---
title: Distance Comparison Encryption
url: https://www.emergentmind.com/topics/distance-comparison-encryption
type: topic
---

# Distance Comparison Encryption

Distance Comparison Encryption denotes cryptographic techniques that allow parties to compute and compare geometric quantities—such as point-to-point distances, distance-to-threshold tests, nearest-neighbor rankings, path segment intersections, and shortest-path distances—without revealing the underlying coordinates, feature vectors, trajectories, or graph structure beyond the intended output [2507.14713]. Across the literature, the term covers several distinct mechanisms rather than a single primitive: additively homomorphic evaluation of squared Euclidean distance, keyed secure modular hashing for threshold-limited Euclidean estimation, distance-preserving randomization, conditional approximate distance-comparison-preserving symmetric encryption for embedding retrieval, and structured-encryption schemes for exact or approximate shortest-distance queries on encrypted graphs [1601.01079].

## 1. Problem formulations and scope

The core setting is a protected distance query. In confidentiality-preserving image search, a client outsources images and their feature vectors to a cloud server and later issues queries to retrieve nearest neighbors by distance to a query feature vector $q$; the server-side goal is to rank database features $\{f^{(i)}\}$ by their distance to $q$ without learning $f^{(i)}$, $q$, or the images beyond what is needed to answer the query [1601.01079]. In the two-party setting of secure modular hashing, Alice and Bob hold private real-valued vectors $x_1,x_2 \in \mathbb{R}^N$ and require a Euclidean distance computation without revealing their signals either to each other or to a somewhat-trusted third party [1609.05178]. In privacy-preserving RAG, the cloud stores encrypted embeddings and must support query-conditioned ranking while hiding inter-database structure and mitigating query analysis [2601.12331]. In encrypted graph databases, the cloud stores an encrypted graph and encrypted indexes and must answer exact or approximate shortest-distance queries between vertices [2603.26219], [1809.07912]. In privacy-preserving drone navigation, two drones owned by different companies must detect path intersections or unsafe proximity while keeping routes confidential [2507.14713].

These formulations differ in metric, trust model, and admissible leakage. Euclidean and squared Euclidean distance dominate vector-search settings [1601.01079]. Graph systems target shortest-path distance, and Connor adds a cost threshold to obtain approximate constrained shortest distance [1809.07912]. The ElGamal-based location-privacy protocol computes great-circle distance via the Haversine formula and can be extended to proximity-only comparison [2004.07297]. In graph and geometric settings alike, the intended output may be an exact scalar distance, an approximate estimate below a threshold, a Boolean predicate, or only a ranking.

A concise comparison of representative formulations is given below.

| Setting | Protected object | Output capability |
|---|---|---|
| Confidentiality-preserving image search | Feature vectors and images | Nearest-neighbor ranking by distance |
| Secure Modular Hashes | Private real-valued vectors | Euclidean estimation below threshold $T$ |
| CAPRISE for RAG | Embeddings and queries | Query-to-database ordering |
| Encrypted graph querying | Graph structure, labels, identifiers | Exact or approximate shortest distance |
| Drone collision avoidance | Paths and segment endpoints | Intersection or threshold Boolean |
| Location-privacy protocol | Latitude and longitude | Numerical distance or near/far |

