Calculation of encoded and encrypted values

Abstract

Some embodiments relate to encryption methods that perform encryption calculations on a set of one or more encoded and encrypted values. Encryption that encodes and encrypts a value into a plurality of respective sub-values. The sub-values have corresponding message moduli and carry message moduli greater than the message moduli. Values are non-carry coded and encrypted by non-carry sub-values that are less than the corresponding message modulus. Values are coded and encrypted with carry by at least one sub-value with carry greater than or equal to the corresponding message modulus. An encryption operation is applied to the at least one input value with carry coding and encryption to obtain an output value with carry coding and encryption. A cryptographic carry reduction is applied to the carry-coded and encrypted output value to obtain a further coded and encrypted of the output value, where at least one carry sub-value is reduced to a non-carry sub-value.

Description

Technical Field

[0001] The presently disclosed subject matter relates to a cryptographic method of performing cryptographic calculations, corresponding apparatus, compiler methods and apparatus for cryptographic calculations, and computer-readable media. Background Art

[0002] Homomorphic cryptography allows one to perform encrypted computations: computations (such as circuit evaluations) that are performed by one party on encrypted data without that party being able to decrypt it. For example, input data and computation results can be received and returned in encrypted form. Intermediate data (such as the internal state of a computation) can also be in encrypted form.

[0003] Even if the result of a computation is returned in encrypted form, the output when decrypted is expected to be the same or very close to it as if the operation was performed on the unencrypted data. Homomorphic encryption can be used to outsource storage and computation with privacy preservation. This allows data to be encrypted and outsourced to a cloud environment for processing and / or storage while still encrypted.

[0004] For example, homomorphic cryptography can be applied in areas such as medical care, where privacy regulations may make it difficult to share plaintext data, but computations on encrypted medical data may be permitted. For example, a medical model developed for classifying medical data can be configured to receive medical data from a third party (e.g., a hospital) in encrypted form. The medical model can, for example, classify medical data as normal or abnormal, or as having a particular medical syndrome, disease, or other condition. Using homomorphic encryption, the medical model can be applied to medical data received in encrypted form. This means that the party providing the medical model cannot access the plaintext medical data corresponding to the encrypted medical data. Users of the service can decrypt the results of the application of the medical model.

[0005] In particular, there are homomorphic cryptographic techniques that, at least in principle, can be used to compute any function on encrypted data. Such techniques are called "fully homomorphic encryption" (FHE) techniques.

[0006] For security reasons, known implementations of FHE use noisy ciphertexts. For example, encryption of a data item may include mapping the data item to a point in a key-dependent lattice, adding noise to the point. Specifically, many known implementations of FHE use LWE-type ciphertexts, the security of which depends on the cryptographic difficulty of the fault-tolerant learning problem. Such LWE-type ciphertexts may include one or more mask values ​​(e.g., values ​​modulo some modulus q, or torus elements), plus a body value, which is derived from the mask value and the plaintext using the encryption key, and the body value contains noise. A generalization of this is the GLWE-type ciphertext, which encrypts and uses a polynomial instead of a scalar value. The RLWE-type ciphertext is another type of GLWE ciphertext. Other known implementations of FHE use NTRU-type ciphertexts, to which essentially the same considerations apply.

[0007] When a data item has just been encrypted, the noise is low - the encryption is recent. For example, the amount of noise is low so that if the data item is to be decrypted, the noise can be removed at some point in the decryption process, such as by rounding. On the other hand, the noise should be high enough to make attacks on the system sufficiently difficult. For example, many homomorphic encryption schemes can be attacked using linear algebra or other efficient algorithms (such as lattice reduction algorithms) under the assumption that there is no noise. When a data item is encrypted, noise is added that is chosen so that attacks are difficult, while homomorphic operations can still be performed and decryption is still possible.

[0008] Most homomorphic operations increase the noise inherent in the homomorphically encrypted data items. When many such operations are performed, the noise may reach a level where a unique decryption is no longer possible. In general, it is known to reduce the noise of homomorphically encrypted values ​​using a technique called bootstrapping. Bootstrapping can use a public key called a bootstrap key. By using bootstrapping to reduce the noise when needed, in principle any desired number of homomorphic operations can be computed.

[0009] A special class of fully homomorphic encryption schemes is the TFHE class of homomorphic encryption schemes. This scheme is described in I. Chillotti et al., "Programmable bootstrapping enables efficient homomorphic inference of deep neural networks", Cyber ​​Security Cryptography and Machine Learning (CSCML 2021), Volume 12716 of Lecture Notes in Computer Science, pages 1-19, Springer, 2021 (incorporated herein by reference). TFHE class schemes differ from other FHE schemes in that they support a relatively efficient bootstrapping technique; in addition, they are able to evaluate functions simultaneously during the bootstrapping operation, which is called programmable bootstrapping. Conventional bootstrapping corresponds to programmable bootstrapping with an identity function.

[0010] Other known implementations of TFHE-like schemes use NTRU-type ciphertexts, to which substantially the same considerations apply. Specifically, NTRU can be used in conjunction with the provided techniques by using blind rotations that produce the product of the NTRU encryption polynomial of the test polynomial and the bootstrapped monomial and / or applying blind rotations to the NTRU ciphertext as input. Examples of suitable NTRU encryption are defined in C. Bonte et al., “FINAL: Faster FHE instantiated with NTRU and LWE,” Cryptology ePrint Archive, Paper 2022 / 07; and in K. Kluczniak, “NTRU-v-um: Secure Fully Homomorphic Encryption from NTRU with Small Modulus,” Cryptology ePrint Archive, Paper 2022 / 089.

[0011] Interestingly, the output of programmable bootstrapping has an amount of noise that is independent of the noise in the input ciphertext. Therefore, by performing programmable bootstrapping, the noise in the input ciphertext can be reduced to a fixed amount while potentially simultaneously applying a function to the input ciphertext. By performing programmable bootstrapping at the appropriate time, cryptographic computations of infinite multiplicative complexity can be performed.

[0012] Despite the power of PBS operations, efficiently performing arithmetic operations (e.g., multiplication) on relatively large values ​​(e.g., values ​​defined modulo a number greater than 256 or greater than 1024) remains challenging today. One reason for this is that PBS scales worse than linearly with input size.

[0013] In the paper "Putting up the Swiss army knife of homomorphic calculations by means of TFHE functional bootstrapping", Cryptography ePrintArchive, Report 2022 / 149, by P.Clet et al., a technique for performing multiplication and addition on ciphertexts is proposed based on the method of digital decomposition. This means that the values ​​are encoded and encrypted by encrypting the elements of the radix decomposition of the value modulo the radix β. In this article, the authors propose an addition using two or more programmable bootstraps for each ciphertext that encrypts the decomposed elements. The additions are performed in a sequential manner. The multiplications are performed based on the textbook multiplication method. Despite these developments, further improvements in cryptographic operations on large encrypted values ​​are still needed. Summary of the invention

[0014] The inventors have noted a number of shortcomings in existing approaches.

[0015] Some existing methods have less precision for integer plaintexts using TFHE: when using a single ciphertext to encrypt an integer, it is currently not feasible in practice to perform arithmetic operations such as multiplication on ciphertexts with more than 7 bits of plaintext.

[0016] Existing methods also lack efficiency. Methods based on converting the calculation into a Boolean circuit and then bootstrapping the evaluation circuit through gates can slow down significantly in practice when the plaintext is not a Boolean value. In addition, existing methods that rely on encoding values ​​using small integers (such as 1-bit or 2-bit integers) are slow because operations on these small integers are usually constructed using a PBS, or followed by a PBS, thus requiring a large number of expensive PBSs.

[0017] Another drawback of existing approaches is their lack of parallelizability. For example, when integers are encoded via radix decomposition, performing an addition or multiplication may involve carry propagation along the MSB of the homomorphic integer, which is a sequential process. This means that homomorphic circuit evaluation is slow when it can be parallelized.

[0018] Another disadvantage is the lack of flexibility. Existing implementations of arithmetic operations, such as addition or multiplication with carry propagation, do not allow for flexible adjustment of the way the arithmetic operation occurs based on the size of the input, thereby optimizing performance for the current use case.

[0019] The present invention aims to address at least some of these problems.

[0020] According to one aspect of the invention, there is provided a cryptographic computing method for performing cryptographic computing, as defined in the claims. According to yet another aspect, there is provided an apparatus corresponding to the computer-implemented method, as defined in the claims. According to another aspect, there is provided a computer-readable medium, as defined in the claims.

[0021] Various aspects are directed to performing cryptographic calculations on a set of one or more encoded and encrypted values. These values ​​can be numeric values, such as values ​​defined modulo some overall modulus q. Such values ​​modulo the modulus q can be interpreted as, for example, unsigned integers (e.g., from the domain [0, q)); signed integers (e.g., [-q / 2, q / 2)); fixed-point numbers, etc.

[0022] Such an encoded and encrypted value may be encoded and encrypted as an encryption of multiple corresponding sub-values, also referred to herein as "blocks". For example, the value and sub-values ​​may be associated with each other according to a cardinality decomposition of a fixed base β. Several other ways in which the value and sub-values ​​may be associated are also possible, as discussed in detail elsewhere.

[0023] In one embodiment, the encryption of the sub-value is LWE encryption. In one embodiment, the encryption of the sub-value is NTRU encryption.

[0024] The encryption computation may include applying one or more encryption operations to the encoded and encrypted values ​​of the group, for example, arithmetic operations (such as addition and / or multiplication); function application (such as application of ReLU, sign, exponential or other univariate functions); and / or other digital operations.

[0025] Such cryptographic operations may typically take as input one or more encoded and encrypted input values ​​(and optionally additional inputs, such as further encrypted or unencrypted values), and may produce one or more encoded and encrypted output values. Interestingly, these operations are performed cryptographically in the sense that they do not reveal information about the input and / or output values, and in particular, the input values ​​are not decrypted in order to perform the operation.

[0026] Interestingly, the inventors envision encoding the encoded and encrypted values ​​as encrypted subvalues ​​that allow carry preservation. The subvalues ​​may have an associated message modulus, and a carry message modulus that is greater than the message modulus. For example, the subvalues ​​may be defined according to a radix decomposition, where the radix is ​​8, and therefore the message modulus is also 8, but may be encrypted as a value modulo a carry message modulus of 64. Accordingly, a value may be encoded and encrypted without carry, meaning that the subvalue is a non-carry subvalue less than the corresponding message modulus; but a value may also be encoded and encrypted with carry, meaning that at least one subvalue is a carry subvalue greater than or equal to the corresponding message modulus.

[0027] The carry-encoded and encrypted value can be obtained based on the relationship between the value and the non-carry subvalues ​​and based on the corresponding carry reduction operation (for example, based on the cardinality factorization of the message modulo β and based on the carry reduction of the subvalue m to m mod β and the carry reduction of the subvalue m to m mod β and the carry reduction of the subvalue m to m mod β). Carry reduction that propagates to the next most significant value) corresponds to its child value.

[0028] The inventors have realized that the carry-encoded subvalues ​​can be used not only in cryptographic operations, but also as input or output of cryptographic operations. A cryptographic operation (e.g., addition, multiplication, another arithmetic operation, or single-variable function evaluation) can be applied to at least one carry-encoded and encrypted input value and can produce at least one carry-encoded and encrypted output value.

[0029] In some cases, a cryptographic carry reduction may be applied to the output value, wherein at least one subvalue with a carry may be reduced to a non-carry subvalue. However, in other cases, the output value may not be subjected to a carry reduction and may be input into a further cryptographic operation (e.g., a further addition, multiplication, or other arithmetic operation) along with the carry. In any case, if desired, a cryptographic carry reduction may be applied during the cryptographic operation, such as to an intermediate subvalue. In general, a cryptographic carry reduction may be applied to ensure that subsequent cryptographic operations do not produce subvalues ​​that exceed the modulus of the carry message.

[0030] By allowing a carry-encoded and encrypted value to be used as an input and / or output of a cryptographic operation, and by optionally performing carry reductions (in some cases without performing carry reductions on all carry-encoded and encrypted subvalues ​​of the value), the efficiency of cryptographic computations can be greatly improved for a number of reasons detailed below. In general, the provided techniques enable efficient execution of cryptographic computations, such as evaluating arithmetic circuits on a value encoded and encrypted into multiple subvalues. By selectively performing encrypted carry reductions on selected subvalues, a configurable cryptographic computation technique is provided that allows for optimization of aspects of the computation to be performed prior to or during execution.

[0031] In particular, by using multiple sub-values, the lack of precision of some existing methods can be compensated. This enables cryptographic calculations to be performed on values ​​defined modulo a relatively large modulus, as will be shown in an example later.

[0032] Through selective carry reduction, the number of carry reduction operations required can be greatly reduced; for example, cryptographic computations can be performed using a smaller number of programmable bootstrap applications than in existing methods, greatly improving efficiency. For example, multiple additions, other linear operations, or even multiplications of encrypted values ​​can be performed without performing carry reductions in the middle. Various parameters can be varied, including the message modulus, the carry message modulus, and the encoding of subvalues ​​of the plaintext during encryption. This opens the possibility to optimize the homomorphic evaluation of a given cryptographic computation, improving flexibility and performance.

[0033] In addition, the provided technique provides improved parallelizability. Since the output of an operation may have a carry, carry reduction between steps may be avoided, thereby performing one or a series of encryption operations on corresponding subvalues ​​in parallel. For example, when using a coding based on radix decomposition, additions may be performed separately on corresponding subvalues. When using a coding based on a remainder system, multiplication and carry reduction may also be parallelized. As a result, performance is improved, especially on multi-threaded systems and multi-core systems.

[0034] Specifically, the above-referenced paper "Putting up the Swiss army knife of homomorphic calculations by means of TFHE functional bootstrapping" proposes an addition that is sequential and uses at least 2 PBSs per ciphertext that encrypts the decomposed elements. In contrast, the presented technique allows the addition to be implemented using only one PBS per ciphertext and only when carry reduction is required for that ciphertext; if carry reduction is not required, the addition can be fully parallelized. Compared to the multiplication they proposed, the presented technique is more efficient and can be better parallelized.

[0035] In general, cryptographic computations may be performed in a TFHE setting. This means that the ciphertext used to encrypt the subvalues ​​allows for programmable bootstrapping operations. Specifically, the ciphertext may be an LWE (learning-with-error) encryption, i.e., an encryption based on the cryptographic assumption that the learning-with-error problem is difficult. As known per se, programmable bootstrapping may evaluate LWE decryption in the exponent of a GLWE encrypted monomial (e.g., implemented as a so-called blind rotation). Specifically, programmable bootstrapping may involve computing an encrypted polynomial product of a bootstrap monomial and a test polynomial representing the plaintext value as an exponent. The test polynomial may represent a function applied to the input by programmable bootstrapping. Programmable bootstrapping may use a bootstrap key that is capable of performing programmable bootstrapping but not decryption of the ciphertext. Programmable bootstrapping operations may be used to implement one or more cryptographic operations of encrypted carry reduction and / or encrypted computations.

[0036] Instead of using LWE / GLWE type ciphertexts, different lattice encryptions can also be used. For example, the ciphertext to which blind rotations are applied and / or the resulting encrypted polynomial product can be an NTRU ciphertext. For example, an NTRU encryption of a message μ can be defined by adding the quotient of a noise polynomial g and a private key polynomial f to the message, e.g., can be a reversible polynomial (usually with small coefficients); and NTRU encryption can be done by Given, or written as g=e1+f·e2 via c=e1 / f+μ+e2. Specifically, an NTRU ciphertext may contain only a single polynomial. The security of such a ciphertext may be based on the NTRU assumption.

[0037] In one embodiment, the ciphertext to which blind rotation is applied may be an LWE-type ciphertext. For example, blind rotation may be part of a cryptographic computation performed on an LWE-type ciphertext (e.g., without involving any NTRU-type ciphertext). Alternatively, an LWE-type ciphertext may be obtained by converting from an NTRU-type ciphertext, for example, as part of a cryptographic computation performed on an NTRU-type ciphertext. Blind rotation may also be applied directly to an NTRU-type ciphertext without converting to LWE. More generally, the ciphertext may be a lattice-type ciphertext, the security of which depends on the cryptographic difficulty of the lattice problem, LWE and NTRU being two examples.

[0038] In one embodiment, the output value can be calculated by performing multiple cryptographic operations on a set of encoded and encrypted values, wherein the cryptographic operations are performed without performing any cryptographic carry reductions between or during the cryptographic operations. For example, the cryptographic operations may include multiple additions and / or multiple multiplications. For example, performing the cryptographic calculations may include evaluating an arithmetic circuit that includes the cryptographic operations. The arithmetic circuit may have, for example, a multiplication depth of at least two (meaning that the output of one multiplication is used directly or indirectly as the input of another multiplication) or a multiplication depth of at least three. By allowing carry, in some cases, such calculations can be performed without carrying reductions in the middle, or in any case using fewer carry reductions, thereby providing significant performance improvements.

