Towards Practical Homomorphic Encryption with Efficient Public key Generation

ACEEE Int. J. on Network Security , Vol. 03, No. 04, Oct 2012

Towards Practical Homomorphic Encryption with
Efficient Public key Generation
Y Govinda Ramaiah, G Vijaya Kumari
Department of Computer Science and Engineering,
JNTUH College of Engineering, Hyderabad, India
Email: {ygovinda, dr.gvk}@ieee.org
means the size of the ciphertext should remain same (within
the required bounds) irrespective of the function being
evaluated. In his first construction, Gentry has formulated a
three-step procedure to obtain an FHE scheme satisfying
these requirements. This procedure includes, 1) Constructing
a Somewhat Homomorphic Encryption (SHE) scheme that
supports many additions, but, only a limited number of
multiplications, 2) Squashing the decryption function of the
SHE so that the scheme can evaluate its own decryption
function (bootstrappability), and 3) obtaining the FHE by
applying a ciphertext refreshing method periodically, for
bootstrapping, to bring back the noise in the ciphertexts to
the required low level once it exceeds a threshold value
[2][3][6].
The FHE schemes developed so far based on the above
blueprint are inefficient and impractical because of the
colossal difference between the computational complexities
of processing the ciphertexts and the corresponding plaintexts
[12]. The major factors contributing to these high
computational complexities are huge public key, large
message expansion and the ciphertext refreshing Recrypt
procedure.
Many of the existing homomorphic encryption schemes
support unlimited additions, and supporting unlimited
multiplications is the main hindrance. In fact, the ciphertext
refreshing procedure in the Gentry’s FHE is introduced to
allow for unlimited multiplications on ciphertexts. The issue
of practicality of the FHE schemes arise several important
questions. Principally, is it really necessary to follow the
above blueprint for constructing an FHE scheme? How many
multiplications on ciphertexts are required for any application
in practice for supporting encrypted data processing? Or in
other words, do we really need an FHE with capability of
supporting unlimited multiplications? Several works
[17][31][32] have tried to provide answers to these questions
in the form of developing an SHE scheme suitable for certain
practical applications. The essence is that, in practice there
are several applications which involve many additions but, a
few number of multiplications in the functions they use for
manipulation of data, and hence an SHE scheme is sufficient
for processing the encrypted data in these applications
[11][17][19][20]. Despite this fact, no practical SHE schemes
exist yet.

Abstract—With the advent of cloud computing several security
and privacy challenges are put forth. To deal with many of
these privacy issues, ‘processing the encrypted data’ has been
identified as a potential solution, which requires a Fully
Homomorphic Encryption (FHE) scheme. After the
breakthrough work of Craig Gentry in devising an FHE,
several new homomorphic encryption schemes and variants
have been proposed. However, all those theoretically feasible
schemes are not viable for practical deployment due to their
high computational complexities. In this work, a variant of
the DGHV’s integer based Somewhat Homomorphic
Encryption (SHE) scheme with an efficient public key
generation method is presented. The complexities of various
algorithms involved in the scheme are significantly low. The
semantic security of the variant is based on the two-element
Partial Approximate Greatest Common Divisors (PAGCD)
problem. Experimental results prove that the proposed scheme
is very much efficient than any other integer based SHE
scheme existing today and hence practical.
Index Terms—Homomorphic Encryption, Implementation,
Practicality, Efficient public key, Cloud security, Privacy.

I. INTRODUCTION
A Fully Homomorphic Encryption (FHE) scheme or a
privacy homomorphism [1] supports “processing the data
while it is encrypted”[2][3]. The research on the topic has
gained momentum after Craig Gentry’s first construction of
such a scheme [2][3] based on the algebraic lattice theory in
the year 2009. Since an FHE scheme allows delegation of
computational tasks to the remote untrustworthy server,
Gentry’s breakthrough work has become an attractive
solution, particularly for the security and privacy problems
of cloud computing and the related applications. However,
existing solutions are theoretically promising, but, far away
from practical implementation due to high computational
complexities involved.
In simple words, an encryption scheme is said to be fully
homomorphic when unlimited addition and multiplication
operations are supported on the ciphertexts generated by it
[2][3][6]. Such a scheme will have the capability to compute
arbitrarily any function on the encrypted data. Data is
encrypted bitwise, and the circuit representation of functions
is exploited in order to evaluate a function on the ciphertexts.
Apart from the two general requirements semantic security
and correctness of the scheme, an FHE should meet two
additional requirements, compactness and circuit privacy
[5]. Achieving compactness poses a great challenge, which
© 2012 ACEEE
DOI: 01.IJNS.3.4.1071

