Archivecryptography
Homomorphic Encryption: Compute on Ciphertext
FHE is real and still expensive. Know which variant matches your operation before committing.
- Published
- Reading time
- 1 min read
Homomorphic encryption lets a server compute on encrypted data and return an encrypted result that decrypts to the correct answer. The client never shares keys.
Variants
- Partially homomorphic: one operation (RSA is multiplicatively homomorphic; Paillier is additively homomorphic).
- Somewhat homomorphic: limited depth of both operations.
- Fully homomorphic (FHE): arbitrary circuits, with noise growth requiring bootstrapping.
The cost
Ciphertexts are large (kilobytes per number), operations are orders of magnitude slower than plaintext, and bootstrapping is expensive. Practical deployments target specific workloads: private set intersection, encrypted analytics, certain ML inference.
Alternatives
- Secure multi-party computation for joint computation without a trusted server.
- Trusted execution environments when the threat model allows hardware trust.
- Differential privacy when aggregate answers suffice.
Takeaway: FHE is not a drop-in for a database. Match the operation class and latency budget, or use MPC/TEE where they fit better.