High-Performance FV Somewhat Homomorphic Encryption on GPUs: An Implementation using CUDA

Transcription

1 High-Performance FV Somewhat Homomorphic Encryption on GPUs: An Implementation using CUDA Ahmad Al Badawi National University of Singapore (NUS) Sept 10 th 2018 CHES 2018

2 FHE The holy grail of Cryptography FHE enables computing on encrypted data without decryption [GB2009] Challenge: requires enormous computation Encryption/Decryption Homomorphic evaluation of f Enc(x) Enc(f(x)) Client Cloud Server Ahmad Al Badawi - ahmad@u.nus.edu 2

3 How the problem is being tackled? Algorithmic methods: New FHE schemes Plaintext packing (1D, 2D, ) Encoding schemes Approximated computing Squashing the target function DAG optimizations for the target circuit Acceleration methods: Speedup FHE basic primitives (KeyGen, Enc, Dec, Add, Mul) Modular Algorithms Parallel Implementations Hardware implementations: GPUs, FPGAs and probably ASICs Ahmad Al Badawi - ahmad@u.nus.edu 3

4 Our Contributions 1. Implementation of FV RNS on GPUs 2. Introducing a set of CUDA optimizations 3. Benchmarking with state-of-the-art implementations Ahmad Al Badawi - ahmad@u.nus.edu 4

5 Why GPUs for FHE? GPU + Naturally available many computing cores Developer friendly (FPGA, ASIC) FHE + Huge level of parallelism If you were plowing a field, which would you rather use? Two strong oxen or 1024 chickens? Seymour Cray Ahmad Al Badawi - ahmad@u.nus.edu 5

6 Textbook FV Basic mathematical structure is R: Z x /(x n + 1) Plaintext space: R t : Z t x /(x n + 1) Ciphertext space: R q : Z q x /(x n + 1) Public key: pk 0, pk 1 R q Secret key: sk R q c = Enc(m): ( q t m + pk 0u + e 0 q, pk 1 u + e 1 q ) m = Dec c : t q c 0 + c 1 sk q t c + = Add c 0, c 1 : ( c 00 + c 10 q, c 01 + c 11 q ) Ahmad Al Badawi - ahmad@u.nus.edu 6

7 c = Mul c 0, c 1, evk : 1. Tensor product: Textbook FV (cont.) v 0 = t q c 00c 10 q, v 2 = t q c 01c 11 q v 1 = t q (c 00c 11 + c 01 c 10 ) 2. Base decomposition: 2. Relinearization: l (i) v 2 = v 2 w i, l = i=0 l c (i) = v j + evk ij v 2, j {0,1} i=0 q Ahmad Al Badawi - ahmad@u.nus.edu 7 q

8 Implementation Requirements Polynomial arithmetic in cyclotomic rings Large polynomial degree (a few thousands) Power-of-2 cyclotomic Addition/Subtraction: O(n) Multiplication: O(n log n) Large coefficients Z q (a few hundreds of bits) Modular algorithms (RNS) Extra non-trivial operations: Scaling-and-round t x q Base decomposition Ahmad Al Badawi - ahmad@u.nus.edu 8

9 Polynomial Arithmetic CRT: q = k 1 p i i=0, where p i is a prime log 2 p-bit number RNS / CRT k = log 2 q log 2 p.... n... p 0 p 1 p k 1 Addition/Subtraction: component-wise add/sub modulo p i Ahmad Al Badawi - ahmad@u.nus.edu 9

10 Polynomial Arithmetic (cont.) 32-bit number RNS / CRT NTT NTT (DGT) n... p 0 n... p 0 k = log 2 q log 2 p... p p 1 p k 1 p k 1 NTT 1 Addition/Subtraction/Multiplication: component-wise add/sub/mul modulo p i Ahmad Al Badawi - ahmad@u.nus.edu 10

11 DFT, NTT, DWT, DGT? DFT Pros - Well-established - Several efficient libraries to use Cons - Floating point errors increase as (n & p i s) increase - Reduce precision (smaller p i s) => longer RNS matrix => more DFTs NTT - Exact - Transform length (2n) DWT - Exact - Only power-of-2 cyclotomics - Transform length (n) DGT - Exact - Transform length ( n 2 ) - 50% Less interaction with memory - Only power-of-2 cyclotomics - Gaussian Arithmetic (larger number of multiplications ~(30% - 40%) We use DGT in our implementation Ahmad Al Badawi - ahmad@u.nus.edu 11

