Introduction to Fully Homomorphic Encryption

FHE is a privacy-preserving cryptographic mechanism that allows computation directly on encrypted data, removing the need for decryption during processing. This enables the protection of sensitive data in applications such as distributed computation, AI training and inference, and collaborative analytics with untrusted partners.

Definitions

General Definitions

• PETs: Privacy enhancing technologies are cryptographic and computational methods, such as FHE, SMPC, TEE, DP, and ZKP. These technologies enable data to be processed while maintaining strict confidentiality and minimizing the disclosure of information through mathematically grounded guarantees

• Technical Control: A security mechanism implemented through software, hardware, or firmware to enforce security policies and mitigate threats, typically via access controls, encryption, intrusion detection, and authentication protocols

• Trust: The degree of confidence that a system, entity, or component will perform as expected, enforcing security policies, access controls, and data integrity without introducing vulnerabilities or unauthorized actions

Regulation

• DORA: The Digital Operational Resilience Act is a European Union (EU) regulation that requires financial entities to implement comprehensive Information and Communication Technology (ICT) risk management, standardized incident reporting, third-party risk oversight, and threat-led penetration testing to ensure operational resilience across the European financial services ecosystem

• FIPS: Federal Information Processing Standard Publication 140-3 (FIPS 140-3), published by the National Institute of Standards and Technology (NIST), is a U.S. government standard that specifies security requirements for cryptographic modules used to protect sensitive information in computer and telecommunications systems

• HIPAA: The U.S. Health Insurance Portability and Accountability Act establishes federal requirements for covered entities to implement administrative, physical, and technical safeguards for health information through access controls, audit logging, encryption, and minimum-necessary disclosure standards with patient consent frameworks

• ISO: The International Organization for Standardization develops consensus-based technical specifications and management system frameworks, such as information security (ISO 27001), quality management (ISO 9001), and risk management (ISO 31000) standards, that provide systematic approaches to organizational governance and compliance

Architecture

Figure 1 shows FHE architecture[^1]:

Figure 1: FHE Architecture

Figure 2 shares a simpler representation of FHE architecture:

Figure 2: FHE Architecture (Simpler)

Schemes

Each FHE scheme is designed to handle specific data types for specific use cases:

• BGV: An FHE scheme created by Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan. BGV supports operations only on integer values and packs many values into a single ciphertext, allowing Single Instruction Multiple Data (SIMD)-style GPU-based parallel operations. BGV is suitable for workloads that require precise integer computations and structured circuit evaluation, such as tax-calculations processed under encryption or verifying encrypted digital signatures, where even a tiny arithmetic deviation breaks the whole thing

• BFV: Created by Zvika Brakerski, Junfeng Fan, and Frederik Vercauteren, BFV is similar to BGV, with the technical distinction lying in the management of cryptographic “noise” within the ciphertext. Also operates in the SIMD paradigm

• CKKS: An FHE scheme created by Jung Hee Cheon, Andrey Kim, Miran Kim, and Yongsoo Son, CKKS is designed for efficient computation on encrypted approximate real values via fixed point encoding. CKKS packs many values into a single ciphertext and supports SIMD-style parallel operations on these packed slots. These properties make CKKS particularly suitable for machine learning workloads that rely on vectorized arithmetic over real-valued data

• TFHE: FHE over the Torus. Unlike SIMD-oriented schemes, such as CKKS and BGV, that pack many values into a single ciphertext for high-throughput vectorized computation, TFHE encrypts and processes one value per ciphertext. Its design makes it well suited for blockchain workloads that require rapid evaluation of Boolean circuits rather than bulk numerical computation, such as policy checks and conditional execution in smart contracts

Note that the selection of an appropriate FHE scheme for a given workload is typically an expert task that involves an understanding of the data types, workflow, analytics and processing requirements, and required security level. These factors govern the selection of an appropriate scheme alongside additional considerations such as cryptographic parameter selection.

Standards

The standardization of FHE is critical to ensuring trustworthy, compliant, and stable implementations for industry use.

The relevant standardization bodies to the mathematical security of FHE are the same ones that govern cryptography in general. As a non-exhaustive list, this includes the ISO and NIST. While NIST is a domestic U.S. standards body, its standards are often reflected internationally. For example, the NIST guidelines on post-quantum cryptography and the subsequent PQC-enabled Transport Layer Security (TLS) profiles have been adopted by the Internet Engineering TaskForce and the European Telecommunications Standards Institute. Likewise, NIST standards such as FIPS 140-2/3 for hardware security have been commonly adopted in other jurisdictions.

