How to Implement Homomorphic Encryption: FHE, CKKS, and BGV Explained
Fully Homomorphic Encryption (FHE) allows computation on encrypted data without decryption — the holy grail of privacy-preserving computing. This guide explains FHE schemes, benchmarks, and practical applications.
Introduction
Fully Homomorphic Encryption (FHE) allows computation on encrypted data without decryption — the holy grail of privacy-preserving computing. This guide explains FHE schemes, benchmarks, and practical applications.
Prerequisites
- ✓ Strong mathematics background (abstract algebra, number theory)
- ✓ Cryptography knowledge (RSA, AES, elliptic curves)
- ✓ Programming experience (C++ or Python)
Key Concepts
Step-by-Step Guide
- 1
Understand the HE Landscape
Homomorphic encryption has three levels: Partially HE (supports one operation — e.g., RSA for multiplication), Somewhat HE (supports limited operations — e.g., Paillier for addition), Fully HE (supports unlimited operations — e.g., BGV, CKKS, FHEW). FHE is the most powerful but also the most computationally expensive.
- 2
Learn the CKKS Scheme
CKKS (Cheon-Kim-Kim-Song) is the most practical FHE scheme for real-world applications. It supports approximate arithmetic on complex/real numbers, making it ideal for machine learning and statistical computations. The trade-off: results are approximate, not exact.
python# Using OpenFHE Python bindings from openfhe import * params = CCparamsCKKSRNS() params.SetMultiplicativeDepth(6) params.SetScalingModSize(50) cc = GenCryptoContext(params) cc.Enable(PKESchemeFeature.PKE) cc.Enable(PKESchemeFeature.LEVELEDSHE) keys = cc.KeyGen() # Encrypt ct1 = cc.Encrypt(keys.publicKey, [1.5, 2.3, 4.1]) ct2 = cc.Encrypt(keys.publicKey, [2.0, 1.1, 3.5]) # Compute on encrypted data ct_sum = cc.EvalAdd(ct1, ct2) ct_prod = cc.EvalMult(ct1, ct2) - 3
Understand BGV for Exact Arithmetic
BGV (Brakerski-Gentry-Vaikuntanathan) supports exact arithmetic on integers. Use BGV when you need exact results (e.g., cryptographic protocols, voting, financial calculations). BGV is typically slower than CKKS but provides correctness guarantees.
Tip: Choose CKKS for ML/statistics (approximate is fine), BGV for exact integer arithmetic (financial, voting). - 4
Manage Noise and Bootstrapping
Every homomorphic operation adds noise to the ciphertext. After enough operations, the noise overwhelms the message and decryption fails. Bootstrapping refreshes the ciphertext by homomorphically evaluating the decryption circuit — but it is extremely expensive (10-1000x slower than the original operation).
Warning: Bootstrapping is the main bottleneck in FHE. Modern schemes (FHEW, TFHE) have faster bootstrapping (~10ms) but still much slower than plaintext computation. - 5
Benchmark FHE Performance
FHE performance benchmarks: Simple addition: 1-10ms. Multiplication: 10-100ms. Bootstrapping: 100ms-10s. Compared to plaintext: 1000-10000x overhead. CKKS is fastest for real-number arithmetic. FHEW/TFHE are fastest for boolean operations.
textFHE Performance (2026): Operation | CKKS | BGV | TFHE -----------------|---------|---------|-------- Add | 1ms | 2ms | 0.1ms Multiply | 15ms | 50ms | 1ms Bootstrapping | 500ms | 2s | 10ms Plaintext ratio | 1000x | 5000x | 500x - 6
Apply FHE to Machine Learning
Privacy-preserving ML is the most promising FHE application. Clients encrypt their data, send it to a server that runs inference on encrypted data, and return encrypted predictions. The server never sees the plaintext data. Libraries: Concrete-ML (Zama), HEaaN (CryptoLab), OpenFHE.
