Sparse-secret Ring-LWE in FHE: Is It Really Needed? Ilia Iliashenko - PowerPoint PPT Presentation

Sparse-secret Ring-LWE in FHE: Is It Really Needed? Ilia Iliashenko (joint work with Hao Chen, Kim Laine, Yongsoo Song) Lattice Coding & Crypto Meeting, Royal Holloway 20 Nov

Learning with Errors (LWE) 𝒄 = 𝑩 ⋅ 𝒕 + 𝒇 0×2 is uniformly random, 𝒕 ∈ ℤ / 0 and 𝒇 ∈ ℤ / 0 is small. 𝑩 ∈ ℤ / Decision: distinguish between (𝑩, 𝒄) and uniformly random (𝑵, 𝒘) . Search: find 𝒕 .

Sample 𝒕 and 𝒇 coefficient-wise 𝒕 𝟏 𝒕 𝟐 … 𝒕 𝒐6𝟐 𝒄 = 𝑩 ⋅ 𝒕 + 𝒇 Uniformly random 𝑉 8 over 0,1 0 . Uniformly random 𝑉 < over −1,0,1 0 . 0 . Uniformly random 𝑉 / over ℤ / 0 . Discrete Gaussian 𝒠 / over ℤ /

Hardness of LWE 𝒕 𝟏 𝒕 𝟐 … 𝒕 𝒐6𝟐 𝒄 = 𝑩 ⋅ 𝒕 + 𝒇 Uniformly random 𝑉 8 over 0,1 0 . Uniformly random 𝑉 < over −1,0,1 0 . 0 . Uniformly random 𝑉 / over ℤ / 0 . Discrete Gaussian 𝒠 / over ℤ / 𝒕 ← 𝑉 / , or 𝑉 8 , or 𝒠 / LWE is as hard as classical lattice problems (GapSVP, DGS) 𝒇 ← 𝒠 / with 𝜏 ∈ Ω 𝑜

Sparse-secret LWE 𝒕 𝟏 𝒕 𝟐 … 𝒕 𝒐6𝟐 𝒄 = 𝑩 ⋅ 𝒕 + 𝒇 Uniformly random 𝑉 8 over 0,1 0 . Uniformly random 𝑉 < over −1,0,1 0 . 0 . Uniformly random 𝑉 / over ℤ / 0 . Discrete Gaussian 𝒠 / over ℤ / 𝒕 ← 𝑉 < ℎ : 𝑥𝑢 𝒕 = ℎ ??? 𝒇 ← 𝒠 /

Ring-LWE 𝒃 𝟏 −𝒃 𝒐6𝟐 … 𝒃 𝟐 𝒃 𝟏 𝒄 = ⋅ 𝒕 + 𝒇 𝒃 𝟑 𝒃 𝟐 … … 𝒃 𝒐6𝟐 𝒃 𝒐6𝟑

Ring-LWE 𝑐 = 𝑏 ⋅ 𝑡 + 𝑓 𝑏, 𝑐, 𝑡, 𝑓 ∈ 𝑆 / = ℤ[𝑌]/(𝑟, 𝑌 0 + 1) ( 𝑜 must be a power of two)

Hardness of Ring-LWE 𝑐 = 𝑏 ⋅ 𝑡 + 𝑓 𝑏, 𝑐, 𝑡, 𝑓 ∈ 𝑆 / = ℤ[𝑌]/(𝑟, 𝑌 0 + 1) ( 𝑜 must be a power of two) 𝑡 ← 𝑉 / or 𝒠 / Ring-LWE is at least as hard as SIVP

Attacks on sparse-secret LWE Albrecht, Eurocrypt’17 Albrecht et al., Asiacrypt ’17 Cheon et al., IEEE Access’19 Curtis and Player, WAHC’19 Cheon and Son, WAHC’19 …

Efficient FHE schemes need sparse secrets for bootstrapping plaintext computation bootstrapping noise Bootstrapping performs decryption homomorphically.

