Fully Homomorphic Encryption Zvika Brakerski Weizmann Institute of - - PowerPoint PPT Presentation

Fully Homomorphic Encryption

Zvika Brakerski Weizmann Institute of Science

ASCrypto, October 2013

Outsourcing Computation

Email, web-search, navigation, social networking…

𝑦 𝑔 𝑔(𝑦) 𝑦

What if 𝑦 is private?

Search query, location, business information, medical information…

The Situation Today

We promise we wont look at your data. Honest! We want real protection.

Outsourcing Computation – Privately

WANT NTED ED Homomorphic Evaluation function: 𝐹𝑤𝑏𝑚: 𝑔, 𝐹𝑜𝑑 𝑦 → 𝐹𝑜𝑑(𝑔 𝑦 )

𝑦 𝑔 𝑧 𝐹𝑜𝑑(𝑦) 𝐸𝑓𝑑 𝑧 = 𝑔(𝑦)

Learns nothing on 𝑦.

Fully Homomorphic Encryption (FHE)

𝑦 𝑔 𝑧 = 𝐹𝑤𝑏𝑚𝑓𝑤𝑙(𝑔, 𝐹𝑜𝑑 𝑦 ) 𝐹𝑜𝑑(𝑦) 𝐸𝑓𝑑𝑡𝑙 𝑧 = 𝑔(𝑦) 𝑡𝑙 , 𝑞𝑙 𝑓𝑤𝑙

Correctness:

𝐹𝑜𝑑(𝑦) ≅ 𝐹𝑜𝑑(0)

Input privacy:

𝑧 𝐸𝑓𝑑 𝑧 = 𝑔(𝑦)

• NAND.
• (+,×) over ℤ2 (= binary 𝑌𝑃𝑆, 𝐵𝑂𝐸 )

𝐹𝑜𝑑𝑞𝑙(𝑦)

Fully Homomorphic = Correctness for any efficient 𝑔 = Correctness for universal set

Trivial FHE?

PKE ⇒ “FHE”:

• 𝐿𝑓𝑧𝑕𝑓𝑜 and 𝐹𝑜𝑑: Same as PKE.
• 𝐹𝑤𝑏𝑚𝐺𝐼𝐹 𝑔, 𝑑 ≜ (𝑔, 𝑑)
• 𝐸𝑓𝑑𝑡𝑙

𝐺𝐼𝐹 (𝑔, 𝑑) ≜ 𝑔(𝐸𝑓𝑑𝑡𝑙(𝑑))

NOT what we were looking for…

All work is relayed to receiver.

Compact FHE: 𝐸𝑓𝑑 time does not depend on ciphertext. ⇒ ciphertext length is globally bounded.

In this talk (and in literature) FHE ≜ Compact-FHE

𝐹𝑜𝑑 (𝑦)

= 𝑔 𝐸𝑓𝑑𝑡𝑙 𝐹𝑜𝑑 𝑦 = 𝑔(𝑦)

Trivial FHE?

PKE ⇒ “FHE”:

• 𝐿𝑓𝑧𝑕𝑓𝑜 and 𝐹𝑜𝑑: Same as PKE.
• 𝐹𝑤𝑏𝑚𝐺𝐼𝐹 𝑔, 𝑑 ≜ (𝑔, 𝑑)
• 𝐸𝑓𝑑𝑡𝑙

𝐺𝐼𝐹 (𝑔, 𝑑) ≜ 𝑔(𝐸𝑓𝑑𝑡𝑙(𝑑))

This “scheme” also completely reveals 𝑔 to the receiver. Can be a problem. Circuit Privacy: Receiver learns nothing about 𝑔 (except output). In this talk: Only care about compactness, no more circuit privacy. Circuit private FHE is not trivial to achieve – even non-compact. Compactness ⇒ Circuit Privacy (by complicated reduction) [GHV10]

Applications

In the cloud:

• Private outsourcing of computation.
• Near-optimal private outsourcing of storage (single-server PIR). [G09,BV11b]
• Verifiable outsourcing (delegation). [GGP11,CKV11]
• Private machine learning in the cloud. [GLN12,HW13]

Secure multiparty computation:

• Low-communication multiparty computation. [AJLTVW12,LTV12]
• More efficient MPC. [BDOZ11,DPSZ12,DKLPSS12]

Primitives:

• Succinct argument systems. [GLR11,DFH11,BCCT11,BC12,BCCT12,BCGT13,…]
• General functional encryption. [GKPVZ12]
• Indistinguishability obfuscation for all circuits. [GGHRSW13]

Verifiable Outsourcing (Delegation)

Can send wrong value of 𝑔(𝑦) .

