---
title: 'Homomorphic Encryption: Computation on Encrypted Data'
url: https://www.emergentmind.com/topics/homomorphic-encryption-he
type: topic
---

# Homomorphic Encryption: Computation on Encrypted Data

Homomorphic encryption (HE) is a class of cryptographic primitives enabling computation on encrypted data, such that decryption of the result yields the output as if computed on the plaintext. HE underpins privacy-preserving computation in untrusted environments and is foundational in secure outsourced computation, federated learning, cloud data analytics, privacy-preserving machine learning, secure statistical data mining, and privacy-protecting protocols for genomics, medical imaging, and database search.

## 1. Formalism and Core Scheme Taxonomy

HE is typically specified as a tuple of efficient algorithms $(\mathsf{KeyGen},\mathsf{Enc},\mathsf{Eval},\mathsf{Dec})$. For security parameter $\lambda$, $\mathsf{KeyGen}$ produces public and secret keys; $\mathsf{Enc}$ encrypts a message $m$; $\mathsf{Eval}$ enables computation of a function $f$ or circuit $C$ on ciphertexts, and $\mathsf{Dec}$ decrypts the output ciphertext to $f(m_1,\ldots,m_t)$, preserving correctness:
$$
\mathsf{Dec}_{sk}\left(\mathsf{Eval}_{pk}(C, \mathsf{Enc}_{pk}(m_1), \ldots, \mathsf{Enc}_{pk}(m_t))\right) = C(m_1, \ldots, m_t)
$$
HE schemes are classified by the scope of permitted homomorphic computations:

- **Partially Homomorphic Encryption (PHE):** Supports one operation (additive or multiplicative) an unbounded number of times (e.g., Paillier for addition, RSA/ElGamal for multiplication) [2306.14407], [1704.03578].
- **Somewhat Homomorphic Encryption (SWHE):** Permits both addition and multiplication, but with noise growth limiting circuit depth [2306.14407], [1704.03578].
- **Leveled FHE:** Supports all circuits up to a depth $d$ by parameter delegation (moduli selection), avoiding bootstrapping [2305.05904], [2011.06820], [1508.06574].
- **Fully Homomorphic Encryption (FHE):** Allows unbounded circuit depth via bootstrapping—periodically homomorphically evaluating decryption to reduce noise [2305.05904], [1704.03578].

Security is based on hard problems: classical PHE schemes (e.g., RSA, Paillier, ElGamal) rely on factoring or discrete log; all post-2009 practical FHE schemes rely on the Learning With Errors (LWE) and Ring-LWE (RLWE) assumptions [2305.05904], [2504.16091].

## 2. Algebraic Foundations and Main Scheme Families

The RLWE paradigm dominates efficient FHE implementations. Let $R_q = \mathbb{Z}_q[x]/(f(x))$, frequently with $f(x)$ cyclotomic, $n = \deg f$, and "noise" sampled from a discrete Gaussian $\chi$. Ciphertexts are typically tuples over $R_q$; plaintexts are in $R_t$, $t \ll q$. Most schemes are key-switching and modulus-switching enabled, allowing efficient relinearization and depth management [2305.05904], [1704.03578], [1508.06574].

### Key FHE Families and Features

| Scheme      | Model             | Key Concepts         | Security           | Applications                  |
|-------------|-------------------|----------------------|--------------------|-------------------------------|
| BGV         | Leveled+bootstrap | Modulus-switching    | RLWE               | Linear algebra, private DBs   |
| BFV         | Integer/FV-style  | Plaintext batching   | RLWE               | ML, statistics                |
| CKKS        | Approximate       | Scaled real vectors  | RLWE               | Private ML, genomics          |
| TFHE        | Boolean gates     | Fast gate bootstrap  | LWE/Torus-LWE      | Secure logic, bit ops         |

- **BGV** and **BFV** provide leveled and optionally fully homomorphic integer arithmetic [2305.05904], [1704.03578], [1508.06574].
- **CKKS** offers approximate arithmetic with SIMD (“slot packing”), advantageous for ML inference and floating-point workflows [2305.05904], [1508.06574], [2011.06820].
- **TFHE** is optimized for bit-level Boolean circuits, supports sub-millisecond universal bootstrapping, and is essential for privacy-preserving logic [2305.05904], [2203.02547].

Noise management is central: additive and multiplicative noise growth are regime-defining. Ciphertext expansion, noise budget, and the requirement for relinearization and rescaling after each multiplication determine circuit depth and parameter selection [2305.05904], [1508.06574], [2011.06820], [1704.03578].

## 3. Bootstrapping, Depth, and Performance Engineering

Bootstrapping—homomorphically evaluating nearly the entire decryption procedure using encrypted secret keys—restores noise to a baseline and enables FHE [2305.05904], [2112.15479], [1704.03578]. In BGV/BFV/CKKS, bootstrapping consists of hundreds of homomorphic multiplications, automorphisms, and rescalings, consuming large modulus levels and imposing significant time/memory requirements [2112.15479].