[0039] In one embodiment, the encryption operation can be applied by applying the corresponding sub-operations separately to the corresponding encryption of the sub-values ​​of the input value. Specifically, performing the encryption operation can consist of performing these sub-operations alone. For example, this can be the case for linear operations, or multiplication when using a remainder system representation. In one embodiment, the separately applied encryption operations can be performed at least partially in parallel, which is beneficial for performance, particularly for multi-threaded systems and multi-core systems.

[0040] In one embodiment, encoding a value as a non-carry subvalue is based on a radix decomposition of the value. In other words, a value encoded by a set of carry-with and non-carry subvalues ​​can be calculated by performing a carry reduction on the carry-with subvalues ​​and reconstructing the value from the radix decomposition. The radix decomposition can be for the radix of the corresponding base element, wherein the corresponding message modulus corresponds to the corresponding base element. Encoding using radix decomposition allows various parts of the cryptographic calculation to be performed relatively efficiently, particularly arithmetic operations such as addition and / or multiplication and / or division; comparison operations such as determining which of two values ​​is greater; and carry reduction.

[0041] The basis elements may define a total modulus corresponding to the product of the corresponding basis elements. Thus, a basis decomposition with a given basis may be used to encode a value modulo the total modulus. A basis may also be used in combination with a modulus that is less than the product of the basis elements, as also described elsewhere in this specification.

[0042] The basis elements can all be the same, e.g., they may all be equal to 2 for a base-2 radix factorization, or they may all be equal to 5 for a base-5 radix factorization. Interestingly, however, this is not necessary. In some embodiments, the basis elements of the radix factorization are not all the same. This provides greater flexibility in selecting the basis elements based on the size requirements of the application at hand, thereby reducing the overhead of using a larger modulus than necessary. Specifically, the basis elements do not have to all be the same power or power of two, or they do not have to all be powers of two at all. The inventors have realized that cryptographic computing techniques, particularly in the TFHE setting, can also be applied in this more general setting.

[0043] In one embodiment, the encrypted carry reduction in the radix decomposition setting can be performed by decomposing the subvalue with carry of the output value into the encryption of the corresponding subvalue of the subvalue, and adding the subvalue encryption of the subvalue to the encryption of the corresponding subvalue of the output value. In this way, the subvalue with carry can be reduced to a value lower than the message modulus. By repeating this process for the corresponding subvalue with carry, the encoding and encryption of the value without carry can be obtained.

[0044] In one embodiment, an encrypted multiplication of a coded and encrypted value with a non-encrypted scalar may be performed. The encrypted multiplication may be achieved by calculating the corresponding encrypted subvalues ​​of the multiplication of the subvalues ​​of the coded and encrypted value with the scalar, for example, using programmable bootstrapping. If radix factorization encoding is used, the results of the encrypted multiplication may be combined to obtain an overall result. In this way, multiplication with a relatively large scalar may be performed. For example, for a smaller scalar, the corresponding encrypted subvalues ​​may also be directly multiplied with the scalar itself to obtain the corresponding encrypted output subvalues. If a remainder system encoding is used, the corresponding products of the corresponding subvalues ​​may form the overall result.

[0045] In one embodiment, the encrypted multiplication of the first encoded and encrypted value and the second encoded and encrypted value can be performed by performing the encrypted multiplication of the encryption of the subvalues ​​of the first encoded and encrypted value and the second encoded and encrypted value. In a radix decomposition setting, the encrypted multiplication of the subvalues ​​can obtain the encoded and encrypted value. These encoded and encrypted values ​​can be added together to obtain an overall result. During the multiplication process, carry reduction can be performed as needed, for example, as indicated by the degree of integrity of the calculation described herein. Interestingly, particularly efficient multiplication of large encrypted values ​​can be achieved in this way.

[0046] In one embodiment, the value encoded and encrypted using radix decomposition coding is defined as modulo by a modulus smaller than the maximum value (e.g., the product of base elements) that can be represented by radix decomposition. In this way, the number of situations in which radix decomposition coding can be used has been greatly increased. For efficiency, radix decomposition coding preferably uses smaller base elements, in which case the maximum representable value is the product of such small base elements. Interestingly, the inventors realize that radix decomposition coding can still be used in the case where the calculation is expected to be modulo by a modulus that is not the product of a small base element. Various encryption operations can be performed as if modulo by the product of base elements, except that the encryption carry reduction of the most significant sub-message can be adjusted by correcting the carry reduction according to the required modulus. For example, the correction can be performed by multiplying the most significant sub-value by a scalar and deducting the result from the value of the most significant sub-value that has been deleted.

[0047] In one embodiment, encoding a value as a non-carry subvalue is based on a remainder system representation of the value. This representation is also referred to as a CRT (Chinese Remainder Theorem) representation. The representation can be based on a set of mutually prime base elements. For example, the corresponding subvalue of the encoded and encrypted value can have a message modulus corresponding to the base element.

[0048] Specifically, the carry-encoded encrypted value can be expressed as i The CRT decomposition and the corresponding sub-value m i Modulus reduction to m i modβ i The carry reduction of corresponds to its subvalues.

[0049] Similar to the cardinality representation, linear arithmetic operations can be efficiently implemented using the CRT representation. Interestingly, the CRT representation can also allow particularly efficient multiplication and carry reduction, both of which can additionally be performed on the corresponding subvalues ​​separately and are therefore parallelizable. In addition, using the CRT representation, various other types of operations (such as applying single-variable functions) are possible.

[0050] In one embodiment, the value is encoded as a non-carry sub-value can be represented based on the remainder system, and further based on the cardinality of the element represented by the remainder system. This method is referred to as "mixing" method in this article. For example, according to corresponding (different or equal) cardinality, one, multiple or all elements in the remainder system can be carried out cardinality decomposition. Use hybrid method, can use relatively large CRT base element to use CRT method efficiently.

[0051] In one embodiment, when using radix decomposition to encode an element of a remainder system representation, the modulus about which the element is defined (i.e., the corresponding basis element of the CRT basis) can be smaller than the maximum value representable by the radix decomposition. As described generally for radix decomposition, radix decomposition can still be used in this case, thereby enabling it to be applied to a wider range of situations. This combination is particularly beneficial because it allows for a better combination of the pressing needs of having coprime basis elements in the CRT and having a radix decomposition using small basis elements.

[0052] If the inputs and outputs of the cryptographic operations do not use carries, e.g., if cryptographic carry reductions are used only within the cryptographic operations; if cryptographic carry reductions are used directly after each cryptographic operation so as to produce outputs without carries; or if the cryptographic operations do not involve any carries at all, e.g., if they are implemented using programmable bootstrapping without using carries, then several advantages of using a CRT representation, particularly efficient and parallelizable cryptographic linear and multiplication operations, are applicable. Also contemplated is a cryptographic computation method that uses a CRT but does not involve cryptographic operations applied to values ​​that are encrypted and encoded without carries.

[0053] Specifically, a cryptographic computing method is contemplated, comprising: accessing one or more coded and encrypted values, wherein encoding the value as a non-carry subvalue is based on a remainder system representation of the value; and applying a cryptographic operation to at least one of the coded and encrypted input values ​​to obtain a coded and encrypted output value. A cryptographic device corresponding to the method is also contemplated.

[0054] In one embodiment, performing an encrypted computation with carry may include tracking the degree of integrity of subvalues ​​of the encoded and encrypted value. The degree of integrity may indicate bounds on the subvalues, for example, expressed as a maximum value that a subvalue is known to have, or a ratio of the maximum value to the carried message modulus. For example, for a value that is not encoded and encrypted with carry, the degree of integrity may indicate that its subvalue is less than the corresponding message modulus. For a value that is encoded and encrypted with carry, the degree of integrity may indicate that at least one of its subvalues ​​is likely to be greater than or equal to the corresponding message modulus, in other words, is not guaranteed to be less than the message modulus.

[0055] During and / or between cryptographic operations, the degree of integrity may be used to determine whether to perform cryptographic carry reduction on cryptographic subvalues. Specifically, the degree of integrity of a subvalue with carry to be calculated from one or more input cryptographic subvalues ​​in a cryptographic operation may be determined. If the bounds indicated by the degree of integrity exceed the corresponding carry message modulus, cryptographic carry reduction may be applied to the one or more input cryptographic subvalues ​​before calculating the carry subvalues, such that the bounds of the subvalue with carry no longer exceed the carry message modulus. Thus, overflow of the subvalues ​​may be avoided.

[0056] Interestingly, by tracking the degree of completeness during cryptographic computations, a flexible way of performing cryptographic computations can be obtained, wherein the decision whether to perform cryptographic carry reductions can be adaptively made. Thus, the decision can depend on the current input, e.g., public scalars used in the computation, bounds on the cryptographic inputs provided by the inputter, the degree of completeness in a particular iteration of an iterative algorithm, etc. This generally results in more efficient execution of cryptographic computations. It also makes it easier to specify cryptographic computations, since there is no need to explicitly specify when to perform carry reductions. This may make the presented technique particularly suitable for non-experts in cryptographic computations.

[0057] For example, a cryptographic computation may be performed in such a way that, in a first execution, a cryptographic carry reduction of a certain cryptographic subvalue occurs, while in a second execution, the cryptographic carry reduction is avoided. Furthermore, operations of cryptographic computations that are performed multiple times may or may not include cryptographic carry reductions, depending on the degree of integrity of their inputs. For example, a cryptographic multiplication or other cryptographic operation may include a cryptographic carry reduction of a cryptographic subvalue computed during the operation in a first execution of the multiplication, but not in a second execution of the multiplication.

[0058] According to a further aspect of the present invention, a compiler method and apparatus as defined in the claims are provided. As the inventors appreciate, there is no need to track integrity levels during cryptographic computations. Many of the advantages of using integrity levels can also be achieved if integrity level calculations are performed as part of a compiler method that compiles computations into homomorphic executables. That is, the homomorphic executable can be capable of efficiently performing cryptographic computations, in particular, performing encrypted carry reduction operations only when needed. The homomorphic executable can be executed by an encryption computation engine and causes the encryption computation engine to perform encryption computations on a set of one or more encoded encryption values ​​as described herein. The homomorphic executable can include one or more instructions to perform encrypted carry reduction operations as described herein, for example as part of an encryption operation or between executions of an encryption operation. The compiler method can include: for a carry sub-value to be calculated, determining an integrity level indicating a bound of the carry sub-value; and, if the bound exceeds the corresponding carry message modulus, generating instructions that cause the encryption computation engine to apply the encrypted carry reduction before calculating the carry sub-value. The compiler method may also include optimizing one or more parameters of the cryptographic calculation, such as a number and a value for a message and a carry message modulus, for compiling the cryptographic calculation into an executable file.

[0059] In one embodiment, one or each message modulus is not a power of 2. Although existing techniques for cryptographic calculations (particularly in TFHE settings) typically use powers of 2 for their moduli, the inventors appreciate that this is not required, and that the provided techniques may be used when one or more message moduli are not a power of 2. Instead or in addition, in one embodiment, one or more of the carried message moduli are not a power of 2. This allows operations to be better tailored to the current situation, for example, performing calculations on values ​​defined modulo a modulus that matches the calculation and range of the current input value.

[0060] In one embodiment, the message modulus is at least 3 and / or at least 5 and / or at least 10. An advantage of using a larger value for the message modulus is that the precision of individual ciphertexts is greater, thereby requiring fewer ciphertexts to represent the value. In addition, computations (particularly those not involving carry reductions) can be more efficient.

[0061] In one embodiment, the carry message modulus may be at least four times, at least eight times, or at least thirty-two times the corresponding message modulus. Thus, expressed in bits, in practice, at least two, at least three, or at least five carry bits may be provided. By using a carry message modulus that is significantly larger than the message modulus, the number of operations or sub-steps of operations that can be performed before a carry reduction is required is increased, thereby improving efficiency.

[0062] In one embodiment, one or each carry message modulus is at most 128, at most 256, or at most 512. The efficiency of operations such as carry reductions using programmable bootstrapping typically scales worse than linearly with the size of the carry message modulus. By keeping the carry message modulus limited, the computational cost of such operations also remains limited.

[0063] In one embodiment, the modulus defining the encrypted value is at least 1024, at least 4096, or at least 16384. Interestingly, despite the use of such large moduli, the provided techniques still allow for relatively efficient computations on them.

[0064] In one embodiment, the function evaluation may be applied to one or more encoded and encrypted values ​​by extracting one or more bits from one or more subvalues ​​of the encoded and encrypted value; converting the extracted bits to GGSW ciphertext; and applying the lookup table to the GGSW ciphertext. As explained in more detail elsewhere, this is a particularly efficient way to implement the function, particularly for relatively large values, such as values ​​with a relatively large number of message and / or carry message moduli and / or subvalues.

[0065] In one embodiment, a cryptographic computation may at some point include the evaluation of a multivariable function (e.g., a two-variable function) on a plurality of cryptographic input values ​​(e.g., subvalues). An important example of a multivariable function is a cryptographic multiplication of an encryption of a first subvalue and a second subvalue, e.g., the same encoded and encrypted value or different encoded and encrypted values. For example, such a cryptographic multiplication may occur as part of a cryptographic multiplication of encoded and encrypted values, or as part of a different type of cryptographic operation. In any case, the multivariable function evaluation may be performed by determining a combined encryption representing the respective encrypted input values; and performing the multivariable function evaluation by applying a univariable function to the combined encryption, which corresponds to applying the multivariable function to the respective input values, e.g., by applying programmable bootstrapping to the combined encryption.

[0066] This is a particularly efficient method for performing multivariable function evaluations, which also combines well with determining the degree of integrity and using carries. Specifically, when encrypting input values ​​with carries, there may indeed be enough space in the plaintext space to store the combined encryption; if necessary, encryption carry reductions can be performed to ensure that the combined encryption does not overflow the carry message modulus.

[0067] The provided techniques for improved computing of encrypted data can be applied to a wide range of practical applications. Such practical applications include encrypting and evaluating software programs without accessing plaintext data. For example, people can evaluate medical diagnostic software about medical data without actually accessing the medical data. Medical data can include medical images. Medical images can include, for example, multidimensional image data acquired by a variety of acquisition methods, such as two-dimensional (2D), three-dimensional (3D) or four-dimensional (4D) images, such as but not limited to standard X-ray imaging, computed tomography (CT), magnetic resonance imaging (MRI), ultrasound (US), positron emission tomography (PET), single photon emission computed tomography (SPECT) and nuclear medicine (NM).

[0068] In one embodiment, the provided techniques can be used to evaluate a neural network with respect to encrypted inputs. A party evaluating a neural network may or may not have plaintext access to the training parameters of the neural network, such as weights and biases. In general, the techniques provided herein (e.g., improved polynomial multiplication, programmable bootstrapping, and outer products) improve the efficiency of evaluating a neural network and / or reduce the storage and transmission requirements of the ciphertext or key material used.

[0069] An embodiment of the method may be implemented on a computer as a computer-implemented method, or implemented in dedicated hardware, or in a combination of the two. Executable code for an embodiment of the method may be stored on a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Preferably, the computer program product includes non-transitory program code stored on a computer-readable medium for performing an embodiment of the method when the program product is executed on a computer.

[0070] In one embodiment, the computer program comprises computer program code, which is adapted to perform all or part of the steps of an embodiment of the method when the computer program is run on a computer.Preferably, the computer program is embodied on a computer readable medium. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Further details, aspects and embodiments will be described by way of example only with reference to the accompanying drawings. The elements in the drawings are illustrated for simplicity and clarity and are not necessarily drawn to scale. In the drawings, elements corresponding to elements already described may have the same reference numerals. In the drawings,

[0072] FIG. 1 a schematically illustrates an example of an implementation of an encryption device;

[0073] FIG. 1 b schematically shows an example of an implementation scheme of a compiler device;

[0074] FIG. 1c schematically illustrates an example of an implementation of an encryption computing system;

[0075] FIG. 2a and FIG. 2b schematically show an embodiment of a lookup table for programmable bootstrapping;

[0076] FIG3 a schematically shows an embodiment of carrying a sub-value;

[0077] FIG3 b schematically shows an embodiment of addition with carry sub-value;

[0078] FIG3 c schematically illustrates an embodiment of scalar multiplication with carry sub-values;

[0079] FIG3 d schematically illustrates an example of an implementation of an encrypted multiplication operation of an encryption of a first subvalue and a second subvalue;

[0080] Figure 4 Schematically illustrates an embodiment of a value encoded and encrypted based on radix decomposition;

[0081] Figure 5 Schematically illustrates an embodiment of a value encoded and encrypted based on a remainder system representation;

[0082] Figure 6 Schematically illustrating an embodiment of a value encoded and encrypted based on a radix factorization and using a modulus that is smaller than the maximum value representable by the radix factorization;

[0083] Figure 7 Schematically illustrating an embodiment of a value encoded and encrypted based on a remainder system representation and further based on a radix decomposition of an element of the remainder system representation;

[0084] Figure 8 An example of an implementation of an encryption method for performing encryption calculations is schematically shown;

[0085] Fig. 9 An example of an implementation of a compiler method is schematically shown;

[0086] Fig.10 schematically illustrates a computer readable medium having a writable portion according to an embodiment;

[0087] Fig.11 A representation of a processor system according to an embodiment is schematically shown. DETAILED DESCRIPTION

[0088] While the presently disclosed subject matter may be embodied in many different forms, one or more specific embodiments are shown in the drawings and will be described in detail herein, it being understood that the disclosure should be considered as an exemplification of the principles of the presently disclosed subject matter and is not intended to be limited to the specific embodiments shown and described.