𝑦 𝑔 𝑔(𝑦) 𝑦

What if the server is cheating? Need proof!

, 𝜌

FHE ⇒ Verifiable Outsourcing

FHE ⇒ Verifiability and Privacy.

Pre-FHE solutions: multiple rounds [K92] or random oracles [M94].

• 1. Verifiability with preprocessing under “standard”

assumptions: [GGP10, CKV10].

• 2. Less standard assumptions but without preprocessing via

SNARGs/SNARKs [DCL08,BCCT11,…] (uses FHE or PIR).

FHE ⇒ Verifiable Outsourcing [CKV10]

𝑦 𝑔 𝑡𝑙 , 𝑞𝑙 𝑓𝑤𝑙 𝑑𝑦 = 𝐹𝑜𝑑 𝑦 , 𝑑0 𝑧𝑦, 𝑧0 Check 𝑧0 = 𝑨0?

Yes ⇒ output 𝐸𝑓𝑑(𝑧𝑦) No ⇒ output ⊥ Preprocessing: 𝑑0 = 𝐹𝑜𝑑(0) 𝑨0 = 𝐹𝑤𝑏𝑚(𝑔, 𝑑0)

Verification:

Idea: “Cut and choose”

𝑑𝑦, 𝑑0 look the same ⇒ cheating server will be caught w.p. ½

(easily amplifiable)

But preprocessing is as hard as computation!

Server executes 𝑧 = 𝐹𝑤𝑏𝑚(𝑔, 𝑑)

FHE ⇒ Verifiable Outsourcing [CKV10]

𝑦 𝑔 𝑡𝑙 , 𝑞𝑙 𝑓𝑤𝑙 (𝑓𝑤𝑙′′, 𝐹𝑜𝑑′′ 𝑑𝑦 ), (𝑓𝑤𝑙′, 𝐹𝑜𝑑′ 𝑑0 ) 𝑧′′𝑦, 𝑧′0 Check 𝐸𝑓𝑑′(𝑧′0) = 𝑨0?

Yes ⇒ output 𝐸𝑓𝑑′′(𝐸𝑓𝑑 𝑧𝑦 ) No ⇒ output ⊥ Preprocessing: 𝑑0 = 𝐹𝑜𝑑(0) 𝑨0 = 𝐹𝑤𝑏𝑚(𝑔, 𝑑0)

Verification:

Idea: Outer layer keeps server “oblivious” of 𝑨0.

⇒ Can recycle 𝑨0 for future computations.

Server executes 𝑧′ = 𝐹𝑤𝑏𝑚′(𝐹𝑤𝑏𝑚 𝑔,⋅ , 𝑑′) 𝑧′′ = 𝐹𝑤𝑏𝑚′′(𝐹𝑤𝑏𝑚 𝑔,⋅ , 𝑑′′) Server is not allowed to know if we accept/reject!

FHE Timeline

30 years of hardly scratching the surface:

• Only-addition [RSA78, R79, GM82,

G84, P99, R05].

• Addition + 1 multiplication

[BGN05, GHV10].

• Other variants [SYY99, IP07,

MGH10].

… is it even possible?

Basic scheme: Ideal cosets in polynomial rings.

⇒ Bounded-depth homomorphism.

• Assumption: hardness of (quantum) apx. short

vector in ideal lattice.

Bootstrapping: bounded-depth HE ⇒ full HE.

But bootstrapping doesn’t apply to basic scheme...

• Need additional assumption: hardness of sparse

subset-sum.

The FHE Challenge

Make it more secure. Make it simpler. Make it practical.

