Homomorphic Encryption Explained

This article has three layers:

1. The intuition: no mathematics needed
2. Real-world use: private cloud computing, medical and genomic data, joint bank risk control, private machine learning, electronic voting, private information retrieval, the state of the industry and the performance cost
3. The mathematics: RSA, Paillier, ElGamal, ring homomorphisms, LWE/RLWE, noise, modulus switching, bootstrapping and BGV/BFV/CKKS, with small worked examples

Layer 1: The Intuition

1.1 Working on a locked box through gloves

Imagine a jeweler with a craftsman he doesn't trust, fearing he will steal the gold. So the jeweler arranges this:

1. The gold goes into a locked transparent glove box, with a pair of gloves reaching in from the side.
2. The craftsman puts his hands in the gloves and can melt, draw and solder the gold into a necklace inside the box.
3. But the craftsman can't open the lock, so he can't touch the gold or take it away.
4. When he finishes, the box goes back to the jeweler, who alone has the key and opens it to get the finished piece.

The correspondence:

The key point: the craftsman works the whole time, yet never learns what the gold looks like. Ordinary encryption only achieves "locked for storage and transport", and has to be unlocked before any computation; homomorphic encryption achieves "can be processed while locked".

1.2 What "computing directly on ciphertexts" means

Take the simplest example. You have two numbers, $3$ and $5$, and want a cloud server to compute $3+5$ for you, without the server knowing the two numbers.

All the server sees is two strings of gibberish. It performs some "ciphertext addition" on them and gets a third string of gibberish. You decrypt the third string and get exactly $8$. The server knows neither that the inputs were $3$ and $5$ nor that the result is $8$.

Note that "ciphertext addition" is generally not adding the two strings of digits directly. For Paillier, it is multiplying two ciphertexts; for lattice schemes, it really is adding vectors or polynomials. The exact operation depends on the scheme, as Layer 3 explains.

1.3 Three levels: PHE, SHE, FHE

Any computation can ultimately be broken down into addition and multiplication (XOR and AND gates, on bits), so the key questions are which operations can be done on ciphertexts, and how many times.

One way to remember them:

• PHE: the glove box holds only a hammer. You can keep hammering, but hammering is all you can do.
• SHE: a full set of tools, but each step leaves a little dust in the box (mathematically called noise). Once enough dust builds up you can't see, and the box can never be opened again.
• FHE: SHE plus a way to "remove the dust without unlocking" (bootstrapping), so work can continue indefinitely.

1.4 Why it's called "homomorphic"

"Homomorphism" is a mathematical word meaning literally "the same shape". In abstract algebra, a ring homomorphism $\varphi: R \to S$ is a map satisfying

$$\varphi(a+b) = \varphi(a) + \varphi(b),\qquad \varphi(ab) = \varphi(a)\varphi(b).$$

It "carries" the operations of $R$ into $S$: operate then map equals map then operate.

Homomorphic encryption says exactly this, usually viewed in the other direction: decryption, the map from ciphertexts to plaintexts, preserves operations, that is,

$$\mathrm{Dec}(c_1 \oplus c_2) = \mathrm{Dec}(c_1) + \mathrm{Dec}(c_2),\qquad \mathrm{Dec}(c_1 \otimes c_2) = \mathrm{Dec}(c_1)\cdot \mathrm{Dec}(c_2),$$

where $\oplus, \otimes$ are the corresponding operations in the ciphertext space. In other words, "computing in the ciphertext world" and "computing in the plaintext world" have the same shape, hence the name.

Strictly speaking, though, decryption in modern fully homomorphic schemes is only an approximate homomorphism, because each operation brings in a little noise. Layer 3 covers this in detail.

Layer 2: Real-World Use

2.1 Private cloud computing (outsourced computation)

This is the original motivation for homomorphic encryption. A company wants to use computing power in the cloud, but its data is sensitive (finances, medical records, user behavior):

• The traditional approach: upload plaintext, or decrypt in the cloud before computing, so the cloud provider and anyone who breaks into the cloud can see the data.
• Homomorphic encryption: upload ciphertext, and the cloud computes on it and sends back an encrypted result. The cloud only ever touches ciphertext.

It protects "data in use". Transport encryption (TLS) protects "data in transit" and disk encryption protects "data at rest", and the moment of computation is exactly the gap neither covers.