Within specific domains such as healthcare, or under local jurisdictional requirements for data security, relevant standards such as HIPAA and the EU’s General Data Protection Regulation (GDPR) are anticipated to adopt guidance on the security level of FHE from organizations such as the ISO and NIST. FHE, by keeping data encrypted during processing, squarely meets the spirit of HIPAA’s encryption safeguard as it ensures electronic protected health information (ePHI) remains “unusable and unreadable to unauthorized individuals” at rest, in transit, and in use. However, there will likely be additional governance requirements regarding the usage of FHE as a technical control within specific domains.

Standardization of FHE on security aspects such as parameter selection and other technical considerations (e.g., balancing security against computational tractability) are currently underway within an ISO working group.
With respect to best practices at this current moment in time, organizations seeking to understand or adopt FHE as a technical control (even at the proof-of-concept stage) are encouraged to follow conventional best practices in the implementation of cryptography. This includes the use of schemes that are openly described in the technical literature with library-level implementations that are fully open source and which have been subjected to an open and ongoing process of cryptanalysis. This includes the BGV, BFV, CKKS, and TFHE schemes described above. These are the schemes that are covered by the ISO standardization process and are expected to represent the bulk of standards-compliant implementations in the foreseeable future.

Security Models in PETs

There are two dominant models of information security in PETs: input privacy and output privacy.

Input Privacy

• Objective: To prevent information leakage during data processing or computation
• Security Model: Protection of the input data from being exposed to the computing environment, collaborating parties, or the data processing system itself

• Relevant PETs:

  • FHE
  • SMPC
  • TEEs
  • ZKP

Output Privacy

• Objective: To prevent information leakage through queries or the output of computation
• Security Model: Assumes that computing may take place on data in the clear (i.e., unencrypted) but aims to limit how much an adversary can learn from observing the outputs
• Relevant PETs:
  • DP
  • Synthetic Data

Comparing FHE to Other PETs

Differential Privacy (DP)

DP is an output privacy technique effective for use cases involving aggregated statistical analysis or training on large datasets, where individual contributions are small and accuracy loss can be tolerated. Its performance overhead is minimal, and it works with conventional compute and machine learning pipelines.

DP as a concept covers a wide range of applications, ranging from data analysis to masking queries in application protocols such as Private Information Retrieval (PIR). The objective of DP is to provide a mathematically verifiable assertion that the outcome of the analysis of a dataset is independent of any single individual’s data.

However, DP introduces statistical noise and relies on the presence of multiple data entries, making it unsuitable for queries requiring high precision. DP is not a viable substitute for FHE for any use case where personalized outputs matter. For example, a cancer detection model where individual inaccuracies could return an answer with clinically significant errors.

Secure Multi-Party Computation (SMPC)

SMPC allows multiple parties to compute jointly on private data without revealing their inputs. It’s well-suited for collaborative analytics or training across untrusted stakeholders.

However, SMPC requires multiple rounds of communication between parties, introducing high latency and coordination overhead. It also ineffectively accelerates on modern hardware because the bottleneck is in interaction rather than computation.

Secure Multi-Party Computation Example

Figure 3 illustrates secure multi-party computation[^2]:

Figure 3: Secure Multi-Party Computation

As an example of the way the technology works (displayed in Figure 3), suppose Alice, Bob, and Cynthia would like to know the average of their hourly wages without telling each other the actual amounts. Alice, Bob, and Cynthia each know their hourly wage and individually break that amount into four numbers that add to the hourly wage (Step 1). They keep one amount to themselves then share one with each of the other two people and share one number with a trusted third party, a consultant or outside expert. Sharing these individual data points reveals nothing about Alice, Bob, or Cynthia’s actual hourly wage. Alice, Bob, and Cynthia, and the trusted third party, now each have three pieces of information for which they each calculate an average (Steps 2 and 3). Next, Alice, Bob, and Cynthia share their averages with the trusted third party who compiles the information by adding their own average calculation to the other three averages (Step 4). The sum of those four averages produces the final result, the average of Alice, Bob, and Cynthia’s hourly wages. At the end of this process, the average hourly wage is known, but neither Alice, Bob, nor Cynthia have learned each other’s hourly wage.

Trusted Execution Environments (TEE)

TEEs represent a broad category of hardware-based solutions to privacy and security based on hardware-level isolation and cryptographic attestation mechanisms. TEEs offer near-native performance by executing sensitive code inside an isolated hardware environment. The scope of protection can vary in scale from single processes (i.e., “process-based” TEEs, such as Intel SGX) through to full operating system environments running under virtualization, depending on underlying hardware capabilities. Their security assumes trust in both the technical implementation of the hardware isolation and the chain of cryptographic attestation. TEEs have been established to be vulnerable to side-channel attacks, hardware bugs, and privileged access breaches.

