Pith. sign in

REVIEW 4 major objections 5 minor 33 references

Compile-Time Fully Homomorphic Encryption of Vectors: Eliminating Online Encryption via Algebraic Basis Synthesis

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper proposes SynthEnc, which builds batched FHE ciphertexts by linearly combining precomputed encrypted basis vectors and a freshly scaled zero ciphertext, aiming to remove runtime encryption while preserving IND-CPA security.

desk verdict The compile-time vector encryption idea is a natural system optimization, but the paper's central claim is false: the single-zero-ciphertext masking scheme is trivially attackable, and the security proof does not hold together. read the letter →

arxiv 2505.12582 v2 pith:V3GVA6MM submitted 2025-05-19 cs.CR

Dongfang Zhao This is my paper · ORCID
classification cs.CR MSC 94A60
keywords fullyhomomorphicencryptionciphertextsynthesiscompile-timebatchingIND-CPAsecurityvectorencrypteddatabasesmodulemorphism
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Fully homomorphic encryption makes encryption itself the bottleneck when new data has to be ingested continuously, since every packet needs a fresh ciphertext. This paper proposes a compile-time alternative: encrypt the standard basis vectors of the plaintext module once, then synthesize any vector's ciphertext as the $\mathbb{Z}_t$-linear combination of those basis ciphertexts, masked by a single precomputed zero ciphertext scaled by a freshly sampled scalar. The central claim is that this synthesized encryption is IND-CPA secure whenever the underlying FHE scheme is, with adversarial advantage bounded by $(d+1)\varepsilon_1+\varepsilon_2$. If the claim holds, runtime ingestion never calls the encryption routine, only homomorphic addition and scalar multiplication, and the randomness pool shrinks from many zero ciphertexts to one.

What carries the argument

The central object is a randomized $\mathbb{Z}_t$-module morphism: a precomputed ciphertext basis $\mathcal{B}=\{c_1,\dots,c_d\}$ with $c_i=\mathsf{Enc}(e_i)$, followed by a masking layer built from a single cached zero ciphertext $r_0=\mathsf{Enc}(0^d)$ scaled by a fresh scalar. Runtime synthesis evaluates $\mathsf{SynthEnc}(m)=\sum_i m_i c_i+\alpha r_0$ using only ciphertext addition and scalar multiplication, so no encryption primitive is invoked online. The security argument is carried by the hybrid sequence $G_0,\dots,G_{d+1}$ in which consecutive games differ in one plaintext coordinate, with the indistinguishability of $\alpha r_0$ versus fresh $\mathsf{Enc}(0^d)$ supplying the final reduction step.

What would settle it

In a concrete batched scheme such as BFV or BGV, compute $r_0=\mathsf{Enc}(0^d)$ once, sample many fresh scalars $\alpha$, and collect the noise polynomials of $\alpha r_0$ together with many fresh $\mathsf{Enc}(0^d)$ ciphertexts; a statistical test on noise norm or higher moments that separates the two distributions with non-negligible advantage would refute Lemma 3 and the proof of Theorem 4.

Watch

Extended reading notes

Core claim

The paper's discovery is a way to make vector-level precomputation compatible with batched FHE. With $c_i=\mathsf{Enc}(e_i)$ for the $d$ unit vectors of $\mathbb{Z}_t^d$ and a fixed $r_0=\mathsf{Enc}(0^d)$, the construction sets $\mathsf{SynthEnc}(m)=\sum_i m_i c_i + \alpha r_0$ for a fresh $\alpha \leftarrow \mathbb{Z}_t$. Linearity of the underlying encryption gives $\mathsf{Dec}(\mathsf{SynthEnc}(m))=m$, while the scalar-masked zero supplies per-message randomness. The proof is a hybrid argument over $d+1$ games that exchange the plaintext coordinates one at a time, yielding the bound $\mathsf{Adv}^{\mathrm{IND-CPA}}_{\mathsf{SynthEnc}}\le (d+1)\varepsilon_1+\varepsilon_2$; Lemma 2 bounds each coordinate swap and Lemma 3 asserts that $\alpha r_0$ is indistinguishable from a fresh encryption of zero. The construction is claimed to preserve the batched slot layout, so rotation, summation, and aggregation work without repair.

