Dasta – Alternative Linear Layer for Rasta

Motivated by new applications such as secure Multi-Party Computation (MPC), Fully Homomorphic Encryption (FHE), and Zero-Knowledge proofs (ZK), many MPC-, FHE- and ZK-friendly symmetric-key primitives that minimize the< number of multiplications over Fp for a large prime p have been recently proposed in the literature. These symmetric primitives are usually defined via invertible functions, including (i) Feistel and Lai-Massey schemes and (ii) SPN constructions instantiated with invertible non-linear S-Boxes. However, the “invertibility” property is actually never required in any of the mentioned applications.In this paper, we discuss the possibility to set up MPC-/FHE-/ZK-friendly symmetric primitives instantiated with non-invertible bounded surjective functions. In contrast to one-to-one functions, each output of a l-bounded surjective function admits at most l pre-images. The simplest example is the square map x → x2 over Fp for a prime p ≥ 3, which is (obviously) 2-bounded surjective. When working over Fnp for n ≥ 2, we set up bounded surjective functions by re-considering the recent results proposed by Grassi, Onofri, Pedicini and Sozzi at FSE/ToSC 2022 as starting points. Given a quadratic local map F : Fmp → Fp for m ∈ {1, 2, 3}, they proved that the shift-invariant non-linear function over Fnp defined as SF (x0, x1, . . . , xn−1) = y0∥y1∥ . . . ∥yn−1 where yi := F(xi, xi+1) is never invertible for any n ≥ 2 · m − 1. Here, we prove that • the quadratic function F : Fmp → Fp for m ∈ {1, 2} that minimizes the probability of having a collision for SF over Fnp is of the form F(x0, x1) = x20 + x1 (or equivalent);• the function SF over Fnp defined as before via F(x0, x1) = x20 +x1 (or equivalent) is 2n-bounded surjective.As concrete applications, we propose modified versions of the MPC-friendly schemes MiMC, HadesMiMC, and (partially of) Hydra, and of the FHE-friendly schemes Masta, Pasta, and Rubato. By instantiating them with the bounded surjective quadratic functions proposed in this paper, we are able to improve the security and/or the performances in the target applications/protocols.

With the wide adoption of cloud computing paradigm, it is important to develop appropriate techniques to protect client data privacy in the cloud. Encryption is one of the major techniques that could be used to achieve this goal. However, data encryption at the rest alone is insufficient for secure cloud computation environments. There is also the need for efficient techniques to carry out computation over encrypted data. Fully homomorphic encryption (FHE) and garbled circuits are naturally used to process encrypted data without leaking any information about the data. However, existing FHE schemes are inefficient for processing large amount of data in cloud and garbled circuits are one time programs and cannot be reused. Based on quaternion/octonion algebra and Jordan algebra over finite rings \(\mathbb {Z}_q\), this paper designs efficient fully homomorphic symmetric key encryption (FHE) schemes without bootstrapping (that is, noise-free FHE schemes) that are secure in the weak ciphertext-only security model assuming the hardness of solving multivariate quadratic equation systems and solving univariate high degree polynomial equation systems in \(\mathbb {Z}_q\). The FHE scheme designed in this paper is sufficient for privacy preserving computation in cloud.

Multi‐key fully homomorphic encryption (MKFHE) allows computations on ciphertexts encrypted by different users, which can be applied to implement secure multi‐party computing (MPC). The current NTRU‐based MKFHE has the following two drawbacks: One is that the relinearisation process during homomorphic evaluation is so complicated that the corresponding computation time is costly. The other is that a class of subfield attacks are proposed and affects the security of NTRU schemes over power‐of‐2 cyclotomic rings for large moduli q, especially for the NTRU‐based fully homomorphic encryption (FHE) schemes. In this work, an efficient MKFHE scheme is proposed over prime cyclotomic rings with fewer relinearisations, which seems a good choice because of its potential to resist a subfield attack. More specifically, the time of the relinearisation process is reduced by half in homomorphic evaluations by separating the homomorphic multiplication and the relinearisation process (implementing two homomorphic multiplication operations together before relinearisation), while in current NTRU‐type MKFHE schemes, these two processes are usually performed together. The error bound of the basic function components is re‐analysed over prime cyclotomic rings in the average case, which can be used in the error analysis of our scheme. We construct an efficient NTRU‐based single‐key FHE scheme and an efficient MKFHE scheme over prime cyclotomic rings through relinearisation and modulus‐switching techniques. The MKFHE scheme proposed has the on‐the‐fly property and has a tight ciphertext size compared with the GSW‐type and BGV‐type MKFHE schemes. An experiment shows that the homomorphic evaluation of the optimised single‐key FHE scheme proposed is 1.9 times faster than an efficient NTRU‐type MKFHE DHS16 proposed at DCC 2016.