2.2 Medical and genomic data analysis

Data sharing among hospitals and research institutions is strictly limited by law (such as HIPAA in the US and GDPR in the EU). Homomorphic encryption allows:

• Several hospitals to pool encrypted records, with researchers computing statistics on the ciphertexts (means, regressions, chi-squared tests);
• Individuals to send an encrypted genome to a testing company, which compares disease risk loci on the ciphertext, with only the individual able to see the report.

Since 2014 academia has held the annual iDASH competition in privacy-preserving genomic analysis, with homomorphic encryption always a main track; tasks have included genome-wide association studies (GWAS) and logistic regression training on ciphertexts.

2.3 Joint risk control and anti-money-laundering among banks

Money launderers often scatter funds across many banks, and each bank sees only its own segment, not the whole picture; yet banks can't freely share customer data with each other.

Homomorphic encryption works like this: each bank encrypts transaction features and hands them to a joint analyst, who assembles a cross-bank flow graph and computes risk scores on ciphertexts, finally decrypting only the conclusion "this account is suspicious". Similar ideas are used for joint credit scoring and cross-institution blacklist queries. Real systems often combine homomorphic encryption with secure multi-party computation (MPC) and private set intersection (PSI).

2.4 Private machine learning inference

The model is on the server, the data is with the user, and neither wants to hand theirs over:

1. The user encrypts the input (a chest X-ray, say, or speech features) and sends it to the server;
2. The server runs inference with a plaintext model on the encrypted input, with matrix multiplication implemented by homomorphic addition and multiplication;
3. An encrypted prediction comes back, which only the user can decrypt.

The difficulty is activation functions. Non-polynomial functions like ReLU and sigmoid can't be computed directly. Common approaches are low-degree polynomial approximation (where CKKS excels) or direct table lookup with TFHE's programmable bootstrapping. Zama's Concrete ML is a tool that automatically compiles scikit-learn and PyTorch models into FHE circuits.

2.5 Electronic voting

Voting was one of the earliest successful applications of homomorphic encryption, using additive homomorphism:

• Each ballot is $\mathrm{Enc}(0)$ or $\mathrm{Enc}(1)$;
• The tallier "adds" all the ciphertexts to get $\mathrm{Enc}(\text{total votes})$;
• Only the total is decrypted, and no individual ballot is ever decrypted.

The open-source Helios voting system uses exponential ElGamal (see section 3.3) for homomorphic tallying, along with zero-knowledge proofs that each ballot really is $0$ or $1$ and not a cheating ballot like $\mathrm{Enc}(1000)$.

2.6 Private information retrieval (PIR)

You want to look up a record in a public database, without the database knowing which one you looked up.

With homomorphic encryption: encode the query as an encrypted "selection vector" $\mathrm{Enc}(0), \dots, \mathrm{Enc}(1), \dots, \mathrm{Enc}(0)$ (only position $i$ is $1$), and the server computes

$$\sum_j \mathrm{Enc}(e_j)\cdot \mathrm{DB}_j = \mathrm{Enc}(\mathrm{DB}_i).$$

The server performs the same operation on every record, so it has no idea what $i$ is. Real schemes compress the selection vector and use recursive layers to reduce communication.

2.7 The state of the industry

Main open-source libraries

A real deployment: Apple

• Live Caller ID Lookup (iOS 18, 2024): when a call comes in, the phone has to ask a server "whose number is this, and is it spam?". Apple uses BFV-based private information retrieval: the phone sends an encrypted number query, the server does the lookup on ciphertext and returns an encrypted result, and the server doesn't know who called you.
• Enhanced Visual Search (recognizing landmarks in photos): also uses homomorphic encryption for encrypted nearest-neighbor search, combined with differential privacy and an anonymizing network relay.

In addition, Google has open-sourced FHE compilers (HEIR and others), Intel offers the HEXL acceleration library, and DARPA's DPRIVE program funds dedicated FHE accelerator chips. On standardization, ISO/IEC 18033-6 already includes partially homomorphic schemes like ElGamal and Paillier, while standardization of fully homomorphic schemes (driven by the HomomorphicEncryption.org community) is still under way.

2.8 The performance cost

The main problems of homomorphic encryption are that it is slow and big.

