Improved Fully Homomorphic Encryption over the Integers with Shorter Public Keys

With the wide adoption of cloud computing paradigm, it is important to develop appropriate techniques to protect client data privacy in the cloud. Encryption is one of the major techniques that could be used to achieve this goal. However, data encryption at the rest alone is insufficient for secure cloud computation environments. There is also the need for efficient techniques to carry out computation over encrypted data. Fully homomorphic encryption (FHE) and garbled circuits are naturally used to process encrypted data without leaking any information about the data. However, existing FHE schemes are inefficient for processing large amount of data in cloud and garbled circuits are one time programs and cannot be reused. Based on quaternion/octonion algebra and Jordan algebra over finite rings \(\mathbb {Z}_q\), this paper designs efficient fully homomorphic symmetric key encryption (FHE) schemes without bootstrapping (that is, noise-free FHE schemes) that are secure in the weak ciphertext-only security model assuming the hardness of solving multivariate quadratic equation systems and solving univariate high degree polynomial equation systems in \(\mathbb {Z}_q\). The FHE scheme designed in this paper is sufficient for privacy preserving computation in cloud.

In this paper we report on our work to design, implement and evaluate a Fully Homomorphic Encryption (FHE) scheme. Our FHE scheme is an NTRU-like cryptosystem, with additional support for efficient key switching and modulus reduction operations to reduce the frequency of bootstrapping operations. Ciphertexts in our scheme are represented as matrices of 64-bit integers. The basis of our design is a layered software services stack to provide high-level FHE operations supported by lower-level lattice-based primitive implementations running on a computing substrate. We implement and evaluate our FHE scheme to run on a commodity CPU-based computing environment. We implemented our FHE scheme to run in a compiled C environment and use parallelism to take advantage of multi-core processors. We provide experimental results which show that our FHE implementation provides at least an order of magnitude improvement in runtime as compared to recent publicly known evaluation results of other FHE software implementations.

Fully homomorphic encryption (FHE) allows one to perform arbitrary computation on encrypted data. From the cloud computing perspective, a FHE scheme can be used to outsource a computation to a remote cloud server without revealing the computed data to the server. This is a very attractive cryptographic primitive. Existing methods used to construct FHE schemes are complicated, and often these methods are difficult to understand except by experts in the field. This paper aims to explain how to construct a FHE scheme in an easily understandable way. We first present a general overview of FHE scheme construction. We then take the van Dijk et al FHE scheme as an example and explain how a FHE scheme is obtained from a simple integer-based encryption scheme. Our explanation gives details of the noise bound, how noise growth can be controlled and how the vanDijk scheme is implemented.

Multi‐key fully homomorphic encryption (MKFHE) allows computations on ciphertexts encrypted by different users, which can be applied to implement secure multi‐party computing (MPC). The current NTRU‐based MKFHE has the following two drawbacks: One is that the relinearisation process during homomorphic evaluation is so complicated that the corresponding computation time is costly. The other is that a class of subfield attacks are proposed and affects the security of NTRU schemes over power‐of‐2 cyclotomic rings for large moduli q, especially for the NTRU‐based fully homomorphic encryption (FHE) schemes. In this work, an efficient MKFHE scheme is proposed over prime cyclotomic rings with fewer relinearisations, which seems a good choice because of its potential to resist a subfield attack. More specifically, the time of the relinearisation process is reduced by half in homomorphic evaluations by separating the homomorphic multiplication and the relinearisation process (implementing two homomorphic multiplication operations together before relinearisation), while in current NTRU‐type MKFHE schemes, these two processes are usually performed together. The error bound of the basic function components is re‐analysed over prime cyclotomic rings in the average case, which can be used in the error analysis of our scheme. We construct an efficient NTRU‐based single‐key FHE scheme and an efficient MKFHE scheme over prime cyclotomic rings through relinearisation and modulus‐switching techniques. The MKFHE scheme proposed has the on‐the‐fly property and has a tight ciphertext size compared with the GSW‐type and BGV‐type MKFHE schemes. An experiment shows that the homomorphic evaluation of the optimised single‐key FHE scheme proposed is 1.9 times faster than an efficient NTRU‐type MKFHE DHS16 proposed at DCC 2016.

