Blind Oracle
FHE · TFHE-rs · gate bootstrapping
Encrypt two numbers in your browser, let an untrusted Oracle add the ciphertexts it can never read, then decrypt the sum locally.
THE QUESTIONER
Your keys. Your values. Your world.
HOW THIS DEMO WORKS
- Your browser generates keys and encrypts your numbers.
- Only ciphertext is sent over the wire to the Oracle.
- The Oracle adds ciphertexts and returns ciphertext.
- Your browser decrypts locally and reveals the sum.
This is Fully Homomorphic Encryption (TFHE-rs, gate bootstrapping bootstrapping = noise reset). The “plaintext world vs ciphertext world” panel below shows why the encrypted result decrypts to the right answer.
Same numbers, fresh randomness → different ciphertext bytes every time. Watch the fingerprints on the Oracle side change.
ENCRYPTED WIRE
The secret key stays pinned in your browser. Only ct_a, ct_b and the (non-decrypting) serverKey travel out; ct_result travels back.
GATE BOOTSTRAPPING & THE NOISE BUDGET
Every TFHE ciphertext hides its value under random noise. Each operation grows that noise; too much and decryption fails. Gate bootstrapping resets the noise after every gate so you can keep computing — but each reset is expensive, which is why real FHE programs stay small.
rise = operation adds noise · drop = bootstrapping refreshes it
THE BLIND ORACLE
Evaluation key only. Cannot decrypt. evaluation key = can transform ciphertext, cannot decrypt
ct_a preview
awaiting ciphertext A...
ct_b preview
awaiting ciphertext B...
The swatch and digest are a fingerprint of the actual ciphertext bytes. Encryption is probabilistic: re-encrypt the same number and this fingerprint changes — yet the Oracle still adds the two ciphertexts to the correct sum.
PLAINTEXT WORLD vs CIPHERTEXT WORLD
Homomorphism means the same computation runs in both worlds and the answers match: Enc(a) ⊞ Enc(b) decrypts to a + b. Encrypt and compute above, then watch both tracks fill in.
PLAINTEXT (what you know)
CIPHERTEXT (what the Oracle sees)
decrypt locally with your key → ?
Both tracks landed on the same number — the Oracle added two values it could never read, and the ciphertext result decrypted to exactly a + b. That is homomorphism, demonstrated rather than asserted.
WHY ADDING NOISE STILL ADDS: PEEK INSIDE ONE CIPHERTEXT
A TFHE ciphertext is not a locked box holding your number — it is your number plus a pile of random noise. The Oracle can add two of these piles without ever separating value from noise, which is exactly why it computes but cannot read. Open the peek to see one small value buried under that noise.
- Value + noise, added together: adding the two ciphertexts adds both the hidden 3 and 4 (giving 7) and both noise piles — so the result is a noisier encoding of the correct sum. Your secret key subtracts the noise away; the Oracle has no key, so to it the whole strip is random.
- Why bootstrapping exists: each add grows the noise strip. Do too many and the noise overruns the value slot — decryption returns garbage. Gate bootstrapping resets the noise back down after each gate, at real cost, so the computation can keep going. That is the rise-then-reset the noise budget above is about.