Can homomorphic encryption be practical?
Converting pairing-based cryptosystems from composite-order groups to prime-order groups