An Ultra-Highly Parallel Polynomial Multiplier for the Bootstrapping Algorithm in a Fully Homomorphic Encryption Scheme

The inefficiency of bootstrapping is the primary bottleneck preventing fully homomorphic encryption (FHE) from practical applications. One of the main obstacles to improving the bootstrapping performance using hardware acceleration is the large storage overhead of the bootstrapping keys. To the best of our knowledge, a recent TFHE‐like FHE scheme proposed by Xiang and colleagues in 2023 has the smallest bootstrapping key size, which is about 70 MB for 128‐bit security parameter (including 60 MB for the key‐switching keys and about 10 MB for the blind rotation keys). In this paper, we further improved the bootstrapping algorithm of Xiang et al. with a 30x reduction in key size and a 1.2x speedup. In particular, our new algorithm only requires less than 3 MB bootstrapping keys and can be completed in merely 3 ms at 128‐bit security. Technically, we rearranged the main process of the TFHE‐like bootstrapping algorithm which allows us to greatly reduce the size of the key‐switching keys from previous to bits, where n is the dimension of the lattice. We also improved the computation of the automorphisms by using a single generator, which allows us to reduce the blind rotation key size from previous to bits, where q is the modulus of the ciphertext. Finally, we apply our new FHE scheme to discretized neural networks (DiNNs). Experimental results show that compared to a previous FHE‐friendly DiNN approach by Bourse and colleagues in 2018 at the same security and accuracy, our approach achieves a 36x reduction in memory and a 8x speedup in time.

With the wide adoption of cloud computing paradigm, it is important to develop appropriate techniques to protect client data privacy in the cloud. Encryption is one of the major techniques that could be used to achieve this goal. However, data encryption at the rest alone is insufficient for secure cloud computation environments. There is also the need for efficient techniques to carry out computation over encrypted data. Fully homomorphic encryption (FHE) and garbled circuits are naturally used to process encrypted data without leaking any information about the data. However, existing FHE schemes are inefficient for processing large amount of data in cloud and garbled circuits are one time programs and cannot be reused. Based on quaternion/octonion algebra and Jordan algebra over finite rings \(\mathbb {Z}_q\), this paper designs efficient fully homomorphic symmetric key encryption (FHE) schemes without bootstrapping (that is, noise-free FHE schemes) that are secure in the weak ciphertext-only security model assuming the hardness of solving multivariate quadratic equation systems and solving univariate high degree polynomial equation systems in \(\mathbb {Z}_q\). The FHE scheme designed in this paper is sufficient for privacy preserving computation in cloud.

In this paper we report on our work to design, implement and evaluate a Fully Homomorphic Encryption (FHE) scheme. Our FHE scheme is an NTRU-like cryptosystem, with additional support for efficient key switching and modulus reduction operations to reduce the frequency of bootstrapping operations. Ciphertexts in our scheme are represented as matrices of 64-bit integers. The basis of our design is a layered software services stack to provide high-level FHE operations supported by lower-level lattice-based primitive implementations running on a computing substrate. We implement and evaluate our FHE scheme to run on a commodity CPU-based computing environment. We implemented our FHE scheme to run in a compiled C environment and use parallelism to take advantage of multi-core processors. We provide experimental results which show that our FHE implementation provides at least an order of magnitude improvement in runtime as compared to recent publicly known evaluation results of other FHE software implementations.

Fully Homomorphic Encryption (FHE) allows a client to share their data with an external server without ever exposing their data. FHE serves as a potential solution for data breaches and the marketing of users’ private data. Unfortunately, FHE is much slower than conventional asymmetric cryptography, where data are encrypted only between endpoints. Within this work, we propose the Dynamic AcceleRaTor for Parallel Homomorphic pROGrams, DARTPHROG, as a potential tool for accelerating FHE. DARTPHROG is a superscalar architecture, allowing multiple homomorphic operations to be executed in parallel. Furthermore, DARTPHROG is the first to utilize the new Hardware Optimized Modular-Reduction (HOM-R) system, showcasing the uniquely efficient method compared to Barrett and Montgomery reduction. Coming in at 40.5 W, DARTPHROG is one of the smaller architectures for FHE acceleration. Our architecture offers speedups of up to 1860 times for primitive FHE operations such as ciphertext/plaintext and ciphertext/ciphertext addition, subtraction, and multiplication when operations are performed in parallel using the superscalar feature in DARTPHROG. The DARTPHROG system implements an assembler, a unique instruction set based on THUMB, and a homomorphic processor implemented on a Field Programmable Gate Array (FPGA). DARTPHROG is also the first superscalar evaluation of homomorphic operations when the Number Theoretic Transform (NTT) is excluded from the design. Our processor can therefore be used as a base case for evaluation when weighing the resource and execution impact of NTT implementations.

