Calculation of encoded and encrypted values

Abstract

Some embodiments relate to an encryption method that performs an encryption computation on a set of one or more encoded and encrypted values. The values are encoded and encrypted as a plurality of respective sub-values. The sub-values have a corresponding message modulus and a carry message modulus that is greater than the message modulus. The values are encoded and encrypted without carry by non-carry sub-values that are less than the corresponding message modulus. The values are encoded and encrypted with carry by at least one carry sub-value that is greater than or equal to the corresponding message modulus. An encryption operation is applied to the at least one input value encoded and encrypted with carry to obtain an output value encoded and encrypted with carry. An encryption carry reduction is applied to the output value encoded and encrypted with carry to obtain a further encoding and encryption of the output value in which the at least one carry sub-value is reduced to a non-carry sub-value.

Description

TECHNICAL FIELD

[0001] The presently disclosed subject matter relates to an encryption method of performing an encrypted computation, a corresponding device, a compiler method and device for encrypted computation, and a computer readable medium. BACKGROUND

[0002] Homomorphic cryptography allows one to perform computations on encrypted data: computations (e.g. circuit evaluations) that one party performs on encrypted data that the party cannot decrypt. For example, input data and computation results can be received and returned in encrypted form. Intermediate data (e.g. internal states of the computation) can also be in encrypted form.

[0003] Even if the result of the computation is returned in encrypted form, the output upon decryption is expected to be identical or very close to what would have been obtained had the computation been performed on unencrypted data. Homomorphic encryption can be used for privacy-preserving outsourced storage and computation. This allows data to be encrypted and outsourced to a cloud environment for processing and / or storage while encrypted.

[0004] For example, homomorphic cryptography can be applied in fields such as medical health, where privacy regulations can make it difficult to share plaintext data, but computations on encrypted medical data can be allowed. For example, a medical model such as for classifying medical data can be configured to receive medical data in encrypted form from a third party (e.g. a hospital). The medical model may, for example, classify medical data as, for example, normal or abnormal, or as having a certain particular medical syndrome, disease or other condition. Using homomorphic encryption, the medical model can be applied to medical data received in encrypted form. This means that the party providing the medical model cannot access the plaintext medical data corresponding to the encrypted medical data. The user of the service can decrypt the results of the application of the medical model.

[0005] In particular, there exist homomorphic cryptography techniques that, at least in principle, can be used to compute any function on encrypted data. Such techniques are referred to as “fully homomorphic encryption” (FHE) techniques.

[0006] For security reasons, known implementations of FHE use noisy ciphertexts. For example, encryption of a data item can include mapping the data item to a point in a key-dependent lattice, adding noise to the point. In particular, many known implementations of FHE use LWE-type ciphertexts, whose security relies on the cryptographic difficulty of a fault-tolerant learning problem. Such LWE-type ciphertexts can include one or more mask values (e.g., values modulo some modulus q, or ring elements), plus a body value, which is derived from the mask value(s) and the plaintext using an encryption key, and which contains noise. One generalization of this is GLWE-type ciphertexts, which encrypt and use polynomials instead of scalar values. RLWE-type ciphertexts are another type of GLWE ciphertext. Other known implementations of FHE use NTRU-type ciphertexts, which are basically subject to the same considerations.

[0007] When a data item is just encrypted, the noise is low - the encryption is fresh. For example, the amount of noise is low so that if the data item is to be decrypted, the noise can be removed at some point in the decryption process, e.g., by rounding. On the other hand, the noise should be high enough to make attacks on the system difficult enough. For example, many homomorphic encryption schemes can be subject to linear algebra or other efficient algorithms (e.g., lattice point reduction algorithms) if there is no noise. When a data item is encrypted, selected noise is added so that attacks are difficult, while still allowing homomorphic operations to be performed, and decryption is still possible.

[0008] Most homomorphic operations increase the noise inherent in homomorphically encrypted data items. When many such operations are performed, the noise can reach a level where unique decryption is no longer possible. In general, it is known to use a technique called bootstrapping to reduce the noise of homomorphically encrypted values. Bootstrapping can use a public key called a bootstrapping key. By using bootstrapping to reduce the noise when needed, in principle any desired number of homomorphic operations can be computed.

[0009] A special class of fully homomorphic encryption schemes is the TFHE class of homomorphic encryption schemes. Such schemes are described in I. Chillotti et al., “Programmable bootstrapping enables efficient homomorphic inference of deep neural networks”, in Cyber Security Cryptography and Machine Learning (CSCML 2021), Lecture Notes in Computer Science, Vol. 12716, pp. 1-19, Springer, 2021 (incorporated herein by reference). TFHE class schemes differ from other FHE schemes in that they support a relatively efficient bootstrapping technique; in addition, they are also able to evaluate a function simultaneously during the bootstrapping operation, referred to as programmable bootstrapping. Regular bootstrapping corresponds to programmable bootstrapping with an identity function.

[0010] Other known implementations of TFHE class schemes use NTRU type ciphertexts, which are basically subject to the same considerations. In particular, NTRU can be used in conjunction with the techniques provided by using blind rotations of NTRU encryption polynomial products that yield test polynomials and bootstrapping monomials and / or applying blind rotations to NTRU ciphertexts as input. Suitable embodiments of NTRU encryption are defined in C. Bonte et al., “FINAL: Faster FHE instantiated with NTRU and LWE”, Cryptology ePrint Archive, Paper 2022 / 07; and in K. Kluczniak, “NTRU-v-um: Secure Fully Homomorphic Encryption from NTRU with Small Modulus”, Cryptology ePrint Archive, Paper 2022 / 089.