Load-bearing premise

The whole proof depends on two substitutions being invisible to the adversary: swapping in a fresh basis ciphertext one coordinate at a time, and treating a random scalar times the cached zero ciphertext as exactly a newly encrypted zero; if either leaks noise structure, the claimed security bound does not follow.

Editorial extensions

If this is right

  • After one offline phase of $d+1$ encryptions, every subsequent vector costs $O(d)$ ciphertext operations and zero encryption calls, so ingestion throughput becomes a function of homomorphic arithmetic rather than of the encryption routine.
  • The randomness mechanism needs only one stored zero ciphertext instead of a pool of $s$ zero ciphertexts, trading $O(1)$ memory for a fresh scalar multiplication at runtime.
  • Because synthesized ciphertexts keep the batched slot layout, downstream operations such as rotation, aggregation, relinearization, and modulus switching apply without layout correction.
  • If the IND-CPA bound is sound, the construction composes with standard FHE APIs and can serve as a drop-in ingestion layer for encrypted databases, streaming pipelines, and secure compiler backends.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same basis-synthesis idea would extend to tensors or matrix blocks, where the number of stored basis ciphertexts equals the number of entries (or the matrix rank, if low-rank structure is exploited) instead of the number of distinct plaintext values, trading memory for online work in a different curve.
  • The security bound depends on the untested distributional claim that $\alpha r_0$ re-randomizes like a fresh encryption of zero; a direct experiment measuring the noise distribution of $\alpha r_0$ against fresh encryptions, over the intended parameter set, would validate or refute the central step before production use.
  • If Lemma 3 holds, it implies that homomorphic scalar multiplication is itself a re-randomization mechanism for the zero plaintext, a property stronger than standard IND-CPA and potentially useful as a standalone primitive for ciphertext refreshing.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes a method for generating FHE ciphertexts at runtime without invoking the encryption algorithm, by precomputing a public basis of encryptions of unit vectors and a single fixed encryption of the zero vector, then forming new ciphertexts as a linear combination of the basis plus a scalar-multiplied zero ciphertext. It claims that this 'synthesized encryption' scheme SynthEnc is IND-CPA secure assuming the underlying FHE scheme is IND-CPA secure, and provides a hybrid-game proof with an advantage bound of (d+1)ε1+ε2. The manuscript also includes a noise analysis, discussions of compatibility with batching and rotations, and a speculative final section on algebraic generalizations. I find that the security proof is invalid and, more seriously, that the proposed construction is insecure: because the basis and the zero ciphertext are public and the masking scalar is drawn from a small set, an adversary can recover the encrypted message by brute force.

Significance. The practical motivation is sensible: avoiding online encryption in FHE ingestion pipelines is a real systems concern, and the algebraic interface is presented clearly as a module-morphism abstraction. However, the central security claim is not merely unproven but false. The proposed masking step uses a fixed public ciphertext of zero multiplied by a scalar drawn from Z_t (or Z_q), which provides at most log t bits of entropy and permits an exact distinguishing attack when the basis is public. The two supporting lemmas in the security proof are also invalid: Lemma 2 substitutes a fresh encryption of a scalar for a scalar-multiple of a public basis ciphertext, changing the distribution, and Lemma 3 asserts the indistinguishability of α·r0 from a fresh encryption of zero without reducing it to any standard assumption. Consequently, the paper's main contribution as a secure encryption scheme is not established. The paper does contain a reasonable formalization of correctness and noise growth for linear combinations of precomputed ciphertexts, but that does not compensate for the broken security argument.

