Understanding Fully Homomorphic Encryption (FHE): Computing on Data Without Ever Opening It

Tech & Insight — The Homomorphic Encryption & Private AI Series (4 parts)

• ① Understanding Fully Homomorphic Encryption (FHE): Computing on Data Without Ever Opening It — current post
• ② Understanding THOR: Running LLM Inference on Ciphertext
• ③ Understanding the GL Scheme: Homomorphic Encryption Redesigned from the Ground Up for Matrices — coming soon
• ④ Understanding Private AI: Using AI Without Handing Over Your Data — coming soon

At a glance (TL;DR)

• Fully Homomorphic Encryption (FHE) is a cryptographic technique that lets you compute and analyze data while it stays encrypted. It is effectively the only known purely cryptographic method that protects data not only at rest and in transit, but also while it is in use.
• First proposed as an idea in 1978, it went more than 30 years without even a proof that it was possible, earning the nickname "the Holy Grail of cryptography." In 2009, Craig Gentry proved for the first time that it could be done.
• Performance has improved dramatically since, and FHE has now entered real service — powering select features on Apple's iPhone, confidential transactions on blockchains, and encrypted LLM inference (Private AI).
• DESILO is a leading deep-tech company in this field. Together with FHE's inventor Craig Gentry, it co-invented the fifth-generation GL Scheme (Gentry-Lee Scheme) and delivered the world's first commercial implementation, and it developed THOR, an FHE-based LLM inference framework.

Table of contents

1. What is homomorphic encryption
2. From partial to fully homomorphic: a taxonomy
3. 48 years of history: from proving the impossible to commercialization
4. How it works: lattices, noise, and bootstrapping
5. Comparing the major schemes: BGV/BFV, TFHE, CKKS, GL
6. On the myth that "homomorphic encryption is slow"
7. FHE versus other privacy-enhancing technologies (PETs)
8. Use cases by industry
9. Standardization and the global ecosystem
10. Korea and homomorphic encryption
11. Frequently asked questions (FAQ)
12. DESILO and FHE
13. Glossary
14. The FHE generational lineage
15. References

---

1. What is homomorphic encryption

Homomorphic Encryption (HE) is a cryptographic technique that performs computation directly on ciphertext, without ever decrypting it. Its essential property fits in a single sentence.

Run a computation on encrypted data, then decrypt the result, and you get exactly the same answer as if you had run that computation on the original data.

The name "homomorphic" comes from the mathematical notion of a homomorphism: the operational structure of the plaintext space is preserved in the ciphertext space. In symbols:

E(a) ⊕ E(b) = E(a + b)

That is, a specific operation (⊕) on ciphertexts corresponds exactly to addition (+) on plaintexts. Whoever performs the computation — a cloud server, an AI provider, a data-analysis agency — handles nothing but ciphertext from start to finish, so they never see the inputs, the intermediate values, or the final result. Only the data owner, who holds the secret key, can open the outcome.

The locked glovebox analogy

Craig Gentry, who first realized FHE, likened his technique to a jewelry workshop. Alice the jeweler wants her employees to work with valuable gold and gemstones without being able to steal them, so she builds a locked, transparent glovebox that workers can reach into only through attached gloves. An employee can assemble the materials inside into a finished ring, but only Alice holds the key that unlocks the box and takes the contents out.

Here, locking the materials inside the box is "encryption," assembling them through the gloves is "computation on ciphertext," and the key that retrieves the finished ring is the "secret key." The worker gets the job done without ever owning or seeing the materials. That this becomes possible in computing is the essence of homomorphic encryption.

Why it is the "last missing piece": protecting data in use

Data security breaks down into three stages across the data lifecycle.

Encryption at rest and in transit are already mature. The problem is the moment data is used. To analyze it, train on it, or query it, you have until now had to decrypt it back to plaintext. Most large breaches target exactly this moment — when data sits in memory as plaintext. Insider threats, questions of trust in cloud providers, and cross-border transfer rules all originate here.

