Cryptographic encryption calculation method and device, method and device for determining test polynomial, and computer-readable storage medium

Abstract

The present invention relates to cryptographic calculation methods and devices, methods and devices for determining test polynomials, and computer-readable storage media. Some embodiments are directed to a cryptographic calculation method (400). The method involves blindly rotating a ciphertext according to a test polynomial. The blind rotation produces an encryption polynomial product of the test polynomial and a bootstrap monomial that represents the plaintext value as an exponent, the encryption polynomial product modulo a modulus (q) and a quotient polynomial (p(X)). The quotient polynomial (p(X)) is divided by the NTT polynomial (X M ‑1), the NTT polynomial (X M ‑1) Allowing number theoretic transformations modulo the modulus q, e.g., q is a power of 2 and #imgabs0# Using NTT can make blind rotations more efficient, while the test polynomial is defined such that the polynomial product is programmed to have the expected output values ​​of the corresponding plaintext values ​​as fixed coefficients.

Description

Technical Field

[0001] The presently disclosed subject matter relates to a cryptographic calculation method, a method for determining a test polynomial, corresponding apparatus, and a computer-readable medium. Background Art

[0002] Homomorphic cryptography allows one to perform encrypted computations: the computation (e.g., circuit evaluation) is performed by one party on encrypted data without that party being able to decrypt it. For example, input data and computation results can be received and returned in encrypted form. Intermediate data (e.g., the internal state of the computation) can also be in encrypted form.

[0003] Even if the result of a computation is returned in encrypted form, when decrypted, the output is expected to be the same or very close to performing the operation on the unencrypted data. Homomorphic encryption can be used to outsource storage and computation with privacy preservation. This allows data to be encrypted and outsourced to a cloud environment for processing and / or storage while still encrypted.

[0004] For example, homomorphic cryptography can be applied in areas such as medical care, where privacy regulations may make it difficult to share plaintext data, but computations on encrypted medical data may be permitted. For example, a medical model developed for classifying medical data can be configured to receive medical data in encrypted form from a third party (e.g., a hospital). The medical model can, for example, classify medical data as normal or abnormal, or as having a particular medical syndrome, disease, or other condition. Using homomorphic encryption, the medical model can be applied to receive medical data in encrypted form. This means that the party providing the medical model cannot access the plaintext medical data corresponding to the encrypted medical data. Users of the service can decrypt the results of the application of the medical model.

[0005] In particular, there are homomorphic cryptographic techniques that can, at least in principle, be used to compute any function that encrypts data. Such techniques are known as "fully homomorphic encryption" (FHE) techniques.

[0006] For security reasons, known implementations of FHE use noisy ciphertexts. For example, encryption of a data item may include mapping the data item to a point in a key-dependent lattice, adding noise to the point. In particular, many known implementations of FHE use LWE-type ciphertexts, the security of which depends on the cryptographic difficulty of the fault-tolerant learning problem. Such LWE-type ciphertexts may include one or more mask values ​​(e.g., values ​​modulo some modulus q, or torus elements), plus a body value, which is derived from the mask values ​​and the plaintext using an encryption key, and which contains noise. A variant of this is a GLWE-type ciphertext, which is encrypted and uses a polynomial instead of a scalar value. Other known implementations of FHE use NTRU-type ciphertexts, to which essentially the same considerations apply.

[0007] When a data item has just been encrypted, the noise is low - the encryption is recent. For example, the amount of noise is low so that if the data item is to be decrypted, the noise can be removed at some point in the decryption process, such as by rounding. On the other hand, the noise should be high enough to make attacks on the system sufficiently difficult. For example, many homomorphic encryption schemes can be attacked using linear algebra or other efficient algorithms (e.g., lattice reduction algorithms) under the assumption that there is no noise. When a data item is encrypted, noise is added that is chosen so that attacks are difficult, while homomorphic operations can still be performed and decryption is still possible.

[0008] Most homomorphic operations increase the noise inherent in the homomorphically encrypted data item. When many such operations are performed, the noise may reach a level where a unique decryption is no longer possible. In general, it is known to reduce the noise of homomorphically encrypted values ​​using a technique called bootstrapping. Bootstrapping can use a public key called a bootstrap key. By using bootstrapping to reduce the noise when necessary, in principle any desired number of homomorphic operations can be computed.

[0009] A special class of fully homomorphic encryption schemes is the TFHE class of homomorphic encryption schemes. Such schemes are described in "Programmable bootstrapping enables efficient homomorphic inference of deep neural networks", Cyber ​​Security Cryptography and Machine Learning (CSCML 2021), Volume 12716 of Lecture Notes in Computer Science, Pages 1-19, Springer, 2021 (incorporated herein by reference). TFHE class schemes differ from other FHE schemes in that they support a relatively very efficient bootstrapping technique; in addition, they are able to evaluate functions simultaneously during the bootstrapping operation, which is called programmable bootstrapping. Conventional bootstrapping corresponds to programmable bootstrapping with an identity function.

[0010] This programmable bootstrapping technique can reduce noise in a ciphertext (e.g., an LWE-type ciphertext) by performing so-called blind rotations. Blind rotations can be performed using a test polynomial defined as So that each coefficient The expected output value corresponding to the scaled plaintext value i is encoded. Blind rotation may involve homomorphic evaluation of the decryption (e.g., LWE decryption) of the exponent of the encrypted bootstrap monomial (e.g., GLWE encryption), resulting in the test polynomial With bootstrapped monomials The encrypted (e.g., GLWE-encrypted) polynomial product of The resulting polynomial product is encrypted modulo q = 2 Ω And the polynomial X N +1 modulo the ciphertext, where N is a power of 2. This ensures that the most significant bit of the scaled plaintext value is set to 0. In this case, the polynomial product Will The expected output value is used as its constant coefficient. This is because encryption is based on the quotient polynomial X N +1 modulo. That is, since the quotient polynomial X N +1 for this specific choice, the identity X k =-X k+N Established, therefore This coefficient can then be extracted to obtain the encryption of the desired output value.

[0011] Interestingly, the output of the blind rotation has an amount of noise that is independent of the noise in the input ciphertext. Therefore, by performing a programmable bootstrapping that includes a blind rotation, the noise in the input ciphertext can be reduced to a fixed amount, while potentially simultaneously applying a function to the input ciphertext. By performing the programmable bootstrapping at the appropriate time, cryptographic computations of infinite multiplicative complexity can be performed.

[0012] Known programmable bootstrapping, and in particular blind rotation thereof, have a number of limitations. First, blind rotation generally requires that the most significant bit of the scaled plaintext value be set to 0, in other words, the ratio of the plaintext whose value can be programmed is only 1 / 2. Second, known blind rotation requires the calculation of a large number of Ω And the polynomial X N +1 modulo a polynomial product, where N is a power of 2. This polynomial multiplication is computationally expensive, making blind rotations, and therefore programmable bootstrapping, still relatively computationally expensive. Summary of the invention

[0013] According to one aspect of the invention, there is provided a cryptographic encryption calculation method as defined in the claims. According to another aspect of the invention, there is provided a method for determining a test polynomial used in the cryptographic calculation method as defined in the claims. According to other aspects, there is provided an apparatus corresponding to the computer-implemented methods as defined in the claims. According to another aspect, there is provided a computer-readable medium as defined in the claims.

[0014] The cryptographic computation may involve performing blind rotations of a ciphertext (e.g., an LWE-type ciphertext); for example, as part of a programmable bootstrapping. Encryption, such as the original ciphertext The blind rotation can be calculated by testing the polynomial with bootstrapped monomials that represent plaintext values ​​as exponentials in a polynomial ring (e.g., ), such as

[0015] Blind rotation may involve computing multiple polynomial products in a polynomial ring. In the prior art, the polynomial ring is constructed by the modulus q and the quotient polynomial X N +1 modulo ring where q and N are both powers of 2. The inventors have realized that since polynomial products are an integral part of blind rotations, it would be beneficial to use more efficient techniques to compute polynomial products in blind rotations.

[0016] A technique known per se for performing efficient multiplication in a polynomial ring is the number theoretic transform (NTT). In order to perform polynomial multiplication using NTT, the polynomials can be represented using a so-called NTT Fourier domain representation. Typically, the Fourier domain representation of a polynomial comprises a plurality of corresponding evaluation points of the polynomial at a plurality of corresponding evaluation points. When the Fourier domain representation is employed, the polynomials can be efficiently multiplied, for example, by point-by-point multiplication of the evaluation points. Furthermore, using NTT, the Fourier domain representation of a polynomial can be efficiently computed from its coefficient representation (by applying the number theoretic transform itself), and the coefficient representation can be efficiently computed from the Fourier domain representation (using the inverse number theoretic transform). Various number theoretic transforms are known per se, including the discrete Fourier transform (defined in its standard form as the quotient polynomial X n -1 and a prime power modulo q, where n|q-1), as disclosed, for example, in J. von zur Gathen and J. Gerhard, "Modern Computer Algebra", Cambridge University Press, 3rd edition, 2013, Chapter 8 (incorporated herein by reference for the description of DFT), algorithm and Nussbaumer's algorithm, e.g. in DJ Bernstein, "Multidigit multiplication for mathematicians", unpublished manuscript (available at https: / / cr.yp.to / papers.html#m3), August 2001 (just and Nussbaumer algorithm, which are incorporated herein by reference).

[0017] Thus, performing polynomial multiplication "using a number theoretic transform" may generally refer to performing polynomial multiplication in the Fourier domain of a number theoretic transform, optionally in conjunction with converting the polynomials from or to the Fourier domain representation using NTT and / or its inverse.

[0018] Unfortunately, the prior art blind rotation itself cannot be made more efficient by applying number theoretic transformations. For efficiency reasons, the prior art uses the modulus q = 2 Ω , for example, q = 2 32 or q = 2 64 At the same time, using the quotient polynomial X N +1 because it means relationship X k =-X k+N holds in polynomial rings, which is necessary to make the prior art blind rotations work. However, for these parameters, applying number-theoretic transformations is not possible, since number-theoretic transformations require X N +1 divided by the polynomial X M-1, where M and q are relatively prime. In the parameters used in the prior art, both N and q are powers of 2, so any multiple of N cannot be relatively prime to q.

[0019] Furthermore, using the prior art, it is not possible to fully benefit from the improved performance provided by number theoretic transformations by simply changing the parameters of the polynomial ring used. As discussed above, due to the relationship X k =-X k+N , so we need the quotient polynomial X N +1. Modulus q = 2 Ω Effective modular computing can be achieved.

[0020] Interestingly, the inventors found a way to make blind rotations compatible with number-theoretic transformations. The inventors realized that it is not necessary to rely on the relation X k =-X k+N To make the multiplication with the test polynomial work. Instead, given a specific modulus and a specific quotient polynomial, the test polynomial can be defined so that the product of the test polynomial and the bootstrap monomial of a certain plaintext value uses the expected output value of the plaintext value as a fixed coefficient. In this case, each corresponding coefficient of the test polynomial no longer corresponds to a corresponding expected output value as in the prior art. For example, the test polynomial is different from Nevertheless, using such a test polynomial in a blind rotation can produce an encryption polynomial from which the expected output value can be extracted by extracting the fixed coefficients.

[0021] Using this improved test polynomial, blind rotations can be performed in a polynomial ring to which number theoretic transformations are applied. Specifically, the polynomial ring can be defined by a modulus q (which can be, for example, a power of 2) and by a quotient polynomial p(X) (e.g., different from X N +1). Here, the quotient polynomial can be divided by an NTT polynomial (i.e., a polynomial that allows number-theoretic transformations modulo q). In general, this means that the NTT polynomial is equal to X M -1, where M is relatively prime to q. Given such a modulus and such a quotient polynomial, polynomial multiplication modulo the quotient polynomial can be implemented as polynomial multiplication in the Fourier domain of a number-theoretic transformation, for example, as polynomial multiplication modulo the NTT polynomial. In fact, computing the polynomial multiplication modulo the NTT polynomial and reducing the result modulo the quotient polynomial can give the same result as performing the multiplication modulo the quotient polynomial, for example, a(X)b(X)mod p(X)=(a(X)b(X)mod(X) M -1))mod p(X).