The Number Theoretic Transform (NTT) plays a central role for supporting high-performance polynomial multiplication on Post-Quantum Cryptography (PQC) and Fully-Homomorphic Encryption (FHE). This paper proposes a novel Montgomery-based butterfly to efficiently implement NTTs on FPGAs. This proposal is supported on prime moduli suitable for FHE, which minimizes the requirements to allow the speedup of the computation of the butterfly. A search algorithm is presented to select these moduli, while flexibility is a target in all parameters making the proposed architectures well-suited for FHE and PQC schemes. We experimentally evaluate the effectiveness of the novel butterfly-core on a Xilinx Virtex-7 device. The results show reductions up to 19%, 41%, 37%, and 67% in the number of lookup tables, slices, flip-flops, and Digital Signal Processors (DSPs), respectively, in comparison to the related state of the art. By integrating the proposed butterflies in a complete NTT accelerator, a speedup of up to 1.42 is achieved, while less than half of the number of DSPs are required, when compared to the other proposals. Moreover, the integration of the proposed accelerators to design FHE-based processors is discussed.

Multi‐key fully homomorphic encryption (MKFHE) allows computations on ciphertexts encrypted by different users, which can be applied to implement secure multi‐party computing (MPC). The current NTRU‐based MKFHE has the following two drawbacks: One is that the relinearisation process during homomorphic evaluation is so complicated that the corresponding computation time is costly. The other is that a class of subfield attacks are proposed and affects the security of NTRU schemes over power‐of‐2 cyclotomic rings for large moduli q, especially for the NTRU‐based fully homomorphic encryption (FHE) schemes. In this work, an efficient MKFHE scheme is proposed over prime cyclotomic rings with fewer relinearisations, which seems a good choice because of its potential to resist a subfield attack. More specifically, the time of the relinearisation process is reduced by half in homomorphic evaluations by separating the homomorphic multiplication and the relinearisation process (implementing two homomorphic multiplication operations together before relinearisation), while in current NTRU‐type MKFHE schemes, these two processes are usually performed together. The error bound of the basic function components is re‐analysed over prime cyclotomic rings in the average case, which can be used in the error analysis of our scheme. We construct an efficient NTRU‐based single‐key FHE scheme and an efficient MKFHE scheme over prime cyclotomic rings through relinearisation and modulus‐switching techniques. The MKFHE scheme proposed has the on‐the‐fly property and has a tight ciphertext size compared with the GSW‐type and BGV‐type MKFHE schemes. An experiment shows that the homomorphic evaluation of the optimised single‐key FHE scheme proposed is 1.9 times faster than an efficient NTRU‐type MKFHE DHS16 proposed at DCC 2016.

Fully homomorphic encryption (FHE) allows one to perform arbitrary computation on encrypted data. From the cloud computing perspective, a FHE scheme can be used to outsource a computation to a remote cloud server without revealing the computed data to the server. This is a very attractive cryptographic primitive. Existing methods used to construct FHE schemes are complicated, and often these methods are difficult to understand except by experts in the field. This paper aims to explain how to construct a FHE scheme in an easily understandable way. We first present a general overview of FHE scheme construction. We then take the van Dijk et al FHE scheme as an example and explain how a FHE scheme is obtained from a simple integer-based encryption scheme. Our explanation gives details of the noise bound, how noise growth can be controlled and how the vanDijk scheme is implemented.

Optimizing performance of Fully Homomorphic Encryption (FHE) is nowadays an active trend of research in cryptography. One way of improvement is to use a hybrid construction with a classical symmetric encryption scheme to transfer encrypted data to the Cloud. This allows to reduce the bandwidth since the expansion factor of symmetric schemes (the ratio between the ciphertext and the plaintext length) is close to one, whereas for FHE schemes it is in the order of 1,000 to 1,000,000. However, such a construction requires the decryption circuit of the symmetric scheme to be easy to evaluate homomorphically. Several works have studied the cost of homomorphically evaluating classical block ciphers, and some recent works have suggested new homomorphic oriented constructions of block ciphers or stream ciphers. Since the multiplication gate of FHE schemes usually squares the noise of the ciphertext, we cannot afford too many multiplication stages in the decryption circuit. Consequently, FHE-friendly symmetric encryption schemes have a decryption circuit with small multiplication depth.

