---
title: Keyed-Homomorphic Encryption Overview
url: https://www.emergentmind.com/topics/keyed-homomorphic-encryption-khe
type: topic
---

# Keyed-Homomorphic Encryption Overview

Keyed-Homomorphic Encryption (KHE) denotes homomorphic cryptosystems that explicitly keep track of encryption keys and support evaluation over ciphertexts tied to different keys or identities [2506.20101]. In symmetric-key settings, the same term is used for schemes in which encryption and decryption are controlled by a symmetric secret key, while homomorphic evaluation is performed on ciphertexts without revealing that key [1310.2452][1902.05771]. In the BFV/CKKS literature on secure aggregation, KHE is treated as synonymous in spirit with Multi-Key Homomorphic Encryption (MKHE): evaluators compute over ciphertexts encrypted under distinct keys without a single shared secret, whereas threshold HE uses a single public key and shares the secret key among parties [2506.20101][1911.04101].

## 1. Terminological scope and conceptual variants

Across these works, KHE is not a single standardized construction but a family of keyed homomorphic paradigms. One line of work uses KHE as an umbrella notion for key-aware homomorphic evaluation across different identities or public keys; in that formulation, “multi-identity” and “multi-key” HE are concrete realizations, and the key set referenced by a ciphertext is part of the semantics of evaluation [2506.20101]. A second line uses KHE for symmetric-key homomorphic encryption, where a single secret key governs encryption and decryption, while evaluators operate directly on ciphertexts and do not hold that secret key [1310.2452][1902.05771].

This terminological split is substantive rather than merely stylistic. In symmetric-key KHE, all ciphertexts are under one secret key, and key awareness concerns access control and delegation. In MKHE, ciphertexts may originate under distinct keys, and the central technical problem is how to evaluate across heterogeneous key domains while preserving joint decryptability. A common source of ambiguity is therefore the assumption that KHE must be public-key and cross-key; the cited literature shows that it also includes single-key symmetric constructions.

A further conceptual boundary is with threshold HE. In the MKHE-centered account, threshold HE uses one public key and a shared secret, so it avoids heterogeneous-key extension but requires threshold setup and a comparatively static participant set. MKHE instead preserves distinct keys and supports evaluation over their union, at the price of more elaborate expansion, relinearization, and distributed decryption mechanisms [2506.20101][1911.04101].

## 2. Symmetric-key keyed homomorphism

The symmetric matrix-based fully homomorphic construction in "Fully Homomorphic Encryption Scheme with Symmetric Keys" fixes ciphertext space in $\mathrm{Mat}_4(\mathbb{Z}_N)$, where $N=\prod_{i=1}^{m} f_i$ and each $f_i=p_i q_i$. The secret key is an invertible matrix $k \in \mathrm{GL}_4(\mathbb{Z}_N)$ with inverse $k^{-1}$. Encryption samples $r \in \mathbb{Z}_N \setminus \{m\}$, builds a diagonal matrix $D(m,r)=\mathrm{diag}(m,x_1,x_2,x_3)$ via CRT-defined auxiliary entries, and outputs $C=k^{-1}D(m,r)k \bmod N$; decryption computes $D=k C k^{-1} \bmod N$ and returns $D_{1,1}$. Evaluation requires neither the secret key nor a separate evaluation key: homomorphic addition is matrix addition modulo $N$, and homomorphic multiplication is matrix multiplication modulo $N$. Because conjugation by $k$ is exact modulo $N$, the scheme defines $\eta(C)\equiv 0$ for ciphertexts produced by $\mathrm{Enc}$ and $\mathrm{Eval}$, so the construction is multi-hop, requires no bootstrapping, and supports arithmetic circuits of unbounded depth modulo $N$ [1310.2452].

That matrix scheme is explicitly symmetric rather than public-key. Its security discussion reduces confidentiality to the hardness of factoring $N$, states one-wayness and IND-KPA/IND-CPA goals, and does not claim CCA2 security. It also introduces operational primitives $\mathrm{Lock}(A;k)=k^{-1}Ak \bmod N$, $\mathrm{Unlock}(B;k)=kBk^{-1} \bmod N$, and $\mathrm{KeySetGen}_s$, which composes several matrices $k^{(i)}$ into a master key $k=\prod_{i=1}^{s} k^{(i)}$. These primitives are used to organize a cloud workflow with separate roles for Data Owner, Delegator, Computation Center, Mapping Division, and Data User, while keeping evaluators keyless [1310.2452].

