Quote from: ShadowOfHarbringer on October 07, 2013, 07:24:47 AM

Quote from: gmaxwell on October 02, 2013, 10:57:57 PM

Quote from: ShadowOfHarbringer on October 02, 2013, 10:53:58 PM

Correct me if I am wrong here, please.

You are wrong. But you're asking in the wrong place go see the nice article on wikipedia.

I did see the article on wikipedia, and it says that full homomorphic encryption is a scientists' wet dream and it has never been achieved.

Well technically it was achieved by Gentry and a few related improvements on that, however those schemes are extremely far from practical. Ie megabyte keys, bajillion machine cycles per encrypted operation etc. Still it was a nice result that proves it is actually possible which was uncertain in the 30+ years since it was posed as a question by Rivest et al. They even somewhat recently have a library so one could download it and try out how expensive it is.

Anyway for homomorphically encrypted coin values you dont need fully homomorphic (ie you dont need both additively homomorphic & multiplicatively homomorphic, additive only is enough). In fact thats even easy and there are several additively homomorphic encryption systems like elgamal and paillier. The hard part is efficiently preventing the user adding n the order of the group to their balance for massive scale fraud.

Adam