Fully Homomorphic Encryption (FHE): Unlimited Computation on Encrypted Data
What FHE enables, where it works today, and the performance tradeoffs to consider.
Written by
Berwin D
Learn
Jul 7, 2026
Fully homomorphic encryption (FHE) is the most powerful form of homomorphic encryption. It allows both addition and multiplication to be performed on encrypted data an unlimited number of times, which means arbitrary computation can run on ciphertexts without ever decrypting them. A server can execute any program on data it cannot read, returning an encrypted result only the data owner can unlock.
FHE was considered a theoretical holy grail of cryptography for over 30 years. The question of whether unlimited computation on encrypted data was even possible remained open until Craig Gentry constructed the first FHE scheme in 2009 as part of his doctoral work at Stanford. His construction introduced bootstrapping, the technique that made unlimited computation possible.
Since 2009, FHE performance has improved by many orders of magnitude, and FHE is now used in specific production applications. This guide covers what FHE is, how it differs from other homomorphic encryption, the main schemes, why it was hard, the applications, and how it compares to multi-party computation. For the broader context, see the homomorphic encryption overview.
FHE vs Partial and Somewhat Homomorphic Encryption
Homomorphic encryption comes in three levels of capability.
Partially Homomorphic Encryption (PHE) supports one operation type, either addition or multiplication, an unlimited number of times. RSA supports multiplication. Paillier supports addition. PHE is efficient but limited to a single operation.
Somewhat Homomorphic Encryption (SHE) supports both addition and multiplication, but only for a limited number of operations before accumulated noise makes decryption fail.
Fully Homomorphic Encryption (FHE) supports both addition and multiplication an unlimited number of times. Because any computation can be expressed as a circuit of additions and multiplications, FHE can in principle evaluate any function on encrypted data.
The jump from SHE to FHE is what Gentry solved. SHE schemes existed before 2009, but they hit a wall when noise accumulated. FHE broke through that wall.
Why FHE Was Hard: Noise and Bootstrapping
FHE schemes are built on lattice cryptography, using hard problems like Learning With Errors (LWE) and its ring variant. For security, each ciphertext includes a small amount of random noise.
Every homomorphic operation grows the noise. Addition grows it a little. Multiplication grows it a lot. Once the noise exceeds a threshold, the ciphertext can no longer be decrypted correctly. This noise growth is why somewhat homomorphic schemes support only bounded computation.
Gentry's breakthrough was bootstrapping. Bootstrapping homomorphically evaluates the decryption function on a noisy ciphertext, producing a fresh ciphertext that encrypts the same value with reduced noise. This resets the noise budget, allowing computation to continue indefinitely. Bootstrapping is what turns a somewhat homomorphic scheme into a fully homomorphic one.
Bootstrapping is also the most computationally expensive operation in FHE, which is the primary reason FHE has historically been slow. Much of the research progress since 2009 has focused on making bootstrapping faster.
The Main FHE Schemes
Four families of FHE schemes dominate, each optimized for different workloads.
BGV (Brakerski-Gentry-Vaikuntanathan). An efficient scheme for integer arithmetic, well-suited to exact computation on encrypted integers. Implemented in HElib and OpenFHE.
BFV (Brakerski-Fan-Vercauteren). Another integer arithmetic scheme, similar in use to BGV, with different noise management. Implemented in Microsoft SEAL and OpenFHE.
CKKS (Cheon-Kim-Kim-Song). Supports approximate arithmetic on real and complex numbers, which makes it well-suited to machine learning and signal processing where approximate results are acceptable. Widely used for privacy-preserving ML inference.
TFHE (Torus FHE). Optimized for fast bootstrapping and Boolean circuit evaluation, enabling low-latency operations. Used by Zama in its Concrete library and for blockchain FHE applications.
The choice of scheme depends on the workload: BGV and BFV for exact integer computation, CKKS for approximate real-number computation like ML, and TFHE for fast Boolean operations.
