Faster fully homomorphic encryption: Bootstrapping in less than 0.1 seconds

Transcription

1 Faster fully homomorphic encryption: Bootstrapping in less than 0.1 seconds I. Chillotti 1 N. Gama 2,1 M. Georgieva 3 M. Izabachène Séminaire GTBAC Télécom ParisTech April 6, / 43

2 Table of contents 1 Fully Homomorphic Encryption Applications 2 TLWE The real torus LWE and TLWE 3 TGSW and the external product Encryption and Gadget TLWE and TGSW 4 Faster Bootstrapping Gate bootstrapping Security analysis 5 Conclusion 2 / 43

3 Table of contents 1 Fully Homomorphic Encryption Applications 2 TLWE The real torus LWE and TLWE 3 TGSW and the external product Encryption and Gadget TLWE and TGSW 4 Faster Bootstrapping Gate bootstrapping Security analysis 5 Conclusion 3 / 43

4 Homomorphic Encryption IDEA: perform computations on encrypted data, without decrypting it. b 1, b 2 {0, 1} b 1 b 1 hom b 2 = b 1 b 2 b 2 b 1 hom b 2 = b 1 b 2 4 / 43

5 Homomorphic Encryption More generally b 1. ϕhom( b1,..., bn ) = ϕ(b1,..., bn) b n where b 1,..., b n {0, 1} and ϕ is a boolean circuit. 5 / 43

6 Homomorphic Encryption An Homomorphic Encryption scheme is composed by 4 algorithms: 6 / 43

7 Homomorphic Encryption An Homomorphic Encryption scheme is composed by 4 algorithms: Key Generation KeyGen : λ (sk, pk) 6 / 43

8 Homomorphic Encryption An Homomorphic Encryption scheme is composed by 4 algorithms: Key Generation KeyGen : λ (sk, pk) Decryption Dec (deterministic) : (c, sk) m 6 / 43

9 Homomorphic Encryption An Homomorphic Encryption scheme is composed by 4 algorithms: Key Generation KeyGen : λ (sk, pk) Decryption Dec (deterministic) : (c, sk) m Encryption Enc (randomized) : such that Dec(c, sk) = m (m, pk) c 6 / 43

10 Homomorphic Encryption Evaluation Eval (possibly randomized) : (ϕ, c 1,..., c k ) c such that Dec(c, sk) = ϕ(m 1,..., m k ) m 1 c 1.. Eval(ϕ,...) c ϕ(m 1,..., m k ) m k c k 7 / 43

11 Homomorphic Encryption Evaluation Eval (possibly randomized) : (ϕ, c 1,..., c k ) c such that Dec(c, sk) = ϕ(m 1,..., m k ) m 1 c 1.. Eval(ϕ,...) c ϕ(m 1,..., m k ) m k c k A scheme that can homomorphically evaluate all functions/circuits is said Fully Homomorphic (FHE). 7 / 43

12 Applications 8 / 43

13 Applications Statistic computations on sensitive data 8 / 43

14 Applications Statistic computations on sensitive data Secure multiparty computation 8 / 43

15 Applications Statistic computations on sensitive data Secure multiparty computation Electronic voting 8 / 43

16 Applications Statistic computations on sensitive data Secure multiparty computation Electronic voting Cloud computing 8 / 43

17 Applications Statistic computations on sensitive data Secure multiparty computation Electronic voting Cloud computing and even more... 8 / 43

18 A world full of noise... anim.html 9 / 43

19 Bootstrapping now ciphertext c 1 c 2 bits bits. c l k 1 k 2 Decryption circuit (public) 0 message. secret key k n 10 / 43

20 Bootstrapping now ciphertext c 1 c 2 bits bits. c l k 1 k 2 hom. Decryption circuit (public) 0 message encrypted. secret key encrypted k n 10 / 43

21 Bootstrapping now Bootstrapping is the most expensive part of the entire homomorphic procedure Original idea by Gentry [Gen09] Last years: work to reduce the execution time and memory consuming...but a lot have to be done! 11 / 43

22 Table of contents 1 Fully Homomorphic Encryption Applications 2 TLWE The real torus LWE and TLWE 3 TGSW and the external product Encryption and Gadget TLWE and TGSW 4 Faster Bootstrapping Gate bootstrapping Security analysis 5 Conclusion 12 / 43

