Computation of LWE encryption values

Abstract

Some embodiments relate to a computer-implemented method (1200) of performing computations on LWE encrypted values. The invention relates to a TFHE setting in which the encryption supports programmable bootstrapping operations that evaluate LWE decryption in the exponent of a GLWE encrypted monomial. In this setting, LWE encrypted input values are converted into GLWE encrypted polynomials by applying a ciphertext key switching operation to compute a LWE encrypted product value based on the one or more LWE encrypted input values, where the coefficients of the polynomial are linear combinations of the set of input values; encrypted polynomial multiplication is applied in the GLWE domain, and a ciphertext sample extraction operation is applied to the resulting GLWE encrypted polynomial to obtain the LWE encrypted product value as an encryption of one of its coefficients.

Description

Technical Field

[0001] The currently disclosed subject matter relates to computer-implemented methods, devices, and computer-readable media for performing computations on LWE encrypted values. Background Technology

[0002] Homomorphic cryptography allows computations to be performed on encrypted data without the need for decryption, such as evaluating circuits. For example, input data and computation results can be received and returned in encrypted form. Intermediate data (e.g., the internal state of the computation) can also be in encrypted form.

[0003] Although the computation result is returned in encrypted form, the output is identical when decrypted to the output when the operation is performed on unencrypted data. Homomorphic encryption can be used to protect privacy during outsourced storage and computation. This allows data to be encrypted and outsourced to a cloud environment for processing and / or storage while remaining encrypted.

[0004] For example, homomorphic cryptography can be applied in fields such as healthcare, where privacy regulations may make sharing plaintext data difficult, but computations on encrypted medical data may be permitted. For instance, developing a medical model for classifying medical data can be configured to receive medical data in encrypted form from a third party (e.g., a hospital). The medical model can, for example, classify the medical data as normal or abnormal, or as having a specific medical syndrome, disease, or other ailment. Using homomorphic encryption, the medical model can be applied to the received medical data in encrypted form. This means that the party providing the medical model cannot access the plaintext medical data corresponding to the encrypted medical data. Users of the service can decrypt the results of the medical model application.

[0005] In particular, there exist homomorphic cryptographic techniques that, at least in principle, can be used to compute any function of encrypted data. Such techniques are known as "fully homomorphic encryption" (FHE).

[0006] For security reasons, known implementations of FHE use noisy ciphertext. For example, encrypting a data item may include mapping the data item to a point in a key-related lattice and adding some noise to that point. In particular, many known implementations of FHE use LWE encrypted values, the encryption of which depends on the encryption difficulty of the error learning problem, or on, for example, the problem of fault-tolerant learning on rings (RLWE) or the problem of generalized fault-tolerant learning (GLWE).

[0007] When data items are first encrypted, the noise is low—the encryption is recent. For example, the noise level is low enough that if the data item needs to be decrypted, the noise can be removed at some point during the decryption process, such as through rounding. On the other hand, the noise should be high enough to make attacks on the system sufficiently difficult. For example, many homomorphic encryption schemes might be vulnerable to attacks by linear algebra or other efficient algorithms (e.g., lattice-based algorithms) if no noise is present. When data items are encrypted, selected noise is added to make attacks difficult while still allowing homomorphic operations to be performed.

[0008] Most homomorphic operations add noise to the homomorphically encrypted data item. When many such operations are performed, the noise can reach a level where unique decryption is no longer possible. Generally, a technique called bootstrapping is known to reduce noise in homomorphically encrypted values. Bootstrapping can be done using a public key called a bootstrap key. By using bootstrapping to reduce noise when needed, in principle any desired number of homomorphic operations can be computed.

[0009] A special class of fully homomorphic encryption schemes is the TFHE class of homomorphic encryption schemes. Such schemes are described in I. Chillotti et al., “TFHE: fast fully homomorphic encryption over the torus” (J. Cryptol., 33(1):34-91, 2020) (included in this paper by reference) and I. Chillotti et al., “Programmable Bootstrapping Enables Efficient Homomorphic Inference of Deep Neural Networks” (available at https: / / eprint.iacr.org / 2021 / 091 / 20210127:133406). The TFHE class of schemes differs from other FHE schemes in that it supports a relatively very efficient bootstrapping technique. This bootstrapping technique reduces noise in the LWE encrypted input by evaluating the LWE decryption in the exponent of the GLWE encrypted monomial, thereby producing an LWE encrypted output with a noise level independent of the noise in the LWE encrypted input. The TFHE bootstrapping is also programmable, as the output can be the result of applying a function to the input.

[0010] Although TFHE-type schemes allow for relatively efficient performance of extensive computations on encrypted data, improvements are still needed, particularly in terms of the efficiency of performing these operations and / or support for a wider range of computations. Summary of the Invention

[0011] According to one aspect of the invention, a computer-implemented method for performing computations on an LWE encrypted value as defined in claim is provided. According to a second aspect, an apparatus for performing computations on an LWE encrypted value as defined in claim is provided. According to a third aspect, a computer-readable medium as defined in claim is provided.

[0012] In general, the claims relate to performing computations on LWE encrypted values. Typically, an LWE encrypted value can be the encryption of a value based on the cryptographic hardness of a tolerance learning (LWE) problem. An LWE encrypted value is typically a single numerical value. The claims also relate to the use of GLWE encrypted polynomials. GLWE encrypted polynomials can be the encryption of polynomials based on a generalized tolerance learning problem. Typically, GLWE encryption can be used to encrypt polynomials whose degree is strictly less than the given ring dimension N of the polynomial. In this specification, the term GLWE encrypted polynomial is sometimes abbreviated as GLWE to refer to the case where the ring dimension of the polynomial is greater than 1; for example, GLWE does not include LWE.

[0013] The claims relate to LWE encryption according to a “TFHE class” fully homomorphic encryption scheme, meaning: a scheme supporting a programmable bootstrapping (PBS) operation that evaluates the LWE decryption of the LWE-encrypted input value in the exponent of the GLWE-encrypted monomial. One embodiment is the scheme of I. Chillotti et al. The programmable bootstrapping can be applied according to an identity function (in which case it can lead to encryption of the same input value with less noise), or according to another function (in which case it can lead to encryption of the result of applying that function to the input value). The programmable bootstrapping can use a set of bootstrapping keys that enable bootstrapping while simultaneously disallowing decryption of the LWE-encrypted value.

[0014] The programmable bootstrapping operations in TFHE-class schemes make them an attractive option for a wide range of applications. Because bootstrapping is relatively efficient compared to many other FHE schemes, performing relatively complex computations (e.g., multiplication depths of at least 10, 50, or 100) is more feasible. In particular, the cryptographic parameters of TFHE-class schemes can be chosen based on the required precision and the final computational cost, independent of the number of homomorphic operations and their circuit depth. In contrast, bootstrapping is very inefficient in other FHE schemes; in fact, these schemes are often applied in a hierarchical manner, meaning their parameters are chosen based on the given computation, allowing them to be performed without bootstrapping. However, this hierarchical approach is not feasible for more complex computations, making TFHE-class schemes particularly useful in such cases.

[0015] However, existing TFHE-type schemes have a disadvantage in that they have many limitations in multiplying LWE encrypted values. (In this specification, the term "product" is used to refer to the result of multiplication.) Multiplication x·y is typically implemented using programmable bootstrap operations, or directly by writing the product as a single-variable function and applying the programmable bootstrap to these single-variable functions, such as x·y=(x+y). 2 / 4-(xy) 2 / 4, or indirectly using circuit bootstrapping and external products.

[0016] Using PBS for multiplication has at least two disadvantages. The first disadvantage is that PBS is relatively expensive in terms of computational efficiency and the memory and storage requirements of the key material it uses. The second disadvantage is the known requirement for padding bits in the PBS input; in other words, the most significant bit of the LWE encrypted input value to which PBS is applied must be zero, or at least known to be zero. This is a consequence of existing PBS methods for evaluating LWE decryption in the exponent of GLWE encrypted monomials, as discussed in more detail elsewhere. This limitation of PBS restricts the values ​​that can be multiplied using it; for example, x+y and xy in the above embodiment may both require padding bits. This is undesirable because it limits the size of the values ​​that can be computed, or requires larger parameters to allow computation on values ​​of a given size, resulting in lower computational efficiency.

[0017] Interestingly, the inventors found an alternative method to perform multiplication in TFHE-type schemes. Specifically, they were able to perform multiplication of LWE-encrypted input values ​​a and b by converting LWE-encrypted input values ​​a and b in a TFHE-type scheme into GLWE-encrypted polynomials p(x) and q(x) using a key-switching operation. The key-switching can produce GLWE-encrypted polynomials with coefficients equal to the input values, for example, p(x) = a·x. 0 and q(x) = b·x 0 Or, more generally, to produce a linear combination of the input values. Cryptographic polynomial multiplication can then be applied to the GLWE cryptographic polynomial to obtain a product of polynomials (e.g., p(x)q(x) = ab·x). 0 The LWE encryption is performed. By performing an appropriate key switch, the coefficients of the polynomial product (e.g., constant coefficients) can be equal to the product of the LWE encrypted input values, a·b, or more generally, the expected sum of the products of linear combinations of these input values. The desired product value can then be obtained in LWE encrypted form by extracting operations on the GLWE encrypted product or cryptographic samples derived from it.

[0018] While cryptographic polynomial multiplication using GLWE cryptographic polynomials was known in itself, the inventors made a surprising discovery: this cryptographic polynomial multiplication could be used to improve the multiplication of LWE cryptographic values ​​(i.e., non-polynomials) in TFHE-class settings. This initially seemed impossible. GLWE polynomial multiplication is typically used in hierarchical settings, where very large cryptographic parameters are often chosen to enable a particular application without bootstrapping. In TFHE-class schemes, much smaller parameters are typically chosen, and in an application-independent manner, due to the greater efficiency of bootstrapping. This inherent difference in setup already made it seem unlikely that GLWE polynomial application techniques would work in TFHE-class settings.

[0019] Specifically, for efficiency reasons, the GLWE encryption used in programmable bootstrap TFHE class settings typically has relatively small parameters, such as parameter n = kN at most 640 or at most 1000, for example n = 630, for example with q = 2 32 Combination. For such known parameters, the output of the PBS is known to have a relatively small number of noise-free bits, for example, less than 8. GLWE multiplication is typically applied to settings with more noise-free bits (e.g., at least 20, at least 100, or at least 250). In TFHE-type settings, applying techniques from that setting is expected to add so much noise to the message that the meaningful content of the message will be completely lost. In fact, the inventors’ detailed noise analysis shows that, in the above embodiment, the combination of key switching, GLWE multiplication, and sample extraction may result in approximately 11 additional noise bits, thus completely eliminating the 8 available noise-free bits. Interestingly, however, using the same noise analysis, the inventors found that when using a suitable polynomial ring dimension (e.g., at most or at least N = 2), the noise can be significantly reduced. 11 Or at most or at least N=2 12 When these parameters are set, multiplication can be performed to preserve enough noise-free bits. Programmable bootstrapping can still be performed efficiently under these parameters.

[0020] Furthermore, the inventors discovered that using GLWE polynomial multiplication in the TFHE setup significantly improves efficiency. It was found that the cost of multiplication could be reduced from two PBS operations at the cost of over 500 outer products to the equivalent of fewer than 7 outer products. Additionally, the amount of key material required for multiplication was reduced to less than half. Another advantage is that two LWE encrypted values ​​can be multiplied without padding bits. This means that, given the same parameters, multiplication can be performed on larger values. It also supports a variety of other applications previously impossible in the TFHE setup, several of which are illustrated in this specification.

[0021] Furthermore, from the perspective of hierarchical technology, combining these techniques with TFHE programmable bootstrapping seems unexpected. Since the cryptographic parameters used in hierarchical settings are typically much larger, applying programmable bootstrapping in this setting is far less efficient. Additionally, SIMD (Single Instruction, Multiple Data) packing is commonly used in hierarchical settings. With SIMD packing, multiple plaintexts can be combined into a single GLWE polynomial encryption, and homomorphic operations can be applied to individual ciphertexts to apply that operation to each underlying plaintext, thus allowing the computation time for each plaintext to be amortized. TFHE bootstrapping is incompatible with SIMD packing, therefore integrating TFHE into hierarchical settings is impractical.

[0022] In one implementation, GLWE encrypted polynomial multiplication can be exemplified using relinearization. GLWE encryption can be viewed as a first-order polynomial in the key (e.g., as a single variable in the case of RLWE, or as multiple variables for other types of GLWE encryption). Thus, by computing the GLWE encrypted polynomial product (viewed as a polynomial in the key), a second-order polynomial in the key can be obtained. A relinearized key can be provided, which can be used to transform this second-order polynomial back to a first-order polynomial, for example, the GLWE encryption of the product, without needing to obtain the plaintext. This relinearization-based GLWE multiplication is known in itself and has been found to provide the aforementioned improvements in computational and storage efficiency when used to implement LWE encrypted value multiplication as described above.

[0023] In one implementation, the provided technique can be used to multiply an LWE-encrypted first value with an LWE-encrypted second value, i.e., to determine the LWE encryption of the product of the first and second values. For this purpose, key switching can be used to determine a first and second input polynomial for GLWE encryption, using the first and second values ​​as coefficients (e.g., as constant coefficients). The GLWE-encrypted product of the first and second input polynomials can be computed such that the coefficients of the resulting output polynomial are equal to the desired product. The LWE encryption of the product can be obtained by extracting these coefficients using sample extraction.

[0024] In one implementation, the provided technique can be used to compute the inner product between a first set of LWE encrypted values ​​and a second set of LWE encrypted values. To do this, a first input polynomial and a second input polynomial for GLWE encryption, with the first and second sets of values ​​as coefficients, can be determined, respectively. Values ​​can be mapped to coefficients in such a way that the coefficients of the product polynomial correspond to the inner product. The LWE encrypted inner product can then be obtained as the coefficients of the GLWE encrypted output polynomial. Interestingly, the GLWE polynomial multiplication only needs to be computed once, making the inner product computation more efficient than multiplying the input values ​​individually.

[0025] Many variations are possible. For example, additional values ​​can be included in the GLWE encrypted input polynomial to compute, for example, multiple products using a single GLWE polynomial multiplication. For instance, the product value could represent a quadratic function in the LWE encrypted input value, thus allowing efficient evaluation of that quadratic function. Additional operations can also be performed in the GLWE polynomial domain, such as computing the GLWE encrypted product polynomial, upon which further polynomial multiplications can be applied, such that the resulting LWE encrypted product value can represent a cubic or even higher-order polynomial function in the LWE encrypted input value.

[0026] In one implementation, the computation of LWE encrypted values ​​can involve both the computation of LWE encrypted products and programmable bootstrapping operations. For example, programmable bootstrapping can be applied to LWE encrypted products, or LWE encrypted products can be computed based on programmable bootstrapping for LWE encrypted input values. This allows for the combination of efficient (programmable) bootstrapping and efficient multiplication without padding within the same homomorphic computation, which was previously impossible.

[0027] Many other applications can also be enabled by achieving LWE encrypted product value computation without padding. For many such applications, how accurately the product value is determined is not important; for example, whether it is done through key switching, GLWE encrypted polynomial multiplication, and sample extraction is irrelevant. Although the inventors are unaware of any existing alternative technologies for efficiently computing LWE encrypted products, they do envision combining these applications with any other current or future technologies for computing LWE encrypted products (e.g., any technology that produces product values ​​without padding).

[0028] In one implementation, the provided technique is used to improve the TFHE programmable bootstrap operation. As mentioned above, a known problem with TFHE programmable bootstrap, for the specific case of multiplying two values, is that it requires its LWE encrypted input value to have padding bits. This requirement arises due to its modulus-to-digital switching. The modulus-to-digital switching scales the LWE encrypted input value to the domain [0, 2N), where N is the ring dimension of the GLWE encrypted polynomial. A blind rotation is then performed to decrypt the scaled LWE encryption in the exponent, resulting in a monomial X. m′ Where m′∈[0, 2N). Due to the dimension N, the relation X N =-1 holds true, so for the value m′ located in [N, 2N), the resulting monomial is -X. m′-N Therefore, using known programmable bootstraps, it is not possible to evaluate a function whose value depends on the most significant bit, and / or the resulting output may have an incorrect sign.

[0029] Interestingly, the inventors realized that this deficiency could be overcome by using multiplication without padding. To achieve this, a programmable bootstrap could be applied, but a modulus switch could be performed to scale the LWE encrypted input values, thus making the correctness of the LWE encrypted function output dependent on the sign. For example, if the function were to be applied to the full input values, it could be scaled to [0, N). In this case, blind rotation might produce a monomial X. m′ Since the exponent of X is a value modulo 2N, it satisfies the relation X N =-1, the correctness of the monomial may depend on the sign. As discussed elsewhere, other scaling methods can control the portion of the input value to which programmable bootstrapping is applied, while still obtaining results where correctness depends on the sign.

[0030] As the inventors recognize, by applying the same programmable bootstrap to the LWE encrypted input value, the LWE encrypted constant output can be obtained, the correctness of which depends on the same sign: if the LWE encrypted function output is correct, then the LWE encrypted constant output is correct, and if the LWE encrypted function output is negative, then the LWE encrypted constant output is also negative.

[0031] Interestingly, the fact that the two symbols are identical means that the programmable bootstrap of the function can be corrected based on the LWE cryptographic constant output, which depends on the symbols for correctness. That is, by computing the corrected function output, it can be made correct both when all symbols are correct and when all symbols are incorrect. Therefore, an improved programmable bootstrap can be obtained that works correctly without requiring inputs with padding bits.

