Lattice Attacks on the DGHV Homomorphic Encryption Scheme

In 2010, van Dijk, Gentry, Halevi, and Vaikuntanathan described the first fully homomorphic encryption over the integers, called DGHV. The scheme is based on a set of m public integers ci = pqi + ri, i = 1, · · · ,m, where the integers p, qi and ri are secret. In this paper, we describe two lattice-based attacks on DGHV. The first attack is applicable when r1 = 0 and the public integers ci satisfy a linear equation a2c2 + . . .+amcm = a1q1 for suitably small integers ai, i = 2, . . . ,m. The second attack works when the positive integers qi satisfy a linear equation a1q1 + . . . + amqm = 0 for suitably small integers ai, i = 1, . . . ,m. We further apply our methods for the DGHV recommended parameters as specified in the original work of van Dijk, Gentry, Halevi, and Vaikuntanathan.