Homomorphic encryption

Homomorphic encryption is a form of encryption that allows computation on ciphertexts, generating an encrypted result which, when decrypted, matches the result of the operations as if they had been performed on the plaintext. The purpose of homomorphic encryption is to allow computation on encrypted data.

Homomorphic encryption can be used to securely chain together different services without exposing sensitive data. For example, services from different companies can calculate 1) the tax, 2) the currency exchange rate, and 3) shipping on a transaction without exposing the unencrypted data to each of those services.^[1] Homomorphic encryption can also be used to create other secure systems such as secure voting systems,^[2] collision-resistant hash functions, and private information retrieval schemes.

Homomorphic encryption schemes are inherently malleable. In terms of malleability, homomorphic encryption schemes have weaker security properties than non-homomorphic schemes.

Partially homomorphic cryptosystems

In the following examples, the notation $\mathcal{E}(x)$ is used to denote the encryption of the message $x$ .

Unpadded RSA

If the RSA public key is modulus $m$ and exponent $e$ , then the encryption of a message $x$ is given by $\mathcal{E}(x) = x^e \;\bmod\; m$ . The homomorphic property is then

\mathcal{E}(x_1) \cdot \mathcal{E}(x_2) = x_1^e x_2^e \;\bmod\; m = (x_1x_2)^e \;\bmod\; m = \mathcal{E}(x_1 \cdot x_2)

ElGamal

In the ElGamal cryptosystem, in a cyclic group $G$ of order $q$ with generator $g$ , if the public key is $(G, q, g, h)$ , where $h = g^x$ , and $x$ is the secret key, then the encryption of a message $m$ is $\mathcal{E}(m) = (g^r,m\cdot h^r)$ , for some random $r \in \{0, \ldots, q-1\}$ . The homomorphic property is then

{\begin{aligned}&{\mathcal {E}}(m_{1})\cdot {\mathcal {E}}(m_{2})=(g^{{r_{1}}},m_{1}\cdot h^{{r_{1}}})(g^{{r_{2}}},m_{2}\cdot h^{{r_{2}}})\\[6pt]={}&(g^{{r_{1}+r_{2}}},(m_{1}\cdot m_{2})h^{{r_{1}+r_{2}}})={\mathcal {E}}(m_{1}\cdot m_{2}).\end{aligned}}

Goldwasser–Micali

In the Goldwasser–Micali cryptosystem, if the public key is the modulus m and quadratic non-residue x, then the encryption of a bit b is $\mathcal{E}(b) = x^b r^2 \;\bmod\; m$ , for some random $r \in \{0, \ldots, m-1\}$ . The homomorphic property is then

{\mathcal {E}}(b_{1})\cdot {\mathcal {E}}(b_{2})=x^{b_{1}}r_{1}^{2}x^{b_{2}}r_{2}^{2}\;{\bmod {\;}}m=x^{b_{1}+b_{2}}(r_{1}r_{2})^{2}\;{\bmod {\;}}m={\mathcal {E}}(b_{1}\oplus b_{2})

where $\oplus$ denotes addition modulo 2, (i.e. exclusive-or).

Benaloh

In the Benaloh cryptosystem, if the public key is the modulus m and the base g with a blocksize of c, then the encryption of a message x is $\mathcal{E}(x) = g^x r^c \;\bmod\; m$ , for some random $r \in \{0, \ldots, m-1\}$ . The homomorphic property is then

{\mathcal {E}}(x_{1})\cdot {\mathcal {E}}(x_{2})\;{\bmod {\;}}m=(g^{x_{1}}r_{1}^{c})(g^{x_{2}}r_{2}^{c})\;{\bmod {\;}}m=g^{x_{1}+x_{2}}(r_{1}r_{2})^{c}={\mathcal {E}}(x_{1}+x_{2})

Paillier

In the Paillier cryptosystem, if the public key is the modulus m and the base g, then the encryption of a message x is $\mathcal{E}(x) = g^x r^m \;\bmod\; m^2$ , for some random $r \in \{0, \ldots, m-1\}$ . The homomorphic property is then