[0089] In the following, for ease of understanding, various elements of the embodiments are described in operation. However, it is obvious that the corresponding elements are arranged to perform the functions described by them.

[0090] Furthermore, the presently disclosed subject matter is not limited to the embodiments but also comprises every other combination of features described herein or recited in mutually different dependent claims.

[0091] First, some general information and notation applicable to several embodiments is provided.Throughout this specification, the parameter q represents the modulus used for encoding and encrypting values, such as a positive integer. Indicator ring The parameter N represents the size of the various polynomials used, and is usually a power of 2. Indicator ring Indicator ring χ σindicates a Gaussian distribution with its mean set to zero and its standard deviation set to σ. The symbol || indicates a concatenation. The most (or least) significant bit of an integer is called the MSB (or LSB). The lookup table is abbreviated as LUT. indicates the (computational) complexity of the algorithm Alg, potentially depending on some parameters p1,…,p n .

[0092] The Chinese Remainder Theorem (CRT) is stated as follows. Let R be a ring, and let I0,I1,…,I n is the value in R for a mutually prime ideal numbers. Then there exist the following ring isomorphisms:

[0093]

[0094] In this specification, CRT indicates from R to R / I0×R / I1×…×R / I n The inverse CRT (indicated as iCRT) converts R / I0×R / I1×…×R / I n Mapped to R.

[0095] Various embodiments use LWE (Learning to Resistant Errors) encryption. Generally speaking, LWE type ciphertexts may include one or more mask values, and a main value derived from the mask value and the plaintext value. These values ​​are typically integers modulo a given modulus q. Various embodiments also use GLWE (Generalized Learning to Resistant Errors) type ciphertexts. GLWE type ciphertexts may include one or more mask polynomials, and a main polynomial derived from the mask polynomial and the plaintext polynomial. GLWE type ciphertexts may be defined modulo the modulus q and the quotient polynomial p(X). LWE ciphertexts may be viewed as a special type of GLWE ciphertext in which the degree of the quotient polynomial is 1. Another special type of ciphertext is the RLWE (Ring Learning to Resistant Errors) ciphertext in which the number of mask polynomials is 1.

[0096] Specifically, according to the secret key information The GLWE ciphertext can be defined as follows:

[0097]

[0098] here, is a secret key with coefficients sampled, for example, from a uniform binomial distribution, a uniform trinomial distribution, or a Gaussian distribution. is an appropriate scaling of the input message. is a function that has, for example, The coefficients of uniformly distributed sampling in The polynomial in , E is The noise (error) polynomial in , such that its coefficients are, for example, derived from a Gaussian distribution χ σ The parameter k is a positive integer and represents the number of polynomials in the GLWE secret key. To simplify the notation, S k+1 can be defined as -1. In this embodiment, the LWE ciphertext is the GLWE ciphertext, where N=1. In this case, the parameter n=k can be regarded as the size of the LWE secret key, and both the ciphertext and the key can be represented by lowercase letters (e.g., ct q In this embodiment, the RLWE ciphertext is a GLWE ciphertext, where k=1 and N>1, for example, a power of 2.

[0099] Although, the integer q is used throughout this specification to indicate a ciphertext modulus, it is noted that multiple ciphertext moduli may be used in cryptographic multiplications, for example where modulus switching is used to align ciphertexts according to the same q when necessary.

[0100] The above embodiment describes a symmetric variant of the secret key, GLWE. As known per se, the techniques provided herein apply equally to the public key variant. In the latter case, for example, the above secret key can be used as a private key, where the public key includes an encryption of one or more zeros, for example, see R. Rothblum, "Homomorphic encryption: From private-key to public-key", Theory of Cryptography (TCC 2011), Volume 6597 of Lecture Notes in Computer Science, pages 219-234, Springer, 2011 (incorporated herein by reference).

[0101] Various embodiments operate in the context of a TFHE setting, meaning that a ciphertext that supports programmable self-bootstrapping (PBS) is used. A programmable self-bootstrapping may take as input a ciphertext and output a ciphertext that is the same message or a function of the message with noise that is unrelated to the input. The PBS may include homomorphic decryption of the input ciphertext in the exponent of an evaluation polynomial. In general, in TFHE-like schemes, a secure set of encryption parameters may be chosen so as to minimize computational cost while meeting the required accuracy. Interestingly, such parameters may be chosen independently of the number of homomorphic operations and the depth of the circuits evaluated. Examples of encryption schemes in a TFHE setting that may be combined with the techniques provided herein are provided in the following references:

[0102] -[DM15] L.Ducas et al., "FHEW: bootstrapping homomorphic encryption in less than a second", proceedings EUROCRYPT 2015;

[0103] -[CGGI16] I. Chillotti et al., "Faster fully homomorphic encryption: Bootstrapping in less than 0.1seconds", proceedings ASIACRYPT 2016;

[0104] -[CGGI17] I. Chillotti et al., "Faster packed homomorphic operations and efficient circuit bootstrapping for TFHE", proceedings ASIACRYPT 2017.

[0105] -[BIPPS22] C. Bonte et al., "FINAL: Faster FHE instantiated with NTRU andLWE", Cryptology ePrint Archive, Paper 2022 / 07.

[0106] Various embodiments are directed to performing cryptographic calculations on values ​​encrypted as subvalues. In this specification, by way of illustration, these values ​​are generally presented as integers modulo a certain modulus. Such values ​​modulo an integer can be equivalently considered to be elements of a discrete torus, as is done in several of the references mentioned above. In particular, various references use the real torus to represent the message space and ciphertext space, and by using the arithmetic modulus 2 32 or 2 64 To implement This can be equivalently viewed as corresponding to using Integers in (use q=2 32 Or q = 2 64 ) is calculated. Therefore, integers and discrete torus elements modulo a given modulus may be used alternatively, in particular, and There are isomorphisms between them, as also pointed out in the literature, for example, see C. Boura et al., “CHIMERA: Combining Ring-LWE-based Fully Homomorphic Encryption Schemes”, J. Math. Cryptol., 14(1): 316-338, 2020.

[0107] The programmable bootstrapping operations in TFHE-like schemes make them an attractive choice for a variety of applications. Since bootstrapping is relatively efficient compared to many other FHE schemes, it is more feasible to perform relatively complex computations (e.g., computations with a multiplication depth of at least 10, at least 50, or at least 100). Specifically, the cryptographic parameters of TFHE-like schemes can be selected based on the desired accuracy and the computational cost incurred and independently of the number of homomorphic operations and their circuit depth. In contrast, in other FHE schemes, the bootstrapping efficiency is very low, so that in practice these schemes are often applied in a hierarchical manner, meaning that their parameters are selected depending on a given computation so that it can be performed without bootstrapping. However, this hierarchical approach is not feasible for more complex computations, so TFHE-like schemes are particularly useful in such cases.

[0108] In general, the security of GLWE-based ciphertexts is based on the distribution of the secret key, as well as three main parameters: n = kN, where N is the degree of the quotient polynomial, k is the number of random masking polynomials of the ciphertext, and n is the length of the secret key; q, the modulus; σ, a statistical parameter of the noise, such as its standard deviation. Given these parameters, it is known per se how to assess the degree of security provided, see, for example, M. Albrecht et al., "On the concrete hardness of Learning with Errors", Journal of Mathematical Cryptology, 9(3): 169-203, 2015 (incorporated herein by reference).

[0109] In embodiments herein, the parameters of the TFHE-like LWE-based and GLWE-based ciphertexts used may be selected based on the desired security level and based on the desired precision of operations (such as linear combinations of LWE ciphertexts and / or applying programmable bootstrapping, in other words, the noise level generated by applying these operations). Interestingly, in the TFHE setting, the security parameters may be selected independently of the computational complexity (e.g., independent of the multiplication depth of the computation). This is different from non-TFHE-like schemes, where security parameters are typically selected to limit or eliminate bootstrapping.

[0110] Specifically, the LWE-based ciphertext and / or the GLWE-based ciphertext used in the TFHE setting of this article can use a relatively small modulus, such as a modulus of at most 32 bits, at most 64 bits, or at most 128 bits. This modulus is typically selected independently of the computation to be performed, for example, it is selected based on the desired accuracy and / or efficiency. The parameters N, k and / or σ can be selected to achieve the desired security level, and are typically also independent of the computation to be performed. For example, N can be set to at least 512 and / or at most 2048 or 4096, for example, 1024. For example, in one embodiment, RLWE is used, where N is at least 512 and / or at most 2048 or 4096 (e.g., 1024), and k=1. Such values ​​of N are typically not used in non-TFHE-type encryption schemes, where such values ​​would severely limit the computations that can be performed; instead, in non-TFHE-type schemes, q and N are typically selected based on the desired security level, so q may be much larger.

[0111] Figure 1a schematically illustrates an example of an implementation of a cryptographic computing device 110. The device 110 may be used to perform cryptographic computing on a set of one or more encoded and encrypted values.

[0112] The encoded and encrypted value may be encoded and encrypted as an encryption of a plurality of corresponding subvalues. Here, the subvalues ​​may have a corresponding message modulus and a carry message modulus greater than the message modulus. In the encoded and encrypted value, one or more values ​​may be encoded and encrypted without a carry. In this case, the non-carry subvalue may be less than the corresponding message modulus. In the encoded and encrypted value, one or more values ​​may be encoded and encrypted with a carry. In this case, at least one subvalue with a carry may be greater than or equal to the corresponding message modulus. The remaining zero or more subvalues ​​may be non-carry subvalues.

[0113] Device 110 may include a processor system 130, a memory 140, and a communication interface 150. Memory 140 may include local memory, such as a local hard drive or electronic memory. Memory 140 may include non-local memory, such as cloud memory. In the latter case, memory 140 may include a memory interface with the non-local memory. For example, memory 140 may be used to store one or more encoded and encrypted values ​​being calculated. Memory 140 may contain additional data, such as a bootstrap key used in blind rotation as discussed elsewhere.

[0114] The device 110 can communicate internally, with other devices, external memory, input devices, output devices, and / or one or more sensors via a computer network. The computer network can be the Internet, an intranet, a LAN, a WLAN, etc. The computer network can be the Internet. The device can optionally include a connection interface 150, which is arranged to communicate with other devices as needed. For example, the connection interface may include a connector, such as a wired connector (e.g., an Ethernet connector, an optical connector, etc.) or a wireless connector (e.g., an antenna, such as a Wi-Fi, 4G or 5G antenna). Communications (e.g., internal communications) can use other communication protocols or media, such as an internal data bus.

[0115] In the device 110, the communication interface 150 can be used to send or receive digital data. For example, the device 110 can be configured to receive or send data representing one or more encoded and encrypted values ​​and / or LWE encryptions (e.g., representing inputs and / or outputs of cryptographic calculations). As another example, the communication interface 150 can be used to receive data representing a bootstrap key.

[0116] The execution of device 110 may be implemented in a processor system 130 (e.g., one or more processor circuits, such as a microprocessor), an embodiment of which is shown herein. Device 110 may include multiple processors, which may be distributed in different locations. For example, device 110 may use cloud computing.

[0117] The processor subsystem 130 may be configured to apply a cryptographic operation to the at least one carry-encoded and encrypted input value to obtain a carry-encoded and encrypted output value. The processor subsystem 130 may be further configured to apply a cryptographic carry reduction to the carry-encoded and encrypted output value to obtain a further encoding and encryption of the output value, wherein at least one carry-encoded subvalue is reduced to a carry-free subvalue.

[0118] The processor subsystem 130 may be configured to obtain one or more inputs to a cryptographic calculation, for example including one or more encoded and encrypted values, and / or including one or more encrypted but unencoded values, which the processor subsystem 130 may optionally convert into encoded and encrypted values ​​as described herein. The encoded and encrypted values ​​provided as inputs are typically encoded and encrypted without carry, although in principle it is possible to obtain inputs with carry. In addition to the inputs, the processor subsystem 130 may obtain bounds on the encrypted values, for example, as a degree of integrity or the like.

[0119] The processor subsystem 130 may be configured to output one or more outputs of the cryptographic computation, e.g., including one or more encoded and encrypted values, and / or including one or more encrypted but unencoded values ​​that the processor subsystem 130 has determined, e.g., by converting the encoded and encrypted values ​​into encrypted values ​​as described herein. When outputting the encoded and encrypted values, the processor subsystem 130 may be configured to apply an encryption carry reduction operation to output the encrypted and encoded values ​​without a carry.

[0120] For example, processor subsystem 130 may obtain input and / or output from / to memory 130 and / or from / to another party via communication interface 150 .

[0121] The functional units shown in some of the figures may be functional units of a processor system. For example, the figures may be used as blueprints of possible functional organizations of a processor system. In most of the figures, the processor circuits are not shown separately from the units. For example, FIG. Figure 6 The functional units shown in (see below) may be implemented in whole or in part in computer instructions stored at a device such as device 110, e.g., in electronic flash memory of device 110, and executable by a microprocessor of device 110. In a hybrid embodiment, the functional units are implemented partly in hardware (e.g., as a coprocessor, such as an arithmetic and / or cryptographic coprocessor) and partly in software stored and executed on device 110.

[0122] For example, device 110 may be a device for performing cryptographic computations. Cryptographic computations may employ homomorphic encryption cryptographic techniques. For example, device 110 may be used to perform cryptographic computations, e.g., even if the data is received in encrypted form (e.g., from a data provider) and even if device 110 is unable to decrypt the data, the device may perform the computation. The computation may involve cryptographic operations and / or carry reductions as described herein.

[0123] For example, memory 140 may store encrypted data items, such as data items received from one or more data providers, or data items generated as intermediate or final results (e.g., outputs) of computations. Typically, most or all of the data items for which device 110 performs computations are encrypted with a key (or keys) unknown to device 110—i.e., device 110 may not be configured to obtain plaintext data items corresponding to encrypted data items (e.g., stored in memory 140). The decryption key in plaintext form is secret to device 110, although the encryption / decryption key may be available in encrypted form.

[0124] For example, the processor system can be configured to perform a series of homomorphic encryption operations. The encryption operations can include linear operations, such as addition, subtraction, and / or scalar multiplication; multiplication; single variable function evaluation, etc. Interestingly, using the provided techniques, multiple encryption arithmetic operations can be performed on a set of encoded and encrypted values, for example, an arithmetic circuit having a multiplication depth of at least two, at least three, or at least five, wherein the execution does not include encryption carry reduction.

[0125] FIG1b schematically illustrates an embodiment of an implementation of a compiler device 119 for compiling a computation into a homomorphic executable file. The homomorphic executable file can be executed by a cryptographic computation engine and causes the cryptographic computation engine to perform a cryptographic computation on a combination of one or more encoded and encrypted values ​​as described herein, for example, through the device 110 of FIG1a. The homomorphic executable file can include one or more instructions to perform a cryptographic carry reduction operation as described herein, for example as part of a cryptographic operation or between executions of a cryptographic operation. The device 119 can perform the cryptographic computation itself, for example, the device 110 of FIG1a can be combined with the device 119 of FIG1b.

[0126] Device 110 may include processor system 139, memory 149, and communication interface 159. Processor system 139, memory 149, and communication interface 159 may be implemented as discussed with respect to the corresponding components of FIG. 1a. Memory 149 may be used to store a description of a homomorphic computation to be compiled into a homomorphic executable file, for example, stored as program code, an instruction graph, etc. Communication interface 159 may be used to receive the computation to be compiled. Communication interface 159 may be used to send a homomorphic executable file.

[0127] The processor subsystem 139 can be configured to generate a homomorphic executable file by converting the operation into a homomorphic computing instruction, as known in the art itself. Interestingly, the processor subsystem 139 can be configured to track the integrity of the subvalues ​​of the encoded and encrypted values ​​used in the encryption calculation. In this way, the encryption carry reduction operation can be included in the homomorphic executable file when needed. Specifically, the processor system 139 can be configured to determine the integrity of the limit indicating the carry subvalue for the carry subvalue to be calculated. If the limit exceeds the corresponding carry message modulus, the processor subsystem 139 can generate an instruction that causes the encryption calculation engine to apply the encryption carry reduction before calculating the carry subvalue. The processor subsystem 139 can be configured to optimize one or more parameters of the encryption calculation, such as the number and value of the message and the carry message modulus, so that the encryption calculation is compiled into an executable file.

[0128] Figure 1c schematically illustrates an example of an implementation of a cryptographic computing system 100. The system 100 is configured to perform cryptographic computations using homomorphic encryption (eg, fully homomorphic encryption).

[0129] The system 100 in this embodiment includes a compiler device 111, a data supplier device 113, and an encryption computing device 112. The compiler device 111 may be combined with the encryption computing device 112 or the data supplier device 113 in a single device. The device 112 may be configured to receive encrypted data items from the data supplier 113. At least one or more data items may be received in encrypted form. One or more other data items may be received in plain text. The device 112 may be configured to receive a homomorphic executable file for performing an encryption computation from the compiler device 111.