[0011] Interestingly, the output of programmable bootstrapping has a noise amount that is independent of the noise in the input ciphertext. Thus, by performing programmable bootstrapping, one can reduce the noise in the input ciphertext to a fixed amount, while possibly simultaneously applying a function to the input ciphertext. By performing programmable bootstrapping at the appropriate time, one can perform encrypted computations of unbounded multiplicative complexity.

[0012] While PBS operations are powerful, it is still challenging today to efficiently perform arithmetic operations (e.g., multiplication) on relatively large values (e.g., values defined modulo a modulus larger than 256 or larger than 1024). One reason for this is that PBS operations scale worse than linearly on the input size.

[0013] In the paper “Putting up the Swiss army knife of homomorphic calculations by means of TFHE functional bootstrapping” by P. Clet et al., Cryptology ePrint Archive, Report 2022 / 149, a technique to perform multiplication and addition on ciphertexts is presented, based on the method of digital factorization. This means that a value is encoded and encrypted by encrypting the factorization elements of the value modulo a base β. In this paper, the authors propose to use two or more programmable bootstrap additions per ciphertext that encrypts a factorized element. The additions are performed in a sequential manner. Multiplication is performed based on the textbook multiplication method. Despite these developments, further improvements are needed for the encryption of operations on large encrypted values. SUMMARY

[0014] The inventors noticed many drawbacks in the existing methods.

[0015] Some existing methods have a small precision for integer plaintexts using TFHE: when a single ciphertext is used to encrypt an integer, it is not feasible in practice to perform arithmetic operations such as multiplication on ciphertexts of more than 7-bit plaintexts.

[0016] Existing methods are also inefficient. Based on the method of converting computations to Boolean circuits, then evaluating the circuit by gate bootstrapping, the speed is significantly slowed down in practice when the plaintexts are not Boolean values. Moreover, existing methods that rely on encoding values using small integers (e.g., 1-bit or 2-bit integers) are slow because operations on these small integers usually use PBS constructions, or followed by a PBS, thus requiring a large number of expensive PBS.

[0017] Another drawback of existing methods is that they lack parallelism. For example, when integers are encoded by factorization of a base, performing an addition or multiplication can involve carry propagation along the MSB of the homomorphic integer, which is a sequential process. This means that the speed during evaluation of homomorphic circuits is slow when it can be parallelized.

[0018] Another drawback is the lack of flexibility. Existing implementations of arithmetic operations, such as addition with carry propagation or multiplication, do not allow for flexible adjustment of the way in which the arithmetic operation takes place depending on the size of the input, thereby optimizing performance for the current use case.

[0019] It is an object of the present invention to address at least some of these problems.

[0020] According to one aspect of the present invention, there is provided a method of performing an encrypted computation, as defined by the claims. According to yet another aspect, there is provided an apparatus corresponding to the computer-implemented method, as defined by the claims. According to a further aspect, there is provided a computer-readable medium, as defined by the claims.

[0021] Various aspects relate to performing an encrypted computation on a set of one or more encoded and encrypted values. These values can be numerical values, e.g., defined modulo some overall modulus q. Such values modulo modulus q can be interpreted as, e.g., unsigned integers (e.g., from the domain [0, q)); signed integers (e.g., [-q / 2, q / 2)); fixed-point numbers, etc.

[0022] Such encoded and encrypted values can be encoded and encrypted as an encryption of a plurality of respective sub-values, also referred to herein as "chunks". By way of example, the values and sub-values can be related to each other according to a base-number decomposition of a fixed base β. Several other ways in which the values and sub-values can be related are also possible, as discussed in detail elsewhere.

[0023] In one embodiment, the encryption of the sub-values is LWE encryption. In one embodiment, the encryption of the sub-values is NTRU encryption.

[0024] The encrypted computation can comprise applying one or more encrypted operations, e.g., arithmetic operations (such as addition and / or multiplication); function applications (such as applying ReLU, sign, exponential, or other monovariate functions); and / or other numerical operations, to the encoded and encrypted values of the set.

[0025] Such encrypted operations can generally take as input one or more encoded and encrypted input values (and optionally additional inputs, e.g., further encrypted or unencrypted values), and can produce one or more encoded and encrypted output values. Interestingly, these operations are performed in an encrypted manner, in the sense that they do not reveal information about the input and / or output values, in particular, the input values are not decrypted in order to perform the operations.

[0026] Interestingly, the inventors contemplate encoding and encrypting values as encrypted subvalues that allow carry to be preserved. The subvalues can have an associated message modulus, and a carry message modulus that is larger than the message modulus. For example, the subvalues can be defined according to a radix decomposition, where the radix is 8, and thus the message modulus is also 8, but can be encrypted as a value modulo a carry message modulus of 64. Accordingly, values can be encoded and encrypted without carry, meaning that the subvalues are non-carry subvalues that are less than the corresponding message modulus; but values can also be encoded and encrypted with carry, meaning that at least one of the subvalues is a carry subvalue that is greater than or equal to the corresponding message modulus.

[0027] Values that are encoded and encrypted with carry can correspond to their subvalues according to a relationship between the value and the non-carry subvalues, and according to a corresponding carry reduction operation (e.g., according to a radix decomposition with a message modulo β, and according to a carry reduction of a subvalue m to m mod β and a carry propagation to the next most significant value).

[0028] The inventors recognize that carry subvalues can be used not only in encryption operations, but also as inputs or outputs of encryption operations. An encryption operation (e.g., an addition, multiplication, another arithmetic operation, or evaluation of a univariate function) can be applied to at least one input value that is encoded and encrypted with carry, and can produce at least one output value that is encoded and encrypted with carry.