{\mathcal {E}}(x_{1})\cdot {\mathcal {E}}(x_{2})=(g^{x_{1}}r_{1}^{m})(g^{x_{2}}r_{2}^{m})\;{\bmod {\;}}m^{2}=g^{x_{1}+x_{2}}(r_{1}r_{2})^{m}\;{\bmod {\;}}m^{2}={\mathcal {E}}(x_{1}+x_{2})

Other partially homomorphic cryptosystems

Okamoto–Uchiyama cryptosystem
Naccache–Stern cryptosystem
Damgård–Jurik cryptosystem
Sander-Young-Yung cryptosystem
Boneh–Goh–Nissim cryptosystem
Ishai-Paskin cryptosystem

Fully homomorphic encryption

A cryptosystem that supports arbitrary computation on ciphertexts is known as fully homomorphic encryption (FHE) and is far more powerful. Such a scheme enables the construction of programs for any desirable functionality, which can be run on encrypted inputs to produce an encryption of the result. Since such a program need never decrypt its inputs, it can be run by an untrusted party without revealing its inputs and internal state. Fully homomorphic cryptosystems have great practical implications in the outsourcing of private computations, for instance, in the context of cloud computing.^[3]

The problem of constructing a fully homomorphic encryption scheme was first proposed in 1978, within a year of the development of RSA.^[4] For more than 30 years, it was unclear whether a solution existed. During that period, partial results included the Sander-Young-Yung system, which solved the problem for logarithmic depth circuits;^[5] the Boneh–Goh–Nissim cryptosystem, which supports evaluation of an unlimited number of addition operations but at most one multiplication;^[6] and the Ishai-Paskin cryptosystem, which supports evaluation of polynomial-size branching programs.^[7]

Early homomorphic cryptosystems

Gentry's cryptosystem

Craig Gentry,^[8] using lattice-based cryptography, described the first plausible construction for a fully homomorphic encryption scheme. Gentry's scheme supports both addition and multiplication operations on ciphertexts, from which it is possible to construct circuits for performing arbitrary computation.

The construction starts from a somewhat homomorphic encryption scheme, which is limited to evaluating low-degree polynomials over encrypted data. (It is limited because each ciphertext is noisy in some sense, and this noise grows as one adds and multiplies ciphertexts, until ultimately the noise makes the resulting ciphertext indecipherable.) Gentry then shows how to slightly modify this scheme to make it bootstrappable, i.e., capable of evaluating its own decryption circuit and then at least one more operation. Finally, he shows that any bootstrappable somewhat homomorphic encryption scheme can be converted into a fully homomorphic encryption through a recursive self-embedding. For Gentry's "noisy" scheme, the bootstrapping procedure effectively "refreshes" the ciphertext by applying to it the decryption procedure homomorphically, thereby obtaining a new ciphertext that encrypts the same value as before but has lower noise. By "refreshing" the ciphertext periodically whenever the noise grows too large, it is possible to compute arbitrary number of additions and multiplications without increasing the noise too much. Gentry based the security of his scheme on the assumed hardness of two problems: certain worst-case problems over ideal lattices, and the sparse (or low-weight) subset sum problem. Gentry's Ph.D. thesis^[9] provides additional details.

Regarding performance, ciphertexts in Gentry's scheme remain compact insofar as their lengths do not depend at all on the complexity of the function that is evaluated over the encrypted data, but the scheme is impractical, and its ciphertext size and computation time increase sharply as one increases the security level. Several optimizations and refinements were proposed by Damien Stehle and Ron Steinfeld,^[10] Nigel Smart and Frederik Vercauteren,^[11]^[12] and Craig Gentry and Shai Halevi,^[13]^[14] the latter obtaining the first working implementation of Gentry's fully homomorphic encryption.