[0022] Thus, blind rotations can be performed modulo q and modulo a quotient polynomial p(X) divided by the NTT polynomial, and thus polynomial multiplications of blind rotations can be implemented using number theoretic transformations. This improves the efficiency of blind rotations compared to known blind rotations. Furthermore, since polynomial multiplications modulo the modulus and the quotient polynomial can also occur in other operations of cryptographic calculations, such as key switching that can be optionally performed as part of programmable bootstrapping, these other operations can also use number theoretic transformations and thus can also be made more efficient.

[0023] In one embodiment, the modulus is a power of 2. For example, the modulus may be equal to 2. 32 , 2 64 or 2 128 Therefore, it can be , where q is a power of 2. Such moduli may allow modular operations (e.g., addition and / or multiplication) to be implemented particularly efficiently, for example, using native instructions of a CPU. A power-of-2 moduli is a specific embodiment of a moduli for which known blind rotations cannot be implemented using number-theoretic transformations according to the quotient polynomial X. N +1 modulo, because X M -1=(X N +1)(X N -1) is even and therefore not coprime with q. By using a different quotient polynomial, such as X N +X N / 2 +1 In combination with the test polynomial described in the paper, it is interesting to note that NTT can be used with such q.

[0024] In one embodiment, for an integer M, the NTT polynomial is equal to X M -1. For example, M may be a power of 2, or a product of powers of 2 and / or powers of 3. For such values ​​of M, valid number-theoretic transformations are known. The quotient polynomial p(X) may not be equal to X. N +1, N = M / 2. In this case, the relationship X k =-X k+N is not true, but advantageously, using a test polynomial as described herein still allows the use of NTT. For example, the quotient polynomial p(X) may be not equal to X N +1, but you can also use a quotient polynomial that is not equal to the cyclotomic polynomial.

[0025] In one embodiment, the order N of the quotient polynomial is strictly greater than half the order M of the NTT polynomial. For example, the quotient polynomial can be equal to X N +X N / 2 +1 or X N -X N / 2 +1, where the NTT polynomial is equal to XM -1, M = 3N / 2. This is particularly advantageous because it allows blind rotation and therefore also programmable bootstrapping that can be part of or work on a wider range of plaintext values.

[0026] Specifically, the ciphertext to which blind rotation is applied is usually defined modulo the order M of the NTT polynomial, e.g., the plaintext can take M possible values. For example, the ciphertext can be obtained by blind rotation, in which the input ciphertext is scaled to the order M of the NTT polynomial. Blind rotation may be able to provide the desired output value for N of these M possible values. This is because blind rotation is based on polynomial multiplication modulo the quotient polynomial, and the order of the quotient polynomial is N. For example, in the prior art, M=2N, and blind rotation usually assumes that the most significant bit of the input plaintext is not set.

[0027] By choosing an order N strictly greater than M / 2, a fraction of the plaintext greater than half can be programmed by blind rotations. For example, the quotient polynomial X N ±X N / 2 +1 (e.g., where N is twice a power of 3 or four times a power of 3) allows increasing the fraction of programmable ciphertexts from half to two-thirds. Thus, blind rotations as well as programmable bootstrapping can work on a wider range of input ciphertexts. For example, the extra operations needed to ensure that the most significant bit of the input plaintext is not set in the encryption calculation can be avoided, making the encryption calculation more efficient.

[0028] In one embodiment, the order of the NTT polynomial is a product of powers of 2 and / or powers of 3. In this case, number theoretic transformations are particularly effective, and therefore it is particularly advantageous to use them. For example, the order of the NTT polynomial can be a power of 2. This is particularly effective. The order of the NTT polynomial can also be a power of 3, which is advantageous because the order of the quotient polynomial p(X) can be set to two-thirds of the order of the NTT polynomial, for example p(X)=X N +X N / 2 +1 divided by the NTT polynomial X 3N / 2 -1, thus allowing a large proportion of plaintext values ​​to be programmed.

[0029] In one embodiment, the modulus q is a prime number, and the order M of the NTT polynomial is divided by the modulus minus one. In this case, the integer field modulo the modulus q contains the Mth primitive root of unity, allowing the use of particularly efficient NTT techniques (such as discrete Fourier transforms). Depending on the modulus q, modular operations can also be implemented efficiently, for example, modulo 2 31 <q=10·3 18 +1<2 32 or 2 63 <q=4·3 39 +1<264 Modulo calculations can be implemented relatively efficiently using 32-bit, 64-bit, and / or 128-bit arithmetic, and are convenient since they match common data types.

[0030] In one embodiment, the quotient polynomial is equal to X N + X N / 2 + 1 or X N - X N / 2 + 1. As discussed elsewhere, this choice of quotient polynomial is advantageous because it allows programming for a relatively large proportion of plaintext values. Additionally, for this choice of quotient polynomial, the test polynomial can be determined particularly efficiently for a given set of desired output values. Specifically, as described herein, each coefficient of the test polynomial can be calculated based on at most two desired output values, specifically, as the sum of two potentially negative desired output values. Additionally, interestingly, the desired output values can be efficiently programmed with an arbitrary fixed coefficient, e.g., the coefficient can be different from the leading coefficient as well as the constant coefficient. This is beneficial for further operations in encrypted calculations, where further operations are applied to the encrypted polynomial resulting from a blind rotation before extracting the coefficients.

[0031] The test polynomial can be determined based on a lookup table defining the desired output values for the corresponding plaintext values. The inventors recognized that given the modulus, the quotient polynomial p(X), and the NTT polynomial, a suitable test polynomial can generally be determined for a given lookup table. Specifically, the inventors recognized that for M, the quotient polynomial p(X) divided by X M - 1, the inverse of the polynomial X, X - 1, exists in R[X] / (p(X)) and can be represented as a polynomial of order < N with coefficients in R. This enables the following relationship to be derived for a given polynomial to hold: as an element of R[X] / (p(X)). Here, v N = 0. In fact, multiplying the test polynomial v(X) by the monomial X -1 will thus correspond to adding a scaled form of the constant term of v(X) to the other coefficients and shifting. Based on this relationship, an expression for the product of the test polynomial and the encrypted polynomial of the monomial representing the plaintext value can be obtained as part of the blind rotation. From the fact that such an expression can be obtained, the test polynomial with the desired output values for the corresponding plaintext values can thus be determined. Detailed examples are given herein, particularly for the case where the fixed coefficient is the constant coefficient or the leading coefficient, and for the case where the quotient polynomial is equal to X N + X N / 2 + 1 or X N - X N / 2 + 1. In these cases, the test polynomial can be calculated particularly efficiently.

[0032] In one embodiment, the fixed coefficients are constant coefficients or leading coefficients. In this case, the test polynomial for a given lookup table can be determined particularly efficiently by calculating the corresponding coefficients of the test polynomial from the corresponding expected output values. For example, the coefficients of the test polynomial can be calculated as (1) or (2) where v i is the coefficient of the plaintext value i, p k is the kth coefficient of the quotient polynomial, and K j is the expected output value of plaintext value j.

[0033] In one embodiment, the ciphertext to which blind rotation is applied may be an LWE-type ciphertext. For example, blind rotation may be part of a cryptographic calculation performed on an LWE-type ciphertext (e.g., without involving any NTRU-type ciphertext). Alternatively, an LWE-type ciphertext may be obtained by converting from an NTRU-type ciphertext, for example, as part of a cryptographic calculation performed on an NTRU-type ciphertext. Blind rotation may also be applied directly to an NTRU-type ciphertext without converting to LWE. More generally, the ciphertext may be a lattice-type ciphertext, the security of which depends on the cryptographic difficulty of the lattice problem, with LWE and NTRU being two examples.

[0034] In one embodiment, performing a blind rotation may include computing one or more outer products of a ciphertext with a gadget ciphertext. Such a gadget ciphertext may include multiple constituent ciphertexts defined based on a gadget matrix. In the setting of LWE / GLWE, the gadget ciphertext may be a GGSW type ciphertext. In the NTRU setting, gadget encryption is also referred to as NGS encryption or gadget NTRU. The gadget ciphertext may be contained in a bootstrap key, for example, may represent a number, such as the bits of a decryption key for decrypting a ciphertext to which the blind rotation is applied. The computation of such outer products typically involves a large number of polynomial multiplications modulo the modulus and the quotient polynomial. By using the provided techniques, these polynomial multiplications may be performed using number theoretic transformations, thereby significantly improving efficiency.

[0035] In one embodiment, the encryption calculation method may include performing programmable bootstrapping. Modulus switching may be applied to the input ciphertext to obtain further ciphertext, such as LWE type ciphertext. As known per se, this may involve scaling the input ciphertext to the order of the NTT polynomial. The further ciphertext may be subjected to blind rotation. The blind rotation may be followed by sample extraction, in which the encryption of the fixed coefficients is extracted from the polynomial product calculated by the blind rotation. The sample extraction may optionally be followed by key switching. Specifically, the encryption calculation method may be a "TFHE-class" encryption calculation method, in which programmable bootstrapping is its core operation. Improving the blind rotation involved may provide important efficiency improvements in this setting.

[0036] In general, additional operations can be performed between the various steps of programmable bootstrapping, for example, the ciphertexts of several modulus swaps can be added together; the outputs of several blind rotations can be added before performing sample extraction; and so on. Various such operations may involve polynomial multiplications, for example, modulo a quotient polynomial or modulo another polynomial divided by the NTT polynomial. Specifically, the output of the blind rotation may include a polynomial modulo a quotient polynomial, to which an additional polynomial multiplication may be applied before performing sample extraction. In this case, the use of the blind rotations described herein also allows NTT to be used for such additional polynomial multiplications, thereby further improving the efficiency of programmable bootstrapping.

[0037] In one embodiment, when performing blind rotation using a number theoretic transform, polynomials of the bootstrap key may be used that are not obtained in coefficient representation but in Fourier domain representation of the number theoretic transform. The blind rotation then does not include converting these polynomials of the bootstrap key from the coefficient representation to the Fourier domain representation. For example, the polynomial may be received from another party or accessed from a memory in the Fourier domain representation. This makes blind rotation particularly efficient because the conversion can be done in advance. Since the bootstrap key is typically generated once and then used multiple times, it is more efficient to determine its Fourier domain representation when it is generated rather than when it is used.

[0038] The cryptographic computation may be a "TFHE-type" cryptographic computation. Such a TFHE-type cryptographic computation is characterized by the use of a programmable bootstrap operation, in which an encryption polynomial product is computed from a bootstrap monomial representing the plaintext value as an exponent and a test polynomial. In other words, the programmable bootstrap may involve evaluating the decryption of the ciphertext in the exponent of the encryption monomial. The evaluation may be computed using an outer product of a gadget ciphertext with a bootstrap key, such as a GGSW-type ciphertext, an NGS ciphertext, or a gadget NTRLI ciphertext. Such a gadget ciphertext may contain multiple constituent ciphertexts (e.g., a GLWE-type ciphertext in the case of GGSW), and the computation of the outer product may involve multiplying corresponding constituent ciphertexts of the gadget ciphertext by corresponding polynomials. As described herein, such a programmable bootstrap becomes more efficient and / or more flexible in terms of the input plaintext accepted.

[0039] The provided techniques for improving the calculation of encrypted data can be applied to a wide range of practical applications. Such practical applications include the evaluation of software programs for encryption without access to plaintext data. For example, one can evaluate medical diagnostic software about medical data without actually accessing the medical data. Medical data can include medical images. Medical images can include, for example, multidimensional image data acquired by a variety of acquisition methods, such as two-dimensional (2D), three-dimensional (3D) or four-dimensional (4D) images, such as but not limited to standard X-ray imaging, computed tomography (CT), magnetic resonance imaging (MRI), ultrasound (US), positron emission tomography (PET), single photon emission computed tomography (SPECT) and nuclear medicine (NM).