[0029] In some cases, the encryption carry reduction can be applied to the output value, where at least one carry subvalue can be reduced to a non-carry subvalue. However, in other cases, the output value can not be carry reduced, and can be input with carry to a further encryption operation (e.g., a further addition, multiplication, or other arithmetic operation). In any case, the encryption carry reduction can be applied during the encryption operation, e.g., to intermediate subvalues, if desired. Generally, the encryption carry reduction can be applied to guarantee that subsequent encryption operations do not produce subvalues that exceed the carry message modulus.

[0030] By allowing values that are encoded and encrypted with carry to be inputs and / or outputs of encryption operations, and by optionally performing carry reduction (in some cases, not to all carry subvalues of an encoded and encrypted value), the efficiency of encryption computations can be greatly improved, based on a number of reasons detailed below. Overall, the techniques provided enable encryption computations to be performed efficiently, e.g., evaluating arithmetic circuits on values that are encoded and encrypted into multiple subvalues. By selectively performing encryption carry reduction on selected subvalues, a configurable encryption computation technique is provided that allows for optimization of computation aspects before execution or on-the-fly during execution.

[0031] In particular, by using multiple sub-values, the lack of precision of some existing methods can be made up. This enables performing encryption computations on values defined modulo a relatively large modulus, for which embodiments will be given later.

[0032] By selective carry reduction, the number of carry reduction operations required can be greatly reduced; for example, compared to existing methods, encryption computations can be performed using a smaller number of programmable bootstrapping applications, thereby greatly improving efficiency. For example, multiple additions, other linear operations, or even multiplications of encrypted values can be performed without performing carry reduction in between. Various parameters can be varied, including the message modulus, the carry message modulus, and the encoding of the plaintext sub-values in the encryption process. This provides the possibility to optimize the homomorphic evaluation of a given encryption computation, improving flexibility and performance.

[0033] Furthermore, the provided technology provides improved parallelism. Since the output of the operations can have a carry, carry reduction between steps can be avoided, thereby performing one or a series of encryption operations on the respective sub-values in parallel. For example, when using encoding based on radix decomposition, additions can be performed separately on the respective sub-values. When using encoding based on a residue system, multiplication and carry reduction can also be parallelized. Thereby, performance is improved, in particular on multi-threaded and multi-core systems.

[0034] In particular, the above cited paper “Putting up the Swiss army knife of homomorphic calculations by means of TFHE functional bootstrapping” proposes an addition which is sequential and uses at least 2 PBS per ciphertext for the encrypted elements of the decomposition. In contrast, the provided technology allows to use only one PBS per ciphertext and to implement the addition only when a carry reduction of that ciphertext is required; if no carry reduction is required, the addition can be completely parallelized. Compared to the multiplication they propose, the provided technology is more efficient and can be better parallelized.

[0035] Generally, the encrypted computation can be performed in a TFHE setting. This means that the ciphertext for the encrypted subvalue allows programmable bootstrapping operations. In particular, the ciphertext can be LWE (Learning with Errors) encryption, i.e. encryption based on the cryptographic assumption that the learning with errors problem is hard. As known per se, programmable bootstrapping can evaluate LWE decryption in the exponent of a GLWE encrypted monomial (e.g. implemented as a so-called blind rotation). In particular, programmable bootstrapping can involve computing an encrypted polynomial product of a bootstrapping monomial representing a plaintext value as an exponent and a testing polynomial. The testing polynomial can represent a function applied to the input by the programmable bootstrapping. The programmable bootstrapping can use a bootstrapping key that is able to perform the programmable bootstrapping but not able to perform decryption of the ciphertext. The encrypted carry reduction and / or one or more encrypted operations of the encrypted computation can be implemented using the programmable bootstrapping operations.

[0036] Instead of using LWE / GLWE type ciphertexts, different lattice encryption can also be used. For example, the ciphertext to which the blind rotation is applied and / or the encrypted polynomial product resulting therefrom can be NTRU ciphertexts. For example, an NTRU encryption of a message μ can be defined by adding the quotient of a noise polynomial g and a private key polynomial f to the message, e.g. may be invertible polynomials (typically with small coefficients); and the NTRU encryption can be given by c = e1 / f + μ + e2, or written as g = e1+ f e2. In particular, the NTRU ciphertexts can only contain a single polynomial. The security of such ciphertexts can be based on the NTRU assumption.

[0037] In one embodiment, the ciphertext to which the blind rotation is applied can be an LWE type ciphertext. For example, the blind rotation can be part of the encrypted computation performed on the LWE type ciphertext (e.g. without involving any NTRU type ciphertexts). Or, the LWE type ciphertext can be obtained by conversion from an NTRU type ciphertext, e.g. as part of the encrypted computation performed on the NTRU type ciphertext. It is also possible to apply the blind rotation directly to the NTRU type ciphertext without conversion to LWE. More generally, the ciphertexts can be lattice type ciphertexts whose security depends on the cryptographic hardness of a lattice problem, LWE and NTRU being two examples.

[0038] ​In an embodiment, the output value can be computed by performing a plurality of cryptographic operations on a set of encoded and encrypted values, wherein the cryptographic operations are performed without performing any cryptographic carry reduction between or during the cryptographic operations. For example, the cryptographic operations can comprise a plurality of additions and / or a plurality of multiplications. For example, performing the cryptographic computation can comprise evaluating an arithmetic circuit comprising the cryptographic operations. The arithmetic circuit can have, for example, a multiplication depth of at least two (meaning that the output of one multiplication is used directly or indirectly as input to another multiplication) or a multiplication depth of at least three. By allowing carries, in some cases such computations can be performed without carry reduction at intermediate stages, or with any reduction of carries, thereby providing a significant performance improvement.

