Linearly Homomorphic Authenticator Schemes

• Linearly homomorphic authenticators are cryptographic primitives that enable derivation of valid authenticators on linear functions of data without needing signing keys.
• They support diverse constructions including public-key signatures, MACs, multi-key aggregation, and ring-anonymous variants for applications like federated learning and verifiable computation.
• Security guarantees encompass unforgeability, context hiding, and anonymity while addressing efficiency trade-offs in large-scale and encrypted data processing.

Searching arXiv for the specified paper and closely related work on linearly homomorphic authenticators. A linearly homomorphic authenticator scheme is a cryptographic primitive that attaches a verification token to data and permits derivation of a valid authenticator on an admissible linear function of authenticated messages without access to the signing or authentication key. Across recent constructions, the abstraction covers public-key signatures, MAC-like designated-verifier mechanisms, multi-key and identity-based authenticators, ring-anonymous variants, and verifiable encodings embedded in homomorphic encryption. What remains invariant is the requirement that homomorphic evaluation on authenticators be consistent with linear evaluation on the underlying messages, while the admissible message spaces, coefficient domains, privacy guarantees, and verification models differ markedly among instantiations (Bottoni et al., 5 Sep 2025, Guo et al., 3 Jul 2025, Chatel et al., 2022).

1. Formal definition and homomorphic semantics

In a standard formulation, an LHA is specified by algorithms such as Setup, KeyGen, Auth, Eval (or Combine), and Ver; in signature-oriented presentations the corresponding syntax is Setup, KeyGen, Sign, Verify, and Evaluate. The essential correctness requirement is that, given valid authenticators on messages $m_1,\ldots,m_k$, anyone can derive an authenticator on a linear function $f(m_1,\ldots,m_k)$ and verification succeeds on the derived message-output pair (Bottoni et al., 5 Sep 2025, Guo et al., 2024).

The broadest formulation in the cited literature allows

$f(m_1,\ldots,m_k)=\sum_i a_i m_i,$

with public homomorphic evaluation on the authenticators. In the lattice-based ring-signature formulation, the statement is explicit: given authenticators on $m_1,\ldots,m_k$, anyone can derive an authenticator on $f(m_1,\ldots,m_k)=\sum a_i m_i$ without access to signing keys, and the derived authenticator verifies on the derived message (Guo et al., 3 Jul 2025). In the tight lattice linearly homomorphic signature, the message space is $M=\mathbb{Z}_p^n$, and admissible functions are $R$-linear with $R=\mathbb{Z}$ restricted to coefficients $c_i\in(-p/2,p/2]$, so that

$$f(m_1,\ldots,m_k)=\sum_{i=1}^k c_i m_i \in \mathbb{Z}_p^n$$

is verified publicly under a tag $f(m_1,\ldots,m_k)$0 (Guo et al., 2024).

The coefficient domain is not universal. In the lattice-based linearly homomorphic ring signature, inputs are in $f(m_1,\ldots,m_k)$1 and homomorphic coefficients are $f(m_1,\ldots,m_k)$2, so the supported operations are additions and selection by $f(m_1,\ldots,m_k)$3 coefficients rather than arbitrary integer linear combinations (Guo et al., 3 Jul 2025). In the federated-learning instantiation, the homomorphism is used additively with $f(m_1,\ldots,m_k)$4 for all $f(m_1,\ldots,m_k)$5; scalar multiplication is not required because federated averaging is performed only after verification by dividing by $f(m_1,\ldots,m_k)$6 locally (Bottoni et al., 5 Sep 2025). In the semigroup-homomorphic lattice construction, “addition” is concatenation and “scalar multiplication” is repetition, so the admissible linearity is semigroup-linear rather than vector-space linear (Guo et al., 21 Mar 2025).

The literature also distinguishes classes within the LHA umbrella. Homomorphic signatures are public-key and publicly verifiable. Homomorphic MACs are symmetric-key authenticators with key-based access control. Homomorphic ring signatures add signer ambiguity to the homomorphic signature setting, so the authenticator proves that “someone in the ring” authorized the data and its linear transformations (Guo et al., 3 Jul 2025). This classification is important because many practical systems referred to as homomorphic authenticators are not signatures in the strict public-verifiability sense.