23 LWE LWE = Learning With Errors [Reg05] Ring-LWE [LPR10] 13 / 43

24 LWE LWE = Learning With Errors [Reg05] Ring-LWE [LPR10] In our paper LWE: denition similar to [BLPRS13],[CS15],[CGGI16] TLWE: generalized denition similar to [BGV12] 13 / 43

25 The real torus T = R/Z = R mod 1 (T, +, ) is a Z-module ( : Z T T a valid external product) 14 / 43

26 The real torus T = R/Z = R mod 1 (T, +, ) is a Z-module ( : Z T T a valid external product) It is a group: x + y mod 1 and x mod 1 14 / 43

27 The real torus T = R/Z = R mod 1 (T, +, ) is a Z-module ( : Z T T a valid external product) It is a group: x + y mod 1 and x mod 1 It is a Z-module: = 0 is dened! 14 / 43

28 The real torus T = R/Z = R mod 1 (T, +, ) is a Z-module ( : Z T T a valid external product) It is a group: x + y mod 1 and x mod 1 It is a Z-module: = 0 is dened! It is not a Ring: is not dened! 14 / 43

29 The real torus T = R/Z = R mod 1 (T, +, ) is a Z-module ( : Z T T a valid external product) It is a group: x + y mod 1 and x mod 1 It is a Z-module: = 0 is dened! It is not a Ring: is not dened! Vectors/matrices By extension, (T n, +,.) is a Z-module [ ] 1 2 [ ] = [ ] 1 2 [ ] / 43

30 Torus polynomials T N [X] (T N [X], +, ) is a R-module Here, R = Z[X]/(X N + 1) And T N [X] = T[X] mod (X N + 1) 15 / 43

31 Torus polynomials T N [X] (T N [X], +, ) is a R-module Here, R = Z[X]/(X N + 1) And T N [X] = T[X] mod (X N + 1) Examples (1 + 2X) ( X) = 15 / 43

32 Torus polynomials T N [X] (T N [X], +, ) is a R-module Here, R = Z[X]/(X N + 1) And T N [X] = T[X] mod (X N + 1) Examples (1 + 2X) ( X) =( X) mod (X2 + 1) mod 1 15 / 43

33 Torus polynomials T N [X] (T N [X], +, ) is a R-module Here, R = Z[X]/(X N + 1) And T N [X] = T[X] mod (X N + 1) Examples (1 + 2X) ( X) =( X) mod (X2 + 1) mod 1 Decompose ( X) over [ 1 2, 1 4, 1 8 ] with small coefs 15 / 43

34 Torus polynomials T N [X] (T N [X], +, ) is a R-module Here, R = Z[X]/(X N + 1) And T N [X] = T[X] mod (X N + 1) Examples (1 + 2X) ( X) =( X) mod (X2 + 1) mod 1 Decompose ( X) over [ 1 2, 1 4, 1 8 ] with small coefs ( X) = (0 + X) 2 + (1 + X) 4 + (1 + X) 8 15 / 43

35 LWE symmetric encryption 16 / 43

36 LWE symmetric encryption 2/3 1/3 0 Example: M = {0, 1/3, 2/3} mod 1 µ = 1/3 mod 1 M 16 / 43

37 LWE symmetric encryption 2/3 1/3 0 (, ϕ) Example: M = {0, 1/3, 2/3} mod 1 µ = 1/3 mod 1 M LWE Encryption 1 Choose ϕ = µ + Gaussian Error 16 / 43

38 LWE symmetric encryption 2/3 a 1/3 0 (a, ϕ) Example: M = {0, 1/3, 2/3} mod 1 µ = 1/3 mod 1 M LWE Encryption 1 Choose ϕ = µ + Gaussian Error 2 Choose a random mask a T n 16 / 43

39 LWE symmetric encryption secret key: s {0, 1} n 2/3 a 1/3 b = s a + ϕ a 0 (a, ϕ) Example: M = {0, 1/3, 2/3} mod 1 µ = 1/3 mod 1 M (a, b) LWE Encryption 1 Choose ϕ = µ + Gaussian Error 2 Choose a random mask a T n 3 Return the locked representation (a, b) 16 / 43