[0040] In one embodiment, the provided techniques can be used to evaluate a neural network with respect to encrypted inputs. A party evaluating a neural network may or may not have plaintext access to the training parameters of the neural network, such as weights and biases. In general, the techniques provided herein (e.g., improved polynomial multiplication, programmable bootstrapping, and outer products) improve the efficiency of evaluating a neural network and / or reduce the storage and transmission requirements of the ciphertext or key material used.

[0041] An embodiment of the method may be implemented on a computer as a computer-implemented method, or implemented in dedicated hardware, or in a combination of the two. Executable code for an embodiment of the method may be stored on a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Preferably, the computer program product includes non-transitory program code stored on a computer-readable medium for performing an embodiment of the method when the program product is executed on a computer.

[0042] In one embodiment, the computer program comprises computer program code, which is adapted to perform all or part of the steps of an embodiment of the method when the computer program is run on a computer.Preferably, the computer program is embodied on a computer readable medium. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Further details, aspects and embodiments will be described by way of example only with reference to the accompanying drawings. The elements in the drawings are illustrated for simplicity and clarity and are not necessarily drawn to scale. In the drawings, elements corresponding to elements already described may have the same reference numerals. In the drawings,

[0044] Figure 1a An example of an implementation of an encryption computing device is schematically shown;

[0045] Figure 1b An example of an implementation of an apparatus for determining a test polynomial used in cryptographic calculations is schematically shown;

[0046] Figure 1c An example of an implementation of an encryption computing system is schematically shown;

[0047] Figure 2 An example of an implementation of a programmable bootstrap cell is schematically shown;

[0048] Figure 3 An example of an implementation of an accumulation unit is schematically shown;

[0049] Figure 4 An example of an implementation scheme of a cryptographic computing method is schematically shown;

[0050] Figure 5 An example of an implementation of a method for determining a test polynomial used in a cryptographic calculation is schematically shown;

[0051] Figure 6 schematically illustrates a computer-readable medium having a writable portion, the writable portion comprising a computer program according to an embodiment;

[0052] Figure 7 A representation of a processor system according to one embodiment is schematically shown. DETAILED DESCRIPTION

[0053] While the presently disclosed subject matter may be embodied in many different forms, one or more specific embodiments are shown in the drawings and will be described in detail herein, it being understood that the disclosure should be considered as an exemplification of the principles of the presently disclosed subject matter and is not intended to be limited to the specific embodiments shown and described.

[0054] In the following, for ease of understanding, various elements of the embodiments are described in operation. However, it is obvious that the corresponding elements are arranged to perform the functions described by them.

[0055] Furthermore, the presently disclosed subject matter is not limited to the embodiments but also comprises every other combination of features described herein or recited in mutually different dependent claims.

[0056] In general, various embodiments relate to LWE (Learning With Errors) type ciphertexts. Specifically, programmable bootstrapping can obtain an LWE type input ciphertext that encrypts a plaintext value as input, and output an LWE type output ciphertext that encrypts a desired output value of the plaintext. The LWE type ciphertext can include one or more mask values ​​and a body value derived from the mask value and the plaintext value.

[0057] The input and output ciphertexts of the LWE type can be defined modulo the modulus q. As disclosed in "ProgrammableBootstrapping Enables Efficient Homomorphic Inference of Deep NeuralNetworks", the values ​​of the LWE type ciphertext can be viewed as discrete tori or equivalently, is regarded as an integer modulo q. As a specific embodiment, according to the key For plain text value The encrypted LWE type ciphertext Can be calculated as a random mask And the subject value For the random noise value e, μ * =μ+e. In the above embodiment, Represents a binary set Other variants exist, for example the key does not necessarily need to consist of bits, see for example European patent application EP21290025 (incorporated herein by reference).

[0058] Note that the LWE type ciphertext to which blind rotation is applied as described herein is generally defined modulo a modulus M, which is equal to the order of the NTT polynomial used in the blind rotation. For example, the ciphertext may be obtained by scaling an LWE type input ciphertext modulo another modulus q (e.g., a modulus corresponding to the coefficients of the polynomial used in the blind rotation) to this modulus M by performing a modulus switch.

[0059] Various embodiments also relate to GLWE (Generalized Learning With Error) type ciphertexts. GLWE type ciphertexts may include one or more mask polynomials and a principal polynomial derived from the mask polynomial and the plaintext polynomial. GLWE type ciphertexts may be defined modulo a modulus q and a quotient polynomial p(X) (e.g., a quotient polynomial p(X) of order greater than 1). For example, let For the key For plain text GLWE type ciphertext to be encrypted can be computed as a masked polynomial And the main polynomial where for the random noise polynomial e, μ * =μ+e. LWE type ciphertext is an embodiment of GLWE type ciphertext, where (N, k) = (1, n). Another embodiment of GLWE type ciphertext is Ring Resistant Learning with Errors (RLWE) type ciphertext. RLWE type ciphertext includes only one mask polynomial.

[0060] Instead of using LWE / GLWE type ciphertexts, different lattice encryptions can also be used. For example, the ciphertext to which the blind rotation is applied and / or the encrypted polynomial product generated by the ciphertext can be an NTRU ciphertext. For example, the NTRU encryption of a message μ can be defined by adding the quotient of a noise polynomial g and a private key polynomial f to the message, e.g., can be a reversible polynomial (usually with small coefficients); and NTRU encryption can be achieved by Given, or written as g=e1+f·e2, given by c=e1 / f+μ+e2. Specifically, the NTRU ciphertext may include only a single polynomial. The security of such a ciphertext may be based on the NTRU assumption.

[0061] Specifically, NTRU can be used in conjunction with the provided techniques by using blind rotations that produce the product of a test polynomial and a bootstrapped monomial with the NTRU encryption polynomial and / or applying blind rotations to NTRU ciphertext as input. Suitable embodiments of NTRU encryption are defined in C. Bonte et al., "FINAL: Faster FHE instantiated with NTRU and LWE", https: / / ia.cr / 2022 / 074, and in K. Kluczniak, "NTRU-v-um: Secure FullyHomomorphic Encryption from NTRU with Small Modulus", https: / / ia.cr / 2022 / 089.

[0062] Various embodiments also relate to gadget ciphertexts. In general, a gadget ciphertext may be defined as a ciphertext comprising a plurality of constituent ciphertexts that encrypt corresponding values ​​based on plaintext, and the ciphertext may be defined based on a gadget matrix. For LWE / GLWE, the gadget ciphertext may be a GGSW type ciphertext as defined, for example, in the "Programmable bootstrapping enables ..." reference (incorporated herein with respect to the description of GGSW). In the NTRU setting, as gadget encryption, for example, one can use: NGS encryption in “FINAL: Faster FHE instantiated with NTRU and LWE”, https: / / ia.cr / 2022 / 074 by C. Bonte et al. (incorporated herein by reference for the definition of NGS); or gadget NTRU encryption in “NTRU-v-um: Secure Fully Homomorphic Encryption from NTRU with Small Modulus”, https: / / ia.cr / 2022 / 089 by K. Kluczniak (incorporated herein by reference for the definition of gadget NTRU).

[0063] The above embodiments describe (G)LWE / NTRU / ... ciphertexts according to a symmetric encryption scheme (e.g., one key is used for both encryption and decryption), but the ciphertexts used may also be according to an asymmetric encryption scheme (e.g., different public and private keys are used for encryption and decryption, respectively). For example, the above keys may be used as private keys, where the public key includes one or more encryptions of zeros, see, for example, R. Rothblum, "Homomorphic encryption: From private-key to public-key", Theory of Cryptography (TCC 2011), Volume 6597 of Lecture Notes in Computer Science, pages 219-234, Springer, 2011 (incorporated herein by reference).

[0064] Various implementations use number theoretic transformations to perform polynomial multiplication modulo a modulus q and a quotient polynomial p(X) divided by the NTT polynomial. In general, the NTT polynomial is equal to X M -1, and the quotient polynomial divides the NTT polynomial, for example, trivially by making them equal, or strictly by the NTT polynomial. The modulus q may be chosen such that M is The units in , preferably in such a way that The primitive roots of unity of the order M are included. In this case, polynomial multiplication in the Fourier domain of the field of number theory can be implemented particularly efficiently, for example as a point-by-point multiplication of estimates of multipliers of powers of the primitive roots of unity. Techniques for this are known per se, for example from "Modern Computer Algebra" by J. von zur Gathen and J. Gerhard, Cambridge University Press, 3rd edition, 2013. The term "primitive root of unity" is used throughout the specification as defined in this citation.

[0065] For example, the quotient polynomial can be any polynomial that divides X M -1, and the Fourier representation of the polynomial can be defined as the set of estimates of the polynomial in the set of powers of the Mth primitive root of unity. The Fourier representation can be multiplied by the point-by-point multiplication of the estimates of the corresponding powers of the Mth primitive root of unity. In order to efficiently convert between the coefficient representation of the polynomial and the Fourier domain representation, it is advantageous if M contains one or more powers of 2 and / or one or more powers of 3, for example, M is a power of 2 or M is a power of 3.

[0066] The Fourier representation of a polynomial can include estimates for every power of the root of unity, but this is not required. In many cases, using a subset of the powers is sufficient, resulting in a more efficient Fourier domain representation. If the quotient polynomial equals (X M -1) / (X d -1), where M = hd and d = MN (hence N = Md = (h-1)d). For example, for h = 2, the quotient polynomial can be (X 2d -1) / (X d -1)=(X d +1)=(X N +1), or for the case of H = 3, the quotient polynomial can be (X 3d -1) / (X d -1)=(X 2d +X d +1)=(X N +X N / 2 +1). In this case, the Fourier domain representation of the polynomial can be defined as the evaluation of the polynomial only in a subset of the Mth power of the primitive root of unity ω, e.g., for h = 2, the powers ω, ω 3 ,…,ω 2d-1 , for h = 3, the power (ω,ω 2 ),(ω 4 ,ω 5 ),…,(ω 3d-2 ,ω 3d-1). To multiply polynomials, it is sufficient to evaluate only this subset of powers of the root of unity, leading to a more efficient multiplication of polynomials. Nevertheless, efficient number-theoretic transformations and inverses are possible.

[0067] The described technique involves blind rotation using a bootstrap key. The cryptographic computation technique that supports such blind rotation can be referred to as a "TFHE-like" homomorphic encryption scheme.

[0068] The programmable bootstrapping operations in TFHE-like schemes make them an attractive choice for a variety of applications. Since bootstrapping is relatively efficient compared to many other FHE schemes, it is more feasible to perform relatively complex computations (e.g., computations with a multiplication depth of at least 10, at least 50, or at least 100). Specifically, the cryptographic parameters of TFHE-like schemes can be selected based on the required accuracy and the computational cost incurred and independently of the number of homomorphic operations and their circuit depth. In contrast, in other FHE schemes, bootstrapping can be very inefficient, so that in practice these schemes are often applied in a hierarchical manner, meaning that their parameters are selected depending on a given computation so that it can be performed without bootstrapping. However, this hierarchical approach is not feasible for more complex computations, so TFHE-like schemes are particularly useful in such cases.

