Homomorphic Encryption: Computing on Encrypted Data

Homomorphic encryption is a form of encryption that allows computation to be performed directly on encrypted data, producing an encrypted result that, when decrypted, matches the result of performing the same computation on the original data. The data never has to be decrypted to be processed. A cloud server can compute on data it cannot read.

This solves a problem that ordinary encryption cannot. Standard encryption protects data at rest and in transit, but to compute on it, you must first decrypt it, exposing it at the moment of processing. Homomorphic encryption removes that exposure. The data stays encrypted throughout the computation.

The concept was long considered a theoretical holy grail of cryptography until Craig Gentry constructed the first fully homomorphic encryption scheme in 2009. Since then, performance has improved by orders of magnitude, and homomorphic encryption is now used in production for specific privacy-preserving applications. This guide covers what it is, the types, how it works, the applications, the limitations, and how it relates to multi-party computation.

The Core Idea

Homomorphic encryption preserves the structure of data through encryption, so that operations on ciphertexts correspond to operations on the underlying plaintext.

In concrete terms: encrypt the number 5 and the number 3. With a homomorphic scheme that supports addition, you can add the two ciphertexts together without decrypting them. Decrypt the result, and you get 8. The server that performed the addition never saw 5, 3, or 8. It operated entirely on encrypted values.

This means a party can outsource computation on sensitive data to an untrusted server. The server computes on ciphertexts and returns an encrypted result. Only the data owner, holding the decryption key, can read the result. The server learns nothing about the inputs or the output.

The Three Types of Homomorphic Encryption

Homomorphic encryption schemes differ in which operations they support and how many.

Partially Homomorphic Encryption (PHE). Supports one type of operation (either addition or multiplication) an unlimited number of times. RSA is multiplicatively homomorphic. The Paillier cryptosystem is additively homomorphic and is used inside some threshold signature protocols. PHE is efficient but limited to a single operation type.

Somewhat Homomorphic Encryption (SHE). Supports both addition and multiplication, but only a limited number of operations before the accumulated noise makes decryption fail. Useful for computations of bounded complexity.

Fully Homomorphic Encryption (FHE). Supports both addition and multiplication an unlimited number of times, enabling arbitrary computation on encrypted data. This is the most powerful and the most computationally expensive. See the fully homomorphic encryption guide for detail.

The progression from PHE to FHE trades capability against cost. PHE is fast but does one thing. FHE does everything but is expensive.

How It Works: Noise and Bootstrapping

Modern homomorphic encryption schemes are based on lattice cryptography, specifically problems like Learning With Errors (LWE) and Ring-LWE. These schemes introduce a small amount of random noise into each ciphertext for security.

Every homomorphic operation increases the noise. Addition increases it slightly. Multiplication increases it substantially. Once the noise grows too large, the ciphertext can no longer be decrypted correctly. This is why somewhat homomorphic schemes support only a limited number of operations.

Craig Gentry's 2009 breakthrough was bootstrapping: a technique that resets the noise by homomorphically decrypting and re-encrypting the ciphertext, producing a fresh ciphertext with reduced noise that can support further operations. Bootstrapping is what makes fully homomorphic encryption possible, allowing unlimited computation. It is also computationally expensive, which is the main reason FHE has historically been slow.

Real-World Applications

Private cloud computation. A hospital encrypts patient data, sends it to a cloud service for analysis, and receives an encrypted result. The cloud never sees the patient data. This enables outsourced computation on regulated data.

Private information retrieval. A user queries a database without the database learning which record was requested, by having the query and matching performed homomorphically.

Privacy-preserving machine learning inference. A user submits encrypted input to a machine learning model and receives an encrypted prediction. The model owner does not see the input, and the user does not see the model weights.

Encrypted analytics. Organizations run analytics on encrypted datasets, useful in regulated industries where data cannot be exposed even to internal analysts.

Secure voting and auctions. Tally encrypted votes or bids without revealing individual entries.

Performance Limitations

Homomorphic encryption, particularly FHE, remains computationally expensive compared to computing on plaintext. Operations on ciphertexts can be thousands of times slower than the equivalent plaintext operations, and ciphertexts are much larger than plaintexts.

Performance has improved dramatically since 2009 through better schemes (BGV, BFV, CKKS, TFHE), hardware acceleration, and optimized libraries. Specific applications, especially those with bounded computation like inference or simple analytics, are now practical. General-purpose arbitrary computation at scale remains expensive.

This performance profile is why homomorphic encryption is often used selectively, for the specific part of a workload that requires computing on encrypted data, rather than as a blanket replacement for plaintext computation.

Leading Libraries and Companies

The ecosystem includes mature open-source libraries (SEAL, OpenFHE, HElib) and companies building products on homomorphic encryption for data collaboration, blockchain, and machine learning.

Homomorphic Encryption vs Multi-Party Computation

Homomorphic encryption and multi-party computation both enable computation on data that stays private, but they work differently and suit different situations.

Homomorphic encryption lets a single party compute on encrypted data without interaction. The data owner encrypts, sends the ciphertext, and the computing party works on it alone. No back-and-forth is needed, but the computation is expensive.

Multi-party computation lets multiple parties jointly compute over their combined private inputs through an interactive protocol. It is generally much faster than FHE for the same computation, but requires the parties to be online and exchange messages during the computation.

The practical guidance: MPC is usually faster and suits situations where multiple parties hold data and can interact. Homomorphic encryption suits situations where one party wants to outsource computation on its own encrypted data to an untrusted server without interaction. Many real systems combine both, along with other privacy-enhancing technologies. See the secure multi-party computation guide and the privacy-enhancing technologies overview.

Silence Laboratories builds its privacy-preserving compute products primarily on multi-party computation, which delivers the performance profile suited to financial data collaboration. Homomorphic encryption is a complementary technology in the broader privacy-enhancing landscape.

Related Reading

• Fully Homomorphic Encryption

• Secure Multi-Party Computation

• Differential Privacy

• Privacy-Enhancing Technologies Overview

• Private Computing Infrastructure

• Silent Compute Product

FAQ

What is homomorphic encryption? Homomorphic encryption allows computation to be performed directly on encrypted data, producing an encrypted result that matches the result of computing on the original data. The data never has to be decrypted to be processed, so a server can compute on data it cannot read.

What is the difference between partially and fully homomorphic encryption? Partially homomorphic encryption (PHE) supports one operation type (addition or multiplication) unlimited times. Fully homomorphic encryption (FHE) supports both addition and multiplication unlimited times, enabling arbitrary computation. FHE is more powerful but much more computationally expensive.

Who invented fully homomorphic encryption? Craig Gentry constructed the first fully homomorphic encryption scheme in 2009, introducing the bootstrapping technique that resets ciphertext noise and enables unlimited computation. This was a landmark result that had been considered a theoretical holy grail of cryptography.

Is homomorphic encryption practical? For specific applications with bounded computation, such as encrypted inference or simple analytics, yes. Performance has improved by orders of magnitude since 2009. General-purpose arbitrary computation at scale remains expensive, so homomorphic encryption is often used selectively for the parts of a workload that require it.

What is the difference between homomorphic encryption and MPC? Homomorphic encryption lets a single party compute on encrypted data without interaction, but is expensive. Multi-party computation lets multiple parties jointly compute over private inputs through an interactive protocol, and is generally faster. MPC suits interactive multi-party settings. HE suits non-interactive outsourced computation.