40 LWE symmetric encryption secret key: s {0, 1} n a (a, b) LWE Decryption 16 / 43

41 LWE symmetric encryption secret key: s {0, 1} n a (a, ϕ) ϕ = b s a a (a, b) LWE Decryption 1 Unlock the representation (a, ϕ) 16 / 43

42 LWE symmetric encryption secret key: s {0, 1} n 2/3 a 1/3 ϕ = b s a a 0 (a, ϕ) (a, b) LWE Decryption 1 Unlock the representation (a, ϕ) 2 Round ϕ to the nearest message µ M 16 / 43

43 LWE symmetric encryption secret key: s {0, 1} n a (a, ϕ) b = s a + ϕ ϕ = b s a a (a, b) 16 / 43

44 LWE symmetric encryption secret key: s {0, 1} n b = s a + ϕ 0 ϕ = b s a 0a (a, b) Trivial LWE samples LWE samples with mask a = 0 are trivial. They never occur in general...but are still worth mentionning! 16 / 43

45 LWE Homomorphic Properties x a + y a = a a = x a + y a b b b b = x b + y b 17 / 43

46 LWE Homomorphic Properties x a + y a = a a = x a + y a b b b b = x b + y b x a + y a = a ϕ ϕ ϕ ϕ = x ϕ + y ϕ 17 / 43

47 LWE Homomorphic Properties x a + y a = a a = x a + y a b b b b = x b + y b x a + y a = a ϕ ϕ ϕ ϕ = x ϕ + y ϕ µ = E(ϕ) µ µ µ = x µ + y µ 17 / 43

48 LWE Homomorphic Properties x a + y a = a a = x a + y a b b b b = x b + y b x a + y a = a ϕ ϕ ϕ ϕ = x ϕ + y ϕ µ = E(ϕ) µ µ µ = x µ + y µ α = stdev(ϕ) α α α 2 = x 2 α 2 + y 2 α 2 17 / 43

49 LWE Homomorphic Properties x a + y a = a a = x a + y a b b b b = x b + y b x a + y a = a ϕ ϕ ϕ ϕ = x ϕ + y ϕ µ = E(ϕ) µ µ µ = x µ + y µ α = stdev(ϕ) α α α 2 = x 2 α 2 + y 2 α 2 Ω: The only proba. space where this intuitive picture makes sense! 17 / 43

50 LWE LWE = Learning With Errors [Reg05] Ring-LWE [LPR10] 18 / 43

51 LWE LWE = Learning With Errors [Reg05] Ring-LWE [LPR10] In our paper LWE: denition similar to [BLPRS13],[CS15],[CGGI16] TLWE: generalized denition similar to [BGV12] 18 / 43

52 TLWE Encryption ϕ s : T N [X] k+1 T N [X] (a, b) b s a H T N [X] k+1 TLWE Samples 19 / 43

53 TLWE Encryption ϕ s : T N [X] k+1 T N [X] (a, b) b s a Im ϕ s H T N [X] k+1 M {(0, µ)} isom µ TLWE Samples Trivial samples 19 / 43

54 TLWE Encryption ϕ s : T N [X] k+1 T N [X] (a, b) b s a Im ϕ s H T N [X] k+1 TLWE Samples Γ = ker ϕ s Homogeneous samples M {(0, µ)} Trivial samples isom µ 19 / 43

55 TLWE Encryption ϕ s : T N [X] k+1 T N [X] (a, b) b s a Im ϕ s H T N [X] k+1 TLWE Samples Γ = ker ϕ s Homogeneous samples M {(0, µ)} Trivial samples isom µ c = z + (0, µ) encrypt: add z ker ϕ s µ c decrypt: apply ϕ s µ = ϕ s (c) 19 / 43

56 TLWE Encryption ϕ s : T N [X] k+1 T N [X] (a, b) b s a Im ϕ s H T N [X] k+1 TLWE Samples Γ = ker ϕ s Homogeneous samples (Approx of R-module) M {(0, µ)} Trivial samples isom µ c = z + (0, µ) c encrypt: add approx(z ker ϕ s ) decrypt: apply ϕ s... µ approx(µ) = ϕ s (c) 19 / 43