2. Construction paradigms and algebraic realizations

One concrete realization is the context-hiding, identity-based, multi-key LHA integrated into secure aggregation for federated learning. In that scheme, each client with identity $f(m_1,\ldots,m_k)$7 derives $f(m_1,\ldots,m_k)$8, authenticates a vector $f(m_1,\ldots,m_k)$9, and obtains

$f(m_1,\ldots,m_k)=\sum_i a_i m_i,$0

where $f(m_1,\ldots,m_k)=\sum_i a_i m_i,$1 binds the signature to the signer’s identity and $f(m_1,\ldots,m_k)=\sum_i a_i m_i,$2 are global components enabling homomorphic combination across different signers. The aggregator computes

$f(m_1,\ldots,m_k)=\sum_i a_i m_i,$3

and verification checks whether $f(m_1,\ldots,m_k)=\sum_i a_i m_i,$4 authenticates $f(m_1,\ldots,m_k)=\sum_i a_i m_i,$5 under the exact identity set $f(m_1,\ldots,m_k)=\sum_i a_i m_i,$6 (Bottoni et al., 5 Sep 2025).

Lattice-based realizations use trapdoor generation, Gaussian sampling, and SIS-based reductions. The tightly secure lattice LHS constructs signatures as short lattice vectors satisfying simultaneous congruence conditions modulo $f(m_1,\ldots,m_k)=\sum_i a_i m_i,$7 and modulo $f(m_1,\ldots,m_k)=\sum_i a_i m_i,$8, with tag-dependent matrices $f(m_1,\ldots,m_k)=\sum_i a_i m_i,$9 generated by orthogonal tag embedding. Homomorphic evaluation is literal linear combination: $m_1,\ldots,m_k$0 and verification checks norm bounds, message binding modulo $m_1,\ldots,m_k$1, and tag-dependent binding modulo $m_1,\ldots,m_k$2 (Guo et al., 2024). A related semigroup-homomorphic lattice scheme uses GPV preimage sampling for each message component, but its homomorphic composition is concatenative: $m_1,\ldots,m_k$3 which addresses homomorphism over a semigroup rather than over a group (Guo et al., 21 Mar 2025).

Anonymous variants use ring structure. In the lattice-based linearly homomorphic ring signature, a signer forms a ring $m_1,\ldots,m_k$4 from arbitrary public keys, signs under a common tag $m_1,\ldots,m_k$5, and outputs $m_1,\ldots,m_k$6 satisfying

$m_1,\ldots,m_k$7

Public evaluation simply sums signature vectors with coefficients in $m_1,\ldots,m_k$8, while verification reconstructs $m_1,\ldots,m_k$9, recomputes the target vector from $f(m_1,\ldots,m_k)=\sum a_i m_i$0, and checks both the congruence and the acceptance norm (Guo et al., 3 Jul 2025).

A different design line embeds authentication into ciphertext structure. In VERITAS and in the multigroup FHE construction, the authenticator is not a standalone public-key signature but a verifiable encoding over encrypted data. Replication encoding authenticates by expanding each plaintext slot into challenge slots and replicated data slots; polynomial encoding authenticates by representing the plaintext as a degree-1 polynomial constrained at $f(m_1,\ldots,m_k)=\sum a_i m_i$1 and at a secret point $f(m_1,\ldots,m_k)=\sum a_i m_i$2. The homomorphic update of the authenticator is performed by the underlying homomorphic encryption evaluation, and verification occurs after decryption through either challenge-slot consistency or a polynomial identity check (Chatel et al., 2022, Fernàndez-València, 2023).

3. Multi-key aggregation, tags, anonymity, and privacy

A central development in recent LHA work is the transition from single-key homomorphism to multi-key aggregation. In the federated-learning protocol, no shared signing key or trusted setup among clients is needed. Each client publishes $f(m_1,\ldots,m_k)=\sum a_i m_i$3, and verification is performed with the exact public-key set corresponding to the active identities: $f(m_1,\ldots,m_k)=\sum a_i m_i$4 If the aggregator tries to include a forged key or omit a contributor, verification fails because the public-key set used in verification must match the identities bound in $f(m_1,\ldots,m_k)=\sum a_i m_i$5 (Bottoni et al., 5 Sep 2025).

