10

I've seen that it's widely accepted that before Gentry's breakthrough (which is not practical yet) in 2009 there were no known full homomorphic encryption scheme.

I've read here in another answer that:

"...there are many known partially homomorphic cryptosystems, each one can either multiply or add numbers."

Now here on some interactive webpage allowing to test Paillier here:

mhe.github.io/jspaillier/

I can do [(A+B)*C], hence doing both addition and multiplication (?).

Why is Paillier not fully homomorphic seen that it can do both addition and multiplication?

Cedric Martin
  • 455
  • 4
  • 11

1 Answers1

11

It can not do multiplication in the plaintext domain using two ciphertexts. In other words, given $E(m_1)$ and $E(m_2)$, you can not get $E(m_1\cdot m_2)$. You can only get $E(m_1+m_2)$.

Given $E(m_1)$ and $m_2$, you can get $E(m_1\cdot m_2)$ however. But notice that $m_2$ in this case was not encrypted. On the site you reference, $C$ is not encrypted. It is using this feature that I just described.

mikeazo
  • 39,117
  • 9
  • 118
  • 183