We devise multi-party computation protocols for general secure function evaluation with the property that each party is only required to communicate with a small number of dynamically chosen parties. More explicitly, starting with n parties connected via a complete and synchronous network, our protocol requires each party to send messages to (and process messages from) at most polylog(n) other parties using polylog(n) rounds. It achieves secure computation of any polynomial-time computable randomized function f under cryptographic assumptions, and tolerates up to $({1\over 3} - \epsilon) \cdot n$ statically scheduled Byzantine faults. We then focus on the particularly interesting setting in which the function to be computed is a sublinear algorithm: An evaluation of f depends on the inputs of at most q=o(n) of the parties, where the identity of these parties can be chosen randomly and possibly adaptively. Typically, q=polylog(n). While the sublinear query complexity of f makes it possible in principle to dramatically reduce the communication complexity of our general protocol, the challenge is to achieve this while maintaining security: in particular, while keeping the identities of the selected inputs completely hidden. We solve this challenge, and we provide a protocol for securely computing such sublinear f that runs in polylog(n)+O(q) rounds, has each party communicating with at most q ·polylog(n) other parties, and supports message sizespolylog(n) ·(l+n), where l is the parties' input size. Our optimized protocols rely on a multi-signature scheme, fully homomorphic encryption (FHE), and simulation-sound adaptive NIZK arguments. However, we remark that multi-signatures and FHE are used to obtain our bounds on message size and round complexity. Assuming only standard digital signatures and public-key encryption, one can still obtain the property that each party only communicates with polylog(n) other parties. We emphasize that the scheduling of faults can depend on the initial PKI setup of digital signatures and the NIZK parameters.

Fully homomorphic encryption (FHE) allows computing on encrypted data, enabling secure offloading of computation to untrusted servers. Though it provides ideal security, FHE is prohibitively expensive when executed in software. These overheads are a major barrier to FHE's widespread adoption. We present F1, the first FHE accelerator that is capable of executing full FHE programs. F1 builds on an in-depth architectural analysis of the characteristics of FHE computations that reveals acceleration opportunities. F1 is a wide-vector processor with novel functional units deeply specialized to FHE primitives, such as modular arithmetic, number-theoretic transforms, and structured permutations. This organization provides so much compute throughput that data movement becomes the bottleneck. Thus, F1 is primarily designed to minimize data movement. F1 is the first system to accelerate complete FHE programs, and outperforms state-of-the-art software implementations by gmean 5,400x. These speedups counter FHE's overheads and enable new applications, like real-time private deep learning in the cloud.

To tackle emerging security and privacy concerns in consortium blockchain applications, particularly in handling sensitive identity information and transaction data, a novel privacy-preserving framework is proposed. The scheme leverages advanced technologies such as post-quantum cryptography, multi-party computation (MPC), and fully homomorphic encryption (FHE) to enhance security and efficiency. Firstly, a quantum-resistant blind signature mechanism is designed using lattice-based cryptography to mitigate centralization issues and strengthen security against quantum attacks. Secondly, a regulatory-compliant hierarchical encryption model is developed using fully homomorphic encryption, enabling fine-grained access control and data integrity verification without decrypting sensitive data. Additionally, zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARKs) are integrated to ensure privacy while allowing verifiable computation. Experimental evaluations demonstrate that the proposed scheme achieves high encryption efficiency, reduced computational overhead during encryption/decryption, and strong resistance to malicious activities such as tampering, eavesdropping, and replay attacks

We present new constructions of multi-party homomorphic secret sharing (HSS) based on a new primitive that we call homomorphic encryption with decryption to shares (HEDS). Our first construction, which we call \(\mathsf {Scooby} \), is based on many popular fully homomorphic encryption (FHE) schemes with a linear decryption property. \(\mathsf {Scooby} \) achieves an n-party HSS for general circuits with complexity \(O(|F| + \log n)\), as opposed to \(O(n^2 \cdot |F|)\) for the prior best construction based on multi-key FHE. \(\mathsf {Scooby} \) can be based on (ring)-LWE with a super-polynomial modulus-to-noise ratio. In our second construction, \(\mathsf {Scrappy} \), assuming any generic FHE plus HSS for NC1-circuits, we obtain a HEDS scheme which does not require a super-polynomial modulus. While these schemes all require FHE, in another instantiation, \(\mathsf {Shaggy} \), we show how in some cases it is possible to obtain multi-party HSS without FHE, for a small number of parties and constant-degree polynomials. Finally, we show that our \(\mathsf {Scooby} \) scheme can be adapted to use multi-key fully homomorphic encryption, giving more efficient spooky encryption and setup-free HSS. This latter scheme, \(\mathsf {Casper} \), if concretely instantiated with a B/FV-style multi-key FHE scheme, for functions F which do not require bootstrapping, gives an HSS complexity of \(O(n \cdot |F| + n^2 \cdot \log n)\).