Fully homomorphic encryption (FHE) is a "holy grail" of cryptography. However, it is not yet adopted in practice because no known scheme is efficient. In this paper, we mainly focus on how to reduce the public key sizes in FHE. Based on Dijk et al.'s FHE scheme (DGHV) and Gentry's fully homomorhpic technology, we propose two schemes with shorter public keys by encrypting with a combination of the public key elements to replace a linear form in DGHV scheme and a quadratic form in Coron et al.'s scheme. Compared with DGHV scheme and Coron et al.'s scheme, our schemes can greatly reduce the public key sizes, which make our schemes more efficient. Furthermore, we prove the security of our schemes based on difficulties of the approximate greatest common divisor (AGCD) problem and the sparse subset sum problem.

Fully Homomorphic Encryption (FHE) is a cryptosystem supporting arbitrary computations over encrypted data. Gentry is one of the foregoers to put forward the concept of full homomorphism who developed the first version of efficient FHE schemes. FHE provides important ideas and directions for the study of privacy-preserving. In my paper, we present a multi-key FHE scheme in virtue of NTRU (Number Theory Research Unit) to implement a neural network, which is capable of preventing the training data from revealing. Compared with the traditional schemes, the neural network of our system works over ciphertexts with semantic security. Meanwhile, the cryptosystem scheme is in the form of multi-keys, thus the data owned by different providers, model trainers, or servers can be independently encrypted but jointly computed. Thereafter, in contrast to federated learning, our scheme does not require any local training. To testify our method, we finally selected a set of commonly used parameters and designed a neural network based on NTRU encryption. And used the physical machine to make encryption predictions for encoding the MNIST dataset, the prediction accuracy of our privacy model is 80%.

Fully Homomorphic Encryption (FHE) allows computations on encrypted data without decryption, providing strong security for sensitive information. However, computational and memory demands for FHE are significant challenges, particularly in the Number Theoretic Transform (NTT) phase. This paper presents three efficient Twiddle Factor Generators (TFGs) to address these challenges: the Half-Memory TFG, the On-the-fly Serial TFG, and the On-the-fly Parallel TFG. The Half-Memory TFG reduces memory usage by storing only half of the twiddle factors and calculating the rest as needed. The On-the-fly Serial TFG eliminates memory requirements by computing twiddle factors, while the On-the-fly Parallel TFG enhances computational speed through parallel processing. Implemented on the FPGA KCU105 board, these TFGs demonstrated significant improvements in hardware resource utilization and computational efficiency. The Half-Memory TFG effectively reduces memory footprint, the On-the-fly Serial TFG eliminates memory usage with acceptable computational overhead, and the On-the-fly Parallel TFG offers superior performance for high-throughput applications. These innovations make FHE more practical for real-world applications, contributing to the broader goal of enabling secure, privacy-preserving computations on encrypted data.

본고에서는 키 전환(key switching) 과정이 필요 없는 Ring-LWE(Learning With Errors) 기반 완전 준동형 암호화(FHE : Fully Homomorphic Encryption) 스킴을 제안한다. 기존의 LWE 기반 FHE 스킴은 벡터 공간의 원소인 암호문의 차원을 줄이기 위하여 키 전환(key switching) 과정을 필요로 하였다. 이 key switching 과정은 새로운 개인키/공개키 쌍과 부가적인 연산 과정을 필요로 하여 FHE 스킴 구현에 있어서 구현 효율성 저하의 큰 요인이 된다. 우리는 환(ring) 상의 이차방정식을 푸는 문제의 어려움이라는 새로운 안전성 가정을 이용하여 암호문의 차원을 줄임으로써 키 전환 과정이 필요 없는 FHE 스킴을 제안한다. 이 방법은 기존의 키 전환 과정에 비해 필요로 하는 새로운 공개키 크기가 매우 작고 부가 연산이 거의 없다는 측면에서 FHE 구현 효율성을 제고할 수 있다. We present a fully homomorphic encryption (FHE) scheme without key switching based on ring- learning with errors (RLWE) problems and some other assumption. Previous FHE schemes based on LWE needed a step called key switching to reduce the dimension of ciphertext. The key switching step actually needs a heavy computation and severe increasement of keys. So the key switching step is a big burden for implementing FHE Schemes. We suggest a FHE scheme without key switching step by reducing the dimension of ciphertexts in other way. Instead of throwing away key switching, we need another hardness assumption of the difficulty of solving quadratic equation over rings.