A. Related work and recent advances
Soon after the Gentry’s FHE invention, three major variant
schemes have appeared following the blueprint of his
10

construction. The first of these was devised by Smart and
Vercauteren [4], the second one was by Van Dijk et.al. [5],
and the third variant was by Brakerski and Vaikuntanathan
[11]. Stehlé and Steinfeld [7] suggested two optimizations to
Gentry’s scheme that lead to improvement in the complexity
of decryption process from Õ(n6) to Õ(n3.5). Ogura et al. [8],
Scholl and Smart [15] have proposed improvements to the
key generation algorithm of Gentry’s FHE scheme. The FHE
of Brakerski and Vaikuntanathan [10] eliminated the step-2,
i.e., squashing the decryption function, of Gentry’s blueprint.
A different technique was used by Gentry and Halevi [16] to
eliminate this squashing step, which involves expressing the
decryption function of the SHE as a depth-3 arithmetic circuit
and switching between Multiplicatively Homomorphic
Encryption (MHE) mode and SHE mode during the
homomorphic evaluation of that circuit. Lauter, Naehrig and
Vaikuntanathan [17] demonstrated the construction of an
SHE, which can efficiently evaluate low degree functions.
Brakerski et al.’s work [12] completely eliminated the
bootstrapping process.
The first attempt in the implementation of an FHE is by
Smart and Vercauteren [4], but, they could not implement the
bootstrappable version due to the assumption that the
determinant of the lattice they used should be prime.
Eliminating this prime determinant requirement and combining
with several optimizations Gentry and Halevi [18]
demonstrated the first implementation of the Gentry’s original
ideal lattice based scheme. Coron et.al.[9] have described the
first implementation of integer based FHE scheme of [5]. Their
major contribution was in reducing the public key size of the
scheme in [5] from Õ(n 10) to Õ(n7). Other efforts in
implementing the variants of Gentry’s scheme are, integer
based symmetric key FHE implementation by Jibang Liu et al.
[21], proof-of-concept implementation of Brakerski et al.’s
SHE scheme [11] by Lauter et al. [17], Gentry’s SHE
implementation by Michal MikuŠ [13] and Smart and
Vercauteren’s FHE implementation by Henning Perl et al. [14].
The work of Vinod Vaikuntanathan [19] provides an expository
survey of the recent advances in homomorphic cryptography.
Jing-Li et al. [28] described the extension of Gentry’s scheme
[3] to larger message space. Govinda Ramaiah and Vijaya
Kumari [29] and Hao-Miao Yang et al. [31] have proposed
similar variant of the integers based scheme of [5] in separate
works with an efficient public key generation method, which
leads to a public key of size Õ(n3). Nevertheless, the scheme
proposed by [29] uses a simple and straightforward method
to achieve compactness. Coron et al.’s work [30] was an
optimization of their previous work [9] in reducing the size of
the public key of [5] to Õ(n5). Very recently another variant
SHE is proposed by Govinda Ramaiah and Vijaya Kumari
[32]. This scheme is capable of encrypting many bits together
or integer plaintexts.

show that, the computational complexities are drastically
reduced, when compared to any other integer based SHE
scheme existing today. This makes the proposed solution
close to deployment in suitable practical applications. The
method of key generation when combined with ciphertext
refreshing procedure described in [5] using the optimization
suggested by [7] leads to an efficient FHE scheme
comparatively.
II. PRELIMINARIES
A. Notation and basics
In this paper, lower case italic letters denote the parameters
used to represent sizes (bit-length) of various integers.
Similarly, upper case letters denote the integers and real
numbers, and bold upper case letters denote the sets. X
indicates rounding of the real number X to the nearest integer
that is unique in the open interval (X-1/2, X+1/2]. The quotient
and remainder resulting from the division Z/P are designated
by QP(Z) = Z/P , and RP(Z) = Z - QP(Z)P, respectively . The
notation [Z]P or Z mod P is used interchangeably to represent
modulo operation of Z with respect to P, which results in
RP(Z). Since QP(Z) is defined by rounding to the nearest
integer, RP(Z) (-P/2, P/2] when P is odd. lg X designates the
logarithm of X to the base 2. Choosing a random integer X
$
uniformly from a finite set S is indicated as X  S. The soft

oh notation f(n) = Õ(g(n)) is used to represent f(n) =
O(g(n)lgkg(n)) for some k, ignoring the logarithmic factors
and any other smaller additive complexities. A K-rough integer
is an integer not having prime factors smaller than the integer
K. It is suggested to refer [2], [3] and [5] for various definitions
related to Fully Homomorphic Encryption.

B. The DGHV scheme
In this section, the construction of Van Dijk et.al’s SHE
scheme over the integers [5] is described. Let, n denote the
security parameter.
e denotes size of the secret key integer. In order to support
homomorphism for sufficiently deeper circuits, e is taken
as
The public key consists of many approximate multiples
of the secret key integer. The approximate multiple of an integer
is obtained by adding a small error or noise integer to its
exact multiple.
t denotes the number of integers in the public key. To use
the leftover hash lemma (Lemma 2.1, [5]) in reducing the
security of the scheme to solving AGCD problem (defined
below), t is taken as
r denotes size of the noise in each of the public key integers.
To foil the brute-force attack against the noise, r is taken
as ω(lg n).
g denotes the size of each public key integer. For security
against the lattice based attacks on the underlying AGCD
problem, g is taken as ω(e2 lg n).