[0130] Device 112 may perform computations as described herein on received data items and possibly stored data items. Interestingly, computations may be performed by the device on encrypted data without decrypting the data, e.g., without converting the encrypted data items to data in plain text form.

[0131] The device 112 in this embodiment may be based on the device 110 of Figure 1a, for example, may include the processor system 130, memory 140 and / or communication interface 150 of Figure 1a. Each of the devices 111, 112, 113 may be based on the device 119 of Figure 1b, for example, may each include the processor system 139, memory 149 and / or communication interface 159 of Figure 1b.

[0132] Optionally, compiler device 111 or data provider device 113 may be further configured to generate key material for cryptographic computing device 112 to perform cryptographic computing, for example, including a bootstrap key for performing programmable bootstrapping as discussed herein. The device generating the key material may provide bootstrap key 151 to device 112, for example, by sending it via computer network 150, uploading it to a shared memory, etc. The key material may also be generated by a separate key generation device (not shown in this figure).

[0133] Although not shown in this figure, the cryptographic computing system 100 may include multiple cryptographic computing devices, such as two, three, or more than three. The cryptographic computing may be distributed among the multiple cryptographic computing devices. The cryptographic computing devices may exchange intermediate computing results (usually encrypted) between each other, such as encoded and encrypted values ​​including multiple encrypted subvalues. Each cryptographic multiplication device may be implemented like the cryptographic computing device 112, and may perform cryptographic operations and / or cryptographic carry reduction operations as described herein.

[0134] Homomorphic encryption schemes can be applied in many settings. For example, the encryption computing device 112 can be operated by a cloud provider. A cloud provider can provide computing and storage services to its customers. By using homomorphic encryption, a data provider device 113 (e.g., a client of a cloud provider) can send its data in encrypted form. The cloud provider can still perform the required computation and / or the required storage, but cannot know the corresponding plaintext data. For example, the data provider device 113 can encrypt the data item using an encryption key of a type corresponding to the specific homomorphic encryption system used. When the data provider 113 receives the computation result from the encryption computing device 112, the encrypted data item can be decrypted using the corresponding decryption key. The encryption key and the decryption key can be the same - and usually are.

[0135] For example, the cryptographic computing system 100 can be configured to train a machine learning model (e.g., an image classifier, such as a medical model) without the cryptographic computing device having access to the plaintext data items. For example, a linear regression can be performed on the input data, possibly without even bootstrapping. For example, back propagation can be performed on the input data, possibly with bootstrapping. The resulting model parameters can be returned to the entity that possesses the decryption key. This enables multiple providers of medical data to aggregate their data by sending the data to a cloud provider. The cloud provider then returns the model parameters without access to the plaintext data. The encryption key can be equal to the decryption key.

[0136] After the model is trained, the encrypted computing system 100 can be used to provide the model, for example, for use with medical data. This can be done using plaintext model parameters or encrypted model parameters - in both cases using encrypted data (e.g., encrypted input data, intermediate data, and output data). Using plaintext model parameters is generally more efficient. In both cases, one effect of the system is that calculations (e.g., image classification, such as medical image classification) are performed without the computer being aware of the plaintext data items. For example, a mammogram can be used to assess cancer without the image ever being presented in plaintext on the encrypted computing device 112, and without any encrypted computing device 112 or a consortium of such devices being aware of the results of the cancer assessment. From a privacy perspective, it may be acceptable to operate a plaintext model on encrypted privacy-sensitive data, while it may be unacceptable to operate on plaintext privacy-sensitive data.

[0137] Other applications involve database services, such as looking up encrypted data in an encrypted database; for example, the calculation may be a comparison between an input item and a database item. For example, multiple calculations can be combined to produce a database index that matches an index. For example, the database can be a genomic database, and the input can be a gene sequence. For example, the system 100 can be used for protective control of equipment. For example, a device (even a large device such as a power plant) can send a sensor value to an encrypted computing device 112 and receive an encrypted control signal in return. The control signal is calculated based on the sensor signal. An attacker of the system may be able to determine the content of data entering and exiting one or more encrypted computing devices 112, or even gain access to intermediate data of these devices, but since the data is encrypted, this will not help him. Since the decryption key is unknown to these devices, even if all encrypted computing devices 112 of the system 100 are completely cracked, the data will not be leaked. Calculating the control signal can involve mathematical operations such as linear algebra, averaging, matrix multiplication, polynomial evaluation, etc., all of which can be performed using homomorphic encryption operations. In any case, such applications will involve calculations involving arithmetic operations on relatively large numbers, which can be efficiently implemented as described herein.

[0138] For example, a pool of encrypted data items can be maintained in an encrypted computing system; a subset of them can be received, and another subset can be the result of the encrypted calculation, for example, an intermediate result. For example, the encrypted computing device 112 can be configured to apply a homomorphic encryption operation to one, two or more encrypted data items in the pool, such as a set of input values ​​and / or intermediate values ​​and / or output values. The result may be a new encrypted data item that can be stored in the pool. For example, one or more values ​​can be encoded and encrypted, while other zero or more values ​​can be directly encrypted without encoding. The pool can be stored in the memory of the encrypted computing system. This can be a local memory or a distributed memory. In the latter case, it may happen that one or more encrypted data items are represented multiple times in the pool. For example, if the value of the encrypted data item is needed elsewhere, the encrypted data item, in particular the encoded and encrypted data item, can be sent from one computing device to another computing device. The pool can be implemented in a variety of ways, for example, as a register file, an array, a variety of data structures, etc.

[0139] An encrypted data item may represent a variety of data. For example, an encrypted data item may represent a number that needs to be averaged, or a number used for linear regression, etc. For example, an encrypted data item may represent an image. For example, each pixel of an image may correspond to one or more encrypted data items. For example, a grayscale pixel may be represented by a grayscale level, which in turn may be represented by a single encrypted data item. For example, 256 grayscale levels may be encoded in a single encrypted data item. For example, a color pixel may be represented as multiple color levels, such as RGB levels, which in turn may be represented by a tuple of encrypted data items. For example, three 256 levels of color may be encoded as corresponding encoded values ​​or encoded and encrypted values.

[0140] A set of homomorphic encryption operations can be defined for the computation. For example, based on the homomorphic encryption operations, a computation network or circuit can be constructed that implements the computation together, for example, by a compiler device as described for FIG. 1b or by the computing device itself. For example, the operation can include a Boolean operation. The manner in which the homomorphic encryption operations are combined (e.g., which operation is applied to which operand in the pool) determines the computation being performed. For example, the computation can be represented as a list of homomorphic encryption operations to be performed and instructions on which encrypted data item to perform. The network or circuit can indicate to the encryption computing device 112 when to perform an encrypted carry reduction, and / or the encryption computing device 112 can determine whether to perform an encrypted carry reduction computation based on tracking the degree of integrity of the subvalue being computed.

[0141] FIG. 2 a and FIG. 2 b schematically show an embodiment of a programmable bootstrap lookup table.

[0142] In various embodiments, the cryptographic computation is a cryptographic computation in a TFHE setting. In this setting, the cryptographic scheme used (e.g., LWE cryptography) may support programmable bootstrap operations. As known per se, such programmable bootstrapping may evaluate LWE decryptions in exponents of GLWE encrypted monomials. As known per se, programmable bootstrapping may be used to evaluate various functions on the LWE cryptography to which it is applied, by using corresponding test polynomials in the programmable bootstrapping operations. As also described elsewhere, programmable bootstrapping may be used to perform cryptographic carry reductions, as well as various other operations, such as single variable function evaluation.

[0143] An embodiment of a programmable bootstrap operation is now discussed. The bootstrap can evaluate a univariate function and simultaneously reduce the noise of the input ciphertext. Throughout this specification, the symbol PBS is used to indicate programmable bootstrapping. The function evaluated on the input can be represented as a lookup table (LUT). The lookup table can correspond to a test polynomial that can be multiplied with the GLWE encrypted monomial. By calculating the GLWE encrypted monomial and multiplying it by the test polynomial, the lookup table can be effectively rotated to output the correct element in the table.

[0144] A visual representation of a polynomial stored in a LUT is shown in Figure 2a. In this embodiment, an array is shown, with respective elements 201-204 representing the polynomial The function may be the identity function, in which case programmable bootstrapping can implement conventional bootstrapping.

[0145] In various cases, a redundant lookup table may be used. Specifically, for a given value r, an r-redundant LUT may be used, where the coefficients are repeated r times in succession. This is illustrated in FIG2 b. In this embodiment, the LUT for function f is represented as an array comprising 16 repetitions of corresponding blocks 210, 211, 212 for each output value. A PBS with redundancy may be used to reduce noise in the input ciphertext.

[0146] The PBS may use a bootstrap key. The bootstrap key may include a GGSW encryption of corresponding elements of a secret key used to encrypt the input LWE ciphertext of the PBS. The bootstrap may include a modulus switching operation, where The input LWE ciphertext in is converted to a scaled ciphertext, such as from The public bootstrap key may be used to apply blind rotation to effectively rotate the GLWE encryption of the redundant LUT based on the LWE ciphertext generated by the modulus switching. A sample extraction operation may be applied to extract the fixed coefficients (e.g., constant coefficients) of the GLWE encryption as the LWE ciphertext.

[0147] Throughout this specification, the following notation may be used to indicate the execution of programmable bootstrap operations:

[0148] ct out ←PBS(ct in ,BSK,P f ),

[0149] in

[0150] Using techniques known per se, for example from “Programmable bootstrapping enables efficient homomorphic inference of deep neural networks”, PBS can be performed with the following computational complexity:

[0151]

[0152] in

[0153]

[0154] Various existing implementations of programmable bootstrapping, such as this one, can operate on input ciphertexts whose most significant bit is zero.

[0155] As an example, NTRU type encryption may be used on the input ciphertext and / or on the encrypted polynomial product. More generally, the provided technique may be applied to generate test polynomials and to generate ciphertexts according to different X values. N Any blind rotation of the product of the encryption polynomials modulo the bootstrap polynomial with the quotient polynomial of +1, such as any accumulator-based blind rotation.

[0156] Specifically, with respect to the use of NTRU for encrypted polynomial products, note that the "blind rotation" algorithm discussed itself uses an abstract accumulator ACC. While this accumulator can be implemented based on GLWE as discussed, this is not required. Other types of accumulators are possible, such as NTRU-based accumulators. Based on the NTRU ciphertext, a gadget encryption similar to the GGSW encryption can be defined, and using it the outer product can be defined. Detailed embodiments can be found in C. Bonte et al., "FINAL: FasterFHE instantiated with NTRU and LWE", https: / / ia.cr / 2022 / 074 Thus, the accumulator can be implemented based on NTRU, where its value can contain, for example, Elements in and CMux can be defined.

[0157] As an example, applying blind rotations to an LWE ciphertext c encrypted using this type of NTRU-based accumulator can produce a scaled plaintext for some −m′·Δ in The bootstrap monomial and the test polynomial P f The encrypted polynomial product of In this case, the encryption polynomial can be of the form Using the appropriate key switching key, the encryption polynomial can optionally be extracted from the encryption polynomial The LWE ciphertext is encrypted with a constant term of , as discussed in the “FINAL” reference.

[0158] Alternatively or in addition to the encryption polynomial, the input ciphertext need not be an LWE type ciphertext. Specifically, blind rotations can be applied to NTRU type ciphertexts, as discussed in the "FINAL" reference. The input LWE ciphertext can also be obtained by converting the input LWE ciphertext from an NTRU ciphertext, as described in the "FINAL" reference.

[0159] Also in this case, it is desirable to define the test polynomial P f So that the encrypted polynomial product contains the expected output value of the fixed coefficient.

[0160] Interestingly, it is also possible to combine the techniques presented in this specification with programmable bootstrapping without padding, which means that programmable bootstrapping can operate on input ciphertexts with arbitrary most significant bits. Such programmable bootstrapping is provided, for example, in I. Chillotti et al., “Improved programmable bootstrapping with larger precision and efficient arithmetic circuits for TFHE”, proceedings ASIACRYPT 2021. In such cases, when using Encode as described elsewhere in this document, one can use Rather than

[0161] Yet another way to perform programmable bootstrapping is by extracting the corresponding bits of the ciphertext and converting them into GGSW ciphertext, for example using a circuit bootstrapping known per se; and applying a lookup table to the corresponding GGSW ciphertext. As known per se, the latter can be performed particularly efficiently using mixed padding (e.g. horizontal and / or vertical padding). Furthermore, with this technique for performing programmable bootstrapping, no padding bits may be required, for example the most significant bit may hold an arbitrary value. This technique will be useful with respect to Figure 4 Discuss in more detail.

[0162] Typically, programmable bootstrapping may include a key switching operation that is performed so that the output ciphertext is encrypted with the same key as the input ciphertext. Throughout this specification, the symbol PBS-KS may be used to indicate such programmable bootstrapping including a key switching. In this case, the key material PUB for programmable bootstrapping may include a key switching key for performing this key switching. Typically, performing a key switching is optional. The complexity of PBS-KS is in Indicates the complexity of key switching.

[0163] FIG. 3 a schematically shows an embodiment of a carry-in sub-value.

[0164] In various embodiments, a value may be encoded and encrypted as an encryption of a plurality of corresponding subvalues, e.g., corresponding numbers corresponding to a radix decomposition of the value. Based on this correspondence, the corresponding subvalues ​​may be associated with a certain modulus called a message modulus. For example, when a radix-β radix decomposition is used, the message modulus may be set to β. Thus, a value may be encoded and encrypted by encoding the value as subvalues ​​modulo the message modulus and encrypting the subvalues.

[0165] Interestingly, however, in various embodiments described herein, subvalues ​​may be stored with carry. This means that the subvalue is defined modulo a message modulus p that is larger than the message modulus with carry. Therefore, the subvalue may be larger than the message modulus.

[0166] The corresponding sub-values ​​can each be encrypted according to the same encryption key, but this is not required. In the latter case, various operations on the encoded and encrypted values ​​(such as carry propagation described herein) can use key switching as needed, such as switching from the encryption key of one sub-value to the encryption key of another sub-value.

[0167] For example, as illustrated in FIG. 3a , the ciphertext may encrypt a value characterized by:

[0168] - optional padding bits 301 which are set to zero as their most significant bits;

[0169] - carry the message modulus p, 302, and the message modulus β, 303, e.g., a radix factorization radix, such that β ≤ p (note that p and β need not be powers of 2);

[0170] - a value x, for example, a non-carry value x less than β or a carry value x greater than or equal to β and less than p.

[0171] For example, the carry message modulus p can be at least four times the message modulus β, at least eight times the message modulus, or at least 32 times the message modulus. For example, the carry message modulus can be at most 128, at most 256, or at most 512. Considering a message of a certain size (e.g., at most 8 bits or at most 16 bits), the remaining space of the carry message modulus can be used for the carry.

[0172] For example, the figure shows a message with modulus β = 4 = 2 2 Sum carry message modulus p = 16 = 2 2+2 An encryption using this message modulus and carry message modulus can have 2 carries which are set to 0 for non-carry values ​​and can be advantageously used for encryption operations.

[0173] For example, the non-carry value m can be scaled according to the following algorithm and then the scaled version can be used in encryption For example Perform LWE encryption on a non-carry value m. This example algorithm takes an integer between 0 and p, providing a padding bit and more space to compute the graded operation.

[0174]

[0175] The encryption operation may cause the encrypted value to increase, in particular, to become greater than the message modulus. Specifically, the most significant portion (e.g., the most significant bit) of the encrypted value corresponding to dividing the encrypted value by the message modulus may represent a carry and may be referred to herein as a "carry buffer."

[0176] Two such embodiments are illustrated with respect to FIG. 3 b and FIG. 3 c. FIG. 3 b illustrates an encrypted addition of two values ​​311, 312 that are encrypted without a carry (e.g., the carry buffer and padding bits are set to zero). As illustrated in the figure, the value encrypted by the generated ciphertext 313 may exceed the message modulus, i.e., the value may be a subvalue with a carry. In this special case, as shown in the figure, a carry bit 314 may be consumed due to the addition.

[0177] Figure 3c illustrates another embodiment. The figure illustrates the encryption of a non-carry value 321 and the scalar multiplication of a scalar (ie, non-encrypted value) μ < β, thereby producing an encrypted value 322. In this case, the number of carry bits 323 that may be affected is proportional to the size of the constant.

[0178] Returning to FIG. 3a. As illustrated in FIG. 3b and FIG. 3c, various encryption operations may result in carry-encoded and encrypted values; that is, values ​​having carry-encoded subvalues ​​that are greater than or equal to the corresponding message modulus. Or at least, for some subvalues, it may not be guaranteed that they do not contain a carry. While it is possible to perform an encryption carry reduction operation directly on such a carry-encoded value to reduce its value to below the message modulus, the inventors realize that this is not always necessary. In some cases, the carry-encoded and encrypted subvalue may be retained and used as input to another encryption operation.