Tagging serves a similar dataset-separation role in lattice signatures. In the tight lattice LHS, each dataset is identified by a tag $f(m_1,\ldots,m_k)=\sum a_i m_i$6, and the tag is embedded through the orthogonal matrix $f(m_1,\ldots,m_k)=\sum a_i m_i$7. Verification is therefore not merely a message check; it is a check that the derived authenticator is valid for the claimed linear function under the same tag, preventing unauthorized recombinations across tags (Guo et al., 2024). The semigroup-linear lattice construction uses a related tag-dependent matrix

$f(m_1,\ldots,m_k)=\sum a_i m_i$8

with delegated bases for $f(m_1,\ldots,m_k)=\sum a_i m_i$9 to isolate per-dataset signature spaces without dimension blowup (Guo et al., 21 Mar 2025).

Privacy notions are scheme-dependent. The multi-key federated-learning authenticator is explicitly context-hiding: once signed, individual contributions remain hidden, and no one can leak information from signatures beyond what is revealed by the aggregate and the public verification-key set (Bottoni et al., 5 Sep 2025). The tight lattice LHS provides $M=\mathbb{Z}_p^n$0-weakly context hiding: if at most $M=\mathbb{Z}_p^n$1 derived signatures correspond to linear functions that agree on two input tuples, then the distributions of the derived signatures are statistically close (Guo et al., 2024). The semigroup-linear lattice signature proves weak context hiding in the Boneh–Freeman sense, again by showing that signatures are discrete Gaussian samples on identical cosets whenever the computed outputs coincide (Guo et al., 21 Mar 2025).

Anonymity is a stronger notion than context hiding and arises in ring-based LHAs. The lattice LHRS achieves strong anonymity under full key exposure: even when all secret keys are exposed, a challenge signature is statistically indistinguishable with respect to which ring member signed it, because the output distribution is tied to the coset and Gaussian parameter rather than to the particular trapdoor used in sampling (Guo et al., 3 Jul 2025). By contrast, verifiable encodings such as REP and PE in VERITAS are designated-verifier authenticators; their security depends on secret verification material, so they do not offer public verifiability and should not be conflated with public homomorphic signatures (Chatel et al., 2022).

4. Security models and guarantees

Unforgeability is the baseline guarantee. In the federated-learning multi-key LHA, without access to $M=\mathbb{Z}_p^n$2 for some $M=\mathbb{Z}_p^n$3, an adversary cannot produce a valid aggregated authenticator for any $M=\mathbb{Z}_p^n$4 except with negligible probability. The paper states the tampering consequence explicitly: $M=\mathbb{Z}_p^n$5 and likewise verification fails if a forged component authenticator is injected into the homomorphic combination unless it was produced with an authorized signing key and the claimed aggregate is adjusted accordingly (Bottoni et al., 5 Sep 2025).

The signature-centric literature formalizes this through EUF-CMA-type games. The tight lattice LHS proves existential unforgeability under chosen-message attacks in the standard model, with a tight reduction to SIS and without random oracles. A successful forgery yields the SIS vector

$M=\mathbb{Z}_p^n$6

satisfying $M=\mathbb{Z}_p^n$7 and a norm bound $M=\mathbb{Z}_p^n$8 (Guo et al., 2024). The lattice LHRS proves unforgeability against insider corruption and reduces forgery outside the signed span under a fixed tag to finding a short nonzero kernel vector for the embedded ring matrix, again under SIS (Guo et al., 3 Jul 2025). The semigroup-linear lattice scheme gives a tight reduction, up to negligible loss, from its fixed-message-range unforgeability notion to SIS with bound $M=\mathbb{Z}_p^n$9 (Guo et al., 21 Mar 2025).

Soundness in verifiable-encoding authenticators is probabilistic rather than exact algebraic unforgeability. In REP, a successful wrong output that still passes challenge and replication checks is bounded by $R$0. In PE, if the authentication degree is $R$1, the cheating probability is at most

$R$2

using the polynomial identity lemma over $R$3. Polynomial compression changes the bound to

$R$4

while re-quadratization is argued to preserve security through random masking (Chatel et al., 2022). The multigroup FHE variant states the generic forgery condition as production of an accepted $R$5 under either an unseen label or an output inconsistent with the authenticated inputs and linear circuit, under RLWE, PRF, and collision-resistant hash assumptions (Fernàndez-València, 2023).

