Homomorphic Encryption: Computing on Data Without Ever Seeing It

What Homomorphic Encryption Lets You Do

Homomorphic encryption is a class of encryption schemes that allow mathematical operations to be performed directly on encrypted data, producing an encrypted result that, when later decrypted, matches the result of performing those same operations on the original unencrypted values. In other words, if you encrypt two numbers, add their ciphertexts together, and decrypt the sum, you get the same answer as if you had added the original numbers directly. This property is the foundation for a powerful idea: outsourced computation without trust. A cloud provider, a hospital's data partner, or a third-party analytics service can process someone's data, running a computation, a database search, or a machine learning inference, without the server ever being able to see the actual underlying values. All it ever handles is ciphertext. This matters enormously for privacy-sensitive domains like healthcare, finance, and government records, where organizations want to leverage powerful cloud infrastructure but cannot legally or ethically expose raw sensitive data. Homomorphic encryption effectively decouples computation from data visibility, letting untrusted or semi-trusted parties do useful work on data they can never actually read.

Partially Homomorphic vs Fully Homomorphic Encryption

Not all homomorphic schemes are equally powerful. Partially homomorphic encryption supports only one type of operation performed an unlimited number of times on ciphertexts. The Paillier cryptosystem, for example, is additively homomorphic: you can add encrypted numbers together, which is useful for tasks like tallying encrypted votes or aggregating encrypted financial values. Unpadded RSA, by contrast, is multiplicatively homomorphic, allowing encrypted values to be multiplied together. These schemes are efficient and well understood, but limited in scope since real computation usually needs more than one operation type. Fully homomorphic encryption, or FHE, supports both addition and multiplication together on encrypted data. That combination turns out to be enough to build any computation at all, because any digital circuit, and therefore any algorithm, can be constructed from just those two basic operations acting as logical building blocks (roughly analogous to AND and XOR gates). This is what makes FHE so much more ambitious than partial schemes: instead of enabling one narrow task, it theoretically enables arbitrary programs to run entirely over encrypted inputs, which is why it was pursued as cryptography's holy grail for so long.

Gentry's 2009 Breakthrough and Lattice-Based Cryptography

The idea of fully homomorphic encryption was proposed as early as 1978, shortly after RSA itself, but for roughly thirty years it remained an open problem with no known construction. Researchers could build partially homomorphic schemes, but combining addition and multiplication in a single scheme that stayed secure and correct proved extraordinarily difficult. That changed in 2009, when Craig Gentry, then a graduate student, published the first working construction of fully homomorphic encryption in his doctoral thesis. Gentry's scheme was built on lattice-based cryptography, which relies on the mathematical hardness of problems involving high-dimensional lattices, grids of points extending infinitely in multiple dimensions, where finding the shortest vector or closest point is computationally infeasible for large enough dimensions. Lattice problems were an appealing foundation not just because they resist classical attacks, but because they are believed to resist quantum computer attacks as well, unlike RSA or elliptic curve cryptography. Gentry's construction was a landmark moment in cryptography: it proved fully homomorphic encryption was possible at all, and it launched an entire subfield of research aimed at making the idea practical, efficient, and usable in real systems.

The Noise Problem and Bootstrapping

The central technical obstacle in building FHE is noise. Lattice-based homomorphic schemes encrypt data by embedding it with a small amount of random mathematical noise, which is essential for security. Every homomorphic operation performed on a ciphertext, whether addition or especially multiplication, increases the amount of noise present in the result. This noise grows with each operation until eventually it grows too large, at which point the ciphertext can no longer be correctly decrypted and the underlying data is effectively lost. This meant early homomorphic schemes could only support a fixed, limited number of operations before breaking down, far short of the unlimited computation needed for general-purpose use. Gentry's key innovation was a technique called bootstrapping. The idea is remarkably self-referential: the encryption scheme is used to homomorphically evaluate its own decryption circuit on a noisy ciphertext, producing a fresh, re-encrypted version of the same underlying value but with the noise level reset back down to a low, manageable amount. Because this refresh operation can be repeated indefinitely, bootstrapping in principle allows unlimited further computation on the data, transforming a noise-limited scheme into a truly fully homomorphic one capable of evaluating circuits of arbitrary depth.

Real-World Relevance and Current Limitations

In the years since Gentry's breakthrough, fully homomorphic encryption has moved from pure theory toward practical experimentation. It is now being explored for privacy-preserving cloud computing, where sensitive workloads can run on untrusted infrastructure, private machine learning inference, where a model provider can classify or score a user's encrypted data without seeing the input or revealing the model, and confidential data analytics, where multiple organizations can jointly compute statistics over combined datasets without exposing their individual records. Several open-source libraries and even hardware accelerators now exist to support FHE workloads. However, significant limitations remain. Fully homomorphic encryption is computationally expensive, often thousands of times slower than the equivalent computation performed on unencrypted data, and it also expands the size of the data substantially due to ciphertext overhead. Bootstrapping itself, while solving the noise problem, is one of the most expensive operations in the entire scheme. These costs have limited widespread practical deployment so far, restricting FHE largely to narrow, high-value use cases where privacy guarantees outweigh performance costs. That said, the field is advancing quickly, with steady algorithmic improvements, specialized hardware, and hybrid approaches narrowing the performance gap year over year.

Frequently asked questions

Try it live

Everything above runs in your browser — open Homomorphic Encryption: Computing on Data Without Ever Seeing It and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.