B. Contributions of this work
This paper presents a more concrete and secure version
of the SHE theoretically proposed in [29] with implementation
and more tangible performance details. Experimental results
© 2012 ACEEE
DOI: 01.IJNS.3.4.1071

11

print is applied. Since the optimizations suggested in this
work target only the underlying SHE, discussion is restricted
to the same in this paper. DGHV suggested different optimizations for achieving compactness. The simplest of those
optimizations involve publishing an exact multiple of the secret key P, and reducing the ciphertext modulo that exact
multiple after every addition and multiplication in Evaluate.
This method is followed by [9] also, and the same technique
is used for compactness of ciphertexts in the proposed
scheme. The security of DGHV scheme is based on the hard
problem of solving Approximate Greatest Common Divisors
(AGCD), which can be defined as follows.
Approximate Greatest Common Divisors Problem: The
(r, e, g)–Approximate Greatest Common Divisors problem is,
given polynomially many samples from the distribution
Dg,r(P), for a randomly choosen e-bit odd integer P, output P.

d denotes the size of the additional noise (d > r) used during
the encryption of a plaintext bit.
The parameter setting suggested by [5], claiming a
complexity of Õ(n10) is,
e = Õ(n2), r = n, d = 2n, g = Õ(n5), t = g + n
Figure.1 shows the DGHV’s SHE scheme with respect to the
above parameters.

III. THE GV SCHEME
In this section a more concrete and secure version of the
variant scheme proposed by Govinda Ramaiah and Vijaya
Kumari [29] with an efficient public key generation method is
presented. The public key consists of two big integers X0
and X1. Integer X0 is an exact multiple of the odd secret integer
P and X1 is an approximate multiple, i.e., multiple of P
containing some additive error R. To encrypt a plaintext bit
M, first the erroneous integer X1 of the public key is added
with some more additional noise R’, resulting in another big
integer say X2. This X2 is now multiplied with a random even
integer 2N, the result is added to the plaintext bit and the final
sum is reduced modulo the error-free integer X0 in the public
key. For homomorphic evaluation of a function, the addition
and multiplication operations in the corresponding
generalized binary circuit are performed over ciphertexts by
reducing the result of each addition and multiplication modulo
the error-free integer X0 in the public key. The security of the
scheme is reduced to the two-element Partial Approximate
Greatest Common Divisors (PAGCD) problem. The parameter
setting for the GV variant scheme is reviewed as follows.
For the given security parameter n,
e denotes the size of the secret key integer P. For achieving
homomorphism in evaluation of sufficiently deeper
circuits, e is taken as d (n lg2 n).
d is size of the multiplicative noise integer used for
encryption. To avoid the brute-force attack against it, the
size of this integer is taken as 2n.
r is the size of the noise in the public key integer X1, which
is taken as ω(lg n) to foil the brute-force attack against
the noise.
g is the number of bits in each of the public key integers.
Roughly, g is the size of the factor Q in the multiples of P,
in the public key. Since the public key consists of only
two elements, the attacks related to two-element PAGCD
problem (section IV) only are considered. Hence it is
claimed that, it is sufficient to take g > e against the
condition used in [5] as g > e2 to thwart lattice based
attacks on the AGCD problem with some arbitrary t number

Figure1. The DGHV Somewhat Homomorphic Encryption Scheme

The size of the public key in this scheme is Õ(n10) because, the public key consists of t = Õ(n5) integers each of
size g = Õ(n5). When the ciphertext expression (step 4 in
Encrypt) is expanded, it takes the form (M+2B+PQ). The term
(M+2B) << P, is the noise (the distance to the multiple PQ),
which makes C an approximate or near multiple of P. The main
problem which makes the scheme Somewhat Homomorphic
is the rapid growth in this noise during multiplication operation in Evaluate. For every multiplication, the bit length of
the resulting noise equals the sum of the bit lengths of the
multiplicand noises, which crosses the size of P/2 after certain number of multiplications, resulting in incorrect
decryption. Further, since P is odd it will not influence the
parity of C/P , and thus the decryption function can be
written as [[C]P]2 = [C- C/P ]2 ,which is equal to the XOR of
the Least Significant Bits (LSBs) of C and C/P , i.e., [[C]P]2
= LSB(C)
LSB( C/P ). Even though this squashed
version of the decryption function that involves a single
gate applied to only two bits looks simple, the computation
of C/P is so complex that the decryption circuit cannot
handle it [6]. To make the scheme bootstrappable and consequently obtaining FHE by overcoming this problem, the
ciphertext refreshing procedure suggested in Gentry’s blue
© 2012 ACEEE
DOI: 01.IJNS.3.4.1071

12

of elements. Therefore, g is taken as ω(e lg n).
The suggested parameter setting with respect to the
above discussion is, e = Õ(n2), r = n, d = 2n, and g = Õ(n3).
The GV’s SHE scheme is shown in Figure2. Superscript SP
denotes that the algorithms are related to the proposed variant
with Smaller Public key.
KeyGen SP (n):
1.

$
Sample P  (2



e-1

+1))

e

[2 , 2 ) to generate the secret

key. i.e., secret key is a random e-bit odd integer P.
r
r
$
2.
Sample R 
 (-2 , 2 ) to generate the noise for the

public key integer.
3.
Choose two g-bit random integers Q0, Q1. For this,
g
$
sample Qi 
 [0, 2 / P), for i = 0,1.

4.
Compute X0 = PQ0, and X1 = PQ1 + R.
5.
Repeat the steps 2 – 4, if [X0]2 = 0. That means, X0 will
be an odd integer. The condition X0 > X1 specified in the
DGHV scheme is omitted.
6.
Output the secret key SK = P and the public key
PK = (X0, X1).
EncryptSP (PK, M
1.

3.
4.

{0,1},

Choose a random d-bit integer N. For this, sample
$
N



2.

{0,1} ): To encrypt a plaintext bit M

[2 d-1, 2d).