Optimizations [SV10,SS10,GH10]

Simplified basic scheme [vDGHV10,BV11a]

• Under similar assumptions.

?

FHE without Ideals [BV11b]

Linear algebra instead of polynomial rings

Assumption: Apx. short vector in arbitrary lattices (via LWE).

Fundamental algorithmic problem – extensively studied.

[LLL82,K86,A97,M98,AKS03,MR04,MV10]

Shortest-vector Problem (SVP):

FHE without Ideals [BV11b]

• Simpler: straightforward presentation.
• More secure: based on a standard assumption.
• Efficiency improvements.

Linear algebra instead of polynomial rings

Assumption: Apx. short vector in arbitrary lattices (via LWE).

• Basic scheme: noisy linear equations over ℤ𝑟.

– Ciphertext is a linear function 𝑑(𝑦) s.t. 𝑑 𝑡𝑙 ≈ 𝑛 . – Add/multiply functions for homomorphism. – Multiplication raises degree ⇒ use relinearization.

• Bootstrapping: Use dimension-modulus reduction to shrink

ciphertexts.

Concurrently [GH11]: Ideal lattice based scheme without squashing.

FHE without Ideals

Follow-ups:

• [BGV12]: Improved parameters.

– Even better security. – Improved efficiency in ring setting using “batching”. – Batching without ideals in [BGH13].

• [B12]: Improved security.

– Security based on classical lattice assumptions. – Explained in blog post [BB12].

Various optimizations, applications and implementations:

[LNV11, GHS12a, GHS12b, GHS12c, GHPS12, AJLTVW12, LTV12, DSPZ12, FV12, GLN12, BGHWW12,HW13 …]

The “Approximate Eigenvector” Method [GSW13]

• Basic scheme: Approximate eigenvector over ℤ𝑟.

– Ciphertext is a matrix 𝐷 s.t. 𝐷 ⋅ 𝑡𝑙 ≈ 𝑛 ⋅ 𝑡𝑙 . – Add/multiply matrices for homomorphism*.

• Bootstrapping: Same as previous schemes.

Ciphertexts = Matrix

Same assumption and keys as before – ciphertexts are different

• Simpler: straightforward presentation.
• New and exciting applications “for free”! IB-FHE, AB-FHE.
• Same security as [BGV12, B12].
• Unclear about efficiency: some advantages, some drawbacks.

Sequentialization [BV13]

What is the best way to evaluate a product of 𝑙 numbers? X X X X

vs.

X X

Parallel Sequential c1 c2 c3 c4 c1 c2 c3 c4

Conventional wisdom Actually better

(if done right)

Sequentialization [BV13]

Barrington’s Theorem [B86]: Every depth 𝑒 computation can be transformed into a width-5 depth 4𝑒 branching program.

A sequential model of computation

• Better security – breaks barrier of [BGV12, B12,GSW13].
• Using dimension-modulus reduction (from [BV11b]) ⇒ same

hardness assumption as non homomorphic encryption.

• Short ciphertexts.

Efficiency

Standard benchmark: AES128 circuit Implementations of [BGV12] by [GHS12c,CCKLLTY13] ≈5 min/input

Limiting factors:

• Circuit representation.
• Bootstrapping.
• Key size.

⇒ To be practical, we need to improve the theory.

2-years ago it was 3 min/gate [GH10]

New works [GSW13,BV13] address some of these issues, but have other drawbacks

See also HElib https://github.com/shaih/HElib

Hybrid FHE

• In known FHE encryption is slow and ciphertexts are long.
• In symmetric encryption (e.g. AES) these are better.

𝑦 𝑔 𝑧 = 𝐹𝑤𝑏𝑚𝑓𝑤𝑙(𝑔, 𝐹𝑜𝑑 𝑦 ) 𝐹𝑜𝑑𝑞𝑙(𝑦) 𝐸𝑓𝑑𝑡𝑙 𝑧 = 𝑔(𝑦) 𝑡𝑙 , 𝑞𝑙 𝑓𝑤𝑙

Best of both worlds?