Homomorphic encryption closes this last gap. Even as data crosses an organization's boundary into an external cloud, a partner, or an AI model and is computed on, it is never exposed as plaintext for even a single instant. That is why FHE is regarded less as an individual security product than as "a shift in the computing paradigm that lets you use data even in untrusted environments."

---

2. From partial to fully homomorphic: a taxonomy

Not every homomorphic scheme supports every operation. They fall into three tiers by the kind and number of operations they allow.

An intriguing fact: RSA (1977), the first public-key cryptosystem, already had multiplicative homomorphism "by accident" — multiply two ciphertexts and you get the ciphertext of the product of the plaintexts. Paillier (1999), which is additively homomorphic, was also widely used. But to express meaningful computation — statistical analysis, machine learning, search — you need both addition and multiplication, and enough of each. Because being able to perform unlimited addition and multiplication is, in theory, sufficient to express any computation (the completeness of logic circuits), fully homomorphic encryption is like a "general-purpose computer that runs on ciphertext."

For context, Pascal Paillier, who created the additively homomorphic scheme, is a co-founder of Zama, today a specialist FHE company. The cryptographer who opened the partial-homomorphism era became a founder in the fully-homomorphic one.

---

3. 48 years of history: from proving the impossible to commercialization

1978 — the question is born

The year after RSA was published, RSA's "R," Ron Rivest, and its "A," Leonard Adleman, together with Michael Dertouzos, posed a bold question in a paper titled "On Data Banks and Privacy Homomorphisms": what if a bank could compute on data without decrypting it? The "privacy homomorphism" they named is the starting point of today's homomorphic encryption. Yet for the next 30-odd years no one could prove it was possible, and many cryptographers assumed it never would be.

2009 — Gentry's breakthrough

Craig Gentry, then a doctoral student at Stanford University, presented the first fully homomorphic encryption construction, based on ideal lattices (STOC 2009). A 30-year-old open problem had just turned out to be "possible." For this work Gentry received the ACM Doctoral Dissertation Award, a MacArthur Fellowship (the so-called "genius grant"), and even the Gödel Prize, considered one of the highest honors in theoretical computer science. It is a rare case of a single doctoral thesis reshaping the landscape of a field. That first implementation was so slow that a single basic operation could take tens of minutes — and from that point on, the history of homomorphic encryption became a history of performance.

Generation by generation

The fourth-generation CKKS (Cheon–Kim–Kim–Song) was co-invented by Yongsoo Song — now a professor in the Department of Computer Science and Engineering at Seoul National University and a co-founder of DESILO — during his doctoral studies at SNU. It carries special significance: the most widely used homomorphic encryption in AI and data analysis today was born in Korea.

The fifth-generation GL (Gentry-Lee) Scheme was co-invented by FHE's founder Craig Gentry and DESILO Chief Scientist Yongwoo Lee. Its paper was released on the IACR ePrint archive in November 2025, and it was formally presented at the FHE.org 2026 conference in Taiwan. By fundamentally restructuring the computational efficiency of matrix multiplication, it broke through the performance ceiling of earlier generations — and DESILO built and shipped the world's first commercial software implementation of it. The person who opened FHE's history and a Korean company opened its next chapter together.

---

4. How it works: lattices, noise, and bootstrapping

Even without equations, three ideas capture the heart of modern FHE.

Lattice-based cryptography and the LWE problem

Most modern FHE bases its security on lattice-based cryptography, and specifically on the hardness of the Learning With Errors (LWE) problem and its ring variant, RLWE. Intuitively, LWE works like this. You are given a set of simultaneous linear equations, but each one has a tiny error (noise) mixed in. Without the error you could solve it with middle-school math; the moment small errors are added, the problem becomes intractable even for a supercomputer. This "difficulty of recovering a secret from noisy equations" is the source of FHE's security.