Figure 4 illustrates data being processed in a TEE:

Figure 4: Trusted Execution Environment

Zero-Knowledge Proofs (ZKP)

ZKPs allow the validity of a statement to be demonstrated without revealing the underlying information. ZKPs range from simple checks, such as whether one number exceeds another, to proof that a sequence of computations was carried out correctly. This makes them well suited to workflows where aspects of identity must be proven without disclosure or where concise assurances are needed that complex operations were performed as specified without re-executing them. However, ZKPs do not themselves modify or update the underlying state; they provide evidence of correctness, not stateful computation.

Zero-Knowledge Proof Example

Figure 5 illustrates a ZKP¹:

Figure 5: Zero-Knowledge Proof Protocol: Data Exchange

PET Comparison Matrix

Table 1: PET Comparison Matrix

Real-World Examples

Wally: A Practical FHE Implementation for Private Search

Apple’s Wally proves that privacy-preserving search is possible without giving up performance. For those using the Apple Photos app in iOS 18, Wally enables search for things like objects or people without Apple ever seeing the exact words typed, as everything is encrypted and real queries are mixed with fake ones, so it’s hard to tell which is real. The tech uses DP and Somewhat Homomorphic Encryption (SHE), which is a lighter-weight form of FHE.

Overall, Apple has delivered useful privacy protections for search features in consumer devices. Wally is built to work at scale, and Apple has proven it can handle millions of search queries and millions of items in the database with lower lag and less data transfer than other tools.

There are still some trade-offs and open questions, such as delays and increased energy usage due to Wally mixing in fake queries and routing traffic through anonymizing networks. However, as more honest clients participate, the overhead from fake queries decreases proportionally, making it ideal for large-scale deployment. More importantly, though, while SHE is useful for many use-cases, it doesn’t provide the level of cryptographic guarantees available with FHE.

The underlying SHE components have been released by Apple as an open-source Swift library.

Figure 6: Differential Privacy-Related Changes to Hide Real Queries (Changes Highlighted in Gray)

Microsoft Edge Password Monitor

Microsoft Edge’s Password Monitor uses FHE to provide a privacy-preserving password breach alert service, notifying users when a saved password is found in a breach and using homomorphic encryption to check passwords securely without exposing them.

Introduced in early 2021 (Edge version 88), Password Monitor privately checks whether saved passwords have appeared in known data breaches without revealing actual passwords to Microsoft. In practical terms, Edge takes an encrypted copy of a user’s credentials and compares it against a cloud-based database of leaked passwords while the data remains encrypted. The server performs the breach check on the encrypted data and returns an encrypted True/False result indicating if a password was found. Only a user’s browser (with the user’s key) can decrypt that result, so that neither Microsoft nor any attacker in transit can read related passwords or the breach result.

In January 2021, the Microsoft Edge team announced the Password Monitor’s rollout and highlighted its use of homomorphic encryption as a key privacy safeguard. A Microsoft Research blog post coincided with this release, explaining the cryptographic protocol in detail. Microsoft took SEAL library FHE research prototypes and integrated them into its consumer browser feature. The company also modified and optimized SEAL to run efficiently on all supported Edge devices and to minimize user performance impacts.

As of 2025, the Edge Password Monitor remains an opt-in feature that users can enable, and it stands as a successful early example of FHE in a consumer security feature.

Additional Resources

Cloud Security Alliance (CSA). (2025). Healthcare Confidential Computing and the Trusted Execution Environment, July 2025. https://cloudsecurityalliance.org/artifacts/healthcare-confidential-computing-and-the-trusted-execution-environment

Gifford, R., Goldstone, J., and Wilson, J. (2024). Understanding the Differences Between FHE and Confidential Computing, Cloud Security Alliance (CSA) Blog, August 2024. https://cloudsecurityalliance.org/blog/2024/08/22/understanding-the-differences-between-fully-homomorphic-encryption-and-confidential-computing

Moudgal, K., Prager, A., and Sharma, N. (2024). Project EPIC. https://www.jpmorgan.com/kinexys/documents/JPMC-Kinexys-Project-Epic-Whitepaper-2024.pdf

Royal Society. (2023). From privacy to partnership: The role of privacy enhancing technologies in data governance and collaborative analysis, January 2023.
https://royalsociety.org/-/media/policy/projects/privacy-enhancing-technologies/from-privacy-to-partnership.pdf