major comments (4)
  1. [§6.1, Definition 1] Definition 1 gives the adversary the public basis B and the fixed zero ciphertext r0, and the challenge ciphertext is c* = Σ_i (m_b)_i·c_i + α·r0 with α uniform in Z_t. Since B and r0 are known, the adversary can enumerate all candidate α∈Z_t, compute c* − α·r0, and check whether the result equals the known linear combination for m0 or m1 (or decrypt it with its own key if it is the owner). This yields an exact distinguisher with advantage negligibly close to 1, so the claimed bound in Theorem 4 is false.
  2. [§6.2, Lemma 2] Lemma 2's reduction is invalid: in the actual hybrid games, the i-th coordinate term is (m_b)_{i+1}·c_{i+1}, a scalar multiple of the public fixed ciphertext c_{i+1}, whereas the reduction inserts a fresh challenge ciphertext c* = Enc(m*) into the simulated ciphertext. These two distributions differ because c_{i+1} is given to the adversary as part of B and cannot be replaced by c*. The simulator cannot simulate the scalar-multiplied basis term from a fresh encryption of the scalar, so the claimed bound |Pr[A wins G_i] − Pr[A wins G_{i+1}]| ≤ ε1 is unsupported.
  3. [§6.2, Lemma 3] Lemma 3 asserts that α·r0 is computationally indistinguishable from a fresh encryption of zero, but the proof only restates the property being proved: saying that scalar multiplication 'does not expose plaintext content' is exactly the claim at issue. Since r0 is a fixed public ciphertext, the set {α·r0 : α∈Z_t} has only t elements and is trivially distinguishable from the full distribution of fresh encryptions, for example by checking membership in that low-entropy set or by examining the noise structure. Thus Lemma 3 is false as stated.
  4. [§4.3, §5.1, §6.1] The sampling domain for the masking scalar is inconsistent: Algorithm 2 and §4.3 sample a uniformly from Z_q, while the security game in Definition 1 samples α from Z_t, and the correctness analysis in §5.1 requires |a| to be very small (e.g., in {0,1} or Z_t). If a is uniform in Z_q, the noise term a·r0 is so large that decryption correctness fails; if a is limited to Z_t or a small range, the masking provides at most log t bits of entropy, enabling the attack described above. The construction cannot simultaneously satisfy correctness and the claimed security under any single consistent sampling choice.
minor comments (5)
  1. [§6.2] There is no Lemma 1 in the manuscript, yet the proof of Theorem 4 refers to 'Lemma 2' and 'Lemma 3'; the numbering should be fixed by either adding Lemma 1 or renumbering the lemmas.
  2. [Algorithm 2] Algorithm 2 samples the masking scalar a from Z_q at step 4, while Definition 1 samples α from Z_t; the notation and the sampling distribution should be unified across the construction, the security game, and the correctness analysis.
  3. [§5.1] The correctness condition requires each |m_i| < t/4 and a small |a|, but this is stated without justification and appears incompatible with plaintexts spanning the full Z_t module as assumed in the algebraic framework.
  4. [§4.3] The phrase 'randomness space is preserved' is vague; the paper should specify the exact distribution of α·r0 and provide a concrete noise bound for this masking term.
  5. [§8] The 'Final Remark' section contains speculative mathematical directions (cohomology, derived categories, non-commutative geometry) that are not connected to the rest of the paper and should be removed or clearly separated as future-work discussion.

Circularity Check

2 steps flagged · score 7.0 of 10

Security proof depends on Lemma 3, which asserts the exact indistinguishability property Theorem 4 needs; the hybrid reduction is not self-contained.

  1. self definitional [Section 6.2, Lemma 3 (used in Theorem 4; motivated in Section 4.3)]
    "Then for uniformly random α← Zt, the product α· r0 is computationally indistinguishable from a fresh encryption of zero: α· r0≈c Enc(0d). ... Therefore, the ability to distinguish α· Enc(0d) from fresh encryption contradicts the ciphertext distribution indistinguishability under operations supported by the scheme. Since scalar multiplication does not expose plaintext content or noise structure beyond semantic security guarantees, the output remains computationally indistinguishable from a fresh encryption."

    Lemma 3 is the only step bounding the masking term in Theorem 4's advantage (d+1)ε1+ε2. Its proof invokes 'ciphertext distribution indistinguishability under operations supported by the scheme', which is exactly the statement being proved, not a standard assumption or a consequence of IND-CPA of Enc. With (B,r0) public (Definition 1), the set of masks {αr0} is tiny, so this equivalence is not derived from the underlying scheme; it is the scheme's central security claim restated as a lemma.

  2. other [Section 6.2, Lemma 2 (hybrid coordinate substitution)]
    "Given challenge ciphertext c∗← Enc(m∗) for m∗∈{ (m0)i+1, (m1)i+1}, B simulates all other terms in c∗: c = Σ ... + c∗ + α· r0. Then runs A on (B, r0, c). If A guesses b′ = 1 with advantage δ, then B distinguishes Enc(m0) from Enc(m1) with advantage δ."