[0069] For example, a bootstrap key for a TFHE-like encryption scheme may include n gadget (e.g., GGSW type) ciphertexts, encrypting a key number such as a LWE key, where n is typically at most 1000 or at most 640, such as n=630. The gadget ciphertexts may, for example, include l=3 ciphertexts, each of which includes k=1 masking polynomials (e.g., RLWE may be used) and one body polynomial in the case of GLWE. Other embodiment parameters are discussed throughout. In general, the security of GLWE-based ciphertexts is based on the distribution of the key and is based on three main parameters: n=kN, where N is the order of the quotient polynomial, k is the number of random masking polynomials of the ciphertext, and n is the length of the key; q, the modulus; σ, a statistical parameter of the noise, such as its standard deviation. Given these parameters, it is known per se how to evaluate the degree of security provided, see, for example, M. Albrecht et al., "On the concrete hardness of Learning with Errors", Journal of Mathematical Cryptology, 9(3): 169-203, 2015 (incorporated herein by reference). Similarly, for NTRU-based ciphertexts, which are usually composed of a single polynomial, the security is based on the distribution of the key and on two main parameters: N, the order of the quotient polynomial; σ, a statistical parameter of the noise.

[0070] In embodiments herein, the parameters of the TFHE-like (e.g., LWE / GLWE) ciphertexts used may be selected based on the desired security level and based on the desired precision of operations (such as linear combinations of ciphertexts and / or applying programmable bootstrapping, in other words, the noise level generated by applying these operations). Interestingly, in the TFHE setting, the security parameters may be selected independently of the computational complexity (e.g., independent of the multiplication depth of the computation). This is different from non-TFHE-like schemes, where security parameters are typically selected to limit or eliminate bootstrapping.

[0071] Specifically, the LWE-based ciphertext and / or the GLWE-based ciphertext used in the TFHE setting of this article can use a relatively small modulus, such as a modulus of at most 32 bits, at most 64 bits, or at most 128 bits. This modulus is typically selected independently of the computation to be performed, for example, it is selected based on the desired accuracy and / or efficiency. The parameters N, k, and / or σ can be selected to achieve the desired security level, and are typically also independent of the computation to be performed. For example, N can be set to at least 512 and / or at most 2048 or 4096, for example, 1024. For example, in one embodiment, RLWE is used, where N is at least 512 and / or at most 2048 or 4096 (e.g., 1024), and k=1. Such values ​​of N are typically not used in non-TFHE-type encryption schemes, where such values ​​would severely limit the computations that can be performed; instead, in non-TFHE-type schemes, q and N are typically selected based on the desired security level, so q may be much larger.

[0072] Figure 1a An example of an implementation of a cryptographic computing device 110 is schematically illustrated.

[0073] Device 110 may include a processor system 130, a memory 140, and a communication interface 150. Memory 140 may include local memory, such as a local hard drive or electronic memory. Memory 140 may include non-local memory, such as cloud memory. In the latter case, memory 140 may include a memory interface with the non-local memory. For example, memory 140 may be used to store LWE type ciphertexts on which programmable bootstrapping or blind rotations are performed.

[0074] The memory 140 may also be used to store a bootstrap key used in blind rotation. Blind rotation may use the bootstrap key to perform LWE decryption in the exponent of the bootstrap monomial. The bootstrap key may be stored in the Fourier domain representation of the number theoretic transform used in blind rotation, thereby improving its efficiency.

[0075] As an alternative to LWE, NTRU, for example, can also be used.

[0076] The device 110 can communicate internally, with other devices, external memory, input devices, output devices, and / or one or more sensors via a computer network. The computer network can be the Internet, an intranet, a LAN, a WLAN, etc. The computer network can be the Internet. The device includes a connection interface 150, which is arranged to communicate with other devices as needed. For example, the connection interface may include a connector, such as a wired connector (e.g., an Ethernet connector, an optical connector, etc.) or a wireless connector (e.g., an antenna, such as a Wi-Fi, 4G or 5G antenna). Communications (e.g., internal communications) may use other communication protocols or media, such as an internal data bus.

[0077] In the device 110, the communication interface 150 may be used to send or receive digital data. For example, the device 110 may be configured to receive or send data representing an LWE type ciphertext, such as an input to a blind rotation or programmable bootstrapping, or an output thereof. The communication interface 150 may also be used to receive data representing a bootstrapping key. The bootstrapping key may be received in the Fourier domain representation of the NTT used in the blind rotation.

[0078] The execution of device 110 may be implemented in a processor system 130 (e.g., one or more processor circuits, such as a microprocessor), an embodiment of which is shown herein. Device 110 may include multiple processors, which may be distributed in different locations. For example, device 110 may use cloud computing.

[0079] The processor system 130 may be configured to obtain an LWE type ciphertext that encrypts a plaintext value, for example, by receiving it or calculating it by performing an encryption calculation. The processor system 130 may be configured to perform a blind rotation on the LWE type ciphertext according to a test polynomial. The blind rotation may produce an encryption polynomial product of the test polynomial and a bootstrap monomial, the encryption polynomial product being modulo the modulus and modulo the quotient polynomial. The bootstrap monomial may represent the plaintext value as an exponent. The quotient polynomial may be divided by an NTT polynomial that allows a number theoretic transformation to be modulo the modulus. The processor subsystem 130 may be configured to perform a polynomial multiplication of the blind rotation using a number theoretic transformation. The test polynomial may be defined such that the polynomial product has the expected output value of the plaintext value as a fixed coefficient. The processor system 130 may also be configured to output the calculated encryption polynomial product, for example for encryption calculations. For example, processor system 130 may compute an LWE encryption representing an output of the encryption calculation from the computed encryption polynomial product and output the LWE encryption, such as by storing it on memory 130 and / or sending it to another party via communication interface 150 .

[0080] As an alternative to LWE, NTRU, for example, can also be used.

[0081] Some of the functional units shown in the figures may be functional units of a processor system. For example, the figures may be used as blueprints of possible functional organizations of a processor system. In most of the figures, the processor circuits are not shown separately from the units. For example, Figure 2 and Figure 3 The functional units shown in (see below) may be implemented in whole or in part in computer instructions stored at a device such as device 110, e.g., in an electronic memory of device 110, and executable by a microprocessor of device 110. In a hybrid embodiment, the functional units are implemented partly in hardware (e.g., as a coprocessor, such as an arithmetic and / or cryptographic coprocessor) and partly in software stored and executed on device 110.

[0082] For example, device 110 may be a device for performing cryptographic computations. The cryptographic computations may use homomorphic encryption cryptographic techniques. For example, device 110 may be used to perform cryptographic computations, e.g., even if the data is received in encrypted form (e.g., from a data provider), and even if device 110 is unable to decrypt the data, the device may perform the computations. The computations may involve blind rotations as described herein, e.g., as part of programmable bootstrapping.

[0083] For example, memory 140 may store encrypted data items, such as data items received from one or more data providers, or data items generated as intermediate or final results (e.g., outputs) of a computation. Typically, most or all of the data items for which device 110 performs computations are encrypted with a key (or keys) unknown to device 110—i.e., device 110 may not be configured to obtain plaintext data items corresponding to encrypted data items (e.g., stored in memory 140). The decryption key in plaintext form is secret to device 110, although the encryption / decryption key may be available in encrypted form. For example, the processor system may be configured to perform a series of homomorphic encryption operations, which may include arithmetic operations on encrypted values, such as addition and multiplication, and may also include one or more blind rotations, for example as part of a corresponding programmable bootstrap operation.

[0084] Figure 1b Schematically illustrates a method for determining a cryptographic calculation (eg, Figure 1a The cryptographic calculation may include computing a polynomial product of the bootstrap monomial and the test polynomial, wherein the polynomial product is modulo a modulus and a quotient polynomial, wherein the quotient polynomial is divided by the NTT polynomial. The device 119 may perform the cryptographic calculation itself, for example, Figure 1a The device 110 can be connected with Figure 1b 119 combinations of devices.

[0085] Device 110 may include a processor system 139, a memory 149, and a communication interface 159. Processor system 139, memory 149, and communication interface 159 may be as described above. Figure 1a Memory 149 may be used to store a lookup table defining expected output values ​​for corresponding plaintext values. The lookup table may be stored by storing corresponding output values, corresponding input value pairs, or another representation (e.g., a symbolic or executable representation) of a function that maps inputs to outputs.

[0086] The communication interface 159 may be used to receive the lookup table and / or one or more system parameters, such as the modulus, quotient polynomial, and NTT polynomial. The communication interface 159 may be used to send the calculated test polynomial.

[0087] Processor system 139 may be configured to obtain the modulus, the quotient polynomial, and the NTT polynomial. Processor system 139 may be further configured to calculate the test polynomial such that the polynomial product has the corresponding expected output value of the corresponding plaintext value as a fixed coefficient.

[0088] Figure 1c Schematically illustrated is an example of an implementation of a cryptographic computing system 100. The system 100 is configured to perform cryptographic computations using homomorphic encryption (eg, fully homomorphic encryption).

[0089] The system 100 in this embodiment includes a key generation device 111, a data provider device 113 and an encryption computing device 112. The key generation device 111 and the data provider device 113 can be combined in a single device. The device 112 can be configured to receive encrypted data items from the data provider 113. At least one or more data items can be received in encrypted form. One or more other data items can be received in plain text format. Calculations are run on the received data items, and calculations can also be run on the stored data items. Interestingly, calculations can be performed on encrypted data without the need to decrypt the data (e.g., without the need to convert the encrypted data items into data in plain text format).

[0090] The device 112 in this embodiment can be based on Figure 1a The device 110 may include, for example Figure 1a The processor system 130, memory 140 and / or communication interface 150 of the device 111, 112, 113 can be based on Figure 1b The devices 119, for example, may each include Figure 1b processor system 139, memory 149 and / or communication interface 159.

[0091] In this embodiment, device 111 includes a key generation unit 131, such as a key generation unit 131 implemented by a processor system of device 111. Key generation unit 131 is configured to generate a bootstrap key 151 used by cryptographic computing device 112. The bootstrap key can allow blind rotation to be performed, as described herein. Device 111 can provide bootstrap key 151 to device 112, for example, by sending bootstrap key 151 via computer network 150, uploading bootstrap key 151 to a shared memory, etc. Device 111 can provide a polynomial of the bootstrap key in the form of a Fourier domain representation of a number theoretic transform.

[0092] In this embodiment, the device 112 includes a cryptographic computing unit 132, such as a cryptographic computing unit 132 implemented by a processor system of the device 112. The cryptographic computing unit 132 may be configured to perform cryptographic computing. The cryptographic computing may involve, for example, blind rotations of LWE-type ciphertexts, such as for Figure 1a To perform the blind rotation, cryptographic computation unit 132 may use bootstrap key 151 obtained from device 111 (e.g., received via network 150 or retrieved from shared storage). Blind rotation may use a test polynomial. The test polynomial may be determined by device 111, device 112, or device 113 from a lookup table, such as for Figure 1b The cryptographic calculations may include many other operations, as known per se, for example, the device 112 may be configured to evaluate arithmetic circuits, neural networks evaluating encrypted data, etc.

[0093] Although not shown in this figure, the cryptographic computing system 100 may include multiple cryptographic computing devices, such as two, three, or more than three. The cryptographic computing may be distributed among the multiple cryptographic computing devices. The cryptographic computing devices may exchange intermediate computing results (usually encrypted) between each other. Each cryptographic multiplication device may be implemented like the cryptographic computing device 112, and may perform multiplication of a ciphertext with a polynomial as described herein.

[0094] Homomorphic encryption schemes can be applied in many settings. For example, the encryption computing device 112 can be operated by a cloud provider. A cloud provider can provide computing and storage services to its customers. By using homomorphic encryption, a data provider device 113 (e.g., a client of a cloud provider) can send its data in encrypted form. The cloud provider can still perform the required computation and / or the required storage, but cannot know the corresponding plaintext data. For example, the data provider device 113 can encrypt the data item using an encryption key of a type corresponding to the specific homomorphic encryption system used. When the data provider 113 receives the computation result from the encryption computing device 112, the encrypted data item can be decrypted using the corresponding decryption key. The encryption key and the decryption key can be the same - and usually are.