[0179] However, at some point in time, a cryptographic carry reduction may be required, for example, if the cryptographic operation or sub-operation to be applied may potentially result in a value that exceeds the corresponding carry message modulus. Therefore, it can be determined whether to perform a cryptographic carry reduction on a carry-in value at some point during the cryptographic calculation.

[0180] Interestingly, to determine whether to perform encrypted carry reduction, the inventors envisioned tracking the degree of integrity of the carry-in bit values computed as part of the encryption operation. The degree of integrity can indicate the bounds of the carry-in bit values. The degree of integrity can be regarded as metadata associated with the ciphertext. The degree of integrity can indicate whether an encrypted (e.g., graded) homomorphic operation can be applied to the ciphertext, or whether its carry needs to be cleared first. When graded operations can still be computed, the degree of integrity can quantify the number of graded operations that can still be performed.

[0181] The degree of integrity is typically computed dynamically during the execution of the encryption calculation, although it can also be computed by a compiler device, as discussed elsewhere. Tracking the degree of integrity during the calculation can here be referred to as an "intelligent" variant of performing the encryption calculation using encrypted carry reduction. The intelligent encryption calculation can verify certain conditions to automatically decide whether the carry buffer must be cleared or whether another graded operation can still be performed. In that sense, the intelligent encryption calculation can be seen as an improvement over a kind of gate bootstrapping in which sub-values do not need to be binary and carry can be retained between encryption operations to perform more graded operations between bootstraps. Interestingly, it may not be necessary to determine when to perform encrypted carry reduction during the design time of the encryption calculation, since the intelligent encryption calculation can automatically determine whether to perform encrypted carry reduction.

[0182] Specifically, the ciphertext can be used to encrypt sub-values within a specific interval defined by the degree of integrity. The encrypted sub-values can be used as inputs to graded homomorphic operations, which can result in different, usually larger intervals. Specifically, the most significant part of the sub-value can be filled with carry. This part of the encrypted sub-value can be referred to as the carry buffer.

[0183] Specifically, an encrypted value m (e.g., a sub-value of an encoded and encrypted value) encrypted according to a key s can be represented together with its associated degree of integrity as a so-called Arith ciphertext defined as follows

[0184]

[0185] where

[0186] Specifically, the degree of integrity can be defined as follows. Let be the carry message modulus, and let be the message modulus (which may or may not be a power of 2), e.g., a radix decomposition base, such that β ≤ p. Let ct be the ciphertext encrypting a value m < p. Let μ be the known worst case for m, e.g., m can be the largest integer such that 0 ≤ m ≤ μ. (where ) can be defined as the following values:

[0187]

[0188] Using this definition, if the degree of a ciphertext ct reaches 1, it means that this ciphertext is probably encrypting the value p-1, which is the largest integer that can be stored by such a ciphertext without consuming padding bits (or without overlapping, if padding bits are not used). Therefore, when deg≈1, a carry reduction can be performed. In other words, for a carry-in subvalue to be calculated, the degree of integrity it produces can be determined, and if it is greater than 1, a cryptographic carry reduction can be performed before calculating the carry-in subvalue.

[0189] Although the above is used throughout this specification as an illustrative definition of integrity level, other definitions are possible. For example, the integrity level may be defined by the overall size of the interval of possible values ​​for the value, or by the minimum and maximum possible values ​​of the encryption, etc. In any case, the integrity level may indicate the bounds of the sub-value with carry, and if it is determined that its bounds exceed the corresponding carry message modulus of the sub-value with carry to be calculated, then a cryptographic carry reduction may be applied before calculating the sub-value with carry.

[0190] Specifically, the degree of integrity of an encrypted value may be finer than indicating whether the value contains a carry, or may be finer than calculating the overall number of carry bits the value has. Thus, a tighter worst-case estimate of the level of consumption of carry bits may be obtained, allowing an increase in the number of staged arithmetic operations before performing carry extraction.

[0191] It is now illustrated how the degree of integrity can be calculated for various homomorphic arithmetic operations on encrypted values, in particular for addition, subtraction, and scalar multiplication. In general, the degree of integrity can be determined by determining bounds on the output of the operation based on bounds on the corresponding input. Such bounds can generally depend on how the operation is implemented, and in many cases can be derived from the implementation.

[0192] It is further shown how permission checks can be defined for homomorphic operations to determine whether the operation can be performed without exceeding the carry message modulus.As discussed elsewhere in this specification, operations on encoded and encrypted values ​​can be implemented in terms of such operations on encrypted values.

[0193] In the following discussion, two Arith ciphertexts and A product is called "compatible" if:

[0194]

[0195] Specifically, the integrity degree of encrypted addition can be calculated. The following is for two ciphertexts with integrity degrees of deg1 and deg2 respectively. and The output is the new ciphertext encrypted by the addition of the two original messages with the updated integrity level

[0196]

[0197] If the input is compatible and This algorithm can be applied. The computational complexity of the addition algorithm is Can be

[0198] As another example, the integrity level of the encryption negation can be determined. Specifically, the following ciphertext of the encrypted message m is The output is the new ciphertext The completeness of its use update deg out Encrypt the negation of the original message. Define ζ as:

[0199]

[0200] This value is useful for the Neg algorithm. So that 0≤m≤μ. Then, there is no symbol:

[0201]

[0202] Therefore, z can represent the smallest multiple of β such that μ ≤ z. This value can represent the worst case of negation.

[0203]

[0204] if This algorithm can be applied. Computational complexity Can be

[0205] Another example is the calculation of the integrity level of encrypted subtraction. The following example shows two LWE ciphertexts: and The output is the new ciphertext It encrypts the subtraction of the two original messages with the updated integrity level.

[0206]

[0207]

[0208] If the input is compatible, and Then the algorithm can be applied. The computational complexity of subtraction is Can be

[0209] Another embodiment is encrypted scalar multiplication, in other words, multiplication by a value known to the party performing the encrypted multiplication. The following example ciphertext Homomorphic scalar multiplication between and a known integer μ. The output is the new ciphertext It encrypts the product of the original message and μ.

[0210]

[0211] if This algorithm can be applied. The computational complexity of the scalar multiplication algorithm is Can be

[0212] An alternative way to perform the multiplication is by using a programmable bootstrap. A programmable bootstrap typically resets the integrity level to a value that does not hold a carry.

[0213] Figure 3d schematically illustrates an example of an implementation of an encrypted multiplication operation of an encryption of a first encrypted value and a second encrypted value. For example, the value may be a subvalue of the corresponding encrypted and encoded value whose product is being calculated. It also illustrates how the integrity level is calculated.

[0214] This technique of computing the encrypted multiplication of two ciphertexts can have independent significance, for example, and can also be used for encrypted calculations that do not involve values ​​that are encoded and encrypted with a carry, or can even be used for encrypted calculations that do not involve encoded and encrypted values ​​at all. Thus, such encrypted calculations can include accessing a set of encrypted values ​​and performing encrypted calculations, including computing one or more encrypted multiplications, as discussed with respect to the figure.

[0215] The encrypted multiplication operation may be used to calculate the most significant part of the product of two encrypted values ​​331, 332, for example, the product of two values ​​defined modulo β or the least significant part, for example, the product of two values ​​defined modulo β, x·ymodβ.

[0216] The cryptographic multiplication operation may be performed by first determining a combined encryption 333 that includes both the first subvalue and the second subvalue; and then applying programmable bootstrapping 334 to the combined encryption 333 to obtain a result 335. Specifically, to obtain the combined encryption 333, the first encrypted value 331 may be scaled, or in other words, the first encrypted value 331 may be shifted; and the shifted ciphertext 336 may be added to the unscaled second encrypted value 332.

[0217] Specifically, the least significant part of the product can be calculated:

[0218]

[0219]

[0220] This technique can be applied to compatible ciphertexts where Computational complexity of LSB multiplication algorithm Can be

[0221] A similar algorithm can be used to calculate the MSB instead of the LSB. A different lookup table is used for the final programmable bootstrap:

[0222]

[0223]

[0224] As mentioned above, the computational complexity of this algorithm can be

[0225] More generally, a multivariable function evaluation may be performed on one or more input ciphertexts (e.g., encrypted subvalues) by determining a combined encryption representing corresponding encrypted input values; and applying a univariate function to the combined encryption, e.g., via a programmable bootstrap. MulLSB and MulLSB are examples of this, but this technique is also applicable to other multivariable (e.g., bivariable) functions. Interestingly, in this way, a multivariable function may be efficiently evaluated using a single programmable bootstrap.

[0226] Specifically, consider a two-variable function, such as a lookup table l(m1,m2). In this case, the two messages m1,m2 can be combined by, for example, shifting one of the two ciphertexts. Thus, the message can be effectively moved to a higher position in the MSB. The shifted ciphertext can be added to the other ciphertext. For example, the ciphertext ct2 can be multiplied by (μ1+1) and then added to ct1. In this way, even in the worst case scenario, no information is mixed. This can be possible if both the ciphertext and the result of the combination (e.g., multiplication and addition by a constant) meet the conditions of degree and noise. Once the two messages are combined into a single ciphertext, the two-element function l can be evaluated as a single-variable LUTl′ in the connection.

[0227] The same technique can be applied to multivariable functions with more than two inputs if the degree of the ciphertexts involved in the calculation and their error allow the execution of the steps leading to the connection. In the same way as the output degree of a univariate function is calculated, the output degree can also be calculated when the function is multivariable.

[0228] Return to Figure 3a.

[0229] An alternative to the encrypted multiplication of Figure 3d is now discussed, which is less efficient but may be preferred in some cases because it requires less precision. For this alternative, it is also illustrated how the degree of integrity may be determined.

[0230] In this embodiment, two ciphertexts are determined and The output is the new ciphertext It encrypts the LSB part of the product of the two original messages and their updated integrity levels. Interestingly, the two input messages only need to contain enough space to compute the LWE addition / subtraction. This implementation relies on the relationship

[0231]

[0232] Thus, multiplication can be done in terms of LWE addition, LWE subtraction, and evaluation of appropriate univariate functions using programmable bootstrapping (in this case, the function ), further LWE subtraction, and an optional programmable bootstrap procedure for carry reduction of the result to perform:

[0233]

[0234] The above process can be applied to compatible inputs where the arguments to Arith::Sub are suitable for the algorithm, and The computational complexity of this version of the LSB multiplication algorithm is Can be

[0235] Another example of an operation that can determine the degree of integrity is to extract the carry of a ciphertext. This operation can be used to implement cryptographic carry reduction, as also discussed elsewhere. Specifically, the following algorithm takes as input an Arith ciphertext with a certain degree of integrity, and performs PBS to extract the portion of the message that overflows the base β into another Arith ciphertext.

[0236]

[0237] if This process can be applied. The computational complexity can be

[0238]

[0239] Another operation whose integrity level can be determined is the extraction of a message modulo the message modulus. Specifically, the following algorithm takes as input an Arith ciphertext with a certain integrity level, and performs PBS to extract the portion of the message that does not overflow β into another Arith ciphertext.

[0240]

[0241]

[0242] if The above process can be applied. The computational complexity can be

[0243] It is possible to define basis change operations. In some cases, it may be necessary to change the To this end, an algorithm can be defined that converts and basis (p out ,β out ) as input and returns the ciphertext of m encrypted in the new basis This algorithm can be implemented via programmable bootstrapping and can be indicated as:

[0244]

[0245] if Then this algorithm can be used and can have a computational complexity of

[0246] In a further operation, the encrypted value can be multiplied by a scalar (i.e., a value known to the party performing the encryption calculation), while changing the basis (β,p) of the ciphertext. This operation can be implemented as follows:

[0247]

[0248] If then this algorithm can be used and can have a computational complexity

[0249] Generally speaking, for a carry value to be calculated during encrypted computation, such as a carry sub-value of an encoded and encrypted value, a degree of integrity can be determined, and if the degree of integrity so indicates, an encrypted carry reduction can be applied to the input used to calculate the carry value.

[0250] To this end, it can be verified whether the carry buffer will overflow when calculating the carry value, and if so, the carry can be reduced by clearing (e.g., for CRT representation) or transferring (e.g., for radix representation), as the case may be. For the encoded and encrypted values to be calculated, carry reduction can be applied to zero sub-values, one or more sub-values, or all sub-values, as the case may be. In the case of an operation with multiple input values (e.g., addition), carry reduction can generally be applied to zero input values, one or more input values, or all input values. The encrypted operation thus obtained can be referred to as the "intelligent version" of the encrypted operation, which corresponds to the original operation but verifies whether the carry buffer may overflow for the corresponding sub-operations and performs carry reduction in such cases.

[0251] Figure 4 An embodiment of an encoded and encrypted value based on radix decomposition (also known as RadModInt representation) is schematically shown.

[0252] Specifically, a value can be encoded as a group of multiple corresponding sub-values m according to the relationship i Here, the vector is called the basis of the radix decomposition. As in traditional radix decomposition, the basis elements can all be equal to the same value b, where the radix decomposition can also be called a radix-b radix decomposition. However, it is also possible that not all basis elements are the same. This is also called a mixed radix representation. This increases the flexibility of the representable moduli. In any case, the encoded value can be defined as the value taken modulo the total modulus of the radix decomposition (or the smaller modulus discussed with respect to Figure 6 ).

[0253] Specifically, a value 0 ≤ m < M can be encoded and encrypted by encoding the value 0 ≤ m < M and encrypting the resulting encoded sub-values according to the following steps:

[0254]

[0255]

[0256] It is worth noting that this encoding can be combined with programmable bootstrapping using padding bits or PBS without padding, as required.

[0257] By using base decomposition, encryption calculations can be performed on values ​​defined by taking the modulus of the total modulus M, where M is the product of the base elements. The base elements can be, for example, up to 32, or up to 64, or up to 128. The base elements do not need to be a power of 2. One or more or all of the base elements can be at least 3, at least 5, or at least 10. For example, a base with a size κ of at least 2, at least 4, or at least 8 can be used. Using such base elements allows the calculation of subvalues ​​to be realized relatively efficiently. The overall modulus can be, for example, at least 256, at least 512, or at least 1024. Therefore, calculations can be performed on values ​​that cannot be efficiently realized if they are not decomposed into subvalues.

[0258] Using cardinality factorization, the modular integer can be realized as i (where 0≤i<κ) modulo κ encrypted blocks. For a block, we can define It includes the message modulus and the carry message modulus. can be called a basis related to the modular integer. Calculation modulo integers.

[0259] Figure 4 This is illustrated by way of example. In this example, three corresponding blocks 401-403 are used, i.e. κ=3. For all 0≤i<κ, β i =4 and p i =16; and M = 4 3 In this figure, a new RadModInt is shown whose subvalues ​​do not contain a carry. Specifically, it can be seen that the plaintext of block 401 involves padding bits 404; carry message modulus 405; and message modulus 406.

[0260] Interestingly, when using radix factorization, various parameters of the encryption calculation can be varied, including but not limited to the modulus M and the basis Therefore, the overall computational cost can be reduced by optimizing these parameters for a specific use case (e.g., automatically optimizing these parameters through a compiler facility).

[0261] We will now discuss in detail several examples of cryptographic operations that can be performed on values ​​that are encoded and encrypted using radix factorization. We will first introduce some notation. For example, m=m0+ (in ) decomposed into integers Encrypted ciphertext According to the key s, it can be indicated as:

[0262]

[0263] under, Encoded and encrypted ciphertext The encrypted subvalue can be indicated as And similarly for the base element (where i≤j) is Abbreviation, and for are similar. The size of the

[0264] As also noted elsewhere, the corresponding encrypted subvalue Encryption may be performed according to different encryption keys, with key switching being used to switch between encryption keys as needed.

[0265] also, The compatibility of ciphertext can be defined as follows. are two RadModInt ciphertexts. If Two RadModInt ciphertexts and can be defined as compatible, and

[0266]

[0267] make As the basis, and The following functions will be used in the following examples. for The recursive definition is:

[0268]

[0269] and As

[0270]

[0271] and As

[0272]

[0273] The following example illustrates an operation where the ciphertext is decomposed into of In other words, wherein the value is encoded using radix decomposition and the encryption is determined based on the encryption of the value. Determining the encoding and the encryption may include using PBS to The corresponding members of the ciphertext are used to continuously calculate the Euclidean division of the input ciphertext, where the remainder is the non-carry subvalue stored as the Arith ciphertext. The remainder can be calculated based on the corresponding carry message modulus p i Shift so that the modulus with the carry message The collection remains consistent.

[0274]

[0275] If μ≤p-1, then this algorithm can be used and has the computational complexity

[0276] The following illustrates an operation that uses radix decomposition to increase the number of subvalues ​​used to encode and encrypt a value. To do this, zero encryption can be used to extend the encoding and encryption. Interestingly, this operation is very efficient for encoding based on radix decomposition. This operation can be indicated as RadModIntCT::Padding and can be used The size from Change to To this end, you can use For example, a simple encryption of zeros completes the ciphertext. This is useful in conjunction with the Decompose algorithm, for example, because its output ciphertext may not have length k. This operation can be expressed as:

[0277]

[0278] if The elements of the basis are equal to the index α, so κ out ≥κ+α This operation can be used for elements of . Formally, let and Then for [α∈0,κ out -κ], for all i∈[0,κ-1], β i =β out,α+i And p i =p out,α+i .