Cryptosystem over the integers

In 2010, Marten van Dijk, Craig Gentry, Shai Halevi and Vinod Vaikuntanathan presented a second fully homomorphic encryption scheme,^[15] which uses many of the tools of Gentry's construction, but which does not require ideal lattices. Instead, they show that the somewhat homomorphic component of Gentry's ideal lattice-based scheme can be replaced with a very simple somewhat homomorphic scheme that uses integers. The scheme is therefore conceptually simpler than Gentry's ideal lattice scheme, but has similar properties with regards to homomorphic operations and efficiency. The somewhat homomorphic component in the work of van Dijk et al. is similar to an encryption scheme proposed by Levieil and Naccache in 2008,^[16] and also to one that was proposed by Bram Cohen in 1998.^[17] Cohen's method is not even additively homomorphic, however. The Levieil–Naccache scheme supports only additions, but it can be modified to also support a small number of multiplications. Many refinements and optimizations of the scheme of van Dijk et al. were proposed in a sequence of works by Jean-Sébastien Coron, Tancrède Lepoint, Avradip Mandal, David Naccache, and Mehdi Tibouchi.^[18]^[19]^[20]^[21] Some of these works included also implementations of the resulting schemes.

The 2nd generation of homomorphic cryptosystems

Several new techniques that were developed starting in 2011-2012 by Zvika Brakerski, Craig Gentry, Vinod Vaikuntanathan, and others, led to the development of much more efficient somewhat and fully homomorphic cryptosystems. These include:

The Brakerski-Gentry-Vaikuntanathan cryptosystem (BGV),^[22] building on techniques of Brakerski-Vaikuntanathan.^[23]
Brakerski's scale-invariant cryptosystem.^[24]
The NTRU-based cryptosystem due to Lopez-Alt, Tromer, and Vaikuntanathan (LTV).^[25]
The Gentry-Sahai-Waters cryptosystem (GSW).^[26]
The Fan-Vercauteren cryptosystem (FV).^[27]

The security of most of these schemes is based on the hardness of the Learning with errors problem, except for the LTV scheme whose security is based on a variant of the NTRU computational problem, and the FV scheme which is based on the Ring Learning with errors variant of this problem. The distinguishing characteristic of these cryptosystems is that they all feature much slower growth of the noise during the homomorphic computations. Additional optimizations by Craig Gentry, Shai Halevi, and Nigel Smart resulted in cryptosystems with nearly optimal asymptotic complexity: Performing $T$ operations on data encrypted with security parameter $k$ has complexity of only $T\cdot \mathrm {polylog} (k)$ .^[28]^[29]^[30] These optimizations build on the Smart-Vercauteren techniques that enables packing of many plaintext values in a single ciphertext and operating on all these plaintext values in a SIMD fashion.^[12] Many of the advances in these second-generation cryptosystems were also ported to the cryptosystem over the integers.^[20]^[21]

Zvika Brakerski and Vinod Vaikuntanathan observed that for certain types of circuits, the GSW cryptosystem features an even slower growth rate of noise, and hence better efficiency and stronger security.^[31] Jacob Alperin-Sheriff and Chris Peikert then described a very efficient bootstrapping technique that uses exactly this type of circuits^[32] This type of circuits, however, seems incompatible with the ciphertext-packing techniques, and hence the Gentry-Halevi-Smart optimizations^[28] cannot be applied here.

The first one-way, homomorphically encrypted, Euclidean-measurable feature vector for biometric processing was proposed in a paper by Streit, Streit and Suffian in 2017. ^[33] In this paper, the authors theorized and also demonstrated using a small sample size (n=256 faces) that (1) it was possible to use neural networks to build a cryptosystem for biometrics that produced one-way, fully homomorphic feature vectors composed of normalized floating-point values; (2) the same neural network would also be useful for 1:1 verification (matching); and (3) the same neural network would not be useful in 1:many identification tasks since search would occur in linear time (i.e. non polynomial). The paper’s first point was (in theory) later shown to be true, and the papers first, second and third points were later shown to be true only for small samples but not for larger samples.

A later tutorial (blog posting) by Mandel in 2018 demonstrated a similar approach to Streit, Streit and Suffian and confirmed using a Frobenius 2 distance function to determine the closeness of two feature vectors. In this posting, Mandel used a Frobenius 2 distance function to determine the closeness of two feature vectors and also demonstrated successful 1:1 verification. Mandel did not offer a scheme for 1:many identification as this method would have required a non polynomial full linear scan of the entire database. The Streit, Streit and Suffian paper attempted a novel “banding” approach for 1:many identification in order to mitigate the full linear scan requirement, but it is now understood that this approach produced too much overlap to help in identification. ^[34]

All the second-generation cryptosystems still follow the basic blueprint of Gentry's original construction, namely they first construct a somewhat-homomorphic cryptosystem that handles noisy ciphertexts, and then convert it to a fully homomorphic cryptosystem using bootstrapping.

