Two-level homomorphic encryption for Node.js by WebAssembly

September 12, 2026 · View on GitHub

Abstract

This library supports two kinds of lifted ElGamal encryption,

For two vectors x = (x1, ..., xn) and y = (y1, ..., yn), EncG1(x1) * EncG2(y1) + ... + EncG1(xn) * EncG2(yn) = EncGT(x1 * y1 + ... + xn * yn).

see mcl

2026/Sep/12 v2.0.1 Security fixes.
- Breaking change: enc*, encWithZkp*, mulInt, and verify(c, zkp, m) throw if the plaintext is not an integer in the signed int32 range (NaN, 2.5, '3', 2**31, ...). Previously such values were silently converted by ToInt32 (e.g. encG1(NaN) was Enc(0)).
- dec fails instead of silently truncating a plaintext beyond int32 when the DLP range is widened by setTryNum.
- The random function is restored even if enc*(m, randHistory) throws.
- deserialize rejects an oversized input instead of corrupting the wasm stack.
2026/Aug/01 v1.8.0 The wasm module is built with clang instead of emcc.
2023/Sep/06 The performance of enc/dec is a little improved.
2023/Aug/17 The performance of dec is a little improved.
2022/Jul/20 v1.0.0
2020/Dec/27 change file layout
2020/Dec/18 sec.decWithZkpDec(c, aux) returns [m, zkp] that zkp proves dec(c) = m for CipherTextGT c, and aux.verify(c, zkp, m) returns the correctness where aux = pub.getAuxiliaryForZkpDecGT().
2020/Nov/06 sec.decWithZkpDec(c, pub) returns [m, zkp] that zkp proves dec(c) = m for CipherTextG1 c, and pub.verify(c, zkp, m) returns the correctness.

pnpm test

The version v0.7.0 breaks backward compatibility of the entry point.

Node.js : const she = require('she-wasm')
React : const she = require('she-wasm/browser')
HTML : <script src="https://herumi.github.io/she-wasm/browser/she.js"></script>

Install Clang and lld.

sudo apt install clang lld
pnpm install
git submodule update --init --recursive
cd src
make

MITSUNARI Shigeo(herumi@nifty.com)