Distance Comparison Encryption

• Distance Comparison Encryption is a set of cryptographic techniques that enable secure computation and comparison of distances without exposing raw data or underlying structures.
• It employs methods such as additive homomorphic encryption, secure modular hashing, and distance-preserving randomization to facilitate various distance queries including Euclidean, threshold tests, and shortest-path evaluations.
• These techniques are applied in scenarios like privacy-preserving image search, encrypted graph queries, and secure drone navigation, balancing efficiency, accuracy, and confidentiality.

Distance Comparison Encryption denotes cryptographic techniques that allow parties to compute and compare geometric quantities—such as point-to-point distances, distance-to-threshold tests, nearest-neighbor rankings, path segment intersections, and shortest-path distances—without revealing the underlying coordinates, feature vectors, trajectories, or graph structure beyond the intended output (Luedeman et al., 19 Jul 2025). Across the literature, the term covers several distinct mechanisms rather than a single primitive: additively homomorphic evaluation of squared Euclidean distance, keyed secure modular hashing for threshold-limited Euclidean estimation, distance-preserving randomization, conditional approximate distance-comparison-preserving symmetric encryption for embedding retrieval, and structured-encryption schemes for exact or approximate shortest-distance queries on encrypted graphs (Cao et al., 2016).

1. Problem formulations and scope

The core setting is a protected distance query. In confidentiality-preserving image search, a client outsources images and their feature vectors to a cloud server and later issues queries to retrieve nearest neighbors by distance to a query feature vector $q$; the server-side goal is to rank database features $\{f^{(i)}\}$ by their distance to $q$ without learning $f^{(i)}$, $q$, or the images beyond what is needed to answer the query (Cao et al., 2016). In the two-party setting of secure modular hashing, Alice and Bob hold private real-valued vectors $x_1,x_2 \in \mathbb{R}^N$ and require a Euclidean distance computation without revealing their signals either to each other or to a somewhat-trusted third party (Jimenez et al., 2016). In privacy-preserving RAG, the cloud stores encrypted embeddings and must support query-conditioned ranking while hiding inter-database structure and mitigating query analysis (Ye et al., 18 Jan 2026). In encrypted graph databases, the cloud stores an encrypted graph and encrypted indexes and must answer exact or approximate shortest-distance queries between vertices (Fu, 27 Mar 2026, Shen et al., 2018). In privacy-preserving drone navigation, two drones owned by different companies must detect path intersections or unsafe proximity while keeping routes confidential (Luedeman et al., 19 Jul 2025).

These formulations differ in metric, trust model, and admissible leakage. Euclidean and squared Euclidean distance dominate vector-search settings (Cao et al., 2016). Graph systems target shortest-path distance, and Connor adds a cost threshold to obtain approximate constrained shortest distance (Shen et al., 2018). The ElGamal-based location-privacy protocol computes great-circle distance via the Haversine formula and can be extended to proximity-only comparison (Romero-Tris et al., 2020). In graph and geometric settings alike, the intended output may be an exact scalar distance, an approximate estimate below a threshold, a Boolean predicate, or only a ranking.

A concise comparison of representative formulations is given below.

Setting	Protected object	Output capability
Confidentiality-preserving image search	Feature vectors and images	Nearest-neighbor ranking by distance
Secure Modular Hashes	Private real-valued vectors	Euclidean estimation below threshold $T$
CAPRISE for RAG	Embeddings and queries	Query-to-database ordering
Encrypted graph querying	Graph structure, labels, identifiers	Exact or approximate shortest distance
Drone collision avoidance	Paths and segment endpoints	Intersection or threshold Boolean
Location-privacy protocol	Latitude and longitude	Numerical distance or near/far

2. Metrics and algebraic mechanisms

Most DCE constructions are metric-specific. For feature vectors $x,y \in \mathbb{R}^t$, squared Euclidean distance is decomposed as

$$d^2(x,y)=\sum_{i=1}^t (x_i-y_i)^2 =\sum_{i=1}^t x_i^2 - 2\sum_{i=1}^t x_i y_i + \sum_{i=1}^t y_i^2.$$

This decomposition is central in additive-homomorphic schemes because it converts distance evaluation into additions and scalar multiplications by plaintext coefficients (Cao et al., 2016). With Paillier, if $\{E(x_i)\}$ are encrypted and $\{f^{(i)}\}$0 are available in plaintext, the server computes

$\{f^{(i)}\}$1

and assembles

$\{f^{(i)}\}$2

where $\{f^{(i)}\}$3 (Cao et al., 2016). The operative constraint is that Paillier supports homomorphic addition and scalar multiplication by a known integer, but not ciphertext–ciphertext multiplication; if both operands must remain encrypted, additive HE alone is insufficient (Cao et al., 2016).