For an order-of-magnitude example: with parameters $n = 2^{14}$ and $\log_2 q \approx 438$, a ciphertext consists of two polynomials, about

$$2 \times 2^{14} \times 438 \ \text{bit} \approx 1.4\times 10^{7}\ \text{bit} \approx 1.8\ \text{MB}.$$

Fortunately, with batching (see section 3.7), one ciphertext can hold thousands of numbers for SIMD parallel computation, and the amortized cost is much lower.

Layer 3: The Mathematics

3.1 RSA's multiplicative homomorphism

Textbook RSA: choose two large primes $p, q$, let $n = pq$ and $\varphi(n) = (p-1)(q-1)$, take $e$ with $\gcd(e, \varphi(n)) = 1$, and $d \equiv e^{-1} \pmod{\varphi(n)}$.

$$\mathrm{Enc}(m) = m^e \bmod n,\qquad \mathrm{Dec}(c) = c^d \bmod n.$$

The multiplicative homomorphism is almost obvious:

$$\mathrm{Enc}(a)\cdot \mathrm{Enc}(b) = a^e b^e = (ab)^e = \mathrm{Enc}(ab) \pmod n.$$

In the language of abstract algebra, $x \mapsto x^e$ is a homomorphism from the multiplicative monoid $(\mathbb{Z}_n, \cdot)$ to itself (restricted to the unit group $\mathbb{Z}_n^\times$, it is a group automorphism). But it doesn't preserve addition: in general $(a+b)^e \neq a^e + b^e$. So RSA is only PHE.

Why textbook RSA is insecure

1. Determinism: the same $m$ encrypts to the same result every time. If the plaintext space is small (a vote has only "yes/no"), an attacker can encrypt every possible plaintext and compare. Secure public-key encryption must be randomized to achieve semantic security (IND-CPA).
2. Malleability: without knowing $m$, an attacker can replace $c$ with $c \cdot 2^e$, and the recipient decrypts $2m$. For something like "transfer amount" this is a disaster. Note that homomorphism itself is malleability, so no homomorphic encryption can reach the strongest IND-CCA2 security, and it can only aim for IND-CPA.
3. Small-plaintext attacks: if $e = 3$ and $m^3 < n$, then $c = m^3$ never wraps around in the integers, and taking the cube root gives $m$ directly.

RSA in actual use always applies random padding first (such as OAEP), and padding happens to destroy the homomorphism. So RSA's homomorphism is more a teaching example than a practical tool.

3.2 Paillier: additive homomorphism

Paillier (1999) is the most widely used additively homomorphic scheme, based on the composite residuosity assumption: distinguishing "$n$-th powers" from "random elements" in $\mathbb{Z}_{n^2}^\times$ is hard.

Key generation: take large primes $p, q$, with $n = pq$, $\lambda = \operatorname{lcm}(p-1, q-1)$ and $g = n + 1$. Define $L(x) = \dfrac{x - 1}{n}$ and let $\mu = \lambda^{-1} \bmod n$. The public key is $(n, g)$ and the private key is $(\lambda, \mu)$.

Encryption: for plaintext $m \in \mathbb{Z}_n$, pick a random $r \in \mathbb{Z}_n^\times$,

$$\mathrm{Enc}(m; r) = g^m r^n \bmod n^2.$$

Decryption:

$$\mathrm{Dec}(c) = L\!\left(c^\lambda \bmod n^2\right)\cdot \mu \bmod n.$$

Why decryption works:

• The binomial theorem gives $(1+n)^m = \sum_k \binom{m}{k} n^k \equiv 1 + mn \pmod{n^2}$, because $n^2$ and higher terms vanish.
• By the Chinese Remainder Theorem $\mathbb{Z}_{n^2}^\times \cong \mathbb{Z}_{p^2}^\times \times \mathbb{Z}_{q^2}^\times$, and the orders $p(p-1)$, $q(q-1)$ of the two factors both divide $n\lambda$, so every element's order divides $n\lambda$, that is, $r^{n\lambda} \equiv 1 \pmod{n^2}$.
• So $c^\lambda = (1+n)^{m\lambda} r^{n\lambda} \equiv 1 + m\lambda n \pmod{n^2}$, $L(c^\lambda) = m\lambda \bmod n$, and multiplying by $\mu = \lambda^{-1}$ gives $m$.