Efficient FHE schemes need sparse secrets for bootstrapping Multiplicative depth of bootstrapping depends on 𝑥𝑢 𝑡 : • FV: log 𝑥𝑢 𝑡 + log(log 𝑥𝑢 𝑡 + log 𝑢) • BGV: log 𝑥𝑢 𝑡 + log 𝑢 Reference: Chen and Han, Eurocrypt’18 TFHE bootstrapping does not have this dependency.

Approximate HE 𝑑𝑢 𝑛 Z ⋆ 𝑑𝑢 𝑛 8 = 𝑑𝑢 ≃ 𝑛 Z ⊙ 𝑛 8

Approximate HE (HEAAN/CKKS) Idea: consider ciphertext noise as a part of a message. Decrypt 𝑑𝑢 = 𝑛 + 𝑓 ≃ 𝑛. Reference: Cheon et al., Asiacrypt’17

HEAAN bootstrapping computation Mult plaintext noise undecryptable

HEAAN bootstrapping computation bootstrapping plaintext noise

HEAAN “bootstrapping” bootstrapping plaintext is lost

HEAAN “bootstrapping” Correctness of Homomorphic Encryption HE scheme 𝐹 is correct for a circuit 𝐷 if for any plaintexts 𝜌 Z , … , 𝜌 k it holds: If ct = Evaluate e (𝐷, Enc 𝜌 Z , … , Enc 𝜌 k ) , bootstrapping then Dec e 𝑑𝑢 = 𝐷 𝜌 Z , … , 𝜌 k . Bootstrappable Encryption Scheme Let 𝐷 e be the set of circuits that 𝐹 can plaintext is lost compactly and correctly evaluate. We say that 𝐹 is bootstrappable with the respect to gate Γ if 𝐸𝑓𝑑 e Γ ⊆ 𝐷 e .

HEAAN “bootstrapping” Correctness of Homomorphic Encryption HE scheme 𝐹 is correct for a circuit 𝐷 if for any plaintexts 𝜌 Z , … , 𝜌 k it holds: If ct = Evaluate e (𝐷, Enc 𝜌 Z , … , Enc 𝜌 k ) , bootstrapping then Dec e 𝑑𝑢 = 𝐷 𝜌 Z , … , 𝜌 k . Bootstrappable Encryption Scheme Let 𝐷 e be the set of circuits that 𝐹 can plaintext is lost compactly and correctly evaluate. We say that 𝐹 is bootstrappable with the respect to gate Γ if 𝐸𝑓𝑑 e Γ ⊆ 𝐷 e .

HEAAN works with complex vectors ℂ 0 ℂ 0/8 𝑨 Z 𝑨 8 … 𝑨 0/8 𝑨 Z … 𝑨 0/8 𝑨 0/8 … 𝑨 Z s Inverse DFT* 𝑌 u 𝑌 06Z … ⌊ ⌉ … ⌊ ⌉ Δ ⋅ 𝑤 u Δ ⋅ 𝑤 06Z 𝑤 u … 𝑤 06Z ℝ 0 𝑆 / *with primitive roots of unity

How to encode less than 𝑜/2 values? ℂ { ℤ[𝑍] 𝑍 u 𝑍 Z 𝑍 8{6Z … 𝑨 Z 𝑨 8 … 𝑨 { 𝑤 u 𝑤 Z … 𝑤 8{6Z 𝑛 must divide n /2 𝑍 ↦ 𝑌 0/8{ 𝑌 (0/8{)(8{6Z) 𝑌 u 𝑌 0/8{ 𝑤 u 0 … 𝑤 Z … 𝑤 8{6Z … 0 𝑆 /

Decoding 𝑌 u 𝑌 06Z 𝑌 u 𝑌 06Z computation ~ ~ 𝑏 u … 𝑏 06Z 𝑏 u … 𝑏 06Z DFT* 1/∆ ~ ∆ ~ ⋅ 𝒜 𝟐 + 𝒇 𝟐 ∆ ~ ⋅ 𝒜 𝒐/𝟑 + 𝒇 𝒐/𝟑 ≈ 𝑨 Z … ≈ 𝑨 0/8 … *with primitive roots of unity