The multivariate-polynomial construction in "A Somewhat Homomorphic Encryption Scheme based on Multivariate Polynomial Evaluation" is also symmetric-key, but its algebraic organization is different. The secret key includes an ideal $I$, evaluation points $\{z_i\}$, a scaling factor $p$, and a vector $s$. Ciphertexts lie in $\mathbb{F}_q^n$ and take the form
$$
c = m p \cdot 1 + G f + e \bmod q,
$$
where $f \in I_{\le r}$ and $e=(0,\bar e)$. Decryption computes
$$
m'=\left\lfloor \frac{1}{\sigma_s p}\cdot (\langle s,c\rangle \bmod q)\right\rfloor \bmod 2.
$$
Evaluation is again keyless: addition is $c_1+c_2 \bmod q$, and multiplication is $(1/p)\cdot (c_1 \odot c_2)\bmod q$, where $\odot$ is the Hadamard product. The scheme is only somewhat homomorphic, because noise grows under evaluation. After $t$ additions, the inner-product noise standard deviation scales as $\sqrt{t}\,\|s_2\|_2 \alpha q$, while multiplication introduces the bound $\mathrm{stddev}(e_{\text{mult}}) < \sqrt{2}\,\alpha q + (1/\sqrt{p})(\alpha q)^2$ [1902.05771].

These two symmetric-key KHE lines occupy opposite ends of the exactness spectrum. The matrix scheme performs exact modular arithmetic with no noise growth, whereas the polynomial scheme behaves like a conventional leveled SHE system: correctness depends on keeping the extracted noise below the decision threshold, and multiplicative depth is structurally limited [1310.2452][1902.05771].

## 3. Multi-key evaluation and threshold-assisted reconciliation

A formal MKHE syntax used in the BFV/CKKS setting comprises $\mathrm{Setup}$, $\mathrm{KeyGen}$, $\mathrm{Encrypt}$, $\mathrm{Expand}$, $\mathrm{Eval}$, $\mathrm{Decrypt}$, $\mathrm{PartDec}$, and $\mathrm{FullDec}$. A fresh ciphertext under one public key is first expanded into a unified representation referencing a set of keys; evaluation then runs over the expanded ciphertexts and produces an output tied to the union of the participating key sets; decryption can be single-shot or distributed through partial decryptions $\nu_i$ followed by a merge step. Correctness is exact for exact schemes and approximate for CKKS [2506.20101].

"Collaborative Homomorphic Computation on Data Encrypted under Multiple Keys" realizes this cross-key KHE functionality by combining threshold HE and MKHE. A fixed set of model owners first aggregates their keys into one joint key $pk_{\mathbb{M}}$ through threshold setup, while each dynamic client retains its own key $pk_{\mathcal{C}}$. At evaluation time, ciphertexts are extended only to the two-key set $\{pk_{\mathbb{M}}, pk_{\mathcal{C}}\}$ rather than to $N+1$ separate keys. In the paper’s terminology, this reduces the extended ciphertext “dimension” from $(N+1)\times 2$ to $2\times 2$, equivalently reducing extended ciphertext length from $2(N+1)$ to $4$ [1911.04101].

The mechanism is built from leveled MKBGV and RGSW. Fresh BGV ciphertexts are standard two-component RLWE encryptions; extension places those components into the slots corresponding to the active keys; multiplication uses a tensor product followed by $\mathrm{KeySwitch}$ and $\mathrm{ModulusSwitch}$. Decryption is collaborative. Each model owner returns a blinded partial
$$
\rho_i = c_{\mathbb{M},1} s_{M_i} + t e_i,
$$
the evaluator aggregates $\rho=\sum_i \rho_i$, and the client completes decryption via
$$
\mu'=\langle c_{\mathcal{C}}, s_{\mathcal{C}}\rangle + (c_{\mathbb{M},0}-\rho).
$$
The evaluator is semi-honest, the model-owner side is fixed, and the approach removes per-client joint-key setup while preserving collaborative decryption [1911.04101].