$
Sample R’ 



r

r

(-2 , 2 ) to generate additional noise for

the public key integer X1.
Compute X2 = X1+ R’
Output the ciphertext C = [M + 2NX2]X

0

DecryptSP(SK, C) and EvaluateSP(PK, CKT, (C1,….,Ck)) algorithms
are same as that of the DGHV scheme with the only difference that,
for any two ciphertexts C1 and C2 during the generalized circuit
evaluation, every addition and multiplication operation is performed
as,
Add : Compute Ca = [C1 + C2] mod X0, and
Mul : Compute Cm = [C1C2] mod X0
Figure2. The GV Somewhat Homomorphic Encryption Scheme

The appealing feature of this scheme is the smaller public
key with only two integers of size Õ(n3) each. It is quite easy
to see that GV scheme is a variant of the DGHV scheme for
the chosen parameter setting. For EvaluateSP, corresponding
to the generalized circuit CKTg we have the following notion
of permitted circuit.
Permitted circuit: An arithmetic circuit with addition and
multiplication gates is called a permitted circuit for the GV
scheme if, for any set of integer inputs each < 2d in absolute
value, the maximum absolute value output by the circuit is
< 2e-2. We denote the set of permitted circuits as CKTp.
Theorem1. The GV scheme proposed is correct, compact
and is algebraically homomorphic for the given plaintext
M {0,1}, and for any circuit CKT CKTp.
Proof: Let us consider the fresh ciphertext output by
EncryptSP(PK, M). We have, C = [M + 2NX2] mod X0
= [M + 2N(R’+R+PQ1)] mod X0
= M+2N(R’+R)+P(2NQ1 – K Q0) for some integer K 0
= M+2B+PQ’ where B=N(R’+R), and Q’=(2NQ1 – KQ0). For
correct decryption of a ciphertext, the absolute value of the
term (M+2B) should be always less than P/2. For the fresh
ciphertexts, it is enough to verify the sizes of these values.
13
© 2012 ACEEE
DOI: 01.IJNS.3.4.1071

For the chosen parameters we have the bit length of (M+2B)
is d = 2n and the bit length of P is e = n2. This shows that, the
condition for correct decryption just discussed is satisfied.
Hence, DecryptSP works properly for all the fresh ciphertexts.
To prove the correctness with respect to EvaluateSP, we use
the notion of permitted circuit. It should be noted that, the
integers mentioned in the definition of the permitted circuit
corresponds to the noise in d ciphertexts.e-2 noise in the
the
The
fresh ciphertexts wille-1 <e 2 and we have 2 = P/2, for some
be
odd integer P [2 , 2 ). That means, when a permitted
circuit is applied to a set of ciphertext integers, the maximum
absolute value of the noise should be less than P/2, where P
is the minimum value of the secret key integer that can be
chosen. Now, in EvaluateSP, let the circuit CKTg is applied to
the ciphertext integers C1, ….., Ck and the resulting ciphertext
is C. Since the circuit CKTg CKTp, the resulting noise in C
after the EvaluateSP will be less than P/2 for any P chosen
from the specified interval for that particular instance of the
scheme, which shows that the decryption works properly
proving the correctness of EvaluateSP .
It is evident that the modular reduction results in an integer
the size of which is always less than or equal to the modulus.
Therefore, reduction with X0 produces an integer with size
|X0|. Since, |X0| is Õ(n3), this defines the bound for the
ciphertext compactness. Thus, the size of the ciphertext
resulting from EvaluateSP is always Õ(n3) irrespective of
the circuit CKT being evaluated, which proves the
compactness of the scheme. It can be easily verified that the
modular reduction with X0 affects only the PQ term in a
ciphertext and the noise remains unaltered. Hence, decryption
works properly even after the modular reduction with X0.
Let, C1=(M1+2B1+PQ1’), and C2=(M2+2B2+PQ2’) Addition
in EvaluateSP gives,
Ca=C1+C2 = (M1+M2)+2Ba+PQa , for some integers Ba and Qa.
Similarly, multiplication in EvaluateSP gives,
Cm = C1C2 = (M1M2 )+2Bm+PQm , for some integers Bm and Qm.
It can be seen that for the given values of R and P, the values
corresponding to the noise B and the integer Q in the fresh
ciphertexts as well as the ciphertexts resulting d from
d-1
EvaluateSP, all belong to the same intervals [2 , 2 ) and
g
[0, 2 /P) respectively whenever the circuit being evaluated
CKT CKTp. Hence, Ca decrypts to (M1+M2) and Cm decrypts
to (M1M2 ) correctly.
Lemma 1. Let f(x0,…..,xk) be a multivariate polynomial in k
variables with degree m and CKT be the corresponding
arithmetic circuit. Then, CKT CKTp if | f | (2d )

m

e-2

2 ,

where | f | is the l1 norm of the coefficient vector of f.
The above lemma defines the multiplicative capacity of
the scheme and in turn the set of permitted polynomials. The
number of multiplications supported corresponds to the
degree m of the permitted polynomials, which can be given
as,
m

