As described above, by selecting a public and private key pair that satisfies a certain condition, data m can be encrypted into corresponding homomorphic ciphertext c according to the implementation described in FIG. 1, and homomorphic ciphertext c can be decrypted into corresponding data m according to the implementation described in FIG. 2. The following describes, with reference to an implementation by using an example, how to select a public and private key pair that satisfies the previous condition.

First, number N is determined. A value of N can be a product of two large prime numbers P and Q, so that it is difficult to obtain values of P and Q. A length P and Q can be 1024 bits. In this case, a length of N=P·Q is 2048 bits, namely, the previous parameter n=2048. Certainly, another length can be used in another implementation. Implementations are not limited in the present specification. When the length of N is large enough, there is a very low probability that the values of P and Q are obtained. Therefore, when a public and private key pair is generated based on the values of P and Q, it can be ensured that it is difficult to obtain values of public and private keys, which features high security. Length n of N can be first determined, then prime numbers P and Q with a length of (n/2) are selected, and it is ensured that P=Q=3 mod 4 and gcd(P?1, Q?1)=2 (in other words, the greatest common divisor of P?1 and Q?1 is 2) are satisfied. In this case, N=P·Q is calculated.