Fully homomorphic encryption (FHE) is a post-quantum secure cryptographic technology that enables privacy-preserving computing on an untrusted platform without divulging any secret or sensitive information. The core of FHE is the bootstrapping algorithm, which is the intermediate refreshing procedure of a processed ciphertext. However, this step has been the computational bottleneck that prevents real-world deployments among various FHE schemes. This paper, to the best of our knowledge, for the first time, presents a scalable and ultra-highly parallel design for the number theoretic transform (NTT)-based polynomial multiplier with a variable number of reconfigurable processing elements (PEs). Hence, the highest degree of acceleration can be achieved for any targeted hardware platform by implementing as many PEs as possible under the resource constraint. The corresponding addressing and scheduling schemes are also proposed to avoid memory access conflict for the PEs, which yields an extremely high utilization ratio of 99.18% on average. In addition, the latency of the proposed design with the general negative wrapped convolution algorithm is reduced by 59.20% compared to prior works.

Optimizing performance of Fully Homomorphic Encryption (FHE) is nowadays an active trend of research in cryptography. One way of improvement is to use a hybrid construction with a classical symmetric encryption scheme to transfer encrypted data to the Cloud. This allows to reduce the bandwidth since the expansion factor of symmetric schemes (the ratio between the ciphertext and the plaintext length) is close to one, whereas for FHE schemes it is in the order of 1,000 to 1,000,000. However, such a construction requires the decryption circuit of the symmetric scheme to be easy to evaluate homomorphically. Several works have studied the cost of homomorphically evaluating classical block ciphers, and some recent works have suggested new homomorphic oriented constructions of block ciphers or stream ciphers. Since the multiplication gate of FHE schemes usually squares the noise of the ciphertext, we cannot afford too many multiplication stages in the decryption circuit. Consequently, FHE-friendly symmetric encryption schemes have a decryption circuit with small multiplication depth.

Fully Homomorphic Encryption (FHE) is a cryptosystem supporting arbitrary computations over encrypted data. Gentry is one of the foregoers to put forward the concept of full homomorphism who developed the first version of efficient FHE schemes. FHE provides important ideas and directions for the study of privacy-preserving. In my paper, we present a multi-key FHE scheme in virtue of NTRU (Number Theory Research Unit) to implement a neural network, which is capable of preventing the training data from revealing. Compared with the traditional schemes, the neural network of our system works over ciphertexts with semantic security. Meanwhile, the cryptosystem scheme is in the form of multi-keys, thus the data owned by different providers, model trainers, or servers can be independently encrypted but jointly computed. Thereafter, in contrast to federated learning, our scheme does not require any local training. To testify our method, we finally selected a set of commonly used parameters and designed a neural network based on NTRU encryption. And used the physical machine to make encryption predictions for encoding the MNIST dataset, the prediction accuracy of our privacy model is 80%.

The inefficiency of bootstrapping is the primary bottleneck preventing fully homomorphic encryption (FHE) from practical applications. One of the main obstacles to improving the bootstrapping performance using hardware acceleration is the large storage overhead of the bootstrapping keys. To the best of our knowledge, a recent TFHE‐like FHE scheme proposed by Xiang and colleagues in 2023 has the smallest bootstrapping key size, which is about 70 MB for 128‐bit security parameter (including 60 MB for the key‐switching keys and about 10 MB for the blind rotation keys). In this paper, we further improved the bootstrapping algorithm of Xiang et al. with a 30x reduction in key size and a 1.2x speedup. In particular, our new algorithm only requires less than 3 MB bootstrapping keys and can be completed in merely 3 ms at 128‐bit security. Technically, we rearranged the main process of the TFHE‐like bootstrapping algorithm which allows us to greatly reduce the size of the key‐switching keys from previous to bits, where n is the dimension of the lattice. We also improved the computation of the automorphisms by using a single generator, which allows us to reduce the blind rotation key size from previous to bits, where q is the modulus of the ciphertext. Finally, we apply our new FHE scheme to discretized neural networks (DiNNs). Experimental results show that compared to a previous FHE‐friendly DiNN approach by Bourse and colleagues in 2018 at the same security and accuracy, our approach achieves a 36x reduction in memory and a 8x speedup in time.