Implementations

The first reported implementation of fully homomorphic encryption is the Gentry-Halevi implementation mentioned above of Gentry's original cryptosystem;^[14] they reported timing of about 30 minutes per basic bit operation. The second-generation schemes made this implementation obsolete, however.

Many implementations of second-generation somewhat-homomorphic cryptosystems were reported in the literature. An early implementation from 2012 due to Gentry, Halevi, and Smart (GHS)^[30] of a variant of the BGV cryptosystem,^[22] reported evaluation of a complex circuit (implementing the encryption procedure of the AES cipher) in 36 hours. Using the packed-ciphertext techniques, that implementation could evaluate the same circuit on 54 different inputs in the same 36 hours, yielding amortized time of roughly 40 minutes per input. This AES-encryption circuit was adopted as a benchmark in several follow-up works,^[20]^[35]^[36] gradually bringing the evaluation time down to about four hours and the per-input amortized time to just over 7 seconds.

In May 2018 the first commercial implementation of private biometrics (privatebiometrics.com) was published, by Open Inference Holdings LLC. The vendor used novel machine learning models to generate 4kB private biometric feature vectors and thus allowed similarity both between vectors to be calculated (1:1 verification) and achieved cryptography’s “holy grail” ^[37] by using the same method to provide 1:many identification in polynomial time across a large biometrics database (100 million faces).

On the client device, privatebiometrics.com transforms each reference biometric (template) into a one-way, fully homomorphic, Euclidean-measurable feature vector using matrix multiplication from the neural network that may then be stored locally or transmitted. The original biometric is deleted immediately after the feature vector is computed or, if the solution is embedded in firmware, the biometric is transient and never stored. Once the biometric is deleted, it is no longer possible to lose or compromise the biometric. ^[38]

The private biometric feature vector can be used in one of two ways. If the feature vector is stored locally, it may be used to compute 1:1 verification with high accuracy (99% or greater) using linear mathematics. If the feature vector is also stored in a Cloud, the feature vector may also be used as an input for a neural network to perform 1:many identification with the same accuracy, speed and privacy as the original plaintext reference biometric (template). ^[38]

Three implementations of second-generation homomorphic cryptosystems are available in open source libraries:

the HElib library^[39] due to Shai Halevi and Victor Shoup that implements the BGV cryptosystem with the GHS optimizations,
the FHEW library^[40] due to Leo Ducas and Daniele Micciancio that implements a combination of Regev's LWE cryptosystem with the bootstrapping techniques of Alperin-Sheriff and Peikert,^[32] and
the TFHE library^[41] due to Ilaria Chillotti, Nicolas Gama, Mariya Georgieva and Malika Izabachene that proposes a faster variant over the Torus with an intuitive API to evaluate boolean circuits.

All these libraries implement fully homomorphic encryption including bootstrapping. HElib reports a time of 5–10 minutes for bootstrapping a packed ciphertext with about 1000 plaintext values,^[42] FHEW reports a time of around 1/2 second for bootstrapping a non-packed ciphertext encrypting a single bit,^[43] and TFHE reports a time of 13 milliseconds for evaluating any bootstrapped binary gate on non-packed ciphertexts encrypting a single bit.^[44]

In late 2014, a re-implementation of homomorphic evaluation of the AES-encryption circuit using HElib reported an evaluation time of just over 4 minutes on 120 inputs, bringing the amortized per-input time to about 2 seconds.^[39]

Applications

Encrypted database querying

Typical database encryption leaves the database encrypted at rest, but when queries are performed the data must be decrypted in order to be parsed. Homomorphic encryption schemes have been devised such that database queries can run against ciphertext data directly.^[45] It must be noted that in this paper, the authors have accepted that they have used simple and non secure homomorphic scheme and still it takes a huge toll on the performance. For e.g. a 16 bit multiplication takes approximately 24 minutes.