[0032] Correction can be performed in several ways. In one implementation, a programmable bootstrap can be used to obtain an LWE encryption ±f(x) of the function output whose correctness depends on the sign, and this LWE encryption can be multiplied by a constant encryption, such as ±1 or another constant (if the output needs to be rescaled). If the sign is correct, the result is +f(x)·+1=f(x). If the sign is incorrect, the result is -f(x)·-1=f(x). Thus, multiplication corrects the function output.

[0033] In one implementation, the correction can be performed in the GLWE domain. The symbol-dependent LWE cryptographic constant output can be converted into a symbol-dependent GLWE cryptographic constant polynomial, such as ±1·X. 0 Programmable bootstrap GLWE encrypted singletons (e.g., ±X) m′ This can be multiplied by the GLWE cryptographic constant polynomial. This can be done at any suitable point during the programmable bootstrapping, for example, before or after multiplying with the test polynomial. The result is the same: the programmable bootstrapping of the LWE cryptographic function output is corrected so that padding bits are no longer needed.

[0034] Besides changing which domain the correction is applied in, it is also possible to change what kind of correction is applied. In a particularly advantageous implementation, programmable bootstrapping is used to apply the corresponding functions f0 and f1 to obtain the corresponding function outputs ±f0(x) and ±f1(x); and a constant function is applied to obtain a constant ±c whose sign correctness depends on the sign. In this case, the constant ±c can be used not only to correct the sign but also to select whether to use the output of function f0 or function f1. In particular, depending on scaling, this constant can be equal to 1 / 2, in which case the correction can be performed depending on scaling to calculate the LWE encryption output (±1 / 2+1 / 2)·±f0(x)+(±1 / 2-1 / 2)·±f1(x). If the sign is positive, the output may correspond to f0(x); if the sign is negative, the output may correspond to f1(x).

[0035] Therefore, effectively, if the sign is positive, the global function f(x) corresponding to f0(x) can be computed, and if the sign is negative, the global function f(x) corresponding to f1(x) can be computed. As discussed, if the most significant bit of x is set to 1, the sign may be incorrect, otherwise it is correct. Therefore, the global function f(x) can be computed by splitting it into functions f0(x) (for cases where the most significant bit is not set) and f1(x) (for cases where the most significant bit is set). Interestingly, this way of computed f(x) is generally more efficient than computed f(x) using PBS for global functions. The fields of functions f0(x) and f1(x) are half the field size of f(x). That is, the most significant bit of both functions can be ignored. Furthermore, the identity function only needs to be evaluated on a field that is half the field size of f(x). Performing three programmable bootstraps on a field of half the size may be more efficient than performing one bootstrap on a field of the full size. Therefore, it is surprising that the efficiency of performing programmable bootstraps can be improved while still not requiring padding bits. Another advantage is that the three bootstrapping operations can be performed in parallel, making PBS implementation in a multi-threaded manner particularly efficient.

[0036] In one implementation, the programmable bootstrap of the applied function shares its blind rotation operations with the programmable bootstrap of the applied constant function. Thus, a single GLWE encrypted monomial can be computed and then multiplied by the corresponding test polynomials of the function and the constant function. If two functions f0(x) and f1(x) are used as discussed herein, they can also share blind rotations. Since blind rotations are the expensive part of the programmable bootstrap, being able to share them can greatly improve efficiency.

[0037] In one implementation, programmable bootstrapping can be used to apply multiple corresponding functions to LWE encrypted input values. This can be accomplished by applying test polynomials representing the outputs of multiple corresponding functions. That is, programmable bootstrapping typically involves multiplying the GLWE encrypted monomial representing the message by the test polynomial representing the function to be applied (e.g., by starting with the test polynomial and applying a blind rotation to it, or by performing a blind rotation first and then multiplying the result with the test polynomial). Test polynomials can be constructed such that some output coefficient of the product (typically a constant coefficient) corresponds to the function output. As the inventors recognize, test polynomials can be constructed such that other coefficients with a fixed offset from the output coefficients (e.g., coefficients immediately following the output coefficients) correspond to the outputs of other functions. The corresponding polynomial coefficients can then be extracted to obtain the corresponding function output. In this way, multiple functions can be computed using the same programmable bootstrapping. This technique is not only efficient, but interestingly, the resulting noise growth is also limited because it is independent of the evaluated function. This technique can also be combined with the use of redundant test polynomials to address noise issues.

[0038] In one implementation, circuit bootstrapping can be performed by applying multiple corresponding functions to the LWE encrypted input value. As is known per se, circuit bootstrapping can be used to convert LWE ciphertext into ciphertext for hierarchical evaluation, such as into GGSW ciphertext. Circuit bootstrapping is a computationally intensive process, in which evaluating multiple functions with respect to the same LWE ciphertext is a significant part. Therefore, it particularly benefits from the provided techniques.

[0039] In one implementation, a programmable bootstrap without padding can be used to extract the least significant portion of the LWE encrypted input value. To do this, an appropriately rescaled identity function can be applied to the LWE encrypted input value to obtain the LWE encryption function output. Modulus-to-digital switching can be configured to scale the LWE encrypted input value such that the LWE encryption function output encrypts the least significant portion of the input value. The remaining portion of the LWE encryption can be obtained by subtracting the least significant portion from the LWE encrypted input value, and the process can be repeated on this remaining portion. Therefore, the LWE encrypted input value can be decomposed into smaller blocks, such as k-bit blocks of some k, e.g., k=1, k is at most or at least 2, or k is at most or at least 4.

[0040] Interestingly, by using scaling in analog-to-digital switching, blocks can be extracted using a programmable bootstrap, whose input field corresponds to the size of the block rather than the size of the input value. Because of the use of a padding-free programmable bootstrap, correct decomposition can be achieved even if the blocks in the LWE encrypted input value are not guaranteed to have leading padding bits.

[0041] In one implementation, appropriately scaled least significant portions of the extracted LWE encryption can be summed to obtain a bootstrap LWE encryption output representing the input value. Therefore, by being able to decompose the LWE encryption input value into blocks, a specific and efficient way to bootstrap the LWE encryption input value to reduce its noise can be obtained.

[0042] In one implementation, the appropriately scaled least significant portion of the extracted LWE encryption can be input into a corresponding programmable bootstrap operation to apply the overall function to the LWE encrypted input value. Therefore, techniques known per se can be used to decompose the overall function into sub-functions acting on blocks of the input value, allowing for a more efficient evaluation of the overall function over the entire input value. Since the blocks are extracted via a more efficient programmable bootstrap, the overall function can be evaluated in a more efficient manner.

[0043] In one implementation, the provided technique for multiplying with LWE encrypted values ​​can be used to evaluate binary circuits with respect to one or more LWE encrypted binary input values. Specifically, an AND gate can be implemented as a multiplication of LWE encrypted values, noting that a scaling-dependent AND gate corresponds to multiplication if a scaling-dependent binary true is represented as 1 and a scaling-dependent binary false is represented as 0. Therefore, the improved multiplication directly leads to an improvement in the binary circuit evaluation.

[0044] Encoding binary false and true as zero and half the modulus of LWE encryption (or vice versa) is particularly advantageous. This allows for the implementation of several binary operations (especially XOR and NOT operations) through addition and subtraction of the ciphertext, making it particularly efficient. Specifically, several such operations can be applied to the ciphertext without requiring bootstrapping or programmable bootstrapping after each operation. Previously, this particularly advantageous encoding was not possible: the encoding uses the most significant bit to encode the binary value, and known programmable bootstrapping and multiplication cannot be performed on this bit because they require padding bits.

[0045] When needed, programmable bootstrapping can be applied to reduce noise in LWE encrypted binary values. Two particularly efficient methods for performing this programmable bootstrapping are possible when the binary value is represented as zero or half the modulus of the LWE encryption. One method is to multiply the LWE encryption monomial of the binary value by the test polynomial, such that the programmable bootstrapping results in an LWE encryption bootstrapping output equal to a positive or negative quarter of the LWE modulus. This can then be added to a quarter of the LWE modulus to obtain a bootstrapping of the input bits equal to zero or half the modulus. Another method is to scale the LWE encryption binary value so that the programmable bootstrapping produces an LWE encryption function output that is itself equal to zero or half the LWE modulus. Both techniques allow for efficient bootstrapping of LWE encryption bits, for example, through one or more XOR operations and NOT operations, resulting in more efficient binary circuit evaluation.

[0046] In one implementation, programmable bootstrapping can be used to evaluate by 2 k (For some k > 1) modulo arithmetic circuit modulo. Similar to the binary case above, these values ​​can be encoded in the high k bits of LWE encryption. The arithmetic circuit can include addition with k least significant bits retained. This operation can be efficiently implemented as addition of the corresponding ciphertext. Negation can be implemented by negating the ciphertext. Similarly, as described herein, multiplication with least significant bits retained can be efficiently implemented by performing multiplication of the LWE ciphertext without padding. Again, this was not possible previously because padding bits were required.

[0047] In one implementation scheme, at 2 k In modulo arithmetic circuits or other situations, addition or multiplication can be performed while retaining only the most significant part, for example, by discarding k least significant bits. Interestingly, such addition or multiplication can also be efficiently implemented via programmable bootstrapping without padding.

[0048] Specifically, one approach to performing these operations is to first compute the complete LWE encrypted sum or product, possibly after scaling the input so that the computation of the sum or product retains the most significant bit. A programmable bootstrap can then be used to extract the least significant part (e.g., k bits) by applying an identity function (appropriately rescaled if necessary) to the LWE encrypted sum or product, while using modulus switching to scale the LWE encrypted sum or product so that the programmable bootstrap produces the least significant part of the LWE encryption. This scaling of the LWE encrypted sum or product to retain only the least significant part is possible because of the use of a programmable bootstrap that does not require padding bits. Due to the scaling, the identity function only needs to be applied to a field the size of the least significant part, thus improving efficiency. The least significant part of the LWE encryption can then be extracted from the LWE encrypted sum or product to obtain the desired LWE encryption result.

[0049] The improved computational techniques provided for encrypting data can be applied to a wide range of practical applications. Such applications include the encrypted evaluation of software programs without access to plaintext data. For example, one could evaluate medical diagnostic software based on medical data without actually accessing the medical data. Medical data can include medical images. Medical images can include, for example, multidimensional image data acquired through various acquisition methods, such as two-dimensional (2D), three-dimensional (3D), or four-dimensional (4D) images, including but not limited to standard X-ray imaging, computed tomography (CT), magnetic resonance imaging (MRI), ultrasound (US), positron emission tomography (PET), single-photon emission computed tomography (SPECT), and nuclear medicine (NM).

[0050] In one implementation, the provided techniques can be used to evaluate a neural network with respect to cryptographic input. The party evaluating the neural network may or may not access the network's training parameters, such as weights and biases, in plaintext. Overall, the techniques presented herein (e.g., improved bit-free multiplication with programmable bootstrapping) improve the efficiency of evaluating neural networks, or, in other words, improve the accuracy achievable with the same cryptographic parameters. Specifically, by using programmable bootstrapping (where the correctness-dependent LWE cryptographic constant output is used to select and correct the correctness-dependent LWE cryptographic function output or the correctness-dependent LWE cryptographic additional function output), and / or by applying the overall function in blocks, it becomes possible and less costly to compute inference with more bit precision.

[0051] One embodiment of this method can be implemented on a computer as a computer-implemented method, or in dedicated hardware, or a combination of both. Executable code for one embodiment of the method can be stored on a computer program product. Embodiments of the computer program product include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Preferably, the computer program product includes non-transitory program code stored on a computer-readable medium for performing one embodiment of the method when the program product is executed on a computer.

[0052] In one embodiment, the computer program includes computer program code that, when run on a computer, is adapted to perform all or part of the steps of one embodiment of the method. Preferably, the computer program is implemented on a computer-readable medium. Attached Figure Description

[0053] Further details, aspects, and embodiments will be described with reference to the accompanying drawings and by way of example only. Elements in the drawings are illustrated for simplicity and clarity and are not necessarily drawn to scale. In the drawings, elements corresponding to those already described may have the same reference numerals. In the drawings,

[0054] Figure 1a An embodiment of an implementation of a device for performing calculations on LWE encrypted values ​​is illustrated schematically;

[0055] Figure 1b An embodiment of a homomorphic computing system implementation is illustrated schematically;

[0056] Figure 2a An embodiment of the implementation of the method "GenMult" that applies encrypted GLWE multiplication is illustrated schematically;

[0057] Figure 2b An embodiment of the implementation of the "GenSquare" method for applying encrypted GLWE multiplication is illustrated schematically;

[0058] Figure 2c An embodiment of the implementation of the method "MultLWE" for calculating LWE encrypted product values ​​is illustrated schematically;

[0059] Figure 3a An embodiment of an implementation of the "GenPBS" method, which applies programmable bootstrapping computation, is illustrated schematically.

[0060] Figure 3b An embodiment of an implementation of the "GenPBS" method, which applies programmable bootstrapping computation, is illustrated schematically.

[0061] Figure 4a An embodiment of the implementation of the method "WoP-PBS" for applying functions to LWE encrypted input values ​​is illustrated schematically;

[0062] Figure 4b An embodiment of the implementation of the method "WoP-PBS" for applying functions to LWE encrypted input values ​​is illustrated schematically;

[0063] Figure 5a An embodiment of the “WoP-PBS” method, which applies one function to another to LWE encrypted input values, is illustrated schematically.

[0064] Figure 5b The diagram illustrates a global function that is divided into one function and another based on the most significant bit.

[0065] Figure 6An embodiment of the implementation of the method "WoP-PBSmanyLUT" that applies multiple functions to LWE encrypted input values ​​is illustrated schematically;

[0066] Figure 7a An embodiment of an implementation of the method "Decomp" for extracting the least significant portion of an input value is schematically illustrated.

[0067] Figure 7b An embodiment of the implementation of the method "LP-WoP-BS" for bootstrapping LWE encrypted input values ​​is illustrated schematically;

[0068] Figure 7c An embodiment of the implementation of the method "LP-WoP-PBS" for applying a global function to LWE encrypted input values ​​is illustrated schematically;

[0069] Figure 8a An embodiment of a method for computing an AND gate on one or more LWE encrypted binary input values ​​is schematically illustrated.

[0070] Figure 8b An embodiment of a method for reducing noise in the binary value of LWE encryption is illustrated schematically;

[0071] Figure 8c An embodiment of a method for reducing noise in the binary value of LWE encryption is illustrated schematically;

[0072] Figure 9 An embodiment of the implementation of the method "AddMSB1" / "MulMSB1" for adding or multiplying LWE encrypted input values ​​and retaining the most significant part is illustrated schematically;

[0073] Figure 10a An embodiment of analog-to-digital switching operation is illustrated schematically;

[0074] Figure 10b An embodiment for extracting the least valid portion of the corresponding LWE encryption of the LWE encrypted input value is illustrated schematically;

[0075] Figure 11a An embodiment of a method implemented by a computer to perform calculations on LWE encrypted values ​​is illustrated schematically;

[0076] Figure 11b A computer-readable medium having a writable portion comprising a computer program according to one embodiment is illustrated schematically.

[0077] Figure 11c A representation of a processor system according to one embodiment is shown schematically. Detailed Implementation

[0078] Although the subject matter disclosed herein may be implemented in many different forms, it is understood that this disclosure should be regarded as an example of the principles of the subject matter disclosed herein, and is not intended to limit it to the specific embodiments shown and described, as one or more particular embodiments are shown in the accompanying drawings and will be described in detail herein.

[0079] In the following text, for ease of understanding, multiple elements of the implementation scheme are described in the operation. However, it is obvious that the corresponding elements are arranged to perform the functions described by them.

[0080] Furthermore, the subject matter disclosed herein is not limited to embodiments, but also includes combinations of each other feature described herein or recited in mutually different dependent claims.

[0081] Multiple implementations involve encrypting values ​​based on the Learning for Fault Tolerance (LWE) problem or the Generalized Learning for Fault Tolerance (GLWE) problem. This means that the encryption scheme treats the LWE or GLWE problem as a potential cryptographically difficult problem. Several embodiments of such encryption schemes are known in themselves and can be used with the provided techniques.

[0082] A known method for encrypting plaintext M using an LWE-based or GLWE-based encryption scheme is to encrypt the message as a sum of one or more random elements, the inner product of the random elements and the key, an error element, and the plaintext. For example:

[0083]

[0084] In this embodiment, q is the modulus; N is the polynomial ring dimension, typically a power of 2; Where f(X) is irreducible, usually f(x) = X N +1, where N is a power of 2; It is a key; yes The random element in; E is The error polynomial in the middle, It is plain text In this example, scaling is performed based on a scaling factor Δ. LWE encryption corresponds to the specific case k = n > 1 and N = 1. Ring fault-tolerant learning (RLWE) encryption corresponds to the specific case k = 1 and N > 1. In general, the GLWE encryption polynomial can be obtained by taking N > 1 and any k (therefore, RLWE encryption of the polynomial is an embodiment of GLWE encryption of the polynomial).

[0085] In GLWE, the ring dimension N of the polynomial is typically a power of 2. Random elements can be sampled as a polynomial, where the coefficients are derived from... The sampling is uniformly distributed. The error polynomial can be based on the error distribution associated with the GLWE problem (e.g., Gaussian distribution). Sampling can be performed based on the key distribution associated with the GLWE problem (e.g., uniform binary distribution, uniform triple distribution, or Gaussian distribution).

[0086] In the above embodiment, the ring Define the message space and the ciphertext space. An alternative is to use a real torus. Discrete torus or As a message space, and using or As a ciphertext space.