57 TLWE Encryption ϕ s : T N [X] k+1 T N [X] (a, b) b s a How to recover µ exactly?!! H Γ M Option 1: µ = E(ϕ = s (c)) T N [X] ker ϕ s (in the relevant proba. space) {(0, µ)} TLWE Samples The Ω-space logic Homogeneous samples Trivial samples Option 2: µ = (Approx round(ϕ s of (c)) On ar-module) given finite message space M isom c = z + (0, µ) The logic of the decryption algorithm µ encrypt: add approx(z ker ϕ s ) Im ϕ s µ c decrypt: apply ϕ s... approx(µ) = ϕ s (c) 19 / 43

58 Table of contents 1 Fully Homomorphic Encryption Applications 2 TLWE The real torus LWE and TLWE 3 TGSW and the external product Encryption and Gadget TLWE and TGSW 4 Faster Bootstrapping Gate bootstrapping Security analysis 5 Conclusion 20 / 43

59 GSW We want FHE! What is still missing to have Fully Homomorphic Encryption? 21 / 43

60 GSW We want FHE! What is still missing to have Fully Homomorphic Encryption? GSW [GSW13] is a FHE scheme based on LWE Relies on a gadget decomposition function 21 / 43

61 GSW We want FHE! What is still missing to have Fully Homomorphic Encryption? GSW [GSW13] is a FHE scheme based on LWE Relies on a gadget decomposition function In this talk Abstraction of [GSW13] by [GINX16] TGSW: "GSW" on T 21 / 43

62 TGSW The gadget v = ( v 1... v k+1 ) H h = 1/ / /2 l / / /2 l h generating family of H h M l,k+1(t N [X]) h is block diagonal super-increasing We are able to decompose elements in the sub-module H The coecients in the decomposition are small Approximated decomposition (up to some precision parameters) Improve time and memory requirements for a small amount of additional noise 22 / 43

63 TGSW Parameters Let H = T N [X] k T N [X] h = (h 1,..., h l ) H l a super-increasing generating family of H Dec h the "small" decomposition function from H R l (R = Z[X]/(X N + 1)) such that Dec h (x) h = x for all x H Γ = ker ϕs denotes homogeneous TLWE samples 23 / 43

64 TGSW Parameters Let H = T N [X] k T N [X] h = (h 1,..., h l ) H l a super-increasing generating family of H Dec h the "small" decomposition function from H R l (R = Z[X]/(X N + 1)) such that Dec h (x) h = x for all x H Γ = ker ϕs denotes homogeneous TLWE samples Encryption: C = Z + µ h where Z Γ l 23 / 43

65 TGSW Parameters Let H = T N [X] k T N [X] h = (h 1,..., h l ) H l a super-increasing generating family of H Dec h the "small" decomposition function from H R l (R = Z[X]/(X N + 1)) such that Dec h (x) h = x for all x H Γ = ker ϕs denotes homogeneous TLWE samples Encryption: C = Z + µ h where Z Γ l Homomorphic operations: Let C 1 = Z 1 + µ 1 h and C 2 = Z 2 + µ 2 h Linear combinations: δ 1 C 1 + δ 2 C 2 encrypts δ 1 µ 1 + δ 2 µ 2 (δ i R) Multiplication : Dec h (C 1 ) C 2 encrypts µ 1 µ 2 23 / 43

66 Toy example (without noise) ϕ s = Z/Z 1 = 4 Z/Z 1 Parameters H = Z/Z = 1 4 Z/Z 1 25 h = ( 1 100, 2 100, 5 100, , , Dec h : decomposition in Euro coins Γ = 1 4Z/Z H: modulo of the code Z/Z (is a Z-module) ) (isom) 25 Z/Z Im ϕs 24 / 43

67 Toy example (without noise) ϕ s = Z/Z 1 = 4 Z/Z 1 Parameters H = Z/Z = 1 4 Z/Z 1 25 h = ( 1 100, 2 100, 5 100, , , Dec h : decomposition in Euro coins Γ = 1 4Z/Z H: modulo of the code Samples Z/Z (is a Z-module) ) (isom) 25 Z/Z Im ϕs ( 32 C 1 = 100, , , , 90 ) ( 100, 0 1 = 100 4, 0 4, 1 4, 3 4, 2 4, 2 4 ( 73 C 2 = 100, , , 5 100, , 50 ) ( 3 = 100 4, 1 4, 2 4, 1 4, 3 4, 2 4 ) + 7 h ) 2 h 24 / 43