FHE enables ML inference on encrypted medical data — hospitals can use cloud AI without exposing patient records. - 7
Implement Private Information Retrieval
PIR allows a client to retrieve an item from a server's database without the server learning which item was retrieved. FHE-based PIR is the most efficient approach. Use cases: private DNS queries, patent searches, medical record retrieval.
Tip: PIR is one of the most practical FHE applications — it has reasonable performance and clear privacy benefits. - 8
Use FHE for Secure Voting
FHE enables end-to-end verifiable voting: votes are encrypted, homomorphically tallied, and the result can be verified without decrypting individual votes. This prevents vote buying and coercion while maintaining ballot secrecy. Several countries are piloting FHE-based voting systems.
- 9
Explore FHE Hardware Acceleration
FHE's computational overhead makes hardware acceleration critical. Approaches: GPU acceleration (10-50x speedup with CUDA), FPGA acceleration (50-100x), ASIC designs (100-1000x expected). DARPA's DPRIVE program is funding FHE ASIC development targeting real-time performance.
Warning: Without hardware acceleration, FHE is too slow for most real-time applications. Budget for GPU or FPGA acceleration in production deployments. - 10
Choose an FHE Library
OpenFHE — open-source, supports CKKS/BGV/TFHE, C++ with Python bindings. Microsoft SEAL — well-documented, CKKS and BGV. Concrete (Zama) — Python-first, focused on ML. HEaaN (CryptoLab) — commercial, optimized CKKS. Choose based on your language preference and use case.
textLibrary Comparison: OpenFHE: C++/Python, all schemes, open-source SEAL: C++/Python, CKKS+BGV, Microsoft Concrete: Python, CKKS, ML-focused HEaaN: C++, CKKS, commercial TFHEpp: C++, TFHE, fast bootstrapping - 11
Plan for FHE Adoption
FHE is not yet practical for all use cases. Start with: PIR (good performance), simple ML inference (with acceleration), and voting (small computation). Monitor hardware acceleration progress — FHE ASICs expected by 2027-2028 will make real-time applications feasible. Prepare your architecture for FHE integration.
Summary
Fully Homomorphic Encryption enables computation on encrypted data without decryption — the ultimate privacy-preserving technology. CKKS is best for approximate arithmetic (ML, statistics), BGV for exact integer arithmetic. The main challenge is performance: FHE is 1000-10000x slower than plaintext computation. Hardware acceleration (GPU, FPGA, ASIC) is closing this gap. Start with PIR and simple ML inference, and prepare for broader adoption as hardware acceleration matures.
Frequently Asked Questions
For specific use cases: yes. PIR, simple ML inference, and voting are practical today with GPU acceleration. General-purpose FHE computation at scale requires hardware acceleration that is still 2-3 years away.
1000-10000x slower depending on the operation. Addition is fastest (1-10ms), multiplication is moderate (10-100ms), bootstrapping is slowest (100ms-10s). GPU acceleration reduces this by 10-50x.
CKKS supports approximate arithmetic on real/complex numbers — best for ML and statistics. BGV supports exact arithmetic on integers — best for financial calculations and voting. CKKS is faster; BGV is more precise.
Not entirely. FHE is non-interactive (client sends encrypted data, server computes, returns result) but slow. MPC is interactive (multiple parties compute together) but faster. They complement each other — hybrid approaches often work best.
Test Your Knowledge
1. What makes Fully Homomorphic Encryption "fully" homomorphic?
FHE supports both addition and multiplication (and therefore arbitrary computation) on encrypted data. Partially HE supports only one operation, Somewhat HE supports limited combinations.
2. What is bootstrapping in FHE?
Every homomorphic operation adds noise. Bootstrapping homomorphically evaluates the decryption circuit to refresh the ciphertext, reducing noise and enabling further computation. It is the main performance bottleneck.
3. Which FHE scheme is best for machine learning applications?
CKKS supports approximate arithmetic on real numbers, which is ideal for ML and statistical computations where small approximation errors are acceptable.