(e -2-lg | f |) / d

identically to a valid encryption of ([RP(Z)]2+Mi) for all but a
negligible fraction of the public keys generated by the GV
scheme. Therefore, A has a noticeable advantage in guessing the plaintext bit encrypted under PK. Due to this, LSBQuotient will output LSB of (QP(Z)) with overwhelming probability.
For any two integers Z1 = RP(Z1)+PQP(Z1) and Z2 =
RP(Z2)+PQP(Z2), where the difference in the sizes of RP(Zi)
and P are as mentioned in the parameter setting, apply the
binary-GCD algorithm as described in [5] finding the parity
of both QP(Z1) and QP(Z2) from LSB-Quotient above. After
about O(g) iterations we get two integers say Z1’, Z2’ with
QP (Z2’) = 0 and QP (Z1’) = 1, which is the odd part of
GCD(QP(Z1), QP(Z2)). That means, we get finally some integer
Z =binary-GCD(Z1,Z2) = GCD(QP(Z1), QP(Z2))P+Rn = 1P+Rn for
some noise Rn.
To Recover P, the algorithm B takes the two public key
integers X0, X1 and applies the binary-GCD algorithm to them.
Note that X0, X1 are generated so that they have a common
hidden P. Also, since Q0, Q1 ( i.e., QP(X0), QP(X1)) are
chosen at random from a very large interval, according to the
theorem D, page 342, of [27], there is a very good probability
of 6/
0.61, that Q0, Q1 are co-prime (i.e., odd part of
GCD(Q0, Q1) is 1). Hence, GCD(X0, X1) will return some
r
Z = 1P + Rn, with |Rn| < 2 with high enough probability. Now,
again when the binary-GCD is applied to (X0, Z), the sequence
of parity bits of QP(X0) in all the iterations will be the binary
representation of QP(X0) = Q0. Since X0 is an exact multiple of
P, P = X0 / Q0.
Thus, B is a solver of PAGCD and its overall success
probability as analyzed in [5] is /2 and its running time is
polynomial in the running time of A, n and 1/ .
Lemma 2. Let the parameters e, g, r, d are set as specified
in the scheme. The secret key SK = P and the public key PK
= (X0, X1) are chosen according to the KeyGenSP. For every
g
r
integer Z [0, 2 ) , which is 2 away from a multiple of P,
,
consider the following distribution.

IV. SECURITY OF THE GV SCHEME
Since GV scheme is a variant of the DGHV’s SHE, the
same strategy employed by [5] and [9] can be followed to
base the security of the scheme on the hard problem of solving
a version of AGCD called Partial Approximate Greatest
Common Divisor (PAGCD).
Two-element PAGCD problem: The two-element (r, e, g) PAGCD problem is: For a random e-bit odd positive integer P,
given X0 = PQ0 and X1= PQ1+R, where Qi ( i=0,1), R are chosen
g
r
r
from the intervals [0, 2 /P), and (-2 , 2 ) respectively, output P.
Chen and Nguyen [23] shown that, solving PAGCD is
relatively easier than solving General AGCD. However, as
mentioned by them their attack’s implementation parameters
are suboptimal for medium and large challenges put forth by
Coron et. al.[9]. Hence, if the security parameter n is
appropriately chosen, the PAGCD problem will be intractable
ensuring the semantic security of the scheme. We have the
following theorem, similar to [5] in order to reduce the security
of our scheme to the two-element PAGCD problem.
Theorem 2. Let e, g, r, d be the parameters of the GV
scheme, which are polynomial in the security parameter n.
An adversary A with an advantage against the scheme
can be converted in to an algorithm B for solving the twoelement (r, e, g )-PAGCD problem with success probability
at least /2. The running time of B is polynomial in the
running time of A, n and 1/
Proof: Let A be the adversary against the GV scheme.
The input to A is the public key generated by KeyGenSP and
the ciphertext produced by EncryptSP. The output of A is the
plaintext bit M with probability 1/2+ for a non-negligible .
Now, as described in [5], the algorithm B that solves the twoelement (r, e, g)-PAGCD problem is as follows.
To start with, B takes the two public key integers
X0= PQ0, X1 = PQ1+R corresponding to an odd e-bit secret
key integer P, as generated by KeyGenSP. Using the subroutine
given in Figure3, B finds the LSB of the rquotient QP(Z) of a
g
given integer Z [0, 2 ), with |RP(Z)| < 2 .

d-1

Figure 3.Subroutine for predicting LSB of the quotient

In the line 5 of LSB-Quotient bi is the parity of QP(Z). This is
because, since P is odd we have, Parity(QP(Z))= Parity(RP(Z))
Parity(Z). In the following Lemma 2 we show that, the
ciphertext Ci in line 3 of LSB-Quotient is distributed almost
© 2012 ACEEE
DOI: 01.IJNS.3.4.1071

d

r

r

$
$
CPK(Z)={ N 
 )[2 , 2 ), R’ 


 (- 2 , 2 ) : Output
C’ = [Z + 2N(R’+X1)]X }
0
CPK(Z) is same as the distribution induced over the
ciphertexts generated by EncryptSP(PK, M = [[Z ]P]2), with
overwhelming probability.
Proof: For a given ciphertext C, the integer QP(C) is uniform in (-Q0/2, Q0/2] from the leftover hash lemma (Lemma 2.1,
[5]). Let C’=[Z+2N(R’+X1)]X = M’+2B’+PQ’, for some integers
0
B’ and Q’. Thus, the integer Z used to generate C’ can be
treated as a ciphertext generated by EncryptSP( PK, M’ ). This
r
is because, Z is 2 away from a multiple of P. Therefore, C’
corresponds to the result of homomorphic addition of two
ciphertexts corresponding to the plaintext bit (M’ + M) with
M = 0. Now, Theorem1 shows that C’ produces correct
plaintext up on decryption. Also, consider the integer hash
d-1
d
function family, h’: [2 , 2 ) 
 Q0 , where Q0 denotes
integers mod Q0 , and h’(N) = [2NQ1]Q , with N chosen from
d-1
d
0
[2 , 2 ). Clearly h’ is pair wise independent because, for any
d-1
d
two integers N1, N2 chosen from [2 , 2 ), with N1 N2,