68 Toy example (without noise) Multiplication: Dec h (C 1 ) C 2 = = /100 21/100 40/100 5/100 35/100 50/100 ( , , , , , Verication: does encode 7 ( 2) = 11 mod 25 ( , , , , 20 ) 100, 0 = 100 ( 2 4, 1 4, 0 4, 0 4, 0 4, 2 4 ) ) + 11 h 25 / 43

69 Toy example (without noise) Multiplication: Dec h (C 1 ) C 2 = = /100 21/100 40/100 5/100 35/100 50/100 ( , , , , , Verication: does encode 7 ( 2) = 11 mod 25 ( , , , , 20 ) 100, 0 = 100 ( 2 4, 1 4, 0 4, 0 4, 0 4, 2 4 ) ) + 11 h 25 / 43

70 TLWE and TGSW H TLWE ϕ s = Γ= ker ϕ s M isom T N [X] 26 / 43

71 TLWE and TGSW H TLWE ϕ s = Γ= ker ϕ s M isom T N [X] H l Γl R h R TGSW 26 / 43

72 TLWE and TGSW H TLWE ϕ s = Γ= ker ϕ s M isom T N [X] H l Γl R h R TGSW e R l, A R, b T N [X]: e TGSW(A) is a TLWE of A ϕ s (e h) 26 / 43

73 TLWE and TGSW H TLWE ϕ s = Γ= ker ϕ s M isom T N [X] H l Γl R h R TGSW e R l, A R, b T N [X]: e TGSW(A) is a TLWE of A ϕ s (e h) = Decomp h (TLWE(b)) TGSW(A) is a TLWE of A b 26 / 43

74 Toy example (WITH noise) Parameters H = Z/Z = 1 4 Z/Z 1 25Z/Z (is a Z-module) h = ( 1 100, 2 100, 5 100, , , ) Dec h : decomposition in Euro coins Γ = 1 4Z/Z H: modulo of the code Samples ( 31 C 1 = 100, , , , 89 ) 100, [( 1 = 4, 0 4, 1 4, 3 4, 2 4, 2 ) ( , 2 100, 3 100, 1 100, 1 100, ( 71 C 2 = 100, , , 5 100, , 48 ) 100 [( 3 = 4, 1 4, 2 4, 1 4, 3 4, 2 ) ( , 2 100, 3 100, 0 100, 2 100, )] + 7 h )] 2 h 27 / 43

75 Toy example (WITH noise) Parameters H = Z/Z = 1 4 Z/Z 1 25Z/Z (is a Z-module) h = ( 1 100, 2 100, 5 100, , , ) Dec h : decomposition in Euro coins Γ = 1 4Z/Z H: modulo of the code Samples ( 31 C 1 = 100, , , , 89 ) 100, [( 1 = 4, 0 4, 1 4, 3 4, 2 4, 2 ) ( , 2 100, 3 100, 1 100, 1 100, ( 71 C 2 = 100, , , 5 100, , 48 ) 100 [( 3 = 4, 1 4, 2 4, 1 4, 3 4, 2 ) ( , 2 100, 3 100, 0 100, 2 100, )] + 7 h )] 2 h 27 / 43

76 Toy example (WITH noise) Multiplication: Dec h (C 1,1 ) C 2 = [ ] Dec h (C 1,1 ) C 2 = ( ) Verication: does encode 7 ( 2) = 11 mod 25 ( ) [( ) ( )] = + 11 h /100 23/100 37/100 5/100 33/100 48/ / 43

77 Product External product (found independently by [BP16]) : T GSW T LW E T LW E (A, b) A b = Dec h,β,ɛ (b) A (µ A, µ b ) µ A µ b where Dec h,β,ɛ is the approximate gadget decomposition 29 / 43

78 Product External product (found independently by [BP16]) : T GSW T LW E T LW E (A, b) A b = Dec h,β,ɛ (b) A (µ A, µ b ) µ A µ b where Dec h,β,ɛ is the approximate gadget decomposition Internal product (classical) : T GSW T GSW T GSW (A, B) A B = (µ A, µ B ) µ A µ B A b 1. A b (k+1)l 29 / 43

79 Product T-GSW T-LWE µ A η A µ A µ b T-LWE µ b µ A 1 η b + O(η A ) η b Err(A b) l Nβη A + µ A 1 (1 + kn)ɛ + µ A 1 η b where β and ɛ are the parameters used in the decomposition Dec h,β,ɛ (b). 30 / 43

