Fully homomorphic encryption using ideal lattices

We propose a fully homomorphic encryption scheme – i.e., a scheme that allows one to evaluate circuits over encrypted data without being able to decrypt. Our solution comes in three steps. First, we provide a very general result – that, to construct an encryption scheme that permits evaluation of arbitrary circuits, it suffices to construct an encryption scheme that can evaluate (slightly augmented versions of) its own decryption circuit; we call a scheme that can evaluate its (augmented) decryption circuit bootstrappable. Next, we describe a public key encryption scheme using ideal lattices that is almost bootstrappable. Intuitively, ideal lattices are well-suited to construct bootstrappable encryption for two reasons. First, lattice-based cryptosystems typically have decryption algorithms with low circuit complexity, often dominated by an inner product computation that

• Type: Conference
• Year: 2009
• Where: STOC
• Authors: Craig Gentry
• Keywords: Algorithms, Decryption Circuit, Encryption Scheme, Homomorphic Encryption Scheme, STOC 2009