Packing Messages and Optimizing Bootstrapping in GSW-FHE

Transcription

1 Packing Messages and Optimizing Bootstrapping in GSW-FHE Ryo Hiromasa Masayuki Abe Tatsuaki Okamoto Kyoto University NTT PKC 15 April 1, / 13

2 Fully Homomorphic Encryption (FHE) c Enc(m) f, c ĉ Eval( f, c) ( f (m) Dec(ĉ)) ĉ 2 / 13

3 Fully Homomorphic Encryption (FHE) c Enc(m) f, c ĉ Eval( f, c) ( f (m) Dec(ĉ)) ĉ FHE from Ideal lattices: [Gen09] Integers: [DGHV10] RLWE: [BV11b] LWE: [BV11a] Approx eigenvector: [GSW13] 2 / 13

4 Fully Homomorphic Encryption (FHE) c 1 Enc(m 1 ) c r Enc(m r ) ( f (m i ) Dec(ĉ i )) f, c 1,, c r ĉ 1,, ĉ r ĉ 1 Eval( f, c 1 ) ĉ r Eval( f, c r ) FHE from Ideal lattices: [Gen09] Integers: [DGHV10] RLWE: [BV11b] LWE: [BV11a] Approx eigenvector: [GSW13] 2 / 13

5 Fully Homomorphic Encryption (FHE) c 1 Enc(m 1 ) c r Enc(m r ) ( f (m i ) Dec(ĉ i )) f, c 1,, c r ĉ 1,, ĉ r ĉ 1 Eval( f, c 1 ) ĉ r Eval( f, c r ) FHE from Ideal lattices: [Gen09] Integers: [DGHV10] RLWE: [BV11b] LWE: [BV11a] Approx eigenvector: [GSW13] 2 / 13

6 Single-Instruction-Multiple-Data (SIMD) FHE c Enc(m 1,, m r ) f, c ĉ Eval( f, c) ( f (m 1 ),, f (m r ) Dec(ĉ)) ĉ FHE from Ideal lattices: [Gen09] Integers: [DGHV10] RLWE: [BV11b] LWE: [BV11a] Approx eigenvector: [GSW13] 2 / 13

7 Single-Instruction-Multiple-Data (SIMD) FHE c Enc(m 1,, m r ) f, c ĉ Eval( f, c) ( f (m 1 ),, f (m r ) Dec(ĉ)) ĉ FHE from Ideal lattices: [Gen09] Integers: [DGHV10] RLWE: [BV11b] LWE: [BV11a] Approx eigenvector: [GSW13] SIMD FHE from Ideal lattices: [SV10] Integers: [CCKLLTY13] RLWE: [SV10] LWE: [BGH13] Approx eigenvector:? 2 / 13

8 This Talk 1 SIMD FHE from approximate eigenvector method 3 / 13

9 This Talk 1 SIMD FHE from approximate eigenvector method Simple homomorphic SIMD operations (just matrix addition/multiplication) 3 / 13

10 This Talk 1 SIMD (Matrix) FHE from approximate eigenvector method Simple homomorphic SIMD operations (just matrix addition/multiplication) Supports homomorphic matrix addition and multiplication 3 / 13

11 This Talk 1 SIMD (Matrix) FHE from approximate eigenvector method Simple homomorphic SIMD operations (just matrix addition/multiplication) Supports homomorphic matrix addition and multiplication A natural extension of SIMD FHE Can compute more complicated homomorphic operations 3 / 13

12 This Talk 1 SIMD (Matrix) FHE from approximate eigenvector method Simple homomorphic SIMD operations (just matrix addition/multiplication) Supports homomorphic matrix addition and multiplication A natural extension of SIMD FHE Can compute more complicated homomorphic operations Requires an additional (but reasonable in FHE literature) assumption for security 3 / 13

