Advances in Cryptology – EUROCRYPT 2010

Volume 6110 of the series Lecture Notes in Computer Science pp 506-522

A Simple BGN-Type Cryptosystem from LWE

  • Craig GentryAffiliated withIBM Research
  • , Shai HaleviAffiliated withIBM Research
  • , Vinod VaikuntanathanAffiliated withIBM Research


We construct a simple public-key encryption scheme that supports polynomially many additions and one multiplication, similar to the cryptosystem of Boneh, Goh, and Nissim (BGN). Security is based on the hardness of the learning with errors (LWE) problem, which is known to be as hard as certain worst-case lattice problems.

Some features of our cryptosystem include support for large message space, an easy way of achieving formula-privacy, a better message-to-ciphertext expansion ratio than BGN, and an easy way of multiplying two encrypted polynomials. Also, the scheme can be made identity-based and leakage-resilient (at the cost of a higher message-to-ciphertext expansion ratio).