Fully Homomorphic Encryption (FHE)

Fully homomorphic encryption (FHE) is a type of encryption that allows any calculation to be carried out directly on encrypted data. A server can add, multiply and combine encrypted numbers and produce an encrypted result, which only the holder of the secret key can decrypt. At no point does the server see the underlying information. This makes it possible to hand sensitive data to a cloud provider or a public network for processing without revealing it.

FHE belongs to the field of privacy-enhancing technologies, alongside zero-knowledge proofs, secure multi-party computation and trusted hardware. It was long considered a theoretical goal of cryptography; the first workable scheme was published in 2009. It is now used in research, in some commercial products and in blockchain projects that aim to support confidential smart contracts, but it remains far slower than computing on plain data.

Imagine a locked glovebox with built-in gloves, the kind used in laboratories. You put valuable materials inside, lock it and hand it to a craftsman. He can reach in through the gloves and work on the materials, but he cannot take them out or see them clearly. When he hands the box back, only you have the key to open it and collect the finished piece.

FHE works the same way with data. A bank could send encrypted customer records to an outside firm, which runs its analysis on the locked data and returns a locked answer. The firm never learns anything about the customers, and the bank alone can unlock the result.

The idea of computing on encrypted data was suggested in the late 1970s, soon after public-key cryptography appeared. Some schemes could perform one type of operation, such as only multiplication or only addition, and were called partially homomorphic. The problem of supporting any computation stayed open for three decades. In 2009, Craig Gentry described the first fully homomorphic scheme, based on mathematical structures called lattices, and introduced a technique called bootstrapping to clear the "noise" that builds up as calculations are performed on encrypted data.

Later schemes greatly improved speed. Widely used families include BGV and BFV for exact arithmetic on integers, CKKS for approximate arithmetic suited to statistics and machine learning, an area also explored by zero-knowledge machine learning, and TFHE for fast operations on individual bits. Open-source libraries have made the technology available to developers, and an industry consortium has worked on standardizing parameters for security. Large technology companies and specialist start-ups have both invested in the field, and some have released compilers that turn ordinary code into programs that run on encrypted data.

In FHE, data is encrypted in a way that preserves mathematical structure. If two numbers are encrypted and the encrypted values are combined using the scheme's operations, decrypting the result gives the same answer as combining the original numbers. Since addition and multiplication can be combined to build any computation, a scheme that supports both without limit can, in principle, run any program on encrypted inputs.

Each operation adds a little random noise to the ciphertext. Too much noise makes decryption fail, so schemes either limit the number of operations or periodically "refresh" ciphertexts through bootstrapping, which is the most expensive step. Ciphertexts are also much larger than the data they protect.

• Private data sharing. Banks could pool encrypted data to detect fraud or money laundering patterns across institutions without exposing customer details to each other.
• Cloud analytics. Firms using cloud computing can outsource calculations on sensitive records, such as credit or health data, while keeping them encrypted.
• Confidential smart contracts. Several blockchain projects use FHE so that balances, bids or votes stay encrypted on a public chain while smart contracts still process them, an aim shared with confidential computing.
• Private voting and auctions. Encrypted votes or bids can be tallied without revealing individual choices.

• Performance. Computing on encrypted data is typically thousands of times slower or more than on plain data, although specialized hardware is being developed to narrow the gap.
• Key management. Someone must hold the decryption key; in blockchain systems this is often split among a group using threshold cryptography, which introduces trust assumptions.
• Complexity. Writing programs for FHE requires specialist tools, and mistakes in parameters can weaken security.
• Integrity is separate. FHE keeps data private but does not by itself prove that a computation was carried out correctly, so it is sometimes combined with other techniques.

Because most FHE schemes are based on lattice problems, they are thought to resist attack by future quantum computers, which adds to interest in the technology as part of long-term data security planning.