13 This Talk 1 SIMD (Matrix) FHE from approximate eigenvector method Simple homomorphic SIMD operations (just matrix addition/multiplication) Supports homomorphic matrix addition and multiplication A natural extension of SIMD FHE Can compute more complicated homomorphic operations Requires an additional (but reasonable in FHE literature) assumption for security 2 Application: optimizing bootstrapping of [AP14] 3 / 13

14 This Talk 1 SIMD (Matrix) FHE from approximate eigenvector method Simple homomorphic SIMD operations (just matrix addition/multiplication) Supports homomorphic matrix addition and multiplication A natural extension of SIMD FHE Can compute more complicated homomorphic operations Requires an additional (but reasonable in FHE literature) assumption for security 2 Application: optimizing bootstrapping of [AP14] Lattice approximation factor: O(n 3 ) O(n 25 ) 3 / 13

15 This Talk 1 SIMD (Matrix) FHE from approximate eigenvector method Simple homomorphic SIMD operations (just matrix addition/multiplication) Supports homomorphic matrix addition and multiplication A natural extension of SIMD FHE Can compute more complicated homomorphic operations Requires an additional (but reasonable in FHE literature) assumption for security 2 Application: optimizing bootstrapping of [AP14] Lattice approximation factor: O(n 3 ) O(n 25 ) Allows us to get the best factor O(n 15+ϵ ) without successive dimension-modulus reduction 3 / 13

16 Starting point: Gentry-Sahai-Waters FHE (GSW-FHE) Learning with Errors (LWE): A U Z n m U q, t Z n q, e R χ m, b T = t T A + e T bt A Uniform(Z (n+1) m q ) 4 / 13

17 Starting point: Gentry-Sahai-Waters FHE (GSW-FHE) Learning with Errors (LWE): A U Z n m U q, t Z n q, e R χ m, b T = t T A + e T bt A Uniform(Z (n+1) m q ) GSW-FHE Secret key is s Z q (n+1) G = (1, 2,, 2 log q 1 ) I Public key is a LWE matrix B Z (n+1) m q st sb 0 A ciphertext of m {0, 1} is a matrix C = BR + m G mod q st sc = noise + m sg 4 / 13

18 Extension to Matrix GSW-FHE: A Natural Extension Condition to be Sufficed For a secret key S Z r (n+r) q, a ciphertext of M {0, 1} r r is C Z q (n+r) N st SC = noise + MSG 5 / 13

19 Extension to Matrix GSW-FHE: A Natural Extension Condition to be Sufficed For a secret key S Z r (n+r) q, a ciphertext of M {0, 1} r r is C Z q (n+r) N st SC = noise + MSG Homomorphic matrix addition: just matrix addition S(C 1 + C 2 ) = noise + (M 1 + M 2 )SG 5 / 13

20 Extension to Matrix GSW-FHE: A Natural Extension Condition to be Sufficed For a secret key S Z r (n+r) q, a ciphertext of M {0, 1} r r is C Z q (n+r) N st SC = noise + MSG Homomorphic matrix addition: just matrix addition S(C 1 + C 2 ) = noise + (M 1 + M 2 )SG G 1 (X): outputs a small matrix X st GX = X 5 / 13

21 Extension to Matrix GSW-FHE: A Natural Extension Condition to be Sufficed For a secret key S Z r (n+r) q, a ciphertext of M {0, 1} r r is C Z q (n+r) N st SC = noise + MSG Homomorphic matrix addition: just matrix addition S(C 1 + C 2 ) = noise + (M 1 + M 2 )SG G 1 (X): outputs a small matrix X st GX = X Homomorphic marix multiplication: computes G 1 ( ) and matrix multiplication If we let C R 2 G 1 (C 2 ), then SC 1 C 2 = (noise + M 1SG)C 2 = noise + M 1 SC 2 = noise + M 1 M 2 SG 5 / 13

22 Extension to Matrix GSW-FHE: Construction Computing Ciphertexts For a matrix X st SX = MS, ciphertexts are required to be of the form: C = BR + XG 6 / 13

