What is Fully Homomorphic Encryption (FHE), and what is its main practical limitation today?
FHE lets you perform arbitrary computation on ciphertexts — the result, when decrypted, equals what you would have gotten by computing on the plaintexts. Today it's practically usable but slow — orders of magnitude slower than plaintext computation.
The spectrum of homomorphism:
| Scheme | What you can compute on ciphertexts |
|---|---|
| Partially HE (Paillier, ElGamal) | Add OR multiply, but not both |
| Somewhat HE | Add and multiply, but only a bounded number of times |
| Fully HE (Gentry 2009 and successors) | Unlimited add and multiply — i.e. any computation |
What FHE enables:
- Encrypted database queries — the cloud computes on your encrypted data without ever seeing it.
- Private ML inference — you submit an encrypted image, the model returns an encrypted classification.
- Encrypted analytics — a researcher aggregates statistics across hospitals' encrypted records.
Why it's not yet everywhere:
- Each homomorphic multiplication can be 1000× to 1 000 000× slower than the same operation in the clear.
- Ciphertexts are large (kilobytes per scalar), making bandwidth a problem.
- "Bootstrapping" (refreshing noisy ciphertexts) is the expensive operation that makes FHE possible but limits its speed.
Leading libraries: Microsoft SEAL, OpenFHE, Concrete (Zama), TFHE-rs.
Tip: For most "I need to compute on encrypted data" problems in 2025, MPC or Trusted Execution Environments (Intel SGX, AWS Nitro Enclaves) are faster than FHE. FHE shines when you need a single-party cloud computation with no online interaction — e.g. an encrypted ML inference API.