Alternative constructions preserve distance indirectly. Secure Modular Hashes define

$\{f^{(i)}\}$4

with $\{f^{(i)}\}$5 Gaussian and $\{f^{(i)}\}$6 uniform, so that each hash component is i.i.d. uniform over $\{f^{(i)}\}$7 and independent of $\{f^{(i)}\}$8 when the keys are unknown to the observer (Jimenez et al., 2016). Distance is then estimated through the Lee distance

$\{f^{(i)}\}$9

whose expectation tracks $q$0 below a threshold and saturates to $q$1 for larger separations (Jimenez et al., 2016).

Distance-preserving randomization uses a random orthonormal matrix $q$2 with $q$3 and publishes only randomized vectors $q$4 and optionally $q$5. Exact Euclidean distance is preserved because

$q$6

but the server learns all relative distances and therefore neighbor ranks (Cao et al., 2016).

CAPRISE adopts a different algebraic objective. It encrypts database embeddings as $q$7 and queries as $q$8, then relies on ciphertext-space Euclidean distance $q$9 to preserve only query-to-database ordering, subject to a separation margin $f^{(i)}$0 and bounds $f^{(i)}$1, $f^{(i)}$2 (Ye et al., 18 Jan 2026). This is explicitly conditional: it preserves comparisons of $f^{(i)}$3 versus $f^{(i)}$4, while intentionally not preserving inter-database orderings.

Graph-oriented DCE replaces geometric distance with shortest-path distance. EPDQ adopts the 2-hop labeling identity

$f^{(i)}$5

while Connor uses encrypted 2-hop labels for constrained shortest distance and encodes distances for somewhat homomorphic aggregation (Fu, 27 Mar 2026, Shen et al., 2018).

3. Major construction families

Additive-homomorphic DCE is the classical vector-search formulation. In the Lu et al. image-search setting, the note on confidentiality-preserving image search identifies two distinct outcomes: the first scheme does not use the additive homomorphic property at all because the server merely stores and forwards ciphertexts, whereas the second scheme does use Paillier to assemble encrypted squared distances but still requires the query components $f^{(i)}$6 in plaintext at the server and leaves the client with $f^{(i)}$7 public-key decryptions (Cao et al., 2016). The note therefore concludes that the first scheme can be replaced by symmetric-key encryption without functional loss, and that the second scheme’s additive HE is unnecessary in the honest-but-curious model if the client can decrypt features and compute distances locally (Cao et al., 2016).

Secure Modular Hashing defines a threshold-limited DCE primitive. The construction gives information-theoretic privacy against a third party that does not know $f^{(i)}$8, since each hash component is uniform over $f^{(i)}$9 independently of the input (Jimenez et al., 2016). The comparison primitive is the Mean Lee Distance

$q$0

which estimates $q$1 for distances below a threshold $q$2 and becomes uninformative above $q$3 because the expectation saturates near $q$4 (Jimenez et al., 2016). The paper further provides a Hoeffding bound and a concrete example: for $q$5, $q$6, and $q$7, $q$8 gives precision $q$9 with probability $x_1,x_2 \in \mathbb{R}^N$0 (Jimenez et al., 2016).

Distance-preserving randomization is computationally simple and exact for Euclidean distance. Its central advantage is that the server performs only plaintext linear algebra on randomized features, which is fast and scalable (Cao et al., 2016). Its central limitation is structural leakage: all pairwise distances, scales, and neighbor ranks remain available to the server, and with enough known plaintext–randomized pairs, recovery of the orthonormal transform is possible (Cao et al., 2016).

CAPRISE is a symmetric DCE construction for outsourced embedding retrieval. It preserves the ordering of $x_1,x_2 \in \mathbb{R}^N$1 against $x_1,x_2 \in \mathbb{R}^N$2, but not the ordering of $x_1,x_2 \in \mathbb{R}^N$3 among database entries (Ye et al., 18 Jan 2026). Database vectors receive larger random perturbations than queries, which destroys stable pairwise structure in ciphertext space while retaining query-conditioned ranking under the stated margin condition. The cloud computes $x_1,x_2 \in \mathbb{R}^N$4 directly, and the client may re-rank locally after decryption if needed (Ye et al., 18 Jan 2026).