[0087] Another embodiment of encrypting plaintext M(X) according to LWE-based or GLWE-based encryption is by computing GGSW ciphertext. Message Based on GLWE key (As described above) the encrypted GGSW ciphertext is a matrix:

[0088]

[0089] The t-th row (where, 1≤i≤k+1 and ) is GLWE encryption (as described above), based on the plaintext key S:

[0090]

[0091] Among them, S k+1 (X) = -1 and It is the base, usually a power of 2. The above message and the plaintext space... Alternatives also apply here. Instantiation of a GGSW with k=n and N=1 is based on LWE ciphertext, called GSW ciphertext. Instantiation of a GGSW with k=1 and N>1 is based on RLWE ciphertext, called RGSW ciphertext. These types of ciphertexts are known to be used to generate bootstrap keys or to support certain hierarchical operations.

[0092] Generally, the security of LWE and GLWE-based ciphertexts is based on the key distribution and three main parameters: n = kN, where N is the polynomial ring dimension, k is the number of random elements in the ciphertext, and n is the key length; q, the ciphertext modulus; and σ, a statistical parameter of the noise, such as its standard deviation. Given these parameters, how to estimate the level of security provided is known in itself, for example, see M. Albrecht et al., “On the concrete hardness of Learning with Errors,” Journal of Mathematical Cryptology, DOI: 10.1515 / jmc-2015-0016 (included in this paper by reference).

[0093] In the implementation described herein, the parameters for the LWE-based and GLWE-based ciphertexts of the TFHE class used can be selected based on the desired security level and the desired computational precision (e.g., multiplication of LWE ciphertexts and / or application of programmable bootstrapping as described herein, in other words, the noise level generated by applying these operations). This paper provides a detailed noise analysis of multiplication with LWE ciphertexts according to the proposed technique. As is known per se, the noise levels of the other operations proposed herein can be derived from the noise levels of their suboperations. Interestingly, the choice of security parameters can be independent of computational complexity, such as the depth of multiplication. This differs from non-TFHE class schemes, where security parameters are typically chosen to limit or eliminate bootstrapping.

[0094] Specifically, the LWE-based ciphertext and / or GLWE-based ciphertext used in this paper can use relatively small moduli, such as up to 32 bits, up to 64 bits, or up to 128 bits, for example, q = 2. 32 q=2 64 Or q = 2 128 The modulus is typically chosen independently of the computation to be performed, for example, based on the desired precision and / or efficiency. Parameters n and / or σ can be chosen to achieve the desired security level, also typically independent of the computation to be performed. For example, n can be set to at least 512 and / or at most 2048 or 4096, e.g., 1024. For example, in one implementation, RLWE is used, where N is at least 512 and / or at most 2048 or 4096, e.g., 1024, and k = 1. Such n values ​​are generally not used in non-TFHE-type encryption schemes, where such values ​​would severely limit the computations that can be performed; instead, in non-TFHE-type schemes, q and n are typically chosen based on the desired security level, so q can be much larger.

[0095] As illustrated in the embodiments above, LWE encryption can be considered a specific instance of GLWE encryption, i.e., using a polynomial with a degree less than 1. In this specification, when referring to a GLWE encryption polynomial, a specific instance of LWE encryption should be excluded; for example, encryption refers to GLWE encryption based on a polynomial with a ring dimension greater than 1. However, the polynomial to be encrypted can be a zero-degree polynomial, such as a constant polynomial.

[0096] The above embodiments are symmetric-key encryption schemes in which the same symmetric key is used to encrypt and decrypt messages. However, the above embodiments can also be applied to asymmetric-key settings, where the public key used for encryption is different from the private key used for decryption. This transformation is known in itself, for example, see Z. Brakerski and V. Vaikuntanathan, “Fully Homomorphic Encryption from Ring-LWE and Security for Key DependentMessages,” proceedings CRYPTO 2011. The symmetric key is used as an example throughout this specification; it is to be understood that symmetric keys can also be used.

[0097] Generally, the provided techniques can be used in conjunction with TFHE-type encryption schemes based on the LWE problem (e.g., encryption schemes based on LWE that support programmable bootstrapping). Besides the "TFHE: fast fully homomorphic encryption over the torus" encryption scheme, this includes, for example, the encryption scheme of L. Ducas and D. Micciiancio, "FHEW: bootstrapping homomorphic encryption in less than a second," proceedings EUROCRYPT 2015.

[0098] Given ciphertext encrypted with a given key according to a given encryption scheme, various implementations employ cryptographic key switching operations to determine another ciphertext encrypted with a different key and / or a different encryption scheme. For example, key switching can be applied to the results of programmable bootstrapping. Cryptographic key switching operations typically use a key switching key, which is a key that allows the cryptographic key switching operation to be performed without disabling the decryption of the ciphertext. For example, the key switching key may include encryption of bits or other blocks of the key used to encrypt the input ciphertext. Key switching may introduce additional noise.

[0099] Specifically, the cryptographic key switching operation can be used to determine the GLWE cryptographic output polynomial from a set of LWE cryptographic input values. The output polynomial can be, for example, a zero-degree polynomial with constant coefficients among the input values. More generally, the output polynomial can be defined as a linear function of one or more input values.

[0100] Specifically, key switching can be private key switching. Private key switching allows for switching of p LWE ciphertexts. Apply privacy-preserving linear or Lipschitzian functions And use the key switching key KSK to create the GLWE ciphertext GLWE SK (f(m1,…,m p The key switching key can hide the function being applied. This key switching operation can be represented as follows:

[0101] CT out ←PrivateKS({ct i} i∈{1，p} KSK).

[0102] Key switching can also be public key switching. In this case, the linear or Lipshitz function f to be applied is known to the device performing the key switching and can be chosen by the device performing the key switching. This operation can be represented as follows:

[0103] CT out ←PublicKS({ct i} i∈{1，p} KSK, f).

[0104] For example, after a programmable bootstrap of an LWE encrypted input value, a key switch (e.g., a public key switch) can be performed to obtain an LWE encrypted programmable bootstrap output that uses the same cryptographic parameters as the LWE encrypted value. For example, the function f above can be an identity function, and the output GLWE can be instantiated as an LWE instance, for example, k = n′ and N = 1.

[0105] As one example, key switching can be packet key switching, where the GLWE encrypted output polynomial uses the corresponding LWE encrypted input value as coefficients. Specifically, given a set of LWE ciphertexts p≥1 and a set of... For p indices, the following function can be applied:

[0106]

[0107] This key switching can be represented as:

[0108]

[0109] Typically, packet key switching is implemented using public key switching, although private key switching can also be used.

[0110] Figure 1a An embodiment of an implementation of a device 110 for performing calculations on LWE encrypted values ​​is illustrated schematically.

[0111] LWE encrypted values ​​can be encrypted based on a fault-tolerant learning problem. Encryption can support programmable bootstrapping. Programmable bootstrapping can evaluate LWE decryption in the exponent of a GLWE encrypted monomial. GLWE encrypted polynomials can be encrypted based on polynomials of a generalized fault-tolerant learning problem.

[0112] Device 110 may include processor system 130, memory 140, and communication interface 150. Memory 140 may include local memory, such as a local hard disk drive or electronic storage. Memory 140 may also include non-local memory, such as cloud storage. In the latter case, memory 140 may include a memory interface to non-local memory. For example, memory 140 may be used to store a set of auxiliary keys for performing computations. The auxiliary keys may not allow decryption of LWE encrypted values. The auxiliary keys may include a set of bootstrap keys for performing programmable bootstrap operations. Memory 140 may store additional information, such as LWE encrypted values ​​and / or GLWE encrypted ciphertext used to perform computations, as also discussed elsewhere.

[0113] Device 110 can communicate internally with other devices, external storage, input devices, output devices, and / or one or more sensors via a computer network. This computer network can be the Internet, an intranet, a LAN, a WLAN, etc. The device includes a connection interface 150 arranged to communicate with other devices as needed. For example, the connection interface may include connectors, such as wired connectors (e.g., Ethernet connectors, optical connectors, etc.) or wireless connectors (e.g., antennas, such as Wi-Fi, 4G, or 5G antennas). Communication (e.g., internal communication) may use other communication protocols or media, such as an internal data bus.

[0114] In device 110, communication interface 150 can be used to send or receive digital data. For example, device 110 can be configured to receive, for instance, a set of LWE encrypted values ​​to be computed from a data provider device. Device 110 can perform computations, such as one or more computations including LWE encrypted product values ​​and / or one or more programmable bootstraps. Device 110 can send the result of the computation (e.g., LWE encrypted output values) to another device, such as the data provider device or another device.

[0115] Execution of device 110 may be implemented in processor system 130 (e.g., one or more processor circuits, such as a microprocessor), embodiments of which are shown herein. Device 110 may include multiple processors that may be distributed in different locations. For example, device 110 may use cloud computing.

[0116] Processor system 130 can be configured to compute an LWE encrypted product value based on one or more LWE encrypted input values. The computation of the product value may involve applying a cryptographic key switching operation to a set of LWE encrypted input values ​​to determine one or more GLWE encrypted input polynomials. The coefficients of the input polynomials may be a linear combination of a set of input values. The computation may also include applying cryptographic polynomial multiplication based on one or more GLWE encrypted input polynomials to obtain a GLWE encrypted output polynomial. The computation may also include applying a cryptographic sample extraction operation based on the GLWE encrypted output polynomial. The LWE encrypted product value can be obtained as an encryption of the polynomial coefficients.

[0117] Some of the functional units shown in the diagrams can be functional units of a processor system. For example, the diagram can be used as a blueprint for the possible functional organization of a processor system. In most diagrams, processor circuitry is not shown separately from the units. For example, Figures 2a-2c , Figures 3a-3b , Figures 4a-4b , Figure 5a , Figure 6 , Figures 7a-7c , Figures 8a-8c and Figure 9 The functional units shown (see below) may be implemented wholly or partially as computer instructions stored at a device (such as device 110), for example, stored in the electronic flash memory of device 110, and executable by the microprocessor of device 110. In a hybrid implementation, the functional units are implemented partly in hardware (e.g., as a coprocessor, such as an arithmetic and / or cryptographic coprocessor) and partly in software stored and executed on device 110.

[0118] For example, device 110 may be a device for performing computations using homomorphic cryptography. For example, device 110 may be used to perform computations on data, even if the data is received in encrypted form from a data provider, for example. The computation may include calculating one or more LWE cryptographic product values, for example, calculating the LWE cryptographic product of two LWE cryptographic input values, or calculating a square, etc.

[0119] For example, memory 140 may store LWE encrypted data items, such as data items received from one or more data providers, or data items generated as intermediate or final results (e.g., output) of a computation. Typically, most or all of the data items for which device 110 performs computation are encrypted with a key (or keys) unknown to device 110—that is, device 110 may not be configured to obtain plaintext data items corresponding to the encrypted data items (e.g., stored in memory 140). The plaintext decryption key is secret from device 110, although the encryption / decryption key may be available in encrypted form. For example, a processor system may be configured to perform a series of homomorphic encryption operations, which may include arithmetic operations on encrypted values, such as addition and multiplication, but may also include arithmetic operations on encrypted polynomials. Homomorphic operations may also include operations such as key switching and bootstrapping.

[0120] Figure 1b An embodiment of an implementation of an encrypted computing system 100 is schematically illustrated. System 100 is configured to perform computations using homomorphic encryption (e.g., fully homomorphic encryption). This computation may involve the calculation of LWE encrypted product values ​​by MultLWE cells 107-112.

[0121] The system 100 in this embodiment includes a data provider device 160 and an encrypted computing device 110. Device 110 can be configured to receive encrypted data items from the data provider 160. At least some data items can be received in encrypted form. Some data items can be received in plaintext format. Computations are performed on the received data items, and also on stored data items. Interestingly, computations can be performed on encrypted data without decryption, for example, without converting the encrypted data items to plaintext format.

[0122] The device 110 in this embodiment can be based on Figure 1a The device 110, for example, may include... Figure 1a The device 110 includes a processor system 130, a memory 140, and / or a communication interface 150. In this embodiment, the device 110 includes, for example, MultLWE units 107-112 implemented by the device's processor system. As part of performing cryptographic computation, MultLWE unit 121 can compute an LWE cryptographic product value based on an LWE cryptographic input value. For example, the LWE cryptographic input value can be or can be based on an LWE cryptographic value provided by the data provider device 160. Alternatives for performing cryptographic computation without a MultLWE unit are also possible and discussed throughout the specification; for example, the device 110 may include a GenPBS unit that may or may not be based on MultLWE.

[0123] Although not shown in this figure, the encrypted computing system 100 may include multiple encrypted computing devices, such as two, three, or more than three. Encrypted computing can be distributed among the multiple encrypted computing devices. The encrypted computing devices can exchange intermediate computation results (typically encrypted) with each other. Each encrypted multiplication device can be implemented like encrypted computing device 110 and can perform the calculation of LWE encrypted product values ​​as described herein.

[0124] Homomorphic encryption schemes can be applied to many settings. For example, encrypted computing device 110 can be used by a cloud provider. The cloud provider can offer computing and storage services to its customers. By employing homomorphic encryption, Figure 1b Data provider device 160 (e.g., a cloud provider's client) can send its data in encrypted form. The cloud provider can still perform the necessary computations and / or storage, but cannot know the corresponding plaintext data. For example, data provider device 160 can encrypt the data item using an encryption key of a type corresponding to the specific homomorphic encryption system used. When data provider 160 receives the computation result from encrypted computing device 110, it can decrypt the encrypted data item using the corresponding decryption key. The encryption key and the decryption key can be the same—and often are.

[0125] For example, an encrypted computing system 100 can be configured to train a machine learning model (e.g., an image classifier, such as a medical model) where the encrypted computing device has no access to the plaintext data items. For example, linear regression can be performed on the input data, possibly even without bootstrapping. For example, backpropagation can be performed on the input data, possibly utilizing bootstrapping. The resulting model parameters can be returned to an entity possessing the decryption key. This allows multiple providers of medical data to aggregate their data by sending it to a cloud provider. The cloud provider then returns the model parameters without accessing the plaintext data. The encryption key can be equal to the decryption key.

[0126] After the model is trained, the encrypted computing system 100 can be used to provide the model, for example, with medical data. This can be done using plaintext model parameters or encrypted model parameters—in both cases, encrypted data is used (e.g., encrypted input data, intermediate data, and output data). Using plaintext model parameters is generally more efficient. In both cases, one effect of the system is that computations can be performed without the computer knowing the plaintext data items (e.g., image classification, such as medical image classification). For example, a mammogram can be used to assess cancer without the image having been presented in plaintext on the encrypted computing device 110, and without any knowledge of the cancer assessment results by the encrypted computing device 110 or any consortium of such devices. From a privacy perspective, computing a plaintext model on encrypted privacy-sensitive data may be acceptable, while computing on plaintext privacy-sensitive data may be unacceptable.

[0127] Other applications involve database services, such as searching for encrypted data in an encrypted database; for example, a computation might be a comparison between an input item and a database item. For example, multiple computations can be combined to produce a database index that matches an index. For example, the database could be a genomic database, and the input could be a gene sequence. For example, system 100 can be used for protective control of devices. For example, a device (even a large device such as a power plant) can send sensor values ​​to encrypted computing device 110 and receive encrypted control signals as a return. Control signals are calculated based on the sensor signals. An attacker might be able to determine the content of data entering or leaving one or more encrypted computing devices 110, or even gain access to intermediate data on these devices, but this would be of no use to them because the data is encrypted. Since the decryption key is unknown to these devices, even if all the encrypted computing devices 110 of system 100 are completely compromised, the data will not be leaked. Computations on control signals can involve mathematical operations such as linear algebra, averaging, matrix multiplication, and polynomial evaluation, all of which can be performed using homomorphic encryption.

[0128] For example, a pool of encrypted data items can be maintained in a cryptographic computing system; some of these items can be received, and some can be the results of cryptographic computations, such as intermediate results. For instance, cryptographic computing device 110 can be configured to apply homomorphic encryption operations to one, two, or more encrypted data items in the pool, such as a set of input values ​​and / or intermediate values ​​and / or output values. The result may be a new encrypted data item that can be stored in the pool. The pool can be stored in the memory of the cryptographic computing system. This can be local memory or distributed memory. In the latter case, one or more encrypted data items may be represented multiple times in the pool. For example, if the value of an encrypted data item is needed elsewhere, the encrypted data item can be sent from one computing device to another. The pool can be implemented in various ways, such as as a register file, an array, various data structures, etc.

[0129] Encrypted data items can represent various types of data. For example, an encrypted data item can represent a number that needs to be averaged, or a number used for linear regression. For example, an encrypted data item can represent an image. For example, each pixel of an image can correspond to one or more encrypted data items. For example, a grayscale pixel can be represented by grayscale levels, which can in turn be represented by a single encrypted data item. For example, 256 grayscale levels can be encoded in a single encrypted data item. For example, a color pixel can be represented by multiple color levels, such as RGB levels, which can in turn be represented by tuples of encrypted data items. For example, three 256-level colors can be encoded in three encrypted data items. The number of encrypted data items used to represent a certain type of data depends on the capacity of the homomorphic encryption scheme. For example, a more restrictive homomorphic encryption scheme might only be able to encode one bit for each encrypted data item. In this case, a color pixel might require 24 encrypted data items.

[0130] While the decryption key may not be accessible, and the exact amount of noise in the encrypted value may be unknown, it can generally be limited, for example, because the initial noise level of the recently encrypted value is known, and the noise increase from various operations is known. The noise increase may depend on the type of operation (e.g., addition versus multiplication) and other parameters (if present). For example, a homomorphic encryption operation could be scalar multiplication: multiplying by a known value (e.g., the plaintext value). For instance, multiplying by a larger value may add more noise than multiplying by a smaller number. Given the operation performed, the exact amount of noise increase can be estimated mathematically or empirically. While some operations may add significant noise, others may not, such as adding to a plaintext constant.