    In the hybrid games the coordinate term is (mb)j·cj, a scalar multiple of the precomputed basis ciphertext cj=Enc(ej). The reduction replaces it with c*, a fresh encryption of the scalar. This is a valid simulation only if Enc(m) and m·Enc(ej) are computationally indistinguishable, a distributional identity that is not established and does not follow from IND-CPA of Enc. The lemma therefore assumes a synthesized-versus-fresh ciphertext indistinguishability—the very type of claim the main theorem is meant to prove.

full rationale

The paper's novelty claim is that a single fixed zero ciphertext scaled by a fresh scalar preserves IND-CPA security. The derivation chain is: correct synthesis by linearity (Section 4.2), then hybrid games (Lemmas 2–3) to bound adversarial advantage. The coordinate-substitution hybrid (Lemma 2) is standard in shape but requires replacing m·Enc(ei) with a fresh Enc(m), which is not delivered by the stated IND-CPA assumption; the paper supplies no proof and instead asserts the simulation. The decisive gap is Lemma 3, whose statement is exactly that α·r0 is indistinguishable from a fresh encryption of zero. Its proof says this follows from 'ciphertext distribution indistinguishability under operations supported by the scheme', which is a re-description of the lemma, not an external reduction. Consequently Theorem 4's bound (d+1)ε1+ε2 inherits an unproven, self-referential premise rather than reducing to the scheme's IND-CPA. The self-citation to Rache [7] is not load-bearing for the security proof, so it does not affect the score. The forward-looking algebraic speculation in Section 8 is outside the derivation chain. Overall, the central security claim is partially circular: one core lemma is equivalent to the theorem's conclusion by construction.

Assumptions & free parameters 1 free parameters · 3 assumptions · 0 invented entities

The construction depends on standard FHE security and homomorphism assumptions, plus two unproved and load-bearing premises about the randomization term and the hybrid simulator. No new physical or mathematical entities are introduced.

free parameters (1)
  • randomizer scalar sampling domain = Z_t in Definition 1; Z_q in Section 4.3; small range {0,1} or Z_t in Section 5.1
    The central construction's security depends on this distribution. The three specifications are mutually inconsistent; the small-domain version makes the mask brute-forceable while the large-domain version violates the noise bound.
assumptions (3)
  • domain assumption The underlying FHE scheme Enc is IND-CPA secure and supports homomorphic addition and scalar multiplication by plaintext scalars.
    Invoked throughout, e.g., Section 4.2 and Section 6. It is a standard security assumption but does not by itself imply the synthesis scheme's security.
  • ad hoc to paper For a fixed ciphertext r0=Enc(0) and uniform α, α·r0 is computationally indistinguishable from a fresh encryption of zero (Lemma 3).
    This is the key unproved premise. The proof argues by assertion that operations preserve indistinguishability, which is circular and not a known property of all IND-CPA FHE schemes.
  • ad hoc to paper A fresh encryption of a scalar s can substitute for the ciphertext s·c_i (with c_i=Enc(e_i)) inside the hybrid simulation without changing the adversary's view (Lemma 2).
    The reduction uses Enc(m*) directly in place of (m*)_i·c_i, but these differ in plaintext embedding and noise distribution; no argument shows the adversary cannot detect the difference.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Compile-Time Fully Homomorphic Encryption of Vectors: Eliminating Online Encryption via Algebraic Basis Synthesis." pith.science (2026). https://pith.science/paper/V3GVA6MM

@misc{pith2026250512582,
  author       = {Pith},
  title        = {Pith review of: Compile-Time Fully Homomorphic Encryption of Vectors: Eliminating Online Encryption via Algebraic Basis Synthesis},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/V3GVA6MM}},
  note         = {Machine review of arXiv:2505.12582}
}
abstract

We propose a framework for compile-time ciphertext synthesis in fully homomorphic encryption (FHE) systems, where ciphertexts are constructed from precomputed encrypted basis vectors combined with a runtime-scaled encryption of zero. This design eliminates online encryption and instead relies solely on ciphertext-level additions and scalar multiplications, enabling efficient data ingestion and algebraic reuse. We formalize the method as a randomized $\mathbb{Z}_t$-module morphism and prove that it satisfies IND-CPA security under standard assumptions. The proof uses a hybrid game reduction, showing that adversarial advantage in distinguishing synthesized ciphertexts is negligible if the underlying FHE scheme is IND-CPA secure. Unlike prior designs that require a pool of random encryptions of zero, our construction achieves equivalent security using a single zero ciphertext multiplied by a fresh scalar at runtime, reducing memory overhead while preserving ciphertext randomness. The resulting primitive supports efficient integration with standard FHE APIs and maintains compatibility with batching, rotation, and aggregation, making it well-suited for encrypted databases, streaming pipelines, and secure compiler backends.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