[0279] The following example uses cardinality decomposition and Performs an addition operation between two encoded and encrypted values. The addition can be performed by adding the corresponding subvalues. Interestingly, this operation can thus be parallelized. Specifically, Arith::Add can be performed on each i and Call between.

[0280]

[0281] If the input is compatible and This operation can be used. The computational complexity can be

[0282] The following example uses cardinality decomposition and Subtraction of two values ​​that are encoded and encrypted. Similar to addition, this operation can be implemented as a subtraction of corresponding subvalues ​​and can therefore be parallelized. Specifically, this operation can be performed by performing a and This is accomplished by calculating Arith::Sub.

[0283]

[0284]

[0285] If the inputs are compatible with each other and

[0286] This operation can be used. The operation complexity can be

[0287] The following illustrates an encrypted carry reduction operation that can be used to reduce a subvalue with a carry of an encoded and encrypted value to a subvalue without a carry. To do this, the subvalue with a carry can be decomposed into the encryption of the corresponding subvalue of the subvalue. The resulting encryption can then be added to the encryption of the corresponding subvalue of the output value. In this way, the carry of the subvalue can be propagated to subvalues ​​of higher exponents. Specifically, let For example, we can apply the carry reduction to the encrypted subvalue at the index α∈[0,κ-1]

[0288]

[0289]

[0290] if Or just the algorithm In terms of the internal state, if Then this operation can be applied. The computational complexity can be

[0291] The following illustrates an encrypted carry reduction operation, by which an encoded and encrypted value with a carry can be converted to an encoded and encrypted value without a carry. To this end, the encrypted carry reduction can be applied to the corresponding sub-values ​​starting from the least significant sub-value. In this way, the corresponding carry can be propagated. If a sub-value does not hold a carry even after the previous carry reduction, its carry reduction can be skipped. Specifically, let Become a ciphertext. The following algorithms can be used:

[0292]

[0293] if parameter If ClearCarry is allowed, this operation can be used. The computational complexity can be

[0294] An example of an encryption operation is shown below in which radix factorization encoding is used and the encrypted value is multiplied by a scalar, such as a known integer λ. In this example, this is done by multiplying the corresponding subvalues ​​by the scalar (possibly in parallel). This algorithm works for relatively small λ.

[0295]

[0296] if Then this operation can be applied. The computational complexity can be

[0297] An example of an encryption operation is shown below, in which an encrypted but unencoded value (e.g., a subvalue of an encoded and encrypted value) is multiplied by a scalar λ. Interestingly, this operation can be used for relatively large scalars. The operation can result in the encoding and encryption of the product. The corresponding subvalues ​​of the encoded and encrypted product can be calculated by corresponding programmable bootstrap operations corresponding to the corresponding subvalues ​​of the scalar. Specifically, the integers in the scalar λ are Ciphertext Scalar multiplication between can produce a basis of Ciphertext. This can be achieved as follows.

[0298]

[0299]

[0300] If μ≤p-1, this operation can be used. The computational complexity can be

[0301] The following illustrates an encryption operation in which a radix factorization is used to encode and encrypt values ​​and multiply them by a scalar λ. This operation can be implemented by performing scalar multiplications of the corresponding subvalues ​​and the scalar λ to obtain the corresponding encoded and encrypted products, and combining the resulting encoded and encrypted products. Interestingly, this operation can also be used for relatively large scalars. Specifically, let and This operation can be implemented as follows:

[0302]

[0303]

[0304] This operation can be used if the subroutines RadModIntCT::ScalarMulDecomp and RadModIntCT::Add can be applied to their corresponding inputs.

[0305] The computational complexity can be

[0306]

[0307] The following illustrates encrypted multiplication between corresponding values ​​that are encrypted but not encoded, e.g., between subvalues ​​of one or two different encoded and encrypted values. The encrypted multiplication may produce an encoded and encrypted value. The input values ​​may be combined into a single encrypted value by scaling and adding, and corresponding subvalues ​​of the encoded and encrypted value may be determined by applying corresponding programmable bootstrapping. Specifically, two compatible Ciphertext and The result can be decomposed into of Ciphertext, making

[0308]

[0309]

[0310] If Arith::ScalarMul can be applied to You can use this operation.

[0311] The computational complexity can be

[0312]

[0313] The following illustrates an encrypted multiplication between an encrypted but unencoded value and an encoded and encrypted value. This operation can be implemented by multiplying the corresponding subvalues ​​of the encoded and encrypted value by the encrypted but unencoded value to obtain the corresponding encoded and encrypted products; and combining the encoded and encrypted products.

[0314] Words, commands and Then the homomorphic multiplication of m1 and m2 can be implemented as follows:

[0315]

[0316]

[0317] if This operation can be used if RadModIntCT::MulDecomp and RadModIntCT::Add can be applied to their respective arguments. The computational complexity can be

[0318]

[0319] The following illustrates an encrypted multiplication of a first encoded and encrypted value and a second encoded and encrypted value. This multiplication can be achieved by multiplying the first encoded and encrypted value and corresponding subvalues ​​of the second encoded and encrypted value, the multiplications producing encoded and encrypted results; and combining (e.g., adding) the encoded and encrypted results. Specifically, for example, with respect to the operation OneBlockMul discussed above, the encrypted multiplication can be achieved by multiplying the corresponding subvalues ​​of the first encoded and encrypted value by the second encrypted value. Specifically, given two ciphertexts and Block pairs can be calculated (in ). It is worth noting that the encoded and encrypted input and Do not need to be compatible.

[0320] In this example, the result of the multiplication is The cardinality of .

[0321]

[0322] if This operation can be used if the parameters RadModIntCT::OneBlockMul and RadModIntCT::Add can be applied to their corresponding parameters.

[0323] The computational complexity can be

[0324]

[0325] It is also possible to perform encrypted evaluation of a univariate function on the encoded and encrypted value using radix decomposition. For example, the univariate function being evaluated can be an inverse function or a division function. This operation can be implemented in a variety of ways.

[0326] One way to evaluate univariate functions is to apply a tree-programmable bootstrap. Using tree-programmable bootstrap to evaluate large lookup tables over multiple ciphertexts encoding one input to the lookup table can itself be derived from A. et al., "Revisiting the functional bootstrap in TFHE", IACR Trans. Cryptogr. Hardw. Embed. Syst., 2021(2): 229-253, 2021 (incorporated herein by reference). This reference uses plaintext integers that are all encrypted based on the same base β. Interestingly, the inventors realized that these techniques can also be applied to the current setting, especially when the base elements of the base decomposition are not all the same. In this way, multi-radix tree programmable bootstrapping can be obtained.

[0327] Specifically, Is has This lookup table can be applied to objects with a multi-basis representation. The encrypted and encoded value of x Using multi-radix tree PBS, single variable function evaluation can be The ciphertext and a large lookup table P are taken as input and returned Ciphertext, and can be indicated as:

[0328]

[0329] Multi-base tree programmable bootstrapping can be iteratively implemented by selecting the largest remaining base element in an iteration, splitting the remaining lookup table according to the largest remaining base element, applying programmable bootstrapping to the corresponding lookup table components using the sub-value corresponding to the largest remaining base element as a selector, and combining the results into an updated lookup table.

[0330] Specifically, let B = {β i |i∈0,κ-1} and let θ(β) be the component of x that is related to β. In the iteration, define β max =max(β∈B). Split P into Smaller lookup tables, each containing the β of P max Different elements. Use the max) is used as a selector to calculate PBS for each of the v lookup tables. The new large lookup table P consists of the v iteration results of PBS. From B: B = B-β max Delete beta max This iterative process can be repeated until B is empty. In the first iteration, the plaintext lookup table P can be split; in the following iterations, the split can be performed using key switching.

[0331] Regarding computational complexity, in the worst case, for all i∈[0,k-1], β i =β max Therefore, in terms of PBS, the worst-case complexity can be

[0332]

[0333] A particularly efficient technique for performing function evaluation on encoded and encrypted values ​​is now discussed. This technique operates by extracting the bits required to evaluate the function from the corresponding encrypted subvalue; converting the extracted bits to GGSW ciphertext; and applying a lookup table to the corresponding GGSW ciphertext. This technique is applicable to single-variable function evaluation, but is also applicable to multi-variable function evaluation.

[0334] The inventors have realised that this approach has several advantages over directly using blind rotation-based programmable bootstrapping in the present setting (although it will be appreciated that this approach may also indirectly use blind rotation-based programmable bootstrapping, e.g. for conversion to GGSW).

[0335] By operating bitwise at the level of individual subvalues, the use of blind rotations with polynomials that scale exponentially with the size of the message modulus and / or the carry message modulus is avoided. Thus, the proposed univariate function evaluation can operate on subvalues ​​with larger message moduli and / or carry message moduli, for example, the size of the message modulus and / or carry message modulus of the subvalues ​​can be at least 10 bits, at least 13 bits, at least 15 bits, or at least 16 bits. By using larger moduli for subvalues, the efficiency of computation of encoded and encrypted values ​​can be greatly improved. Specifically, fewer carry reductions may be required because the encrypted subvalues ​​may have more room for carries and / or fewer encrypted subvalues ​​may be required to represent a given value.

[0336] Furthermore, at the level of the overall encoded and encrypted value, the proposed univariate function evaluation also provides much improved scaling of the encrypted value size, since the lookup table can be applied to the corresponding GGSW ciphertext more efficiently than using Tree-PBS, e.g., using hybrid padding. Specifically, while Tree-PBS can scale exponentially in the number of subvalues, applying the lookup table to the GGSW ciphertext of bits can be performed more efficiently, e.g., even linearly, in the number of subvalues.

[0337] Another advantage of the proposed univariate function evaluation is that no padding bits are required on the most significant bits of the encrypted value, e.g., there is no need to ensure that the most significant bit remains zero, as is the case with some existing implementations of programmable bootstrapping. This means that for a given ciphertext modulus q, higher accuracy can be achieved.

[0338] A further efficiency gain is provided by improved single-variable function evaluation, since the corresponding encrypted sub-value can be rounded to the required precision before applying the LUT. In addition, multiple single-variable function evaluations can be performed on the same input using the same GGSW encryption bits, making the application of multiple functions particularly efficient.

[0339] The proposed WoP-PBS can take as input a bootstrap key and a LUTL which may or may not be encrypted. WoP-PBS can output a homomorphic evaluation of the LUT on the input message, such as an LWE or GLWE encryption of L[m].

[0340] Specifically, a bit can be extracted from the encrypted sub-value by extracting the corresponding least significant bit using a scaled programmable bootstrapping such that it operates on the corresponding bit as the least significant bit. This operation can be efficiently performed using a generalized programmable bootstrapping, such as that proposed in "Improved programmable bootstrapping with larger precision and efficient arithmetic circuits for TFHE" by I. Chillotti et al. (incorporated herein by reference). Specifically, the generalized programmable bootstrapping can include a modulus switch for direct reading next to the bit to be extracted, and it can be used to evaluate the sign function rescaled to the jth bit.

[0341] In many cases, all bits of the input value can be extracted, but if the function does not depend on one or more bits (for example, the function only uses a few of the least significant bits), then extracting those bits can be avoided, further improving efficiency.

[0342] When using the described generalized programmable bootstrapping, further improvements can be achieved by choosing values ​​of θ > 0 and using a PBSmanyLUT as described in “Improved programmable bootstrapping with larger precision and efficient arithmetic circuits for TFHE”. Programmable bootstrapping also does not need to be applied to every bit, for example if the extracted bits are already at the correct rescaling (or close to it) when extracting information from the input.

[0343] To convert the bits to GGSW ciphertext, circuit bootstrapping can be used, for example, see I. Chillotti et al., "Faster packed homomorphic operations and efficient circuit bootstrapping for TFHE", proceedings of ASIACRYPT 2017 (incorporated herein by reference). For circuit bootstrapping, it is worth noting that its second step can be improved similar to H. Chen et al., "Onion ring ORAM: efficient constant bandwidth oblivious RAM from (leveled) TFHE", proceedings CCS 2019 (incorporated herein by reference). That is, the initial non-functional LWE-to-GLWE KS can be applied to the output of the programmable bootstrapping, and the outer product multiplication of the GGSW encryption of the GLWE key can be performed. Thereby, the size of the evaluated public key can be reduced, and the efficiency can be improved by using FFT.

[0344] Lookup tables can be efficiently applied to GGSW ciphertexts by using packed lookup table evaluation, for example, see I. Chillotti et al., "Faster packed homomorphic operations and efficient circuit bootstrapping for TFHE", proceedings of ASIACRYPT 2017 (incorporated herein by reference). In general, such packed LUT evaluation can adopt hybrid packing, of which horizontal packing and vertical packing are two specific examples.

[0345] Interestingly, the above method applies to values ​​that are encoded and encrypted regardless of whether a carry is used; and it also applies to values ​​that are encrypted but not encoded as corresponding subvalues. In the latter case, many of the advantages discussed also apply. Thus, a method and cryptographic computing device for performing cryptographic computations are contemplated that use the described univariate function evaluation without necessarily also using a carry or an encoded and encrypted value. Overall, it is noteworthy that although the improved univariate function evaluation typically uses programmable bootstrapping based on blind rotations internally (e.g., circuit bootstrapping may involve a constant number of programmable bootstrappings, etc.), at a higher level, the improved univariate function evaluation can be used to replace the programmable bootstrapping performed in cryptographic computations, especially when applied to large message moduli.

[0346] Specifically, univariate function evaluation based on conversion to bits can be implemented as follows:

[0347]

[0348]

[0349] Although the above examples illustrate vertical packing, horizontal or hybrid packing may also be used. In addition, a GLWE ciphertext may be output instead of the LWE ciphertext illustrated above. Furthermore, the above examples may be generalized to multivariate function evaluation with multiple encoded and encrypted inputs (e.g., at least two or at least three) by extracting the required bits from the corresponding inputs and applying the lookup table to the bits from the corresponding inputs.

[0350] As discussed elsewhere, performing cryptographic computations may include tracking the degree of integrity of corresponding carry sub-values. If the degree of integrity of a carry sub-value to be computed indicates that the corresponding carry message modulus may be exceeded, a cryptographic carry reduction may be applied prior to computing the carry sub-value. Specifically, the cryptographic carry reduction operation may be performed prior to or during the cryptographic operation as desired. An operation configured to automatically perform a carry reduction when necessary to ensure that the carry buffer does not overflow is referred to as a "smart" operation.

[0351] Figure 5 An embodiment of a value encoded and encrypted based on a remainder system representation is schematically shown. It is demonstrated how various cryptographic operations can be applied to such an encoded and encrypted value in cryptographic calculations.

[0352] Such encryption computations may involve the use of carries in the encoded and encrypted values, but this is not required, for example, carry reductions may be applied directly after each operation or sub-operation described herein, such that the encryption operations are applied only to the encoded and encrypted values ​​without carries.

[0353] Specifically, the mapping between a value and its subvalues ​​can be expressed according to a remainder system, specifically based on the Chinese Remainder Theorem (CRT). The encoded and encrypted value can be encrypted as a value with the corresponding message modulus β i The encryption of k subvalues ​​of (0≤i≤k-1). Usually, the modulus β i , β j (i≠j) are pairwise coprime, so that the value can be reconstructed from the subvalues ​​using the CRT. In general, any modulus can be used as the carry message modulus, for example, the subvalues ​​can adopt a common carry message modulus. In order to encrypt a value into an encoded and encrypted value, a CRT representation of the value can be calculated, and then the corresponding elements of the representation can be encrypted. Similarly, the inverse CRT can be used to decode an encoded and encrypted value.

[0354] Interestingly, using a remainder system encoding can provide a particularly efficient encrypted carry reduction. Specifically, the carry reduction can be performed by performing a corresponding modulus reduction on the corresponding subvalues, for example, the carry cannot be forwarded from one subvalue to the next subvalue. This makes the carry reduction faster and suitable for multithreading. For example, one, more or all message moduli can be at least 2 and / or at most 32. For example, one, more or all message moduli can be at least 3, at least 5, or at least 10. Specifically, the figure illustrates a value encoded and encrypted as three corresponding subvalues ​​501, 502, 503, which are respectively positioned to take modulo according to the corresponding message modulus 504, 505, 506, and the message modulus is equal to 25, 29 and 32, respectively. Therefore, the encoded and encrypted value can be defined as taking modulo according to M=32×29×25, where κ=3. The common carry message modulus 507, equal to 64, is used in this example.

[0355] Specifically, the encoding of a value into subvalues ​​can be determined as follows:

[0356]

[0357]

[0358] Now let's introduce some notation about codes based on remainder systems. Let is a CRT cardinality such that for all 0≤i,j<κ, when i≠j, the integer pair (β i ,β j ) are relatively prime. The relevant total CRT modulus τ can be defined as

[0359] To encode and encrypt the value m mod τ, the corresponding remainder m modulo the corresponding basis i =m modβ ican be encrypted into κ different Arith ciphertexts.