Additive homomorphism:

$$\mathrm{Enc}(m_1; r_1)\cdot\mathrm{Enc}(m_2; r_2) = g^{m_1+m_2}(r_1 r_2)^n = \mathrm{Enc}(m_1 + m_2;\ r_1 r_2) \pmod{n^2}.$$

Multiplying ciphertexts corresponds to adding plaintexts. There is also scalar multiplication: $\mathrm{Enc}(m)^k = \mathrm{Enc}(km)$. So Paillier can compute "linear combinations of encrypted data", such as weighted sums and averages, but not the product of two encrypted plaintexts.

3.3 ElGamal: multiplicative homomorphism, and the additive "exponential" version

Let $G = \langle g \rangle$ be a cyclic group with a hard discrete logarithm (such as a subgroup of $\mathbb{Z}_p^\times$ or an elliptic curve group). The private key is $x$ and the public key is $h = g^x$.

$$\mathrm{Enc}(m; k) = (g^k,\ m h^k),\qquad \mathrm{Dec}(c_1, c_2) = c_2 \cdot c_1^{-x}.$$

It is naturally randomized (a fresh $k$ each time) and IND-CPA secure under the DDH assumption. Multiplying componentwise gives

$$(g^{k_1}, m_1 h^{k_1})\cdot (g^{k_2}, m_2 h^{k_2}) = (g^{k_1+k_2},\ m_1 m_2\, h^{k_1+k_2}) = \mathrm{Enc}(m_1 m_2;\ k_1 + k_2),$$

so ElGamal is multiplicatively homomorphic.

Exponential ElGamal: put the plaintext in the exponent, encrypting $g^m$ instead of $m$:

$$\mathrm{Enc}(m; k) = (g^k,\ g^m h^k).$$

Multiplying then gives $g^{m_1+m_2}$, which makes it additively homomorphic. The cost is that decryption yields only $g^m$, and another discrete logarithm must be solved to get $m$, so it suits only small $m$. Tallying votes fits exactly (the total can't exceed the number of voters), and this is what Helios does.

3.4 Ring homomorphisms, and why encryption is only an "approximate ring homomorphism"

Recall the definition: a map $\varphi: R \to S$ between rings satisfying

$$\varphi(a + b) = \varphi(a) + \varphi(b),\qquad \varphi(ab) = \varphi(a)\varphi(b),\qquad \varphi(1) = 1,$$

is called a ring homomorphism.

Why we want a ring homomorphism: any function $f: \mathbb{F}_2^k \to \mathbb{F}_2$ can be written as a polynomial over $\mathbb{F}_2$ (addition $=$ XOR, multiplication $=$ AND), and similarly for functions on $\mathbb{Z}_t$. If decryption $\mathrm{Dec}$ is a ring homomorphism, then for any polynomial $P$,

$$\mathrm{Dec}\big(P(c_1, \dots, c_k)\big) = P\big(\mathrm{Dec}(c_1), \dots, \mathrm{Dec}(c_k)\big).$$

That is, "computing $P$ on ciphertexts" equals "computing $P$ on plaintexts", which computes any function: full homomorphism.

Why it can't really be a ring homomorphism: if $\mathrm{Enc}$ itself were a deterministic ring homomorphism $\varphi: \mathbb{Z}_t \to S$, an attacker could mount an algebraic attack with the public operations. A ring homomorphism must satisfy $\varphi(1) = 1_S$, and $1_S$ is public, so an attacker can compute $\varphi(2) = 1_S + 1_S$, $\varphi(3) = 1_S + 1_S + 1_S$ and so on, listing the ciphertext of every plaintext in a table and looking up any ciphertext, with no security whatsoever. In abstract algebra terms, by the first isomorphism theorem $\operatorname{im}\varphi \cong \mathbb{Z}_t/\ker\varphi$, the structure of the image is completely determined by public algebraic data.

The solution: add noise. In modern schemes,

• Each plaintext corresponds to many ciphertexts (encryption is randomized),
• Decryption $=$ "first apply a true ring homomorphism, then round away the small noise".

What truly preserves operations is the phase map, an exact homomorphism; "rounding" is compatible with the operations only while the noise is small enough. So encryption is an approximate ring homomorphism: the homomorphism holds as long as the noise hasn't grown too large.

