Homomorphic Encryption
In 2009, a Stanford graduate student named Craig Gentry published his PhD thesis and quietly solved a problem cryptographers had chased for over 30 years. His solution — fully homomorphic encryption — made it theoretically possible to compute on data that is completely encrypted, without ever decrypting it. A hospital could send its patient records to a cloud server, the server could run statistical analysis on those records, return a result, and the server operator would never see a single patient name. This is not science fiction. It is real mathematics — and it is beginning to reach the real world.
What You'll Learn
In this lesson you will: Understand what it means to compute on encrypted data without decrypting it. Distinguish between partially, somewhat, and fully homomorphic encryption. Explore the core mathematical intuition behind homomorphic schemes. Evaluate real-world applications in cloud computing, healthcare, and private AI.
The Core Problem: Privacy vs. Computation
Standard encryption protects data while it is stored or moving across a network. But the moment you need to compute with that data — run a query, train a model, calculate a total — you must decrypt it first. That decryption window is where breaches happen. Homomorphic encryption (HE) breaks this trade-off. A homomorphic encryption scheme is one where operations on ciphertexts produce ciphertexts that, when decrypted, give the same result as if you had operated on the plaintexts directly. Formally: if E is a homomorphic encryption function, then for the addition operation, E(a) combined with E(b) equals E(a + b). That one property has enormous implications. You can hand encrypted numbers to an untrusted server, ask it to add them, and get back an encrypted sum — without the server ever knowing the individual values.
Imagine a locked glass box with rubber gloves built into the sides. You put your secret documents inside and lock it. A helper on the outside can stick their hands in the gloves and rearrange, count, and sort your documents — without being able to take anything out or read anything directly. Homomorphic encryption is mathematically equivalent to this glove box for data.
Three Levels of Homomorphic Encryption
Not all HE schemes support every operation. Cryptographers classify them by capability: Partially Homomorphic Encryption (PHE) supports only ONE type of operation, applied any number of times. RSA is multiplicatively homomorphic: encrypting a times encrypting b gives encrypting (a times b). The Paillier cryptosystem is additively homomorphic. PHE schemes are fast and exist in production systems today. Somewhat Homomorphic Encryption (SHE) supports both addition and multiplication, but only for a limited number of operations before accumulated noise grows too large and decryption fails. Useful for computations of limited depth. Fully Homomorphic Encryption (FHE) supports arbitrary additions and multiplications without limit. Gentry achieved this by adding a bootstrapping step that refreshes the ciphertext and removes accumulated noise. FHE schemes are dramatically slower than PHE but have no computational limits in principle.
Why Noise Is the Enemy — and How Bootstrapping Solves It
Most practical HE schemes add controlled random noise to ciphertexts as part of encryption. This noise is what makes the scheme secure — an attacker cannot distinguish a ciphertext from random data without the private key. The problem: each arithmetic operation amplifies the noise. After enough multiplications, the noise overwhelms the signal and decryption produces garbage. Gentry's key insight was bootstrapping: a procedure where you homomorphically evaluate the decryption circuit of the encryption scheme itself, refreshing the ciphertext to a low-noise version. Early 2009 implementations took minutes per gate. Modern hardware acceleration has reduced this to milliseconds. Common modern FHE schemes include: BFV and BGV for exact integer arithmetic (used in voting and database queries); CKKS (Cheon-Kim-Kim-Song) for approximate fixed-point arithmetic suited to machine learning; and TFHE and FHEW for Boolean gate evaluation, which achieve the fastest bootstrapping times.
Match each HE property or scheme to its correct classification.
Terms
Definitions
Drag terms onto their definitions, or click a term then click a definition to match.
Real-World Applications
FHE is moving from theory to practice as performance improves: Private cloud queries: A user can search an encrypted database without the server learning the search term or the result. Google's Private Information Retrieval research applies this principle. Private machine learning: Libraries such as Microsoft SEAL and Zama's Concrete let developers run inference on encrypted medical data. A model can classify a patient scan without ever seeing the scan in plaintext. Electronic voting: Fully homomorphic tallying allows votes to be summed while remaining individually encrypted — no single server operator can learn how anyone voted. Financial auditing: A bank can prove to auditors that total reserves exceed liabilities without revealing individual account balances. Genomics: DNA analysis could be performed on encrypted genome data, protecting the most sensitive personal information that exists.
A bank encrypts account balances and sends them to a cloud server. The server adds all the balances and returns an encrypted total. When the bank decrypts it, the total is correct — yet the server never saw any individual balance. Which property made this possible?
What is the purpose of bootstrapping in a fully homomorphic encryption scheme?
Design a Private Healthcare Query System
You are a software engineer at a hospital. Patients have consented to share their encrypted health data with a research cloud that must never see plaintext records. 1. Define your data: choose 3 health metrics to analyze (such as blood pressure, age, or cholesterol level) — keep them general, not identifying. 2. Identify the computation: what aggregation does the researcher need? For example: average blood pressure of patients over 60 with high cholesterol. 3. Choose an HE scheme: would you use PHE (addition only), SHE (limited additions and multiplications), or FHE (unlimited)? Justify your choice based on the complexity of the required computation. 4. Identify the threat model: what can a fully malicious cloud server NOT learn? What CAN it learn even with HE in place? 5. Write a 1-paragraph design brief in plain language explaining your scheme choice, computation plan, and privacy guarantee to a hospital administrator who is not a cryptographer.
Want to keep learning?
Sign up for free to access the full curriculum — all subjects, all ages.
Start Learning Free