Fully Homomorphic Encryption (FHE) allows computations on encrypted data without decryption, providing strong security for sensitive information. However, computational and memory demands for FHE are significant challenges, particularly in the Number Theoretic Transform (NTT) phase. This paper presents three efficient Twiddle Factor Generators (TFGs) to address these challenges: the Half-Memory TFG, the On-the-fly Serial TFG, and the On-the-fly Parallel TFG. The Half-Memory TFG reduces memory usage by storing only half of the twiddle factors and calculating the rest as needed. The On-the-fly Serial TFG eliminates memory requirements by computing twiddle factors, while the On-the-fly Parallel TFG enhances computational speed through parallel processing. Implemented on the FPGA KCU105 board, these TFGs demonstrated significant improvements in hardware resource utilization and computational efficiency. The Half-Memory TFG effectively reduces memory footprint, the On-the-fly Serial TFG eliminates memory usage with acceptable computational overhead, and the On-the-fly Parallel TFG offers superior performance for high-throughput applications. These innovations make FHE more practical for real-world applications, contributing to the broader goal of enabling secure, privacy-preserving computations on encrypted data.

Fully Homomorphic Encryption (FHE) is pivotal for secure computation on encrypted data, crucial in privacy-preserving data analysis. However, efficiently processing high-dimensional data in FHE, especially for machine learning and statistical (ML/STAT) algorithms, poses a challenge. In this paper, we present an effective acceleration method using the kernel method for FHE schemes, enhancing time performance in ML/STAT algorithms within encrypted domains. This technique, independent of underlying FHE mechanisms and complementing existing optimizations, notably reduces costly FHE multiplications, offering near-constant time complexity relative to data dimension. Aimed at accessibility, this method is tailored for data scientists and developers with limited cryptography background, facilitating advanced data analysis in secure environments.

Fully Homomorphic Encryption (FHE) allows a client to share their data with an external server without ever exposing their data. FHE serves as a potential solution for data breaches and the marketing of users’ private data. Unfortunately, FHE is much slower than conventional asymmetric cryptography, where data are encrypted only between endpoints. Within this work, we propose the Dynamic AcceleRaTor for Parallel Homomorphic pROGrams, DARTPHROG, as a potential tool for accelerating FHE. DARTPHROG is a superscalar architecture, allowing multiple homomorphic operations to be executed in parallel. Furthermore, DARTPHROG is the first to utilize the new Hardware Optimized Modular-Reduction (HOM-R) system, showcasing the uniquely efficient method compared to Barrett and Montgomery reduction. Coming in at 40.5 W, DARTPHROG is one of the smaller architectures for FHE acceleration. Our architecture offers speedups of up to 1860 times for primitive FHE operations such as ciphertext/plaintext and ciphertext/ciphertext addition, subtraction, and multiplication when operations are performed in parallel using the superscalar feature in DARTPHROG. The DARTPHROG system implements an assembler, a unique instruction set based on THUMB, and a homomorphic processor implemented on a Field Programmable Gate Array (FPGA). DARTPHROG is also the first superscalar evaluation of homomorphic operations when the Number Theoretic Transform (NTT) is excluded from the design. Our processor can therefore be used as a base case for evaluation when weighing the resource and execution impact of NTT implementations.

Fully homomorphic encryption (FHE) enables privacy-preserving machine learning (PPML) at the cost of intensive computational overhead, which necessitates the use of domain-specific accelerators. To achieve comprehensive support for leveled FHE, this article presents a reconfigurable multi-scheme FHE processor that supports both client-side encryption/decryption and server-side evaluation. First, a reconfigurable processing element (RPE) design for modular arithmetic and a reusable data generator for polynomial sampling are developed to support the various operations in FHE. Second, a configurable RPE array supporting polynomial operations and a decoupled automorphism unit (DAU) necessary for homomorphic rotations are proposed to accelerate the FHE primitives with complex dataflow. Finally, an on-chip data generation strategy and a cache-aware operation scheduling (CAOS) method are introduced to alleviate the memory bottleneck in the end-to-end execution of FHE applications. The chip is fabricated in a 28-nm process and tested with end-to-end execution. Targeting a lightweight parameter set with polynomial degree<inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$N=4096$</tex-math> </inline-formula> at 128-bit security level, the proposed chip achieves <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$4.05~\mu $</tex-math> </inline-formula>J per encryption on the client side and provides a throughput of 8.72 kHMul/s on the server side. In terms of the number theory transform (NTT) operation, the chip demonstrates the highest throughput and best area efficiency compared with state-of-the-art solutions.