Bitcoin split-key vanity mining

Bitcoin addresses are hashes of public keys from ECDSA key pairs. A vanity address is an address generated from parameters such that the resultant hash contains a human-readable string (e.g., 1BoatSLRHtKNngkdXEeobR76b53LETtpyT). Given that ECDSA key pairs have homomorphic properties for addition and multiplication, one can outsource the generation of a vanity address without having the generator know the full private key for this address.

For example,

Alice generates a private key (a) and public key (A) pair, and publicly posts A.
Bob generates a key pair (b, B) such that hash(A + B) results in a desired vanity address. He sells b and B to Alice. A, B, and b are publicly known, so one can verify that the address = hash(A + B) is desired.
Alice computes the combined private key (a + b) and uses it as the private key for the public key (A + B).

Similarly, multiplication could be used instead of addition.

References

↑ Craig Stuntz (2010-03-18). "What is Homomorphic Encryption, and Why Should I Care?".
↑ Ron Rivest (2002-10-29). "Lecture Notes 15: Voting, Homomorphic Encryption" (PDF).
↑ Daniele Micciancio (2010-03-01). "A First Glimpse of Cryptography's Holy Grail". Association for Computing Machinery. p. 96. Retrieved 2010-03-17.
↑ R. L. Rivest, L. Adleman, and M. L. Dertouzos. On data banks and privacy homomorphisms. In Foundations of Secure Computation, 1978.
↑ Sander, Tomas; Young, Adam L.; Yung, Moti. "Non-Interactive CryptoComputing For NC1". FOCS1991. IEEE.
↑ D. Boneh, E. Goh, and K. Nissim. Evaluating 2-DNF Formulas on Ciphertexts. In Theory of Cryptography Conference, 2005.
↑ Y. Ishai and A. Paskin. Evaluating branching programs on encrypted data. In Theory of Cryptography Conference, 2007.
↑ Craig Gentry. Fully Homomorphic Encryption Using Ideal Lattices. In the 41st ACM Symposium on Theory of Computing (STOC), 2009.
↑ Craig Gentry. "A Fully Homomorphic Encryption Scheme (Ph.D. thesis)" (PDF).
↑ Stehle, Damien; Steinfeld, Ron. "Faster Fully Homomorphic Encryption". Asiacrypt 2010. Springer.
↑ Smart, Nigel P.; Vercauteren, Frederik. "Fully homomorphic encryption with relatively small key and ciphertext sizes". PKC 2010. Springer.
1 2 Smart, Nigel P.; Vercauteren, Frederik (2014). "Fully Homomorphic SIMD Operations". Designs, Codes and Cryptography. Springer. 71 (1): 57–81.
↑ Gentry, Craig; Halevi, Shai. "Fully Homomorphic Encryption without Squashing Using Depth-3 Arithmetic Circuits". FOCS 2011. IEEE.
1 2 Gentry, Craig; Halevi, Shai. "Implementing Gentry's fully-homomorphic encryption scheme". EUROCRYPT 2011. Springer.
↑ Marten, van Dijk; Gentry, Craig; Halevi, Shai; Vinod, Vaikuntanathan. "Fully Homomorphic Encryption over the Integers". EUROCRYPT 2010. Springer.
↑ Levieil, Eric; Naccache, David. "Cryptographic Test Correction" (PDF).
↑ Cohen, Bram. "Simple Public Key Encryption". Archived from the original on 2011-10-07.
↑ Coron, Jean-Sébastien; Naccache, David; Tibouchi, Mehdi. "Public Key Compression and Modulus Switching for Fully Homomorphic Encryption over the Integers". EUROCRYPT 2012. Springer.
↑ Coron, Jean-Sébastien; Mandal, Avradip; Naccache, David; Tibouchi, Mehdi. "Fully Homomorphic Encryption over the Integers with Shorter Public Keys". CRYPTO 2011. Springer.