[0039] In an embodiment, the cryptographic operations can be applied by separately applying respective sub-operations to respective sub-values of the input values. In particular, performing the cryptographic operations can consist only of performing these sub-operations. For example, this can be the case for linear operations, or multiplications when using a residue system representation. In an embodiment, the separately applied cryptographic operations can be performed at least partially in parallel, which is advantageous for performance, in particular for multi-threaded systems and multi-core systems.

[0040] In an embodiment, encoding a value into non-carrying sub-values is based on a prime factorization of the value. In other words, a value encoded by a set of carrying and non-carrying sub-values can be computed by performing a carry reduction on the carrying sub-values and reconstructing the value from the prime factorization. The prime factorization can be with respect to a base of respective base elements, wherein respective message moduli correspond to respective base elements. Using a prime factorization for encoding allows relatively efficiently performing individual parts of a cryptographic computation, in particular arithmetic operations such as additions and / or multiplications and / or divisions; comparison operations such as determining which of two values is larger; and carry reduction.

[0041] A base element can define a total modulus corresponding to a product of respective base elements. Thus, a value modulo the total modulus can be encoded using a prime factorization with a given base. It is also possible to use a base in combination with a modulus smaller than the product of the base elements, as also described elsewhere in this specification.

[0042] The base elements can all be the same, e.g., all equal to 2 for base-2 radix decomposition, or all equal to 5 for base-5 radix decomposition. Interestingly, this is not necessary. In some embodiments, the base elements of a radix decomposition are not all the same. This provides greater flexibility in choosing base elements according to the size requirements of the current application, reducing overhead of using a modulus larger than necessary. In particular, the base elements need not all be the same power or power of two, or need not all be powers of two at all. The inventors realized that encryption computation techniques, particularly in the TFHE setting, can also be applied in this more general setting.

[0043] In one embodiment, the encryption carry reduction in a radix decomposition setting can be performed as an encryption of the respective subvalue of the output value with carry, and an addition of the subvalue encryption of that subvalue to the encryption of the corresponding subvalue of the output value. In this way, the subvalue with carry can be reduced to a value below the modulus of the message. By repeating this process for the respective subvalues with carry, an encoding and encryption of the value without carry can be obtained.

[0044] In one embodiment, an encryption multiplication of an encoded and encrypted value with a non-encrypted scalar can be performed. This encryption multiplication can be implemented by computing respective encrypted subvalues of the multiplication of the subvalues of the encoded and encrypted value with the scalar, e.g., using programmable bootstrapping. If a radix decomposition encoding is used, the results of the encryption multiplication can be combined to obtain an overall result. In this way, a multiplication with a relatively large scalar can be performed. For smaller scalars, the respective encrypted subvalues can also be directly multiplied with the scalar itself to obtain the respective encrypted output subvalues, for example. If a residue system encoding is used, the respective products of the respective subvalues can form the overall result.

[0045] In one embodiment, an encryption multiplication of a first encoded and encrypted value with a second encoded and encrypted value can be performed by performing an encryption multiplication of the subvalues of the first encoded and encrypted value and the second encoded and encrypted value. In a radix decomposition setting, the encryption multiplication of the subvalues can result in encoded and encrypted values. These encoded and encrypted values can be added together to obtain an overall result. During the multiplication, carry reduction can be performed as needed, e.g., as indicated by the degree of completeness of the computation as described herein. Interestingly, a particularly efficient multiplication of large encrypted values can be achieved in this way.

[0046] In one embodiment, values that are encoded and encrypted using base decomposition encoding are defined as modulo a modulus that is smaller than the maximum value that can be represented by the base decomposition (e.g., the product of the base elements). In this way, the number of cases in which base decomposition encoding can be used is greatly increased. For efficiency, base decomposition encoding preferably uses small base elements, in which case the maximum representable value is the product of such small base elements. Interestingly, the inventors realized that base decomposition encoding can still be used in cases where calculations are expected to be modulo a modulus that is not the product of small base elements. Various encryption operations can all be performed as if modulo the product of the base elements, except that the encryption carry reduction of the most significant sub-messages can be adjusted by a correction for carry reduction according to the desired modulus. For example, the correction can be performed by multiplying the most significant sub-value by a scalar, and subtracting the result from the value with the most significant sub-value removed.

[0047] In one embodiment, encoding a value into non-carrying sub-values is based on a residue system representation of the value. Such a representation is also referred to as a CRT (Chinese Remainder Theorem) representation. The representation can be based on a set of base elements that are co-prime. For example, the respective sub-values of an encoded and encrypted value can have message moduli that correspond to the base elements.

[0048] In particular, an encoded and encrypted value with carry can correspond to its sub-values according to a CRT decomposition with respective message moduli β i and according to a carry reduction of the respective sub-values m i to m i mod β i .

[0049] Similar to base representations, linear arithmetic operations can be implemented efficiently using CRT representations. Interestingly, CRT representations can also allow particularly efficient multiplication and carry reduction, both of which can additionally be performed separately on the respective sub-values, and thus in parallel. Furthermore, using CRT representations, various other types of operations are possible, such as applying a univariate function.

[0050] In one embodiment, encoding a value into non-carrying sub-values can be based on a residue system representation, and further based on a base decomposition of the elements of the residue system representation. Such a method is referred to herein as a "hybrid" method. For example, one, more or all elements of the residue system can be base decomposed according to respective (different or equal) base numbers. Using the hybrid method, the CRT method can be used efficiently using relatively large CRT base elements.