[0095] For example, the cryptographic computing system 100 can be configured to train a machine learning model (e.g., an image classifier, such as a medical model) without the cryptographic computing device having access to the plaintext data items. For example, a linear regression can be performed on the input data, possibly without even bootstrapping. For example, back propagation can be performed on the input data, possibly with bootstrapping. The resulting model parameters can be returned to the entity that possesses the decryption key. This enables multiple providers of medical data to aggregate their data by sending the data to a cloud provider. The cloud provider then returns the model parameters without access to the plaintext data. The encryption key can be equal to the decryption key.

[0096] After the model is trained, the encrypted computing system 100 can be used to provide the model, for example, for use with medical data. This can be done using plaintext model parameters or encrypted model parameters - in both cases using encrypted data (e.g., encrypted input data, intermediate data, and output data). Using plaintext model parameters is generally more efficient. In both cases, one effect of the system is that calculations (e.g., image classification, such as medical image classification) are performed without the computer being aware of the plaintext data items. For example, a mammogram can be used to assess cancer without the image ever being presented in plaintext on the encrypted computing device 112, and without any encrypted computing device 112 or a consortium of such devices being aware of the results of the cancer assessment. From a privacy perspective, it may be acceptable to operate a plaintext model on encrypted privacy-sensitive data, while it may be unacceptable to operate on plaintext privacy-sensitive data.

[0097] Other applications involve database services, such as looking up encrypted data in an encrypted database; for example, the calculation may be a comparison between an input item and a database item. For example, multiple calculations can be combined to produce a database index that matches an index. For example, the database can be a genomic database, and the input can be a gene sequence. For example, the system 100 can be used for protective control of equipment. For example, a device (even a large device such as a power plant) can send a sensor value to an encrypted computing device 112 and receive an encrypted control signal in return. The control signal is calculated based on the sensor signal. An attacker of the system may be able to determine the content of data entering and exiting one or more encrypted computing devices 112, or even gain access to intermediate data of these devices, but since the data is encrypted, this will not help him. Since the decryption key is unknown to these devices, even if all encrypted computing devices 112 of the system 100 are completely cracked, the data will not be leaked. Calculating the control signal can involve mathematical operations such as linear algebra, averaging, matrix multiplication, polynomial evaluation, etc., all of which can be performed using homomorphic encryption operations.

[0098] For example, a pool of encrypted data items can be maintained in an encrypted computing system; a subset of them can be received, and another subset can be the result of the encrypted calculation, for example, an intermediate result. For example, the encrypted computing device 112 can be configured to apply a homomorphic encryption operation to one, two or more encrypted data items in the pool, such as a set of input values ​​and / or intermediate values ​​and / or output values. The result may be a new encrypted data item that can be stored in the pool. The pool can be stored in a memory of the encrypted computing system. This can be a local memory or a distributed memory. In the latter case, it may happen that one or more encrypted data items are represented multiple times in the pool. For example, if the value of the encrypted data item is needed elsewhere, the encrypted data item can be sent from one computing device to another computing device. The pool can be implemented in a variety of ways, for example, as a register file, an array, a variety of data structures, etc.

[0099] An encrypted data item can represent a variety of data. For example, an encrypted data item can represent a number that needs to be averaged, or a number for linear regression, etc. For example, an encrypted data item can represent an image. For example, each pixel of an image can correspond to one or more encrypted data items. For example, a grayscale pixel can be represented by a grayscale level, which in turn can be represented by a single encrypted data item. For example, 256 grayscale levels can be encoded in a single encrypted data item. For example, a color pixel can be represented as multiple color levels, such as RGB levels, which in turn can be represented by a tuple of encrypted data items. For example, three 256-level colors can be encoded in three encrypted data items. How many encrypted data items are used to represent a certain type of data depends on the capacity of the homomorphic encryption scheme. For example, a more restrictive homomorphic encryption scheme may only be able to encode one bit per encrypted data item. In this case, one color pixel may require 24 encrypted data items.

[0100] A set of homomorphic encryption operations can be defined for a computation. For example, based on the homomorphic encryption operations, a computation network or circuit can be constructed that implements the computation together, for example, through an external compiler device or through the computing device itself. For example, the operation can include Boolean operations. The manner in which the homomorphic encryption operations are combined (e.g., which operation is applied to which operand in the pool) determines the computation being performed. For example, a computation can be represented as a list of homomorphic encryption operations to be performed and instructions on which encrypted data item to perform. The network or circuit can indicate to the encryption computing device 112 when blind rotations and / or programmable bootstrapping are performed, and can include a test polynomial as described herein or a lookup table from which the test polynomial can be calculated.

[0101] Figure 2 An example of an implementation of a programmable boot cell 200 is schematically shown.

[0102] The figure shows an LWE type input ciphertext 210, including a number n of mask values and a principal value These values ​​are defined modulo the modulus q. The input ciphertext 210 can be represented as In some cases, the input LWE ciphertext may be obtained by conversion from the NTRU ciphertext. In other cases, such conversion may not be performed, for example, the input LWE ciphertext may be calculated from the output of the programmable bootstrapped LWE encryption without using any NTRU encryption in this calculation.

[0103] A modulus switching unit 220 is also shown. The modulus switching unit may be configured to perform modulus switching on the input ciphertext 210 to obtain the LWE type ciphertext 211. This may include scaling the corresponding value of the input ciphertext 210 to the order M of the NTT polynomial discussed below, for example, by scaling by a factor of M / q and then rounding. The modulus switching may be implemented as disclosed in the reference “Programmable bootstrapping enables...” As a specific embodiment, the modulus switching may calculate the encryption of the scaled plaintext value:

[0104]

[0105] in

[0106]

[0107] Also shown are an initialization unit 240 and an accumulation unit 260. Units 240 and 260 may be configured together to perform blind rotations on the LWE type ciphertext 211. Units 240 and 260 may use GLWE encryption modulo a modulus q and modulo a quotient polynomial p(X). Typically, the modulus q is the same as the modulus q of the LWE type input ciphertext, but in principle this is not necessary. Interestingly, the quotient polynomial p(X) may be divided by an NTT polynomial, such as X. M -1, the NTT polynomial allows number-theoretic transformations modulo q. In particular, q can be a power of 2, in which case a different value from X can be used. N Further embodiments are provided below.

[0108] Blind rotation may use bootstrap key 270. Bootstrap key 270 may allow blind rotation to be performed on LWE type ciphertext 211.

[0109] Blind rotation can also use the test polynomial v230. The quotient polynomial may not be equal to the X used in the prior art. N +1, so it is no longer possible to use a test polynomial with the corresponding expected output value as its corresponding coefficient. Interestingly, however, the test polynomial can be defined as a product of polynomials modulo q and the quotient polynomial p(X) The expected output value of the corresponding plaintext value is used as a fixed coefficient. Specifically, the test polynomial v230 can be programmed as a lookup table so that (depending on the bias) encodes f(μ) for the chosen function f.

[0110] Blind rotation can convert the input ciphertext The scaled form 211 is converted to a bootstrapped monomial The encrypted polynomial product 250 with the test polynomial v230 is modulo the modulus q and modulo the quotient polynomial p(X). For example, the output may be based on the key Multiplying polynomials GLWE type encryption for encryption in is the plaintext μ of the ciphertext 210 * = discrete value of μ+e, v is the test polynomial 230.

[0111] As shown in the figure, GGSW(s) can be encrypted by performing GGSW encryption on the bootstrap key 270. i ) is used to calculate the blind rotation by a series of corresponding accumulation calculations 260, wherein the GGSW encryption GGSW(s i ) encrypts the corresponding bits of the decryption key of the input ciphertext. The accumulation operation can selectively add the current random mask value of the LWE type ciphertext 211 to the current GLWE encryption 250 depending on whether the bits of the bootstrap key are set.

[0112] Specifically, blind rotation can be achieved as follows:

[0113]

[0114] It can be noted that this algorithm does produce GLWE encryption 250. This embodiment uses n bootstrap keys 270, bsk[j]←GGSW s′ (s j )(1≤j≤n).

[0115] In this embodiment, an initialization 240 is used, which initially sets the GLWE encryption to However, it is also possible to encrypt the value Added to the GLWE encryption, for example, after performing the accumulation operation 260.

[0116] As about Figure 3 As also discussed, the accumulation unit 260 can calculate the outer product of the GLWE type ciphertext 250 and the GGSW type ciphertext 270, wherein calculating the outer product includes performing polynomial multiplications. As shown in the figure, these polynomial multiplications can be performed more efficiently by calculating these polynomial multiplications using a modular multiplication unit 261, which performs polynomial multiplications using number theory transformations.

[0117] This embodiment uses a series of accumulation operations 260 on a bootstrapping key 270, where the bootstrapping key 270 includes a GGSW encryption of the bits of the key, and the accumulation operations use outer products. The techniques provided are readily extensible to other variants of blind rotation. In general, any blind rotation that includes computing an outer product using a GGSW encryption of a bootstrapping key can be improved. For example, where the bootstrapping key 270 includes a blind rotation of non-binary digits as disclosed in European Patent Application EP21290025 (incorporated herein by reference), or a blind rotation that processes multiple key digits simultaneously. Also in such cases, the performance can be improved by performing the polynomial multiplication for the blind rotation using a unit 261 of number-theoretic transform. More generally, any polynomial multiplication performed as part of a blind rotation can be made more efficient by using number-theoretic transform.

[0118] A sample extraction unit 280 is also shown. The sample extraction unit 280 may be configured to take as input a GLWE encrypted polynomial product 250 (the GLWE encrypted polynomial product 250 having a desired output value as a fixed coefficient), and perform sample extraction to extract an LWE encryption 290 of this fixed coefficient from the encryption 250. For example, the sample extraction may be known as from the citation "Programmable bootstrapping enables...".

[0119] Now returning to the way the test polynomial 230v is defined such that the encrypted polynomial product 250 has the desired output value as a coefficient. Interestingly, the inventors realized that the test polynomial can be "programmed" to have this property for any quotient polynomial p(X) that divides the NTT polynomial X M -1.

[0120] Specifically, the test polynomial v ∈ R[X] / (p(X)) 230 can be defined such that the plaintext of the ciphertext 211 encodes the desired output value, and correspondingly (depending on the bias) encodes f(μ) of the selected function f, where μ is the plaintext of the ciphertext 210. For example, the value f(μ) can be encoded as the constant coefficient of. In this case, the test polynomial 230 can be determined by computing the coefficients v i of v 230 for all i < N such that for any vector K = (K0,..., K N-1 ) ∈ R N of the corresponding desired output values, the constant term of X -t v (X) is equal to K t (for all t ∈ {0,..., N - 1}).

[0121] Below, the following symbols are used. Let R be a ring with unity. Consider a univariate N - th order quotient polynomial defined over R:

[0122] p((X)=X N +p N-1 X N-1 +p N-2 X N-2 +…+p0

[0123] And for some given M, such that p(X) is divided by the NTT polynomial X M - 1. For convenience, let p N = 1, so that For a polynomial in R[X] / (p(X)) Denoted by (v(X)) i = v i Represents the i - th order coefficient of v(X) (specifically, (v(X))0 = v0 represents the constant term), and for convenience, v N = 0.

[0124] The inventors can calculate the test polynomial v based on the following understanding: If the quotient polynomial p(X) is divided by the NTT polynomial X M - 1 of M, then X -1 Exists in R[X] / (p(X)). Specifically, X -1 Can be expressed as a polynomial of order < N with coefficients in R. This in turn enables obtaining a formula for X v(X); that is -1 As an element of R[X] / (p(X)). As an element of R[X] / (p(X)).

[0125] Specifically, note that in R[X] / (p(X)), Holds and in turn

[0126]

[0127] This assumes that p0 is invertible in R. This is implied by the fact that the quotient polynomial p(X) is divided by the NTT polynomial X M - 1. In fact, for the polynomial Written as X M - 1 = p(X)·q(X), then p0q0 = - 1 holds, or equivalently, p0(-q0)=1 holds; thus, the inverse of p0 exists and is given by - q0.