The fight against noise

For security, every ciphertext has a small amount of noise deliberately injected. The catch is that this noise grows every time you compute on ciphertexts — a little with addition, a lot with multiplication. Once the noise crosses a certain threshold, the signal (plaintext) is buried in it and decryption fails. So FHE designers manage how much computation each ciphertext can withstand through a concept called the noise budget — much like a radio signal drifting slightly out of tune, the noise rising until, at some point, you can no longer make out the broadcast.

Bootstrapping: Gentry's magic

If the noise budget is finite, the number of operations must be finite too — and that was the wall before 2009. Gentry's breakthrough was bootstrapping. The idea is remarkably recursive: since decryption is itself a computation, running that decryption operation while it stays encrypted yields a fresh ciphertext with the noise reset. The data is never exposed as plaintext for even a moment; only the noise is reinitialized. Perform bootstrapping periodically and a finite noise budget enables unlimited computation — turning "somewhat homomorphic" into "fully homomorphic." Bootstrapping is also the most expensive operation in FHE, so much of the past 15 years of FHE performance gains has been, in effect, the history of improving bootstrapping.

Bonus: quantum resistance

No efficient way to solve lattice problems on a quantum computer is known. That means FHE stands on the same mathematical foundation (lattices) as the flagship algorithms in the post-quantum cryptography (PQC) standard that the U.S. NIST finalized in 2024. In other words, adopting FHE buys two forms of future-proofing at once: protection for "data in use" and quantum resistance — in contrast to legacy public-key cryptography like RSA and ECC, which a quantum computer would render defenseless.

---

5. Comparing the major schemes: BGV/BFV, TFHE, CKKS, GL

FHE is not a single algorithm but a family of "schemes," and each generation has widened the range of data and operations it can handle. Looking at what each generation's schemes are good at shows how far the technology has come and where it is going.

Until now the rule of thumb has been "TFHE for logic, CKKS for statistics, BFV for exact lookups." The fifth-generation GL Scheme takes direct aim at what had remained the hardest problem on this map: large-scale AI computation. By fundamentally redesigning matrix multiplication — which accounts for most of the computation in large AI models — it brings AI workloads that were unwieldy for earlier-generation schemes into practical range.

---

6. On the myth that "homomorphic encryption is slow"

The most common reaction to homomorphic encryption is, "Sounds great, but isn't it too slow?" Half true, half outdated.

How much faster it has gotten. The first implementation in 2009 took tens of minutes for a single basic operation. Over the following 15 years, algorithmic innovation (new schemes, better bootstrapping, batching) and implementation optimization combined to improve performance by an estimated several hundred thousand times or more. Today's overhead relative to plaintext computation varies by workload, but there is no dispute that the field has shifted from "a technique that only works in theory" to "a technique you deploy in production by choosing the right workload."

Three axes of acceleration. The remaining gap is closing on three fronts.

1. Algorithms — new schemes like the GL Scheme that redesign the computational structure itself, along with techniques that reduce the number and cost of bootstrapping operations.
2. Software and GPU optimization — the parallelism of FHE operations pairs well with GPUs. DESILO's FHE library is likewise optimized for both CPU and GPU.
3. Dedicated hardware — the U.S. DARPA has invested in FHE-specific accelerator chips (ASICs) through its DPRIVE program, and numerous chipmakers and startups are developing FHE accelerators.

FHE is already part of daily life. Real deployments prove it.