14

Prh’[h’(N1)= h’( N2)] is quite negligible and is almost zero. This
is because, |Q0| >> |N| and since Q1, Q0 are fixed, modular
reduction of 2N(R’+X1) with Q0 always produces different
remainders for different values of N. Hence in C’, the value of
Q’ is also uniform in (-Q0/2, Q0/2] and the claim follows.
V. KNOWN ATTACKS
In the GV scheme, for a given security parameter n the
lowest possible size of the problem to solve the PAGCD
problem is the public key (X0, X1) for a given secret key integer
P because, the noise in X1 is very much less when compared
to the noise in the ciphertexts for a particular instance of the
scheme. Therefore, the attacks against the two-element
PAGCD problem only are described, i.e., against the public
key only, claiming that the high noise ciphertexts (approximate
multiples of P) successfully defend all these attacks.
1) Factoring the exact multiple: For the chosen
parameter values, the size of the exact multiple of P i.e., X0 is
big enough so that, even the best known integer factoring
algorithms such as the General Number Field Sieve [24] will
not be able to factor X0. Even if the factor P is targeted which
is smaller than the size of total Q0, algorithms such as Lenstra’s
elliptic curve factoring [25] takes about exp (O( e ))time to
find P. But, it is to be noted that P will not be recovered
directly as it is not prime and may be further decomposed in
to smaller primes. For enhanced security, X0 may be generated
1024
with P and Q0 as 2 -rough integers as discussed in [32].
2) Brute-force attack on the noise: Given the public key
integers X0 = PQ0 and X1= PQ1 + R, where size of R is Õ(n), the
simple brute-force attack is: choosing an R form the interval
r
r
(-2 , 2 ), subtracting it from X1, and computing GCD(X0, X1- R)
every time, which may be the required secret integer P. In a
worst case, this process may need to be repeated for all the
integers R in the specified interval. The complexity of this
r
attack would be 2 Õ(g) for g-bit integers.
3) Continued fractions and lattice based attacks:
Howgrave Graham [22] described two methods to solve the
two-element PAGCD problem. In simple terms the continued
fraction based approach (Algorithm 11, [22] ) recovers P if
the condition R < P/Q is satisfied. Similarly, his lattice based
algorithm (Algorithm 12, [22]) recovers P if the condition R <
2
P / (PQ)ε is satisfied for some real number ε in (0,..,1). Also,
for the case of a two-element PAGCD problem, it is possible
to recover P when r/g is smaller than (e/g)2 [5]. Since the
chosen parameter setting does not satisfy these constraints
the concerned methods fail to recover the value of P.
VI. PERFORMANCE AND PRACTICALITY

the public key is Õ(n3). The key generation complexity is
Õ(n3.n2) = Õ(n5) for generating two public key elements. This
is a significant improvement over the SHE schemes of [5] and
[9]. The encryption of a single bit plaintext, which involves a
multiplication of Õ(n3. n) and a modular reduction of the resulting Õ(n3)-bit integer with Õ(n3)-bit X0 takes Õ(n6) steps.
The major factor contributing to the bit complexity of
decryption is the modular reduction of Õ(n3)-bit ciphertext
with the Õ(n2)-bit secret key integer P. This makes the
decryption complexity roughly Õ(n6). Therefore, the overall
theoretical complexity of GV variant is Õ(n6). Since a single
bit plaintext is expanded to a ciphertext of Õ(n3) bits, the
expansion ratio is also less, which is n3. TABLE I summarizes the comparative analysis with existing integer based
SHE schemes.
B. Experimental results
The GV scheme is implemented in Visual C++ 2008 Express
edition using Victor Shoup’s Number Theory Library (NTL)
[33] for the manipulation of big integers involved. The
programs were run on a normal desktop PC with Intel Core 2
Duo T5750 2GHz processor and 4GB RAM, in Windows 7
Professional operating system environment. Experimentation
was carried out to measure the time taken for various
algorithms in the scheme, with different values of the security
parameter.
TABLE I. SUMMARY O F I MPROVEMENTS

The practical multiplicative capacity of the scheme is
obtained at various levels of security. TABLE II below shows
the values of parameters corresponding to different security
levels: Toy, Small, Medium, and Large. The results correspond
to the encryption of a single bit. All the times in TABLE III
and TABLE IV are shown in seconds.
TABLE II. VALUES OF PARAMETERS AT DIFFERENT SECURITY LEVELS

A. Improvement in bit complexity
The public key size of the DGHV scheme is Õ(n10).
Generation of each public key element involves Õ(n5. n2) bit
operations. This will take Õ(n12) computations to generate
complete public key, which contains Õ(n5) elements. The
TABLE V gives the comparision of practical performances
ciphertext expansion in that scheme is n5.
(time in seconds) of the GV scheme with two other
The public key in the GV variant consists of only two
implementations [9][30], corresponding to the value of the
elements each having a size of Õ(n3) bits. Hence, the size of
15
© 2012 ACEEE
DOI: 01.IJNS.3.4.1071