80 Table of contents 1 Fully Homomorphic Encryption Applications 2 TLWE The real torus LWE and TLWE 3 TGSW and the external product Encryption and Gadget TLWE and TGSW 4 Faster Bootstrapping Gate bootstrapping Security analysis 5 Conclusion 31 / 43

81 Faster bootstrapping We applied our result to the fast bootstrapping proposed by Ducas and Micciancio (Eurocrypt 2015) [DM15]: homomorphic NAND gate with fast bootstrapping in 0.69 seconds 32 / 43

82 Faster bootstrapping We applied our result to the fast bootstrapping proposed by Ducas and Micciancio (Eurocrypt 2015) [DM15]: homomorphic NAND gate with fast bootstrapping in 0.69 seconds We replaced all the internal products in the bootstrapping procedure with the external one. Result: (with further optimizations) we had a speed-up of a factor 12 (bootstrapping in seconds) 32 / 43

83 Bootstrapping / 43

84 Bootstrapping / 43

85 Bootstrapping [Gentry09]-style bootstrap / 43

86 Bootstrapping [Gentry09]-style bootstrap / 43

87 Bootstrapping [DM15]-style bootstrap / 43

88 Gate Bootstrapping false := LWE( 1 8 ), noise< / 43

89 Gate Bootstrapping true := LWE(+ 1 8 ), noise < / 43

90 Gate Bootstrapping c 1 + c = / 43

91 Gate Bootstrapping NAND( c 1, c 2 ) : 1 2 return false return true / 43

92 Gate Bootstrapping NAND( c 1, c 2 ) : 1 2 return false return true / 43

93 Gate Bootstrapping [DM15/BR15]-(revisited) 1 2 v i+1 v i [... ] v 2 v 2N 1 0 v 0 v 1 34 / 43

94 Bootstrapping Algorithm (animation) Bootstrapping algorithm of (a, b) 1 Start from (a trivial) TLWE(v 0 + v 1 X + + v N 1 X N 1 ) a 2 Rotate it by p = ϕ s (a, b) positions 3 Extract the constant term (which encrypts v p ) a N coefs mod X N + 1 can be viewed as 2N coefs mod X 2N 1 s.t. v N+i = v i 35 / 43

95 Bootstrapping Algorithm (animation) Bootstrapping algorithm of (a, b) 1 Start from (a trivial) TLWE(v 0 + v 1 X + + v N 1 X N 1 ) a 2 Rotate it by p = ϕ s (a, b) positions 3 Extract the constant term (which encrypts v p ) a N coefs mod X N + 1 can be viewed as 2N coefs mod X 2N 1 s.t. v N+i = v i 35 / 43

96 Bootstrapping Algorithm (animation) Bootstrapping algorithm of (a, b) 1 Start from (a trivial) TLWE(v 0 + v 1 X + + v N 1 X N 1 ) a 2 Rotate it by p = ϕ s (a, b) positions 3 Extract the constant term (which encrypts v p ) a N coefs mod X N + 1 can be viewed as 2N coefs mod X 2N 1 s.t. v N+i = v i Rotate by p positions the coecients c TLWE 35 / 43

97 Bootstrapping Algorithm (animation) Bootstrapping algorithm of (a, b) 1 Start from (a trivial) TLWE(v 0 + v 1 X + + v N 1 X N 1 ) a 2 Rotate it by p = ϕ s (a, b) positions 3 Extract the constant term (which encrypts v p ) a N coefs mod X N + 1 can be viewed as 2N coefs mod X 2N 1 s.t. v N+i = v i Rotate by p positions the coecients c TLWE (X p c) when p is known 35 / 43

98 Bootstrapping Algorithm (animation) Bootstrapping algorithm of (a, b) 1 Start from (a trivial) TLWE(v 0 + v 1 X + + v N 1 X N 1 ) a 2 Rotate it by p = ϕ s (a, b) positions 3 Extract the constant term (which encrypts v p ) a N coefs mod X N + 1 can be viewed as 2N coefs mod X 2N 1 s.t. v N+i = v i Rotate by p positions the coecients c TLWE (X p c) when p is known (TGSW(X p ) c) when p is unknown 35 / 43

