Private key Additive homomorphism


Is there a way in OpenFHE to use private key additive holomorphic encryption?

Yes, private-key RLWE is supported in OpenFHE. For encryption, you can use the private key encryption (Template Class CryptoContextImpl — OpenFHE documentation) Homomorphic addition (EvalAdd) is automatically supported by BGV, BFV, and CKKS (it is simpler than multiplication or rotations). In BGV/BFV, you can use CoedPacked or Packed encoding.


Is the additive homomorphism both for plaintext and ciphertext?

I tried to encrypt 3 plaintexts using 3 different secret keys and use the sum of the secret keys to decrypt the sum of the ciphertexts but the result is incorrect.

Are you asking about multi-key FHE? This is different from additive homomorphic secret-key encryption. OpenFHE supports threshold FHE, where each party has a secret key share. The parties compute a joint public key using a distributed key generation protocol leveraging key homomorphism. Then they encrypt their data using the joint public key. The decryption is done using distributed decryption. If this is what you are asking about, then I suggest watching Homomorphic Encryption for OpenFHE Users –

My question is whether a private multi-key additive holomorphic encryption scheme is possible.

I know that we can use generate a joint public key and then do a distributed decryption.
But is it possible that the parties have a share of the secret key and they encrypt using just their share of the secret key and still be able to decrypt the sum of the encryption shares using either sum of the secret keys or distributed decryption?

Hi @radhika

Using the sum of the secret keys is not a secure option as it defeats the purpose of multi-key FHE. A core idea of multi-key or threshold FHE is to never deal with a secret key, but only deal with its shares. All secret share holders should never collude.

The distributed decryption scenario corresponds to multi-key FHE (as explained in the webinar cited above). OpenFHE does not currently support multi-key FHE as it significantly less efficient than threshold FHE. Basically threshold FHE is the recommended option for the scenario with secret shares.