TABLE III. PRACTICAL PERFORMANCE AT

DIFFERENT SECURITY LEVELS

TABLE IV. PRACTICAL EVALUATION CAPACITY OF

THE SCHEME

security parameter n = 72.
Analysis of experimental results show that, the GV scheme
is quite efficient than any other integer based SHE scheme
existing. This drastic improvement in performance makes the
GV scheme ready for deployment in suitable practical applications. However, the evaluation results correspond to operations over the ciphertexts that encrypt single bits. Thus,
the impracticality of the scheme now can be totally attributed
to the size of the input function or circuit to the EvaluateSP
algorithm. Hence, the reduced complexities combined with
the ability to encrypt many bits at once or integer plaintexts
as done in [32] makes the scheme really practical.
TABLE V. COMPARISON WITH EXISTING I MPLEMENTATIONS

one or few multiplications. However, due to lack of proper
methods for computing square roots and divisions on real
numbers homomorphically, computation of such operations
should be done after decrypting the encrypted sums and
products.
Another application area that is closely related to the
homomorphic cryptography is Private Information Retrieval
(PIR) [19] [10] [20]. In the PIR protocol, a large database is
maintained by the cloud server and the customer likes to
retrieve a particular entry from that database privately.
Customer sends the encrypted index that is to be queried.
The cloud server homomorphically evaluates the database
access function to retrieve the required entry in the database
in encrypted form using the encrypted index, and sends the
result to the customer. Bitwise encryption of index is a
drawback in such situations which leads to high
communication complexity, and as a solution [10] proposes
the use of a symmetric key encryption in combination with
public key homomorphic scheme.
CONCLUSIONS
In this paper, an efficient variant of the DGHV’s SHE
scheme is presented with experimentation details. The
security of the GV scheme proposed is based on the hard
problem of solving the two-element PAGCD. Due to the smaller
public key that contains two integers of size Õ(n3) each, the
overall complexity is halved with reduction from Õ(n12) of the
DGHV scheme to Õ(n6) in the GV variant. Experimental results
prove that the performance of the proposed SHE is very close
to the practicality. The applications for which the scheme is
suitable for practical deployment are discussed.
REFERENCES

C. Applications
The GV scheme is suitable for all the applications which
involve the functions that contain many additions, but, few
multiplications. For example, as shown in Table IV the scheme
supports nearly 40 multiplications for large instance.
Lauter et al.[17], Brakerski and Vaikuntanathan [10][11][19]
and [26] have discussed the applications for which an SHE
scheme is quite sufficient for encrypted data processing and
allow the delegation of computation to a cloud server. The
efficient GV scheme can be practically implemented in all such
applications. There are two categories of applications for a
homomorphic encryption scheme in practice [17]. 1)
Applications that demand encryption of both data and
functions to be computed, e.g. Cloud based financial
information systems and 2) Applications that need only
encryption of data, e.g. Cloud based healthcare services.
Such applications involve simple statistical functions like
average, standard deviation, and logistical regression.
Evaluation of these functions requires many additions and
16
© 2012 ACEEE
DOI: 01.IJNS.3.4.1071

[1] R. Rivest, L. Adleman, M. Dertouzos, M “On data banks and
privacy homomorphisms”, Foundations of Secure
Computation, pp. 169–180, 1978.
[2] C. Gentry, “A fully Homomorphic Encryption scheme”, Ph.D
Thesis, Stanford University, 2009
[3] C. Gentry, “Fully Homomorphic Encryption using ideal
lattices”, In STOC, pp 169-178, ACM, 2009.
[4] N. P. Smart, F. Vercauteren, “Fully Homomorphic Encryption
with relatively small key and ciphertext sizes” In Public Key
Cryptography - PKC’10, Vol. 6056 of LNCS, pp. 420443,Springer, 2010
[5] M. V. Dijk, C. Gentry, S. Halevi, V. Vaikuntanathan, “Fully
homomorphic encryption over the integers”, Proceedings of
Eurocrypt, Vol. 6110 of LNCS, pp. 24-43, Springer, 2010.
[6] C. Gentry, “Computing arbitrary functions of encrypted data”,
Communications of the ACM, 53(3), pp.97-105, 2010.
[7] D. Stehlé, R. Steinfeld, “Faster fully homomorphic encryption.
ASIACRYPT’2010, Vol. 6477 of LNCS, pp.377-394, Springer,
2010
[8] N. Ogura, G. Yamamoto, T. Kobayashi, S. Uchiyama, “An
improvement of key generation algorithm for Gentry’s
homomorphic encryption scheme”, Advances in Information
and Computer Security - IWSEC 2010, Vol. 6434 of LNCS,
pp. 70–83, Springer, 2010.
[9] J. S. Coron, A. Mandal, D. Naccache and M. Tibouchi, “Fully
Homomorphic Encryption over the Integers with Shorter