23 Extension to Matrix GSW-FHE: Construction Computing Ciphertexts For a matrix X st SX = MS, ciphertexts are required to be of the form: C = BR + XG By construction, S includes an identity matrix: S = [I S ] 6 / 13

24 Extension to Matrix GSW-FHE: Construction Computing Ciphertexts For a matrix X st SX = MS, ciphertexts are required to be of the form: C = BR + XG By construction, S includes an identity matrix: S = [I S ] Set X as follows: X = MS 0 X can not be computed publicly (In [GSW13], X = m I, so we can publicly compute it) In FHE, symmetric asymmetric is easy [Bar10, Rot11] It requires to introduce a circular security assumption 6 / 13

25 Extension to Matrix GSW-FHE: Symmetric Asymmetric Let M (i, j) be the matrix with 1 in (i, j)-th 0 0 position and 0 in the others i j 7 / 13

26 Extension to Matrix GSW-FHE: Symmetric Asymmetric Let M (i, j) be the matrix with 1 in (i, j)-th 0 0 position and 0 in the others i Publish encryptions of M (i, j) (= P (i, j) ) as a part of the public key ( this enlarges the key size by a #(encrypted bits) factor) j 7 / 13

27 Extension to Matrix GSW-FHE: Symmetric Asymmetric Let M (i, j) be the matrix with 1 in (i, j)-th 0 0 position and 0 in the others i 1 Publish encryptions of M (i, j) (= P (i, j) ) as a part of the public key ( this enlarges the key size by a #(encrypted bits) factor) P (i, j) = BR (i, j) + 0 s T j 0 G 0 j 0 7 / 13

28 Extension to Matrix GSW-FHE: Symmetric Asymmetric Let M (i, j) be the matrix with 1 in (i, j)-th 0 0 position and 0 in the others i 1 Publish encryptions of M (i, j) (= P (i, j) ) as a part of the public key ( this enlarges the key size by a #(encrypted bits) factor) P (i, j) = BR (i, j) + 0 s T j 0 G Uniform ( circular security) 0 j 0 7 / 13

29 Extension to Matrix GSW-FHE: Symmetric Asymmetric Let M (i, j) be the matrix with 1 in (i, j)-th 0 0 position and 0 in the others i 1 Publish encryptions of M (i, j) (= P (i, j) ) as a part of the public key ( this enlarges the key size by a #(encrypted bits) factor) P (i, j) = BR (i, j) + 0 s T j 0 G Uniform ( circular security) 0 j 0 PubEnc pk (M {0, 1} r r ): Let M[i, j] be the (i, j)-th element of M C = BR + P (i, j) (i, j) [r] [r]: M[i, j]=1 7 / 13

30 Example: Implementing SIMD FHE SIMD Ciphertexts A ciphertext of M {0, 1} r r is a matrix C Z (n+r) N q SC = noise + MSG st Store (m 1,, m r ) {0, 1} r in the diagonal entries of M m 1 SC = noise + m r SG 8 / 13

31 Example: Implementing SIMD FHE SIMD Ciphertexts A ciphertext of M {0, 1} r r is a matrix C Z (n+r) N q SC = noise + MSG st Store (m 1,, m r ) {0, 1} r in the diagonal entries of M m 1 SC = noise + Homomorphic SIMD addition: m r SG m 1,1 m 2,1 S(C 1 + C 2 ) = noise + m 1,r + m 2,r SG 8 / 13

32 Example: Implementing SIMD FHE SIMD Ciphertexts A ciphertext of M {0, 1} r r is a matrix C Z (n+r) N q SC = noise + MSG st Store (m 1,, m r ) {0, 1} r in the diagonal entries of M m 1 SC = noise + Homomorphic SIMD multiplication: m r SG m 1,1 m 2,1 SC 1 C 2 = noise + m 1,r m 2,r SG 8 / 13