[0360] To decrypt a value m that was encoded over multiple Arith ciphertexts using this CRT representation and that was encrypted, first, the Arith ciphertexts that encrypted the subvalues ​​can be decrypted. Then, the encrypted integer can be decoded modulo τ, as is known per se.

[0361] Therefore, according to CRT base For integers Encrypted CrtModInt ciphertext Can be defined as where for all 0≤i<κ, and And m≡m i modβ i The i-th Arith ciphertext can be expressed as As discussed elsewhere, the ciphertext Each may be based on a public encryption key, but this is not strictly required.

[0362] if And if

[0363]

[0364] Then the two CrtModInt ciphertexts and Can be called compatible.

[0365] Now discuss various operations using CRT encoded and encrypted values. Interestingly, when using CRT representation, in many cases, encryption operations can be applied by applying the corresponding sub-operations separately to the corresponding encryption of the sub-values ​​of the input value. This makes the operation efficient and parallelizable. This is especially true for addition, subtraction, and multiplication.

[0366] Specifically, homomorphic addition can be implemented by adding blocks of the same exponent together, e.g.

[0367]

[0368] If the input is compatible, and , Arith::Add can be applied, then this operation can be applied. The computational complexity can be

[0369] Homomorphic subtraction can also be implemented by subtracting blocks of the same exponent, for example:

[0370]

[0371] If the input is compatible, and Arith::Sub can be applied, then this operation can be applied. The computational complexity can be

[0372]

[0373] By multiplying a scalar known to the party performing the cryptographic multiplication, the corresponding block can be multiplied by the modulus β of the corresponding message. i This is done modulo the scalar u, for example:

[0374]

[0375] if , Arith::ScalarMul can be applied, then this operation can be applied. The computational complexity can be

[0376] Another way to implement scalar multiplication is, for example, by applying programmable bootstrapping.

[0377] Interestingly, when using the CRT representation, encryption carry reduction can be applied to carry subvalues, for example by reducing the carry subvalues ​​modulo the corresponding message modulus using programmable bootstrapping. This may not affect other subvalues, and thus, carry reductions for multiple or all subvalues ​​of the encoded and encrypted value may be performed separately and in parallel. Propagation may not be required. For example, a single carry subvalue may be carry reduced as follows:

[0378]

[0379]

[0380] if Then this operation can be applied and can have a computational complexity of

[0381] For each component of CrtModInt Ciphertext extraction by β i The modulo message can perform carry reduction on multiple sub-values, for example:

[0382]

[0383] if Then this operation can be applied. The computational complexity can be

[0384] Homomorphic multiplication can be achieved by converting i(where i∈[0,κ-1]) modulo the corresponding subvalue x modβ i , y mod β i Multiply them together to achieve this, for example:

[0385]

[0386]

[0387] if Arith::MulLSB can be applied, then this operation can be applied. The computational complexity can be Other techniques for multiplication of subvalues ​​may also be used, such as Arith::MulLSB 3PBS .

[0388] A variety of techniques can be used to apply single-variable functions to CRT-encoded and encrypted values. Specifically, tree programmable bootstrapping can be used, or a lookup table can be applied to the extracted bits of the GGSW encryption, such as a combination of the two Figure 4 Depending on the function, it can also be evaluated by applying the univariate function to the corresponding subvalues ​​individually. For example, for This is the case for functions that can be expressed as sums and products over , such as arithmetic functions. In such cases, for example, single-variable functions can be applied as follows:

[0389]

[0390] If for all i such that 0≤i<κ, CrtModInt[i]::deg<1 and the function This operation can be applied if the split is performed on the elements of the CRT representation. The computational complexity can be

[0391] Figure 6 An embodiment of a value encoded and encrypted based on a base decomposition is schematically shown. In this case, it is interesting that the value is defined using a modulus M that is smaller than the maximum value representable by the base decomposition. This has the benefit that the modulus M does not need to be equal to the product of the base elements.

[0392] Specifically, to encode and encrypt the value modulo M, the base can be chosen so that the modulus M is smaller than the maximum value representable by the cardinality factorization The cardinality can be expressed as Figure 4 discussed.

[0393] For example, the figure illustrates the case where the modulus 601 is M=1433. It is worth noting that 1433 is a prime number, so the base or CRT representation cannot be directly used to decompose this modulus. They have a common base element β = 2 5 , 602, where κ = 3, and with a common carry message modulus Where p = 2 7 Thus, in this case, the value may be encoded and encrypted into three encrypted sub-values ​​606-608.

[0394] Encryption operations can be performed according to Figure 4 The latter may be performed as discussed above, except that the carry reduction may involve applying the correction due to the modular reduction modulo M. The latter may be performed by an encrypted modulo reduction of the encryption of the most significant subvalue of the output value. Specifically, as also discussed elsewhere, the carry and message may be extracted from the most significant block, and the modulus may be computed homomorphically by redistribution over the remaining blocks. To this end, several approaches may be taken, as discussed in more detail elsewhere.

[0395] More specifically, according to the secret key s, Factored integers For example in Encrypted ciphertext Can be indicated as

[0396]

[0397] in composition The i-th Arith ciphertext can be defined as

[0398] In the above definition, the modulus Q is set to be located in the most significant block κ-1. It is worth noting that it can be found in RadModInt + The algorithm described in this paper for performing homomorphic modular reduction can be applied to RadModInt using additional Arith ciphertext blocks. + The ciphertext is subjected to modular reduction.

[0399] if

[0400]

[0401] Then the two RadModInt + Ciphertext and is defined as compatible, where and

[0402]

[0403] For example, the ciphertext and Can be compatible.

[0404] You can execute as follows Figure 4 Various operations discussed. Several embodiments of this aspect are now discussed.

[0405] Specifically, we can compute modular addition as we did for the RadModInt ciphertext. + The ciphertext can be viewed as RadModInt ciphertext. This operation can be expressed as

[0406] You can also perform modular subtraction as you did for the RadModInt ciphertext, converting RadModInt + The ciphertext is treated as RadModInt ciphertext. This operation can be indicated as

[0407] You can also perform modular padding as you did for RadModInt ciphertext, replacing the RadModInt in the output + The ciphertext is treated as RadModInt ciphertext. Usually the input from the decomposition can be RadModInt. This operation can be indicated as

[0408] You can also perform encrypted carry reduction on the subvalues ​​with carry, just like you did for the RadModInt ciphertext, + The ciphertext is treated as RadModInt ciphertext. This operation can be indicated as

[0409] Modular reduction can be performed when the carry reduction is performed on the most significant subvalue. We now discuss two possible ways to perform modular reduction. Their relative efficiency may depend on the modulus M and the bound M. max The distance between.

[0410] A first method of performing a modular reduction is to apply programmable bootstrapping to the most significant encrypted subvalue to propagate that subvalue to corresponding encrypted subvalues ​​to obtain a reduced value modulo Q.

[0411] Specifically, carry reduction may involve emptying and propagating the carries of subvalues ​​of the encoded and encrypted value, except for the most significant subvalue. Therefore, all carries except the carry in the most significant block may be empty. This can be done if the carries of the most significant block can support the carry propagation without exceeding. In the most significant block, programmable bootstrapping can be used to extract and convert both the carries and the message. The converted extracted carries and messages can be redistributed into the corresponding blocks.

[0412] Now about Figure 6 The parameters shown in the example give a detailed embodiment, namely Q = 1433, κ = 3, Where β = 2 5 ,and Where p = 2 7 The most significant block can encrypt messages m<2 p , rescaled to the number β 2 The modular reduction can use the corresponding PBS to reduce the number mβ modulo Q 2 And at the same time decompose it in cardinality powers to redistribute it to the corresponding blocks. Let's say m'=mβ 2 mod Q. Then m′ can be decomposed into

[0413]

[0414] PBS LUTs can be constructed to take as input the encryption of m and output the encryption of these decomposed values ​​(m′2, m′1, m′0). The reduced ciphertext can then be obtained as follows:

[0415] - in block 0: by adding between the encryption of the previous block 0 and m′0;

[0416] - in block 1: by addition between the encryption of the previous block 1 and m′1;

[0417] - In block 2: encryption by m'2 whose degree is smaller than the original.

[0418] As a detailed embodiment, modular reduction can be implemented as follows:

[0419]

[0420] if satisfy And Arith::Add can be applied to the ciphertext ct for all j∈[0;κ-2] j and This operation can be applied.

[0421] The computational complexity can be

[0422] It is worth noting that the corresponding programmable bootstrapping can be evaluated as a single programmable bootstrapping using the “PBS many LUT” technique disclosed in “Improved programmable bootstrapping with larger precision and efficient arithmetic circuits for TFHE”.

[0423] An alternative technique for performing the modular reduction is based on a linear relationship between the subvalue corresponding to the most significant basis element and the set of subvalues ​​corresponding to the remaining basis elements modulo a smaller modulus Q. Based on this relationship, the encoded and encrypted value can be modularly reduced to the encoded and encrypted value whose most significant subvalue is zero. Specifically, to obtain a linear relationship, divide by β modulo Q. k-1 The product of the basis elements other than It can be found in cardinality = (β0,β1,…,β κ-1 ) is decomposed into:

[0424]

[0425] If in the decomposition ν κ-1 = 0, this method can be used. In this case, the most significant block is multiplied by the constant ν j can be added to the jth block, and then the new most significant block is set to zero. If the decomposed elements ν0,ν1,…,v κ-2 If Q is small or even zero, the technique is particularly efficient, and for some applications, a suitable modulus Q can be selected to make the modulus reduction efficient, thereby obtaining particularly efficient encryption calculations.

[0426] As an example, refer to Figure 6 Parameters exemplified in: smaller modulus Q = 1433, number of subvalues ​​κ = 3, basis of message modulus Where β = 2 5 , and the carry message modulus Where p = 2 7 In this embodiment, it can be observed that (2 5 ) 2 mod 1433 = -409 = -12 2 5 -25, so the modulus reduction can be performed by adding the previous least significant block 608 to the most significant block 606 and multiplying by -25 in the least significant block 608; adding the previous intermediate block 607 to the previous most significant block 606 and multiplying by -12 in the intermediate block 607; and setting the most significant block 606 to zero.

[0427] Another embodiment where the current modular reduction is particularly efficient is where Q = 1087, κ = 3, Where β = 2 5 , Where p = 2 7 , as before. In this case, it can be observed that (2 5 ) 2 mod1087=-63=-2·2 5 +1, so the modulo reduction can be implemented by scalar multiplication with a small scalar.

[0428] It is worth noting that this technique can be implemented efficiently without programmable bootstrapping. Carry propagation can optionally be performed later via bootstrapping. For example, this technique can be implemented as follows:

[0429]

[0430] If in the decomposition ν, the coefficient v κ-1 = 0, and for all j∈[0;κ-2], Arith::ScalarMul can be applied to the ciphertext and the scalar v j ; the decomposition will not overflow the decomposition base; and RadModInt + ::Padding, RadModInt + ::Sub and RadModInt + ::Add can be applied to their corresponding inputs, then this process can be applied. Let κ + <κ is the number of positive elements in the decomposition, and let κ - <κ is the number of negative elements in the decomposition. Then, the computational complexity of the technique can be It can be noted that if v j If the coefficient is equal to zero, the cycle for that coefficient can be skipped. If the parameters are chosen so that one or more coefficients v j is zero, the technique is particularly efficient.

[0431] Using RadModInt + Performing a cryptographic carry reduction operation on all subvalues ​​of the encoded and encrypted value may be performed by applying the cryptographic carry reduction to the corresponding subvalues ​​except the most significant subvalue and applying the cryptographic modulus to the most significant subvalue. Specifically, this operation may be implemented as follows:

[0432]

[0433] It is worth noting that although RadModInt +::ClearCarry can reduce the carry sub-value to the non-carry sub-value, but RadModInt + The overall result of ::ClearAllCarries may have carry-in subvalues ​​due to the additions performed in the modular reduction. Optionally, further crypto-carry reduction may be applied if desired, for example using RadModInt + ::ClearCarry to reduce such a carried subvalue to a carry-free subvalue, for example, if this allows one or more further operations to be performed.

[0434] If for all i∈[0,κ-2], RadModInt + ::ClearCarry can be applied, and if RadModInt + ::ModularReduction 1,2 can be applied to the result, then the above process can be applied. Depending on the modular reduction used, the computational complexity can be or

[0435] Scalar multiplication can be performed using the SmallScalarMul operation as discussed for the RadModInt ciphertext. This can be particularly well suited for relatively small scalars. For this reason, RadModInt + The ciphertext can be viewed as RadModInt ciphertext. This operation can be indicated as

[0436] Scalar multiplication can be performed using the ScalarMulDecomp operation as discussed for the RadModInt ciphertext, + The ciphertext is treated as RadModInt ciphertext. Specifically, the corresponding subvalues ​​of the encoded and encrypted values ​​can be multiplied, and then the resulting encodings and encryptions can be combined. The scalar multiplication can also include performing a modular reduction. The overall scalar multiplication operation can be indicated as

[0437] In this case, one method of implementing modular reduction is to include one or more additional subvalues ​​in the encoded and encrypted product so that exact multiplication is supported, in other words, so that the encoded and encrypted product can be computed without modular reduction (the number of subvalues ​​to be added is selected to fit the scalar to be multiplied with it); perform the exact multiplication; and apply the corresponding modular reduction to the corresponding added subvalue and the original most significant subvalue, for example from most significant to least significant.

[0438] An alternative approach is to perform the corresponding modular reductions in an iterative manner before combining the corresponding encodings and encrypting. In this case, adding extra subvalues ​​can be avoided.

[0439] The multiplication of the encoded and encrypted values ​​can be performed as discussed for the RadModInt ciphertext, + The ciphertext is treated as RadModInt ciphertext. Specifically, the first encoded and encrypted value may be multiplied with the corresponding subvalues ​​of the second encoded and encrypted value, and the results may be combined. The multiplication may include a modular reduction. The overall multiplication may be indicated as

[0440] To perform a modular reduction, one or more sub-values ​​may be included in the encoded and encrypted product so that an exact multiplication of the encoded and encrypted values ​​may be performed (the number of sub-values ​​being selected to fit the values ​​to be multiplied); an exact multiplication may be performed; and a corresponding modular reduction may be applied to the added block and the initially most significant sub-value, e.g., from most significant to least significant.

[0441] Another way to perform modular reduction is to perform iteratively during the computation, for example, before overlapping the results in the most significant block. This way, no additional subvalues ​​need to be added.

[0442] Figure 7 An embodiment of a value encoded and encrypted based on a remainder system representation and further based on a radix decomposition of elements of the remainder system representation is schematically shown. Such a representation is referred to herein as a "hybrid" encoding and encryption. Specifically, the encoded and encrypted value may include one or more corresponding encodings and encryptions based on the remainder system representation of corresponding subvalues ​​defined according to the remainder system representation.

[0443] Interestingly, in this way, it is possible to combine the advantages of the remainder system representation, i.e. avoiding multiple carry propagation, without the problem of requiring many small coprime numbers. Specifically, by using a hybrid approach, cryptographic calculations can be performed relatively efficiently using particularly large moduli, e.g., the modulus can be at least 2 10 , at least 2 20 or at least 2 30 For example, the number of remainders represented by the remainder system may be at most or at least three, at most or at least six, or at most or at least ten.

[0444] For example, the figure shows the use of modulus (4 5 )×1433×17×(3 4 ) is mixed and encrypted. This modulus can be decomposed into four remainders according to the remainder system 4 5 ,710;1433,720;17,730;and 34 , 740. The encoding and encryption of a given value may include, for a corresponding remainder of a remainder number system decomposition, a corresponding combination of one or more encrypted values ​​representing corresponding elements of the remainder number system decomposition of the value.

[0445] Specifically, for zero, one, or more remainders in the remainder system, the corresponding elements can be encrypted to an encrypted but unencoded value whose message modulus is equal to the remainder, as in Figure 5 The remainder 17, 730 in the figure is such a case, which can be encrypted as 740 modulo the remainder itself.

[0446] For zero, one or more other remainders, the corresponding element may be encoded as an encoded and encrypted value according to the radix decomposition of the element. Here, the remainder may be equal to the maximum value represented by the radix decomposition, for example using Figure 4 and / or the remainder may be less than the maximum value represented by the base decomposition, for example using Figure 6 Encoded and encrypted.

[0447] As shown in the figure, the remainder is 4. 5 , the element modulo 710 can be encoded and encrypted as 5 sub-values ​​711-715 modulo 4, for example, as Figure 4 discussed; and, by remainder 3 4 ,740 modulo the elements can be encoded and encrypted as 4 sub-values ​​741-743 modulo 3. In this embodiment, the elements modulo the remainder 1433,720 can be encoded and encrypted as 2 5 The modulo 3 subvalues ​​721-723, for example, as Figure 6 discussed.

[0448] Specifically, given multiple integers (Q0,…,Q κ-1 ), the value m mod τ can be encoded and encrypted using a hybrid method, where The value m mod Q can be determined by i , i∈[0,κ-1], the corresponding value may be encrypted, encoded and encrypted as RadModInt, and / or encoded and encrypted as in EadModInt + Medium encryption.