## 2. Metrics and algebraic mechanisms

Most DCE constructions are metric-specific. For feature vectors $x,y \in \mathbb{R}^t$, squared Euclidean distance is decomposed as
$$
d^2(x,y)=\sum_{i=1}^t (x_i-y_i)^2
=\sum_{i=1}^t x_i^2 - 2\sum_{i=1}^t x_i y_i + \sum_{i=1}^t y_i^2.
$$
This decomposition is central in additive-homomorphic schemes because it converts distance evaluation into additions and scalar multiplications by plaintext coefficients [1601.01079]. With Paillier, if $\{E(x_i)\}$ are encrypted and $y_i$ are available in plaintext, the server computes
$$
E(\langle x,y\rangle)=\prod_{i=1}^t E(x_i)^{y_i},
$$
and assembles
$$
E(d^2(x,y)) = X \cdot E\!\left(\sum_{i=1}^t y_i^2\right)\cdot
\left(\prod_{i=1}^t E(x_i)^{y_i}\right)^{-2},
$$
where $X = \prod_{i=1}^t E(x_i^2)$ [1601.01079]. The operative constraint is that Paillier supports homomorphic addition and scalar multiplication by a known integer, but not ciphertext–ciphertext multiplication; if both operands must remain encrypted, additive HE alone is insufficient [1601.01079].

Alternative constructions preserve distance indirectly. Secure Modular Hashes define
$$
Q_{k,A,U}(x)=\lfloor Ax+U \rfloor \;(\mathrm{mod}\; k),
$$
with $A$ Gaussian and $U$ uniform, so that each hash component is i.i.d. uniform over $\mathbb{Z}_k$ and independent of $x$ when the keys are unknown to the observer [1609.05178]. Distance is then estimated through the Lee distance
$$
d_{Lee}(a,b)=\min(|a-b|,\,k-|a-b|),
$$
whose expectation tracks $\|x_1-x_2\|_2$ below a threshold and saturates to $k/4$ for larger separations [1609.05178].

Distance-preserving randomization uses a random orthonormal matrix $R \in \mathbb{R}^{t\times t}$ with $R^T R = I_t$ and publishes only randomized vectors $F^{(i)}=Rf^{(i)}$ and optionally $Q=Rq$. Exact Euclidean distance is preserved because
$$
\|Rx-Ry\|^2 = \|x-y\|^2,
$$
but the server learns all relative distances and therefore neighbor ranks [1601.01079].

CAPRISE adopts a different algebraic objective. It encrypts database embeddings as $x_i' = s x_i + \lambda_{x_i}$ and queries as $q' = s q + \eta_q$, then relies on ciphertext-space Euclidean distance $\tilde d(q',x_i')=\|q'-x_i'\|_2$ to preserve only query-to-database ordering, subject to a separation margin $\beta$ and bounds $\|\eta\|<s\beta/8$, $\|\lambda\|<3s\beta/8$ [2601.12331]. This is explicitly conditional: it preserves comparisons of $d(q,x_i)$ versus $d(q,x_j)$, while intentionally not preserving inter-database orderings.

Graph-oriented DCE replaces geometric distance with shortest-path distance. EPDQ adopts the 2-hop labeling identity
$$
\mathrm{dist}(u,v)=\min_{x \in L(u)\cap L(v)} \big(d(u,x)+d(x,v)\big),
$$
while Connor uses encrypted 2-hop labels for constrained shortest distance and encodes distances for somewhat homomorphic aggregation [2603.26219], [1809.07912].

## 3. Major construction families

Additive-homomorphic DCE is the classical vector-search formulation. In the Lu et al. image-search setting, the note on confidentiality-preserving image search identifies two distinct outcomes: the first scheme does not use the additive homomorphic property at all because the server merely stores and forwards ciphertexts, whereas the second scheme does use Paillier to assemble encrypted squared distances but still requires the query components $q_\ell$ in plaintext at the server and leaves the client with $N$ public-key decryptions [1601.01079]. The note therefore concludes that the first scheme can be replaced by symmetric-key encryption without functional loss, and that the second scheme’s additive HE is unnecessary in the honest-but-curious model if the client can decrypt features and compute distances locally [1601.01079].