[0128] Given a polynomial It can be verified

[0129]

[0130] The last inequality is due to the definition of v N = 0 holds. Therefore, the following holds:

[0131]

[0132] So, in fact, with X -1 Multiplication results in a scaled version of the constant term of v(X) being added to the other coefficients, where the scaling depends on the exponent and the shift of the coefficient.

[0133] Based on the relationship (*), the test polynomial 230 can be calculated. Several examples are given. The preferred embodiment includes in the constant or in X -t A set of values ​​is embedded in the leading coefficient of v(X). In these embodiments, the inventors were able to derive expressions for the test polynomials that can be determined particularly efficiently.

[0134] Example Test Polynomial 1: Fixed coefficients are constant coefficients

[0135] Given N expected output values The test polynomial v(X) 230 is determined such that X -t The constant term of v(X) is K t =T[t]. In this case, The corresponding coefficients can be obtained from The corresponding expected output value is calculated, for example, according to the following formula:

[0136]

[0137] For all t∈{0,…,N-1}, it can be verified that (X -t v(X))0=K t .

[0138] For example, the test polynomial can be computed using the following algorithm:

[0139]

[0140]

[0141] Example Test Polynomial 2: Fixed coefficient is the leading coefficient

[0142] Given N expected output values The test polynomial v(X) 230 is determined such that X -t The leading coefficient of v(X) is K t = T[t]. In this case, the test polynomial The corresponding coefficient can be determined as the sum of the corresponding desired output values. For example, for any

[0143]

[0144] For all t ∈ {0, …, N−1}, it can be verified that (X -t v(X)) N-1 = K t .

[0145] For example, the test polynomial can be calculated using the following algorithm:

[0146]

[0147] Example Test Polynomial 3: The quotient polynomial is X N ±X N / 2+ 2 1

[0148] In this embodiment, the quotient polynomial p(X) is a trinomial of the form p(X) = X N + εX N / 2 + 1 for even N and ε ∈ {−1, 1}. Specifically, this means that for all i ∈ {0, …, N} \ {0, N / 2, N}, p0 = p N = 1, p N / 2 = ±1 and p i = 0. For this choice of the quotient polynomial, the test polynomial can be efficiently programmed for any fixed coefficient s by determining the corresponding coefficient as the sum of at most two corresponding desired output values. For example, such that K t = (X -t v(X)) s .

[0149] For example, for s < N / 2, the coefficient can be calculated as follows:

[0150]

[0151] It can be verified that in this case, for all t ∈ {0,..., N−1}, (X -t v(X)) s = K t .

[0152] The above relationship can be derived as follows. The relationship (*) can be specialized for the following case:

[0153]

[0154] From this, it can be inferred that:

[0155]

[0156] It can be deduced that (X -t v(X) s The following expression. For

[0157] (X -t v(X) s =(v(X)) t+s .

[0158] for This situation can be handled by simplifying to the above case:

[0159] (X -t v(X) s =(X -(N / 2-s-1) X -(t-N / 2+s+1) v(X) s

[0160] =(X -(t-N / 2+s+1) v(X) N / 2-1

[0161] =(X -(t-N / 2+s) v(X) N / 2 -∈(X -(t-N / 2+s) v(X))0

[0162] =(v(X))) t+s -∈(v(X)) t+s-N / 2 .

[0163] Finally, for Ns≤t<N, it simplifies to the previous case again:

[0164] (X -t v(X) s =(X -(N-s-1) X -(t-N+s+1) v(X) s

[0165] =(X -(t-N+s+1) v(X) N-1 -∈(X -(t-N+s+1) v(X) N / 2-1

[0166] =-(X -(t-N+s) v(X))0-∈((X -(t-N+s) v(X) N / 2

[0167] -∈(X -(t-N+s) v(X))0)

[0168] =-∈(X -(t-N+s) v(X) N / 2

[0169] = -∈(v(X)) t+s-N / 2

[0170] where ∈ is used 2 = 1. Thus:

[0171]

[0172] The solution can be verified as follows:

[0173] Case 0 ≤ t < N / 2 - s: This implies Thus

[0174] (X -t v(X)) s = (v(X)) s+t = K (s+t)-s = K t .

[0175] Case N / 2 - s ≤ t < N / 2: This corresponds to the second case of (X -t v(X)) s above, thus:

[0176] (X -t v(X)) s = (v(X)) t+s -∈(v(X)) t+s-N / 2 .

[0177] This condition implies and and thus

[0178] (X -t v(X)) s = -εK N / 2+t -ε(-K N / 2+t -εK t ) = K t .

[0179] Case Again, this corresponds to the second case above, but this time and which gives

[0180] (X -t v(X)) s = εK t-N / 2 + K t -εK t-N / 2 = K t .

[0181] Case N - s ≤ t < N: In this case and thus

[0182] (X-t v(X) s = -∈(v(X))) t+s-N / 2 =ε 2 K N / 2+(t+s-N / 2-s) =K t .

[0183] As another example, for s ≥ N / 2, the coefficients may be calculated as follows:

[0184]

[0185] It can be verified that, also in this case, for all t∈{0,…,N-1}, (X -t v(X) s =K t .

[0186] For example, the following algorithm may be used to determine the test polynomial 230:

[0187]

[0188]

[0189] Example Test Polynomial 4. Other Quotient Polynomials / Coefficients

[0190] In general, to determine the test polynomial for the other quotient polynomials, we write ((X -t v(X))) s The explicit formula of and solving the resulting system may follow the method of Example 3. This method is preferred for sparse quotient polynomials (e.g., sparse quotient polynomials with at most 3, at most 5, or at most 10 non-zero coefficients).

[0191] Another way to determine the test polynomial is to compare the polynomial v(X) with the X in R[X] / (p(X)) -1 The multiplication of is considered as a matrix multiplication with the coefficient vector of v(X). This results in a system of N linear equations in N variables, which can be solved using techniques known per se, where the solution corresponds to the coefficients of the test polynomial. In many cases, the system is solvable; if it is not solvable, for example, the next fixed coefficient can be selected to determine the test polynomial.

[0192] Example Modulus / Quotient Polynomial / NTT Polynomial

[0193] Below, some particularly advantageous choices of the modulus, quotient polynomial, and NTT polynomial are discussed, which allow efficient polynomial multiplication using number theoretic transformations.

[0194] In general, the following embodiments consider that for different values ​​of the integer q, the loop The order M of the NTT polynomial can be selected as a power of 3. The quotient polynomial can be set to the M-order cycloid polynomial p(X) = X N +X N / 2 +1 for the quotient polynomial.

[0195] A particularly good choice that combines adequate cryptographic security with efficient computation is M = 3 7 =2187, and N = 2·3 6 = 1458. Note that N / M = 2 / 3 > 1 / 2, so this embodiment enjoys the advantage that blind rotation can handle more than half of the input plaintext values.

[0196] Specifically, as also discussed above, for this quotient polynomial and a given expected output value K=(K0,…,K N-1 )∈R N The value of K can be found in the lookup table of X -t The constant coefficients of v(X) are programmed as fixed coefficients. In this case, the test polynomial The coefficient of can be determined as:

[0197]

[0198] Prime modulus

[0199] For example, as a number-theoretic transformation, a conventional number-theoretic transformation as described, for example, in "Modern Computer Algebra" and also as discussed in more detail elsewhere in this specification can be used. This number-theoretic transformation is also called discrete Fourier transform. This allows direct multiplication of the ring modulo the modulus and the quotient polynomial If the modulus q is chosen so that If M contains the primitive root of unity, then conventional number theoretic transformations can be applied. One way to ensure this is to set q to a prime number such that M divides by q-1. Here are two examples of such prime numbers of size 32 bits and 64 bits to match common data types:

[0200] 2 31 <q=10·3 18 +1<2 32 ,as well as

[0201] 2 63 <q=4·3 39 +1<2 64 .

[0202] As is known per se, the corresponding Mth root of unity can be obtained applying NTT. For example, for q = 10·3 18+1, we can use ω=(1024)3 18-7 mod q, and for q = 4·3 39 +1,ω=(625)3 39-7 mod q. These are the corresponding 3 7 Unit root.

[0203] Modulus of a power of 2

[0204] As also discussed elsewhere, choosing a modulus that is a power of 2 is often very beneficial.

[0205] A common choice is q = 2 32 or q = 2 64 If M is chosen to be a power of 3, then M is relatively prime to q. In this case, the conventional NTT cannot be used directly as a number-theoretic transformation, because does not contain the Mth primitive root of unity (specifically, cannot contain elements of order M, since for this, M needs to be divided by The order of the group of units is q / 2 if q is a power of 2). However, other number-theoretic transformations can be applied in this setting, for example, algorithm or Nussbaumer algorithm. The same is true for other choices of M, such that M is A unit in.

[0206] Figure 3 The accumulator unit 360 (e.g. Figure 2 An example of an implementation of an accumulator unit 360) used in a blind rotation of.

[0207] The accumulator unit 360 may be configured to perform an accumulation calculation that selectively adds the current random mask value 311 of the LWE type ciphertext to the current GLWE encryption 350 depending on whether the GGSW encryption current bit 371 of the bootstrap key is set.

[0208] The accumulator unit 360 may be configured to, depending on whether the current bit 371 of the bootstrap key is set, either inadvertently select the current GLWE encryption 350 or the current GLWE encryption multiplied by a monomial representing the current random mask value 311. This calculation of inadvertently selecting the first GLWE ciphertext or the second GLWE ciphertext is also referred to as a controlled selector gate or controlled multiplexer operation CMux. In general, given a GLWE ciphertext C encrypted with bits b∈{0,1} and two GLWE ciphertexts c0 and c1, the CMux operation may output a gate that is inadvertently selected from the first GLWE ciphertext and the second GLWE ciphertext. b The same plaintext is encrypted into ciphertext.

[0209]

[0210] in, represents the outer product of the ciphertext. A detailed implementation example is given in "Programmable bootstrapping enables efficient homomorphic inference of deep neural networks". In this case, the accumulator unit can calculate Where ACC is the current GLWE encryption 350, is the current random mask value 311, and bsk[j] is the current bit 371 encrypted by GGSW.

[0211] To perform an oblivious selection between two GLWE encryptions, the accumulator unit 360 may calculate a GLWE encrypted difference 363 between the expected output when bit 371 is set and the expected output when bit 371 is not set. The difference 363 may be performed by calculating a polynomial multiplication ModMul 362. The polynomial multiplication may multiply the current GLWE encrypted ACC 350 by a polynomial (e.g., 312), for example, using the above notation, we can calculate Polynomial multiplication 362 is typically performed using a coefficient domain representation of the polynomial rather than a Fourier domain representation of a number theoretic transform.

[0212] Given the encrypted difference 363, the accumulator unit 360 may calculate the outer product of the difference with the GGSW encrypted bits 371. This may produce the GLWE encryption 368, which encrypts the zero if the encrypted bits 371 are zero, and encrypts the difference 363 if the bits are one.

[0213] As is known per se, performing such an outer product of the GLWE encryption 363 and the GGSW encryption 371 may include computing a plurality of corresponding polynomial products. In general, the GGSW encryption 371 of a given plaintext may include a plurality of corresponding GLWE encryptions of values ​​that depend on the plaintext. As an example, the GGSW encryption TGGSW as described in "Programmable bootstrapping enables efficient homomorphic inference of deep neural networks" s′ (m) can be viewed as comprising the corresponding GLWE-type encryption of the corresponding value h(r):

[0214]

[0215] See also the definition of TGGSW encryption given by I. Chillotti et al. in “CONCRETE: Concrete Operates oN Ciphertexts Rapidly by Extending TfhE (available at https: / / homomorphicencryption.org / wp-content / uploads / 2020 / 12 / wahc20_demo_damien.pdf and incorporated herein by reference).