Hybrid FHE

𝑦 𝑔 𝐸𝑓𝑑𝑡𝑙 𝑧 = 𝑔(𝑦) 𝑡𝑙 , 𝑞𝑙 𝑓𝑤𝑙 𝑡𝑧𝑛 c=𝐹𝑜𝑑𝑡𝑧𝑛(𝑦) 𝐹𝑜𝑑𝑞𝑙(𝑡𝑧𝑛)

Easy to encrypt, ciphertext is short… But how to do Eval?

Define: 𝑖 𝑨 = 𝑇𝑍𝑁_𝐸𝑓𝑑𝑨(𝑑) Server Computes: 𝑧′ = 𝐹𝑤𝑏𝑚𝑓𝑤𝑙(𝑖, 𝐹𝑜𝑑𝑞𝑙(𝑡𝑧𝑛))

⇒ 𝑧′ = 𝐹𝑜𝑑 𝑖 𝑡𝑧𝑛

= 𝐹𝑜𝑑 𝑇𝑍𝑁_𝐸𝑓𝑑𝑡𝑧𝑛 𝑑 = 𝐹𝑜𝑑𝑞𝑙(𝑦) 𝑧 = 𝐹𝑤𝑏𝑚𝑓𝑤𝑙(𝑔, 𝑧′)

Approximate Eigenvector Method [GSW13]

Observation: Let 𝐷1, 𝐷2 be matrices with the same eigenvector 𝑡 , and let 𝑛1, 𝑛2 be their respective eigenvalues w.r.t 𝑡 . Then:

• 1. 𝐷1 + 𝐷2 has eigenvalue (𝑛1+𝑛2) w.r.t 𝑡

.

• 2. 𝐷1 ⋅ 𝐷2 (and also 𝐷2 ⋅ 𝐷1) has eigenvalue 𝑛1𝑛2 w.r.t 𝑡

. Idea: 𝑡 = secret key, 𝐷 = ciphertext, and 𝑛 = message.

Insecure! Eigenvectors are easy to find. What about approximate eigenvectors?

⇒ Homomorphism for addition and multiplication. ⇒ Full homomorphism!

Say over ℤ𝑟

Approximate Eigenvector Method [GSW13]

𝐷 ⋅ 𝑡 = 𝑛𝑡 + 𝑓 ≈ 𝑛𝑡

How to decrypt? Must have restriction on 𝑓 Suppose 𝑡 [1] = 𝑟/2 , and 𝑛 ∈ *0,1+

⇒ (𝐷 ⋅ 𝑡

)[1] =

𝑟 2 𝑛 + 𝑓

[1] Find 𝑛 by rounding

Condition for correct decryption: 𝑓 < 𝑟/4 .

Approximate Eigenvector Method [GSW13]

𝐷1 ⋅ 𝑡 = 𝑛1𝑡 + 𝑓 1 𝑓 1 ≪ 𝑟 𝐷2 ⋅ 𝑡 = 𝑛2𝑡 + 𝑓 2 𝑓 2 ≪ 𝑟 𝐷𝑏𝑒𝑒 = 𝐷1 + 𝐷2: (𝐷1+𝐷2) ⋅ 𝑡 = 𝐷1𝑡 + 𝐷2𝑡 = 𝑛1𝑡 + 𝑓 1 + 𝑛2𝑡 + 𝑓 2 = (𝑛1+𝑛2)𝑡 + (𝑓 1+𝑓 2) 𝑓 𝑏𝑒𝑒 Goal: 𝐷1, 𝐷2 ⇒ 𝐷𝑏𝑒𝑒 = 𝐹𝑜𝑑(𝑛1 + 𝑛2) , 𝐷𝑛𝑣𝑚𝑢 = 𝐹𝑜𝑑(𝑛1𝑛2).