Fully Homomorphic Encryption (FHE) is the holy grail of encrypted communications. It opens the door to several advanced functionalities to overcome the security and trust issues of the IT world. After 2009, once Craig Gentry had shown that FHE could be achieved, a study in this field boomed, and significant improvement was made in identifying more efficient and realistic programs. FHE is primitive cryptography that enables arbitrary functions to be calculated via encrypted data. These systems are applicable in different ways since they permit users to encrypt their private information securely while still outsourcing the processing of protected data without fearing disclosing the real data. In 2012, LTV12 presented the first multi-key FHE system and demonstrated the possibility of using multi-key systems in somewhat homomorphic encryption (SHE). Like in the one key context, there have been many advances in the field, but no effort has been made to develop the multi-key methods. This paper presents a discussion of FHE and MKFHE with a specific focus on the current techniques and three implementations, comprising the first in the multi-key setups, to the extent of our understanding.

Accelerating the development of a practical Fully Homomorphic Encryption (FHE) scheme is the goal of the DARPA PROCEED program. For the past year, this program has had as its focus the acceleration of various aspects of the FHE concept toward practical implementation and use. FHE would be a game-changing technology to enable secure, general computation on encrypted data, e.g., on untrusted off-site hardware. However, FHE will still require several orders of magnitude improvement in computation before it will be practical for widespread use. Recent theoretical breakthroughs demonstrated the existence of FHE schemes [1, 2], and to date much progress has been made in both algorithmic and implementation improvements. Specifically our contribution to the Proceed program has been the development of FPGA based hardware primitives to accelerate the computation on encrypted data using FHE based on lattice techniques [3]. Our project, SIPHER, has been using a state of the art tool-chain developed by Mathworks to implement VHDL code for FPGA circuits directly from Simulink models. Our baseline Homomorphic Encryption prototypes are developed directly in Matlab using the fixed point toolbox to perform the required integer arithmetic. Constant improvements in algorithms require us to be able to quickly implement them in a high level language such as Matlab. We reported on our initial results at HPEC 2011 [4]. In the past year, increases in algorithm complexity have introduced several new design requirements for our FPGA implementation. This report presents new Simulink primitives that had to be developed to deal with these new requirements.

Secure report is the problem of a client that retrieves all records matching specified attributes from a database table at the server (e.g. cloud), as in SQL SELECT queries, but where the query and the database are encrypted. Here, only the client has the secret key, but still the server is expected to compute and return the encrypted result. Secure report is theoretically possible with Fully Homomorphic Encryption (FHE). However, the current state-of-the-art solutions are realized by a polynomial of degree that is at least linear in the number m of records, which is too slow in practice even for very small databases. We present the first solution that is realized by a polynomial that attains degree independent of the number of records m, as well as the first implementation of an FHE solution to Secure report. This is by suggesting a novel paradigm that forges a link between cryptography and modern data summarization techniques known as coresets (core-sets), and sketches in particular. The key idea is to compute only a coreset of the desired report. Since the coreset is small, the client can quickly decode the desired report that the server computes after decrypting the coreset. We implemented our main reporting system in an open source library. This is the first implemented system that can answer such database queries when processing only FHE encrypted data and queries. As our analysis promises, the experimental results show that we can run Secure report queries on billions records in minutes on an Amazon EC2 server, compared to less than a hundred-thousands in previous FHE based solutions.

With the widespread adoption of Electronic Health Records (EHRs), ensuring data privacy while enabling efficient sharing and processing has emerged as a critical challenge in healthcare information systems. Existing approaches often struggle to balance stringent security requirements with practical performance needs. To address these challenges, this paper proposes a blockchain-based privacy protection scheme for EHRs that integrates Designated Verifier Aggregate Signatures (DVAS) and Fully Homomorphic Encryption (FHE). In the proposed scheme, healthcare institutions manage EHRs through smart contracts, while FHE is employed to encrypt and protect sensitive medical data used in research. By selectively applying FHE to critical data and minimizing encryption overhead for non-sensitive information, our design significantly enhances computational efficiency and storage performance. Furthermore, the DVAS algorithm minimizes redundant data transmission, ensures data integrity, and restricts signature verification to authorized parties only. Experimental evaluations based on computational time, storage cost, and security analysis demonstrate that the proposed scheme achieves robust security while meeting performance requirements, effectively balancing confidentiality and efficiency in healthcare information systems.