[0449] A detailed embodiment is now provided, in which RadModInt + For all remainders. This embodiment can be applied to the case where RadModInt or a single encryption is used for one, more or all remainders. In this embodiment, according to the CRT base (Q0, ..., Q k-1 ) for integer m∈ in The ModInt ciphertext to be encrypted can be indicated as:

[0450]

[0451] where for all 0≤i≤k-1, So that m≡m i q i In this embodiment, the composition The i-th RadModInt + The ciphertext can be indicated as Then, and

[0452] if Then ModInt ciphertext and can be defined as compatible, where And if the ciphertext and is compatible,

[0453] In general, various computations can be performed, including cryptographic operations and cryptographic carry reductions, such as for Figure 5 The conventional remainder system-based encoding and encryption are discussed above. For example, encrypted addition, subtraction, scalar multiplication, carry reduction, clear all carries, multiplication, and / or single variable function evaluation can be applied.

[0454] Where performing such a calculation includes performing a sub-calculation on one or more elements of the CRT representation, the Figure 4 or Figure 6 The discussed techniques apply sub-computations to corresponding encoded and encrypted elements. For example, an operation on ModInt can be performed on the corresponding component RadModInt + (m mod Q i ), i∈[0,κ-1], where instead of using the Arith-based algorithm, we can use the RadModInt-based algorithm described in this paper. + The algorithm to calculate ModInt

[0455] Figure 8An embodiment of an implementation scheme of an encryption method 800 for performing encryption calculations on a set of one or more encoded and encrypted values ​​is schematically shown. The method 800 can be implemented by a computer. A value can be encoded and encrypted as an encryption of multiple corresponding sub-values. The sub-value can have a corresponding message modulus and a carry message modulus greater than the message modulus. The value can be encoded and encrypted without a carry by a non-carry sub-value less than the corresponding message modulus. The value can be encoded and encrypted with a carry by at least one carry sub-value greater than or equal to the corresponding message modulus.

[0456] The method 800 may include accessing 810 one or more encoded and encrypted values. The method 800 may include applying 820 an encryption operation to at least one carry-encoded and encrypted input value to obtain a carry-encoded and encrypted output value. The method 800 may include applying 830 an encryption-carry reduction to the carry-encoded and encrypted output value to obtain a further encoding and encryption of the output value, wherein at least one carry-encoded subvalue is reduced to a non-carry subvalue.

[0457] Fig. 9 An example of an implementation of a compiler method 900 for compiling a computation into a homomorphic executable file is schematically shown. The homomorphic executable file can be executed by a cryptographic computation engine and can cause the cryptographic computation engine to perform a cryptographic computation on a combination of one or more encoded and encrypted values ​​described herein, such as according to Figure 8 Method 800 of the present invention. A homomorphic executable file may include one or more instructions for performing the encryption carry reduction operation described herein, for example, as part of an encryption operation or between executions of an encryption operation. Compiler method 900 may be implemented by a computer.

[0458] Compiler method 900 may include, for a carry-in sub-value to be calculated, determining 910 a degree of completeness of a bound representing the carry-in sub-value; and, if 920 the bound exceeds a corresponding carry message modulus, generating 930 an instruction causing an encryption calculation engine to apply an encrypted carry reduction before calculating the carry-in sub-value.

[0459] Many different ways of performing methods 800, 900 are possible, as will be apparent to those skilled in the art. For example, the order of the steps may be performed in the order shown, but the order of the steps may vary, or some steps may be performed in parallel. In addition, other method steps may be inserted between the steps. The inserted steps may represent a refinement of the method, as described herein, or may be unrelated to the method. For example, some steps may be performed at least partially in parallel. In addition, a given step may not be fully completed before starting the next step. Methods 800, 900 may also be combined, for example, method 800 for performing cryptographic calculations may be performed based on a homomorphic executable file previously compiled based on method 900.

[0460] Embodiments of the method may be performed using software that includes instructions for causing a processor system to perform method 800or 900. The software may include only those steps taken by a specific sub-entity of the system. The software may be stored in a suitable storage medium (such as a hard disk, a floppy disk, a memory, an optical disk, etc.). The software may be sent as a signal wired or wirelessly, or using a data network (e.g., the Internet). The software may be available for download and / or remote use on a server. Embodiments of the method may be performed using a bitstream that is arranged to configure a programmable logic (e.g., a field programmable gate array (FPGA)) to perform the method.

[0461] It will be understood that the presently disclosed subject matter also extends to computer programs, particularly computer programs on or in a carrier, suitable for implementing the presently disclosed subject matter. The program can be in the form of source code, object code, code intermediate source, and object code (such as partially compiled form), or any other form suitable for use in an embodiment of the present method. An embodiment related to a computer program product includes computer executable instructions corresponding to each processing step of at least one method stated. These instructions can be subdivided into subroutines and / or stored in one or more files, which can be linked statically or dynamically. Another embodiment related to a computer program product includes computer executable instructions corresponding to each device, unit, and / or part of at least one of the systems and / or products stated.

[0462] Typically, the devices described herein (e.g., the devices in Figures 1a-1c) include one or more microprocessors that execute appropriate software stored in the system; for example, the software may have been downloaded and / or stored in a corresponding memory, for example, a volatile memory such as RAM or a non-volatile memory such as flash memory. Alternatively, the system may be implemented in whole or in part in programmable logic, for example as a field programmable gate array (FPGA). The system may be implemented in whole or in part as a so-called application specific integrated circuit (ASIC), such as an integrated circuit (IC) customized for its specific purpose. For example, the circuit may be implemented in CMOS, for example, using a hardware description language such as Verilog, VHDL, etc. Specifically, the system may include a circuit for evaluating cryptographic primitives.

[0463] The processor circuit may be implemented in a distributed manner, for example as multiple sub-processor circuits. The storage may be distributed over multiple distributed sub-storages. Part or all of the storage may be electronic storage, magnetic storage, etc. For example, the storage may have volatile and non-volatile portions. Part of the storage may be read-only.

[0464] Fig.10 A computer readable medium 1000 is shown having a writable portion 1010. The computer readable medium 1000 is shown in the form of an optically readable medium. The computer readable medium 1000 may store data 1020, where the data may represent instructions that, when executed by a processor system, cause the processor system to perform an embodiment of a method and / or compiler method for performing cryptographic calculations according to one embodiment.

[0465] Alternatively or additionally, data 1020 may represent a homomorphic executable file compiled according to the compiler methodologies described herein.

[0466] Alternatively or additionally, data 1020 may represent a group of one or more encoded and encrypted values, including zero or more values ​​encoded and encrypted without a carry and one or more values ​​encoded and encrypted with a carry, as described herein.

[0467] The data 1020 may be implemented on the computer readable medium 1000 as a physical mark or by magnetization of the computer readable medium 1000. However, any other suitable implementation is also conceivable. In addition, it will be understood that although the computer readable medium 1000 is shown as an optical disk, the computer readable medium 1000 may be any suitable computer readable medium, such as a hard disk, solid state memory, flash memory, etc., and may be non-recordable or recordable.

[0468] Fig.11A processor system 1140 according to one embodiment of a device for performing cryptographic calculations or determining a test polynomial is shown schematically. The processor system includes one or more integrated circuits 1110. The architecture of one or more integrated circuits 1110 is schematically shown in the figure. The circuit 1110 includes a processing unit 1120 (e.g., a CPU) for running a computer program component to perform a method according to one embodiment and / or implement its modules or units. The circuit 1110 includes a memory 1122 for storing programming code, data, etc. A portion of the memory 1122 may be read-only. The circuit 1110 may include a communication element 1126, such as an antenna, a connector, or both. The circuit 1110 may include an application-specific integrated circuit 1124 for performing some or all of the processing defined in the method. The processor 1120, the memory 1122, the application-specific integrated circuit 1124, and the communication element 1126 may be connected to each other via an interconnect 1130 (e.g., a bus). The processor system 1110 may be arranged for contact and / or contactless communication, using an antenna and / or a connector, respectively.

[0469] For example, in one embodiment, the processor system 1140 (e.g., a device that performs cryptographic calculations or compilations) may include a processor circuit and a memory circuit, and the processor is arranged to execute software stored in the memory circuit. For example, the processor circuit may be an Intel Core i7 processor, an ARM Cortex-R8, etc. In one embodiment, the processor circuit may be an ARM Cortex M0. The memory circuit may be a ROM circuit, or a non-volatile memory (e.g., flash memory). The memory circuit may be a volatile memory (e.g., SRAM memory). In the latter case, the device may include a non-volatile software interface (e.g., a hard disk, a network interface, etc.) arranged to provide software.

[0470] Although device 1110 is shown as including one of each described component, multiple components may be repeated in multiple embodiments. For example, processor 1120 may include multiple microprocessors that are configured to independently perform the methods described herein, or are configured to perform the steps or subroutines of the methods described herein, so that multiple processors cooperate to implement the functions described herein. In addition, in the case where device 1110 is implemented in a cloud computing system, multiple hardware components may belong to separate physical systems. For example, processor 1120 may include a first processor in a first server and a second processor in a second server.

[0471] It should be noted that the above-mentioned embodiments illustrate rather than limit the presently disclosed subject matter, and that those skilled in the art will be able to design many alternative embodiments.

[0472] In the claims, any reference numerals placed in brackets shall not be interpreted as limiting the claims. The use of the verb "comprise" and its variants does not exclude the presence of elements or steps other than those stated in the claims. The article "one" or "an" in front of an element does not exclude the presence of multiple such elements. When an expression such as "at least one" is placed before a list of elements, it means selecting all elements or any subset thereof from the list. For example, the expression "at least one of A, B, and C" should be understood to include only A, only B, only C, both A and B, both A and C, both B and C, or all of A, B, and C. The subject matter currently disclosed can be implemented by hardware including several different elements, as well as by a suitably programmed computer. In a device claim that lists several components, several of these components can be implemented by the same hardware item. The mere fact that certain measures are recorded in mutually different dependent claims does not mean that a combination of these measures cannot be used to advantage.

[0473] In the claims, reference numerals in parentheses refer to reference symbols in the exemplary embodiment drawings or formulas of the embodiments, thereby improving the intelligibility of the claims. These reference numerals should not be construed as limiting the claims.

Claims

1. A cryptographic method (800) for performing a cryptographic calculation on a set of one or more encoded and encrypted values, wherein: - encoding and encrypting a value into an encryption of a plurality of corresponding subvalues, wherein the subvalues ​​have corresponding message moduli and a carry message modulus greater than the message modulus; - encoding and encrypting the value without a carry by a non-carry subvalue less than the corresponding message modulus; as well as - encode and encrypt the value with at least one subvalue with carry greater than or equal to the corresponding message modulus, The method comprises: - accessing (810) the one or more encoded and encrypted values; - applying (820) a cryptographic operation to the at least one carry-encoded and encrypted input value to obtain a carry-encoded and encrypted output value; - Applying (830) an encryption-carry reduction to the carry-encoded and encrypted output value to obtain a further encoding and encryption of the output value, wherein at least one carry-encoded subvalue is reduced to a non-carry subvalue.

2. The method (800) of claim 1, wherein the encryption of the subvalues ​​is an LWE encryption, wherein the LWE encryption supports a programmable bootstrap operation, wherein the programmable bootstrap evaluates the LWE decryption in the exponent of a GLWE encrypted monomial, and wherein the encrypted carry reduction uses the programmable bootstrap operation.

3. The method (800) of any one of the preceding claims, comprising computing the output value by performing a plurality of cryptographic arithmetic operations on a set of encoded and encrypted values, wherein the performing does not include cryptographic carry reductions.

4. A method (800) according to any of the preceding claims, wherein the encryption operation is applied by applying corresponding sub-operations individually to corresponding encryptions of sub-values ​​of the input value, wherein the individually applied encryption operations are at least partially performed in parallel.

5. The method (800) of any one of the preceding claims, wherein encoding a value as a non-carry sub-value is based on a remainder system representation of the value.

6. The method (800) of claim 5, wherein the encoding is further based on a radix decomposition of elements of the remainder system representation.

7. The method (800) of any one of claims 1 to 4, wherein encoding a value as a non-carry sub-value is based on a radix decomposition of the value.

8. The method (800) according to claim 6 or 7, wherein applying the encrypted carry reduction includes decomposing the subvalues ​​of the output value with carries into encryptions of corresponding subvalues ​​of the subvalues, and adding the subvalue encryptions of the subvalues ​​to the encryptions of the corresponding subvalues ​​of the output value.

9. The method (800) according to any one of claims 6 to 8, comprising performing an encrypted multiplication of the encoded and encrypted value with the scalar by calculating corresponding encrypted subvalues ​​of the multiplication of the subvalues ​​of the encoded and encrypted value with the scalar.

10. The method (800) according to any one of claims 6 to 9 comprises performing an encrypted multiplication of the first encoded and encrypted value and the second encoded and encrypted value by performing an encrypted multiplication of the first encoded and encrypted value and a subvalue of the second encoded and encrypted value, wherein the encrypted multiplication result of the subvalue is the encoded and encrypted value.

11. The method (800) according to any one of claims 6 to 10, wherein the elements of the remainder system or the values ​​without carry encoding and encrypted are defined as modulo a modulus smaller than the maximum value representable by the base decomposition.

12. A method (800) according to any of the preceding claims, wherein applying the cryptographic operation includes, for a carried sub-value to be calculated, determining a degree of integrity indicating a bound on the carried sub-value; and if the bound exceeds a corresponding carry message modulus, applying the cryptographic carry reduction before calculating the carried sub-value.

13. The method (800) according to any of the preceding claims, wherein the message modulus is not a power of 2 and / or at least 3 and / or at least 5 and / or at least 10.

14. The method (800) of any of the preceding claims, wherein the carried message modulus is at least 4 times, at least 8 times, or at least 32 times the corresponding message modulus.

15. The method (800) according to any of the preceding claims, comprising performing one or more encrypted linear operations and / or one or more encrypted multiplications and / or one or more univariate function evaluations.

16. A method (800) according to any of the preceding claims, comprising applying function evaluation to one or more encoded and encrypted values ​​by: extracting one or more bits from one or more sub-values ​​of the encoded and encrypted value; converting the extracted bits to GGSW ciphertext; and applying a lookup table to the GGSW ciphertext.

17. A computer-implemented compiler method (900) for compiling a computation into a homomorphic executable file, wherein the homomorphic executable file is executed by a cryptographic computation engine and causes the cryptographic computation engine to perform a cryptographic computation according to any one of claims 1 to 16, wherein the method comprises: - for a carried sub-value to be calculated, determining (910) a degree of completeness indicative of bounds of said carried sub-value; and - If (920) the bound exceeds the carry message modulus of the carry-with-subvalue, generating (930) instructions that cause the cryptographic computation engine to apply a cryptographic carry reduction before computing the carry-with-subvalue.

18. A cryptographic device (110, 112) for performing a cryptographic calculation on a set of one or more encoded and encrypted values, wherein: - encoding and encrypting a value into an encryption of a plurality of corresponding subvalues, wherein the subvalues ​​have corresponding message moduli and a carry message modulus greater than the message modulus; - encoding and encrypting the value without a carry by a non-carry subvalue less than the corresponding message modulus; as well as - encode and encrypt the value with at least one subvalue with carry greater than or equal to the corresponding message modulus, The device (110, 112) comprises: - a memory (140) for storing one or more encoded encrypted values; - A processor subsystem (130) configured to apply a cryptographic operation to at least one carry-encoded and encrypted input value to obtain a carry-encoded and encrypted output value; and to apply a cryptographic carry reduction to the carry-encoded and encrypted output value to obtain a further encoding and encryption of the output value, wherein at least one carry-encoded subvalue is reduced to a non-carry subvalue.

19. A compiler device (119) for compiling a computation into a homomorphic executable file, wherein the homomorphic executable file is executed by an encryption computing engine, and causes the encryption computing engine to perform the encryption computing according to any one of claims 1 to 16, wherein the device comprises: - a memory (149) for storing data representing a computation to be compiled into a homomorphic executable file; - a processor subsystem (139) configured to determine, for a carried subvalue to be calculated, a degree of completeness indicative of limits of the carried subvalue; And if the bound exceeds the carry message modulus of the carry-with-subvalue, generating instructions that cause the cryptographic computation engine to apply a cryptographic carry reduction before computing the carry-with-subvalue.

20. A transitory or non-transitory computer-readable storage medium (1000) comprising data (1020) representing: - instructions which, when executed by a processor system, cause the processor system to perform a method according to any one of claims 1 to 16; and / or - instructions which, when executed by a processor system, cause the processor system to perform the method according to claim 17; and / or - a set of one or more coded and encrypted values, comprising zero or more carry-less coded and encrypted values ​​and one or more carry-coded and encrypted values, wherein: - encoding and encrypting a value into an encryption of a plurality of corresponding subvalues, wherein the subvalues ​​have corresponding message moduli and a carry message modulus greater than the message modulus; - the value is encoded and encrypted without a carry by a non-carry subvalue less than the corresponding message modulus; and wherein the value is encoded and encrypted with a carry by at least one carry subvalue greater than or equal to the corresponding message modulus.

Images