1 2 3 Coron, Jean-Sébastien; Lepoint, Tancrède; Tibouchi, Mehdi. "Batch Fully Homomorphic Encryption over the Integers". EUROCRYPT 2013. Springer.
1 2 Coron, Jean-Sébastien; Lepoint, Tancrède; Tibouchi, Mehdi. "Scale-Invariant Fully Homomorphic Encryption over the Integers". PKC 2014. Springer.
1 2 Z. Brakerski, C. Gentry, and V. Vaikuntanathan. Fully Homomorphic Encryption without Bootstrapping. In ITCS 2012
↑ Z. Brakerski and V. Vaikuntanathan. Efficient Fully Homomorphic Encryption from (Standard) LWE. In FOCS 2011 (IEEE)
↑ Z. Brakerski. Fully Homomorphic Encryption without Modulus Switching from Classical GapSVP. In CRYPTO 2012 (Springer)
↑ A. Lopez-Alt, E. Tromer, and V. Vaikuntanathan. On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption. In STOC 2012 (ACM)
↑ C. Gentry, A. Sahai, and B. Waters. Homomorphic Encryption from Learning with Errors: Conceptually-Simpler, Asymptotically-Faster, Attribute-Based. In CRYPTO 2013 (Springer)
↑ Fan, Junfeng; Vercauteren, Frederik (2012). "Somewhat Practical Fully Homomorphic Encryption".
1 2 C. Gentry, S. Halevi, and N. P. Smart. Fully Homomorphic Encryption with Polylog Overhead. In EUROCRYPT 2012 (Springer)
↑ C. Gentry, S. Halevi, and N. P. Smart. Better Bootstrapping in Fully Homomorphic Encryption. In PKC 2012 (SpringeR)
1 2 C. Gentry, S. Halevi, and N. P. Smart. Homomorphic Evaluation of the AES Circuit. In CRYPTO 2012 (Springer)
↑ Z. Brakerski and V. Vaikuntanathan. Lattice-Based FHE as Secure as PKE. In ITCS 2014
1 2 J. Alperin-Sheriff and C. Peikert. Faster Bootstrapping with Polynomial Error. In CRYPTO 2014 (Springer)
↑ Streit, S. Streit, B and Suffian S. “Privacy-Enabled Biometric Search.” CoRR. 1708.04726 (2017).
↑ Mandal, Arun. “MTCNN Face Detection and Matching using Facenet Tensorflow.” Python 3.6. Posted: 2018-02-16. Accessed 2018-07-15
↑ Y. Doroz, Y. Hu, and B. Sunar. Homomorphic AES Evaluation using NTRU. In Financial Cryptography 2014
↑ Wei Dai; Yarkin Doroz; Berk Sunar. "Accelerating NTRU based Homomorphic Encryption using GPUs".
↑ David J. Wu. 2015. Fully Homomorphic Encryption: Cryptography's holy grail. XRDS 21, 3 (March 2015), 24-29.
1 2 PrivateBiometrics.com
1 2 Shai Halevi; Victor Shoup. "HElib: An Implementation of homomorphic encryption". Retrieved 31 December 2014.
↑ Leo Ducas; Daniele Micciancio. "FHEW: A Fully Homomorphic Encryption library". Retrieved 31 December 2014.
↑ Ilaria Chillotti; Nicolas Gama; Mariya Georgieva; Malika Izabachene. "Faster Fully Homomorphic Encryption: Bootstrapping in less than 0.1 Seconds". Retrieved 31 December 2016.
↑ Halevi, Shai; Shoup, Victor. "Bootstrapping for HElib". Cryptology ePrint archive. Retrieved 2 January 2015.
↑ Ducas, Léo; Micciancio, Daniele. "FHE Bootstrapping in less than a second". Cryptology ePrint archive. Retrieved 2 January 2015.
↑ Chillotti, Ilaria; Gama, Nicolas; Georgieva, Mariya; Izabachene, Malika. "Improving TFHE: faster packed homomorphic operations and efficient circuit bootstrapping". Cryptology ePrint archive. Retrieved 2 May 2017.
↑ Gahi, Youssef; Guennoun, Mouhcine; El-Khatib, Khalil (11 Dec 2015). "A Secure Database System using Homomorphic Encryption Schemes". arXiv:1512.03498.