The main families can be summarized as follows.

Family	Preserved capability	Primary limitation
Additive HE	Exact squared Euclidean assembly	One operand plaintext or extra protocol required
Secure Modular Hashing	Accurate estimation below threshold $x_1,x_2 \in \mathbb{R}^N$5	Saturation above $x_1,x_2 \in \mathbb{R}^N$6
Distance-preserving randomization	Exact Euclidean distance	Leaks rank and scale
CAPRISE	Query-to-database ordering	Inter-database ANN structure destroyed

4. Specialized domains and systems

In encrypted graph databases, DCE becomes a shortest-distance query problem rather than a vector-similarity problem. EPDQ combines encrypted 2-hop labeling, Pruned Landmark Labeling (PLL), and a tensorized graph representation. Node identities and label hubs are obfuscated with PRFs and PRPs, distances are encrypted with Paillier, and the cloud homomorphically aggregates candidate path lengths $x_1,x_2 \in \mathbb{R}^N$7 by ciphertext multiplication; exact minimum selection is then performed by the authorized user after decryption (Fu, 27 Mar 2026). The scheme formalizes privacy as simulator-based CQA2-security and reports experiments on 11 real-world graphs, with initialization ranging from $x_1,x_2 \in \mathbb{R}^N$8 min to $x_1,x_2 \in \mathbb{R}^N$9 min and server-side shortest-distance query times that can be substantial on million-scale graphs, such as approximately $T$0 s on Com-Youtube (Fu, 27 Mar 2026).

Connor addresses approximate constrained shortest distance rather than exact shortest distance. It builds a secure 2-hop cover labeling index, encrypts distances with somewhat homomorphic encryption, encrypts costs with order-revealing encryption, and uses a tree-based ciphertext comparison protocol to decide whether $T$1 with tunable certainty (Shen et al., 2018). If the comparison tree has depth $T$2, the probability of uncertainty is $T$3 and the certainty is $T$4; for $T$5, certainty is approximately $T$6 (Shen et al., 2018). Distance aggregation then encodes the minimum retained candidate through the most significant bit of a homomorphic sum (Shen et al., 2018).

In privacy-preserving drone navigation, DCE is instantiated through exact integer arithmetic under additively homomorphic encryption plus secure comparison. The core geometric predicate is the orientation test

$T$7

evaluated homomorphically with an interactive ciphertext-multiplication protocol and Joye–Salehi encrypted comparison for sign tests (Luedeman et al., 19 Jul 2025). Segment intersection is then determined from the signs of four orientation values, and only a Boolean warning is revealed to Alice. On two Debian 12 virtual machines intended to mimic Raspberry Pi 4-class drones, the homomorphic approach averaged $T$8 seconds per intersection decision and $T$9 bytes exchanged, compared with $x,y \in \mathbb{R}^t$0 seconds and $x,y \in \mathbb{R}^t$1 bytes for a garbled-circuit baseline (Luedeman et al., 19 Jul 2025).

The ElGamal-based location-privacy protocol targets great-circle distance rather than Euclidean distance. Two users encrypt trigonometric transforms of their latitude and longitude under a control center’s public key, and the control center decrypts only a permuted, obfuscated set of partial terms whose sum yields the Haversine intermediate scalar

$x,y \in \mathbb{R}^t$2

The final distance is then computed as

$x,y \in \mathbb{R}^t$3

or, in a proximity-only extension, only the Boolean result of a threshold comparison is revealed (Romero-Tris et al., 2020).

RAG introduces yet another specialization. In ppRAG, embeddings are encrypted with CAPRISE, documents are AES-encrypted, and query privacy is strengthened by perturbing the query embedding before encryption through DistanceDP. The cloud returns top-$x,y \in \mathbb{R}^t$4 candidates rather than top-$x,y \in \mathbb{R}^t$5, and the client decrypts embeddings and re-ranks locally (Ye et al., 18 Jan 2026).

