A multi-key fully homomorphic encryption method on a torus

Abstract

The present invention discloses a multi-key fully homomorphic encryption method on a torus, which can realize homomorphic addition and homomorphic multiplication operations between multiple users (multiple keys). This scheme includes five steps: parameter generation, key generation, encryption, homomorphic operation and decryption, and finally obtains a homomorphic operation plaintext result, wherein the homomorphic operation algorithm can be divided into four processes: ciphertext expansion, arithmetic operation, bootstrapping and key conversion. Then, a multi-key fully homomorphic encryption method on a torus with higher homomorphic operation efficiency is designed. It mainly solves the problem that the existing multi-key homomorphic encryption algorithm has low homomorphic operation efficiency due to the complex bootstrapping process, and the problem that the existing multi-key fully homomorphic encryption method on a torus has a single operation mode. The scheme provided by the present invention ensures both the correctness of the algorithm and the security of the algorithm.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and specifically relates to a multi-key fully homomorphic encryption method on a ring surface. Background Art

[0002] The good characteristics of multi-key fully homomorphic encryption technology make it have significant advantages in dealing with secure multi-party computing problems. It will be more widely used in the future, so theoretical and applied research in this direction has very important practical significance. How to reduce the computational complexity of the key generation process, further reduce noise accumulation and increase the bootstrap speed will be a hot topic in this field for some time to come.

[0003] At the 2017 Asian Cryptography Conference, Chillotti et al. proposed the CGGI17 scheme based on the CGGI16 scheme, which can reduce ciphertext expansion. At the 2019 Asian Cryptography Conference, Chen et al., based on the low-latency homomorphic encryption idea designed by Chillotti et al., extended the gate bootstrapping of multi-key fully homomorphic encryption on the ring to the multi-key case by designing a multiplication between a single-party bootstrap key and a multi-key RLWE ciphertext, and proposed a multi-key fully homomorphic encryption (MKFHE) scheme CCS19, which can evaluate binary gates on ciphertexts encrypted under different keys and then bootstrap, and experimentally give the running time of homomorphic NAND gates with bootstrapping. The ciphertext scale constructed by this scheme and the computational cost of homomorphic computation grow linearly and quadratically, respectively, which is more efficient in terms of specific complexity compared with previous work.

[0004] Based on the analysis of the above literature, most of the previous multi-key fully homomorphic encryption schemes generally have the following two problems: First, the key exchange process (relinearization) is usually cumbersome and computationally complex, which affects the efficiency of the entire scheme. This is mainly because the generation of computational keys often requires the use of schemes such as GSW, and the number and scale of the required keys are difficult to reduce. Second, noise is an important factor affecting the performance of fully homomorphic encryption schemes. In the case of multiple keys, noise control is particularly important. There are generally two ways to solve the noise problem in homomorphic encryption: hierarchical fully homomorphic LHE and bootstrapping, but most of the existing solutions lack effective measures to deal with noise accumulation and achieve fast bootstrapping. Summary of the invention

[0005] In order to solve the above technical problems, the present invention uses an 8-bit adder and gate bootstrapping to perform addition operations in the homomorphic operation process, and uses det-WFA and circuit bootstrapping to perform multiplication operations, and further designs a multi-key homomorphic encryption scheme with higher homomorphic operation efficiency.

[0006] The technical solution of the present invention is: a multi-key fully homomorphic encryption method on a ring surface, comprising:

[0007] Step S1 (parameter generation): Each participant i inputs the safety factor λ and outputs the LWE parameter pp LWE =(n,χ,α,B',d'), RLWE parameter pp RLWE =(N,ψ,α,B,d,a) and MKHE parameter pp MKHE =(pp LWE ,pp RLWE ).

[0008] Step S2 (key generation): Each participant i enters the MKHE parameter pp MKHE , output private key s i , public key, bootstrap key, key conversion key triple (PK i ,BK i ,KS i ).

[0009] Step S3 (encryption): Each participant i enters the MKHE parameter pp MKHE and message m, output ciphertext ct = (b, a).

[0010] Step S4 (homomorphic operation): cloud inputs MKHE parameter pp MKHE , the ciphertext of each party and public key {(PK i ,BK i ,KS i )} i∈[k] , output the ciphertext after operation

[0011] Step S5 (decryption): Each participant i inputs the MKHE parameter pp MKHE , ciphertext and keys i , output message m i , the final decryption result is m = {m i} i＝[k] .

