《《Fully Homomorphic Encryption Using Ideal Lattices》.pdfVIP

Fully Homomorphic Encryption Using Ideal Lattices Craig Gentry Stanford University and IBM Watson cgentry@cs.stanford.edu ABSTRACT duced by Rivest, Adleman and Dertouzos [54] shortly af- We propose a fully homomorphic encryption scheme – i.e., ter the invention of RSA by Rivest, Adleman and Shamir a scheme that allows one to evaluate circuits over encrypted [55]. Basic RSA is a multiplicatively homomorphic encryp- data without being able to decrypt. Our solution comes tion scheme – i.e., given RSA public key pk = (N, e) and ciphertexts { i πe mod N }, one can efficiently compute i in three steps. First, we provide a general result – that, e = ( π ) mod N , a ciphertext that encrypts the to construct an encryption scheme that permits evaluation i i i i of arbitrary circuits, it suffices to construct an encryption product of the original plaintexts. Rivest et al. [54] asked scheme that can evaluate (slightly augmented versions of) a natural question: What can one do with an encryption its own decryption circuit; we call a scheme that can evaluate