Homomorphic Encryption with Coset Code Construction

arXiv:2610.31437 · cs.IT, cs.CR, math.IT · Submitted 2026-10-22 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: We're looking at the paper: "Homomorphic Encryption with Coset Code Construction".

Elias: Here's the gist of the paper. Homomorphic encryption with coset codes proposes an extension to existing homomorphic encryption constructions by utilizing coset codes to pack multiple message symbols into a single ciphertext vector, thereby reducing transmission overhead while supporting public addition and multiplication operations up to a predetermined degree The Gist This paper extends a construction based on scalar message codes, utilizing coset codes to pack k message symbols into a ciphertext vector of length n.

Nadia: How it works The core idea involves using a coset to jointly represent multiple message symbols, where distinct codewords within the coset correspond to the same message vector.

Elias: During encryption, a codeword is randomly selected, and errors are introduced outside a predefined set of “good positions”.

Nadia: The receiver utilizes these specific positions to identify the coset to which the message belongs and subsequently recovers the complete message vector.

Paper summary: Elias: So, thinking about "Homomorphic Encryption with Coset Code Construction," the authors are essentially proposing a way to pack multiple message symbols into a single ciphertext vector of length n.

Priya: It seems like the core contribution here is using coset codes to achieve that packing, which helps reduce transmission overhead compared to scalar constructions.

Nadia: Yeah, and they show this structure supports public addition and multiplication up to a predetermined degree, which is crucial for actually doing computations on that encrypted data.

Elias: The paper also lays out the algebraic requirements using specific code families like binary Reed–Muller codes and Reed–Solomon subcodes to make that packing work.

Priya: They prove the scheme achieves bounded chosen-plaintext security under the coordinate-label distinguishability assumption, which is a conditional guarantee we need to consider carefully.

Nadia: The implication for us is that it shows how coding theory concepts can be directly applied to homomorphic encryption by structuring the codes in a way that supports these operations.

Elias: It moves the focus from just scalar message codes to vector messages, and they compare the packed version against existing methods, showing a seventy-five percent reduction in ciphertext vectors for fixed message symbols.

Priya: What this means for someone listening who isn't doing deep math is that it suggests we can send more encrypted information in a single transmission packet while still allowing basic math operations on it.

Nadia: It’s about making the infrastructure of homomorphic encryption more efficient, by leveraging the structure of cosets to handle multiple message symbols at once.

Elias: Ultimately, this paper gives us a concrete construction that balances message packing efficiency with the need for public evaluation and a conditional security proof based on coordinate-label distinguishability.

Conclusion: Nadia: So, this paper is titled "Homomorphic Encryption with Coset Code Construction," and it’s by some researchers working on security and cryptography.

Elias: Yeah, they’re using these coset codes to pack message symbols into a single ciphertext vector of length n.

Priya: So what does that actually mean for the structure of the encryption?

Nadia: It means they reduce the amount of data you need to send when you're encrypting multiple pieces of information together.

Elias: Exactly. They use this coset idea so that distinct message symbols can share a single codeword, which cuts down on how many vectors you actually need to transmit.

Priya: And they manage to keep public addition and multiplication working up to a certain degree with this packing.

Nadia: Right, and they prove the scheme is secure against chosen-plaintext attacks, but only under this specific assumption about how coordinates are labeled.

Elias: It’s a conditional security result, which means we need to look closely at those assumptions when we try to use it in a real system.

Priya: So the main idea is packing efficiency versus the math required for operations.

Nadia: Right, and they show that for certain choices of these codes, you can get this better packing without losing too much functionality.

Elias: It seems like they’re showing us a way to improve how we handle vector data in homomorphic encryption setups.

Priya: It really pushes the boundary on how much you can fit into a single ciphertext while still keeping the math manageable for multiplication.

Nadia: And it opens up questions about whether this packing advantage still holds up when you look at real-world security threats and different types of attacks.

Syracuse University

cs.IT, cs.CR, math.IT

Submitted: 2026-10-22

Updated: 2026-10-22

Comments: 28 pages

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 82/100

The gist: Homomorphic encryption with coset codes proposes an extension to existing homomorphic encryption constructions by utilizing coset codes to pack multiple message symbols into a single ciphertext

Key concepts

Coset Codes: These are mathematical codes used to efficiently pack multiple message symbols into a single, longer ciphertext vector. The core idea is that distinct codewords within a specific coset represent the same underlying message vector, allowing for compact representation without losing information.
Clean and Random Mask Decomposition: The codeword is split into two parts: a 'clean' component containing message representatives and a 'random mask' component. The mask introduces randomness during encryption, combining with the message representative to form the ciphertext, which helps in the decryption process.
Coordinate-Label Distinguishability Assumption: This is a security assumption used to prove that an encryption scheme is secure. It means that it is computationally hard for an adversary to distinguish between encryptions based solely on observing labels (coordinates) of the ciphertext, which helps establish bounded chosen-plaintext security.