99 Bootstrapping Algorithm (animation) Bootstrapping algorithm of (a, b) 1 Start from (a trivial) TLWE(v 0 + v 1 X + + v N 1 X N 1 ) a 2 Rotate it by p = ϕ s (a, b) positions 3 Extract the constant term (which encrypts v p ) a N coefs mod X N + 1 can be viewed as 2N coefs mod X 2N 1 s.t. v N+i = v i Rotate by p positions the coecients c TLWE (X p c) when p is known (TGSW(X p ) c) when p is unknown How to rotate by ϕ s (a, b) = b + n i=1 a is i? 35 / 43

100 Bootstrapping Algorithm (animation) Bootstrapping algorithm of (a, b) 1 Start from (a trivial) TLWE(v 0 + v 1 X + + v N 1 X N 1 ) a 2 Rotate it by p = ϕ s (a, b) positions 3 Extract the constant term (which encrypts v p ) a N coefs mod X N + 1 can be viewed as 2N coefs mod X 2N 1 s.t. v N+i = v i Rotate by p positions the coecients c TLWE (X p c) when p is known (TGSW(X p ) c) when p is unknown How to rotate by ϕ s (a, b) = b + n i=1 a is i? 1 Multiply by X b 35 / 43

101 Bootstrapping Algorithm (animation) Bootstrapping algorithm of (a, b) 1 Start from (a trivial) TLWE(v 0 + v 1 X + + v N 1 X N 1 ) a 2 Rotate it by p = ϕ s (a, b) positions 3 Extract the constant term (which encrypts v p ) a N coefs mod X N + 1 can be viewed as 2N coefs mod X 2N 1 s.t. v N+i = v i Rotate by p positions the coecients c TLWE (X p c) when p is known (TGSW(X p ) c) when p is unknown How to rotate by ϕ s (a, b) = b + n i=1 a is i? 1 Multiply by X b 2 For i [1, n] multiply by TGSW(X aisi ) 35 / 43

102 Bootstrapping Algorithm (animation) Bootstrapping algorithm of (a, b) 1 Start from (a trivial) TLWE(v 0 + v 1 X + + v N 1 X N 1 ) a 2 Rotate it by p = ϕ s (a, b) positions 3 Extract the constant term (which encrypts v p ) a N coefs mod X N + 1 can be viewed as 2N coefs mod X 2N 1 s.t. v N+i = v i Rotate by p positions the coecients c TLWE (X p c) when p is known (TGSW(X p ) c) when p is unknown How to rotate by ϕ s (a, b) = b + n i=1 a is i? 1 Multiply by X b 2 For i [1, n] multiply by TGSW(X aisi ) X a is i = 1 + (X a i 1) s i, with s i {0, 1} 35 / 43

103 Bootstrapping Algorithm (animation) Bootstrapping algorithm of (a, b) 1 Start from (a trivial) TLWE(v 0 + v 1 X + + v N 1 X N 1 ) a 2 Rotate it by p = ϕ s (a, b) positions 3 Extract the constant term (which encrypts v p ) a N coefs mod X N + 1 can be viewed as 2N coefs mod X 2N 1 s.t. v N+i = v i Rotate by p positions the coecients c TLWE (X p c) when p is known (TGSW(X p ) c) when p is unknown How to rotate by ϕ s (a, b) = b + n i=1 a is i? 1 Multiply by X b 2 For i [1, n] multiply by TGSW(X aisi ) X a is i = 1 + (X a i 1) s i, with s i {0, 1} TGSW(X a is i ) = h + (X a i 1) TGSW(s i), where BK = TGSW(s i) 35 / 43

104 Security analysis 36 / 43

105 Security analysis Numerical security estimates Based on [APS15],[LP11],[DM15] results 1 Convert the instance to a lattice problem we tested: UniqueSVP, red to SIS, modswitch... 2 Apply the best heuristics 3 Optimized all non-relevant parameters: m, ε, q, trials / 43

106 Security analysis Numerical security estimates Based on [APS15],[LP11],[DM15] results 1 Convert the instance to a lattice problem we tested: UniqueSVP, red to SIS, modswitch... 2 Apply the best heuristics 3 Optimized all non-relevant parameters: m, ε, q, trials... Important security parameters 1 Noise rate: α 2 Entropy of the secret: n and that's all! λ expressed solely as a function of (n, α) 36 / 43