[0012] Compared with the prior art, the present invention has the following advantages:

[0013] The present invention discloses a multi-key fully homomorphic encryption method on a torus, which solves the problem that the existing multi-key homomorphic encryption algorithm has low homomorphic operation efficiency due to the complex bootstrapping process, and the problem that the existing multi-key fully homomorphic encryption scheme based on TFHE has a single homomorphic operation mode (only NAND gate operation). BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a flow chart of a multi-key fully homomorphic encryption method on a torus proposed by the present invention;

[0015] Figure 2 It is the 2-bit multiplication operation and the corresponding det-WFA construction in the present invention;

[0016] Figure 3 Schematic diagram of gate bootstrapping in the present invention (bootstrap after every gate);

[0017] Figure 4 Schematic diagram of the bootstrap circuit in the present invention (bootstrap after a larger circuit);

[0018] Figure 5 It is a schematic diagram of algorithm execution of each link of the scheme described in the present invention. DETAILED DESCRIPTION

[0019] The present invention provides a multi-key fully homomorphic encryption method on a torus, which improves the homomorphic bootstrapping efficiency of the multi-key encryption scheme and increases the homomorphic operation methods.

[0020] In order to make the purpose, technical solutions and advantages of the present invention more clear, the following is a specific implementation, combined with Figure 1 , the present invention is further described in detail.

[0021] Step S1 (parameter generation): Each participant i inputs the safety factor λ and outputs the LWE parameter pp LWE =(n,χ,α,B',d'), RLWE parameter pp RLWE =(N,ψ,α,B,d,a) and MKHE parameter pp MKHE =(pp LWE ,pp RLWE ).

[0022] Step S2 (key generation): Each participant i enters the MKHE parameter pp MKHE , output private key s i , public key, bootstrap key, key conversion key triple (PK i ,BK i ,KS i ).

[0023] Step S3 (encryption): Each participant i enters the MKHE parameter pp MKHE and message m, output ciphertext ct = (b, a).

[0024] Step S4 (homomorphic operation): cloud inputs MKHE parameter pp MKHE , the ciphertext of each party and public key {(PK i ,BK i ,KS i )} i∈[k] , output the ciphertext after operation

[0025] Step S5 (decryption): Each participant i inputs the MKHE parameter pp MKHE , ciphertext and keys i , output message m i , the final decryption result is m = {m i} i＝[k] .

[0026] Step S11: Each participant i inputs the safety factor λ and calls LWE.Setup(1 λ ) to generate the LWE parameter pp LWE =(n,χ,α,B',d');

[0027] Step S12: Call RLWE.Setup(1 λ ) to generate the RLWE parameter pp RLWE =(N,ψ,α,B,d,a), the generated public parameter pp MKHE =(pp LWE ,pp RLWE );

[0028] Step S21: Each participant i samples from the distribution χ and generates an LWE key s i ;

[0029] Step S22: Each participant i takes z i ←ψ, take the error Set the public key to PK i =b i =-z i a+e;

[0030] Step S23: Each participant i takes a random value r←ψ and converts the LWE key s i Encrypt with r to get d i,j , encrypt the random value r with the RLWE key z to get F i,j , set the bootstrap key to BKi ={(d i,j ,F i,j )} j∈[n] ;

[0031] Step S24: Let z i =z 1,0 +z i,1 X+...+z i,N-1 X N-1 ,remember Put a with t∈Z N The corresponding LWE ciphertext is converted to the same message in s∈Z n Another LWE ciphertext under encryption.

[0032] Step S31: Each participant i starts from T n uniformly sample from D to obtain a as mask; α The sample obtained is e as the error;

[0033] Step S32: Output ciphertext ct = (b, a) ∈ T n+1 satisfy

[0034] Step S41: Participant i uses the ciphertext expansion algorithm to fill the ciphertext with zeros. Expanded to the same message under the joint key Encrypted ciphertext

[0035] Combination Figure 2 , Figure 3 , Figure 4 , and its specific implementation method is described.

[0036] Step S42: Input When performing addition operations, an 8-bit adder is used to perform operations, and the gate bootstrap method is used to reduce noise; when performing multiplication operations, a deterministic weighted automaton det-WFA is used to perform operations, and the circuit bootstrap method is used to reduce noise and output the operation results.

[0037] Step S43: Convert to LWE ciphertext and run the multi-key key conversion algorithm. There are two steps: First, for Let b * is the constant term of c0, for i∈[k], let c i The coefficient vector of . Calculate the LWE ciphertext Second: Order Executes a multi-key key conversion algorithm and returns the ciphertext This key-switching algorithm takes as input a stretched ciphertext and a series of key-switching keys and returns the same message encrypted under the joint key.

[0038] Step S51: For the ciphertext and a set of keys (s1,K,s k ), participant i uses the ciphertext and keys i Return bit m i ∈{0,1} such that Minimum.

[0039] Step S52: Decryption result m by each party i Combining to get m = {m i} i＝[k] .

[0040] Step S421: Design a deterministic weighted automaton, for example, the multiplication operation between two 2-bit integers x=x1x0 and y=y1y0 is as follows: Figure 1 As shown, after the initial step of bit-by-bit multiplication, multiple additions are performed (shifting one bit to the left for each row). Each bit of the final result m=m3m2m1m0 is the sum of each column with carry.

