Homomorphic Encryption: Computing on Encrypted Data

Introduction

A hospital wants to use a cloud-based artificial intelligence model to analyze patient medical records for early cancer detection. The problem is devastating in its simplicity: the moment those records leave the hospital’s servers, they are exposed to the cloud provider, its employees, and any attacker who breaches that infrastructure. In 2024, the average cost of a healthcare data breach reached a record $9.77 million, according to IBM. This dilemma — needing third-party computing power while keeping data absolutely private — has haunted the technology industry for decades.

Homomorphic encryption offers an answer that sounds almost impossible. It lets you perform real mathematical computations directly on encrypted data, without ever decrypting it. The cloud server processes the ciphertext, produces an encrypted result, and sends it back. Only the data owner, holding the secret key, can unlock the answer. The server that did all the work never sees a single plaintext byte. This guide breaks down how this technology works, why it matters, and where the field stands today.

What Is Homomorphic Encryption?

Homomorphic encryption is a class of encryption schemes that preserve the mathematical structure of your data even after it has been encrypted. The word “homomorphic” comes from Greek, meaning “same form.” In practice, it means that if you add two encrypted numbers together, the result, once decrypted, is the same as adding the original unencrypted numbers.

Traditional encryption works like a locked safe. You put your documents inside, lock it, and nobody can read them. To learn how standard encryption works, see our guide on encryption explained. But if you need to edit those documents, you must unlock the safe, make your changes, and lock it again. During that brief unlocked moment, the contents are vulnerable.

Homomorphic encryption is fundamentally different. Imagine a locked glove box attached to the safe. Someone can reach in through the gloves, manipulate the documents inside, fold them, sort them, even perform calculations on them — all without the safe ever opening. The documents remain protected throughout the entire process.

This property makes it uniquely suited for scenarios where sensitive data must be processed by an untrusted third party, such as a cloud server, a machine learning pipeline, or a multi-organization collaboration where no single party should see the combined dataset.

How Homomorphic Encryption Works

Understanding the mechanics requires walking through the lifecycle of a single encrypted computation.

1. Key generation. The data owner generates a pair of cryptographic keys: a public key for encryption and a secret key for decryption. In most modern schemes, this also produces an evaluation key that the computing party needs to perform operations on the ciphertext.

2. Encryption with noise. The plaintext is encrypted using the public key. Crucially, modern fully homomorphic encryption (FHE) schemes deliberately inject a small amount of mathematical noise into the ciphertext. This noise is what makes the scheme secure — it hides the plaintext from anyone who does not hold the secret key.

3. Computation on ciphertext. The encrypted data is sent to an untrusted server. That server performs mathematical operations — additions and multiplications — directly on the ciphertext using the evaluation key. Each operation is valid, but it also increases the noise level inside the ciphertext.

4. Bootstrapping. After enough operations, the accumulated noise threatens to corrupt the result. To fix this, the server performs a process called bootstrapping, first proposed by Craig Gentry in 2009. Bootstrapping essentially “refreshes” the ciphertext by homomorphically decrypting it under an encrypted copy of the secret key, resetting the noise to a manageable level. This is the single most expensive step in the entire process.

5. Decryption. The server returns the encrypted result to the data owner, who decrypts it with the secret key. The output is mathematically identical to what would have been produced by running the same operations on the original plaintext.

VIDEO · READY 16:9

PLAY

Homomorphic Encryption Explained

Homomorphic Encryption vs Traditional Encryption

The fundamental distinction lies in what happens to your data while it is being used. Here is how the two approaches compare across the dimensions that matter most.

Real-World Use Cases

Despite its computational cost, homomorphic encryption is already solving real problems in industries where privacy is not optional.

Privacy-Preserving Medical Research Hospitals can encrypt patient genomic data and send it to a research institution’s machine learning model. The model trains on encrypted records and returns encrypted predictions. The research institution gains insights without ever accessing a single patient record. Projects like the OpenFHE library, maintained by Duality Technologies, have made this practical for specific analytics workloads.

Confidential Financial Analytics Banks operating under strict regulations can use FHE to outsource fraud detection to cloud providers. Transaction data remains encrypted throughout the analysis pipeline. The cloud provider identifies suspicious patterns and returns encrypted alerts, never learning the actual account numbers or transaction amounts involved.

Secure Voting and Elections Because addition is a naturally homomorphic operation, encrypted ballots can be tallied without decrypting any individual vote. The election authority publishes the encrypted sum, which is then decrypted to reveal the final count. No intermediate party — not even the counting server — can determine how any single person voted.

Common Mistakes to Avoid

The most critical mistake is treating homomorphic encryption as a drop-in replacement for standard encryption. It is not. FHE imposes a computational overhead that can be several orders of magnitude larger than processing plaintext. If you attempt to encrypt an entire database and run arbitrary SQL queries against it, performance will be catastrophic. The correct approach is to identify the specific, narrow computations that genuinely require privacy and apply FHE only to those.

Another frequent error is confusing the three levels of homomorphic encryption. Partially homomorphic encryption (PHE), like the RSA or Paillier cryptosystems, supports only a single type of operation — either addition or multiplication — and has been practical for decades. Somewhat homomorphic encryption (SHE) supports both operations but only a limited number of times before noise corrupts the result. Fully homomorphic encryption (FHE) supports unlimited operations through bootstrapping but at enormous computational expense. Choosing the wrong level for your use case either sacrifices functionality or wastes performance.

Finally, do not ignore the parameter selection problem. FHE schemes like BFV, BGV, and CKKS require careful tuning of polynomial ring dimensions, coefficient modulus sizes, and noise budgets. The HomomorphicEncryption.org consortium publishes standardized security parameters specifically to prevent developers from accidentally choosing values that look efficient but fail to provide adequate cryptographic strength.

Getting Started

Begin by identifying a specific, contained use case in your organization where sensitive data currently must be decrypted for processing. Common starting points include aggregate statistical queries, simple machine learning inference, or private set intersection operations. These narrow computations are where FHE delivers the most value relative to its performance cost.

Next, evaluate the open-source libraries that implement modern FHE schemes. Microsoft SEAL implements the BFV and CKKS schemes and is well-documented for newcomers. OpenFHE, developed by a consortium of cryptographic researchers, supports BGV, BFV, CKKS, and advanced features like multi-party computation. Both libraries handle the complex parameter selection and noise management internally, allowing you to focus on defining your computation rather than wrestling with lattice mathematics.

For a deeper understanding of how encryption protects data across different states, explore our guide on Encryption at Rest vs in Transit. To understand the lattice-based mathematics that make FHE quantum-resistant, see our article on Post-Quantum Cryptography: NIST Standards Explained.