We present a new scheme for quantum homomorphic encryption which is compact and allows for efficient evaluation of arbitrary quantum circuits, as long as those circuits are of size, polynomial in the security parameter. Building on the framework of Broadbent and Jeffery (CRYPTO'15) and recent results in the area of instantaneous non-local quantum computation by Speelman (TQC'16), we show how to construct quantum gadgets that allow perfect correction of the errors which occur during the homomorphic evaluation of $\mathsf{T}$ gates on encrypted quantum data. Our scheme can be based on any classical (leveled) fully homomorphic encryption (FHE) scheme and requires no computational assumptions besides those already used by the classical scheme. The size of our quantum gadget depends on the space complexity of the classical decryption function -- which aligns well with the current efforts to minimize the complexity of the decryption function. Our scheme (or slight variants of it) offers a number of additional advantages such as ideal compactness, the ability to supply gadgets “on demand,” circuit privacy for the evaluator against passive adversaries, and a three-round scheme for blind delegated quantum computation which puts only very limited demands on the quantum abilities of the client. A conference version of this paper appeared in Advances in Cryptology: Proceedings of the 36th International Cryptology Conference (CRYPTO 2016).
We present a new scheme for quantum homomorphic encryption which is compact and allows for efficient evaluation of arbitrary quantum circuits, as long as those circuits are of size, polynomial in the security parameter. Building on the framework of Broadbent and Jeffery (CRYPTO'15) and recent results in the area of instantaneous non-local quantum computation by Speelman (TQC'16), we show how to construct quantum gadgets that allow perfect correction of the errors which occur during the homomorphic evaluation of T gates on encrypted quantum data. Our scheme can be based on any classical (leveled) fully homomorphic encryption (FHE) scheme and requires no computational assumptions besides those already used by the classical scheme. The size of our quantum gadget depends on the space complexity of the classical decryption function -- which aligns well with the current efforts to minimize the complexity of the decryption function. Our scheme (or slight variants of it) offers a number of additional advantages such as ideal compactness, the ability to supply gadgets “on demand,” circuit privacy for the evaluator against passive adversaries, and a three-round scheme for blind delegated quantum computation which puts only very limited demands on the quantum abilities of the client. A conference version of this paper appeared in Advances in Cryptology: Proceedings of the 36th International Cryptology Conference (CRYPTO 2016).
Quantum homomorphic encryption (QHE) is an encryption method that allows quantum computation to be performed on one party's private data with the program provided by another party, without revealing much information about the data nor about the program to the opposite party. It is known that information-theoretically-secure QHE for circuits of unrestricted size would require exponential resources, and efficient computationally-secure QHE schemes for polynomial-sized quantum circuits have been constructed. In this paper we first propose a QHE scheme for a type of circuits of polynomial depth, based on the rebit quantum computation formalism. The scheme keeps the restricted type of data perfectly secure. We then propose a QHE scheme for a larger class of polynomial-depth quantum circuits, which has partial data privacy. Both schemes have good circuit privacy. We also propose an interactive QHE scheme with asymptotic data privacy, however, the circuit privacy is not good, in the sense that the party who provides the data could cheat and learn about the circuit. We show that such cheating would generally affect the correctness of the evaluation or cause deviation from the protocol. Hence the cheating can be caught by the opposite party in an interactive scheme with embedded verifications. Such scheme with verification has a minor drawback in data privacy. Finally, we show some methods which achieve some nontrivial level of data privacy and circuit privacy without resorting to allowing early terminations, in both the QHE problem and in secure evaluation of classical functions. The entanglement and classical communication costs in these schemes are polynomial in the circuit size and the security parameter (if any).
Quantum homomorphic encryption (QHE) is an encryption method that allows quantum computation to be performed on one party's private data with the program provided by another party, without revealing much information about the data nor about the program to the opposite party. It is known that information-theoretically-secure QHE for circuits of unrestricted size would require exponential resources, and efficient computationally-secure QHE schemes for polynomial-sized quantum circuits have been constructed. In this paper we first propose a QHE scheme for a type of circuits of polynomial depth, based on the rebit quantum computation formalism. The scheme keeps the restricted type of data perfectly secure. We then propose a QHE scheme for a larger class of polynomial-depth quantum circuits, which has partial data privacy. Both schemes have good circuit privacy. We also propose an interactive QHE scheme with asymptotic data privacy, however, the circuit privacy is not good, in the sense that the party who provides the data could cheat and learn about the circuit. We show that such cheating would generally affect the correctness of the evaluation or cause deviation from the protocol. Hence the cheating can be caught by the opposite party in an interactive scheme with embedded verifications. Such scheme with verification has a minor drawback in data privacy. Finally, we show some methods which achieve some nontrivial level of data privacy and circuit privacy without resorting to allowing early terminations, in both the QHE problem and in secure evaluation of classical functions. The entanglement and classical communication costs in these schemes are polynomial in the circuit size and the security parameter (if any).