12 Efficient DGT/NTT/DWT on GPU? Better to store w ji in lookup table. LUT can be stored in GPU texture memory (which is limited on GPU) DWT LUT are O(n) DGT LUT are O( n ) 2 A = NTT(a) s.t. n 1 A j = a i w ji mod q i=0 a = NTT 1 (A) s.t. n 1 a i = n 1 A j w ij mod q j=0 Compute in GF(p ) or in GF(p i )? We found it is better to do it GF(p i ). Why? (see next) Ahmad Al Badawi - ahmad@u.nus.edu 12

13 Compute in GF(p ) or in GF(p i )? k = log 2 q log 2 p.... n... p 0 p 1 p k 1 GF(p) GF(p i ) p : 64-bit prime (should fit in one word) p p 2n (one multiplication) n log 2 p p: word-size prime (can be 64-bit) - Shorter RNS matrix => Less NTTs - No size doubling - Supports unlimited number of operations in NTT domain - Longer RNS matrix => more NTTs - Size double (32-bit => 64-bit) - Supports limited number of operations in NTT domain Ahmad Al Badawi - ahmad@u.nus.edu 13

14 But, is NTT/DWT/DGT performance-critical? Breakdown of homomorphic multiplication (AND) in the BFV FHE scheme Toy Settings Medium Settings NTT RNS Base Extension RNS Scaling others NTT RNS Base Extension RNS Scaling others Large Settings NTT RNS Base Extension RNS Scaling others Halevi, Shai, Yuriy Polyakov, and Victor Shoup. "An Improved RNS Variant of the BFV Homomorphic Encryption Scheme." (2018). Ahmad Al Badawi - ahmad@u.nus.edu 14

15 Computing CRT on GPU? At least two methods: Classic algorithm - CRT a, {p i } : (a 0,, a k 1 ) = a mod p i - CRT 1 (a 0,, a k 1 ) = a s.t. Garner s algorithm a = k 1 q p i i=0 q p i 1 a i (mod p i ) (mod q) where q = k 1 i=0 p i Classic Garners LUT k 2 k k 1 2 Thread Divergence Non tractable Nil Is CRT critical to performance? No! Ahmad Al Badawi - ahmad@u.nus.edu 15

16 RNS tools Useful to: Remain in RNS representation No costly multi-precision arithmetic Two basic operations: Scale-and-round Base decomposition Adopted from (BEHZ2016 * ) scheme Are RNS tools critical to performance? Extremely critical * Bajard, Jean-Claude, et al. "A full RNS variant of FV like somewhat homomorphic encryption schemes." International Conference on Selected Areas in Cryptography. Springer, Cham, Ahmad Al Badawi - ahmad@u.nus.edu 16

17 FV_RNS Homomorphic Multiplication Ahmad Al Badawi - ahmad@u.nus.edu 17

18 Time (ms) Time (ms) Time (ms) Time (ms) Benchmarking Results Key Generation Dec GPU-FV SEAL NFLlib-FV GPU-FV SEAL NFLlib-FV (11,62) (12,186) (13,372) (14,744) (11,62) (12,186) (13,372) (14,744) Enc HomoMul + Relinearization GPU-FV SEAL GPU-FV SEAL NFLlib-FV NFLlib-FV (11,62) (12,186) (13,372) (14,744) (11,62) (12,186) (13,372) (14,744) Ahmad Al Badawi - ahmad@u.nus.edu 18

19 Which FV RNS variant to Implement? Two RNS variants of FV BEHZ HPS Answer can be found in: Al Badawi, Ahmad, et al. "Implementation and Performance Evaluation of RNS Variants of the BFV Homomorphic Encryption Scheme." IACR Cryptology eprint Archive 2018 (2018): 589. Ahmad Al Badawi - ahmad@u.nus.edu 20

20 Thank You Questions? Ahmad Al Badawi 21