[Paper Review] On the Weakness of Fully Homomorphic Encryption

Zhengjun Cao, Lihua Liu|arXiv (Cornell University)|Nov 17, 2015

Cryptography and Data Security18 references3 citations

TL;DR

This paper argues that fully homomorphic encryption (FHE) is fundamentally limited in practical cloud computing due to its reliance on finite fields or rings, which restrict computations to modular arithmetic. The authors demonstrate that FHE cannot correctly handle common arithmetic or relational operations on real numbers because no invertible transformation exists from ℝ to ℤ_Q, rendering FHE ineffective for general-purpose client-server computation.

ABSTRACT

Fully homomorphic encryption (FHE) allows anyone to perform computations on encrypted data, despite not having the secret decryption key. Since the Gentry's work in 2009, the primitive has interested many researchers. In this paper, we stress that any computations performed on encrypted data are constrained to the encrypted domain (finite fields or rings). This restriction makes the primitive useless for most computations involving common arithmetic expressions and relational expressions. It is only applicable to the computations related to modular arithmetic. We want to reaffirm that cryptography uses modular arithmetic a lot in order to obscure and dissipate the redundancies in a plaintext message, not to perform any numerical calculations. We think it might be an overstated claim that FHE is of great importance to client-server computing or cloud computing.

Motivation & Objective

• To challenge the widely held belief that FHE enables arbitrary computations on encrypted data in cloud environments.
• To demonstrate that FHE schemes are constrained to modular arithmetic and cannot correctly process common arithmetic or relational expressions.
• To show that the absence of an invertible transformation from real numbers to finite fields like ℤ_Q breaks the correctness of homomorphic operations on real-number inputs.
• To argue that FHE is not suitable for client-server computing models due to fundamental limitations in handling real-number arithmetic and comparisons.
• To provide concrete counterexamples using the Dijk-Gentry-Halevi-Vaikuntanathan and Nuida-Kurosawa FHE schemes to illustrate these flaws.

Proposed method

• Analyzes the Dijk-Gentry-Halevi-Vaikuntanathan (DGHV) FHE scheme, which encrypts bits individually, and shows that carry propagation cannot be determined from ciphertexts.
• Examines the Nuida-Kurosawa FHE scheme over ℤ_Q, where Q is prime, and proves that no invertible transformation 𝒯 from ℝ to ℤ_Q exists for real numbers.
• Uses ASCII encoding to map decimal numbers like 0.1 and 2.3 into integers in ℤ_Q, then applies homomorphic addition on encrypted values.
• Demonstrates that the decrypted result after modular reduction does not correspond to the correct sum (e.g., 0.1 + 2.3 ≠ 2.4) due to loss of precision and non-invertible encoding.
• Applies the client-server model to show that even if the server performs homomorphic addition, the client cannot recover the correct result due to encoding ambiguity.
• Establishes that relational comparisons (e.g., a < b) are not preserved under encryption, as E(a) < E(b) does not imply a < b.

Experimental results

Research questions

• RQ1 Can fully homomorphic encryption correctly evaluate common arithmetic expressions like x + y on real numbers when the inputs are encrypted?
• RQ2 Is there an invertible transformation from the real number set ℝ to a finite field ℤ_Q that preserves numerical semantics for homomorphic evaluation?
• RQ3 Why do existing FHE schemes fail to support relational expressions such as a < b in a client-server computing model?
• RQ4 To what extent does the reliance on modular arithmetic limit the applicability of FHE in cloud computing environments?
• RQ5 Can homomorphic operations on encrypted data produce correct results for real-number computations, given the constraints of finite fields?

Key findings

• The DGHV FHE scheme cannot correctly compute x + y for encrypted real numbers because carries cannot be determined without the secret key.
• In the Nuida-Kurosawa FHE scheme, no invertible transformation 𝒯 from ℝ to ℤ_Q exists, making it impossible to map real numbers to field elements in a way that preserves arithmetic semantics.
• When homomorphic addition is applied to encrypted representations of 0.1 and 2.3, the result after decryption is 6550628, which decodes to 'c\u0064' in ASCII, not 2.4.
• The result of homomorphic addition on encrypted data does not correspond to the correct sum due to loss of precision and non-invertible encoding, invalidating the computation.
• Relational expressions like a < b are not preserved under encryption, as E(a) < E(b) does not imply a < b, making such comparisons unreliable in FHE.
• The paper concludes that FHE is not applicable to client-server computing because it cannot correctly handle general-purpose arithmetic or relational operations on real numbers.