33 extracted references · 26 canonical work pages

  1. [1]

    Fully Homomorphic Encryption Using Ideal Lattices

    Gentry, C. Fully Homomorphic Encryption Using Ideal Lattices. In Proceedings of the Proceedings of the Forty-first Annual ACM Symposium on Theory of Computing (STOC), 2009

    work page 2009

  2. [2]

    Somewhat Practical Fully Homomorphic Encryption

    Fan, J.; Vercauteren, F. Somewhat Practical Fully Homomorphic Encryption. Cryptology ePrint Archive, Paper 2012/144, 2012. https://eprint.iacr.org/2012/144

    work page 2012

  3. [3]

    Homomorphic Encryption for Arithmetic of Approximate Numbers

    Cheon, J.H.; Kim, A.; Kim, M.; Song, Y.S. Homomorphic Encryption for Arithmetic of Approximate Numbers. In Proceedings of the Advances in Cryptology - ASIACRYPT 2017 - 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, December 3-7, 2017, Proceedings, Part I; Takagi, T.; Peyrin, T., Eds. ...

    doi:10.1007/978-3-319-70694-8_15 2017

  4. [4]

    Efficient Confidentiality-Preserving Data Analytics over Symmetrically Encrypted Datasets

    Savvides, S.; Khandelwal, D.; Eugster, P . Efficient Confidentiality-Preserving Data Analytics over Symmetrically Encrypted Datasets. Proc. VLDB Endow. 2020, 13, 1290–1303. https://doi.org/10.14778/3389133.3389144

    arXiv 2020

  5. [5]

    https://github.com/Microsoft/SEAL, 2021

    Microsoft SEAL (release 3.7). https://github.com/Microsoft/SEAL, 2021. Microsoft Research, Redmond, WA

    work page 2021

  6. [6]

    Revisiting Homomorphic Encryption Schemes for Finite Fields

    Kim, A.; Polyakov, Y.; Zucca, V . Revisiting Homomorphic Encryption Schemes for Finite Fields. In Proceedings of the Advances in Cryptology – ASIACRYPT 2021: 27th International Conference on the Theory and Application of Cryptology and Information Security, Singapore, December 6–10, 2021, Proceedings, Part III, Berlin, Heidelberg, 2021; p. 608–639. https:...

    work page doi:10.1007/978-3-030-92078-4_21 2021

  7. [7]

    Tawose, O.; Dai, J.; Yang, L.; Zhao, D

    T. Tawose, O.; Dai, J.; Yang, L.; Zhao, D. Toward Efficient Homomorphic Encryption for Outsourced Databases through Parallel Caching. Proceedings of the ACM on Management of Data (SIGMOD) 2023. https://doi.org/10.1145/3588920

    doi:10.1145/3588920 2023

  8. [8]

    Fully homomorphic encryption using ideal lattices

    Gentry, C. Fully homomorphic encryption using ideal lattices. Proceedings of the forty-first annual ACM symposium on Theory of computing 2009

    work page 2009

Show all 33 references
  1. [9]

    (Leveled) fully homomorphic encryption without bootstrapping

    Brakerski, Z.; Gentry, C.; Vaikuntanathan, V . (Leveled) fully homomorphic encryption without bootstrapping. In Proceedings of the Proceedings of the 3rd Innovations in Theoretical Computer Science Conference. ACM, 2012, pp. 309–325

    2012

  2. [10]

    Somewhat Practical Fully Homomorphic Encryption

    Fan, J.; Vercauteren, F. Somewhat Practical Fully Homomorphic Encryption. Cryptology ePrint Archive, Paper 2012/144 2012

    2012

  3. [11]

    Fully homomorphic encryption without modulus switching from classical GapSVP .Annual cryptology conference 2012, pp

    Brakerski, Z. Fully homomorphic encryption without modulus switching from classical GapSVP .Annual cryptology conference 2012, pp. 868–886

    2012

  4. [12]