Noise grows a little

Approximate Eigenvector Method [GSW13]

𝐷1 ⋅ 𝑡 = 𝑛1𝑡 + 𝑓 1 𝑓 1 ≪ 𝑟 𝐷2 ⋅ 𝑡 = 𝑛2𝑡 + 𝑓 2 𝑓 2 ≪ 𝑟 𝐷𝑛𝑣𝑚𝑢 = 𝐷1 ⋅ 𝐷2: (𝐷1⋅ 𝐷2) ⋅ 𝑡 = 𝐷1 𝑛2𝑡 + 𝑓 2 = 𝑛2𝐷1𝑡 + 𝐷1𝑓 2 = 𝑛2 𝑛1𝑡 + 𝑓 1 + 𝐷1𝑓 2 𝑓 𝑛𝑣𝑚𝑢

Noise grows. But by how much? Can also use 𝐷2 ⋅ 𝐷1

= 𝑛2𝑛1𝑡 + 𝑛2𝑓 1 + 𝐷1𝑓 2 Goal: 𝐷1, 𝐷2 ⇒ 𝐷𝑏𝑒𝑒 = 𝐹𝑜𝑑(𝑛1 + 𝑛2) , 𝐷𝑛𝑣𝑚𝑢 = 𝐹𝑜𝑑(𝑛1𝑛2).

Plan for Technical Part

• 1. Constructing approximate eigenvector scheme.
• 2. Sequentialization.
• 3. Bootstrapping.
• 4. Open problems and limits on FHE.

Learning with Errors (LWE) [R05]

Random noisy linear equations ≈ uniform

𝐵

𝑡

𝑐 =

+

uniform matrix ∈ ℤ𝑟

𝑁×𝑜

secret vector ∈ ℤ𝑟

𝑜

small noise ∈ ℤ𝑟

𝑛

𝜃𝑗 ≤ 𝛽𝑟

ℤ𝑟

𝑁

𝐵

𝑐

• stat. far from uniform!

≈ 𝑉

LWE assumption

As hard as 𝑜/𝛽 -apx. short vector in worst case 𝑜-dim. lattices

[R05, P09]

Encryption Scheme from LWE

[R05,ACPS09] −𝐵

𝑐 𝑠 𝑑

𝑕

=

𝐵

𝑡

𝑐 =

+

public key

+

𝑕

0,1 𝑁 uniform

𝑡

𝑑

𝑕

1

secret key

=

𝑠 ⋅ 𝜃 + 𝑕 ⋅ 𝑡

“encryption” of 𝒉 ⋅ 𝒕 (without knowing 𝑡 ) [ACPS09] small “noise”

Looks jointly uniform

Encryption Scheme from LWE

[R05,ACPS09] −𝐵

𝑐 𝑆 𝐷𝐻 =

𝐵

𝑡

𝑐 =

+ +

𝐻

0,1 𝑙×𝑁 uniform

𝑡

1

= 𝑆𝜃 + 𝐻𝑡 𝐷𝐻

= 𝑓 small “noise” ℤ𝑟

𝑙×(𝑜+1)

• Approx. Eigenvector Encryption

Goal: Encrypt message 𝑛 ∈ *0,1+ Idea: 𝐹𝑜𝑑 𝑛 = 𝐷𝑛⋅𝐽 ⇒ 𝐷𝑛⋅𝐽 ⋅ 𝑡 = 𝑓 + 𝑛𝐽𝑡 = 𝑛 ⋅ 𝑡 + 𝑓 As we saw: 𝐷1 ⋅ 𝐷2 ⋅ 𝑡 = 𝐷1 ⋅ 𝑓 2 + 𝑛2𝑡 = 𝐷1 ⋅ 𝑓 2 + 𝑛2 ⋅ 𝐷1 ⋅ 𝑡 = 𝐷1 ⋅ 𝑓 2 + 𝑛2𝑓 1 + 𝑛1𝑛2𝑡

desired

• utput

small noise HUGE noise

Need to reduce the norm of 𝐷1 Solution: binary decomposition

Binary Decomposition

Break each entry in 𝐷 to its binary representation

𝐷 = 3 5 1 4 (𝑛𝑝𝑒 8) 𝑐𝑗𝑢𝑡 𝐷 = 0 1 1 1 1 1 1 0 (𝑛𝑝𝑒 8)