107 Security parameter - the rainbow Values of λ(n,α) Boot. Key [11] Boot. Key 256 log 2 (1/α) Switch Key n / 43

108 Table of contents 1 Fully Homomorphic Encryption Applications 2 TLWE The real torus LWE and TLWE 3 TGSW and the external product Encryption and Gadget TLWE and TGSW 4 Faster Bootstrapping Gate bootstrapping Security analysis 5 Conclusion 38 / 43

109 TFHE implementation 39 / 43

110 TFHE implementation Before: 1 bootstrapping in 52 ms 39 / 43

111 TFHE implementation Before: 1 bootstrapping in 52 ms Now: 1 bootstrapping in 20 ms 39 / 43

112 Conclusion Summary Construction and abstraction of TLWE and TGSW The external product : T GSW T LW E T LW E Faster bootstrapping 40 / 43

113 Conclusion Summary Construction and abstraction of TLWE and TGSW The external product : T GSW T LW E T LW E Faster bootstrapping More We can apply our results to leveled HE schemes We can improve this result and make FHE faster 40 / 43

114 Conclusion Summary Construction and abstraction of TLWE and TGSW The external product : T GSW T LW E T LW E Faster bootstrapping More We can apply our results to leveled HE schemes We can improve this result and make FHE faster Thank you! m.s.n. 40 / 43

115 Bibliography [APS15] Albrecht, M.R., Player, R., and Scott, S., "On the concrete hardness of learning with errors." Journal of Mathematical Cryptology 9.3 (2015): [BGV12] Brakerski, Z., Gentry, C., and Vaikuntanathan, V. "(Leveled) fully homomorphic encryption without bootstrapping." In Proceedings of the 3rd Innovations in Theoretical Computer Science Conference (pp ). ACM (2012). [BLPRS13] Brakerski, Z., Langlois, A., Peikert, C., Regev, O., and Stehlé, D. "Classical hardness of learning with errors." In the proceedings of STOC'13 (2013). [BP16], Brakerski, Z., and Perlman, R. "Lattice-Based Fully Dynamic Multi-Key FHE with Short Ciphertexts." In the proceedings of CRYPTO 2016 (2016). [BR15] Biasse, J-F., Ruiz, L., "FHEW with Ecient Multibit Bootstrapping." In the proceedings of LatinCrypt 2015 (2015). 41 / 43

116 Bibliography [CS15] Cheon, J.H., Stehlé, D., "Fully Homomorphic Encryption over the Integers Revisited." In the proceedings of EUROCRYPT'15. Springer-Verlag (2015). [CGGI16] Chillotti, I., Gama, N., Georgieva, M., and Izabachène, M. "A Homomorphic LWE Based E-voting Scheme." In International Workshop on Post-Quantum Cryptography (pp ). Springer International Publishing (2016). [DM15] Ducas, L., Micciancio, D., "FHEW: Bootstrapping Homomorphic Encryption in less than a second." In the proceedings of EUROCRYPT'15. Springer-Verlag (2015). [GINX16] Gama, N., Izabachene, M., Nguyen, P.Q., and Xie, X., "Structural Lattice Reduction: Generalized Worst-Case to Average-Case Reductions." In the proceedings of EUROCRYPT'16. Springer-Verlag (2016). [Gen09] Gentry, C., "A fully homomorphic encryption scheme [Ph. D. thesis]." International Journal of Distributed Sensor Networks, Stanford University (2009). 42 / 43

117 Bibliography [GSW13] Gentry, C., Sahai, A., and Waters, B., "Homomorphic encryption from learning with errors: Conceptually-simpler, asymptotically-faster, attribute-based." Advances in CryptologyCRYPTO Springer Berlin Heidelberg, (2013). [LP11] Lindner, R., and Peikert, C., "Better key sizes (and attacks) for LWE-based encryption." Cryptographers' Track at the RSA Conference. Springer Berlin Heidelberg (2011). [LPR10] Lyubashevsky, V., Peikert, C., and Regev, O., "On Ideal Lattices and Learning with Errors over Rings." Advances in CryptologyEUROCRYPT 2010 (2010). [Reg05] Regev, O., "On lattices, learning with errors, random linear codes, and cryptography." In STOC, pp (2005). 43 / 43