    OpenFHE: Open-Source Fully Homomorphic Encryption Library

    Badawi, A.A.; Bates, J.; Bergamaschi, F.; Cousins, D.B.; Erabelli, S.; Genise, N.; Halevi, S.; Hunt, H.; Kim, A.; Lee, Y.; et al. OpenFHE: Open-Source Fully Homomorphic Encryption Library. Cryptology ePrint Archive, Paper 2022/915, 2022. https: //eprint.iacr.org/2022/915

    2022

  5. [13]

    TFHE: Fast Fully Homomorphic Encryption over the Torus

    Chillotti, I.; Gama, N.; Georgieva, M.; Izabachène, M. TFHE: Fast Fully Homomorphic Encryption over the Torus. Cryptology ePrint Archive, Paper 2018/421, 2018

    2018

  6. [14]

    Accelerating Finite-Field and Torus FHE via Compute-Enabled (S)RAM

    Takeshita, J.; Reis, D.; Gong, T.; Niemier, M.; Hu, X.S.; Jung, T. Accelerating Finite-Field and Torus FHE via Compute-Enabled (S)RAM. IEEE Transactions on Computers 2023, pp. 1–14. https://doi.org/10.1109/TC.2023.3301116

    2023

  7. [15]

    MOSFHET: Optimized Software for FHE over the Torus

    Guimarães, A.; Borin, E.; Aranha, D.F. MOSFHET: Optimized Software for FHE over the Torus. IACR Cryptol. ePrint Arch. 2024, 2022, 515

    2024

  8. [16]

    BASALISC: Programmable asynchronous hardware accelerator for BGV fully homomorphic encryption

    Geelen, R.; Van Beirendonck, M.; Pereira, H.V .; Huffman, B.; McAuley, T.; Selfridge, B.; Wagner, D.; Dimou, G.; Verbauwhede, I.; Vercauteren, F.; et al. BASALISC: Programmable asynchronous hardware accelerator for BGV fully homomorphic encryption. arXiv preprint arXiv:2205.14017 2022

    2022 arXiv

  9. [17]

    Optimized homomorphic encryption solution for secure genome-wide association studies

    Blatt, M.; Gusev, A.; Polyakov, Y.; Rohloff, K.; Vaikuntanathan, V . Optimized homomorphic encryption solution for secure genome-wide association studies. BMC Medical Genomics 2020, 13, 1–13

    2020

  10. [18]

    MP2ML: A mixed-protocol machine learning framework for private inference

    Boemer, F.; Cammarota, R.; Demmler, D.; Schneider, T.; Yalame, H. MP2ML: A mixed-protocol machine learning framework for private inference. In Proceedings of the Proceedings of the 15th international conference on availability, reliability and security, 2020, pp. 1–10

    2020

  11. [19]

    Fully Homomorphic Privacy-Preserving Naive Bayes Machine Learning and Classification

    Han, B.; Kim, Y.; Choi, J.; Shin, H.; Lee, Y. Fully Homomorphic Privacy-Preserving Naive Bayes Machine Learning and Classification. In Proceedings of the Proceedings of the 11th Workshop on Encrypted Computing & Applied Homomorphic Cryptography, New York, NY, USA, 2023; WAHC ’...

    2023

  12. [20]

    Secure Decentralized Image Classification With Multiparty Homomorphic Encryption

    Xu, G.; Li, G.; Guo, S.; Zhang, T.; Li, H. Secure Decentralized Image Classification With Multiparty Homomorphic Encryption. IEEE Transactions on Circuits and Systems for Video Technology2023, 33, 3185–3198. Version August 12, 2025 submitted to Journal Not Specified 18 of 18

    2025

  13. [21]

    Efficient Bootstrapping for Approximate Homomorphic Encryption with Non-sparse Keys

    Bossuat, J.P .; Mouchet, C.; Troncoso-Pastoriza, J.; Hubaux, J.P . Efficient Bootstrapping for Approximate Homomorphic Encryption with Non-sparse Keys. In Proceedings of the Advances in Cryptology – EUROCRYPT 2021; Canteaut, A.; Standaert, F.X., Eds., Cham, 2021; pp. 587–617

    2021

  14. [22]

    FPT: A Fixed-Point Accelerator for Torus Fully Homomorphic Encryption

    Van Beirendonck, M.; D’Anvers, J.P .; Turan, F.; Verbauwhede, I. FPT: A Fixed-Point Accelerator for Torus Fully Homomorphic Encryption. In Proceedings of the Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, New York, NY, USA, 2023; CCS ’23...

