What is homomorphic encryption, and why doesn't AI chat use it yet?

The Morse teamPublished October 26, 20268 min read

Homomorphic encryption is encryption that lets a computer run calculations on data while it stays encrypted, so the server never sees the data, and the key holder decrypts a result that matches what the same calculation would give on the plain data. Fully homomorphic encryption (FHE), first shown by Craig Gentry in 2009, can in principle run any computation this way. As of October 2026 it ships in iPhones for private lookups, but no AI chat app runs a large language model under it, because it's still thousands of times too slow and too costly per word.

We read the HomomorphicEncryption.org standard, ISO's catalogue entries, NIST's privacy-enhancing cryptography pages, the Microsoft SEAL, OpenFHE, and Zama documentation, Apple's own posts, Gentry's thesis page, and the newest FHE language-model papers, on October 22, 2026. Every number below links to the page it came from.

What is the difference between partially, somewhat, and fully homomorphic encryption?

They differ in which operations you can run on ciphertext, and how many.

• Partially homomorphic schemes support one kind of operation. ISO/IEC 18033-6:2019 standardizes two of them, exponential ElGamal and Paillier encryption, for "homomorphically operating on encrypted data." ISO confirmed the standard again in 2024 (ISO).
• Somewhat or leveled schemes support both addition and multiplication, but only to a set depth. Every operation adds noise to the ciphertext, and too much noise makes it undecryptable. The HomomorphicEncryption.org standard says "the most practical homomorphic encryption schemes are limited to performing bounded depth computations" (HES).
• Fully homomorphic schemes have no depth limit. They get there with bootstrapping, "a homomorphic evaluation of the decryption algorithm given the encryption of the secret key," which wipes the noise back down. The same standard calls bootstrapping "a very time-consuming operation" (HES).

Within FHE, the schemes split by what they compute on. SEAL says BFV and BGV do "modular arithmetic" on encrypted integers, while CKKS handles "additions and multiplications on encrypted real or complex numbers" (Microsoft SEAL). CKKS is the one machine-learning work uses, since neural networks run on approximate numbers.

Who invented fully homomorphic encryption?

Craig Gentry, in 2009. A preliminary version, "Fully homomorphic encryption using ideal lattices," appeared at the Symposium on the Theory of Computing that year, and his Stanford PhD thesis, "A fully homomorphic encryption scheme," is what he calls "a complete write-up" of the system (Gentry; Stanford's server was down when we checked, so we read its January 2025 capture on the Internet Archive). The bootstrapping trick every FHE scheme still relies on is his: the HomomorphicEncryption.org standard credits it to "Gentry [G09]."

Is homomorphic encryption standardized?

Partly. Four bodies are involved, at different stages:

The consortium describes itself as "an open consortium of industry, government and academia to standardize homomorphic encryption" (HomomorphicEncryption.org). Its standard lists CKKS only as an alternative scheme that "is not described here," with a note that future versions should include it. NIST's privacy-enhancing cryptography project refers to that consortium as the initiative "promoting the standardization" of FHE and has given talks at its workshops through 2024 (NIST PEC).

Which libraries implement it?

• Microsoft SEAL, MIT licensed, version 4.7, with BFV, BGV, and CKKS (SEAL).
• OpenFHE, BSD 2-clause licensed, with BGV, BFV, CKKS, FHEW, and TFHE, built by "some of" the authors of PALISADE, HElib, HEAAN, and FHEW (OpenFHE).
• swift-homomorphic-encryption, Apple's open-source BFV library, released July 30, 2024 (Swift.org).
• Zama's TFHE-rs and Concrete ML, the latter with a mode for running parts of a language model on encrypted data (Zama).

SEAL's README states the limits directly: "Homomorphic encryption is not a generic technology: only some computations on encrypted data are possible." It adds that comparison, sorting, and regular expressions "are in most cases not feasible," and that it "comes with a substantial performance overhead."

Where is homomorphic encryption used today?