• Apple — iOS 18's Live Caller ID Lookup uses homomorphic encryption. The iPhone checks an incoming number for spam and caller information through an encrypted query alone, without ever revealing the number to the server. Apple has open-sourced its own BFV-based implementation (swift-homomorphic-encryption) and also applies homomorphic encryption to the Photos app's Enhanced Visual Search. FHE is running every day on hundreds of millions of consumer devices.
• Zama — a French company applying FHE to confidential blockchain transactions. In June 2025 it raised a Series B and crossed a $1 billion valuation, becoming the first unicorn in FHE. Late in 2025 it launched a protocol on the Ethereum mainnet that processes transaction amounts while keeping them encrypted.
• DESILO's THOR — a framework that runs LLM inference in a fully homomorphic encryption environment. Developed jointly with Professor Miran Kim's research team at Hanyang University, it was accepted at ACM CCS 2025, the top-tier venue in computer security. It runs an entire existing LLM in an FHE environment without retraining while achieving practical speed — turning "Private AI," where a user's prompts and data stay encrypted throughout AI inference, into reality.

In short, the question has shifted from "can we use it?" to "which workload do we use it on first?"

---

7. FHE versus other privacy-enhancing technologies (PETs)

Homomorphic encryption belongs to a larger category called privacy-enhancing technologies (PETs). Each has a different trust model and protects something different; they are complementary rather than competing.

Two things are worth watching. First, the difference in trust models. TEEs deliver excellent performance but require trusting the hardware maker and its implementation, whereas FHE's security rests purely on mathematics, with no third party to trust. Second, composability. Just as Apple combined FHE and differential privacy for visual search, and just as federated-learning model updates can be protected with homomorphic encryption, real systems are designed by stacking several PETs like layers. The optimal combination depends on the trust level and performance each dataset needs, and this design capability is exactly where a PET company's expertise lies.

---

8. Use cases by industry

Finance. Different financial institutions can run combined analyses without exchanging customer data. Representative scenarios include merging credit information while it stays encrypted to refine scoring models, or jointly detecting anomalous-transaction and money-laundering patterns across institutions. Because the risks of data exfiltration and re-identification are eliminated at the source, avenues for collaboration open up even under strict financial regulation.

Healthcare and bio. Medical data — clinical records, imaging, prescription and checkup histories — is among the most sensitive personal information, and at the same time a field whose research value grows the more data you pool across institutions. With homomorphic encryption, multiple hospitals and research centers can pool patient data while it stays encrypted and conduct joint research. Genomic data in particular is the "ultimate sensitive information" — you cannot change it for life and it is effectively impossible to anonymize — which is where FHE's value shows most dramatically. Protecting individual privacy and advancing medical research, two values long in tension, can finally move forward side by side.

Public sector. Administrative data scattered across ministries and agencies can be securely combined to sharpen the resolution of policy analysis. The more an area is entangled with regulatory issues — cross-border transfer of personal data, entrusted processing of sensitive data — the greater FHE's utility.

AI. As generative AI spread, a new problem emerged: the moment you feed work documents or customer information into an LLM, that content is handed straight to the model operator. This is exactly why AI-adoption discussions keep stalling in heavily regulated industries like finance, healthcare, and the public sector. FHE-based Private AI runs inference while prompts and documents stay encrypted, so not even the model operator can know what a user asked or what answer they received. THOR, which runs the entire LLM inference process on ciphertext, sits at the very front of this movement.

Web3 and blockchain. On public blockchains where everything is visible, "confidential contracts" — smart contracts that run with transaction amounts and balances kept encrypted — are being implemented with FHE. It is drawing attention as a key to resolving the transparency paradox that has kept institutional capital from moving on-chain.

---

9. Standardization and the global ecosystem

For a technology to become industrial infrastructure, it needs standards. Homomorphic encryption's standardization is advancing along three tracks.

HomomorphicEncryption.org. An international industry–academia–research consortium launched in 2017, with companies such as Microsoft, Intel, and Samsung and researchers from major universities. It published a security-parameter standard document (the Homomorphic Encryption Security Standard) in 2018, setting a baseline for practical implementation, and alongside regular standardization meetings it is developing an FHE Benchmarking Suite based on real workloads. DESILO's FHE library is listed on the consortium's official introduction page as a major library implementing the CKKS and GL schemes with CPU and GPU optimization.