[0216] Specifically, computing the outer product may include computing a gadget decomposition GDec 364 of the GLWE encryption 363, as known per se. The gadget decomposition may produce a polynomial vector 365 defined based on the GLWE encryption 363. The gadget decomposition is typically computed on a polynomial represented by coefficients. The outer product may be computed by multiplying the gadget decomposition vector 365 with the GGSW encryption 371 of a matrix considered as a polynomial. Matrix multiplication may be computed modulo the modulus q and the quotient polynomial q(x) as described herein, and may accordingly include polynomial multiplication of a corresponding polynomial based on the GLWE encryption 363 with a polynomial of the GGSW encryption 371.

[0217] Interestingly, these polynomial multiplications can be performed efficiently using number theoretic transformations. To this end, the gadget decomposition 365, which is typically calculated 364 in coefficient representation, can be converted to a Fourier domain representation by applying a number theoretic transformation NTT 320. The result is a gadget decomposition 366 (shown as a dashed line in the figure) in the Fourier domain representation. The gadget decomposition 366 can then be multiplied with the GGSW encryption 371 (also in the Fourier domain representation) by applying the Fourier domain polynomial multiplication FFTMul 330. This multiplication 330 can include point-by-point multiplications of the corresponding polynomials in the set of evaluation points, as discussed in more detail elsewhere. The result can be a GLWE encryption 367 of the Fourier domain representation produced by the outer product. By converting the Fourier domain representation 367 back using the inverse INTT 340 of the number theoretic transformation, the GLWE encryption can be obtained in the coefficient representation 368.

[0218] As shown in the figure, GGSW encryption 371 can be obtained in a Fourier domain representation, such as can be received from another party or received from a Fourier domain storage. However, it can also be converted to a Fourier domain representation by applying NTT 320 as part of accumulation 360.

[0219] A detailed embodiment of converting to 320 and from 340 a Fourier domain representation and performing a polynomial multiplication in the Fourier domain 330 is now presented. This embodiment shows a discrete Fourier transform, sometimes also referred to as a "conventional" or "standard" number theoretic transform.

[0220] In this embodiment, let R be a ring with unity. Also let ω ∈ be a primitive M-th root of unity for an integer M > 1. A description is given of how to multiply two polynomials f, g ∈ R[X] / (X M -1) modulo X M -1. This is known per se, for example from Chapter 8 of "Modern Computer Algebra".

[0221] A polynomial f := f(X) = f0 + f1X + … + f M-1 X M-1 ∈ R[X] of degree < M can be represented in coefficient form as a coefficient vector, e.g., (f0, f1, …, f M-1 ) ∈ R M . The discrete Fourier transform of the polynomial f (viewed as a vector in R M ) can include the evaluations of f at the corresponding powers of ω, e.g.:

[0222]

[0223] For two polynomials f, g ∈ R[X] of degree < M, the following holds:

[0224] DFT ω (f * g) = DFT ω (f) · DFT′ ω (g)

[0225] where * denotes polynomial convolution and · denotes pointwise multiplication of vectors.

[0226] Given polynomials f, g ∈ R[X] / (X M -1) of degree < M, since multiplication modulo X M -1 is convolution (e.g., fg ≡ f * g (mod X M -1)), the polynomial product h := fg ∈ R[X] / (X M -1) can in this embodiment be obtained by applying DFT 320, pointwise multiplication 330, and inverse DFT 340 as:

[0227] h = DFT ω -1 (DFT ω (f) · DFT ω (g)),

[0228] where DFT ω -1 denotes the inverse discrete Fourier transform. Interestingly, for any polynomial h ∈ R[X] of degree < M, holds.

[0229] In general, given a NTT polynomial X divided by M The quotient polynomial q(X) of -1 can be obtained by calculating h(X)mod q(X) to obtain the polynomial product modulo the quotient polynomial.

[0230] For some quotient polynomials q(X), NTT-based polynomial multiplication can be performed particularly efficiently, for example based on a Fourier domain representation whose number of elements is equal to the order of q(X) rather than the order of the NTT polynomial. In this case, the Fourier domain representation can include only a subset of the set of powers of the Mth primitive root of unity.

[0231] For example, given f,g∈R[X] / (X N +X N / 2 +1), writing where f j ∈R and where g j ∈R. For i∈{1,2}, define as well as Note that ω M -1=(ω N / 2 -1)(ω N +ω N / 2 +1)=0, we get ω N +ω N / 2 +1 = 0, because ω is the (3N / 2)th primitive root of unity, and the polynomial X N +X N / 2 +1 can be represented as X N +X N / 2 +1=(X N / 2 -ω N / 2 )(X N / 2 -ω N )=((ω 2 X) N / 2 -1)((ωN) N / 2 -1). Therefore, it can be seen that:

[0232]

[0233] as well as

[0234]

[0235] Similarly, Established, of which and Established, of which

[0236] Let η: =ω3 , which is the (N / 2)th primitive root of unity. For i∈{1,2}, can be calculated as:

[0237]

[0238] For i∈{1,2}, the polynomial h i :=f i g i mod((ω 3-i X) N / 2 -1) can be restored as:

[0239] in Applying the Chinese remainder theorem, we can obtain the product polynomial h: =fg∈R[X] / (X N +X N / 2 +1) is:

[0240]

[0241] Therefore, in this case, the number theoretic transformation operation 320 can be implemented as R[X] / (X N +X N / 2 +1) takes as input a polynomial 365 and returns its Fourier representation 366. For example, given f∈R[X] / (X N +X N / 2 +1), the Fourier representation can be calculated as:

[0242]

[0243] where η = ω 3 ; or equivalently

[0244]

[0245] The inverse operation 340 can be expressed as where polynomial 330 is implemented as

[0246] In the above embodiment, the Mth primitive root of unity is used, where M is the order of the NTT polynomial. Under the unique condition of the units in , number-theoretic transformations can also be implemented. For example, number-theoretic transformations can be used The number theoretic transforms are implemented using the Nussbaumer algorithm, for example, see "Modern Computer Algebra", Algorithm 8.30, or using the Nussbaumer algorithm, for example, see "Modern Computer Algebra", Exercise 4.6.4.59. Additional implementations of number theoretic transforms are disclosed in, for example, D. Bernstein's "Multidigit multiplication formathematicians", unpublished manuscript (available at https: / / cr.yp.to / papers.html#m3), August 2001 (incorporated herein by reference); and H. Nussbaumer's "Fast polynomial transform algorithmsfor digital convolution", IEEE Transactions on Acoustics, Speech, and SignalProcessing, 28(2): 205-215, 1980 (incorporated herein by reference).

[0247] GLWE encryption 368 may be homomorphically added Add 369 to the current GLWE encryption 350 to obtain a GLWE encryption 350' representing the output of the accumulator unit, e.g. or equivalently,

[0248] There are many variations of the above technique, for example, the role of 0 and 1 in encryption key 371 can be reversed by appropriately adjusting difference 363 and the value added to GLWE encryption 368. Addition 369 can be performed in the Fourier domain; etc. Likewise, in other cases, generally accumulator unit 360 can compute the outer product of the GLWE type ciphertext with the GGSW type ciphertext of the bootstrap key, which can be made more efficient by using number theoretic transformations for its polynomial multiplication as discussed above.

[0249] exist Figure 2 and Figure 3 In the embodiment of the present invention, the proposed technology is explained based on (G)LWE encryption and its gadget variant GGSW. Specifically, in the above embodiment, the ciphertext 211 to which blind rotation is applied is LWE ciphertext, the encrypted polynomial product 250 of blind rotation is GLWE encryption, and the accumulator is implemented by GGSW encryption using a bootstrap key.

[0250] However, it is not necessary to use LWE, and in particular NTRU type encryption may be used on the input ciphertext 211 and / or the encrypted polynomial product 250. In the latter case, the bootstrap key may include a small tool NTRU encryption. More generally, the provided technique may be applied to any blind rotation that produces an encrypted polynomial product of a test polynomial and a bootstrap polynomial that is multiplied by a factor different from X. M +1 modulo the quotient polynomial, such as any accumulator-based blind rotation.

[0251] Specifically, with respect to the use of NTRU for encrypting the polynomial product 250, note that the “blind rotation” algorithm discussed itself makes use of an abstract accumulator ACC. Although, as discussed, this accumulator can be implemented based on GLWE, this is not required. Other types of accumulators can also be used, such as NTRU-based accumulators. Based on the NTRU ciphertext, a gadget encryption similar to the GGSW encryption can be defined and used to define the outer product. A detailed embodiment can be found in “FINAL: FasterFHE instantiated with NTRU and LWE” by C. Bonte et al., https: / / ia.cr / 2022 / 074. Thus, the accumulator can be implemented based on NTRU, where its value can, for example, contain elements in , and can be as Figure 3 CMux is defined as discussed above.

[0252] As an example, using this type of NTRU-based accumulator to blindly rotate the LWE ciphertext c that encrypts μ can produce the bootstrapped monomial and the encrypted polynomial product of the test polynomial v In this case, the encryption polynomial can be of the form The NTRU ciphertext, using the appropriate key switching key, can optionally be extracted from this encryption polynomial The constant term is used to encrypt the LWE ciphertext, as discussed in the “FINAL” reference.

[0253] Instead of or in addition to the encryption polynomial, the input ciphertext 211 also need not be an LWE type ciphertext. Specifically, blind rotations may be applied to NTRU type ciphertexts, as discussed in the "FINAL" reference. The input LWE ciphertext 211 may also be obtained by converting the input LWE ciphertext 211 from an NTRU ciphertext, as discussed in the "FINAL" reference.

[0254] Again, in this case, it is desirable to define the test polynomial v such that the encryption polynomial product The desired output value contains fixed coefficients. Similarly, in the case of NTRU, the provided technique allows for the use of different M +1 for various choices of the quotient polynomial to define the test polynomial.

[0255] Figure 4 Schematically illustrated is an example of an implementation of an encryption calculation method 400. The encryption calculation method 400 may be implemented by calculation.

[0256] The method 400 may include obtaining 410 a LWE-type ciphertext, for example encrypting a plaintext value.

[0257] The method 400 may also include performing 420 a blind rotation on the ciphertext according to the test polynomial. The blind rotation may produce an encryption polynomial product of the test polynomial and the bootstrap monomial modulo q and modulo the quotient polynomial p(X). The bootstrap monomial may represent the plaintext value as an exponent. The quotient polynomial p(X) may be divided by the NTT polynomial, e.g., X M -1, which allows a number theoretic transformation modulo modulus q. Performing a blind rotation may include performing 425 a polynomial multiplication using a number theoretic transformation. The test polynomial may be defined such that the polynomial product has the expected output value of the plaintext value as a fixed coefficient.

[0258] Figure 5 An example of an implementation of a method 500 of determining a test polynomial is schematically shown. The method 500 may be implemented by a computer.

[0259] The test polynomial can be used for the cryptographic calculations described herein. The cryptographic calculation method can include calculating the polynomial product of the bootstrap monomial and the test polynomial, the polynomial product modulo q and modulo the quotient polynomial p(X). The quotient polynomial p(X) can be divided by the NTT polynomial.

[0260] The method 500 may include obtaining 510 a lookup table defining expected output values ​​for corresponding plaintext values. The method 500 may include obtaining 520 a modulus, a quotient polynomial, and an NTT polynomial. The method 500 may include calculating 530 a test polynomial such that the polynomial product has the corresponding expected output values ​​for the corresponding plaintext values ​​as fixed coefficients.