[0131] A set of homomorphic encryption operations can be defined for computation. For example, based on homomorphic encryption operations, computational networks or circuits can be constructed, which perform computations together, for example, via an external compiler device or via the computing device itself. For example, operations can include Boolean operations. These operations can include the computation of at least one LWE encrypted product value. The way homomorphic encryption operations are combined (e.g., which operation is applied to which operand in the pool) determines the computation being performed. For example, a computation can be represented as a list of homomorphic encryption operations to be performed and instructions on which encrypted data item to perform them on.

[0132] Figure 2a (GenMult unit 205 is shown) An embodiment of an implementation of a method for applying encrypted GLWE multiplication using GenMult unit 205 is schematically shown.

[0133] The figure illustrates the use of the GenMult unit 205 to apply cryptographic polynomial multiplication to two GLWE cryptographic input polynomials M. (1) 240, M (2) 241, to obtain the GLWE encrypted output polynomial 242. The output polynomial can be the product of the input polynomials, for example, depending on the scaling. If the sum of the degrees of the input polynomials is greater than or equal to the ring dimension N of the polynomials, a modular reduction occurs, for example, Δ -1 M (1) M (2) mod X N +1.

[0134] From the context of polynomial encryption of RLWE ciphertexts, several techniques are known to be usable or applicable to GLWE settings. Generally, cryptographic polynomial multiplication can be performed by computing a product (e.g., a tensor product) followed by relinearization and / or key switching. Several techniques are known for both the product and the relinearization / key switching.

[0135] According to one technique, GenMult unit 205 can apply encrypted GLWE multiplication by computing a polynomial product of a first GLWE cryptographic polynomial and a second GLWE cryptographic polynomial as the corresponding polynomial in the key. GenMult unit 205 can then transform the polynomial product into a first-order polynomial in the key using a relinearization key. This relinearization key can be arranged to transform a second-order polynomial in the key into a first-order polynomial in the key. This method is known in specific cases of RLWE ciphertexts, for example, according to J. Fan et al., “Somewhat practical fully homomorphic encryption” (available at https: / / eprint.iacr.org / 2012 / 144, and incorporated herein by reference), which provides two different relinearization techniques.

[0136] An implementation of GenMult 205 based on the technique of Fan et al. is now provided. This implementation is based on J. Fan et al., but has been adapted in several ways. It uses GLWE instead of RLWE; it allows for different scaling factors Δ i Used for the corresponding input ciphertext; and it is encrypted using a symmetric key:

[0137]

[0138]

[0139] Alternatively, alternative relinearization techniques can be used, such as the second relinearization technique of J. Fan et al., or the technique given by C. Boura et al. in “CHIMERA: Combining Ring-LWE-based Fully Homomorphic Encryption schemes”, J. Math. Cryptol., 14(1): 316-338, 202. Relinearization may optionally include key switching, in which case it can be implemented, for example, as follows:

[0140]

[0141] Where, for i∈[1,k], j∈[1,i], h∈[1,l]:

[0142]

[0143] in,

[0144]

[0145]

[0146] coefficient in middle

[0147] coefficient in middle

[0148] Alternative techniques for performing cryptographic polynomial multiplication are known, such as “Fully homomorphic encryption without modulus switching from classical gapsvp” from Z. Brakerski, IACR Cryptology ePrint Archive, 2012:78, which involves computing the product as tensors of two ciphertexts to be multiplied, multiplying each by a power of 2, and then performing a key switch, where the tensor of the key’s bit decomposition is encrypted.

[0149] Optionally, between the product and relinearization and / or key switching, one or more additional operations, such as one or more additions and / or multiplications with constants, can be performed. This is called lazy relinearization. This can help improve both efficiency and noise management.

[0150] Figure 2b (GenSquare unit 206 is shown) An embodiment of an implementation of a method for applying encrypted GLWE multiplication using GenSquare unit 206 is schematically illustrated. This embodiment is based on Figure 2a The embodiments described herein, and the various alternatives discussed with respect to the figure also apply here.

[0151] As discussed above, encrypted polynomial multiplication can be performed by computing a product (e.g., a tensor product) followed by relinearization and / or key switching. In this embodiment, the computed product is the square of the GLWE encrypted input polynomial 243. After relinearization and / or key switching, the GenSquare unit 206 can output the GLWE encrypted polynomial 244 of the polynomial square.

[0152] For example, regarding Figure 2a The example implementation of GenMult discussed can be adapted to obtain an implementation of GenSquare, as follows:

[0153]

[0154]

[0155] As mentioned above, variations of this implementation are possible, for example, using different relinearization techniques and / or combining them with key switching.

[0156] refer to Figure 2a and Figure 2b A detailed noise analysis is now provided for the example implementations of GenMult and GenSquare discussed above. Similar results are expected to apply to various variants, such as implementations of GLWE polynomial multiplication using different products and / or different relinearization processes.

[0157] The input to GenMult or GenSquare is two GLWE ciphertexts modulo q:

[0158]

[0159]

[0160] For the purposes of this analysis, the assumptions are defined as follows:

[0161] · It is a key polynomial whose coefficients can be sampled from uniform binary, uniform triplet, or Gaussian distributions.

[0162] · and yes The polynomial in the formula has coefficients from Mid-sampling,

[0163] ·E (1) E (2) yes The error polynomials in the equations are such that their coefficients are derived from Gaussian distributions. Mid-sampling,

[0164] · and in And Δ (1) and Δ (2) It is the scaling factor.

[0165] The first step (modulus switching, tensor product, rescaling, rounding, and modulo) is computation:

[0166] depending on k items

[0167] Depends on S i ·S j item

[0168] Depends on S i k items

[0169] 1 constant term

[0170] Among them, Δ=min(Δ1, Δ2).

[0171] The final step (relinearization) is computation: in It is to relinearize the key so that each component (where i∈[1,k], j∈[1,i], h∈[1,l]) is defined as:

[0172]

[0173] in,

[0174]

[0175] In this embodiment, the error variance at the output of the tensor product can be estimated using the following formula, where S′ indicates the squared element of the key, and S″ represents the product of two distinct key elements. The symbols odd and even indicate the odd and even coefficients of the polynomial S′, respectively, while the symbol mean indicates the mean estimate.

[0176]

[0177] The noise formula can be adapted when the message polynomial is not dense and the error polynomial has coefficients following two distinct distributions. Specifically, assume the message polynomial M contains 0 ≤ α ≤ N filling coefficients, and their corresponding error terms follow a Gaussian distribution. And there exist N-α empty coefficients, and they contain coefficients from the distribution The error.

[0178] Consider two message polynomials, M1 and M2. The first polynomial contains α1 message coefficients. The second polynomial contains α² message systems.

[0179] Consider the coefficients in the resulting plaintext polynomial, which is derived from m 1，i ·m 2，j Filling with single products of the form (1≤i≤α1 and 1≤j≤α2).

[0180] For example, in products such as:

[0181] (a0+a1X+a3X 3)·(b0+b1X)=

[0182] =a0b0+(a0b1+a1b0)X+a1b1X 2 +a3b0X 3 +a3b1X 4

[0183] =c0+c1X+c2X 2 +c3X 3 +c4X 4

[0184] These are the coefficients c0, c2, c3, and c4.

[0185] One example is the result of an LWE to GLWE key switch, where the constant term may be the only term containing the message, and its error may be greater than the errors of the other coefficients.

[0186] In this embodiment, the error variance at the output of the tensor product can be estimated using the following formula:

[0187]

[0188] In this embodiment, after tensor product and relinearization, the final error of the multiplication is:

[0189]

[0190] Figure 2c (MultLWE units 207-212 are shown) An embodiment of an implementation of a method for calculating LWE encrypted product values ​​using MultLWE units 207, 208, 209, 210, 211 or 212 is schematically shown.

[0191] This embodiment illustrates the calculation of an LWE encrypted product value 262 based on one or more LWE encrypted input values. For illustrative purposes, two LWE encrypted input values ​​260 and 261 are shown, but it is also possible to use only one LWE encrypted input value, for example, to calculate its square, or to use more LWE encrypted input values, such as to calculate the cube or inner product, as discussed below. LWE encrypted input values ​​260-261 can be encrypted using the same key.

[0192] Referring to the corresponding MultLWE units 207-212 discussed in this figure, one or more GLWE encrypted input polynomials 245-246 can be determined by applying cryptographic key switching operation 200 to a set of LWE encrypted input values ​​260-261 to compute LWE encrypted product value 262. The coefficients of the input polynomials 245-246 are linear combinations of the set of input values. The key switching can be implemented as PackingKS as described herein. The number of GLWE encrypted input polynomials 245-246 can vary; for example, it can be one (e.g., for computed encrypted GLWE multiplication using GenSquare), two (e.g., for computed encrypted GLWE multiplication using GenMult), or more (e.g., for repeated use of GenSquare and / or GenMult). Key switching 200 can be configured to output RLWE encryption 245, 246 (e.g., GLWE parameter k = 1), or other types of GLWE encryption (e.g., GLWE parameter k > 1 and N > 1).

[0193] Based on one or more GLWE encrypted input polynomials 245-246, encrypted polynomial multiplication 205-206 can be applied to obtain the GLWE encrypted output polynomial 247. For example, the encrypted polynomial multiplication could be the multiplication GenMult 205, for example, as per [reference to...]. Figure 2a The discussion may also include any other techniques used to perform polynomial multiplication of two potentially different GLWE cryptographic polynomials. Cryptographic polynomial multiplication can also be squaring GenSquare 205, for example, as discussed regarding Figure 2b The discussion or use of any other techniques for performing polynomial squaring of GLWE cryptographic polynomials.

[0194] Polynomial multiplication can be applied directly to the input polynomial, but one or more operations in the GLWE cryptographic domain can also be applied in the middle (e.g., addition and / or scalar multiplication).

[0195] Multiple polynomial multiplications can also be performed; for example, a GLWE cryptographic polynomial can be multiplied by itself multiple times to compute polynomial powers (e.g., cubes). Additional operations, such as additional additions and / or scalar multiplications, can also be performed on the output polynomial 247 within the GLWE cryptographic domain. For example, arithmetic circuitry can be applied to the GLWE cryptographic input polynomials 245-246 within a GLWE cryptographic domain comprising one or more multiplications 205-206. Arithmetic circuitry can generate multiple GLWE cryptographic polynomials.

[0196] Alternative or additional land, as well as regarding Figure 2a and Figure 2bThe discussion suggests that additional operations can be applied between tensor products and the relinearization / key switching of GenMult and GenSquare operations, for example, using lazy relinearization.

[0197] Based on the GLWE encrypted output polynomial 247, a cryptographic sample extraction operation 201 can be applied. For example, sample extraction can be applied to the output polynomial 247, or more generally, to the result of applying an arithmetic circuit in the GLWE encrypted domain. Sample extraction can produce an LWE encrypted product value 262, which encrypts the coefficients of the polynomial to which it is applied. The LWE encrypted product value 262 can typically represent the result of a polynomial function applied to the LWE encrypted inputs 260-261, such as a quadratic function, such as a square, product, or inner product; or a function of degree greater than 2, such as a cube. Multiple coefficients can also be extracted from multiple GLWE encrypted polynomials as desired, and / or coefficients can be extracted. LWE encryption itself, using sample extraction to obtain coefficients from GLWE encryption, is known, for example, from "TFHE: fast fully homomorphic encryption over the torus".

[0198] Computing LWE-encrypted products in this manner offers several advantages compared to techniques previously used in the TFHE setting. A significant advantage is the elimination of padding, as the multiplication does not rely on PBSs known in the art. Furthermore, computational efficiency is improved. For example, when using RLWE ciphertext to compute the product of two LWE-encrypted values, it can be observed that instead of using two PBSs (each involving over 500 outer products), the computational cost can be reduced to the equivalent of approximately 7 outer products. The performance improvement is even greater for other computations that are difficult to compute in the TFHE setting using conventional techniques (e.g., inner products).

[0199] Another advantage is the reduction in the size of the required key material. Again, taking the calculation of the product of two LWE encrypted values ​​as an example, the required key size is... One integer is used for key switching, plus... A total of integers are used for the relinearization key in GenMult 205, totaling n integers. Using existing PBS-based techniques, the total key size is n. There are 10 integers. Compared to n, The factors are relatively small, and all are roughly the same size. Therefore, it can be observed that the size of the key material used is reduced to less than half. As mentioned above, the reduction is similar for other product calculations (e.g., inner products and squares).

[0200] Generally, the MultLWE unit described herein can be configured such that the LWE encrypted product value 262 is encrypted using the same key as the LWE encrypted input values ​​260, 261; however, the product value 262 can also be encrypted using a different key. For illustrative purposes, in the embodiments given in the remainder of this specification, it can be assumed that the input key and the output key are the same, and it should be understood that these techniques are also applicable when the input key and the output key are different.

[0201] Several detailed embodiments of this calculation of the LWE encrypted product value 262 are now given.

[0202] In the example MultLWE unit 207, the multiplication of the LWE encrypted first value 260 and the second value 261 can be calculated. The GLWE encrypted first input polynomial 245 and the second input polynomial 246 can be determined by using the first value and the second value as coefficients, for example, as constant coefficients. The GenMult unit 205 can be used to calculate the GLWE encrypted product 247 of the first input polynomial 245 and the second input polynomial 246. The LWE encrypted product 262 of the first value and the second value can be extracted by the SampleExtract unit 201 as coefficients of the GLWE encrypted output polynomial 247. This unit can be implemented as follows:

[0203]

[0204]

[0205] In example MultLWE unit 208, the multiplication of the LWE encrypted first value 260 and the second value 261 can be computed using key switching 200 to pack the two values ​​260, 261 into the corresponding coefficients of a single GLWE encrypted input polynomial 245. GenSquare unit 206 can be used to compute the GLWE encrypted output polynomial 247 as the square of the input polynomial. The LWE encrypted product 262 can be obtained as the coefficients of this output polynomial. Interestingly, this improves computational efficiency, for example, because only a single packing is required. This unit can be implemented as follows:

[0206]

[0207]

[0208] As discussed, lazy relinearization can be applied in conjunction with the proposed techniques. For example, the append operation can be applied to the non-relinearized GLWE cryptographic polynomial by applying the append operation to the output of MultLWE units 207-212, removing the relinearization operation of GenMult 205 or GenSquare 206 and the SampleExtract operation 201 from the MultLWE units 207-212 for later execution in different units. The remainder of MultLWE 207, 208 can be represented as follows:

[0209] CT out ←MultLWE * (ct1, ct2, KSK)

[0210] CT out ←MultSquareLWE * (ct1, ct2, KSK)

[0211] In this case, one or more operations can be applied to the outputs of these functions, followed by relinearization and sample extraction to obtain the LWE encrypted value.

[0212] Both MultLWE units 207 and 208 allow the multiplication of two LWE encrypted values. MultLWE unit 207 has the advantage of producing less noise output. MultLWE unit 208 has the advantage of higher computational efficiency. Therefore, depending on the circumstances, MultLWE unit 207 or 208 may preferably perform the multiplication.

[0213] In another example, MultLWE unit 209, multiple first LWE encrypted input values ​​can be packed into the corresponding coefficients of a first GLWE encrypted input polynomial 245, and multiple second LWE encrypted input values ​​can be packed into the corresponding coefficients of a second GLWE encrypted input polynomial 246. By calculating the polynomial product, a GLWE encrypted output polynomial 247 can be obtained, where the corresponding coefficients correspond to the product of the respective first and second input values. These corresponding coefficients can then be extracted by SampleExtract unit 201. Therefore, a single GLWE encrypted polynomial multiplication 245 is sufficient to compute the corresponding LWE encrypted product, resulting in improved efficiency. This unit can be implemented as follows:

[0214]

[0215] In the illustrated embodiment, the encryption of the first set of LWE encrypted input values ​​has the same scaling factor Δ1, and the scaling factor Δ2 of the second set of LWE encrypted input values ​​is similar. This embodiment can be adapted to accept different corresponding scaling factors. as well as

[0216] This algorithm can start with two sets of α LWE ciphertexts, pack each set into a single GLWE ciphertext in precise order, compute multiplication (e.g., tensor product, then re-linearize), and extract each result from the precise coefficients. The two GLWE ciphertexts being multiplied may contain plaintexts P1 and P2, such that:

[0217]

[0218]

[0219] Now, if we multiply them together, we get the following polynomial:

[0220]

[0221] Where i′=imodα and And when extracting the c-th coefficient (c=2) k+1 -2 and 0≤k<α), we will get Δ1Δ2m 1，j m 2，j ,because:

[0222] c = jα + j ≡ j mod α

[0223]

[0224] This is as expected. During the tensor product process, one of the increments (the smallest increment) can be removed.

[0225] Interestingly, this algorithm is comparable in cost to performing multiple MultLWEs independently. MultLWE209 can use two PackingKS and one GenMult. An alternative costs 2α PackingKS and α GenMults. These PackingKS are slightly less expensive because the polynomials to be fed into the FFT are mostly sparse, but α of them need to be performed. Overall, the inventors found that this algorithm exhibits better performance than performing α MultLWEs independently.

[0226] In another embodiment, MultLWE unit 210, multiple LWE encrypted input values ​​can be packaged into the corresponding coefficients of a single GLWE encrypted input polynomial 245. The coefficients can be selected such that using GenSquare 246 to calculate the square of the input polynomial 245 results in a GLWE encrypted output polynomial 247 with the squares of the corresponding input values ​​as the corresponding coefficients. These coefficients can then be extracted. This unit can be implemented as follows:

[0227]

[0228]

[0229] Regarding the implementation of MultLWE unit 209, this implementation can be adapted to support different corresponding scaling factors for the corresponding LWE encrypted input values.