3.5 LWE and RLWE

The LWE problem (Learning With Errors, Regev 2005): take a modulus $q$ and a secret vector $s \in \mathbb{Z}_q^n$. You are given many pairs

$$(a_i,\ b_i = \langle a_i, s\rangle + e_i \bmod q),$$

where $a_i$ is uniformly random and $e_i$ is a small random error. The task is to find $s$ (the search version), or to distinguish these $(a_i, b_i)$ from uniformly random pairs (the decision version).

• Without the errors $e_i$, this is just a system of linear equations, solved by Gaussian elimination.
• With small errors added, elimination amplifies them uncontrollably, and the problem becomes hard. Regev proved that average-case LWE is at least as hard as certain worst-case lattice problems (such as approximate GapSVP and SIVP).
• There is currently no known quantum algorithm that solves LWE efficiently, so lattice cryptography is post-quantum, and FHE is naturally quantum-resistant.

A minimal LWE encryption (symmetric key, encrypting one bit $m \in \{0, 1\}$): let $\Delta = \lfloor q/2 \rfloor$,

$$\mathrm{Enc}(m) = (a,\ b) = \big(a,\ \langle a, s\rangle + e + \Delta m\big),\qquad \text{phase } \varphi_s(a, b) = b - \langle a, s\rangle = \Delta m + e.$$

Decryption checks whether the phase is closer to $0$ or to $\Delta$. The key observation: the phase map $\varphi_s$ is $\mathbb{Z}_q$-linear (a module homomorphism), so adding two ciphertexts adds their phases:

$$\varphi_s(c_1 + c_2) = \Delta(m_1 + m_2) + (e_1 + e_2).$$

RLWE (Ring-LWE, Lyubashevsky–Peikert–Regev 2010): replace vectors with the polynomial ring

$$R_q = \mathbb{Z}_q[x]/(x^n + 1),\qquad n = 2^k.$$

Samples become $(a,\ b = a\cdot s + e) \in R_q^2$, where $a, s, e$ are all polynomials and $e$ has small coefficients. There are two benefits:

• Compact: one polynomial is worth $n$ LWE samples, so keys and ciphertexts are much smaller;
• Fast: polynomial multiplication can use the number theoretic transform (NTT, the FFT over a finite field), in $O(n \log n)$.

Why $x^n + 1$: when $n$ is a power of $2$, $x^n + 1 = \Phi_{2n}(x)$ is the $2n$-th cyclotomic polynomial, irreducible over $\mathbb{Q}$ (Eisenstein's criterion applied after $x \mapsto x+1$). Because $x^n \equiv -1$, multiplication in this quotient ring is a "negacyclic convolution", convenient to compute, and its geometric properties (the canonical embedding) are good, keeping noise growth under control. This is exactly the quotient ring $F[x]/(f)$ from abstract algebra.

3.6 Noise growth, modulus switching, bootstrapping

Ciphertext multiplication and the "evaluation homomorphism"

In RLWE schemes, a ciphertext $(c_0, c_1)$ can be viewed as a linear polynomial in an unknown $y$: $c(y) = c_0 + c_1 y \in R_q[y]$. The first step of decryption is substituting $y = s$:

$$\mathrm{ev}_s: R_q[y] \to R_q,\qquad c(y) \mapsto c(s) = c_0 + c_1 s.$$

This is exactly the evaluation homomorphism from abstract algebra, an exact ring homomorphism. So the product of two ciphertexts is defined as the polynomial product:

$$c(y)\cdot c'(y) = c_0c_0' + (c_0c_1' + c_1c_0')\,y + c_1c_1'\, y^2,$$

which after substituting $s$ is exactly $c(s)\cdot c'(s)$. After multiplying, the ciphertext is quadratic in $y$ (three components), and relinearization (using a public encryption of $s^2$, the key-switching key) turns it back into a linear one.

How noise grows: in BGV style, let the phase be $c(s) = m + t e$ (the plaintext is in the "low bits", read modulo $t$).

Addition grows noise linearly, and multiplication grows it quadratically. After $L$ levels of consecutive multiplication, the noise is roughly $B^{2^L}$, an exponential explosion. Once the noise exceeds the order of $q/2$, reduction "wraps around" and decryption fails. This is why SHE can do only a limited number of multiplications.