Public Keys”, CRYPTO 2011, P. Rogaway (Ed.), Vol. 6841 of
LNCS, pp. 487-504, Springer, 2011.
[10] Z. Brakerski, V. Vaikuntanathan, “Efficient fully homomorphic
encryption from (standard) LWE”, Electronic Colloquium on
Computational Complexity (ECCC) 18: 109, 2011.
[11] Z. Brakerski, V. Vaikuntanathan, “Fully homomorphic
encryption from ring-LWE and security for key dependent
messages. CRYPTO 2011, pp.505-524.
[12] Z. Brakerski, C Gentry, V. Vaikuntanathan, “Fully
homomorphic encryption without bootstrapping”, Electronic
Colloquium on Computational Complexity (ECCC) 18: 111,
2011
[13] M. MikuŠ, “On implementation of the Gentry-Halevi
somewhat homomorphic scheme”, Proceedings of the
International conference on Computers and Computing,
ICCC’11, pp 131-134, 2011.
[14] H. Perl, M. Brenner, M. Smith, “An Implementation of the
fully homomorphic Smart-Vercauteren cryptosystem”,
POSTER,18 th ACM Conference on Computer and
Communications Security CCS-2011.
[15] P. Scholl, N.P. Smart, “Improved key generation for Gentry’s
fully homomorphic encryption Scheme”, Cryptology ePrint
Archive: Report 2011/471, http://eprint.iacr.org/2011/471
[16] C. Gentry, S. Halevi, “Fully homomorphic encryption without
Squashing using depth-3 arithmetic circuits”, Cryptology
ePrint Archive: Report 2011/279. http://eprint.iacr.org/2011/
279
[17] K. Lauter, M. Naehrig V. Vaikuntanathan. “Can Homomorphic
Encryption be practical?”, Cryptology ePrint Archive: Report
2011/405 http://eprint.iacr.org/2011/405
[18] C. Gentry, S. Halevi, “Implementing Gentry’s fully
homomorphic encryption scheme. EUROCRYPT’11, Vol.
6632 of LNCS, pp. 129–148, Springer, 2011.
[19] V. Vaikuntanathan, “Computing Blindfolded: New
developments in Fully homomorphic encryption”, Manuscript
at http://www.cs.toronto.edu/~vinodv/FHE-focs-survey.pdf
[20] C. Fontaine, F. Galand, “A survey of Homomorphic Encryption
for nonspecialists,” EURASIP Journal on Information
Security, Vol. 2007, Article ID 13801, 2007.
[21] Jibang Liu, Yung-Hsiang Lu, Cheng-Kok Koh, “Performance
Analysis of Arithmetic Operations in Homomorphic
Encryption” ECE Technical Reports. Paper 404, 2010 http:/
/docs.lib.purdue.edu/ecetr/404

© 2012 ACEEE
DOI: 01.IJNS.3.4.1071

[22] N. Howgrave-Graham. “Approximate Integer Common
Divisors”, CaLC 2001, Vol. 2146 of LNCS, pp 51–66,
Springer, 2001.
[23] Y. Chen, P. Q. Nguyen, “Faster algorithms for approximate
common divisors: Breaking fully homomorphic-encryption
challenges over the integers”, Cryptology ePrint Archive,
Report 2011/436, http://eprint.iacr.org/2011/436.
[24] M. Briggs, “An Introduction to the General Number Field
Sieve”, Master’s Thesis, Virginia Tech, April 1998. http://
scholar.lib.vt.edu/theses/available/etd-32298-93111/.
[25] H. Lenstra. “Factoring Integers with Elliptic Curves”. Annals
of Mathematics, 126(1987), pp 649-673.
[26] D.K. Rappe, “Homomorphic cryptosystems and their
applications”, Doctoral dissertation thesis, University of
Dortmund, Germany, 2004. www.rappe.de/doerte/Diss.pdf
[27] D E. Knuth. The art of computer programming, seminumerical
algorithms, Vol 2, Addison-Wesley, 3rd edition, 1997.
[28] H. Jing-Li, Y. Ming, W. Zhao-Li, “Fully homomorphic
encryption scheme extended to large message space”,
International Conference on Instrumentation, Measurement,
Computer, Communication and Control, pp.533-536, IEEE,
2011.
[29] Y. Govinda Ramaiah, G. Vijaya Kumari, “Efficient public key
generation for homomorphic encryption over the integers”,
3rd International Conference on Advances in Communication,
Network and Computing, CNC-2012, Janahan Lal Stephen
(Ed.), LNICST, pp. 262–268, Springer, 2012.
[30] J. S. Coron, D. Naccache, M. Tibouchi, “Public key compression
and modulus switching for fully homomorphic encryption
over the integers”, Cryptology ePrint Archive, Report 2011/
440, 2011.
[31] Hao-Miao Yang, Qi XIA, Xiao-fen Wang, Dian-hua Tang, “A
New Somewhat Homomorphic Encryption Scheme over
Integers”, International Conference on Computer Distributed
Control and Intelligent Environmental Monitoring CDCIEM2012, pp.61-64
[32] Y. Govinda Ramaiah, G. Vijaya Kumari, “Efficient Public key
Homomorphic Encryption over Integer Plaintexts”, Third
International Conference on Information Security and
Intelligent Control, pp. 126-131, IEEE, 2012
[33] V. Shoup. NTL: A Library for doing Number Theory. http://
shoup.net/ntl/ , Version 5.5.2, 2010.

17

Towards Practical Homomorphic Encryption with Efficient Public key Generation

More Related Content

Towards Practical Homomorphic Encryption with Efficient Public key Generation