⇒

Small entries like we wanted! But product with 𝑡 now meaningless

Consider the “reverse” operation: 𝑐𝑗𝑢𝑡 𝐷 ⋅ 4 2 1 4 2 1 = 𝐷

𝐻

⇒

𝐷 ⋅ 𝑡 = 𝑐𝑗𝑢𝑡(𝐷) ⋅ 𝐻 ⋅ 𝑡 = 𝑐𝑗𝑢𝑡(𝐷) ⋅ 𝑡 ∗ 𝑡 ∗ = 𝐻 ⋅ 𝑡 “powers of 2” vector Contains 𝑟/2 as an element

• Approx. Eigenvector Encryption

𝐹𝑜𝑑 𝑛 = 𝐷𝑛⋅𝐻 ∈ ℤ𝑟

( 𝑜+1 log 𝑟)×(𝑜+1)

⇒ 𝐷𝑛⋅𝐻 ⋅ 𝑡 = 𝑓 + 𝑛 ⋅ 𝐻 ⋅ 𝑡

𝑐𝑗𝑢𝑡(𝐷1) ⋅ 𝐷2 ⋅ 𝑡 = 𝑐𝑗𝑢𝑡(𝐷1) ⋅ 𝑓 2 + 𝑛2𝐻𝑡 = 𝑐𝑗𝑢𝑡 (𝐷1) ⋅ 𝑓 2 + 𝑛2 ⋅ 𝑐𝑗𝑢𝑡(𝐷1) ⋅ 𝐻 ⋅ 𝑡 = 𝑐𝑗𝑢𝑡 (𝐷1) ⋅ 𝑓 2 + 𝑛2 ⋅ 𝐷1 ⋅ 𝑡 = 𝑐𝑗𝑢𝑡 (𝐷1) ⋅ 𝑓 2 + 𝑛2 ⋅ 𝑓 1 + 𝑛1 ⋅ 𝑛2 ⋅ 𝐻 ⋅ 𝑡

desired output small small-ish

𝑓 𝑛𝑣𝑚𝑢 ≤ 𝑂 ⋅ 𝑓 2 + 𝑛2 ⋅ 𝑓 1 ≤ 𝑂 + 1 ⋅ max* 𝑓 1 , 𝑓 2 +

𝑂

𝐷𝑛𝑣𝑚𝑢 = 𝑐𝑗𝑢𝑡 𝐷1 ⋅ 𝐷2

𝑐𝑗𝑢𝑡(𝐷1) ⋅ 𝐷2 ⋅ 𝑡

𝐷𝑜𝑏𝑜𝑒 = 𝐻 − 𝑐𝑗𝑢𝑡 𝐷1 ⋅ 𝐷2

𝑓 𝑜𝑏𝑜𝑒 ≤ 𝑂 ⋅ 𝑓 2 + 𝑛2 ⋅ 𝑓 1 ≤ 𝑂 + 1 ⋅ max* 𝑓 1 , 𝑓 2 +

. =

Homomorphic Circuit Evaluation

𝑓 𝑝𝑣𝑢𝑞𝑣𝑢 ≤ 𝑂 + 1 𝑒 ⋅ 𝑁𝛽𝑟 ≈ 𝑂𝑒𝛽𝑟 𝑓 𝑗𝑜𝑞𝑣𝑢 ≤ 𝑁𝛽𝑟

𝑓 𝑗𝑜𝑞𝑣𝑢 𝑓 𝑝𝑣𝑢𝑞𝑣𝑢

Noise grows during homomorphic evaluation

Depth 𝑒

𝑓 𝑗+1 ≤ (𝑂 + 1) 𝑓 𝑗

…

⇒ Decryption succeeds if 𝛽 ≪ 1/𝑂𝑒.

Full Homomorphism

𝛽 ≤ 𝑂−𝑒 𝑒ℎ𝑝𝑛 ≈ log 1/𝛽

• 1. If depth upper-bound is known ahead of time.
• 2. Single scheme for any poly depth.

Set 𝑂 ≥ 𝑒2 ; 𝛽 = 2− 𝑂 ⇒ log 1/𝛽 = 𝑒

Undesirable:

• Huge parameters.
• Low security.
• Inflexible.

Leveled FHE: Parameters (𝑓𝑤𝑙) grow with 𝑒.

Bootstrap!