Official international standards. ISO/IEC established a standard for partially homomorphic mechanisms (ISO/IEC 18033-6) and is now advancing discussions on international standardization of fully homomorphic encryption; the U.S. NIST also addresses homomorphic encryption in its Privacy-Enhancing Cryptography project, separately from post-quantum cryptography standardization.

The library ecosystem. Alongside global libraries such as IBM HElib, Microsoft SEAL, OpenFHE, Lattigo, and TFHE-rs, in Korea DESILO's DESILO FHE (formerly Liberate.FHE) and CryptoLab's HEAAN are broadening the developer base. DESILO FHE is also featured among the major implementations in Wikipedia's article on the subject.

---

10. Korea and homomorphic encryption

Korea holds a distinctive global standing in homomorphic encryption research.

First, Korea has repeatedly led the generational turnover of homomorphic encryption. The fourth-generation CKKS, which supports real-number arithmetic and spread worldwide, came from a Seoul National University research team — its very name is the initials of its developers (Cheon–Kim–Kim–Song). The fifth-generation GL (Gentry-Lee) Scheme, which arrived to meet the AI era, also came from Korea. Korean researchers serve on the steering committee of the international standardization consortium as well.

Second, institutional demand is high. Since the amendment of the "Data 3 Acts," a pseudonymized-data combination regime has been introduced, but the re-identification risk and procedural burden of the combination-and-use process remain challenges. Homomorphic encryption, which enables combination and analysis while data stays encrypted, is drawing attention as a technology that can change the "use-versus-protect" trade-off. Demand is growing further, in step with the rationalization of network-separation rules in finance and healthcare and the broader push to adopt AI.

Third, the gap between research and industry is narrow. Korea is home both to research talent leading the world's academic conferences and to the specialist companies that turn that research into products. That the co-invention and world-first commercialization of the fifth-generation GL (Gentry-Lee) Scheme came from a Korean company is a symbolic moment for this ecosystem.

---

11. Frequently asked questions (FAQ)

Q1. If computation happens while encrypted, who can see the result?

Only the data owner, who holds the secret key. The server, cloud, or AI provider performing the computation handles the inputs, intermediate values, and results only as ciphertext. This is the fundamental difference between access control (only authorized people can see) and homomorphic encryption (computation happens in a state no one can see).

Q2. Can't homomorphic encryption still be hacked?

Its security rests on the mathematical hardness of lattice problems, and decades of open research have found no efficient attack — the same holds against quantum computers. Of course, any cryptographic technology also needs sound key management and implementation security, which is exactly why you should use standardized security parameters and vetted libraries.

Q3. Why is it drawing attention now, of all times?

Four things converged: ① 15 years of performance gains has now moved into the phase of verification for practical applications, ② the spread of generative AI caused demand to protect "data in use" to surge, ③ privacy regulation is tightening worldwide, and ④ large-scale commercial deployments by Big Tech such as Apple validated the technology.

Q4. Why not just use a TEE (confidential computing)?

A TEE is an excellent, high-performance, and already widely used technology, but it requires trusting the hardware maker and its chip implementation, and side-channel attacks have been reported. FHE guarantees security through mathematics alone, with no third party to trust. Choosing one, or running both together, depending on the required trust level and workload characteristics is the practical answer.

Q5. How much performance overhead is there?

It varies greatly by workload and scheme. Simple lookups and aggregation are already good enough to ship in consumer services (Apple), while heavy workloads like LLM inference are the most active frontier of optimization research. What is clear is that the gap is closing fast on three fronts: algorithms, GPUs, and dedicated hardware.

Q6. Do you need a cryptography expert to adopt it?

You used to, but it is increasingly being abstracted to the level of libraries, APIs, and compilers. Instead of hiring cryptography PhDs, companies are lowering the barrier to adoption by putting their existing data and AI pipelines on top of vetted FHE infrastructure. That is exactly what DESILO's product family aims for.