A persistent misconception is that homomorphic authenticity automatically implies privacy. The cited literature does not support that generalization. Privacy in the federated-learning construction comes from the combination of masking-based secure aggregation and a context-hiding authenticator; privacy in ring-based LHRS comes from anonymity; privacy in PE and REP depends on the semantic security of the underlying homomorphic encryption and the secrecy of the verification material (Bottoni et al., 5 Sep 2025, Guo et al., 3 Jul 2025, Chatel et al., 2022).

5. Protocol embeddings and application domains

The most explicit systems embedding is federated learning with secure aggregation. Each client $R$6 computes pairwise masks

$R$7

sends the masked update $R$8, authenticates the unmasked update with

$R$9

and, in the vectorized version, authenticates columns $R=\mathbb{Z}$0 by

$R=\mathbb{Z}$1

The server un-masks to recover $R=\mathbb{Z}$2, computes

$R=\mathbb{Z}$3

and broadcasts the aggregate and authenticator. Clients verify

$R=\mathbb{Z}$4

accept only if every check succeeds, and then divide by $R=\mathbb{Z}$5 locally for federated averaging (Bottoni et al., 5 Sep 2025).

A second embedding is verifiable outsourced computation over homomorphic encryption. In the multigroup FHE framework, the authenticator is a replication encoding over encrypted plaintext vectors. Authentication outputs $R=\mathbb{Z}$6, evaluation computes $R=\mathbb{Z}$7, and verification first checks the hash-tree label consistency and then decrypts the extended plaintext vector to test challenge slots and replica slots. For linear functions $R=\mathbb{Z}$8, the construction states

$R=\mathbb{Z}$9

(Fernàndez-València, 2023).

VERITAS generalizes this style to arbitrary homomorphic operations in RLWE-based FHE. REP uses replicated and challenge-augmented plaintext slots; PE encodes a plaintext as a low-degree polynomial with constraints at $c_i\in(-p/2,p/2]$0 and $c_i\in(-p/2,p/2]$1. Both are homomorphic for linear updates, and PE is also homomorphic for polynomial circuits through coefficient-vector convolution. The application portfolio explicitly includes ride-hailing, genomic-data analysis, encrypted search, machine-learning training and inference, and federated averaging (Chatel et al., 2022).

Classical application domains of public linearly homomorphic signatures remain prominent. The tight lattice LHS targets network coding authentication, verifiable computation of linear statistics such as sums, averages, and linear regressions, and data provenance or streaming aggregation (Guo et al., 2024). The lattice LHRS adds anonymous provenance, with confidential blockchain transactions and secure multi-party computation cited as motivating scenarios (Guo et al., 3 Jul 2025). The semigroup-linear lattice signature suggests authenticated stream processing and log authentication where append and multiplicity semantics are more natural than vector-space addition (Guo et al., 21 Mar 2025).

6. Efficiency, comparisons, and limitations

Practicality is highly construction-dependent. In the federated-learning multi-key LHA, vectorization is central: clients authenticate vectors $c_i\in(-p/2,p/2]$2 rather than individual scalars, so tags are constant-size per column, independent of $c_i\in(-p/2,p/2]$3, while computation scales with vector length. On a Rust implementation using Arkworks over BLS12-381, tag generation for a model with one million parameters is approximately $c_i\in(-p/2,p/2]$4 seconds per client, aggregator combination is approximately $c_i\in(-p/2,p/2]$5 ms for $c_i\in(-p/2,p/2]$6 clients, $c_i\in(-p/2,p/2]$7 ms for $c_i\in(-p/2,p/2]$8 clients, and $c_i\in(-p/2,p/2]$9 ms for $$f(m_1,\ldots,m_k)=\sum_{i=1}^k c_i m_i \in \mathbb{Z}_p^n$$0 clients, while verification of the aggregated authenticator is approximately $$f(m_1,\ldots,m_k)=\sum_{i=1}^k c_i m_i \in \mathbb{Z}_p^n$$1 ms per client. The measured authenticator size is approximately $$f(m_1,\ldots,m_k)=\sum_{i=1}^k c_i m_i \in \mathbb{Z}_p^n$$2 KB per column (Bottoni et al., 5 Sep 2025).