Applications
Privacy-preserving machine learning inference. A user submits an encrypted input to a model and receives an encrypted prediction. The CKKS scheme is well-suited because ML tolerates approximate arithmetic. The model owner never sees the input, and the user never sees the model weights.
Confidential cloud computation. An organization encrypts sensitive data, sends it to a cloud provider, and receives encrypted results. The provider computes without seeing the data, enabling outsourced computation on regulated data.
Private database queries. A user retrieves a record without the database learning which record was requested.
Encrypted blockchain computation. FHE enables confidential smart contracts where inputs and state remain encrypted. Companies like Zama and Fhenix build FHE tooling for blockchain.
Regulated data analytics. Healthcare and financial institutions run analytics on encrypted data where exposure, even internally, is restricted by regulation.
Is FHE Practical?
FHE has moved from theoretical to practical for specific workloads, while remaining expensive for general-purpose computation.
Operations on FHE ciphertexts are still far slower than plaintext operations, and ciphertexts are much larger. But the improvement since 2009 has been dramatic, driven by better schemes, optimized libraries (Microsoft SEAL, OpenFHE, Zama's Concrete), and emerging hardware acceleration including dedicated FHE chips under development.
For bounded workloads like encrypted inference, private information retrieval, and specific confidential computations, FHE is now practical. For arbitrary large-scale general computation, it remains costly. This is why FHE is typically applied selectively, to the specific part of a workload that genuinely requires computing on encrypted data by a single untrusted party.
FHE vs Multi-Party Computation
FHE and multi-party computation are often compared because both enable computation on private data. They suit different situations.
FHE is non-interactive. One party encrypts data and hands it off. Another party computes on the ciphertext alone, with no further communication needed. This is ideal when a single party wants to outsource computation on its own data to an untrusted server. The cost is computational expense.
MPC is interactive. Multiple parties, each holding private data, run a protocol together, exchanging messages to jointly compute a result. MPC is generally much faster than FHE for the same computation, but requires the parties to be online and communicating.
The practical tradeoff: choose FHE when the situation is a single party outsourcing computation without interaction and the expense is acceptable. Choose MPC when multiple parties hold data and can interact, which covers most financial data collaboration, threshold signatures, and cross-institutional analytics. See the secure multi-party computation guide.
Silence Laboratories builds its privacy-preserving compute products on multi-party computation, which delivers the performance profile and multi-party model suited to financial services. FHE is a complementary technology in the broader privacy-enhancing technologies landscape, strong for non-interactive outsourced computation.
Related Reading
FAQ
What is fully homomorphic encryption? Fully homomorphic encryption (FHE) allows both addition and multiplication on encrypted data an unlimited number of times, enabling arbitrary computation on ciphertexts without decryption. A server can run any program on data it cannot read, returning an encrypted result only the data owner can decrypt.
Who invented fully homomorphic encryption? Craig Gentry constructed the first FHE scheme in 2009 during his doctoral work at Stanford. He introduced bootstrapping, the technique that resets ciphertext noise and enables unlimited computation. This solved a problem that had been open for over 30 years.
What are the main FHE schemes? BGV and BFV for exact integer arithmetic, CKKS for approximate real-number arithmetic (well-suited to machine learning), and TFHE for fast Boolean circuit evaluation. The choice depends on the workload.
Is fully homomorphic encryption practical? For bounded workloads like encrypted inference and private information retrieval, yes. Performance has improved by orders of magnitude since 2009. For arbitrary large-scale general computation, it remains expensive, so FHE is typically applied selectively.
What is the difference between FHE and MPC? FHE is non-interactive: one party computes on another's encrypted data with no communication, but at high computational cost. MPC is interactive: multiple parties jointly compute through a protocol, generally much faster but requiring the parties to communicate. FHE suits non-interactive outsourced computation. MPC suits interactive multi-party settings.
SHARE