[0230] This algorithm can start with a set of α LWE ciphertexts, pack this set into a single GLWE ciphertext in precise order, compute the squares (e.g., tensor product, then re-linearize), and finally extract each result from the precise coefficients. The GLWE ciphertext multiplied by itself may contain plaintext P such that:

[0231]

[0232] Now, if we multiply them together, we get the following polynomial:

[0233]

[0234] When extracting the c-th coefficient (c=2) k+1 -2 and 0≤k<α), we will get because:

[0235] c = 2 k+1 -2 = 2 k +2 k -2

[0236] This is as expected. One of the increments can be removed during the tensor product.

[0237] MultLWE unit 210 can also be adapted to compute the corresponding product between the first set of LWE encrypted input values ​​and the second set of LWE encrypted input values. The first set of LWE encrypted values ​​and the second set of LWE encrypted values ​​can be packed into a single GLWE encrypted input polynomial 245, such that their squares have the corresponding product as coefficients. For example, the grouped LWE encrypted input values ​​can be as well as By using coefficients The first α coefficient is filled with ciphertext from the first group, and the second half is filled with ciphertext from the second group to complete the packing of 200, where 2 α / 2 ≤N. Sample extraction 201 can extract position 2. i-1 +2 α+i-1 The α coefficients in -2 (where i = 0, ..., α-1) are used to obtain the corresponding LWE encrypted product.

[0238] In the above embodiments, the coefficients of the extracted GLWE encrypted output polynomial 247 are equal to the product (e.g., squared) of the corresponding LWE encrypted input values. Interestingly, the inventors recognized that packing 200 can also be performed such that the coefficients correspond to the sum of the products of the LWE encrypted input values, in other words, to the inner product of the LWE encrypted input values ​​treated as vectors. This is demonstrated in MultLWE units 211 and 212.

[0239] In embodiment MultLWE unit 211, the inner product between the first set of LWE encrypted values ​​and the second set of LWE encrypted values ​​can be calculated by determining the first input polynomial 245 and the second input polynomial 246 of GLWE encryption, respectively using the first set of values ​​and the second set of values ​​as coefficients, such that the polynomial product uses the inner product as coefficients. The GLWE encrypted output polynomial 247 can be calculated using GenMult 205 as the product of the first input polynomial 245 and the second input polynomial 246. The LWE encrypted output value 262 can be determined by extracting the coefficients corresponding to the inner product from 201. This unit can be implemented as follows:

[0240]

[0241]

[0242] Regarding the implementation of MultLWE unit 209, this implementation can be adapted to support different corresponding scaling factors for the corresponding LWE encrypted input values.

[0243] This algorithm can start with two sets of α LWE ciphertexts, pack each set into a single GLWE ciphertext in precise order, compute multiplication (e.g., tensor product, followed by relinearization), and finally extract the result from the precise coefficients. The two GLWE ciphertexts being multiplied may contain plaintexts P1 and P2, such that:

[0244]

[0245]

[0246] Now, if we multiply them together, we get the following polynomial:

[0247]

[0248] When extracting the c-th coefficient (c = α - 1), we get This is as expected. One of the increments (the smallest increment) can be removed during the tensor product process.

[0249] In the MultLWE unit 212 of the embodiment, a sum of squares can be calculated; in other words, the inner product of a set of LWE encrypted input values ​​with itself can be calculated. To do this, the GLWE encrypted input polynomial 245 can be determined to use this set of values ​​as coefficients such that its polynomial product has a sum of squares of coefficients. For example, GenSquare 206 can be used to calculate the GLWE encrypted output polynomial 247 as the square of the GLWE encrypted input polynomial 245, and the LWE encrypted product value 262 can be obtained by extracting the coefficients corresponding to the sum of squares at 201. This unit can be implemented as follows:

[0250]

[0251] Regarding the implementation of MultLWE unit 209, this implementation can be adapted to support different corresponding scaling factors for the corresponding LWE encrypted input values.

[0252] This algorithm can start with a set of α LWE ciphertexts, pack the set into a single GLWE ciphertext in precise order, compute the squares (e.g., tensor product, then re-linearize), and finally extract the result from the precise coefficients. The GLWE ciphertext multiplied by itself can contain the plaintext P such that:

[0253]

[0254] Where, when 0≤i<α, μ i =m i When α≤i<2α, μ i =m α-1-i If we multiply them now, we get the following polynomial:

[0255]

[0256] When extracting the c-th coefficient (c = 2α - 1), we get This is as expected. One of the increments can be removed during the tensor product process, and the factor of 2 can be obtained during the polynomial squaring process.

[0257] Noise analysis is now provided for the operations performed by MultLWE units 207-212. Units 207-208 can perform packing key switching before multiplication or squaring and final sample extraction. Sample extraction may not affect the noise, while PackingKS may.

[0258] Consider the LWE key s = (s1, ..., s2) n ) and input LWE ciphertext c = (a1, ..., a n b), making Where e comes from

[0259] Consider the GLWE key S = (S1, ..., S2) k ) and the following GLWE ciphertext (where 1≤i≤n and The key switching key composed of ) makes Where E (i，j) The coefficient comes from

[0260] During the algorithm process, {a i} can be rounded to Find the nearest multiple of i, then decompose it such that for 1 ≤ i ≤ n, for in exist The middle is uniform, and a i，j 'exist The middle is uniform.

[0261] Then, the error variance at the PackingKS output can be estimated as follows:

[0262]

[0263] This is the noise formula for the coefficients filled in during packaging. For other coefficients, the noise can be reduced to:

[0264]

[0265] Units 209-212 can first use key switching to package the LWE ciphertext into a GLWE ciphertext. According to Var(E) PackingKS The estimate given by the formula for ) may introduce noise. The final step could be multiplication or squaring (e.g., using tensor products and relinearization), which can also increase noise. This noise can be as follows: Figure 2a The subject of discussion.

[0266] Figure 3a (GenPBS unit 313, GenPBS* unit 313a and GenMonomialLift unit 313b are shown) An embodiment of an implementation of a method for applying programmable bootstrapping operations using GenPBS unit 313 is schematically illustrated.

[0267] This method can be used in conjunction with the calculation of LWE encrypted product values ​​using MultLWE units (e.g., as regarding...). Figure 2cThe discussed applications include, for example, programmable bootstrapping, which can be applied to LWE encrypted product values ​​or to LWE encrypted values ​​calculated based on it. However, the techniques discussed in this figure can also be used in settings without MultLWE units.

[0268] The programmable bootstrapping GenPBS 313 in the diagram can be applied to the LWE encrypted input value 360. As is known inherently in the TFHE setup, programmable bootstrapping can be performed based on the evaluation 303 of LWE decryption in the exponent of the GLWE encrypted onemium. This evaluation is also known as blind rotation. Blind rotation typically uses a set of bootstrapping keys to allow LWE decryption to be performed only in the exponent; for example, this prevents the LWE encrypted value from being decrypted to obtain its plaintext, but only yields the GLWE encrypted onemium corresponding to the plaintext.

[0269] As is known by itself, the programmable bootstrap 313 can determine the rescaling 330 of the LWE encrypted input value by performing a modulus-to-digital switching operation 302. The modulus-to-digital switching operation 302 can scale the LWE encrypted input value 360 ​​to the set of exponents of the GLWE encrypted monomial, for example, a set of integers modulo 2N. It is known that linearly scaling the LWE encrypted input value 360 ​​to the set [0, 2N], i.e., by calculating...

[0270] Interestingly, the inventors realized that by scaling the analog-to-digital switch 302 in different ways, bootstrapping could be performed on specific blocks of input values. This more general analog-to-digital switch could be achieved through two parameters. and Parameters can be one or both of these. The size of the most significant portion of an input value not considered in PBS can be defined, such as the number of most significant bits. Parameters The number of functions that can be evaluated simultaneously in a single PBS in some implementations can be defined; for example, the number of functions can be...

[0271] Newly introduced parameters like Figure 10a As shown in the figure, the LWE encrypted input value 010 to which the modulus-to-digital switching can be applied is illustrated. The result can be a scaled LWE encrypted ciphertext 011 mapped to the exponent set [0, 2N], 005 of the GLWE encrypted monomial.

[0272] The LWE encrypted input value 010 can contain a message that has: a first part 001, size is 004, for example The LWE encrypted input value may also include an error portion e, 003. The scaled LWE encrypted ciphertext may contain a message portion m, 002, while the partial... 001 is removed due to scaling. The scaled LWE encrypted ciphertext can also contain an error portion e′, 007. Interestingly, the error portion 007 can be followed by a block of size θ, 006 (e.g., θ bits) that does not contain the error.

[0273] return Figure 3a The portion of the LWE encrypted input message 360 ​​considered by the programmable bootstrap can be encoded as a window. One of the values, which is factored Rescaling. Assume element a of the LWE encrypted input value 360. i i∈[1,n+1] belongs to the interval If the parameter represents the bit size, then modulus switching 302 can switch the corresponding element a. i And factors that depend on two parameters (e.g., Multiply; round the result; if It is the bit size, which depends on the parameter. Another factor (e.g., The result is rescaled and then mapped to the set of exponents of the GLWE cryptographic polynomial, for example, by reducing the modulus to 2N.

[0274] Following analog-to-digital switching 302, blind rotation 303 can be applied to the scaled LWE encrypted ciphertext 330. As is known per se, blind rotation can be used to apply a univariate function to the input value, which is why this type of bootstrapping is often referred to as programmable bootstrapping. The applied function may or may not be an identity function. The function to be evaluated can be represented by a test polynomial 350, also known as a lookup table (LUT). Blind rotation can begin with the test polynomial and effectively rotate it by decrypting the exponents of the GLWE encrypted monomials multiplied by the test polynomial to obtain a GLWE encrypted polynomial 351, where the coefficients of the test polynomial corresponding to the encrypted input value are rotated to a fixed position, for example, to constant coefficients. If each coefficient is repeated r times consecutively, the LUT is called r-redundancy. This redundancy allows noise during PBS to be removed.

[0275] The test polynomial 350 can be represented as a lookup table P. LUT Trivial GLWE encryption, for example, without randomness, such as (0, P) LUT For example, P LUTIt can be a redundant lookup table of size N. An encrypted lookup table can be, for example, rotated using a CMux operation loop based on a scaled LWE ciphertext 330 and a bootstrap key. A lookup table P can also be used. LUT The ordinary GLWE encryption 350. In this specification, the symbol P LUT Its variants are used to represent both trivial and nontrivial GLWE encryption 350 lookup tables.

[0276] Therefore, blind rotation 303 can generate a GLWE encrypted polynomial 351, which takes the coefficients of the test polynomial 350 corresponding to the LWE encrypted input value 360 ​​as specific fixed coefficients vX. i For example, the constant coefficient i = 0. 301ct of password sample extraction. out ←SampleExtract i (CT in Optionally, this can be applied to the GLWE encryption polynomial 351, which extracts the i-th coefficient as the LWE encryption output value 361. Therefore, the LWE encryption output value 361 can represent the value applied according to the parameters. The result of a function that scales the LWE encrypted input value to 360. Parameter values. It can be used to apply programmable bootstraps known in the art, and the parameter values It can be used to gain greater flexibility.

[0277] A detailed embodiment of the improved programmable bootstrap is as follows:

[0278]

[0279] Let m be the message and Δ be its scaling factor. and These are the parameters for the analog-to-digital switching 302. (Definition) For example, for simplicity, we can assume However, this is usually unnecessary. In defining the output ciphertext ct... out When , the values ​​β and m′ can be characterized as follows:

[0280] -if Let m′ = m mod q′ / 2 and

[0281] -if Let m′ = m and β be a random bit.

[0282] Therefore, it can be observed that the correctness of the GenPBS 313 output depends only on the sign, for example, on whether β = 0. In some cases, this may not be a problem, for example, it can be ensured that... Furthermore, m mod q′ is always less than q′ / 2 or always at least equal to q′ / 2. This is what is typically done in the prior art when applying known programmable bootstraps. In other cases, if the correctness of the output depends solely on the sign, it may be unacceptable. In this case, it is interesting that the general programmable bootstrap 313 can be used as a subroutine of a programmable bootstrap whose output is always correct, as shown in Figures 4 to 5. Figure 6 As demonstrated, it achieves greater flexibility compared to known PBS.

[0283] Programmable bootstrapping need not include sample extraction 301. For example, additional operations can be performed on the result 351 of blind rotation 303 in the GLWE encryption domain before switching back to the LWE encryption domain. This is shown in the figure as GenPBS* operation 313a.

[0284] A special case of GenPBS* operation 313a is to test the function P. f Set as a constant function P f =Δ out This can be called "monomial lifting" and is shown in the diagram as the GenMonomialLift operation 313b. For example, GenMonomialLift313b can be implemented as:

[0285]

[0286] The output of this algorithm can be characterized as follows. Let m be the message, and Δ be its scaling factor. and For the parameters of modulus switching 302. Consider the LWE ciphertext: LWE s (m·Δ in ) = (a1, ..., a n a n+1 =b). Definition Then in CT out In the definition,

[0287] Figure 3b (GenPBS unit 313′ and GenPBS* unit 313a′ are shown) An embodiment of an implementation of a method for applying programmable bootstrapping operations using GenPBS unit 313′ is schematically illustrated. This embodiment is based on Figure 3a The embodiments and various options described with respect to the figure.

[0288] In the embodiment shown in this figure, one or more programmable bootstraps can be applied to the same LWE encrypted input message 360. Firstly, it can be as follows regarding... Figure 3aThe discussed application of the GenMonomialLift operation 313b to the input message, thus as regarding Figure 3a The discussed generation of GLWE encrypted monomial 352. Due to the use of GenMonomialLift, the computation in this diagram benefits from the parameter... and / or The configurability of the programmable bootstrapping, such as regarding Figure 3a The subject of discussion.

[0289] To apply one or more corresponding functions to the LWE encrypted input values, the GLWE encrypted monomial 352 can be multiplied by one or more corresponding test polynomials used for the corresponding function, thereby obtaining one or more GLWE encrypted polynomials 353, 354 that take the function output as fixed coefficients, as shown in the following... Figure 3a As described. One or more of the test polynomials can be encrypted, in which case, for example, using... Figure 2a The GenMult unit 205 under discussion, or other techniques known per se, can be used to perform GLWE encrypted multiplication. Alternatively or additionally, one or more test polynomials may be plaintext, in which case techniques known per se can be used to perform GLWE encrypted monomial 352 multiplication with plaintext polynomial CMult 304.

[0290] The resulting GLWE cryptographic polynomials 353-354 can represent one or more key-switching-free GenPBS*313a′ (e.g., corresponding to...). Figure 3a The programmable bootstrap output of the GenPBS* unit 313a). Sample extraction 301 can also be applied to some or all of the GLWE encryption polynomials 353-354 to obtain the corresponding LWE encryption function outputs 362-363, as also referenced. Figure 3a The above is discussed. Therefore, the LWE encryption function output 362-363 can represent one or more keys that do not require key switching (e.g., corresponding to...). Figure 3a The programmable bootstrap output of GenPBS 313′ (GenPBS unit 313). Especially when used to apply multiple functions, Figure 3b The technology may be more Figure 3a The technology is more effective.

[0291] Instead of using GenMonomialLift 313b, you can also use functions The GenPBS* unit 313a makes each function This technique itself is known for programmable bootstrapping, but it cannot be achieved through parameters derived from S. Carpov et al.'s "New techniques for multi-value input homomorphic evaluation and applications," Proceedings CT-RSA 2019. Parameterization is then performed. Polynomial multiplication 304-305 can then be used to combine the output of the GenPBS* cell with the corresponding polynomial received as encrypted or plaintext input. Multiplication. In some cases, a polynomial can be defined. The coefficient is less than The coefficient, in this case, leads to an increase in efficiency.

[0292] Figure 4a (WoP-PBS units 415 and 416 are shown) An embodiment of an implementation of a method for applying a function to an LWE encrypted input value using WoP-PBS units 415 or 416 is illustrated.

[0293] As shown in the figure, the programmable bootstrap GenPBS 413 (e.g.) Figure 3a GenPBS 313 or Figure 3b The GenPBS313 can be applied to the LWE encryption input value 460 to obtain the LWE encryption function output 461.

[0294] Programmable bootstraps known in the art (e.g., special cases) The disadvantage of GenPBS 313 is that it only works when the most significant bit is known (e.g., known to be zero). This function effectively ignores the most significant bit, and its sign may be incorrect. This is why existing technologies require the assumption that the programmable bootstrap input will use the padding bit as the most significant bit. Similarly, for the general version GenPBS 413, its output 461 guarantees correctness depending solely on the sign.

[0295] Interestingly, the inventors recognized that when the same LWE encrypted input value is applied multiple times with the same scaling, the programmable bootstrap 413 may consistently produce the same error in its symbols. That is, its outputs may all have correct symbols, or they may all have incorrect symbols. This is because blind rotations are inherently independent of the underlying encoding function.