We present new constructions of multi-party homomorphic secret sharing (HSS) based on a new primitive that we call homomorphic encryption with decryption to shares (HEDS). Our first construction, which we call \(\mathsf {Scooby} \), is based on many popular fully homomorphic encryption (FHE) schemes with a linear decryption property. \(\mathsf {Scooby} \) achieves an n-party HSS for general circuits with complexity \(O(|F| + \log n)\), as opposed to \(O(n^2 \cdot |F|)\) for the prior best construction based on multi-key FHE. \(\mathsf {Scooby} \) can be based on (ring)-LWE with a super-polynomial modulus-to-noise ratio. In our second construction, \(\mathsf {Scrappy} \), assuming any generic FHE plus HSS for NC1-circuits, we obtain a HEDS scheme which does not require a super-polynomial modulus. While these schemes all require FHE, in another instantiation, \(\mathsf {Shaggy} \), we show how in some cases it is possible to obtain multi-party HSS without FHE, for a small number of parties and constant-degree polynomials. Finally, we show that our \(\mathsf {Scooby} \) scheme can be adapted to use multi-key fully homomorphic encryption, giving more efficient spooky encryption and setup-free HSS. This latter scheme, \(\mathsf {Casper} \), if concretely instantiated with a B/FV-style multi-key FHE scheme, for functions F which do not require bootstrapping, gives an HSS complexity of \(O(n \cdot |F| + n^2 \cdot \log n)\).

Fully homomorphic encryption (FHE) enables privacy-preserving machine learning (PPML) at the cost of intensive computational overhead, which necessitates the use of domain-specific accelerators. To achieve comprehensive support for leveled FHE, this article presents a reconfigurable multi-scheme FHE processor that supports both client-side encryption/decryption and server-side evaluation. First, a reconfigurable processing element (RPE) design for modular arithmetic and a reusable data generator for polynomial sampling are developed to support the various operations in FHE. Second, a configurable RPE array supporting polynomial operations and a decoupled automorphism unit (DAU) necessary for homomorphic rotations are proposed to accelerate the FHE primitives with complex dataflow. Finally, an on-chip data generation strategy and a cache-aware operation scheduling (CAOS) method are introduced to alleviate the memory bottleneck in the end-to-end execution of FHE applications. The chip is fabricated in a 28-nm process and tested with end-to-end execution. Targeting a lightweight parameter set with polynomial degree<inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$N=4096$</tex-math> </inline-formula> at 128-bit security level, the proposed chip achieves <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$4.05~\mu $</tex-math> </inline-formula>J per encryption on the client side and provides a throughput of 8.72 kHMul/s on the server side. In terms of the number theory transform (NTT) operation, the chip demonstrates the highest throughput and best area efficiency compared with state-of-the-art solutions.

Accelerating the development of a practical Fully Homomorphic Encryption (FHE) scheme is the goal of the DARPA PROCEED program. For the past year, this program has had as its focus the acceleration of various aspects of the FHE concept toward practical implementation and use. FHE would be a game-changing technology to enable secure, general computation on encrypted data, e.g., on untrusted off-site hardware. However, FHE will still require several orders of magnitude improvement in computation before it will be practical for widespread use. Recent theoretical breakthroughs demonstrated the existence of FHE schemes [1, 2], and to date much progress has been made in both algorithmic and implementation improvements. Specifically our contribution to the Proceed program has been the development of FPGA based hardware primitives to accelerate the computation on encrypted data using FHE based on lattice techniques [3]. Our project, SIPHER, has been using a state of the art tool-chain developed by Mathworks to implement VHDL code for FPGA circuits directly from Simulink models. Our baseline Homomorphic Encryption prototypes are developed directly in Matlab using the fixed point toolbox to perform the required integer arithmetic. Constant improvements in algorithms require us to be able to quickly implement them in a high level language such as Matlab. We reported on our initial results at HPEC 2011 [4]. In the past year, increases in algorithm complexity have introduced several new design requirements for our FPGA implementation. This report presents new Simulink primitives that had to be developed to deal with these new requirements.