The paper presents a fully homomorphic encryption scheme with relatively small key and ciphertext sizes. The scheme is based on a "somewhat" homomorphic encryption scheme, which is constructed from a somewhat homomorphic scheme by Gentry. The public and private keys consist of two large integers, and the ciphertext is a single large integer, leading to smaller message expansion and key sizes compared to Gentry's original scheme. The proposal allows efficient fully homomorphic encryption over any field of characteristic two.
The scheme is described using the elementary theory of algebraic number fields, making it simpler to understand than Gentry's lattice-based approach. The scheme is parametrized by an integer \( N \), and the parameters are typically set to \( (N, 2\sqrt{N}, \sqrt{N}) \). The public key consists of a prime \( p \) and an integer \( \alpha \) modulo \( p \), while the private key can be an integer \( z \) (for bits) or a polynomial \( Z(x) \) of degree \( N-1 \) (for binary polynomials).
Encryption involves encoding the message as a binary polynomial, adding a random polynomial, and evaluating the result at \( \alpha \) modulo \( p \). Decryption involves multiplying the ciphertext by \( z \) and dividing by \( p \), rounding the result, and subtracting it from the ciphertext to recover the plaintext.
The paper also discusses the analysis of the scheme, including key recovery, one-wayness of encryption, and semantic security. It shows that the scheme is a specialization and simplification of Gentry's lattice-based scheme, with smaller key sizes and ciphertexts. The security of the scheme is based on the small principal ideal problem, which is a well-studied problem in computational number theory.
Finally, the paper extends the somewhat homomorphic scheme to a fully homomorphic scheme by introducing a re-encryption algorithm called Recrypt, which reduces the error terms in the ciphertext. This allows for fully homomorphic encryption on \( N \)-bit messages, providing a powerful tool for homomorphic operations in finite fields of characteristic two.The paper presents a fully homomorphic encryption scheme with relatively small key and ciphertext sizes. The scheme is based on a "somewhat" homomorphic encryption scheme, which is constructed from a somewhat homomorphic scheme by Gentry. The public and private keys consist of two large integers, and the ciphertext is a single large integer, leading to smaller message expansion and key sizes compared to Gentry's original scheme. The proposal allows efficient fully homomorphic encryption over any field of characteristic two.
The scheme is described using the elementary theory of algebraic number fields, making it simpler to understand than Gentry's lattice-based approach. The scheme is parametrized by an integer \( N \), and the parameters are typically set to \( (N, 2\sqrt{N}, \sqrt{N}) \). The public key consists of a prime \( p \) and an integer \( \alpha \) modulo \( p \), while the private key can be an integer \( z \) (for bits) or a polynomial \( Z(x) \) of degree \( N-1 \) (for binary polynomials).
Encryption involves encoding the message as a binary polynomial, adding a random polynomial, and evaluating the result at \( \alpha \) modulo \( p \). Decryption involves multiplying the ciphertext by \( z \) and dividing by \( p \), rounding the result, and subtracting it from the ciphertext to recover the plaintext.
The paper also discusses the analysis of the scheme, including key recovery, one-wayness of encryption, and semantic security. It shows that the scheme is a specialization and simplification of Gentry's lattice-based scheme, with smaller key sizes and ciphertexts. The security of the scheme is based on the small principal ideal problem, which is a well-studied problem in computational number theory.
Finally, the paper extends the somewhat homomorphic scheme to a fully homomorphic scheme by introducing a re-encryption algorithm called Recrypt, which reduces the error terms in the ciphertext. This allows for fully homomorphic encryption on \( N \)-bit messages, providing a powerful tool for homomorphic operations in finite fields of characteristic two.