[0296] Therefore, the inventors envision applying programmable bootstrapping 413 several times. The function itself can be applied to obtain a symbol-dependent LWE encryption function output 461, and a constant function can be applied to obtain a symbol-dependent LWE encryption constant output 462. To obtain correct scaling, GenPBS 413 can use parameters... This call effectively scales the LWE encrypted input value 460 to the size N of the lookup table. More generally, this scales the LWE encrypted input value 460 to be discarded by a given number of the most significant bits. Parameters can be used To invoke GenPBS 413. Depends on the scaling factor Δ out The constant output can be equal to one. For example:

[0297]

[0298] It can also be used Figure 6 The PBSmanyLUT 619′ is used to improve efficiency. In any case, since the sign error in the LWE encryption constant output 462 is consistent with the sign error in the LWE encryption function output 461, the LWE encryption function output 461 can be corrected based on the LWE encryption constant output 462.

[0299] As shown in this embodiment, correction can be performed by first calculating the LWE encryption function output 461 and then multiplying it by the LWE encryption constant 462 using the MultLWE unit 462, resulting in the LWE encryption correction function output 463. For example, any suitable MultLWE units 207-212 can be used, or more generally, any technique for multiplying with the LWE encryption value without padding can be used. It can be observed that:

[0300]

[0301] as well as

[0302]

[0303] Therefore, by applying MultLWE 407 to these two ciphertexts 461 and 462, it can be observed that the correct function output 463 is obtained in both cases. That is, let ct out ←MultLWE(ct f ct Sign ,RLK), then:

[0304]

[0305] For example, using Figure 3aThe WoP-PBS unit 415 of GenPBS 313 can be implemented as follows:

[0306]

[0307]

[0308] The alternative WoP-PBS unit 416 can be used Figure 3b It is obtained from GenPBS 313′. Compared to WoP-PBS unit 415, this alternative is computationally more efficient because it uses a single boost instead of two PBSs. For example:

[0309]

[0310]

[0311] This embodiment involves input ciphertext ct in An evaluation of single-item improvement is conducted. This is given... or Because the input may not have padding bits. Next, the product of two polynomials is computed, possibly in parallel. Let and By applying SampleExtract to the constant term of the resulting product, the algorithm can calculate:

[0312] SampleExtract0(ct in ×P f )=LWE(±Δ out f(μ * ))

[0313] Similarly, the second product ct in ×P Δ The constant term can be equal to:

[0314] SampleExtract0(ct in ×P f )=LWE(±Δ out ).

[0315] For two products, the rotations caused by the encrypted monomials can be identical, resulting in identical signs. Then, as expected, the output of the operation is decrypted:

[0316] Decrypt(MultLWE(LWE(±Δ out ·f(μ * LWE(±Δ) out ),RLK))

[0317] We can obtain:

[0318] Δ out ·f(μ * ).

[0319] Figure 4b (WoP-PBS unit 417 is shown) An embodiment of an implementation of a method for applying a function to an LWE encrypted input value using WoP-PBS unit 417 is illustrated.

[0320] This embodiment is based on and Figure 4a The same idea applies: correcting the LWE cryptographic function output computed by the programmable bootstrap, whose correctness depends on the symbol, by using the LWE cryptographic constant output, which depends on the symbol. However, in this embodiment, the correction is applied in the GLWE domain before sample extraction by the programmable bootstrap.

[0321] Specifically, the figure shows the LWE encrypted input value 460. As shown, the programmable bootstrap operation 417 can be applied to the LWE encrypted input value. (See also: Regarding...) Figure 3a and Figure 3b The programmable bootstrapping discussed may involve GenPBS* operation 413a (e.g., using...) Figure 3a GenPBS*313a or Figure 3b The GenPBS*) produces a GLWE cryptographic polynomial 450 whose correctness depends on the output of a function of the sign as coefficients.

[0322] Interestingly, however, this polynomial can be corrected before extracting coefficients from the GLWE cryptographic polynomial 450 to ensure its correctness, and that correctness depends on more than just the sign. For this purpose, as... Figure 4a As shown, the programmable bootstrap 413 can be used to apply a constant function to the LWE encrypted input value 460, causing the correctness of the LWE encrypted constant output 464 and the LWE encrypted polynomial 450 to depend on the same sign. Although shown as a separate unit 413, the programmable bootstrap 413 of the identity function can share operations with the programmable bootstrap 413a of the function to be applied; for example, the programmable bootstrap 413 can be implemented as... Figure 3b The GenPBS 313' is implemented as GenPBS*313', while the programmable bootstrap 413 is implemented as GenPBS*313', both of which use the result 352 of the GenMonomialLift operation 313b.

[0323] To perform correction in the GLWE domain, the symbol-dependent LWE cryptographic constant output 464 can be converted into a symbol-dependent GLWE cryptographic constant polynomial 440 in the packing key switching operation 400. Then, the programmable bootstrap GLWE cryptographic monomial of function 450 can be multiplied by the symbol-dependent GLWE cryptographic constant polynomial 440 using the GenMult operation 405. Thus, a programmable bootstrap GLWE cryptographic monomial 451 can be obtained, whose correctness no longer depends solely on the symbol. This can be used... Figure 2a The GenMult operation 205 can be used, but any other technique for multiplying the GLWE cryptographic polynomial can also be used.

[0324] When applying the GenMult operation 405, the GLWE cryptographic monomial 450 may have already been multiplied by the test polynomial of the function to be applied, for example, as a result of applying the GenPBS* operation 413a, but this is not necessary. For example, the GenMult operation 405 can also be applied to the result of applying the GenMonomialLift operation 413b to the LWE cryptographic ciphertext 460, and then the result of the GenMult operation 405 is multiplied by the test polynomial. Alternatively, the GLWE cryptographic constant polynomial 440, whose correctness depends on the sign, can be multiplied by the test polynomial of the function before multiplying the GLWE cryptographic monomial by the GLWE cryptographic constant polynomial.

[0325] In any case, as a result of the applied correction, the product of the monomial whose correctness depends on the sign, the test polynomial, and the constant polynomial whose correctness depends on the sign, 451, can be obtained. Figure 3a and Figure 3b Similarly, the fixed coefficients of polynomial 451 can correspond to the desired function output. However, in this case, the coefficients are correct, and correctness depends on more than just the sign. Figure 3a and Figure 3b Similarly, the LWE encryption correction function output 463' can then be obtained from the polynomial 451 by performing the SampleExtract operation 401 to extract the fixed coefficients.

[0326] Also Figure 3a and Figure 3bIn some cases, sample extraction 401 is not required as part of the applied PBS, for example, sample extraction can be performed at a later stage of the computation. This operation without sample extraction is shown in the figure as WoP-PBS*417a. An operation using GenMonomialLift 413b can also be defined, which does not include subsequent multiplication with the test polynomial or subsequent sample extraction. This operation corresponds to the monomial lifting operation, whose result is correct and not solely dependent on padding. This operation is shown in the figure as WoP-ML operation 417b.

[0327] For example, WoP-ML operation 417b can be implemented as follows:

[0328]

[0329] As discussed, in the algorithm described above, the ct is used Sign GenPBS 413 can overlap with GenPBS*413a / GenMonomialLift 413b, for example, ct Sign The calculation can be performed as ct Sign ←CT ML ×P1. This can improve efficiency, but at the cost of resulting in higher noise.

[0330] Figure 5a (WoP-PBS unit 518 is shown) An embodiment of an implementation of a method for applying a first function f0(x) and a second function f1(x) to an LWE encrypted input value 560 using the WoP-PBS unit 518 is illustrated. Interestingly, this allows for a more efficient evaluation of the overall function f(x) of the input value 560.

[0331] Figure 5b This is explained in detail below. The message m, 591, is shown, written as β||m′, where β, 592 is the most significant bit and m′, 593 is the remainder of the message. To compute the overall function f(x), 595, this function can be divided into a first function f0, 594 and a second function f1, 595. If β, 592 equals 0, the first function provides the correct result; if β = 1, the second function provides the correct result. Therefore, the function f(x) can be computed using a programmable bootstrapping mechanism, where f0(x) is chosen if x is in the domain 597 satisfying β = 0, and f1(x) is chosen if x is in the domain 598 satisfying β = 1. Encryption of bit β can be obtained by computed using a programmable bootstrapping mechanism with a constant function.

[0332] Interestingly, efficiency can be improved by splitting the computation of the entire function into the computation of a first function and a second function. This is because the first and second functions are defined on domains 597 and 598, which are half the size of the entire function. The computation of the symbol β can be performed on the same domain. Applying PBS to a domain of half the size often makes the application of PBS much more efficient. For example, the known computational complexity of PBS might be:

[0333]

[0334] In this embodiment, it can be seen that using PBS with half the polynomial size N results in a speedup of strictly greater than 2 times; that is, the complexity is proportional to Nlog2(N), where N is the polynomial size. Figures 4a-4b Compared to other techniques, instead of two PBSs (one for the global function and one for the symbol), three PBSs can be executed with half the polynomial size, potentially improving efficiency. Another advantage is that three PBSs can be computed in parallel. This provides a particular improvement when executing on a multithreaded machine, since a single PBS may not parallelize well. In other words, messages with an additional bit can be bootstrapped using the parameters of the classic PBS.

[0335] exist Figure 5a This idea is illustrated in the figure. As shown, the programmable bootstrap operation GenPBS 513 can be applied to the LWE encrypted input value 560 to apply a first function, a second function, and a constant function to the LWE encrypted input value 560. For example, it can be used... Figure 3a GenPBS 313, Figure 3b GenPBS 313′ or Figure 6 The PBSmanyLUT 619' can be used to perform analog-to-digital switching such that the programmable bootstrap generates LWE encryption first function output 561, LWE encryption second function output 562, and LWE encryption constant output 563, all of which depend on the same symbols for correctness.

[0336] and Figure 4a and Figure 4bIn contrast, since the first and second functions may not require the most significant bit, scaling can be performed such that an extra bit of LWE encrypted input message 560 is ignored. For example, where WoP-PBS 415-417 scales the input message to the domain [0, N], WoP-PBS 518 can scale the input message to the domain [0, 2N]. In this sense, the current WoP-PBS can be considered to provide higher precision. More generally, given that the number of most significant bits to be ignored in the input message χ ≥ 0, GenPBS can be called with this same value χ. The calculation of the LWE encryption constant output 563 can be performed using the same scaling to provide a result with symbol-dependent correctness.

[0337] The LWE encryption constant output 563, whose correctness depends on the symbol, can now be used to select and correct either the LWE encryption first function output 561, whose correctness depends on the symbol, or the LWE encryption second function output 562, whose correctness depends on the symbol. In this embodiment, this is accomplished by calculating the LWE encryption first function output 561 and the second function output 562 and applying the correction in the LWE encryption domain, similar to... Figure 4a However, corrections can also be applied in the GLWE cryptographic domain, similar to... Figure 4b .

[0338] Specifically, in this diagram, selection and correction are performed by calculating the LWE encryption product 564 of the LWE encryption first function output 561 and the LWE encryption constant output 563 using MultLWE operations 507-509. The LWE encryption constant output 563 is transformed to form the selection bits for the first function output, thus obtaining the conditional selection first function output 564 of the LWE encryption. Similarly, MultLWE operations 507-509 can be used to calculate the LWE encryption product 565 of the LWE encryption second function output 562 and the LWE encryption constant output 563, where the LWE encryption constant output 563 is transformed to form the selection bits for the second function output, thus obtaining the conditional selection second function output 565 of the LWE encryption. The conditional selection outputs 564 and 565 of the LWE encryption can be added 529 in the AddLWE operation to obtain the overall LWE encryption function output 566. For example, the MultLWE operation could be... Figure 2c The MultLWE operation can be 207, 208, or 209, but any other technique for LWE encrypted multiplication that does not require padding can also be used.

[0339] For example, the LWE encryption constant output can correspond to the output scaling factor Δ out s = ±1 / 2·Δ out The selection bit of the first function output can be calculated by β0 = s + 1 / 2 · Δout This can be obtained by calculating β1 = s-1 / 2·Δ. out To obtain.

[0340] For example, suppose the LWE encrypted input message 560 does not have its most significant bit set. In this case, the LWE encryption first function output 561 can correspond to the output of the overall function, where the sign is also correct. The LWE encryption constant output 563 is also correct, with the correct sign: s = 1 / 2 Δ out The selected bits can be β0 = 1 and β1 = 0, so that the LWE encryption function output 566 corresponds to the correct output of the function.

[0341] Now assume that the LWE encrypted input message 560 has its most significant bit set. In this case, the LWE encrypted second function output 562 can correspond to the output of the overall function, where the sign is incorrect. The LWE encrypted constant output 563 may also have an incorrect sign: s = -1 / 2·Δ out The selected bits can be β0 = 0 and β1 = -1, so that the LWE encryption function output 566 again corresponds to the correct output of the function.

[0342] For example, WoP-PBS518 can be implemented as follows:

[0343]

[0344]

[0345] Several variations of the above algorithm are possible. For MultLWE, any of MultLWE units 307, 308, and 309 can be used. Using MultLWE unit 309 generally provides better performance than MultLWE units 307 and 308. Instead of using individual MultLWE units 507-509 and a separate AddLWE unit 529, a single MultLWE unit can also be used to directly compute the sum of products, for example, MultLWE unit 211:

[0346]

[0347] This will provide better performance.

[0348] The outputs of conditionally chosen functions can also be summed and then re-linearized into LWE ciphertext by performing lazy relinearization. This improves performance and reduces noise, for example:

[0349]

[0350] As mentioned above, the GenPBS operation 513 can be implemented in several ways. Specifically, one possibility is to use a function... The GenPBS* unit 313a makes each function Also, regarding Figure 3b As discussed. Another possibility is to use GenMonomialLift 313b and the corresponding polynomial multiplication 304 or 305, also as discussed regarding Figure 3b For example, those discussed:

[0351]

[0352] Both of these possibilities are particularly advantageous in single-threaded computations, as only a single PBS needs to be computed, or an operation of similar cost, such as a monomial boost. However, the output noise may be greater. The second possibility, using a monomial boost, typically provides higher noise, so the GenPBS* possibility is generally preferred. In multi-threaded setups, GenPBS 313 may be preferred due to its lower noise.

[0353] Figure 6 (WoP-PBSmanyLUT unit 619 is shown) An embodiment of an implementation of a method for applying multiple functions to LWE encrypted input values ​​using WoP-PBSmanyLUT unit 619 is illustrated.

[0354] The LWE encrypted input value 660 is shown. The inventors recognized that programmable bootstrapping (as shown in the diagram) can be performed by using generalized analog-to-digital switching. Figures 3a-3b The functions discussed can be effectively applied to the LWE encrypted input value 660.

[0355] Therefore, in programmable bootstrapping, function outputs representing multiple corresponding functions can be used (e.g., The test polynomial f(x) is defined by interleaving the coefficients of the test polynomials f1(x), f2(x), ... for the corresponding function. For example, the previous... Each coefficient can represent f i The corresponding constant coefficients, the following Each coefficient can represent f i The corresponding first-order coefficient, and so on.

[0356] This figure illustrates the GenPBS* operation 613a using a test polynomial. For example, the GenPBS* operation could be... Figure 3a GenPBS* operation 313a or Figure 3bThe GenPBS* operation 313a′. Although this figure only shows a single set of multiple corresponding functions applied, it can also be similar to... Figure 3b Apply multiple sets of functions.

[0357] The modulus switching of the programmable bootstrap 613a can be performed using the test polynomial discussed, enabling the scaling of LWE encrypted ciphertexts to... The least significant bit is set to zero. Then, blind rotation can produce the GLWE cryptographic polynomial 651, where the constant coefficients (or another fixed coefficient) correspond to the output of the first function, and the following coefficients correspond to the outputs of the other functions. Setting the least significant bit to zero ensures that it starts with a fixed coefficient. Each coefficient is the output of the corresponding function applied to the same input.

[0358] The corresponding coefficients of the GLWE encrypted polynomial 651 can be extracted in the sample extraction operation 601′ to obtain the LWE encrypted output 661 of the corresponding function. The figure shows the PBSmanyLUT 619′ unit that provides this combination of GenPBS*613a and SampleExtract 601′.

[0359] Interestingly, PBSmanyLUT 619′ utilizes the degrees of freedom of GenPBS*613 to employ variable window sizes, enabling efficient evaluation of multiple functions in a single blind rotation. Conceptually, the idea is to define a smaller window for the plaintext by tweaking the bounds in the LSB. GenPBS's... The parameters can be represented by the known TFHE PBS. Compared to the number of bits that were withdrawn. After the modulus-to-digital switch. Each LSB can be set to 0, for example, it can obtain The plaintext. The form of the LUT polynomial can be derived from... Set a parameter to include up to [number] parameters. A function, for example:

[0360] in

[0361] The lookup table may be redundant; in this case, each block of the function (e.g., f) i (in The sequence of coefficients repeats effectively along the polynomial. For example, a lookup table can be represented as containing a polynomial. An array of coefficients:

[0362] c0, c1, c2, ..., c N-1 ,

[0363] A redundant lookup table can be represented as:

[0364] f(0), f(0), f(0),..., f(1), f(1), f(1),...,....

[0365] A redundant lookup table representing multiple functions can be represented as:

[0366] ((f1(0), f2(0),...), (f1(0), f2(0),...),...), ((f1(1), f2(1),...), (f1(1), f2(1),...),...),...

[0367] In this case, after blind rotation and extraction of the first coefficients of the resulting polynomial, f1(m)·Δ can be obtained. out The encryption. Since the LUT represents multiple functions, the next coefficient of the GLWE ciphertext can be represented as f2(m)·Δ. out Extraction through samples A continuous coefficient can be obtained Each output ciphertext represents a function. Interestingly, due to the relatively efficient sample extraction, the complexity is roughly the same as that of a PBS evaluating only one function, and the key material size is the same as that of a PBS evaluating one function.