Rotation of encoded vectors 𝑌 u 𝑌 u 𝑌 06Z 𝑌 06Z 𝑌 → 𝑌 „ … 𝑆 / 𝑏 u … 𝑏 06Z 𝑐 u … 𝑐 06Z ℂ ‚/8 𝑨 †‡Z 𝑨 †‡8 … 𝑨 † 𝑨 Z 𝑨 8 … 𝑨 0/8

Rotation of encoded vectors 𝑌 u 𝑌 u 𝑌 06Z 𝑌 06Z 𝑌 → 𝑌 „ ˆ 𝑆 / 𝑏 u … 𝑏 06Z 𝑐 u … 𝑐 06Z ℂ { 𝑨 Z 𝑨 8 … 𝑨 { 𝑨 Z 𝑨 8 … 𝑨 { Š Rotations by 𝑙𝑛 slots are automorphisms of 𝑆 fixing 𝑆 ~ = ℤ 𝑌 ‹ˆ /(𝑟, 𝑌 0 + 1) , 𝑆 ~ ⊂ 𝑆.

Key generation, encryption and decryption Key generation 𝒠 / 𝑉 < (ℎ) 𝑉 / 𝑏 − 𝑓 + 𝑡 ⋅ = 𝑐 secret key public key

Key generation, encryption and decryption Key generation Encryption Given a public key 𝑞𝑙 and an encoding 𝑛 ∈ 𝑆 / compute 𝒠 / 𝒠 / 𝑉 < 𝒠 / 𝑉 < (ℎ) 𝑉 / 𝑛 + 𝑣 ⋅ 𝑞𝑙 • + 𝑓 u 𝑣 ⋅ 𝑞𝑙 • + 𝑓 Z 𝑑 u 𝑑 Z 𝑏 − 𝑓 + 𝑡 ⋅ = 𝑐 secret key public key

Key generation, encryption and decryption Key generation Encryption Given a public key 𝑞𝑙 and an encoding 𝑛 ∈ 𝑆 / compute 𝒠 / 𝒠 / 𝑉 < 𝒠 / 𝑉 < (ℎ) 𝑉 / 𝑛 + 𝑣 ⋅ 𝑞𝑙 • + 𝑓 u 𝑣 ⋅ 𝑞𝑙 • + 𝑓 Z 𝑑 u 𝑑 Z 𝑏 − 𝑓 + 𝑡 ⋅ = 𝑐 Decryption secret key public key Given a secret key 𝑡 and a ciphertext 𝑑𝑢 = (𝑑 u , 𝑑 Z ) compute 𝑑𝑢 𝑡 / = 𝑑 u + 𝑑 Z ⋅ 𝑡 mod 𝑟 = 𝑛 + 𝑓 noise

Rescaling Let Δ divide 𝑟 . 𝑆 / 𝑆 //” 𝑑 u Δ , 𝑑 Z 𝑑 u , 𝑑 Z Δ 𝛦 8 ⋅ 𝑨 Z 𝛦 ⋅ 𝑨 Z 𝛦 8 ⋅ 𝑨 8 𝛦 ⋅ 𝑨 8 ℂ 0/8 … … 𝛦 8 ⋅ 𝑨 0/8 𝛦 ⋅ 𝑨 0/8

HEAAN bootstrapping Ciphertext Plaintext Cleartext vector 0 𝑛 𝑌 = 𝑑𝑢 𝑡 8{ 8 𝒜 𝟏 … 𝒜 𝒏6𝟐 𝑑𝑢 ∈ 𝑆 / / Input 0 8 , 𝑟′ > 𝑟 𝒜 𝟏 … 𝒜 𝒏6𝟐 ≃ 𝑛(𝑌 8{ ) 𝑑𝑢′ ∈ 𝑆 / – Output

CKKS bootstrapping Ciphertext Plaintext Cleartext vector 0 𝑛 𝑌 = 𝑑𝑢 𝑡 − 𝐽 𝑌 ⋅ 𝑟 8{ 8 𝒜 𝟏 … 𝒜 𝒏6𝟐 𝑑𝑢 ∈ 𝑆 / Input 0 8 , 𝑟′ > 𝑟 𝒜 𝟏 … 𝒜 𝒏6𝟐 ≃ 𝑛(𝑌 8{ ) 𝑑𝑢′ ∈ 𝑆 / – Output