33 Example: Implementing SIMD FHE SIMD Ciphertexts A ciphertext of M {0, 1} r r is a matrix C Z (n+r) N q SC = noise + MSG st Store (m 1,, m r ) {0, 1} r in the diagonal entries of M SC = noise + m 1 m r SG Plaintext-slot permutation: Let Σ be a permutation matrix of σ, W Σ, W Σ T be ciphertexts of Σ, Σ T m σ(1) S(W Σ C W ) = noise + Σ T m σ(r) SG 8 / 13

34 Related Work: Graph-Induced Multilinear Maps [GGH15] Recall: a GSW-FHE ciphertext of m {0, 1} is a matrix C Z N N q (sg)c = m (sg) + noise st sg is called approximate eigenvector m is the eigenvalue 9 / 13

35 Related Work: Graph-Induced Multilinear Maps [GGH15] Recall: a GSW-FHE ciphertext of m {0, 1} is a matrix C Z N N q (sg)c = m (sg) + noise st sg is called approximate eigenvector m is the eigenvalue [GGH15]: approximate eigenvector approximate eigenspace An encoding of M Z r r is a matrix D Z N N q S U Z r N q, E R χ r N, SD = MS + E st for S is an approximate eigenspace 9 / 13

36 Related Work: Graph-Induced Multilinear Maps [GGH15] PreSamp(trapdoor, A, z, σ): outputs x st Ax = z according to a discrete Gaussian dist with parameter σ 10 / 13

37 Related Work: Graph-Induced Multilinear Maps [GGH15] PreSamp(trapdoor, A, z, σ): outputs x st Ax = z according to a discrete Gaussian dist with parameter σ [GGH15] s encoding: D R PreSamp(trapdoor, S, MS + E, σ) 10 / 13

38 Related Work: Graph-Induced Multilinear Maps [GGH15] PreSamp(trapdoor, A, z, σ): outputs x st Ax = z according to a discrete Gaussian dist with parameter σ [GGH15] s encoding: D R PreSamp(trapdoor, S, MS + E, σ) Matrix GSW-FHE: a ciphertext of M {0, 1} r r is computed by C R PreSamp(trapdoor, G, MS G + BR, σ) 0 We have (SG)C = M(SG) + noise SG can be seen as an approximate eigenspace 10 / 13

39 Application: Bootstrapping Bootstrapping transforms FHE schemes to have unlimited amount of homomorphism 11 / 13

40 Application: Bootstrapping Bootstrapping transforms FHE schemes to have unlimited amount of homomorphism This is done by homomorphically evaluating the decryption circuit 11 / 13

41 Application: Bootstrapping Bootstrapping transforms FHE schemes to have unlimited amount of homomorphism This is done by homomorphically evaluating the decryption circuit Recent Developments of Bootstrapping GSW-FHE In GSW-FHE, the noise grows asymmetrically: Let noise(c i ) < B i noise(c 1 c 2 ) < poly(n) B 1 + B 2 11 / 13

42 Application: Bootstrapping Bootstrapping transforms FHE schemes to have unlimited amount of homomorphism This is done by homomorphically evaluating the decryption circuit Recent Developments of Bootstrapping GSW-FHE In GSW-FHE, the noise grows asymmetrically: Let noise(c i ) < B i noise(c 1 c 2 ) < poly(n) B 1 + B 2 noise(c i ) < B noise(c 1 (c 2 ( (c l 1 c l ) ))) < l poly(n) B } {{ } l 11 / 13

43 Application: Bootstrapping Bootstrapping transforms FHE schemes to have unlimited amount of homomorphism This is done by homomorphically evaluating the decryption circuit Recent Developments of Bootstrapping GSW-FHE In GSW-FHE, the noise grows asymmetrically: Let noise(c i ) < B i noise(c 1 c 2 ) < poly(n) B 1 + B 2 noise(c i ) < B noise(c 1 (c 2 ( (c l 1 c l ) ))) < l poly(n) B } {{ } To bootstrap with smaller noise, we want to compute the decryption in sequence l 11 / 13