Modulus switching (the core technique of BGV): after each multiplication, scale the whole ciphertext down,

$$c \ \mapsto\ c' = \Big\lfloor \tfrac{q'}{q}\, c \Big\rceil,\qquad q' < q.$$

The noise shrinks by the factor $q'/q$ too, while (with suitable correction) the plaintext is unchanged. In other words, the absolute size of the noise is pressed back to its original level, at the cost of a smaller modulus and less "remaining room". In practice one takes $q = q_0 q_1 \cdots q_L$ as a product of a chain of primes, "dropping" one prime after each level of multiplication, turning exponential noise growth into growth linear in the number of levels $L$. This chain of primes is represented using the Chinese Remainder Theorem (the RNS representation), also from abstract algebra.

Gentry's bootstrapping: what happens when the levels run out? Gentry's idea is to "run the decryption algorithm homomorphically":

1. In advance, encrypt the private key $s$ under itself (or another public key), and publish $\mathrm{Enc}(s)$, called the bootstrapping key.
2. Take a ciphertext $c$ whose noise is nearly full. The server treats each bit of $c$ as a constant and $\mathrm{Enc}(s)$ as the encrypted input, and homomorphically computes the decryption circuit $\mathrm{Dec}(\cdot, c)$: $$\mathrm{Eval}\big(\mathrm{Dec}(\cdot,\ c),\ \mathrm{Enc}(s)\big) = \mathrm{Enc}\big(\mathrm{Dec}(s, c)\big) = \mathrm{Enc}(m).$$
3. The result is still a ciphertext of $m$, but its noise comes only from "computing the decryption circuit", independent of the noise in the original $c$.

As long as a scheme can homomorphically compute its own decryption circuit and still has room for at least one more multiplication (called bootstrappable), ciphertexts can be "refreshed" without limit, upgrading SHE to FHE.

3.7 The differences among BGV, BFV, CKKS (and TFHE)

The ciphertexts of the three main RLWE schemes all live in $R_q = \mathbb{Z}_q[x]/(x^n + 1)$. They differ in where the plaintext sits in the phase:

The core idea of CKKS: floating-point arithmetic has rounding errors anyway, so treat encryption noise as part of the rounding error. The plaintext $m$ is "the true value times a scaling factor $\Delta$, rounded", and decryption yields $m + e$. As long as $e$ is small relative to $\Delta$, you only lose a few bits of precision. After multiplication the phase becomes $\Delta^2 m m' + \cdots$, and rescale (dividing by $\Delta$ and lowering the modulus) restores the scale, which is the same operation as modulus switching.

Batching (SIMD) and the Chinese Remainder Theorem: for BGV/BFV, if the prime $t \equiv 1 \pmod{2n}$, then $\mathbb{Z}_t$ contains a primitive $2n$-th root of unity $\zeta$, so $x^n + 1$ splits into $n$ linear factors over $\mathbb{Z}_t[x]$, and the Chinese Remainder Theorem gives

$$R_t = \mathbb{Z}_t[x]/(x^n + 1) \;\cong\; \prod_{i=1}^{n} \mathbb{Z}_t[x]/(x - \zeta^{2i-1}) \;\cong\; \mathbb{Z}_t^n.$$

This is a ring isomorphism, so one multiplication in $R_t$ equals one multiplication in each of $n$ slots. One ciphertext handles $n$ numbers at once ($16384$ when $n = 2^{14}$). CKKS uses a similar idea: the canonical embedding $R \to \mathbb{C}^{n}$ packs $n/2$ complex numbers into one polynomial.

3.8 Summary: homomorphic encryption through abstract algebra

Further Reading

• Craig Gentry, A Fully Homomorphic Encryption Scheme, Stanford PhD thesis, 2009
• Oded Regev, On Lattices, Learning with Errors, Random Linear Codes, and Cryptography, 2005
• Brakerski, Gentry, Vaikuntanathan, (Leveled) Fully Homomorphic Encryption without Bootstrapping, 2012 (BGV)
• Fan, Vercauteren, Somewhat Practical Fully Homomorphic Encryption, 2012 (BFV)
• Cheon, Kim, Kim, Song, Homomorphic Encryption for Arithmetic of Approximate Numbers, 2017 (CKKS)
• Pascal Paillier, Public-Key Cryptosystems Based on Composite Degree Residuosity Classes, 1999
• The official documentation and examples of Microsoft SEAL, OpenFHE and Zama TFHE-rs