4

Homomorphic Encryption (HE) which supports any function on ciphertexts is known as Fully Homomorphic Encryption (FHE), while Partially Homomorphic Encryption (PHE) includes encryption schemes that have homomorphic properties, with respect to one operation (e.g., only addition or only multiplication, but not both).

Are symmetric homomorphic encryption schemes (like Domingo-Ferrer, Castelluccia, etc.) also considered to be PHE?

mikeazo
  • 38,563
  • 8
  • 112
  • 180
zof
  • 399
  • 1
  • 5
  • 13
  • I added links to what I think are the relevant publications. If they are not correct, please update. – mikeazo Jul 10 '13 at 14:44

1 Answers1

8

It will depend on the exact system.

The cryptosystem of Castelluccia is additively homomorphic and is thus a PHE cipher.

The cipher of Domingo-Ferrer was broken by Wagner and others. Thus, I wouldn't classify it as either.

The cipher of Xiao, et al. is fully homomorphic.

To determine if a symmetric scheme is a PHE or FHE, just look at what operations it supports. If it supports a single operation (say addition), then it is PHE. If it supports both operations (addition and multiplication), then it is FHE.

Update
A recent trend in the HE encryption literature has been something called Somewhat Homomorphic Encryption (SHE). These are ciphers which support both addition and multiplication but not unlimited numbers of operations. E.g., BGN is a SHE cipher as it supports unlimited additions and one multiplication. The current FHE ciphers are all built using SHE ciphers plus a bootstrapping operation (or generating the keys such that enough of each operation can be supported to compute the desired function, making bootstrapping unnecessary).

mikeazo
  • 38,563
  • 8
  • 112
  • 180
  • What about the BGN scheme ? – zof Jul 12 '13 at 15:14
  • @user7552, updated to include BGN. – mikeazo Jul 12 '13 at 16:42
  • I think these terms are misleding. It depends on the underlying algebraic structure. RSA is fully homomorphic if you consider the monoid $(\mathbb{Z}_n,)$ but somewhat homomorphic, if you consider the ring $(\mathbb{Z}_n,,+)$. In the monoid $(\mathbb{Z}_n,*)$ you have only functions, that can be build by multiplication and any such function can be computed on cyphertext in RSA. In any case a fully homomorphic encryption is then an automorphism of the underlying algebraic structure. I.e. monoid automorphis, or ring automorphism or ideal-lattice autom. – Mark Neuhaus May 16 '18 at 12:02