5. Security models, leakage, and misconceptions

Security claims in DCE are highly model-dependent. Secure Modular Hashing claims information-theoretic privacy against any computationally unbounded adversary that does not know the secret keys $x,y \in \mathbb{R}^t$6, because the distribution of each hash component is uniform over $x,y \in \mathbb{R}^t$7 and independent of the input; under the basic protocol, Charlie learns only the Mean Lee Distance, and under the obfuscated protocol, even that value is hidden by appended uniform noise and permutation (Jimenez et al., 2016). EPDQ instead adopts an honest-but-curious cloud and proves simulator-based CQA2-security, with leakage restricted to encrypted index sizes, token-shape information, and access patterns typical of structured encryption (Fu, 27 Mar 2026). Connor also works in a semi-honest model and formalizes leakage through setup and query leakage functions that include comparison outcomes and some sketch patterns while hiding graph topology and plaintext costs (Shen et al., 2018). The drone protocol relies on the IND-CPA security of Paillier and DGK and on timing-resistant secure comparison, but does not claim IND-CCA security or broader side-channel resistance (Luedeman et al., 19 Jul 2025). The ElGamal location protocol assumes honest-but-curious parties and no collusion between the control center and either user (Romero-Tris et al., 2020).

A recurrent issue is that preserving distance functionality frequently preserves structure. Distance-preserving randomization leaks all pairwise distances, their scale, and thus the rank order of neighbors (Cao et al., 2016). CAPRISE is designed specifically to avoid that leakage by preserving only query-to-database ordering and preventing preservation of inter-database distances or their ordering (Ye et al., 18 Jan 2026). Secure Modular Hashes occupy an intermediate point: distances below $x,y \in \mathbb{R}^t$8 are informative, while larger distances are naturally masked by saturation to $x,y \in \mathbb{R}^t$9 (Jimenez et al., 2016).

A central misconception concerns the phrase “homomorphic encryption-based distance search.” The note on Lu et al. shows that merely storing encrypted features and later decrypting them client-side before computing distances does not use homomorphic properties at all; correctness identities such as $$d^2(x,y)=\sum_{i=1}^t (x_i-y_i)^2 =\sum_{i=1}^t x_i^2 - 2\sum_{i=1}^t x_i y_i + \sum_{i=1}^t y_i^2.$$0 hold for any correct encryption scheme and do not imply homomorphic evaluation (Cao et al., 2016). A second misconception is that additive HE alone keeps both operands hidden. In Paillier-based squared-distance assembly, the server exponentiates $$d^2(x,y)=\sum_{i=1}^t (x_i-y_i)^2 =\sum_{i=1}^t x_i^2 - 2\sum_{i=1}^t x_i y_i + \sum_{i=1}^t y_i^2.$$1 by $$d^2(x,y)=\sum_{i=1}^t (x_i-y_i)^2 =\sum_{i=1}^t x_i^2 - 2\sum_{i=1}^t x_i y_i + \sum_{i=1}^t y_i^2.$$2, so the query must be available as plaintext or fixed-point encoded integers to the server unless a two-party secure inner product or fully/leveled homomorphic scheme is added (Cao et al., 2016).

Query privacy is a distinct concern from data privacy. CAPRISE adds differential privacy to the query embedding to defend against query analysis (Ye et al., 18 Jan 2026). The drone protocol reveals only per-segment Boolean collision flags to Alice, but repeated probing with crafted segments can leak approximate path shape, which the paper argues is constrained in practice by range, timing, and resource limits (Luedeman et al., 19 Jul 2025). In graph SSE systems, exact node identities may be hidden, yet access patterns remain visible (Fu, 27 Mar 2026, Shen et al., 2018).

6. Efficiency, trade-offs, and design principles

The literature repeatedly contrasts public-key homomorphic approaches with symmetric-key or hashing-based alternatives. In vector-search settings, Paillier ciphertexts live modulo $$d^2(x,y)=\sum_{i=1}^t (x_i-y_i)^2 =\sum_{i=1}^t x_i^2 - 2\sum_{i=1}^t x_i y_i + \sum_{i=1}^t y_i^2.$$3, typically costing $$d^2(x,y)=\sum_{i=1}^t (x_i-y_i)^2 =\sum_{i=1}^t x_i^2 - 2\sum_{i=1}^t x_i y_i + \sum_{i=1}^t y_i^2.$$4–$$d^2(x,y)=\sum_{i=1}^t (x_i-y_i)^2 =\sum_{i=1}^t x_i^2 - 2\sum_{i=1}^t x_i y_i + \sum_{i=1}^t y_i^2.$$5 bits per $$d^2(x,y)=\sum_{i=1}^t (x_i-y_i)^2 =\sum_{i=1}^t x_i^2 - 2\sum_{i=1}^t x_i y_i + \sum_{i=1}^t y_i^2.$$6–$$d^2(x,y)=\sum_{i=1}^t (x_i-y_i)^2 =\sum_{i=1}^t x_i^2 - 2\sum_{i=1}^t x_i y_i + \sum_{i=1}^t y_i^2.$$7 bit feature coordinate, so componentwise encryption of a $$d^2(x,y)=\sum_{i=1}^t (x_i-y_i)^2 =\sum_{i=1}^t x_i^2 - 2\sum_{i=1}^t x_i y_i + \sum_{i=1}^t y_i^2.$$8-dimensional vector creates large storage and bandwidth overhead; AES adds minimal expansion and can encrypt an entire feature vector as a single message (Cao et al., 2016). The same note reports that public-key decryption is two to three orders of magnitude slower than AES decryption, which is why a symmetric decrypt-then-compute design may outperform a homomorphic design when the client is already responsible for final ranking (Cao et al., 2016).