[0051] In one embodiment, when encoding elements represented in a residue system using a radix decomposition, the modulus with respect to which the element is defined (i.e. the corresponding base element of the CRT base) can be smaller than the maximum value that the radix decomposition can represent. As described generally for radix decompositions, the radix decomposition can still be used in this case, enabling it to be applied to a wider range of cases. This combination is particularly beneficial as it allows a better combination of the need for having coprime base elements in the CRT and having a radix decomposition using small base elements.

[0052] If the inputs and outputs of the cryptographic operations do not use carries, for example if the cryptographic carries are only used internally within the cryptographic operations; if the cryptographic carries are used directly after each cryptographic operation, such that the output is produced without carries; or if the cryptographic operations do not involve any carries at all, for example if they are implemented using programmable bootstrapping without carries, then several advantages of using the CRT representation are applicable, in particular the efficient and parallelizable cryptographic linear and multiplication operations. An encryption computation method is also envisaged that uses the CRT but does not involve applying a cryptographic operation to a value that is encoded and encrypted without carries.

[0053] In particular, an encryption computation method is envisaged that comprises accessing one or more encoded and encrypted values, wherein the encoding of the values into non-carry sub-values is based on a residue system representation of the values; and applying a cryptographic operation to at least one of the encoded and encrypted input values to obtain an encoded and encrypted output value. An encryption device corresponding to the method is also envisaged.

[0054] In one embodiment, performing a carry-in cryptographic computation can comprise tracking a degree of completeness of the sub-values of the encoded and encrypted values. The degree of completeness can indicate a bound of the sub-values, for example expressed as a maximum value that the sub-values are known to have, or a proportion of the maximum value relative to the carry message modulus. For example, for a value that is encoded and encrypted without carries, the degree of completeness can indicate that its sub-values are smaller than the corresponding message modulus. For a value that is encoded and encrypted with carries, the degree of completeness can indicate that at least one of its sub-values can be greater than or equal to the corresponding message modulus, in other words that it is not guaranteed to be smaller than the message modulus.

[0055] During and / or between the cryptographic operations, the degree of completeness can be used to determine whether to perform a cryptographic carry reduction on the encrypted sub-values. In particular, the degree of completeness of the carry-in sub-values to be computed in the cryptographic operation from one or more input encrypted sub-values can be determined. If the bound indicated by the degree of completeness exceeds the corresponding carry message modulus, then a cryptographic carry reduction can be applied to the one or more input encrypted sub-values before the carry-in sub-values are computed, such that the bound of the carry-in sub-values no longer exceeds the carry message modulus. Overflow of the sub-values can thus be avoided.

[0056] Interestingly, by keeping track of the degree of integrity during the cryptographic computation, a flexible way of performing the cryptographic computation can be obtained, in which it can be adaptively decided whether to perform the cryptographic carry reduction or not. Thus, the decision can depend on the current input, e.g. the public scalar used in the computation, the bound of the encrypted input provided by the inputter, the degree of integrity in a particular iteration of the iterative algorithm, etc. This will typically result in a more efficient execution of the cryptographic computation. Since it is not necessary to explicitly specify when to perform the carry reduction, it also makes it easier to specify the cryptographic computation. This can make the provided techniques particularly suitable for non-experts of cryptographic computations.

[0057] For example, the cryptographic computation can be performed in such a way that in a first execution, the cryptographic carry reduction of a certain encrypted subvalue occurs, while in a second execution, this cryptographic carry reduction is avoided. Furthermore, the operations of the cryptographic computation in the multiple executions can or can not include the cryptographic carry reduction, depending on the degree of integrity of its input. For example, a cryptographic multiplication or other cryptographic operation can include the cryptographic carry reduction of an encrypted subvalue computed during the multiplication in a first execution of the multiplication, but not in a second execution of the multiplication.

[0058] According to a further aspect of the invention, a compiler method and device are provided as defined in the claims. As the inventors realized, it is not necessary to keep track of the degree of integrity during the cryptographic computation. If the degree of integrity computation is part of the compiler method that compiles the computation into a homomorphic executable, many of the advantages of using the degree of integrity can be achieved as well. Namely, the homomorphic executable can be able to efficiently perform the cryptographic computation, in particular to perform the cryptographic carry reduction operation only when needed. The homomorphic executable can be executed by a cryptographic computation engine and cause the cryptographic computation engine to perform a cryptographic computation on a set of one or more encoded encrypted values as described herein. The homomorphic executable can include one or more instructions to perform a cryptographic carry reduction operation as described herein, e.g. as part of a cryptographic operation or between executions of a cryptographic operation. The compiler method can include determining, for a carry-in subvalue to be computed, a degree of integrity indicating a bound of the carry-in subvalue; and if the bound exceeds a corresponding carry message modulus, generating an instruction that causes the cryptographic computation engine to apply a cryptographic carry reduction before computing the carry-in subvalue. The compiler method can further include optimizing one or more parameters of the cryptographic computation, such as the number and values for the message and carry message moduli, for compiling the cryptographic computation into an executable.

[0059] In an embodiment, one or each message modulus is not a power of 2. Although existing techniques for cryptographic computation, particularly in the TFHE setting, typically use powers of 2 for their modulus, the inventors have realised that this is not necessary and the provided techniques can also be used when one or more message modulus is not a power of 2. Conversely or additionally, in an embodiment, one or more carry message modulus is not a power of 2. This allows better tailoring of the operations to the current situation, e.g. performing the computation on values defined by taking the modulus with a modulus that matches the computation and range of the current input values.

[0060] In an embodiment, the message modulus is at least 3 and / or at least 5 and / or at least 10. The advantage of using larger values for the message modulus is that the precision of a single ciphertext is higher, requiring fewer ciphertexts to represent a value. Furthermore, computations, particularly those that do not involve carry reduction, can be more efficient.