The largest deployment we found is Apple's. iOS 18 uses Apple's BFV library for Live Caller ID Lookup, which Apple describes as "a form of private key-value database lookup": the phone asks about a number, and the server answers without learning which number it was (Swift.org). Enhanced Visual Search in Photos goes further. Your phone sends an encrypted embedding of a photo region, "quantized to 8-bit precision before being encrypted," the server finds the nearest landmark under encryption, and a third-party relay hides your IP address (Apple, October 2024). Apple targets "post-quantum 128-bit security" for both.

Both features are lookups: one small encrypted query against one large database. That's the kind of "relatively lightweight" job SEAL says homomorphic encryption suits.

How slow is homomorphic encryption?

Every source we read says it's slow, and the gap grows with the size of the computation. Here are the numbers from the people who build it:

Zama's 2023 post predicted "end-to-end encrypted AI within 5 years," counting on hardware accelerators aiming at a 1,000x speedup in their first generation. The 2026 Llama-3-8B result cut the time from minutes per token to under 20 seconds. But an 8-billion-parameter model is small next to the ones people chat with, and 18 seconds a token means a 300-word answer would take around two hours.

Can AI chatbots run on homomorphic encryption?

Not as of October 2026. The research systems either run a small model slowly or move part of the work back to your device. Zama's Concrete ML has the client run "non-linear layers in the LLM, such as attention and activation functions," while the server handles only the linear ones, and each token costs about 18 MB of traffic for Llama 3.2 1B (Zama).

So the apps that encrypt AI chats end to end run the model inside a trusted execution environment instead, and check its attestation before sending. Apple, the company with the biggest homomorphic encryption deployment, made the same call for Apple Intelligence. Its Private Cloud Compute post says large cloud models need "unencrypted access to the user's request," and "that precludes the use of end-to-end encryption," so iPhones send requests only to servers that "cryptographically attest to running publicly listed software" (Apple Security, June 2024).

IEEE Spectrum wrote in September 2025 that confidential computing "can't support GPUs, making them an ill match for LLMs" (IEEE Spectrum). As of October 22, 2026, NVIDIA's own page says confidential computing is "supported across the NVIDIA Rubin, NVIDIA Blackwell, and NVIDIA Hopper" platforms, the GPUs large models run on.

Homomorphic encryption vs TEE: which protects more?

They protect different things. Homomorphic encryption keeps the data hidden from the hardware itself, so it doesn't depend on any chip working as designed. A TEE decrypts data inside isolated hardware, so it's fast and can prove what code ran. The Consortium's comparison, read October 22, 2026 (CCC):

The Consortium says a homomorphic algorithm "by itself cannot ensure that the correct operations have been done," and that the two "are often complementary." A TEE's weak point is someone with physical access to the server. We cover how TEEs work, and the 2025 attacks that showed that limit, in what is a trusted execution environment.

How Morse keeps your AI chats encrypted today

A model has to read your prompt to answer it. Homomorphic encryption would remove that need, but at 18 seconds a token on a small model it can't serve a chat today. Morse's E2EE mode uses secure enclaves with attestation your browser checks, not homomorphic encryption. Your browser verifies the enclave's hardware proof before anything leaves your device, compares what's running against versions pinned in the app, and seals the message so only that enclave can read it. Morse's servers relay ciphertext they can't read, and the reply is decrypted only in your browser. The guarantee rests on the enclave hardware and attestation working as designed. The enclaves are run by third-party providers, not by Morse.

• E2EE, for prompts no host should read. Open-weight models like GLM, Kimi, and DeepSeek answer inside an enclave your browser has verified. Every reply has a lock you can open to see each check that passed. E2EE chats come with Pro, $19 a month.
• Private, for prompts a host may read but mustn't keep. Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing.
• Anonymous, for GPT, Claude, and Gemini. Morse's proxy strips your account, email, and IP address, so the provider sees the message without knowing it's you.

In every mode, Morse doesn't train AI on your chats, sell your data, or show ads. Your chat history is stored in your browser, encrypted, never on Morse's servers. How end-to-end encrypted AI chat works walks through each check, and how to use AI privately matches the modes to who you're hiding from.

You can start free today, then move to Pro when a chat needs the enclave.