External links

The Swiss Army Knife of Cryptography
PrivateBiometrics.com
technovelgy.com, Biometric Match
Homomorphic encryption in Cryptology Pointers
"Alice and Bob in Cipherspace". American Scientist. September 2012. Retrieved 2018-05-08.
The Homomorphic Encryption Project
The Open Source hcrypt Project
HElib, open source homomorphic encryption library for C++
FHEW, open source homomorphic encryption library for C and C++
TFHE, open source homomorphic encryption library for C and C++

This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.

[1] Craig Stuntz (2010-03-18). "What is Homomorphic Encryption, and Why Should I Care?".

[2] Ron Rivest (2002-10-29). "Lecture Notes 15: Voting, Homomorphic Encryption" (PDF).

[3] Daniele Micciancio (2010-03-01). "A First Glimpse of Cryptography's Holy Grail". Association for Computing Machinery. p. 96. Retrieved 2010-03-17.

[4] R. L. Rivest, L. Adleman, and M. L. Dertouzos. On data banks and privacy homomorphisms. In Foundations of Secure Computation, 1978.

[5] Sander, Tomas; Young, Adam L.; Yung, Moti. "Non-Interactive CryptoComputing For NC1". FOCS1991. IEEE.

[6] D. Boneh, E. Goh, and K. Nissim. Evaluating 2-DNF Formulas on Ciphertexts. In Theory of Cryptography Conference, 2005.

[7] Y. Ishai and A. Paskin. Evaluating branching programs on encrypted data. In Theory of Cryptography Conference, 2007.

[8] Craig Gentry. Fully Homomorphic Encryption Using Ideal Lattices. In the 41st ACM Symposium on Theory of Computing (STOC), 2009.

[9] Craig Gentry. "A Fully Homomorphic Encryption Scheme (Ph.D. thesis)" (PDF).

[10] Stehle, Damien; Steinfeld, Ron. "Faster Fully Homomorphic Encryption". Asiacrypt 2010. Springer.

[11] Smart, Nigel P.; Vercauteren, Frederik. "Fully homomorphic encryption with relatively small key and ciphertext sizes". PKC 2010. Springer.

[SV11-12] 1 2 Smart, Nigel P.; Vercauteren, Frederik (2014). "Fully Homomorphic SIMD Operations". Designs, Codes and Cryptography. Springer. 71 (1): 57–81.

[13] Gentry, Craig; Halevi, Shai. "Fully Homomorphic Encryption without Squashing Using Depth-3 Arithmetic Circuits". FOCS 2011. IEEE.

[GH11-14] 1 2 Gentry, Craig; Halevi, Shai. "Implementing Gentry's fully-homomorphic encryption scheme". EUROCRYPT 2011. Springer.

[15] Marten, van Dijk; Gentry, Craig; Halevi, Shai; Vinod, Vaikuntanathan. "Fully Homomorphic Encryption over the Integers". EUROCRYPT 2010. Springer.

[16] Levieil, Eric; Naccache, David. "Cryptographic Test Correction" (PDF).

[17] Cohen, Bram. "Simple Public Key Encryption". Archived from the original on 2011-10-07.

[CNT12-18] Coron, Jean-Sébastien; Naccache, David; Tibouchi, Mehdi. "Public Key Compression and Modulus Switching for Fully Homomorphic Encryption over the Integers". EUROCRYPT 2012. Springer.

[CMNT11-19] Coron, Jean-Sébastien; Mandal, Avradip; Naccache, David; Tibouchi, Mehdi. "Fully Homomorphic Encryption over the Integers with Shorter Public Keys". CRYPTO 2011. Springer.

[CLT13-20] 1 2 3 Coron, Jean-Sébastien; Lepoint, Tancrède; Tibouchi, Mehdi. "Batch Fully Homomorphic Encryption over the Integers". EUROCRYPT 2013. Springer.

[CLT14-21] 1 2 Coron, Jean-Sébastien; Lepoint, Tancrède; Tibouchi, Mehdi. "Scale-Invariant Fully Homomorphic Encryption over the Integers". PKC 2014. Springer.