[0041] Step S422: det-WFA computes multiplication by tracking the partial sums of each column in the state and using transitions to update these sums. For multiplication of 2-bit integers, the automaton has 6 main states (i, c0, c 10 ,c 11 ,c 20 ,c 21 ), plus 14 intermediate states (indicated by capital letters and brackets) to store the last bit read. The value of the jth (for j∈[0,3]) output bit is weighted on the last transition of each column, and the final weight is the result of the multiplication.

[0042] Step S423 (circuit bootstrapping): input a LWE sample where μ∈Σ; a bootstrap key k+1 key conversion keys Corresponding to when u≤k and f k+1 Function f when (x) = 1·x u (x) = -K u x. Output an RGSW sample C∈RGSW K,η (μ).

Claims

1. A multi-key fully homomorphic encryption method on a torus, characterized in that: include: Step S1 Parameter generation: Each participant i inputs the safety factor λ and outputs the LWE parameter pp LWE =(n,χ,α,B',d'), RLWE parameter pp RLWE =(N,ψ,α,B,d,a) and Multi-key Homomorphic Encryption, MKHE parameter pp MKHE =(pp LWE ,pp RLWE ), where n is the dimension of LWE, χ is the distribution of LWE keys, α is the error rate, B' is the decomposition basis, d' is the dimension of the key transformation gadget vector, N is the dimension of RLWE, a power of 2, ψ is the distribution of RLWE keys on R, and the error rate is α, B>2 is an integer basis, the decomposition dimension is d, and a is a uniformly distributed sample on the distribution Td; Step S2: Key generation: Each participant i enters the MKHE parameter pp MKHE , output private key s i , public key, bootstrap key, key conversion key triple (PK i ,BK i ,KS i ); Step S3 Encryption: Each participant i inputs MKHE parameter pp MKHE and message m, output ciphertext ct = (b, a); Step S4 Homomorphic operation: cloud input MKHE parameter pp MKHE , the ciphertext of each party and public key {(PK i ,BK i ,KS i )} i∈[k] , output the ciphertext after operation Step S5: Decryption: Each participant i inputs MKHE parameter pp MKHE , ciphertext and keys i , output message m i , the final decryption result is m = {m i } i＝[k] ; Step S4 homomorphic operation: cloud input MKHE parameter pp MKHE , the ciphertext of each party and public key {(PK i ,BK i ,KS i )} i∈[k] , output the ciphertext after operation Specifically include: Step S41: Use the ciphertext expansion algorithm to fill the ciphertext with zeros. Expanded to the same message under the joint key Encrypted ciphertext Step S42: Input When performing addition operations, an 8-bit adder is used to perform operations, and the gate bootstrap method is used to reduce noise; when performing multiplication operations, a deterministic weighted automaton det-WFA is used to perform operations, and the circuit bootstrap method is used to reduce noise and output the operation results. Step S43: Convert to LWE ciphertext and run the multi-key key conversion algorithm, which is divided into two steps: first, for Let b * is the constant term of c0, for i∈[k], let c i The coefficient vector of LWE ciphertext is calculated Second: Order Executes a multi-key key conversion algorithm and returns the ciphertext This key transformation algorithm inputs the extended ciphertext and a series of key transformation keys and returns the ciphertext of the same message under joint key encryption; Step S42: input When performing addition operations, an 8-bit adder is used to perform operations, and the gate bootstrap method is used to reduce noise; when performing multiplication operations, a deterministic weighted automaton det-WFA is used to perform operations, and the circuit bootstrap method is used to reduce noise and output the operation results. The specific steps to perform the multiplication of two 2-bit integers include: Step S421: Design a deterministic weighted automaton, multiplication operation between two 2-bit integers x=x1x0 and y=y1y0, after the initial step of bit-by-bit multiplication, perform multiple additions, shifting each row to the left by one bit, and each bit of the final result m=m3m2m1m0 is the sum of each column with carry; Step S422: det-WFA calculates multiplication by tracking the partial sums of each column in the state and using transitions to update these sums. For multiplication of 2-bit integers, the automaton has 6 main states (i, c0, c 10 ,c 11 ,c 20 ,c 21 ), plus 14 intermediate states represented by capital letters and brackets, used to store the last bit read. For j∈[0,3], the value of the jth output bit is put into the weight on the last transition of each column, and the final weight is the result of the multiplication; Step S423 Circuit bootstrapping: Input a LWE sample where μ∈Σ; a bootstrap key k+1 key conversion keys Corresponding to when u≤k and f k+1 Function f when (x) = 1·x u (x) = -K u x, output an RGSW sample C∈RGSW K,η (μ).

Images