[0368] No precise assessment required A function, for example, can reduce the minimum value of the scaled LWE ciphertext. The bit is set to zero, but less than [amount] is extracted. Several coefficients. In terms of efficiency, scaling to powers of 2 is advantageous, for example, by using a parameter representing the number of bits. Because it allows the use of bitwise operations. However, this is not necessary: ​​typically, LWE ciphertext can be transmitted through different... Scaling is applied to any factor Θ to allow evaluation of up to Θ functions using a single blind rotation.

[0369] It can be noted that the correctness of the output 661 of PBSmanyLUT 619′ generally depends on the sign, for example, unless it can be assumed that their most significant bit is zero. Despite this limitation, PBSmanyLUT 619′ remains a beneficial application of the standalone GenPBS*613a.

[0370] For example, PBSmanyLUT unit 619' can be implemented as follows:

[0371]

[0372] As shown in the figure, the test polynomial 650 representing multiple functions can also be used to implement the WoP-PBSmanyLUT unit 619 for evaluating multiple functions, while the LWE encrypted input value 660 does not need to have padding bits.

[0373] To this end, the programmable bootstrap operation 613 can be used to apply a constant function to the LWE encrypted input value 660, causing the correctness of the LWE encrypted constant output 662 to depend on the sign. This LWE encrypted constant output 662 can then be used to correct the programmable bootstrap of the test polynomial 650 representing multiple functions. To compute the LWE encrypted constant output, for example, GenPBS unit 313 or 313' can be used. Interestingly, the LWE encrypted constant output can also be one of the LWE encrypted outputs 661 of PBSmanyLUT619'.

[0374] To apply the correction, you can use about Figure 4a , Figure 4b and Figure 5a Any technology discussed.

[0375] Specifically, similar to Figure 4a Correction can be performed by multiplying the corresponding LWE encryption function output 661 by the LWE encryption constant output 662, for example, using... Figure 2c The MultLWE unit under discussion, or any other technique multiplied by the LWE encrypted value.

[0376] like Figure 6 As shown, corrections can also be performed in the GLWE encryption domain, similar to... Figure 4b To this end, the symbol-dependent LWE cryptographic constant output 662 can be converted into a symbol-dependent GLWE cryptographic constant polynomial 641 using the packing key switching operation 600. Then, the GenMult operation (e.g., ...) can be used for multiplication with the GLWE cryptographic polynomial. Figure 2a In GenMult 205, the programmable bootstrapping GLWE encrypted monomial 651 of the function is multiplied by the GLWE encrypted constant polynomial 641. As mentioned above, the multiplication of monomial 651, constant polynomial 641, and test polynomial 650 can theoretically be performed in any order. In these embodiments, SampleExtract 601' and PackingKS 600' are not performed unless SampleExtract 601' can be used to compute the LWE encrypted constant output 662. The corresponding function output 663 can then be extracted using the sample extraction operation 601, with correctness not solely dependent on the sign, similar to SampleExtract 601'.

[0377] In another embodiment, SampleExtract 601' is performed, and the LWE encryption function output 661, whose correctness depends on the symbol, can be converted into a GLWE encryption polynomial 640 with the corresponding function output as coefficients. GenMult 605 and SampleExtract 601 can then be performed as described above. This alternative can be used when it is desired to use GLWE parameters in the GLWE domain that differ from those used by GenPBS*613, corrected by GenMult 605.

[0378] Specifically, the provided technique for efficiently evaluating multiple functions on the same LWE encrypted input value 660 can be used to more efficiently implement so-called circuit bootstrapping operations. As is known per se, such an operation converts the LWE encrypted input value 660, representing bits, into ciphertext for hierarchical evaluation, such as GGSW ciphertext. Interestingly, the ability of the PBSmanyLUT unit 619′ and the WoP-PBSmanyLUT unit 619 to compute several functions in a single bootstrapping operation can allow for a reduction in the computational cost of circuit bootstrapping. The number of times, that is, the circuit bootstrapping can A single PBS operation applied to the same input ciphertext can be replaced by a single call to PBSmanyLUT 619' or WoP-PBSmanyLUT 619.

[0379] For example, a known circuit bootstrap can use l programmable bootstraps, as shown below:

[0380]

[0381] These programmable bootstraps can be implemented using the PBSmanyLUT unit 619' via the following calculations:

[0382]

[0383] Make P a redundant LUT:

[0384]

[0385] This represents the following polynomial:

[0386]

[0387] Figure 7a (Decomp unit 720 is shown) An embodiment of an implementation of a method for extracting the least significant portion of an input value using Decomp unit 720 is schematically shown.

[0388] This diagram illustrates an LWE encrypted input value 760 from which one or more least significant portions are extracted. As shown, this can be achieved using a programmable bootstrap that does not require padding of the WoP-PBS 715-718 (e.g., as per [reference]). Figure 4a , Figure 4b or Figure 5a The WoP-PBS unit under discussion applies a potentially rescaled identity function to the LWE encrypted input value 760 to extract the least significant portion 761 from the LWE encrypted input value 761.

[0389] Interestingly, in programmable bootstrapping, analog-to-digital switching can scale the LWE encryption input value, allowing the LWE encryption function output 761 to encrypt the least significant portion of the input value. For example, to extract the least significant 4 bits of a 16-bit value, the most significant 12 bits can be ignored, and so on. Interestingly, only the size of the portion to be extracted (not the entire message size) requires PBS, which can significantly improve efficiency. Furthermore, the input value 760 itself does not need to have padding bits. This is impossible in PBS that requires padding bits because the bits preceding the portion to be extracted are unknown.

[0390] Then, in the SubLWE operation 728, the LWE encryption function output 761 can be subtracted from the LWE encryption input value to obtain the LWE encryption of the most significant portion of the LWE encryption input value 760. The above process can be repeated to extract the corresponding least significant portion of the LWE encryption input value 760, for example, to obtain corresponding blocks of, for example, a specific size from the LWE encryption input value. For example, each time m is encrypted... i Δ i , making The alpha ciphertext can be obtained.

[0391] For example, Decomp unit 720 can be implemented as follows:

[0392]

[0393] Optionally, the key switching can be performed during the relinearization computed in the GLWE polynomial, which is part of WoP-PBS. This can improve efficiency if the chosen LWE size is smaller than the initial LWE size. Alternatively, a different function can be used (if desired) instead of computed using WoP-PBS715-718.

[0394] exist Figure 10bThe diagram illustrates the computation of the corresponding least significant portion using the described technique. Again, the input message m, 020, encrypted with error e, is decomposed into four corresponding least significant portions of α = 4. In successive iterations, the least significant values ​​m0, 024; m1, 023; m2, 022; and m3, 021 are successively extracted and subtracted from the input message 020. The extracted corresponding least significant portions have corresponding scaling factors δ. i ,045-042, where the scaling factor 045 of the first extracted part corresponds to the scaling factor of the input message 020 itself.

[0395] Figure 7b (LP-WoP-BS unit 721 is shown) An embodiment of an implementation of a method for bootstrapping LWE encrypted input values ​​using LP-WoP-BS unit 721 is schematically shown.

[0396] As shown in the figure, given the LWE encrypted input value 760, Figure 7a The Decomp unit 720 can be used to obtain the highest valid portions 761-0 to 761-α of the corresponding extracted LWE encryption of the input value. By adding these (appropriately scaled) valid portions 761-i together using the AddLWE unit 729, the LWE encryption output value 762 can be obtained, representing the bootstrapping of the input value; in other words, the LWE encryption of the same value (which may depend on rescaling) has a noise level independent of the noise level in the LWE encryption 760. Therefore, noise in the LWE encryption input value 760 can generally be effectively reduced.

[0397] For example, LP-WoP-BS unit 721 can be implemented as follows:

[0398]

[0399] Figure 7c (LP-WoP-PBS unit 722 is shown) An embodiment of an implementation of a method for applying a global function to LWE encrypted input values ​​using LP-WoP-PBS unit 722 is schematically shown.

[0400] As shown in the figure, given the LWE encrypted input value 760, Figure 7a The Decomp unit 720 can be used to obtain the highest valid portion 761-0 to 761-α of the LWE encryption correspondingly extracted from the input value.

[0401] Given the highest valid part 761-i of the LWE encryption, the DecompF unit 727 can be used to apply the overall function to the LWE encryption input value 770 by applying the corresponding programmable bootstrap operation to the corresponding extracted highest valid part 761-i of the LWE encryption.

[0402] For various types of functions, it is known that their evaluation can be made more efficient by applying them to LWE encryption block 761-i rather than to the overall input value 760 of LWE encryption. Specifically, A can be applied. The technique provided in “Revisiting the functional bootstrap in TFHE”, IACR Trans. Cryptogr. Hardw. Embed. Syst., 2021(2): 229-253, 2021 (included in this paper by reference). This reference provides two algorithms for computing programmable bootstraps based on decomposition, whose signatures can be expressed as:

[0403] ct out ←Tree-PBS({ct in，j} j BSK, KSK, {P i} i∈[1，L] )

[0404] ct out ←ChainPBS({ct in，j} j BSK, KSK, {P i} i∈[1，L] )

[0405] Where {P i} i∈[1，L] This is a lookup table encoding functions F and BSK, where KSK is the required key material. ct in，j It is for m j The LWE encryption block 761-i is used for encryption, where m = ∑ j m j B j , and ct out The LWE encryption function outputs 763.

[0406] For example, LP-WoP-PBS unit 722 can be implemented as:

[0407]

[0408] In the above algorithm, it is also possible to use

[0409] ct out ←ChainPBS({ct in，j} j BSK, KSK, {P i} i∈[1，L] )

[0410] Instead of Tree-PBS. Interestingly, the Tree-PBS and ChainPBS calls used in LP-WoP-PBS can also be improved by replacing the use of known PBSs with WoP-PBSs described herein (e.g., WoP-PBS 415, 416, 417, 518, or WoP-PBSmanyLUT619). This alleviates the need for ciphertext calls to Tree-PBS or ChainPBS with padding bits, thus also providing the advantages discussed for WoP-PBS in this case.

[0411] Figure 8a An embodiment of an implementation of a method for computing AND gates on one or more LWE encrypted binary input values ​​is illustrated schematically.

[0412] In the TFHE setup, it is known to evaluate Boolean circuits by performing linear combination and subsequent programmable bootstrapping for the corresponding gates. The inventors recognized that this evaluation of Boolean circuits could be improved by using multiplication of LWE encrypted ciphertexts as described herein, without requiring padding bits in the ciphertext.

[0413] This embodiment illustrates a first LWE encryption bit 860 and a second LWE encryption bit 861. Interestingly, these bits are encoded as 0 if b = 0, and as q / 2 if b = 1, where q is the modulus of the LWE encryption. As shown, using this encoding, the AND gate can be computed as a homomorphic multiplication of two values ​​more efficiently on LWE encryption bits 860-861, for example, using any of the MultLWE units 207-212, for example,

[0414] ct1 AND ct2=MultLWE(ct1,ct2,RLK,KSK)

[0415] Interestingly, this encoding is achieved through the availability of the padding-free MultLWE operation, allowing other binary operations to be performed without bootstrapping. For example, the XOR operation can be computed as ct1 XOR ct2 = ct1 + ct2, and the NOT operation can be computed by adding q / 2. Other Boolean gates can be implemented based on these basic gates, for example:

[0416] ct1 NAND ct2=NOT(ct1 AND ct2)

[0417] ct1 OR ct2=ct1 XOR ct2 XOR(ct1 AND ct2)

[0418] Therefore, the availability of MultLWE operations, as described in this paper, makes the evaluation of binary circuits more efficient.

[0419] While operations such as XOR or NOT may not require programmable bootstrapping, some of them, like XOR, can introduce noise. Therefore, depending on the computation, noise reduction may be necessary. Interestingly, programmable bootstrapping can be used particularly effectively to reduce noise in such cases. (See reference...) Figure 8b and Figure 8c Two possible ways to do this are discussed.

[0420] exist Figure 8b In this approach, noise in the LWE encryption bit 862 is reduced by performing a programmable bootstrapping using a GenPBS unit 813 (e.g., GenPBS 313 or 313'). This involves multiplying the GLWE encryption monomial of the binary value 862 by the test polynomial, such that the programmable bootstrapping results in a bootstrap output 863 of the LWE encryption equal to either a positive or negative quarter of the LWE modulus. By adding a quarter of the LWE modulus 829, 864 (e.g., a trivial encryption of that value), an encryption 865 with the same number of bits as encryption 862 is obtained, whose noise level is independent of the noise level in encryption 862, thus reducing noise. This can be implemented as follows:

[0421]

[0422] Effectively, it is possible to target functions An evaluation is performed to provide a sample extraction of constant terms in the programmable bootstrap. Then, you can add The form of the trivial LWE. The result is the bootstrapping of the input values ​​because:

[0423]

[0424] exist Figure 8c In this implementation, a GenPBS unit 813 (e.g., GenPBS 313 or 313') is used, where a modulus switch scales the LWE encrypted binary value 862, causing a programmable bootstrap to produce an LWE encryption function output 865'. The LWE encryption function output 865' is equal to 0 or half the LWE modulus, thus directly representing the bootstrap of the input ciphertext 862. This can be implemented as follows:

[0425]

[0426] Here, we use another window size, which can be considered as a displacement, for example, and In this case, it can be observed that the sign does not affect the value of the encoded bits; for example, ±0 = 0 and Then, as expected, use the function. as well as To evaluate GenPBS, you might get 0 or one of the.

[0427] Figure 9 (AddMSBI unit 923 and MulMSB2 unit 925 are shown) An embodiment of an implementation of a method for adding or multiplying an LWE encrypted input value using AddMSBI unit 923 or MulMSBI unit 925 and retaining the most valid part is illustrated.

[0428] These units can be used to efficiently evaluate LWE encrypted integers pressed by 2. p (p>1) Modulo arithmetic circuits. Such arithmetic circuits may include those operating on encrypted values ​​m1, m2∈{0, 2}. p Any combination of the following operators for -1}:

[0429] • The inverse of LSB:

[0430] • Addition while preserving LSB:

[0431] • Addition while retaining MSB:

[0432] Multiplication while preserving the least squares (LSB):

[0433] Multiplication while retaining MSB:

[0434] In one implementation, the arithmetic circuit may include one or more inverse operations. The inverse of the LWE encrypted ciphertext can be computed by performing a homomorphic negation.

[0435] In one implementation, the arithmetic circuit may include one or more "AddLSB" operations. The AddMSB operation can be performed as a homomorphic addition on LWE encrypted ciphertext.

[0436] In one implementation, the arithmetic circuit may include one or more "MulLSB" operations. The MulLSB operation can be performed on LWE encrypted ciphertext by performing LWE encrypted multiplication, for example, using... Figure 2c Any MultLWE 207-212 or by using another technique for LWE encrypted multiplication.

[0437] Since some operations introduce noise, such as homomorphic addition, noise reduction may be necessary. For this purpose, any WoPPBS with an identity function can be used, such as WoPPBS 415, 416, 518, or LP-WoP-BS 721, especially due to their efficiency.

[0438] In one implementation, the arithmetic circuit may include one or more AddMSB operations and / or one or more MulMSB operations. Figure 9 Examples are shown of performing AddMSB or MulMSB operations on the first LWE encrypted input value 960 and the second LWE encrypted input value 961 using AddMSBI unit 923 or MulMSBI unit 925, respectively.

[0439] like Figure 9 As shown, WoP-PBS units 915-919 (e.g., WoP-PBS 415, 416, 417, 518, or WoP-PBSmanyLUT 619) can be used to apply an identity function to the LWE encrypted input values ​​960 and 961 to obtain LWE encrypted padded input values ​​962 and 963, where p padding bits are added to the padded input values. This step is optional and is not required if the padding bits already exist due to earlier operations.

[0440] For AddMSBI unit 923, given LWE-encrypted padded input values ​​962 and 963, the addition operation AddLWE 929 can be applied to obtain the LWE-encrypted sum 964 of padded input values ​​962 and 963. For MulMSBI unit 925, the multiplication operations MultLWE 907 and 908 can be applied to obtain the LWE-encrypted product 964 of padded input values ​​962 and 963. For example, MultLWE units 207 or 208 or any other technique for multiplying with LWE-encrypted input values ​​can be used.

[0441] Generally, given an LWE encrypted sum or product of 964, the expected output 967 of units 923 and 925 can correspond to the p most significant bits of this result. This output can typically be obtained by applying an identity function to the LWE encrypted sum or product using programmable bootstrap 915-919, where the modulus switching of the programmable bootstrap scales the LWE encrypted sum or product of 964, resulting in the programmable bootstrap producing the least significant portion 965 of the LWE encrypted sum or product. The least significant portion 965 can then be subtracted from the LWE encrypted sum or product of 966 in the SubLWE operation 928 to obtain the most significant portion 967 of the LWE encrypted sum or product.

[0442] Optionally, key switching can be performed on input 964 of WoP-PBS 915-919 and / or output of SubLWE 928. For simplicity, these are not shown in the figures and can also be performed alternatively as part of relinearization. For AddMSBI, instead of extracting and subtracting the least significant portion, for some parameters, the most significant portion 967 can be directly extracted using WoP-PBS 915-919.

[0443] For example, AddMSB1 unit 923 can be implemented as follows:

[0444]

[0445]

[0446] Similarly, the MulMSB1 unit 925 can be implemented as follows:

[0447]

[0448] Interestingly, the inventor also designed a method using A. An improved version of the algorithm by [author's name] in "Revisiting the functional bootstrap in TFHE" (also as discussed in [reference needed]). Figure 7c The methods discussed are alternatives to performing AddMSB and MulMSB operations.