[0061] In an embodiment, the carry message modulus can be at least four times, at least eight times, or at least thirty-two times the corresponding message modulus. Thus, expressed in bits, in practice, at least two, at least three, or at least 5 carry bits can be provided. By using a carry message modulus that is significantly larger than the message modulus, the number of operations or number of operation steps that can be performed before carry reduction needs to be done is increased, improving efficiency.

[0062] In an embodiment, one or each carry message modulus is at most 128, at most 256, or at most 512. The efficiency of operations such as carry reduction using programmable bootstrapping scales worse than linearly with the size of the carry message modulus. By keeping the carry message modulus limited, the computational cost of such operations also remains limited.

[0063] In an embodiment, the modulus defining the encrypted values is at least 1024, at least 4096, or at least 16384. Interestingly, despite the use of such large moduli, the provided techniques still allow relatively efficient computation on them.

[0064] In an embodiment, the function evaluation on one or more encoded and encrypted values can be applied by extracting one or more bits from one or more sub-values of the encoded and encrypted values; converting the extracted bits to GGSW ciphertexts; and applying a lookup table to the GGSW ciphertexts. As explained in more detail elsewhere, this is a particularly efficient way of implementing a function, particularly for relatively large values, e.g. values for which the message and / or carry message modulus and / or the number of sub-values is relatively large.

[0065] In one embodiment, the cryptographic computation can include, at some point, evaluation of a multivariate function (e.g., a bivariate function) on multiple encrypted input values (e.g., subvalues). One important example of a multivariate function is the encryption of the multiplication of a first subvalue and a second subvalue, e.g., the same encoded and encrypted value or different encoded and encrypted values. For example, such an encrypted multiplication can arise as part of an encrypted multiplication of encoded and encrypted values, or as part of a different type of cryptographic operation. In any case, the multivariate function evaluation can be performed by determining a combined encryption representing the combination of the respective encrypted input values; and performing the multivariate function evaluation by applying a univariate function to the combined encryption, which corresponds to applying the multivariate function to the respective input values, e.g., by applying a programmable bootstrap to the combined encryption.

[0066] This is a particularly efficient way of performing a multivariate function evaluation that can also be well combined with determining the degree of integrity and using carryover. Specifically, when the encrypted input values carry over, there can indeed be enough room in the plaintext space to store the combined encryption; if necessary, an encrypted carryover reduction can be performed to ensure that the combined encryption does not overflow the carryover message modulus.

[0067] The provided techniques for improved computation of encrypted data can be applied to a wide range of practical applications. Such practical applications include performing cryptographic evaluations on software programs without access to the plaintext data. For example, one can evaluate a medical diagnostic software on medical data without actually accessing the medical data. The medical data can include medical images. The medical images can include multi-dimensional image data, such as two-dimensional (2D), three-dimensional (3D), or four-dimensional (4D) images, acquired by a variety of acquisition modalities, such as, but not limited to, standard x-ray imaging, computed tomography (CT), magnetic resonance imaging (MRI), ultrasound (US), positron emission tomography (PET), single photon emission computed tomography (SPECT), and nuclear medicine (NM).

[0068] In one embodiment, the provided techniques can be used to evaluate a neural network on encrypted inputs. The party evaluating the neural network can or can not have access to the training parameters of the neural network, such as the weights and biases, in plaintext. Overall, the techniques provided herein (e.g., improved polynomial multiplication, programmable bootstrapping, and external products) improve the efficiency of evaluating the neural network and / or reduce the storage and transmission requirements of the used ciphertext or key material.

[0069] One embodiment of the method can be implemented on a computer as a computer implemented method, or in dedicated hardware, or in a combination of both. Executable code for one embodiment of the method can be stored on a computer program product. Embodiments of computer program products include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Preferably, the computer program product comprises non-transitory program code stored on a computer readable medium for performing one embodiment of the method when said program product is executed on a computer.

[0070] In one embodiment, the computer program comprises computer program code adapted to perform all or part of the steps of one embodiment of the method when the computer program is run on a computer. Preferably, the computer program is embodied on a computer readable medium. BRIEF DESCRIPTION OF DRAWINGS

[0071] Further details, aspects and embodiments will be described with reference to the accompanying drawings, in which elements are illustrated for simplicity and clarity and have not necessarily been drawn to scale. In the figures, elements corresponding to elements already described can have the same reference label. In the figures,

[0072] Fig. 1a schematically illustrates an embodiment of an embodiment of an encryption device;

[0073] Fig. 1b schematically illustrates an embodiment of an embodiment of a compiler device;

[0074] Fig. 1c schematically illustrates an embodiment of an embodiment of an encryption computing system;

[0075] Figs. 2a, 2b schematically illustrate embodiments of a lookup table for programmable bootstrapping;

[0076] Fig. 3a schematically illustrates an embodiment with carry subvalues;

[0077] Fig. 3b schematically illustrates an embodiment of addition with carry subvalues;

[0078] Fig. 3c schematically illustrates an embodiment of scalar multiplication with carry subvalues;

[0079] Fig. 3d schematically illustrates an embodiment of an encryption multiplication operation with encryption of first and second subvalues;

[0080] Figure 4 An embodiment of a value encoded and encrypted based on prime factorization is schematically illustrated;

[0081] Figure 5 An embodiment of a value encoded and encrypted based on a residue system representation is schematically illustrated;

[0082] Figure 6 Embodiments of values encoded and encrypted based on a base decomposition and using a modulus smaller than the maximum value representable by the base decomposition are illustratively shown;

[0083] Figure 7 Embodiments of values encoded and encrypted based on a residue system representation and further based on a base decomposition of elements of the residue system representation are illustratively shown;

[0084] Figure 8 Embodiments of embodiments of encryption methods performing encryption computations are illustratively shown;

[0085] Figure 9 Embodiments of embodiments of compiler methods are illustratively shown;

[0086] Figure 10 A computer readable medium having a writable portion according to an embodiment is illustratively shown;

[0087] Figure 11 A representation of a processor system according to an embodiment is illustratively shown. DETAILED DESCRIPTION

[0088] While the presently disclosed subject matter can be implemented in many different forms, one or more specific embodiments thereof are shown in the drawings and will be described herein in detail. It is understood that the present disclosure should be considered as an exemplification of the principles of the presently disclosed subject matter and is intended to be as broad as the principles of the presently disclosed subject matter themselves, not as circumscribed as the particular embodiments illustrated and described.

