah fine by that, if the noise is not beyond $\epsilon$ – sashank Apr 09 '15 at 00:36

1 Answers1

1

Yes, on the paper Homomorphic Encryption for Arithmetic of Approximate Numbers, Cheon et al. propose a scheme in which the error is not completely eliminated during decryption.

That is, if $c$ is an encryption of $m$, then $Dec(c) = m + e$, where $e$ is some small error.

Roughly speaking, that scheme simulates floating-point arithmetic, since this type of arithmetic also accumulate errors.

With that, the authors manage to perform operations that are hard to do with exact homomorphic encryption schemes. For example, in Algorithm 2 (page 15), they show how to compute homomorphically $\frac 1 m$ with $r$ bits of precision (with other schemes, that is only possible using bootstrapping...).

Hilder Vitor Lima Pereira
  • 6,484
  • 21
  • 40