I think the dream of homomorphic encryption ever being practical (at least for what I would consider practical) is unrealistic.<p>Let f(x) represent the encryption of x.<p>I would assume that a practical system has the following properties:
  * It is possible to compose primitive operators and values to implement a +1 operator (i.e. an operator that adds one to an integer). Call this operator g(x), defined such that g(f(x)) = f(x + 1).
  * If the value of 1 is leaked (which might, for example, be a literal that is used in a position that is known to the attacker), that shouldn&#x27;t compromise the entire scheme.
  * The scheme must provide a way to compare for equality so variable-length algorithms are possible. Define a function h such that h(f(x), f(y)) is true iff x = y.<p>By our assumptions, the attacker knows f(1). They can compute f(i + 1) = g(f(i)), and so they can compute as many small integers as they want. Suppose they have an unknown value u, that they know is a small integer, but they don&#x27;t know which one. They can test h(u, i) for each i up to some limit to find the value of u. Hence, the encryption scheme is insecure.