Secure Modular Hashing defines a threshold-limited DCE primitive. The construction gives information-theoretic privacy against a third party that does not know $(A,U)$, since each hash component is uniform over $\mathbb{Z}_k$ independently of the input [1609.05178]. The comparison primitive is the Mean Lee Distance
$$
\bar d_{Lee}(Q(x_1),Q(x_2))=\frac{1}{M}\sum_{i=1}^M d_{Lee}(Q(x_1)_i,Q(x_2)_i),
$$
which estimates $\|x_1-x_2\|_2$ for distances below a threshold $T$ and becomes uninformative above $T$ because the expectation saturates near $k/4$ [1609.05178]. The paper further provides a Hoeffding bound and a concrete example: for $\beta=10$, $\epsilon=0.5$, and $k=8$, $M \ge 244$ gives precision $0.5$ with probability $>0.999$ [1609.05178].

Distance-preserving randomization is computationally simple and exact for Euclidean distance. Its central advantage is that the server performs only plaintext linear algebra on randomized features, which is fast and scalable [1601.01079]. Its central limitation is structural leakage: all pairwise distances, scales, and neighbor ranks remain available to the server, and with enough known plaintext–randomized pairs, recovery of the orthonormal transform is possible [1601.01079].

CAPRISE is a symmetric DCE construction for outsourced embedding retrieval. It preserves the ordering of $d(q,x_i)$ against $d(q,x_j)$, but not the ordering of $d(x_i,x_j)$ among database entries [2601.12331]. Database vectors receive larger random perturbations than queries, which destroys stable pairwise structure in ciphertext space while retaining query-conditioned ranking under the stated margin condition. The cloud computes $\|q'-x_i'\|_2$ directly, and the client may re-rank locally after decryption if needed [2601.12331].

The main families can be summarized as follows.

| Family | Preserved capability | Primary limitation |
|---|---|---|
| Additive HE | Exact squared Euclidean assembly | One operand plaintext or extra protocol required |
| Secure Modular Hashing | Accurate estimation below threshold $T$ | Saturation above $T$ |
| Distance-preserving randomization | Exact Euclidean distance | Leaks rank and scale |
| CAPRISE | Query-to-database ordering | Inter-database ANN structure destroyed |

## 4. Specialized domains and systems

In encrypted graph databases, DCE becomes a shortest-distance query problem rather than a vector-similarity problem. EPDQ combines encrypted 2-hop labeling, Pruned Landmark Labeling (PLL), and a tensorized graph representation. Node identities and label hubs are obfuscated with PRFs and PRPs, distances are encrypted with Paillier, and the cloud homomorphically aggregates candidate path lengths $d(u,x)+d(x,v)$ by ciphertext multiplication; exact minimum selection is then performed by the authorized user after decryption [2603.26219]. The scheme formalizes privacy as simulator-based CQA2-security and reports experiments on 11 real-world graphs, with initialization ranging from $0.03$ min to $54.2$ min and server-side shortest-distance query times that can be substantial on million-scale graphs, such as approximately $150184$ s on Com-Youtube [2603.26219].

Connor addresses approximate constrained shortest distance rather than exact shortest distance. It builds a secure 2-hop cover labeling index, encrypts distances with somewhat homomorphic encryption, encrypts costs with order-revealing encryption, and uses a tree-based ciphertext comparison protocol to decide whether $c_{s,v}+c_{v,t}\le \tau$ with tunable certainty [1809.07912]. If the comparison tree has depth $d_e$, the probability of uncertainty is $2^{-d_e}$ and the certainty is $1-2^{-d_e}$; for $d_e=6$, certainty is approximately $63/64$ [1809.07912]. Distance aggregation then encodes the minimum retained candidate through the most significant bit of a homomorphic sum [1809.07912].

In privacy-preserving drone navigation, DCE is instantiated through exact integer arithmetic under additively homomorphic encryption plus secure comparison. The core geometric predicate is the orientation test
$$
\operatorname{orient}(a,b,c)
=(b_x-a_x)(c_y-a_y)-(b_y-a_y)(c_x-a_x),
$$
evaluated homomorphically with an interactive ciphertext-multiplication protocol and Joye–Salehi encrypted comparison for sign tests [2507.14713]. Segment intersection is then determined from the signs of four orientation values, and only a Boolean warning is revealed to Alice. On two Debian 12 virtual machines intended to mimic Raspberry Pi 4-class drones, the homomorphic approach averaged $4.407$ seconds per intersection decision and $4{,}634$ bytes exchanged, compared with $6.092$ seconds and $39{,}221$ bytes for a garbled-circuit baseline [2507.14713].