Summary

Homomorphic encryption with coset codes proposes an extension to existing homomorphic encryption constructions by utilizing coset codes to pack multiple message symbols into a single ciphertext vector, thereby reducing transmission overhead while supporting public addition and multiplication operations up to a predetermined degree

The Gist

This paper extends a construction based on scalar message codes, utilizing coset codes to pack k message symbols into a ciphertext vector of length n.

How it works

The core idea involves using a coset to jointly represent multiple message symbols, where distinct codewords within the coset correspond to the same message vector. During encryption, a codeword is randomly selected, and errors are introduced outside a predefined set of “good positions”. The receiver utilizes these specific positions to identify the coset to which the message belongs and subsequently recovers the complete message vector.

The scheme employs a structure where a codeword is decomposed into two components, denoted as clean and random mask, based on an internal direct sum C2 = C1 ⊕ K, where C1 contains message representatives and K contains random masks. The message is mapped to a representative in C1, and the randomized encryption process combines this with a random mask z from K and an error vector e from EB to form the ciphertext wm = z cm + z + e.

Public Computation

For multiplication, the evaluator computes the coordinatewise product directly: w× = wm ⊙ wm′. On the set of positions I, where errors are zero in both inputs, the product equals the coordinate-wise product of two “clean” codewords restricted to I. The construction uses a compatible sequence of code spaces to account for growth caused by multiplication while retaining the same message space and ciphertext-vector length.

Correctness and Security

The correctness guarantee is established by showing that decryption yields the input message, and this holds for any instance satisfying Definition 8. The scheme achieves bounded chosen-plaintext security under the coordinate-label distinguishability assumption. This conditional guarantee is proven by showing that an encryption adversary can be converted into a sample distinguisher and then into a coordinate-label distinguisher.

Compatible Code Families

The paper establishes that the algebraic requirements are realizable through two specific code towers:

Binary Reed–Muller codes: Theorem 2 constructs a compatible binary Reed–Muller tower where message and mask terms are separated by the supports of squarefree monomials, without requiring an average-free exponent set.
Reed–Solomon subcodes: Theorem 3 constructs a Reed–Solomon family using an average-free set to separate pure products from mixed terms, which is necessary for multiplication compatibility.

Packing and Comparison

The paper compares the packed representation against the scalar baseline construction of Armknecht et al. [9], showing that packing reduces the number of ciphertext vectors required to transmit a fixed number of message symbols, which can result in a reduction of 75% in the ciphertext-vector payload. The comparison also shows that while packing reduces fresh encryption calls, its security effect must be analyzed together with the available masking space and the restriction from products of zero encryptions.

The construction establishes correctness; its confidentiality remains a separate question. Future research should evaluate the security of these code families and sampling distributions against structural and sample-based attacks, refine the constructions where necessary, and determine whether the advantages of packing techniques persist when compared at equivalent security levels. The paper concludes that for certain parameter choices, publicly computed product results can invalidate this assumption, even without leaking the secret code space or error location information. This particular test does not by itself distinguish encryptions of two chosen messages. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C. The construction and proof are in Section VIII-A, B, and C.

Improvements for AI systems

Enhanced Message Representation for Homomorphic Encryption

The AI system can process longer message records as a single ciphertext vector by utilizing coset codes to pack multiple message symbols into one length n vector, which allows longer messages to be encrypted as a single unit and fully recovered by the recipient.

Support for Bounded Degree Computations

The system can perform public addition and multiplication operations up to a predetermined formal degree Delta, as the construction uses a compatible family of evaluation codes supports public addition and multiplication operations up to a predetermined degree.

Efficient Data Transmission via Packing

The AI system can reduce the number of ciphertext vectors required to transmit a message record by packing symbols, which amortizes the codeword storage overhead across multiple message symbols, potentially leading to a reduction of 75% in the ciphertext-vector payload compared to scalar constructions.

Recovery from Corrupted Data

The system can recover the entire packed message from good positions using Lemma 1, which states that if any two 'clean' codewords match at these good positions, they belong to the same message coset.

Conditional Bounded Chosen-Plaintext Security

The scheme provides a conditional guarantee of L-bounded IND-CPA security under Assumption 1, meaning Assumption 1 implies L-bounded IND-CPA security for the scheme, including the adversary’s public evaluations.

Verification of Algebraic Correctness

The system can verify that computations yield the corresponding message operations because a compatible sequence of code spaces accounts for the growth caused by multiplication, while retaining the same message space and ciphertext-vector length.

Abstract

Homomorphic encryption enables computation on input data without decrypting it. This paper extends a construction based on scalar message codes, utilizing coset codes to pack k message symbols into a ciphertext vector of length n. For a given field and vector length, this packing method reduces the number of ciphertext vectors required to transmit a message record. A compatible family of evaluation codes supports public addition and multiplication operations up to a predetermined degree. We prove that the scheme achieves bounded chosen-plaintext security under the coordinate-label distinguishability assumption.