The security of several fully homomorphic encryption (FHE) schemes depends on the intractability assumption of the approximate common divisor (ACD) problem over integers. Subsequent efforts to solve the ACD problem as well as its variants were also developed during the past decade. In this paper, an improved orthogonal lattice (OL)-based algorithm, AIOL, is proposed to solve the general approximate common divisor (GACD) problem. The conditions for ensuring the feasibility of AIOL are also presented. Compared to the Ding–Tao OL algorithm, the well-known LLL reduction method is used only once in AIOL, and when the error vector r is recovered in AIOL, the possible difference between the restored and the true value of p is given. Experimental comparisons between the Ding-Tao algorithm and ours are also provided to validate our improvements.

본고에서는 키 전환(key switching) 과정이 필요 없는 Ring-LWE(Learning With Errors) 기반 완전 준동형 암호화(FHE : Fully Homomorphic Encryption) 스킴을 제안한다. 기존의 LWE 기반 FHE 스킴은 벡터 공간의 원소인 암호문의 차원을 줄이기 위하여 키 전환(key switching) 과정을 필요로 하였다. 이 key switching 과정은 새로운 개인키/공개키 쌍과 부가적인 연산 과정을 필요로 하여 FHE 스킴 구현에 있어서 구현 효율성 저하의 큰 요인이 된다. 우리는 환(ring) 상의 이차방정식을 푸는 문제의 어려움이라는 새로운 안전성 가정을 이용하여 암호문의 차원을 줄임으로써 키 전환 과정이 필요 없는 FHE 스킴을 제안한다. 이 방법은 기존의 키 전환 과정에 비해 필요로 하는 새로운 공개키 크기가 매우 작고 부가 연산이 거의 없다는 측면에서 FHE 구현 효율성을 제고할 수 있다. We present a fully homomorphic encryption (FHE) scheme without key switching based on ring- learning with errors (RLWE) problems and some other assumption. Previous FHE schemes based on LWE needed a step called key switching to reduce the dimension of ciphertext. The key switching step actually needs a heavy computation and severe increasement of keys. So the key switching step is a big burden for implementing FHE Schemes. We suggest a FHE scheme without key switching step by reducing the dimension of ciphertexts in other way. Instead of throwing away key switching, we need another hardness assumption of the difficulty of solving quadratic equation over rings.

We present new constructions of multi-party homomorphic secret sharing (HSS) based on a new primitive that we call homomorphic encryption with decryption to shares (HEDS). Our first construction, which we call \(\mathsf {Scooby} \), is based on many popular fully homomorphic encryption (FHE) schemes with a linear decryption property. \(\mathsf {Scooby} \) achieves an n-party HSS for general circuits with complexity \(O(|F| + \log n)\), as opposed to \(O(n^2 \cdot |F|)\) for the prior best construction based on multi-key FHE. \(\mathsf {Scooby} \) can be based on (ring)-LWE with a super-polynomial modulus-to-noise ratio. In our second construction, \(\mathsf {Scrappy} \), assuming any generic FHE plus HSS for NC1-circuits, we obtain a HEDS scheme which does not require a super-polynomial modulus. While these schemes all require FHE, in another instantiation, \(\mathsf {Shaggy} \), we show how in some cases it is possible to obtain multi-party HSS without FHE, for a small number of parties and constant-degree polynomials. Finally, we show that our \(\mathsf {Scooby} \) scheme can be adapted to use multi-key fully homomorphic encryption, giving more efficient spooky encryption and setup-free HSS. This latter scheme, \(\mathsf {Casper} \), if concretely instantiated with a B/FV-style multi-key FHE scheme, for functions F which do not require bootstrapping, gives an HSS complexity of \(O(n \cdot |F| + n^2 \cdot \log n)\).