Quantum fully homomorphic encryption (QFHE) enables arbitrary quantum computations on encrypted data, but prior constructions require prohibitive quantum resources--specifically, O(lambda^2) EPR pairs per T-gate evaluation using the Barrington-based approach (DSS16). This paper introduces a unified framework achieving exponential improvement over the generic Barrington-based approach in program length.
The central innovation is a novel modular arithmetic program (MA-Program) tailored to learning with errors (LWE) decryption. We show that LWE decryption computes the inner product <sk,ct> mod q, a modular inner product that is NOT a symmetric function. Thus, prior symmetric-function optimizations (Sinha's O(n)-state branching programs) do not apply. Our MA-Program tracks partial sums modulus q with state space Z_q requiring O(log q) bits, yielding programs of state count O(lambda) with binary encoding O(log lambda) and length O(lambda log lambda). This reduces the quantum gadget size from O(lambda^2) to O(lambda log^2 lambda) EPR pairs.
To achieve a fully classical client, we transfer all quantum resources (EPR preparation, Bell measurements, adaptive error correction) to the server via the MA-Program gadget framework. Clients only perform classical LWE key generation, Pauli key encryption under classical FHE, and no quantum operations; a layered key structure further eliminates circular security assumptions. For parallel computation, we adopt the MBQC framework with flow functions, supporting up to O(log lambda) parallel measurements per layer. This separates offline resource preparation from online adaptive measurement, enabling parallel processing while maintaining deterministic evaluation.
Homomorphic encryption has giant advantages in the protection of privacy information. In this paper, we present a new kind of probabilistic quantum homomorphic encryption scheme for the universal quantum circuit evaluation. Firstly, the pre-shared non-maximally entangled states are utilized as auxiliary resources, which lower the requirements of the quantum channel, to correct the errors in non-Clifford gate evaluation. By using the set synthesized by Clifford gates and T gates, it is feasible to perform the arbitrary quantum computation on the encrypted data. Secondly, our scheme is different from the previous scheme described by the quantum homomorphic encryption algorithm. From the perspective of application, a two-party probabilistic quantum homomorphic encryption scheme is proposed. It is clear what the computation and operation that the client and the server need to perform respectively, as well as the permission to access the data. Finally, the security of probabilistic quantum homomorphic encryption scheme is analyzed in detail. It demonstrates that the scheme has favorable security in three aspects, including privacy data, evaluated data and encryption and decryption keys.
Abstract Quantum homomorphic encryption (QHE) can allow directly computation on the encrypted data without need to decrypt it in advance. It is also necessary to provide another property of verifiability that the client should verify whether the evaluation result is correct. However, most existing QHE schemes did not consider it and only assumed servers to be honest. In this paper, we propose a verifiable QHE (vQHE) scheme by using different types of circuits indistinguishable to the server, where the client can detect whether the server is honest or not by verifying the results of test circuits. Furthermore, by designing the gadgets to implement and test T gates and H gates in a non-interactive way for the used circuits, the proposed vQHE scheme does not require interaction during the process of evaluation. Thus the proposed vQHE scheme has the potential to make clients prefer to use it for protecting their private data in future quantum cloud environments.
Cloud computing allows clients with limited computational resources to offload computations to more powerful remote servers. In this paradigm, homomorphic encryption (HE) schemes enable a server to run any computation on a client's encrypted data. These schemes are widely used in cloud computing protocols such as delegated computing, two-party secure computation, and zero-knowledge proofs. Quantum homomorphic encryption (QHE) aims to achieve the objectives of HE with quantum data and quantum circuits, enabling cloud quantum servers to compute on encrypted quantum data uploaded by clients. In this work, we consider a scenario where a client has access to a quantum “encryption/decryption device”, which allows the encryption, transmission, reception, and decryption of quantum states, but not universal quantum computation. In this setting, we provide a proof-of-concept software simulation of quantum homomorphic encryption. Our code implements the “EPR scheme” of Broadbent and Jeffery, which allows for the execution of universal quantum circuits by the server at the cost of requiring shared EPR pairs between the client and server. Our implementation explores the near-term viability of the EPR scheme. Perhaps unsurprisingly, our experiments indicate that the additional cost of homomorphic circuit evaluation is minor in comparison to the simulation cost of the quantum operations. Our simulation toolkit is implemented in Python and is open-source.