[0089] In the following, for ease of understanding, elements of embodiments are described in terms of operations. However, it is clear that the respective elements are arranged to perform the functions described as being performed by them.

[0090] Furthermore, the presently disclosed subject matter is not limited to the embodiments, but comprises combinations of each of the other features described herein or recited in mutually different dependent claims.

[0091] First, some general information and notation applicable to several embodiments is provided. Throughout this specification, the parameter q denotes a modulus, e.g. a positive integer, used for encoding and encrypting values. Indication ring The parameter N denotes the size of the various polynomials used, and is typically a power of 2. Indication ring Indication ring χ σIndicates a Gaussian distribution with a mean set to zero and a standard deviation set to σ. The symbol || indicates concatenation. The most significant (or least significant) bit of an integer is called the MSB (or LSB). A lookup table is abbreviated as LUT. The computational complexity of the algorithm Alg depends on some parameters p1,…,p n .

[0092] The Chinese Remainder Theorem (CRT) is stated as follows. Let R be a ring, and let I0, I1, ..., I... n In R, for a certain Given that the numbers are coprime ideals, then the following ring isomorphisms exist:

[0093]

[0094] In this specification, the CRT indicator ranges from R to R / I0 × R / I1 × … × R / I n The state of the inverse CRT (indicated as iCRT) is R / I0 × R / I1 × … × R / I n Mapped to R.

[0095] Various implementations use LWE (Learning Tolerant Message) encryption. Generally, LWE-type ciphertext can include one or more mask values, and a body value derived from the mask values ​​and plaintext values. These values ​​are typically integers modulo a given modulus q. Various implementations also use GLWE (Generalized Learning Tolerant Message) type ciphertext. GLWE-type ciphertext can include one or more mask polynomials, and a body polynomial derived from the mask polynomials and plaintext polynomials. GLWE-type ciphertext can be defined modulo q and the quotient polynomial p(X). LWE ciphertext can be considered a special kind of GLWE ciphertext where the degree of the quotient polynomial is 1. Another special kind of ciphertext is RLWE (Ring Learning Tolerant Message) ciphertext, where the number of mask polynomials is 1.

[0096] Specifically, based on the secret key information The GLWE ciphertext can be defined as follows:

[0097]

[0098] here, It is a secret key with coefficients sampled from, for example, a uniform binomial distribution, a uniform trinomial distribution, or a Gaussian distribution. It is an appropriate scaling of the input message. It has, for example, from The coefficients of uniformly distributed sampling in In the polynomial, E is noise (error) polynomial in order to make its coefficients, for example, drawn from a Gaussian distribution χ σ sampling. The parameter k is a positive integer and represents the number of polynomials in the GLWE secret key. To simplify notation, S k+1 can be defined as -1. In this embodiment, the LWE ciphertext is a GLWE ciphertext with N = 1. In this case, the parameter n = k can be considered as the size of the LWE secret key, and both the ciphertext and the key can be denoted in lower case (e.g., ct q and s), respectively. In this embodiment, the RLWE ciphertext is a GLWE ciphertext with k = 1 and N > 1, for example, a power of 2.

[0099] Although, throughout this specification, the integer q is used to denote one ciphertext modulus, it is noted that multiple ciphertext moduli can be used in the encryption multiplication, for example, where modulus switching is used to align the ciphertexts to the same q when needed.

[0100] The above embodiments describe secret keys, symmetric variants of GLWE. As known per se, the techniques provided herein equally apply to public key variants. In the latter case, for example, the above secret key can be used as a private key, where the public key comprises an encryption of one or more zeros, for example, see R. Rothblum, “Homomorphic encryption: From private-key to public-key”, Theory of Cryptography (TCC 2011), Volume 6597 of Lecture Notes in Computer Science, pp. 219-234, Springer, 2011 (incorporated herein by reference).

[0101] Various embodiments operate in a TFHE setting, meaning that ciphertexts supporting Programmable Bootstrapping (PBS) are used. Programmable Bootstrapping can take an input as ciphertext and output a ciphertext of the same message or a function of that message with noise independent of the input. PBS can include a homomorphic decryption of the input ciphertext in the exponent of the evaluated polynomial. In general, in TFHE-like schemes, a secure set of encryption parameters can be chosen in order to minimize the computational cost while satisfying the required precision. Interestingly, such parameters can be chosen independently of the number of homomorphic operations and the depth of the circuit evaluated. Embodiments of encryption schemes that can be combined with the techniques provided herein in a TFHE setting are provided in the following references:

[0102] - [DM15] L. Ducas et al., “FHEW: bootstrapping homomorphic encryption in less than a second”, proceedings EUROCRYPT 2015;

[0103] - [CGGI16] I. Chillotti et al., “Faster fully homomorphic encryption: Bootstrapping in less than 0.1 seconds”, proceedings ASIACRYPT 2016;

[0104] - [CGGI17] I. Chillotti et al., “Faster packed homomorphic operations and efficient circuit bootstrapping for TFHE”, proceedings ASIACRYPT 2017.

