Fully Homomorphic Encryption (FHE)
Takeaway
FHE lets you compute on encrypted data without decrypting; the result decrypts to the same output as computing on plaintext, enabling private cloud computation.
The problem (before → after)
- Before: You must reveal data to compute on it, risking privacy and leakage.
- After: Encrypt once; untrusted servers evaluate circuits homomorphically; only the data owner decrypts the result.
Mental model first
Think of a locked glovebox: you insert inputs and gloves let the operator manipulate objects without opening the box. Computation happens inside; the key never leaves your pocket.
Just-in-time concepts
- Homomorphism: Enc(E(x) ⊕ Enc(E(y))) decrypts to x ⊕ y for supported ops.
- Bootstrapping: Refresh noisy ciphertexts by homomorphically evaluating the decryption circuit.
- Lattice schemes (LWE/RLWE): Hardness underpins security and efficiency.
First-pass solution
Use leveled HE for bounded-depth circuits; add bootstrapping to support arbitrary depth → fully homomorphic.
Iterative refinement
- CKKS supports approximate arithmetic; BFV/BGV support exact modular arithmetic.
- Packing/SIMD encodes vectors to amortize costs.
- Hybrid MPC+HE and trusted hardware combine strengths.
Principles, not prescriptions
- Trade accuracy, depth, and performance; choose schemes per workload.
- Keep secret keys off-server; minimize bootstrapping calls.
Common pitfalls
- Underestimating latency and memory overheads.
- Ignoring noise growth and parameter selection.
Connections and contrasts
- See also: [/blog/secure-multiparty-computation], [/blog/zero-knowledge-proofs], [/blog/differential-privacy].
Quick checks
- Why bootstrapping? — To reset noise and allow unbounded depth.
- Why lattices? — Post-quantum hardness assumptions enabling practical schemes.
- When use CKKS vs BFV? — Approximate real arithmetic vs exact integer arithmetic.
Further reading
- Gentry’s thesis (source above); SEAL/HElib docs