44 Application: Bootstrapping Bootstrapping transforms FHE schemes to have unlimited amount of homomorphism This is done by homomorphically evaluating the decryption circuit Recent Developments of Bootstrapping GSW-FHE In GSW-FHE, the noise grows asymmetrically: Let noise(c i ) < B i noise(c 1 c 2 ) < poly(n) B 1 + B 2 noise(c i ) < B noise(c 1 (c 2 ( (c l 1 c l ) ))) < l poly(n) B } {{ } To bootstrap with smaller noise, we want to compute the decryption in sequence [BV14]: uses the Barrington s theorem l 11 / 13

45 Application: Bootstrapping Bootstrapping transforms FHE schemes to have unlimited amount of homomorphism This is done by homomorphically evaluating the decryption circuit Recent Developments of Bootstrapping GSW-FHE In GSW-FHE, the noise grows asymmetrically: Let noise(c i ) < B i noise(c 1 c 2 ) < poly(n) B 1 + B 2 noise(c i ) < B noise(c 1 (c 2 ( (c l 1 c l ) ))) < l poly(n) B } {{ } To bootstrap with smaller noise, we want to compute the decryption in sequence [BV14]: uses the Barrington s theorem [AP14]: encodes the decryption to a subset sum l 11 / 13

46 Application: Optimizing the Bootstrapping of [AP14] The decryption of standard lattice-based FHE is Decs(c) = c, s 2 = c i s i 2 = s i 2 i i:c i =1 12 / 13

47 Application: Optimizing the Bootstrapping of [AP14] The decryption of standard lattice-based FHE is Decs(c) = c, s 2 = c i s i 2 = s i 2 i i:c i =1 Additive groups are isomorphic to groups of cyclic permutations 12 / 13

48 Application: Optimizing the Bootstrapping of [AP14] The decryption of standard lattice-based FHE is Decs(c) = c, s 2 = c i s i 2 = s i 2 i i:c i =1 Additive groups are isomorphic to groups of cyclic permutations [AP14] encodes c, s to compositions of cyclic permutations 12 / 13

49 Application: Optimizing the Bootstrapping of [AP14] The decryption of standard lattice-based FHE is Decs(c) = c, s 2 = c i s i 2 = s i 2 i i:c i =1 Additive groups are isomorphic to groups of cyclic permutations [AP14] encodes c, s to compositions of cyclic permutations The rounding x 2 = 1 if x q/4 0 otherwise consists of checking equality and summing their results 12 / 13

50 Application: Optimizing the Bootstrapping of [AP14] The decryption of standard lattice-based FHE is Decs(c) = c, s 2 = c i s i 2 = s i 2 i i:c i =1 Additive groups are isomorphic to groups of cyclic permutations [AP14] encodes c, s to compositions of cyclic permutations The rounding x 2 = 1 if x q/4 0 otherwise consists of checking equality and summing their results Our optimization represents Dec except for the summation as a sequence of homomorphic multiplications Lattice approximation factor: O(n 3 ) O(n 25 ) This allows us to get the best factor O(n 15+ϵ ) without successive dimension-modulus reduction 12 / 13

51 Conclusion Our result: SIMD (Matrix) GSW-FHE Simple homomorphic SIMD operations (just matrix addition/multiplication) Supports homomorphic matrix addition and multiplication A natural extension of SIMD FHE Can compute more complicated homomorphic operations Requires an additional assumption for security A FHE variant of the recent MMPs [GGH15] Application: optimizing [AP14] s bootstrapping Lattice approximation factor: O(n 3 ) O(n 25 ) We can get the best factor O(n 15+ϵ ) without successive dimension-modulus reduction 13 / 13