    2023

  15. [23]

    Faster homomorphic comparison operations for BGV and BFV

    Iliashenko, I.; Zucca, V . Faster homomorphic comparison operations for BGV and BFV . Proceedings on Privacy Enhancing Technologies 2021, 2021, 246–264

    2021

  16. [24]

    Homomorphic Encryption Standard

    Albrecht, M.; Chase, M.; Chen, H.; Ding, J.; Goldwasser, S.; Gorbunov, S.; Halevi, S.; Hoffstein, J.; Laine, K.; Lauter, K.; et al. Homomorphic Encryption Standard. Cryptology ePrint Archive, Paper 2019/939 2019

    2019

  17. [25]

    On Ideal Lattices and Learning with Errors over Rings

    Lyubashevsky, V .; Peikert, C.; Regev, O. On Ideal Lattices and Learning with Errors over Rings. J. ACM 2013, 60. https: //doi.org/10.1145/2535925

    2013 doi

  18. [26]

    Over 100 × Faster Bootstrapping in Fully Homomorphic Encryption Through Memory-Centric Optimization with GPUs

    Jung, W.; Kim, S.; Ahn, J.; Cheon, J.H.; Lee, Y. Over 100 × Faster Bootstrapping in Fully Homomorphic Encryption Through Memory-Centric Optimization with GPUs. IACR Transactions on Cryptographic Hardware and Embedded Systems 2021, pp. 114–148

    2021

  19. [27]

    CryptGPU: Fast Privacy-Preserving Machine Learning on the GPU

    Tan, S.; Knott, B.; Tian, Y.; Wu, D.J. CryptGPU: Fast Privacy-Preserving Machine Learning on the GPU. In Proceedings of the IEEE Symposium on Security and Privacy (SP), 2021, pp. 1021–1038

    2021

  20. [28]

    cuFHE: CUDA-Accelerated Fully Homomorphic Encryption Library, 2021

    Lab, V . cuFHE: CUDA-Accelerated Fully Homomorphic Encryption Library, 2021. Available at https://github.com/vernamlab/ cuFHE

    2021

  21. [29]

    nufhe: GPU-accelerated FHE library, 2020

    contributors, N. nufhe: GPU-accelerated FHE library, 2020. Available at https://github.com/nucypher/nufhe

    2020

  22. [30]

    Poseidon: Practical Homomorphic Encryption Accelerator

    Yang, Y.; Zhang, H.; Fan, S.; Lu, H.; Zhang, M.; Li, X. Poseidon: Practical Homomorphic Encryption Accelerator. In Proceedings of the 2023 IEEE International Symposium on High-Performance Computer Architecture (HPCA), 2023, pp. 870–881. https: //doi.org/10.1109/HPCA56546.2023.10070984

    2023

  23. [31]

    F1: A Fast and Programmable Accelerator for Fully Homomorphic Encryption

    Samardzic, N.; Feldmann, A.; Krastev, A.; Devadas, S.; Dreslinski, R.; Peikert, C.; Sanchez, D. F1: A Fast and Programmable Accelerator for Fully Homomorphic Encryption. In Proceedings of the MICRO-54, 2021, pp. 238–252

    2021

  24. [32]

    BTS: An Accelerator for Bootstrappable Fully Homomorphic Encryption

    Kim, S.; Kim, J.; Kim, M.; Jung, W.; Kim, J.; Rhu, M.; Ahn, J. BTS: An Accelerator for Bootstrappable Fully Homomorphic Encryption. In Proceedings of the 49th Annual International Symposium on Computer Architecture (ISCA), 2022, pp. 711–725

    2022

  25. [33]

    CraterLake: A Hardware Accelerator for Efficient Unbounded Computation on Encrypted Data

    Samardzic, N.; Feldmann, A.; Krastev, A.; Manohar, N.; Genise, N.; Devadas, S.; Eldefrawy, K.; Peikert, C.; Sanchez, D. CraterLake: A Hardware Accelerator for Efficient Unbounded Computation on Encrypted Data. In Proceedings of the International Symposium on Computer Architect...

    2022

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.