# A Review of Research on Secure Aggregation for Federated Learning
## 3 Privacy-Preserving Mechanisms
### Homomorphic Encryption  
Homomorphic encryption (HE) is a form of encryption that allows computations to be performed on encrypted data, and the results of these computations remain valid after decryption. The secret encryption and decryption of homomorphic encryption satisfy the equation \(m=Dec(Enc(m,pk),sk)\). When the ciphertext is equal to \(c=f(c_{1},c_{2},\ldots,c_{n})\), and \(c_{i}=Enc(m_{i},pk)\), it follows that \(Dec(c,sk)=f(m_{1},m_{2},\ldots,m_{n})\). Here, \(m\) is the data to be encrypted by each user, \(m_{i}\) denotes the data to be encrypted by each user, \(Dec(a,b)\) is the decryption function, \(Enc(a,b)\) is the encryption function, \(pk,sk\) refer to the public key used for encryption and the private key used for decryption, respectively, \(c\) is the value of the encrypted data after the execution of the function, \(f\) is the function to be executed; the function is generally set to its aggregation algorithm in federated learning. Homomorphic encryption can be classified according to the number of arithmetic operations allowed on the encrypted data. The three classes of homomorphic encryption are as follows:  
* **Partially homomorphic encryption (PHE)**: Permits an unlimited number of operations, but restricts them to a single type, such as addition or multiplication. * **Somewhat homomorphic encryption (SWHE)**: Permits certain types of operations but limits the number of uses, such as allowing only one multiplication. * **Fully homomorphic encryption (FHE)**: Allows infinite types of algorithmic operations and an infinite number of times. The homomorphic encryption algorithms applied in federated learning are described as follows:  
* **Paillier partially homomorphic encryption**: The Paillier encryption algorithm is an asymmetric encryption algorithm with additive homomorphism properties and consists of three main steps:  
1. Key generation: (1) Randomly select large primes \(p,q\) such that \(p\) is not equal to \(q\). (2) Calculate \(n=pq\), \(\lambda=lcm(p-1,q-1)\), \(lcm\) is the least common multiple. (3) Randomly select \(g\in\mathbb{Z}_{n^{2}}^{*}\), and calculate the auxiliary value \(\mu=(L(g^{\lambda}\bmod n^{2}))^{-1}\bmod n\). Here, \(L(x)=\frac{x-1}{n},\mathbb{Z}_{n^{2}}^{*}\) is the multiplicative group modulo \(n^{2}\). (4) Use \((n,g)\) as the public key and \((\lambda,\mu)\) as the private key. 2. Encryption: For plaintext \(m\in\mathbb{Z}_{n}^{*}\), randomly select \(r\in\mathbb{Z}_{n}^{*}\) and compute the ciphertext \(c=g^{m}r^{n}\bmod n^{2}\). 3. Decryption: For ciphertext \(c\in\mathbb{Z}_{n^{2}}^{*}\), compute the intermediate value \(u=c^{\lambda}\bmod n^{2}\) required to restore the plaintext \(m=L(u)\mu\bmod n\). * **EIGamal partially homomorphic encryption**: The EIGamal encryption algorithm is a public key encryption scheme with multiplicative homomorphism properties, comprising three main steps:  
1. Key generation: (1) Choose a large prime \(p\) and a generator \(g\) of the multiplicative group \(\mathbb{Z}_{n}^{*}\). (2) Select a private key \(x\in\{1,2,\ldots,p-2\}\). (3) Calculate \(h=g^{x}\bmod p\) and use \((p,g,h)\) as the public key. 2. Encryption: For plaintext \(m\in\{1,2,\ldots,p-1\}\), randomly select an ephemeral key \(k\in\{1,2,\ldots,p-2\}\), compute \(c_{1}=g^{k}\bmod p\), \(c_{2}=m\hbar^{k}\bmod p\), and represent the ciphertext as the pair \((c_{1},c_{2})\)
3. Decryption: Using the private key \(x\), compute the shared secret \(s=c_{1}^{x}\bmod p\), and then restore the plaintext \(m=c_{2}s^{-1}\bmod p\), where \(s^{-1}\) is the modular inverse of \(s\) modulo \(p\). * **CKKS Fully Homomorphic Encryption**: The CKKS encryption algorithm is a fully homomorphic encryption algorithm designed for approximate computation, consisting of the following five main steps: 1. Key generation: (1) Parameter selection: Defining the ring polynomial \(R=\mathbb{Z}[X]/(X^{N}+1)\), which serves as the polynomial modulus in the CKKS encryption scheme. \(s^{-1}\) is the modular inverse of \(s\) modulo \(p\). \(N\) is a power of 2, and \(X\) is a formal variable.