VERITAS exposes a different trade-off profile. Under BFV parameters $$f(m_1,\ldots,m_k)=\sum_{i=1}^k c_i m_i \in \mathbb{Z}_p^n$$3, $$f(m_1,\ldots,m_k)=\sum_{i=1}^k c_i m_i \in \mathbb{Z}_p^n$$4, and $$f(m_1,\ldots,m_k)=\sum_{i=1}^k c_i m_i \in \mathbb{Z}_p^n$$5, the amortized per-slot timings show Addition at $$f(m_1,\ldots,m_k)=\sum_{i=1}^k c_i m_i \in \mathbb{Z}_p^n$$6 $$f(m_1,\ldots,m_k)=\sum_{i=1}^k c_i m_i \in \mathbb{Z}_p^n$$7 for REP and $$f(m_1,\ldots,m_k)=\sum_{i=1}^k c_i m_i \in \mathbb{Z}_p^n$$8 $$f(m_1,\ldots,m_k)=\sum_{i=1}^k c_i m_i \in \mathbb{Z}_p^n$$9 for PE, Constant multiplication at $f(m_1,\ldots,m_k)$00 $f(m_1,\ldots,m_k)$01 for REP and $f(m_1,\ldots,m_k)$02 $f(m_1,\ldots,m_k)$03 for PE, Rotation at $f(m_1,\ldots,m_k)$04 $f(m_1,\ldots,m_k)$05 for REP and $f(m_1,\ldots,m_k)$06 $f(m_1,\ldots,m_k)$07 for PE, and multiplicative-depth-$f(m_1,\ldots,m_k)$08 evaluation at $f(m_1,\ldots,m_k)$09 $f(m_1,\ldots,m_k)$10 for REP and $f(m_1,\ldots,m_k)$11 $f(m_1,\ldots,m_k)$12 for PE. REP scales linearly with the replication factor $f(m_1,\ldots,m_k)$13, whereas PE pays degree-growth costs that can be mitigated by polynomial compression or interactive re-quadratization (Chatel et al., 2022).

Comparisons with prior verifiability mechanisms clarify where LHAs are attractive. In federated learning, homomorphic hashes and Pedersen-commitment systems may require inter-client exchange of commitments and zero-knowledge proofs for input validation, while RoFL incurs heavy computation and discrete-log decoding in constrained ranges. The multi-key LHA approach instead uses public verification keys and a single aggregated authenticator returned by the server, without inter-client exchanges or ZK proofs (Bottoni et al., 5 Sep 2025). A plausible implication is that constant-size tags per vector and direct verification are especially well matched to large-model aggregation.

The limitations are equally structural. The lattice LHRS supports only linear combinations over $f(m_1,\ldots,m_k)$14, so extending to general $f(m_1,\ldots,m_k)$15-scalar homomorphism remains open (Guo et al., 3 Jul 2025). The tight lattice LHS is single-key and does not support cross-key aggregation; batching is restricted to a single tag and a single public key (Guo et al., 2024). The semigroup-linear signature grows linearly with output length because signatures are sequences of lattice vectors, and its unforgeability notion is fixed-message-range rather than full standard EUF-CMA (Guo et al., 21 Mar 2025). VERITAS and the multigroup FHE authenticator are not publicly verifiable, since verification requires secret material and, in some variants, distributed decryption; replication encoding also increases ciphertext size by a factor $f(m_1,\ldots,m_k)$16, and PE can suffer communication growth with multiplicative depth (Chatel et al., 2022, Fernàndez-València, 2023).

Taken together, these constructions show that “linearly homomorphic authenticator scheme” denotes a family of mechanisms rather than a single canonical object. Some members prioritize public verifiability, some anonymity, some multi-key aggregation, some privacy of computation context, and some compatibility with encrypted computation. The unifying criterion is exact or probabilistically sound authentication of an authorized linear relation on previously authenticated data, achieved through homomorphic update of the authenticator itself.