The Bootstrapping Theorem

Homomorphic ⇒ fully homomorphic when 𝑒𝑒𝑓𝑑 < 𝑒ℎ𝑝𝑛

• 𝑒𝑒𝑓𝑑 = depth of the decryption circuit.
• 𝑒ℎ𝑝𝑛 = maximal homomorphic depth.

In our scheme: 𝑒𝑒𝑓𝑑 = log 𝑂 ⇒ FHE if 𝛽 < 𝑂− log 𝑂

Quasi-polynomial approximation for short vector problems (same factor as [BGV12,B12]) Non-homomorphic schemes only need 𝑂𝑃 1 approximation (Proof to come)

Additional condition, to be discussed.

A Taste of Sequentialization [BV13]

𝑓 𝑛𝑣𝑚𝑢 = 𝑐𝑗𝑢𝑡 (𝐷1) ⋅ 𝑓 2 + 𝑛2 ⋅ 𝑓 1 Asymmetric! Important observations:

• 1. 𝑓

1 gets multiplied by 0/1 ; 𝑓 2 can get multiplied by 𝑂.

• 2. 𝑛2 = 0 ⇒ 𝑓

1 has no effect! Conclusion: The order of multiplication matters. Want to multiply 𝐷

𝐵, 𝐷𝐶 s.t. 𝑓

𝐵 ≫ 𝑓 𝐶 . Which is better: 𝑐𝑗𝑢𝑡 𝐷𝐵 ⋅ 𝐷𝐶 or 𝑐𝑗𝑢𝑡 𝐷𝐶 ⋅ 𝐷

𝐵 ?

A Taste of Sequentialization [BV13]

𝑓 𝑛𝑣𝑚𝑢 = 𝑐𝑗𝑢𝑡 (𝐷1) ⋅ 𝑓 2 + 𝑛2 ⋅ 𝑓 1 Task: Multiply 4 ciphertexts 𝐷1, … , 𝐷4 Multiplication Tree X X X

c1 c2 c3 c4 𝑓 = 𝐹0 𝑓 = 𝐹0(𝑂 + 1) 𝑓 = 𝐹0 𝑂 + 1 2

X X X

c1 c2 c3 c4 𝑓 = 𝐹0 𝐹0(𝑂 + 1) 𝐹0 𝐹0 𝐹0(2𝑂 + 1) 𝐹0(3𝑂 + 1)

Sequential Multiplier

Winner!

Bootstrapping

Homomorphic ⇒ fully homomorphic when 𝑒𝑒𝑓𝑑 < 𝑒ℎ𝑝𝑛

• 𝑒𝑒𝑓𝑑 = depth of the decryption circuit.
• 𝑒ℎ𝑝𝑛 = maximal homomorphic depth.

Bootstrapping

Given scheme with bounded 𝑒ℎ𝑝𝑛 How to extend its homomorphic capability?

Idea: Do a few operations, then “switch” to a new instance

(𝑞𝑙2, 𝑡𝑙2) (𝑞𝑙3, 𝑡𝑙3) (𝑞𝑙1, 𝑡𝑙1)

Switch keys

“cost” in homomorphism

How to Switch Keys

We have seen this before! Hybrid FHE

Hybrid FHE

𝑦 𝑔 𝐸𝑓𝑑𝑡𝑙 𝑧 = 𝑔(𝑦) 𝑡𝑙 , 𝑞𝑙 𝑓𝑤𝑙 𝑡𝑧𝑛 c=𝐹𝑜𝑑𝑡𝑧𝑛(𝑦) 𝐹𝑜𝑑𝑞𝑙(𝑡𝑧𝑛) Define: 𝑖 𝑨 = 𝑇𝑍𝑁_𝐸𝑓𝑑𝑨(𝑑) Server Computes: 𝑧′ = 𝐹𝑤𝑏𝑚𝑓𝑤𝑙(𝑖, 𝐹𝑜𝑑𝑞𝑙(𝑡𝑧𝑛))

⇒ 𝑧′ = 𝐹𝑜𝑑 𝑖 𝑡𝑧𝑛

= 𝐹𝑜𝑑 𝑇𝑍𝑁_𝐸𝑓𝑑𝑡𝑧𝑛 𝑑 = 𝐹𝑜𝑑𝑞𝑙(𝑦) 𝑧 = 𝐹𝑤𝑏𝑚𝑓𝑤𝑙(𝑔, 𝑧′)