This hybrid construction clarifies one important meaning of KHE in collaborative machine learning: key awareness need not imply that every key remains separate throughout the whole protocol. A threshold-aggregated domain can serve as one side of the computation, with MKHE used only to bridge to another party’s key at runtime.

## 4. Secure MKHE for privacy-preserving federated learning

The CDKS family of multi-key BFV/CKKS schemes extends MKHE with asymptotically optimal multi-key packed HE and faster multi-key operations via homomorphic gadget decomposition, but its use in multiparty secure computation creates a specific leakage channel. In the privacy-preserving federated learning setting analyzed in "Secure Multi-Key Homomorphic Encryption with Application to Privacy-Preserving Federated Learning", the server expands each client ciphertext $ct_i=(c_0^i,c_1^i)$ into a common key-indexed form, homomorphically adds them to obtain
$$
\overline{ct}=(\sum_{i=1}^n c_0^i, c_1^1,\dots,c_1^n),
$$
and then receives distributed partial decryptions $\nu_i=c_1^i s_i + e_i \bmod Q$. Because $c_0^i$ is public in the expanded ciphertext and $\nu_i$ is shared for merge, anyone observing both can compute $c_0^i+\nu_i \approx \mu_i \bmod Q$. The paper identifies this as a critical security vulnerability for PPFL and proposes SMHE, which retains the CDKS multi-key structure but introduces a masking layer tailored to BFV/CKKS [2506.20101].

SMHE attaches to each encrypted message a masking tuple $(ct, cz, \Gamma)$. Here $cz$ is an encryption of $0$ under a random mask $r$, and $\Gamma$ is a gadget encryption of $r$. Given two public keys $pk=(b,a)$ and $pk'=(b',a)$, the evaluator computes a correction ciphertext
$$
cx=(b'-b)\boxtimes \Gamma,
$$
so that the masking equations satisfy
$$
\langle sk, cx\rangle + \langle sk', cz\rangle \approx 0
$$
and
$$
\langle sk, ct\rangle + \langle sk, cx\rangle + \langle sk', cz\rangle \approx \mu.
$$
The multi-party operator $\mathrm{Extend}^*$ compresses multiple pairwise extensions by using $\sum_i (b_i-b)$, and masked addition inserts the balancing terms into the expanded ciphertext so that only the final joint decryption cancels them. Multiplication and relinearization are unchanged from CDKS.

In the PPFL workflow, the server publishes $pp \leftarrow \mathrm{SMHE.Setup}(1^\lambda)$, each client runs $\mathrm{SMHE.KeyGen}$, performs local training to obtain a gradient $g_i^t$, encodes it as $\mu_i \in R$, and sends $(ct_i, cz_i, \Gamma_i)$ to the server. The server expands the ciphertexts under the selected client set $S_{\text{benign}}$, iteratively applies $\mathrm{SMHE.Add}$ with masking material, receives partial decryptions $\nu_{id_i}=\bar c_{id_i}s_{id_i}+e_{id_i}$, reconstructs
$$
\mu = \bar c_0 + \sum_{id_i \in S_{\text{benign}}} \nu_{id_i} \bmod Q,
$$
decodes the aggregate gradient $\hat g_t$, and updates
$$
\hat w_t := \hat w_{t-1} - \eta \cdot \hat g_t / \sum \alpha_i.
$$
The privacy claim is that every individual term $c_0^i+\nu_i$ is entangled with masks derived from other parties’ public keys, and de-masking occurs only in the collective sum [2506.20101].

## 5. Security foundations, correctness regimes, and computational behavior

The cited KHE constructions rest on three distinct hardness bases. The BFV/CKKS and BGV-based multi-key systems are formulated over cyclotomic rings such as $R=\mathbb{Z}[x]/(x^N+1)$ and $R_Q=\mathbb{Z}_Q[x]/(x^N+1)$, and rely on RLWE-based indistinguishability; the SMHE paper further states a simulation-based semi-honest security condition in which there exists a PPT simulator $\mathrm{Sim}$ such that $\mathrm{View}_A^{\mathrm{real}}(\lambda) \approx_c \mathrm{View}_{\mathrm{Sim}}^{\mathrm{ideal}}(\lambda)$ [2506.20101]. The hybrid threshold/MKHE system inherits RLWE and RGSW security and assumes a semi-honest evaluator plus blinded threshold-style partial decryptions [1911.04101]. By contrast, the matrix symmetric FHE reduces security to factoring $N$ and emphasizes one-wayness and IND-KPA/IND-CPA rather than lattice assumptions [1310.2452]. The multivariate-polynomial SHE reduces IND-CPA security to the Hidden Subspace Membership problem, and states an HSM-to-LWE equivalence when the noise is confined to the last coordinate [1902.05771].