Secure Modular Hashing was motivated precisely by the observation that HE and MPC often make repeated distance computations impractical. Its communication is independent of the original dimension $$d^2(x,y)=\sum_{i=1}^t (x_i-y_i)^2 =\sum_{i=1}^t x_i^2 - 2\sum_{i=1}^t x_i y_i + \sum_{i=1}^t y_i^2.$$9, and third-party computation requires only $\{E(x_i)\}$0 Lee-distance operations (Jimenez et al., 2016). CAPRISE pursues the same efficiency objective with symmetric primitives: on MS MARCO using gtr-t5-base embeddings and an NVIDIA A100, client-side embedding for a batch of $\{E(x_i)\}$1 queries took approximately $\{E(x_i)\}$2 ms and CAPRISE encryption added approximately $\{E(x_i)\}$3 ms, while retrieval throughput at dimension $\{E(x_i)\}$4 was approximately $\{E(x_i)\}$5 vectors/s versus approximately $\{E(x_i)\}$6–$\{E(x_i)\}$7 vectors/s for a partially homomorphic baseline (Ye et al., 18 Jan 2026). The trade-off is that ANN indexes relying on preserved inter-database geometry are incompatible with CAPRISE because inter-database structure is intentionally destroyed (Ye et al., 18 Jan 2026).

Graph systems show a different trade-off profile. Connor reports encrypted index size around $\{E(x_i)\}$8 the plain index size and encrypted query latencies in the tens of milliseconds on the evaluated graphs, with deeper comparison trees reducing latency by pruning more candidates before homomorphic aggregation (Shen et al., 2018). EPDQ scales to million-scale graphs and supports efficient updates, but server processing time can dominate query cost (Fu, 27 Mar 2026).

Across these systems, several design principles recur. When modular cryptography is applied to real-valued features, the encoding from $\{E(x_i)\}$9 to $\{f^{(i)}\}$00 must be explicit; otherwise wrap-around errors and precision loss are left unspecified (Cao et al., 2016). Public-key operations at the client should be minimized when final comparison is client-side (Cao et al., 2016). Queries should not be sent in plaintext to the server if confidentiality of the query is part of the goal (Cao et al., 2016). In threshold-limited constructions such as Secure Modular Hashes, $\{f^{(i)}\}$01 governs the privacy–accuracy trade-off: larger $\{f^{(i)}\}$02 improves approximation below $\{f^{(i)}\}$03 but increases the number of hash components needed for a given concentration guarantee (Jimenez et al., 2016). In CAPRISE, the parameters $\{f^{(i)}\}$04 and $\{f^{(i)}\}$05 regulate the balance between ranking fidelity and privacy against vector reconstruction and structural analysis (Ye et al., 18 Jan 2026).

Taken together, these results indicate that Distance Comparison Encryption is not a single cryptographic primitive but a design space. Additive homomorphic encryption is suitable when exact algebraic assembly of distances is required and one operand can safely remain in plaintext or an extra protocol handles secure multiplication (Cao et al., 2016). Secure Modular Hashes are appropriate when accurate estimation is only needed below a threshold and a somewhat-trusted third party is acceptable (Jimenez et al., 2016). Distance-preserving randomization is viable when leakage of exact relative distances and rank order is acceptable in exchange for low cost (Cao et al., 2016). CAPRISE is tailored to outsourced retrieval where only query-conditioned ranking must survive encryption (Ye et al., 18 Jan 2026). Structured-encryption graph systems extend the same theme from vector spaces to shortest-path metrics, with exactness or approximation determined by the indexing and comparison layers rather than by generic homomorphic evaluation alone (Fu, 27 Mar 2026, Shen et al., 2018).