How to Switch Keys

𝐸𝑓𝑑𝑡𝑙(⋅) 𝐸𝑓𝑑 ⋅ (𝑑) 𝑑 𝑡𝑙 𝑛 𝑛 Decryption circuit: Dual view: ≡ 𝑖𝑑 ⋅ 𝑖𝑑 𝑡𝑙 = 𝐸𝑓𝑑𝑡𝑙 𝑑 = 𝑛

Key switching procedure 𝑡𝑙1, 𝑞𝑙1 → 𝑡𝑙2, 𝑞𝑙2 :

Input: 𝑑 = 𝐹𝑜𝑑𝑞𝑙1(𝑛) Server aux info: 𝑏𝑣𝑦 = 𝐹𝑜𝑑𝑞𝑙2(𝑡𝑙1) (ahead of time) Output: 𝐹𝑤𝑏𝑚𝑞𝑙2(𝑖𝑑, 𝑏𝑣𝑦) 𝐹𝑤𝑏𝑚𝑞𝑙2 𝑖𝑑, 𝑏𝑣𝑦 = 𝐹𝑤𝑏𝑚𝑞𝑙2 𝑖𝑑, 𝐹𝑜𝑑𝑞𝑙2 𝑡𝑙1 = 𝐹𝑜𝑑𝑞𝑙2 𝑖𝑑 𝑡𝑙1 = 𝐹𝑜𝑑𝑞𝑙2 𝐸𝑓𝑑𝑡𝑙1 𝑑 = 𝐹𝑜𝑑𝑞𝑙2(𝑛) Eval depth = 𝑒𝑒𝑓𝑑

Bootstrapping

Given scheme with bounded 𝑒ℎ𝑝𝑛. How to extend its homomorphic capability?

Idea: Do a few operations, then “switch” to a new instance

(𝑞𝑙2, 𝑡𝑙2) (𝑞𝑙3, 𝑡𝑙3) (𝑞𝑙1, 𝑡𝑙1)

Switch keys

“cost” of 𝑒𝑒𝑓𝑑

• hom. operations

Conclusion: Bootstrapping if 𝑒ℎ𝑝𝑛 ≥ 𝑒𝑒𝑓𝑑 + 1

Need to generate many keys…

Bootstrapping

Given scheme with bounded 𝑒ℎ𝑝𝑛. How to extend its homomorphic capability?

Idea: Do a few operations, then “switch” to a new instance

(𝑞𝑙 , 𝑡𝑙 ) (𝑞𝑙 , 𝑡𝑙 ) (𝑞𝑙 , 𝑡𝑙 )

Switch from the key to itself! Key switching works Server aux info: 𝑏𝑣𝑦 = 𝐹𝑜𝑑𝑞𝑙 (𝑡𝑙 )

Circular Security

Intuitively: Yes, encryption hides the message. Formally: Security does not extend.

What can we do about it?

Option 1: Assume it’s secure – no attack is known. Option 2: Use a sequence of keys. ⇒ No. of keys proportional to computation depth (leveled FHE).

Is it secure to publish 𝑏𝑣𝑦 = 𝐹𝑜𝑑𝑞𝑙(𝑡𝑙)

[BV11a]: Circular secure “somewhat” homomorphic scheme.

Short keys without circular assumption ?

Diversity

• Other (older) schemes with similar properties

[AD97, GGH97, R03, R05, …] ⇒ homomorphism

But all are lattice based

• [BL11] FHE from a noisy decoding problem.

[B13]: Homomorphicly “clean up” the noise ⇒ break security. ⇒ “Too much” homomorphism is a bad sign.

What We Saw Today

• Definition of FHE.
• Applications.
• Historical perspective and background.
• Constructing HE using the approximate eigenvector

method.

• Sequentialization.
• Bootstrapping.
• Limits on HE.

Open Problems

• Short keys without circular security.
• FHE from different assumptions.
• CCA1 secure FHE.
• Bounded malleability.
• Improved efficiency.

Thank You