Correctness also differs sharply across families. The matrix symmetric FHE is exact and explicitly sets $\eta(C)\equiv 0$, so there is no noise accumulation. The multivariate-polynomial scheme is exact only while the extracted inner-product noise remains below the rounding threshold. BFV-style MKHE is exact modulo the plaintext modulus, whereas CKKS-style MKHE is approximate and phrases correctness as $\mathrm{Dec}(ct;\{sk_i\}) \approx \mathcal{C}(\mu_1,\dots,\mu_n)$ [1310.2452][1902.05771][2506.20101].

The most detailed implementation data appear in the SMHE study. Its PPFL implementation targets approximately 128-bit RLWE security with $N=2^{14}$, gadget dimension $\tau=8$, discrete Gaussian parameter $\sigma=3.2$, slot count $n_s=8192$, and $\chi$ with coefficients drawn from $\{0,1\}$; gadget decomposition follows the RNS-friendly approach by Bajard et al., and the released implementation uses C++, NTL 10.4.0, GMP 6.2.1, and PyTorch 1.11.0. For a single AlexNet iteration, client-side runtime is 4.64 s for SMHE and 2.72 s for CDKS, while server-side runtime is 38.22 s and 31.23 s respectively. Communication per iteration is 16.00 MB versus 7.00 MB on FCN and 139.50 MB versus 76.50 MB on AlexNet for SMHE and CDKS, whereas MKGSW reaches 33.39 GB and 381.47 GB. With 10 clients, FCN reports accuracy about 97.9% across schemes, with SMHE at 6.22 h and 41.40 GB; AlexNet reports accuracy about 74%, with SMHE at 232.49 h and 1397.31 GB. The paper summarizes this as less than a $2\times$ runtime and communication overhead relative to CDKS/THE while eliminating the identified leakage [2506.20101].

## 6. Boundaries, limitations, and unresolved questions

Several limitations recur across the KHE literature. The SMHE security proof is only for the semi-honest model; the paper states that extending to malicious adversaries would require verifiable computation such as zero-knowledge proofs or IOPs, and it also notes that the CKKS scaling/rescaling interplay with masking is not elaborated beyond approximate correctness [2506.20101]. The hybrid threshold/MKHE construction assumes a relatively static model-owner group, incurs $2N$ decryption interactions, does not include share verification or zero-knowledge proofs, and leaves concrete parameterization and tight noise bounds to future work [1911.04101].

The symmetric-key constructions have different but equally substantive constraints. The matrix FHE does not claim CCA2 security, describes IND-CPA security only against up to $m$ chosen pairs, and explicitly distinguishes itself from targeted-malleability KHE and key-homomorphic PRFs, which it does not realize [1310.2452]. The multivariate-polynomial construction is only somewhat homomorphic, supports bit messages, requires stronger orthogonality conditions such as $s \in (V_{I_{\le 2r}})^\perp$ for multiplication, and would need progressively larger spaces for deeper multiplicative circuits; bootstrapping is not provided [1902.05771].

These limitations also mark the conceptual boundaries of KHE. In symmetric-key KHE, keyedness chiefly governs who may encrypt and decrypt, while evaluation remains keyless. In MKHE, keyedness becomes part of the ciphertext state itself, because evaluation must preserve the association with a set of keys. The current literature therefore supports two complementary readings: KHE as secret-key-controlled homomorphic delegation, and KHE as homomorphic computation across heterogeneous key domains. The cited constructions show that both readings are active, technically non-equivalent, and relevant to cloud computation, collaborative ML, and privacy-preserving federated learning.

Source: https://www.emergentmind.com/topics/keyed-homomorphic-encryption-khe