CKKS bootstrapping Ciphertext Plaintext Cleartext vector 0 𝑛 𝑌 = 𝑑𝑢 𝑡 − 𝐽 𝑌 ⋅ 𝑟 8{ 8 𝒜 𝟏 … 𝒜 𝒏6𝟐 𝑑𝑢 ∈ 𝑆 / Input 0 8 , 𝑅 u > 𝑟 8{ + 𝐽 𝑌 ⋅ 𝑟 𝑑𝑢 ∈ 𝑆 š › 𝑛 𝑌 ModRaise š › 0 8 , 𝑟′ > 𝑟 𝒜 𝟏 … 𝒜 𝒏6𝟐 ≃ 𝑛(𝑌 8{ ) 𝑑𝑢′ ∈ 𝑆 / – Output

CKKS bootstrapping Ciphertext Plaintext Cleartext vector 0 𝑛 𝑌 = 𝑑𝑢 𝑡 − 𝐽 𝑌 ⋅ 𝑟 8{ 8 𝒜 𝟏 … 𝒜 𝒏6𝟐 𝑑𝑢 ∈ 𝑆 / Input 0 8 , 𝑅 u > 𝑟 8{ + 𝐽 𝑌 ⋅ 𝑟 𝑑𝑢 ∈ 𝑆 š › 𝑛 𝑌 ModRaise š › 0 0 8 𝑑𝑢 Z ∈ 𝑆 š • SubSum 8{ + 𝐽 𝑌 8{ ⋅ 𝑟 ≃ 𝑛 𝑌 š • 0 8 , 𝑟′ > 𝑟 𝒜 𝟏 … 𝒜 𝒏6𝟐 ≃ 𝑛(𝑌 8{ ) 𝑑𝑢′ ∈ 𝑆 / – Output

CKKS bootstrapping Ciphertext Plaintext Cleartext vector 0 𝑛 𝑌 = 𝑑𝑢 𝑡 − 𝐽 𝑌 ⋅ 𝑟 8{ 8 𝒜 𝟏 … 𝒜 𝒏6𝟐 𝑑𝑢 ∈ 𝑆 / Input 0 8 , 𝑅 u > 𝑟 8{ + 𝐽 𝑌 ⋅ 𝑟 𝑑𝑢 ∈ 𝑆 š › 𝑛 𝑌 ModRaise š › 0 8 𝑑𝑢 Z ∈ 𝑆 š • SubSum ≃ 𝑢(𝑌 8{ ) š • 0 8 , 𝑟′ > 𝑟 𝒜 𝟏 … 𝒜 𝒏6𝟐 ≃ 𝑛(𝑌 8{ ) 𝑑𝑢′ ∈ 𝑆 / – Output

CKKS bootstrapping Ciphertext Plaintext Cleartext vector 0 𝑛 𝑌 = 𝑑𝑢 𝑡 − 𝐽 𝑌 ⋅ 𝑟 8{ 8 𝒜 𝟏 … 𝒜 𝒏6𝟐 𝑑𝑢 ∈ 𝑆 / Input 0 8 , 𝑅 u > 𝑟 8{ + 𝐽 𝑌 ⋅ 𝑟 𝑑𝑢 ∈ 𝑆 š › 𝑛 𝑌 ModRaise š › 0 8 𝑑𝑢 Z ∈ 𝑆 š • SubSum ≃ 𝑢(𝑌 8{ ) š • 8 𝑑𝑢 8 ∈ 𝑆 š ‹ CoefToSlot (inverse DFT) 𝒖 𝟏 … 𝒖 𝟑𝒏6𝟐 0 8 , 𝑟′ > 𝑟 𝒜 𝟏 … 𝒜 𝒏6𝟐 ≃ 𝑛(𝑌 8{ ) 𝑑𝑢′ ∈ 𝑆 / – Output