[0449] ct out ←Tree-PBS({ct in，j} j BSK, KSK, {P i} i∈[1，L] )

[0450] This technique allows the computation of a function about one or more ciphertexts using programmable bootstrapping. These techniques utilize known programmable bootstrapping, therefore their inputs are subject to a requirement for padding bits. By using the WoPPBS described herein (e.g., WoPPBS 415, 416, 417, or 518), these techniques can also be applied to ciphertexts without padding bits. An improved version of the above algorithm can be expressed as:

[0451] ct out ←Tree-WoP-PBS({ct in，j} j BSK, KSK, {P i} i∈[1，L] ).

[0452] While this alternative is less efficient than AddMSB1 and MulMSB1 discussed above, its advantage lies in its applicability to inputs with relatively high noise levels, and because it uses programmable bootstrapping, it produces values ​​with relatively low noise. Therefore, it can be advantageous in settings where the input noise is too high for AddMSB1 or MulMSB1 to apply, or in settings where lower noise is desired.

[0453] Using this algorithm, AddMSB can be implemented as follows:

[0454]

[0455] Similarly, MulMSB can be implemented as follows:

[0456]

[0457] Figure 11 schematically illustrates an embodiment of an implementation of a method 1200 for performing computations on LWE encrypted values. The LWE encrypted value can be an encryption of a value based on a fault-tolerant learning problem. The encryption can support a programmable bootstrap operation. The programmable bootstrap operation can evaluate the LWE decryption in the exponent of the GLWE encrypted monomial. The GLWE encrypted polynomial can be an encryption of a polynomial based on a generalized fault-tolerant learning problem.

[0458] This method may include obtaining a set of auxiliary keys for performing computations. The auxiliary keys may not allow decryption of LWE encrypted values. The auxiliary keys may include a set of bootstrap keys for performing programmable bootstrap operations.

[0459] The method may include calculating a 1220LWE encrypted product based on one or more LWE encrypted input values.

[0460] Calculating 1220 may involve applying the 1221 cryptographic key switching operation to a set of LWE encrypted input values ​​to determine one or more GLWE encrypted input polynomials. The coefficients of the input polynomials may be linear combinations of a set of input values.

[0461] Computing 1220 may include applying 1222 encrypted polynomial multiplication based on one or more GLWE encrypted input polynomials to obtain GLWE encrypted output polynomials.

[0462] Calculating 1220 may include applying the 1223 cryptographic sample extraction operation to the output polynomial based on GLWE encryption, thereby obtaining the LWE encrypted product value as the encryption of the polynomial coefficients.

[0463] Many different ways of performing method 1200 are possible, as will be apparent to those skilled in the art. For example, the steps may be performed in the order shown, but the order of the steps may vary, or some steps may be performed in parallel. Furthermore, other method steps may be inserted between the steps. The inserted steps may represent a refinement of the method, as described herein, or may be unrelated to the method. For example, some steps may be performed at least partially in parallel. Moreover, a given step may not be fully completed before the next step begins.

[0464] Implementations of the method can be executed using software that includes instructions for causing a processor system to execute method 1200. The software may include only those steps taken by a specific sub-entity of the system. The software may be stored on a suitable storage medium (such as a hard disk, floppy disk, memory, optical disk, etc.). The software may be transmitted as a signal via wired or wireless means, or via a data network (e.g., the Internet). The software may be available for download and / or remote use on a server. Implementations of the method can also be executed using a bitstream configured to configure programmable logic (e.g., a field-programmable gate array (FPGA)) to execute the method.

[0465] It will be understood that the currently disclosed subject matter also extends to computer programs, particularly computer programs on or in a carrier, suitable for implementing the currently disclosed subject matter. The program may be in the form of source code, object code, intermediate source code, and object code (such as partially compiled forms), or any other form suitable for use in one embodiment of the method. One embodiment relating to a computer program product includes computer-executable instructions corresponding to each processing step of at least one of the stated methods. These instructions may be subdivided into subroutines and / or stored in one or more files that may be statically or dynamically linked. Another embodiment relating to a computer program product includes computer-executable instructions corresponding to each device, unit, and / or portion of at least one of the stated systems and / or products.

[0466] Typically, the devices described herein (e.g.) Figures 1a-1bThe device (in the system) includes one or more microprocessors that execute appropriate software stored in the system; for example, the software may have been downloaded and / or stored in appropriate memory, such as volatile memory like RAM or non-volatile memory like flash memory. Alternatively, the system may be implemented wholly or partially as programmable logic, such as a field-programmable gate array (FPGA). The system may also be implemented wholly or partially as a so-called application-specific integrated circuit (ASIC), such as an integrated circuit (IC) customized for its specific purpose. For example, the circuit may be implemented in CMOS, for example using a hardware description language such as Verilog, VHDL, etc. Specifically, the system may include circuitry for evaluating cryptographic primitives.

[0467] Processor circuitry can be implemented in a distributed manner, for example, as multiple sub-processor circuits. Storage can be distributed across multiple distributed sub-storages. Part or all of the memory can be electronic memory, magnetic memory, etc. For example, memory can have volatile and non-volatile components. Some storage may be read-only.

[0468] Figure 11b A computer-readable medium 1000 having a writable portion 1010 and a computer-readable medium 1001 also having a writable portion are shown. The computer-readable medium 1000 is shown in the form of an optically readable medium. The computer-readable medium 1001 is shown in the form of electronic memory, in this case, a memory card. Both computer-readable media 1000 and 1001 can store data 1020, wherein the data can represent instructions that, when executed by a processor system, cause the processor system to perform an embodiment of a method for performing calculations on an LWE encrypted value according to one embodiment.

[0469] Data 1020 may be implemented on the computer-readable medium 1000 as a physical marker or by magnetization of the computer-readable medium 1000. However, any other suitable implementation is contemplated. Furthermore, it will be understood that although the computer-readable medium 1000 is shown herein as an optical disc, the computer-readable medium 1000 may be any suitable computer-readable medium, such as a hard disk, solid-state memory, flash memory, etc., and may be non-recordable or recordable. The computer program 1020 includes instructions for causing the processor system to execute the method for performing calculations on the LWE encrypted value.

[0470] Figure 11c A processor system 1140 according to an embodiment of a device for performing calculations on LWE encrypted values ​​is shown schematically. The processor system includes one or more integrated circuits 1110. The architecture implementing the one or more integrated circuits 1110 is schematically shown in... Figure 6In step b, circuit 1110 includes a processing unit 1120 (e.g., a CPU) for running computer program components to perform a method according to one embodiment and / or implement its modules or units. Circuit 1110 includes memory 1122 for storing programming code, data, etc. A portion of memory 1122 may be read-only. Circuit 1110 may include a communication element 1126, such as an antenna, a connector, or both. Circuit 1110 may include an application-specific integrated circuit 1124 for performing some or all of the processing defined in the method. Processor 1120, memory 1122, application-specific integrated circuit 1124, and communication element 1126 may be interconnected to each other via interconnect 1130 (e.g., a bus). Processor system 1110 may be arranged for contact and / or contactless communication, using an antenna and / or a connector, respectively.

[0471] For example, in one embodiment, the processor system 1140 (e.g., a device for performing calculations on LWE encrypted values) may include processor circuitry and memory circuitry, the processor being arranged to execute software stored in the memory circuitry. For example, the processor circuitry may be an Intel Core i7 processor, an ARM Cortex-R8, etc. In one embodiment, the processor circuitry may be an ARM Cortex-M0. The memory circuitry may be ROM circuitry or non-volatile memory (e.g., flash memory). Alternatively, the memory circuitry may be volatile memory (e.g., SRAM memory). In the latter case, the device may include a non-volatile software interface (e.g., a hard disk, network interface, etc.) arranged to provide the software.

[0472] Although device 1110 is shown as including one of each described component, multiple components may be repeated in multiple embodiments. For example, processor 1120 may include multiple microprocessors configured to independently perform the methods described herein, or configured to perform steps or subroutines of the methods described herein, such that multiple processors cooperate to achieve the functionality described herein. Furthermore, in the case where device 1110 is implemented in a cloud computing system, multiple hardware components may belong to separate physical systems. For example, processor 1120 may include a first processor in a first server and a second processor in a second server.

[0473] It should be noted that the above-mentioned implementation schemes are illustrative and not limiting of the subject matter currently disclosed, and those skilled in the art can devise many alternative implementation schemes.

[0474] In the claims, any reference numerals enclosed in parentheses shall not be construed as limiting the claims. The use of the verb “comprise” and its variations does not exclude the presence of elements or steps other than those recited in the claims. The article “a” or “an” preceding an element does not exclude the presence of a plurality of such elements. When an expression such as “at least one” precedes a list of elements, it indicates the selection of all elements or any subset thereof from the list. For example, the expression “at least one of A, B, and C” should be understood to include only A, only B, only C, both A and B, both A and C, both B and C, or all of A, B, and C. The subject matter disclosed herein can be implemented by hardware comprising several different elements, as well as by a suitably programmed computer. In a device claim enumerating several components, several of these components can be implemented by the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to exert an advantage.

[0475] In the claims, the reference numerals enclosed in parentheses refer to reference symbols in the exemplary embodiment drawings or formulas of the embodiments, thereby improving the comprehensibility of the claims. These reference numerals should not be construed as limiting the claims.

Claims

1. A computer-implemented method (1200) for performing computation on an LWE encrypted value, wherein the LWE encrypted value is an encryption of a value based on a fault-tolerant learning problem, wherein the encryption supports a programmable bootstrap operation (313), wherein the programmable bootstrap operation evaluates the LWE decryption (303) in the exponent of a GLWE encrypted monomial, wherein the GLWE encrypted polynomial is an encryption of a polynomial based on a generalized fault-tolerant learning problem, the method comprising: - Obtain (1210) a set of auxiliary keys for performing the computation, wherein the auxiliary keys are not allowed to decrypt LWE encrypted values, wherein the auxiliary keys include a set of bootstrap keys for performing the programmable bootstrap computation; - Calculate the (1220, 207-212) LWE encrypted product value based on one or more LWE encrypted input values ​​(260, 261) in the following way: - Apply the cryptographic key switching operation (1221, 200) to a set of LWE cryptographic input values ​​to determine one or more GLWE cryptographic input polynomials (245, 246), where the coefficients of the input polynomials are linear combinations of the set of input values; - Apply cryptographic polynomial multiplication (1222, 205, 206) based on one or more GLWE cryptographic input polynomials to obtain the GLWE cryptographic output polynomial (247). - Based on the GLWE encrypted output polynomial, the cryptographic sample extraction operation (1223, 201) is applied to obtain the encryption of the polynomial coefficients as the LWE encrypted product value (262).

2. The method according to claim 1, wherein: - The set of auxiliary keys also includes a relinearization key, wherein the GLWE cryptographic polynomial is a first-order polynomial in the key, and wherein the relinearization key is arranged to transform a second-order polynomial in the key into a first-order polynomial in the key. - Applying cryptographic polynomial multiplication involves computing the polynomial product of the corresponding GLWE cryptographic polynomials, which are considered as the corresponding polynomials in the key; and transforming the polynomial product into a first-degree polynomial in the key using a relinearization key.

3. The method according to any of the preceding claims, wherein, The LWE encrypted input value includes an LWE encrypted first value and an LWE encrypted second value. The LWE encrypted input polynomial includes a LWE encrypted first input polynomial and a LWE encrypted second input polynomial, with the first value and the second value as coefficients, respectively. The application of encrypted polynomial multiplication includes calculating the LWE encrypted product of the first input polynomial and the second input polynomial. The application of cryptographic sample extraction operation includes extracting the coefficients of the LWE encrypted output polynomial as the LWE encrypted product of the first value and the second value.

4. The method according to claim 1 or 2, wherein, The LWE encrypted input values ​​include LWE encrypted first set of values ​​and LWE encrypted second set of values. The GLWE encrypted input polynomials include GLWE encrypted first input polynomials and GLWE encrypted second input polynomials, which respectively use the first set of values ​​and the second set of values ​​as coefficients. The application of encrypted polynomial multiplication includes calculating the GLWE encrypted product of the first input polynomial and the second input polynomial. The application of cryptographic sample extraction operation includes extracting the coefficients of the GLWE encrypted output polynomial as the LWE encrypted inner product.

5. The method according to claim 1 or 2 further includes applying a programmable bootstrap operation (313) to the LWE encrypted product value.

6. The method according to claim 1 or 2, comprising: - The function is applied to the LWE encrypted input value using programmable bootstrap operations (413, 417, 513), where modulus switching scales the LWE encrypted input value so that the programmable bootstrap produces an LWE encrypted function output whose correctness depends on the symbol. - Use the (413, 513, 613) programmable bootstrap operation to apply constant functions to LWE encrypted input values, producing LWE encrypted constant outputs whose correctness depends on the symbol; - The LWE encryption correction function output is obtained by programmable bootstrapping of the function (405, 407, 507-509, 529, 605) based on the LWE encryption constant output whose correctness depends on the symbol.

7. The method according to claim 6, wherein, The correction includes encrypting the LWE encrypted product value (407, 507-509) as the product of the correctness-dependent function output and the correctness-dependent constant output.

8. The method according to claim 6, wherein, The correction includes transforming the symbol-dependent LWE cryptographic constant output (400) into a symbol-dependent GLWE cryptographic constant polynomial, and multiplying the programmable bootstrap GLWE cryptographic monomial of the function with the GLWE cryptographic constant polynomial (405).

9. The method according to claim 6, wherein, The method further includes using a programmable bootstrap (513) to obtain the output of another LWE encryption function whose correctness depends on another function, and using the output of LWE encryption constants whose correctness depends on the symbol to select and correct (507-509, 529) the output of LWE encryption function whose correctness depends on the symbol, or the output of another LWE encryption function whose correctness depends on the symbol.

10. The method of claim 6, wherein the programmable bootstrapping of the applied function and the programmable bootstrapping of the applied constant function are performed by multiplying the GLWE encrypted monomial of the input value with the corresponding test polynomial of the function and the constant function.

11. The method of claim 6, comprising applying multiple corresponding functions to LWE encrypted input values ​​using a programmable bootstrapping operation by applying a test polynomial (650) representing the function output of multiple corresponding functions and extracting (601) the corresponding polynomial coefficients.

12. The method of claim 6, comprising applying the following steps once or multiple times: - Apply the identity function (715-718) to the LWE encrypted input value to obtain the LWE encrypted function output, where modulus switching scales the LWE encrypted input value so that the LWE encrypted function output encrypts the least significant part of the input value, and - Subtract the output of the LWE encryption correction function (728) from the LWE encryption input value.

13. The method of claim 12 further comprises summing the highest valid portions of the corresponding extracted LWE encryptions together (729) to obtain a bootstrap LWE encryption output value representing the input value.

14. The method of claim 12 further comprises applying the overall function to the LWE encrypted input value by applying (727) the corresponding programmable bootstrap operation to the highest valid portion of the corresponding extracted LWE encryption.

15. The method of claim 1 or 2, comprising evaluating binary circuitry on one or more LWE encrypted binary input values, wherein the evaluation comprises calculating one or more corresponding LWE encrypted AND gate outputs by computing (807-812) corresponding LWE encrypted product values, and wherein the evaluation optionally comprises applying (813) the programmable bootstrap operation to reduce noise in the LWE encrypted binary values.

16. The method of claim 15, wherein the binary value is represented as zero or half the modulus of LWE encryption, and wherein applying a programmable bootstrap to the LWE encrypted binary value comprises: - Multiply the binary value of the GLWE encrypted monomial by the test polynomial, such that the LWE encrypted bootstrap output (863) generated by the programmable bootstrap is equal to either a positive or negative quarter of the LWE modulus, plus (829) a quarter of the LWE modulus; or - Scale the LWE encrypted binary value so that the output (865') of the LWE encryption function generated by the programmable bootstrap is equal to zero or half the LWE modulus.

17. The method according to claim 1 or 2, comprising: - Calculate the LWE encrypted sum or product of the first LWE encrypted input value and the second LWE encrypted input value (907, 908, 929); - The identity function is applied to the LWE encrypted sum or product using a programmable bootstrap (915-919), where the modulus switching scales the LWE encrypted sum or product so that the programmable bootstrap produces the least valid part of the LWE encrypted sum or product. - Subtract the (928) least valid part of the LWE encryption from the sum or product of LWE encryption.

18. An apparatus (110) for performing computations on LWE encrypted values, wherein the LWE encrypted values ​​are encryptions based on values ​​of a fault-tolerant learning problem, wherein the encryption supports a programmable bootstrap operation, wherein the programmable bootstrap operation evaluates LWE decryption in the exponent of a GLWE encrypted monomial, wherein the GLWE encrypted polynomial is an encryption of a polynomial based on a generalized fault-tolerant learning problem, the apparatus comprising: - A memory (140) for storing a set of auxiliary keys for performing the computation, wherein the auxiliary keys are not allowed to decrypt LWE encrypted values, wherein the auxiliary keys include a set of bootstrap keys for performing programmable bootstrap operations; - The processor system (130) is configured to compute an LWE encrypted product based on one or more LWE encrypted input values ​​in the following manner: - Apply a cryptographic key switching operation to a set of LWE encrypted input values ​​to determine one or more GLWE encrypted input polynomials, where the coefficients of the input polynomials are linear combinations of the set of input values; - Apply encrypted polynomial multiplication based on one or more GLWE encrypted input polynomials to obtain GLWE encrypted output polynomials; - Based on the GLWE encrypted output polynomial, a cryptographic sample extraction operation is applied to obtain the encrypted polynomial coefficients as the LWE encrypted product value.

19. A temporary or non-temporary computer-readable medium (1000) comprising data (1020) representing instructions that, when executed by a processor system, cause the processor system to perform the method according to any one of claims 1-17.

Images