Fully Homomorphic Encryption (FHE) permits processing information in the form of ciphertexts without decryption. It can ensure the security of information in common technologies used today, such as cloud computing, the Internet of Things, and machine learning, among others. A primary disadvantage for its practical application is the low efficiency of sign and comparison operations. Several FHE schemes use the Residue Number System (RNS) to decrease the time complexity of these operations. Converting from the RNS to the positional number system and calculating the positional characteristic of a number are standard approaches for both operations in the RNS domain. In this paper, we propose a new method for comparing numbers and determining the sign of a number in RNS. We focus on the even ranges that are computationally simple due to their peculiarities. We compare the performance of several state-of-art algorithms based on an implementation in C++ and relatively simple moduli with a bit depth from 24 to 64 bits. The experimental analysis shows a better performance of our approach for all the test cases; it improves the sign detection between 1.93 and 15.3 times and the number comparison within 1.55–11.35 times with respect to all the methods and configurations.

We give new instantiations of the Fiat-Shamir transform using explicit, efficiently computable hash functions. We improve over prior work by reducing the security of these protocols to qualitatively simpler and weaker computational hardness assumptions. As a consequence of our framework, we obtain the following concrete results. 1) There exists a succinct publicly verifiable non-interactive argument system for log-space uniform computations, under the assumption that any one of a broad class of fully homomorphic encryption (FHE) schemes has almost optimal security against polynomial-time adversaries. The class includes all FHE schemes in the literature that are based on the learning with errors (LWE) problem. 2) There exists a non-interactive zero-knowledge argument system for in the common reference string model, under either of the following two assumptions: (i) Almost optimal hardness of search-LWE against polynomial-time adversaries, or (ii) The existence of a circular-secure FHE scheme with a standard (polynomial time, negligible advantage) level of security. 3) The classic quadratic residuosity protocol of [Goldwasser, Micali, and Rackoff, SICOMP ’89] is not zero knowledge when repeated in parallel, under any of the hardness assumptions above.

Public key encryption schemes developed based on learning with error problem became popular for homomorphic encryption, and are proved as secured schemes based on the worst-case hardness of short vector problems. Homomorphic encryption allows computations over the cipher text without decryption. Implementation of the scheme is not considered to be practical because of its larger public keys and larger cipher texts. Large public key and cipher texts require huge space in the cloud storages. However, there are some approaches proposed to shorten the cipher texts and public keys of LWE-based homomorphic encryption scheme. The objective of the paper is to introduce an idea to shorten the public keys and cipher texts in the storage. Also, support homomorphic addition operation on reduced cipher texts. The aim of the paper is not only to give the practical implementation of standard LWE-based homomorphic encryption operation (Addition) on the reduced cipher texts and also the performance of the proposed scheme.

Accelerating the development of a practical Fully Homomorphic Encryption (FHE) scheme is the goal of the DARPA PROCEED program. For the past year, this program has had as its focus the acceleration of various aspects of the FHE concept toward practical implementation and use. FHE would be a game-changing technology to enable secure, general computation on encrypted data, e.g., on untrusted off-site hardware. However, FHE will still require several orders of magnitude improvement in computation before it will be practical for widespread use. Recent theoretical breakthroughs demonstrated the existence of FHE schemes [1, 2], and to date much progress has been made in both algorithmic and implementation improvements. Specifically our contribution to the Proceed program has been the development of FPGA based hardware primitives to accelerate the computation on encrypted data using FHE based on lattice techniques [3]. Our project, SIPHER, has been using a state of the art tool-chain developed by Mathworks to implement VHDL code for FPGA circuits directly from Simulink models. Our baseline Homomorphic Encryption prototypes are developed directly in Matlab using the fixed point toolbox to perform the required integer arithmetic. Constant improvements in algorithms require us to be able to quickly implement them in a high level language such as Matlab. We reported on our initial results at HPEC 2011 [4]. In the past year, increases in algorithm complexity have introduced several new design requirements for our FPGA implementation. This report presents new Simulink primitives that had to be developed to deal with these new requirements.