The ElGamal-based location-privacy protocol targets great-circle distance rather than Euclidean distance. Two users encrypt trigonometric transforms of their latitude and longitude under a control center’s public key, and the control center decrypts only a permuted, obfuscated set of partial terms whose sum yields the Haversine intermediate scalar
$$
a=\sin^2\!\left(\frac{\lambda_2-\lambda_1}{2}\right)+
\cos \lambda_1 \cos \lambda_2
\sin^2\!\left(\frac{\phi_2-\phi_1}{2}\right).
$$
The final distance is then computed as
$$
d = 2R \cdot \operatorname{atan2}(\sqrt a,\sqrt{1-a}),
$$
or, in a proximity-only extension, only the Boolean result of a threshold comparison is revealed [2004.07297].

RAG introduces yet another specialization. In ppRAG, embeddings are encrypted with CAPRISE, documents are AES-encrypted, and query privacy is strengthened by perturbing the query embedding before encryption through DistanceDP. The cloud returns top-$k'$ candidates rather than top-$k$, and the client decrypts embeddings and re-ranks locally [2601.12331].

## 5. Security models, leakage, and misconceptions

Security claims in DCE are highly model-dependent. Secure Modular Hashing claims information-theoretic privacy against any computationally unbounded adversary that does not know the secret keys $(A,U)$, because the distribution of each hash component is uniform over $\mathbb{Z}_k$ and independent of the input; under the basic protocol, Charlie learns only the Mean Lee Distance, and under the obfuscated protocol, even that value is hidden by appended uniform noise and permutation [1609.05178]. EPDQ instead adopts an honest-but-curious cloud and proves simulator-based CQA2-security, with leakage restricted to encrypted index sizes, token-shape information, and access patterns typical of structured encryption [2603.26219]. Connor also works in a semi-honest model and formalizes leakage through setup and query leakage functions that include comparison outcomes and some sketch patterns while hiding graph topology and plaintext costs [1809.07912]. The drone protocol relies on the IND-CPA security of Paillier and DGK and on timing-resistant secure comparison, but does not claim IND-CCA security or broader side-channel resistance [2507.14713]. The ElGamal location protocol assumes honest-but-curious parties and no collusion between the control center and either user [2004.07297].

A recurrent issue is that preserving distance functionality frequently preserves structure. Distance-preserving randomization leaks all pairwise distances, their scale, and thus the rank order of neighbors [1601.01079]. CAPRISE is designed specifically to avoid that leakage by preserving only query-to-database ordering and preventing preservation of inter-database distances or their ordering [2601.12331]. Secure Modular Hashes occupy an intermediate point: distances below $T$ are informative, while larger distances are naturally masked by saturation to $k/4$ [1609.05178].

A central misconception concerns the phrase “homomorphic encryption-based distance search.” The note on Lu et al. shows that merely storing encrypted features and later decrypting them client-side before computing distances does not use homomorphic properties at all; correctness identities such as $D(E(f^{(i)}))=f^{(i)}$ hold for any correct encryption scheme and do not imply homomorphic evaluation [1601.01079]. A second misconception is that additive HE alone keeps both operands hidden. In Paillier-based squared-distance assembly, the server exponentiates $E(f_\ell^{(i)})$ by $q_\ell$, so the query must be available as plaintext or fixed-point encoded integers to the server unless a two-party secure inner product or fully/leveled homomorphic scheme is added [1601.01079].

