Consider a cloud-based accounting system that needs access to aggregate information such as an account's balance but doesn't need access to individual transaction amounts in a ledger.

Does there exist a homomorphic encryption scheme that allows a public observer (such as a cloud computing provider) to compute the plaintext sum of a set of encrypted unsigned integers without being able to decode any individual transaction value (n=1 notwithstanding)?

As another example, regulations exist to ensure capital reserves. An institution could use such a scheme to furnish proof of compliance without disclosing individual transactions.

  • $\begingroup$ With "plaintext sum" do you mean that the public server is able to "decode only the result of the sum of the encrypted integers (sum allowed by adopting the homomorphic encryption)" ? $\endgroup$ Feb 3, 2012 at 17:36
  • $\begingroup$ Yes that's right $\endgroup$
    – H D
    Feb 4, 2012 at 0:12
  • $\begingroup$ It would be interesting to know if such a system exist for non-arbitrary intervals. For example the customer may allow the decryption of $n_4$ and $n_9$ only, so the accountant could calculate the difference $n_9 - n_4$ but not arbitrary differences. In this way the steps that led to the sum would still be concealed. $\endgroup$
    – gioele
    Feb 4, 2012 at 19:36
  • 1
    $\begingroup$ maybe this belongs to crypto.stackexchange.com $\endgroup$
    – didest
    Feb 4, 2012 at 20:19
  • 1
    $\begingroup$ @Diego, the question is in the scope as explained in the FAQ. $\endgroup$
    – Kaveh
    Feb 5, 2012 at 5:23

2 Answers 2


For all non-negative integers $n_0$,$n_1$,$n_2$ and random strings $r_0,r_1,r_2$

$n_0 \:\: = \:\: (n_0+n_1+n_2)-(n_1+n_2)$
$- \: \operatorname{plaintextsum}(\operatorname{encrypt}(n_1,r_1),\operatorname{encrypt}(n_2,r_2))$


Therefore any such scheme would be completely insecure
if more than 2 non-negative integers are encrypted with it.


The idea could work. The cyphertext would need to come with a non-interactive zero-knowledge proof that the plaintext lies in a certain interval ([0,100] for example) See link below for more details.

It is important to note that the answer at the end needs to be decrypted so it requires use of a decryption oracle at least once. Threshold encryption might be useful here.


  • $\begingroup$ Interesting, thanks! I will read up on that citation. $\endgroup$
    – H D
    Feb 4, 2012 at 21:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.