[0261] Many different ways of performing methods 400, 500 are possible, as will be apparent to those skilled in the art. For example, the order of the steps may be performed in the order shown, but the order of the steps may vary, or some steps may be performed in parallel. In addition, other method steps may be inserted between the steps. The inserted steps may represent a refinement of the method, as described herein, or may be unrelated to the method. For example, some steps may be performed at least partially in parallel. In addition, a given step may not be fully completed before starting the next step. Methods 400, 500 may also be combined, for example, method 400 for performing encryption calculations using a test polynomial may be performed after the test polynomial is calculated according to method 500.

[0262] Embodiments of the method may be performed using software that includes instructions for causing a processor system to perform method 400 or 500. The software may include only those steps taken by a specific sub-entity of the system. The software may be stored in a suitable storage medium (such as a hard disk, a floppy disk, a memory, an optical disk, etc.). The software may be sent as a signal wired or wirelessly, or using a data network (e.g., the Internet). The software may be available on a server for download and / or remote use. Embodiments of the method may be performed using a bitstream that is arranged to configure a programmable logic (e.g., a field programmable gate array (FPGA)) to perform the method.

[0263] It will be understood that the presently disclosed subject matter also extends to computer programs, particularly computer programs on or in a carrier, suitable for implementing the presently disclosed subject matter. The program can be in the form of source code, object code, code intermediate source, and object code (such as partially compiled form), or any other form suitable for use in an embodiment of the present method. An embodiment related to a computer program product includes computer executable instructions corresponding to each processing step of at least one method stated. These instructions can be subdivided into subroutines and / or stored in one or more files, which can be linked statically or dynamically. Another embodiment related to a computer program product includes computer executable instructions corresponding to each device, unit, and / or part of at least one of the systems and / or products stated.

[0264] Typically, the devices described herein (e.g. Figure 1a-Figure 1cThe device in the system) includes one or more microprocessors that execute appropriate software stored in the system; for example, the software may have been downloaded and / or stored in a corresponding memory, for example, a volatile memory such as RAM or a non-volatile memory such as flash memory. Alternatively, the system can be implemented in whole or in part in programmable logic, for example as a field programmable gate array (FPGA). The system can be implemented in whole or in part as a so-called application specific integrated circuit (ASIC), such as an integrated circuit (IC) customized for its specific purpose. For example, the circuit can be implemented in CMOS, for example using a hardware description language such as Verilog, VHDL, etc. In particular, the system can include circuits for evaluating cryptographic primitives.

[0265] The processor circuit may be implemented in a distributed manner, for example as multiple sub-processor circuits. The storage may be distributed over multiple distributed sub-storages. Part or all of the storage may be electronic storage, magnetic storage, etc. For example, the storage may have volatile and non-volatile portions. Part of the storage may be read-only.

[0266] Figure 6 A computer readable medium 1000 is shown having a writable portion 1010. The computer readable medium 1000 is shown in the form of an optically readable medium. The computer readable medium 1000 may store data 1020, where the data may represent instructions that, when executed by a processor system, cause the processor system to perform an embodiment of a method for a cryptographic calculation method and / or a method for determining a test polynomial according to one embodiment.

[0267] Alternatively or additionally, data 1020 may represent a test polynomial used in a cryptographic calculation method according to one embodiment.The test polynomial may have been previously determined according to one embodiment.

[0268] The data 1020 may be implemented on the computer readable medium 1000 as a physical mark or by magnetization of the computer readable medium 1000. However, any other suitable implementation is also conceivable. In addition, it will be understood that although the computer readable medium 1000 is shown as an optical disk, the computer readable medium 1000 may be any suitable computer readable medium, such as a hard disk, solid state memory, flash memory, etc., and may be non-recordable or recordable. The computer program 1020 includes instructions for causing a processor system to perform the method for performing calculations on an encrypted value (e.g., an LWE encrypted value) or the method for determining a test polynomial.

[0269] Figure 7A processor system 1140 according to one embodiment of a device for performing cryptographic calculations or determining a test polynomial is shown schematically. The processor system includes one or more integrated circuits 1110. The architecture of implementing one or more integrated circuits 1110 is schematically shown in the figure. The circuit 1110 includes a processing unit 1120 (e.g., a CPU) for running a computer program component to perform a method according to one embodiment and / or implement its modules or units. The circuit 1110 includes a memory 1122 for storing programming code, data, etc. A portion of the memory 1122 may be read-only. The circuit 1110 may include a communication element 1126, such as an antenna, a connector, or both. The circuit 1110 may include an application-specific integrated circuit 1124 for performing some or all of the processing defined in the method. The processor 1120, the memory 1122, the application-specific integrated circuit 1124, and the communication element 1126 may be connected to each other via an interconnect 1130 (e.g., a bus). The processor system 1110 may be arranged for contact and / or contactless communication, using an antenna and / or a connector, respectively.

[0270] For example, in one embodiment, the processor system 1140 (e.g., a device for performing cryptographic calculations or determining test polynomials) may include a processor circuit and a memory circuit, and the processor is arranged to execute software stored in the memory circuit. For example, the processor circuit may be an Intel Core i7 processor, an ARM Cortex-R8, etc. In one embodiment, the processor circuit may be an ARM Cortex M0. The memory circuit may be a ROM circuit, or a non-volatile memory (e.g., flash memory). The memory circuit may be a volatile memory (e.g., SRAM memory). In the latter case, the device may include a non-volatile software interface (e.g., a hard disk, a network interface, etc.) arranged to provide software.

[0271] Although device 1110 is shown as including one of each described component, multiple components may be repeated in multiple embodiments. For example, processor 1120 may include multiple microprocessors that are configured to independently perform the methods described herein, or are configured to perform the steps or subroutines of the methods described herein, so that multiple processors cooperate to implement the functions described herein. In addition, in the case where device 1110 is implemented in a cloud computing system, multiple hardware components may belong to separate physical systems. For example, processor 1120 may include a first processor in a first server and a second processor in a second server.

[0272] It should be noted that the above-mentioned embodiments illustrate rather than limit the presently disclosed subject matter, and that those skilled in the art will be able to design many alternative embodiments.

[0273] In the claims, any reference numerals placed in brackets shall not be interpreted as limiting the claims. The use of the verb "comprise" and its variants does not exclude the presence of elements or steps other than those stated in the claims. The article "a" or "an" preceding an element does not exclude the presence of multiple such elements. When an expression such as "at least one" is placed before a list of elements, it means selecting all elements or any subset thereof from the list. For example, the expression "at least one of A, B, and C" should be understood to include only A, only B, only C, both A and B, both A and C, both B and C, or all of A, B, and C. The subject matter currently disclosed can be implemented by hardware including several different elements, as well as by a suitably programmed computer. In a device claim that lists several components, several of these components can be implemented by the same hardware item. The mere fact that certain measures are recorded in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

[0274] In the claims, reference numerals in parentheses refer to reference symbols in the exemplary embodiment drawings or formulas of the embodiments, thereby improving the intelligibility of the claims. These reference numerals should not be construed as limiting the claims.

Claims

1. A cryptographic encryption calculation method (400), comprising: - obtaining (410) a ciphertext of the plaintext value; as well as - performing (420) a blind rotation on the ciphertext according to a test polynomial, wherein the blind rotation produces an encryption polynomial product of the test polynomial and a bootstrap monomial, the encryption polynomial product modulo a modulus (q) and modulo a quotient polynomial (p(X)), wherein the bootstrap monomial represents the plaintext value as an exponent; Where: the quotient polynomial (p(X)) divided by the NTT polynomial (X M -1), the NTT polynomial (X M -1) a number theoretic transformation that allows taking a modulus by the modulus (q); performing the blind rotation includes performing (425) a polynomial multiplication using the number theoretic transformation; and the test polynomial is defined so that the polynomial product has the expected output value of the plaintext value as a fixed coefficient.

2. The method (400) of claim 1, wherein the ciphertext is a LWE type ciphertext.

3. The method (400) according to claim 2, wherein the ciphertext is obtained by conversion from an NTRU type ciphertext.

4. The method (400) of claim 1, wherein the ciphertext is an NTRU type ciphertext.

5. The method (400) of claim 1, comprising performing programmable bootstrapping by: obtaining an input ciphertext; performing modulus switching on the input ciphertext to obtain the ciphertext; performing said blind rotation; And, performing sample extraction to extract the encryption of the fixed coefficients from the calculated encryption polynomial product.

6. The method (400) of claim 1, wherein performing the blind rotation comprises computing an outer product of a ciphertext with a gadget ciphertext included in a bootstrap key, wherein a polynomial multiplication to compute the outer product is performed using the number theoretic transformation.

7. The method (400) of claim 1, wherein the quotient polynomial is not equal to X N +1.

8. The method (400) of claim 1, wherein the order (N) of the quotient polynomial is strictly greater than half the order (M) of the NTT polynomial.

9. The method (400) of claim 1, wherein the modulus (q) is a power of 2.

10. The method (400) of claim 1, wherein the modulus (q) is a prime number and the order (M) of the NTT polynomial is divided by the modulus minus one.

11. The method (400) of claim 10, wherein the modulus is equal to 10·3 18 +1 or 4 3 39 +1.

12. The method (400) of claim 1, wherein the quotient polynomial is equal to X N +X N / 2 +1 or X N -X N / 2 +1.

13. The method (400) of claim 1, wherein the order of the NTT polynomial is a power of 3 and the order of the quotient polynomial is two-thirds the order of the NTT polynomial.

14. The method (400) of claim 1, wherein the fixed coefficient is a constant coefficient or a leading coefficient.

15. A method (500) for determining a test polynomial for use in a cryptographic computation method according to any one of claims 1 to 14, wherein the cryptographic computation method comprises computing a polynomial product of a bootstrap monomial and a test polynomial, the polynomial product being modulo a modulus (q) and modulo a quotient polynomial (p(X)), and wherein the quotient polynomial (p(X)) is divided by an NTT polynomial, the method comprising: - obtaining (510) a lookup table defining expected output values ​​for corresponding plaintext values; - obtaining (520) the modulus, the quotient polynomial and the NTT polynomial; as well as - calculating (530) said test polynomials such that said polynomial products have as fixed coefficients the defined expected output values ​​of said corresponding plaintext values.

16. An encryption computing device (110, 112), comprising: - a memory (140) for storing ciphertext encrypted from a plaintext value; a processor subsystem (130) configured to perform a blind rotation on the ciphertext according to a test polynomial, wherein the blind rotation produces an encrypted polynomial product of the test polynomial and a bootstrap monomial modulo a modulus (q) and modulo a quotient polynomial (p(X)), wherein the bootstrap monomial represents the plaintext value as an exponent; Where: the quotient polynomial (p(X)) divided by the NTT polynomial (X M -1), the NTT polynomial (X M -1) a number theoretic transformation allowing taking the modulus by the modulus (q); performing the blind rotation comprises performing a polynomial multiplication using the number theoretic transformation; and the test polynomial is defined such that the polynomial product has the expected output value of the plaintext value as a fixed coefficient.

17. A device (111, 112, 113, 119) for determining a test polynomial, the test polynomial being used in a cryptographic calculation method according to any one of claims 1 to 14, wherein the cryptographic calculation method comprises calculating a polynomial product of a bootstrap monomial and a test polynomial, the polynomial product being modulo a modulus (q) and modulo a quotient polynomial (p(X)), and wherein the quotient polynomial (p(X)) is divided by an NTT polynomial, the device comprising: - a memory (149) for storing a lookup table defining expected output values ​​for corresponding plaintext values; - a processor subsystem (139), the processor subsystem being configured to: - obtaining the modulus, the quotient polynomial and the NTT polynomial; as well as - calculating the test polynomials such that the polynomial products have the corresponding expected output values ​​of the corresponding plaintext values ​​as fixed coefficients.

18. A transitory or non-transitory computer-readable storage medium (1000) comprising data representing: - instructions which, when executed by a processor system, cause the processor system to perform a method according to any one of claims 1 to 14 and / or to perform a method according to claim 15; and / or - A test polynomial for use in a cryptographic calculation method according to any one of claims 1 to 14.

Images