Query privacy is a distinct concern from data privacy. CAPRISE adds differential privacy to the query embedding to defend against query analysis [2601.12331]. The drone protocol reveals only per-segment Boolean collision flags to Alice, but repeated probing with crafted segments can leak approximate path shape, which the paper argues is constrained in practice by range, timing, and resource limits [2507.14713]. In graph SSE systems, exact node identities may be hidden, yet access patterns remain visible [2603.26219], [1809.07912].

## 6. Efficiency, trade-offs, and design principles

The literature repeatedly contrasts public-key homomorphic approaches with symmetric-key or hashing-based alternatives. In vector-search settings, Paillier ciphertexts live modulo $n^2$, typically costing $2048$–$4096$ bits per $32$–$64$ bit feature coordinate, so componentwise encryption of a $t$-dimensional vector creates large storage and bandwidth overhead; AES adds minimal expansion and can encrypt an entire feature vector as a single message [1601.01079]. The same note reports that public-key decryption is two to three orders of magnitude slower than AES decryption, which is why a symmetric decrypt-then-compute design may outperform a homomorphic design when the client is already responsible for final ranking [1601.01079].

Secure Modular Hashing was motivated precisely by the observation that HE and MPC often make repeated distance computations impractical. Its communication is independent of the original dimension $N$, and third-party computation requires only $O(M)$ Lee-distance operations [1609.05178]. CAPRISE pursues the same efficiency objective with symmetric primitives: on MS MARCO using gtr-t5-base embeddings and an NVIDIA A100, client-side embedding for a batch of $128$ queries took approximately $79.52$ ms and CAPRISE encryption added approximately $15$ ms, while retrieval throughput at dimension $768$ was approximately $2339$ vectors/s versus approximately $250$–$300$ vectors/s for a partially homomorphic baseline [2601.12331]. The trade-off is that ANN indexes relying on preserved inter-database geometry are incompatible with CAPRISE because inter-database structure is intentionally destroyed [2601.12331].

Graph systems show a different trade-off profile. Connor reports encrypted index size around $6\times$ the plain index size and encrypted query latencies in the tens of milliseconds on the evaluated graphs, with deeper comparison trees reducing latency by pruning more candidates before homomorphic aggregation [1809.07912]. EPDQ scales to million-scale graphs and supports efficient updates, but server processing time can dominate query cost [2603.26219].

Across these systems, several design principles recur. When modular cryptography is applied to real-valued features, the encoding from $\mathbb{R}^t$ to $\mathbb{Z}_n$ must be explicit; otherwise wrap-around errors and precision loss are left unspecified [1601.01079]. Public-key operations at the client should be minimized when final comparison is client-side [1601.01079]. Queries should not be sent in plaintext to the server if confidentiality of the query is part of the goal [1601.01079]. In threshold-limited constructions such as Secure Modular Hashes, $k$ governs the privacy–accuracy trade-off: larger $k$ improves approximation below $T$ but increases the number of hash components needed for a given concentration guarantee [1609.05178]. In CAPRISE, the parameters $s$ and $\beta$ regulate the balance between ranking fidelity and privacy against vector reconstruction and structural analysis [2601.12331].

Taken together, these results indicate that Distance Comparison Encryption is not a single cryptographic primitive but a design space. Additive homomorphic encryption is suitable when exact algebraic assembly of distances is required and one operand can safely remain in plaintext or an extra protocol handles secure multiplication [1601.01079]. Secure Modular Hashes are appropriate when accurate estimation is only needed below a threshold and a somewhat-trusted third party is acceptable [1609.05178]. Distance-preserving randomization is viable when leakage of exact relative distances and rank order is acceptable in exchange for low cost [1601.01079]. CAPRISE is tailored to outsourced retrieval where only query-conditioned ranking must survive encryption [2601.12331]. Structured-encryption graph systems extend the same theme from vector spaces to shortest-path metrics, with exactness or approximation determined by the indexing and comparison layers rather than by generic homomorphic evaluation alone [2603.26219], [1809.07912].

Source: https://www.emergentmind.com/topics/distance-comparison-encryption