- Efforts focus on reducing its computational complexity (e.g., hardware-aware optimizations, parallel architectures, advanced RNS arithmetic), with hardware implementations such as BTS achieving up to $5,556\times$ improvements on machine learning workloads versus CPU [2112.15479].
- Parameter tuning is critical: the trade-off between security (via polynomial dimension $N$ and modulus $q$), practical noise margin, multiplicative depth, and working set/memory constraints is delicate [2305.05904], [2112.15479], [2003.04510], [1508.06574].

SIMD batching—packing multiple plaintext elements into a single ciphertext—amortizes per-operation overhead across slots and is key to usable encrypted matrix multiplication and ML inference [2405.02238], [1810.10121], [2311.06142]. Compiler technology (e.g., Viaduct-HE, nGraph-HE) automates data layout and schedule search to optimize slot utilization, depth, and communication [2311.06142], [1810.10121].

## 4. Applications and Protocol Integration

HE is deployed in a spectrum of domains:

- **Privacy-Preserving Machine Learning:** Both inference and federated training are feasible; e.g., deep learning on encrypted medical images (oblivious inference on OCT scans and federated nodule detection with CKKS and threshold Paillier in [2110.07768]), collaborative FL on foundation models (CKKS-based FedAvg with sensitivity mask in [2303.10837]), and support for regression, PCA, and clustering [1508.06574], [2011.06820].
- **Secure Database Search:** Exact and range queries evaluated via homomorphic matching polynomials over ring-based FHE; blockwise encoding in RLWE rings accelerates protocols compared to bitwise integer DGHV [1606.03304].
- **Encrypted Genomics:** Large-scale GWAS computation with complex packing into CKKS slots; semi-parallel logistic regression using homomorphic matrix-multiplies and slot-level polynomial approximations [1902.04303].
- **Encrypted Statistical Analytics:** Homomorphic linear algebra primitives for regression, ML model evaluation, and encrypted matrix operations; slot-packing enables vector operations at scale [1508.06574], [2405.02238].

Searchable encryption schemes increasingly employ HE (often PHE for sum/TF-IDF rankings) as a subcomponent for index construction and search, with support for ranked multi-keyword queries and verifiability, though limitations in functional expressiveness and ciphertext expansion persist [2306.14407].

## 5. Practical Limitations, Hardware, and Compiler Optimizations

HE systems contend with several fundamental limitations [1508.06574], [2305.05904], [2112.15479]:

- **Noise growth bounds circuit depth:** Without bootstrapping, schemes are leveled and circuits must fit within the permitted multiplicative depth (dictated by $q$, $N,$ and the choice of $\chi$).
- **Ciphertext Expansion:** All RLWE-based schemes expand plaintexts to tuples of $n$-degree polynomials with $q$-bit coefficients; typical sizes are 1–5 kB for BFV/BGV, hundreds of kB for large packing [2305.05904], [1508.06574].
- **Operation Complexity:** Ciphertext-ciphertext multiplication—including key-switching and relinearization—are orders of magnitude slower than plaintext operations; bootstrapping remains the largest computational bottleneck unless offloaded to ASIC/FPGA accelerators [2003.04510], [2112.15479].
- **Compiler Support:** Array-to-HE compilers such as Viaduct-HE [2311.06142] and graph-based intermediate representations (e.g., nGraph-HE [1810.10121]) automate layout and depth minimization, enabling competitive runtimes and sophisticated schedule search.

Hardware accelerators—flexibly co-designed for NTT, RNS base conversion, and memory-access locality—are pivotal for scaling to deep neural networks and high-throughput analytics [2112.15479], [2005.03002], [2003.04510].

## 6. Security Analysis, Post-Quantum Status, and Open Directions

Almost all current practical HE schemes base security on RLWE, conjectured quantum-resistant but potentially subject to subexponential attacks if lattice reduction advances. Main points [2504.16091], [2305.05904], [1704.03578]:

- **Lattice-based schemes (LWE/RLWE):** Currently best-studied and most widely implemented (BGV, BFV, CKKS, TFHE) [2305.05904], [2504.16091].
- **Code-based FHE:** Motivated by post-quantum diversification, these rely on NP-hard syndrome decoding (e.g. McEliece, rank-metric constructions) but remain mainly SWHE (supporting limited depth), with obstacles in bootstrapping efficiency and key size [2504.16091]. Five key future research directions include practical bootstrapping for codes, key-size reduction with structured codes, error-correction homomorphic to noise, formal reduction to worst-case code problems, and integration with multi-party and zero-knowledge protocols [2504.16091].

Open research challenges documented in recent surveys [2305.05904], [2011.06820], [2311.06142] include:

- Reducing bootstrapping latency to millisecond scale.
- Automating parameter selection for tighter security/noise/ciphertext trade-offs.
- Compiler and toolchain advancements for transparent integration into machine learning and data science.
- Multi-user and threshold FHE for distributed/private key settings.

HE is already fueling practical, privacy-preserving workflows in sensitive cloud computing, federated learning, statistical analytics, and secure multi-party collaboration. Ongoing advances in acceleration, tooling, and deeper theoretical understanding are rapidly expanding its scientific and engineering impact.

Source: https://www.emergentmind.com/topics/homomorphic-encryption-he