[BGV12-22] 1 2 Z. Brakerski, C. Gentry, and V. Vaikuntanathan. Fully Homomorphic Encryption without Bootstrapping. In ITCS 2012

[BV11b-23] Z. Brakerski and V. Vaikuntanathan. Efficient Fully Homomorphic Encryption from (Standard) LWE. In FOCS 2011 (IEEE)

[Bra12-24] Z. Brakerski. Fully Homomorphic Encryption without Modulus Switching from Classical GapSVP. In CRYPTO 2012 (Springer)

[LTV12-25] A. Lopez-Alt, E. Tromer, and V. Vaikuntanathan. On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption. In STOC 2012 (ACM)

[GSW13-26] C. Gentry, A. Sahai, and B. Waters. Homomorphic Encryption from Learning with Errors: Conceptually-Simpler, Asymptotically-Faster, Attribute-Based. In CRYPTO 2013 (Springer)

[27] Fan, Junfeng; Vercauteren, Frederik (2012). "Somewhat Practical Fully Homomorphic Encryption".

[GHS12a-28] 1 2 C. Gentry, S. Halevi, and N. P. Smart. Fully Homomorphic Encryption with Polylog Overhead. In EUROCRYPT 2012 (Springer)

[GHS12b-29] C. Gentry, S. Halevi, and N. P. Smart. Better Bootstrapping in Fully Homomorphic Encryption. In PKC 2012 (SpringeR)

[GHS12c-30] 1 2 C. Gentry, S. Halevi, and N. P. Smart. Homomorphic Evaluation of the AES Circuit. In CRYPTO 2012 (Springer)

[31] Z. Brakerski and V. Vaikuntanathan. Lattice-Based FHE as Secure as PKE. In ITCS 2014

[AP14-32] 1 2 J. Alperin-Sheriff and C. Peikert. Faster Bootstrapping with Polynomial Error. In CRYPTO 2014 (Springer)

[33] Streit, S. Streit, B and Suffian S. “Privacy-Enabled Biometric Search.” CoRR. 1708.04726 (2017).

[34] Mandal, Arun. “MTCNN Face Detection and Matching using Facenet Tensorflow.” Python 3.6. Posted: 2018-02-16. Accessed 2018-07-15

[35] Y. Doroz, Y. Hu, and B. Sunar. Homomorphic AES Evaluation using NTRU. In Financial Cryptography 2014

[36] Wei Dai; Yarkin Doroz; Berk Sunar. "Accelerating NTRU based Homomorphic Encryption using GPUs".

[37] David J. Wu. 2015. Fully Homomorphic Encryption: Cryptography's holy grail. XRDS 21, 3 (March 2015), 24-29.

[PB-38] 1 2 PrivateBiometrics.com

[HElib-39] 1 2 Shai Halevi; Victor Shoup. "HElib: An Implementation of homomorphic encryption". Retrieved 31 December 2014.

[FHEW-40] Leo Ducas; Daniele Micciancio. "FHEW: A Fully Homomorphic Encryption library". Retrieved 31 December 2014.

[TFHE-41] Ilaria Chillotti; Nicolas Gama; Mariya Georgieva; Malika Izabachene. "Faster Fully Homomorphic Encryption: Bootstrapping in less than 0.1 Seconds". Retrieved 31 December 2016.

[HS14b-42] Halevi, Shai; Shoup, Victor. "Bootstrapping for HElib". Cryptology ePrint archive. Retrieved 2 January 2015.

[DM14-43] Ducas, Léo; Micciancio, Daniele. "FHE Bootstrapping in less than a second". Cryptology ePrint archive. Retrieved 2 January 2015.

[CGGI17-44] Chillotti, Ilaria; Gama, Nicolas; Georgieva, Mariya; Izabachene, Malika. "Improving TFHE: faster packed homomorphic operations and efficient circuit bootstrapping". Cryptology ePrint archive. Retrieved 2 May 2017.

[45] Gahi, Youssef; Guennoun, Mouhcine; El-Khatib, Khalil (11 Dec 2015). "A Secure Database System using Homomorphic Encryption Schemes". arXiv:1512.03498.