---

12. DESILO and FHE

DESILO, founded in 2020, is a Private AI infrastructure company built on fully homomorphic encryption. Under the problem statement "draw out the value of sensitive data without ever taking the data out," it has pursued both the research and the commercialization of homomorphic encryption.

Research. DESILO built the world's first commercial software implementation of the fifth-generation GL Scheme, co-invented by FHE's founder Craig Gentry and DESILO Chief Scientist Yongwoo Lee (currently a professor in the Department of Electrical and Electronic Engineering at Inha University). THOR, its FHE-based LLM inference framework, was accepted at ACM CCS 2025 through joint research with Professor Miran Kim's team at Hanyang University, and is recognized for running an entire existing LLM in a homomorphic encryption environment at practical speed without retraining. Two papers on the GL Scheme and GL bootstrapping were accepted at IACR CRYPTO 2026, one of the most prestigious venues in cryptography. DESILO's FHE library is listed as a major library on the international standardization consortium HomomorphicEncryption.org.

Products. DESILO's product family runs from the DESILO FHE Library, optimized for CPU and GPU with the goal of world-leading computation speed; through DESILO Private AI, which performs LLM inference and retrieval-augmented generation on top of encrypted data; to DESILO DCR (Data Clean Room), which provides a secure environment for analyzing sensitive data.

Ecosystem. DESILO has raised investment from Naver D2SF, LG Electronics, and the Korea Development Bank (KDB), among others, and contributes to the growth of the homomorphic encryption ecosystem through open-source releases and international standardization activities.

Homomorphic encryption has been called "the Holy Grail of cryptography" not merely because it was a hard problem to solve, but because once the technology becomes real it upends the entire set of assumptions surrounding data collaboration, the cloud, and AI. DESILO is leading the way toward a world where data can be used without constraints.

---

13. Glossary

---

14. The FHE generational lineage

---

15. References

• R. Rivest, L. Adleman, M. Dertouzos, "On Data Banks and Privacy Homomorphisms" (1978) — the origin of the homomorphic-encryption concept
• C. Gentry, "Fully Homomorphic Encryption Using Ideal Lattices" (STOC 2009) — the first FHE construction
• Z. Brakerski, C. Gentry, V. Vaikuntanathan, "(Leveled) Fully Homomorphic Encryption without Bootstrapping" (2012) — BGV
• I. Chillotti, N. Gama, M. Georgieva, M. Izabachène, "TFHE: Fast Fully Homomorphic Encryption over the Torus" (ASIACRYPT 2016)
• J. H. Cheon, A. Kim, M. Kim, Y. Song, "Homomorphic Encryption for Arithmetic of Approximate Numbers" (ASIACRYPT 2017) — CKKS
• J. Moon, D. Yoo, X. Jiang, M. Kim, "THOR: Secure Transformer Inference with Homomorphic Encryption" (ACM CCS 2025) — ePrint https://ia.cr/2024/1881, DOI 10.1145/3719027.3765150
• HomomorphicEncryption.org — the homomorphic-encryption standardization consortium
• Apple, "Announcing Swift Homomorphic Encryption" (Swift.org, 2024): https://www.swift.org/blog/announcing-swift-homomorphic-encryption/
• DESILO FHE Library: https://desilo.ai/en/solutions/desilo-fhe-library · https://fhe.desilo.dev/latest/

---

Tech & Insight — The Homomorphic Encryption & Private AI Series (4 parts)

• ① Understanding Fully Homomorphic Encryption (FHE): Computing on Data Without Ever Opening It — current post
• ② Understanding THOR: Running LLM Inference on Ciphertext
• ③ Understanding the GL Scheme: Homomorphic Encryption Redesigned from the Ground Up for Matrices — coming soon
• ④ Understanding Private AI: Using AI Without Handing Over Your Data — coming soon