<p>The idea could work. The cyphertext would need to come with a non-interactive 
zero-knowledge proof that the plaintext lies in a certain interval ([0,100] for example) See link below for more details.</p>

<p>It is important to note that the answer at the end needs to be decrypted so it requires use of a decryption oracle at least once. Threshold encryption might be useful here. </p>

<p><a href="http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.103.4029&amp;rep=rep1&amp;type=pdf" rel="nofollow">http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.103.4029&amp;rep=rep1&amp;type=pdf</a></p>

CC BY-SA 3.0
2012-02-04T21:20:08.033Z
Interesting, thanks! I will read up on that citation.
H D
CC BY-SA 3.0
2012-02-04T04:28:48.290Z
2012-02-04T04:28:48.290Z
Samuel Ranellucci
<p>Consider a cloud-based accounting system that needs access to aggregate information such as an account's balance but doesn't need access to individual transaction amounts in a ledger.</p>

<p>Does there exist a homomorphic encryption scheme that allows a public observer (such as a cloud computing provider) to compute the <em>plaintext</em> sum of a set of encrypted unsigned integers without being able to decode any individual transaction value (n=1 notwithstanding)?</p>

<p>As another example, regulations exist to ensure capital reserves. An institution could use such a scheme to furnish proof of compliance without disclosing individual transactions.</p>

CC BY-SA 3.0
2012-02-03T17:36:33.217Z
With "plaintext sum" do you mean that the public server is able to "decode only the result of the *sum* of the encrypted integers (*sum* allowed by adopting the homomorphic encryption)" ?
Marzio De Biasi
CC BY-SA 3.0
2012-02-04T00:12:46.863Z
Yes that's right
H D
CC BY-SA 3.0
2012-02-04T19:36:28.670Z
It would be interesting to know if such a system exist for non-arbitrary intervals. For example the customer may allow the decryption of $n_4$ and $n_9$ only, so the accountant could calculate the difference $n_9 - n_4$ but not arbitrary differences. In this way the steps that led to the sum would still be concealed.
gioele
CC BY-SA 3.0
2012-02-04T20:19:55.633Z
maybe this belongs to http://crypto.stackexchange.com/
didest
CC BY-SA 3.0
2012-02-05T05:23:15.370Z
@Diego, the question is in the scope as explained in the [FAQ].
Kaveh
<cr.crypto-security><homomorphic-encryption>
Auditable encrypted ledger
H D
# Auditable encrypted ledger

(Asked by: username_0 on 2012-02-03)

Consider a cloud-based accounting system that needs access to aggregate information such as an account's balance but doesn't need access to individual transaction amounts in a ledger.

Does there exist a homomorphic encryption scheme that allows a public observer (such as a cloud computing provider) to compute the *plaintext* sum of a set of encrypted unsigned integers without being able to decode any individual transaction value (n=1 notwithstanding)?

As another example, regulations exist to ensure capital reserves. An institution could use such a scheme to furnish proof of compliance without disclosing individual transactions.

**Tags:** cr.crypto-security, homomorphic-encryption
> **Comments:**
> **username_1**: With "plaintext sum" do you mean that the public server is able to "decode only the result of the *sum* of the encrypted integers (*sum* allowed by adopting the homomorphic encryption)" ?  
> **username_0**: Yes that's right  
> **username_2**: It would be interesting to know if such a system exist for non-arbitrary intervals. For example the customer may allow the decryption of $n_4$ and $n_9$ only, so the accountant could calculate the difference $n_9 - n_4$ but not arbitrary differences. In this way the steps that led to the sum would still be concealed.  
> **username_3**: maybe this belongs to http://crypto.stackexchange.com/  
> **username_4**: @Diego, the question is in the scope as explained in the [FAQ].  

---

## 1 answers

### Answer by username_5 on 2012-02-04. Score: 0

The idea could work. The cyphertext would need to come with a non-interactive
zero-knowledge proof that the plaintext lies in a certain interval ([0,100] for example) See link below for more details.

It is important to note that the answer at the end needs to be decrypted so it requires use of a decryption oracle at least once. Threshold encryption might be useful here.

<http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.103.4029&rep=rep1&type=pdf>

> **Comments:**
> **username_0**: Interesting, thanks! I will read up on that citation.  

---