[0105] - [BIPPS22] C. Bonte et al., “FINAL: Faster FHE instantiated with NTRU and LWE”, Cryptology ePrint Archive, Paper 2022 / 07.

[0106] Various embodiments are directed to performing encrypted computations on values that are encrypted as sub-values. In this specification, by way of illustration, these values are often presented as integers modulo a certain modulus. Such values modulo integers can be equivalently thought of as elements of discrete ring tori, as done in several of the references mentioned above. In particular, various references use the real ring torus to represent the message space and the ciphertext space, and implement 32 discretization by using the arithmetic modulus 2 64 or 2 . This can equivalently be seen as corresponding to performing computations with integers in with q = 2 32 or q = 2 64 . Thus, integers modulo a given modulus and discrete ring torus elements can be used interchangeably, in particular, in and homomorphisms, as also pointed out in the literature, see for example C. Boura et al., “CHIMERA: Combining Ring-LWE-based Fully Homomorphic Encryption Schemes”, J. Math. Cryptol., 14(1):316-338, 2020.

[0107] Programmable bootstrapping operations in TFHE-like schemes make them an attractive choice for a variety of applications. Since bootstrapping is relatively efficient compared to many other FHE schemes, it is more feasible to perform relatively complex computations (e.g., computations with a multiplication depth of at least 10, at least 50, or at least 100). In particular, the cryptographic parameters of a TFHE-like scheme can be chosen based on the desired precision and resulting computational cost, independently of the number of homomorphic operations and their circuit depth. In contrast, in other FHE schemes, bootstrapping is very inefficient, such that in practice these schemes are typically applied in a hierarchical fashion, meaning that their parameters are chosen depending on the given computation, such that it can be performed without bootstrapping. However, this hierarchical approach is not feasible for more complex computations, and thus TFHE-like schemes are particularly useful in this case.

[0108] Generally, the security of GLWE-based ciphertexts is based on the distribution of the secret key, as well as three main parameters: n = kN, where N is the degree of the quotient polynomial, k is the number of random masking polynomials of the ciphertext, and n is the length of the secret key; q, the modulus; and s, a statistical parameter of the noise, e.g., its standard deviation. Given these parameters, it is known per se how to evaluate the degree of security provided, see for example M. Albrecht et al., “On the concrete hardness of Learning with Errors”, Journal of Mathematical Cryptology, 9(3): 169-203, 2015 (incorporated herein by reference).

[0109] In embodiments herein, the parameters of LWE- and GLWE-based ciphertexts of the TFHE-like schemes used can be chosen based on the desired level of security, as well as based on the desired precision of the operations (such as linear combinations of LWE ciphertexts and / or application of programmable bootstrapping, in other words, the noise level resulting from the application of these operations). Interestingly, in the TFHE setting, the security parameters can be chosen independently of the computational complexity (e.g., independently of the multiplication depth of the computation). This is different from non-TFHE-like schemes, where the security parameters are typically chosen to limit or eliminate bootstrapping.

[0110] In particular, the LWE-based ciphertexts and / or GLWE-based ciphertexts used in the TFHE setup herein can use a relatively small modulus, e.g. a modulus of at most 32 bits, at most 64 bits or at most 128 bits. This modulus is typically chosen independently of the computation to be performed, e.g. according to a desired precision and / or efficiency. The parameters N, k and / or σ can be chosen to achieve a desired security level, typically also independently of the computation to be performed. For example, N can be set to at least 512 and / or at most 2048 or 4096, e.g. 1024. For example, in one embodiment, RLWE is used with N at least 512 and / or at most 2048 or 4096 (e.g. 1024) and k = 1. Such values of N are typically not used in non-TFHE class encryption schemes, where they would severely limit the computations that can be performed; instead, in non-TFHE class schemes, q and N are typically chosen according to a desired security level, so q can be much larger.

[0111] Figure la schematically illustrates an embodiment of an encrypted computing device 110. The device 110 can be used to perform an encrypted computation on a set of one or more encoded and encrypted values.

[0112] The encoded and encrypted values can be encoded and encrypted as encryptions of a plurality of respective sub-values. Here, the sub-values can have a corresponding message modulus and a carry message modulus that is larger than the message modulus. In the encoded and encrypted values, one or more values can be encoded and encrypted without a carry. In this case, the non-carry sub-values can be smaller than the corresponding message modulus. In the encoded and encrypted values, one or more values can be encoded and encrypted with a carry. In this case, at least one carry sub-value can be larger than or equal to the corresponding message modulus. The remaining zero or more sub-values can be non-carry sub-values.

[0113] The device 110 can comprise a processor system 130, a memory 140 and a communication interface 150. The memory 140 can comprise a local memory, e.g. a local hard drive or electronic memory. The memory 140 can comprise a non-local memory, e.g. a cloud memory. In the latter case, the memory 140 can comprise a memory interface to the non-local memory. The memory 140 can be used to store one or more encoded and encrypted values that are being computed, for example. The memory 140 can contain additional data, e.g. a bootstrap key for use in blind rotation as discussed elsewhere.

[0114] Device 110 can communicate internally, with other devices, external storage, input devices, output devices, and / or one or more sensors over a computer network. The computer network can be the Internet, an intranet, a LAN, a WLAN, etc. The computer network can be the Internet. The device can optionally include a connection interface 150 arranged to communicate with other devices as needed. For example, the connection interface can include a connector, e.g., a wired connector (e.g., an Ethernet connector, an optical connector, etc.) or a wireless connector (e.g., an antenna, e.g., a Wi-Fi, 4G, or 5G antenna). Communication (e.g., internal communication) can use other communication protocols or media, e.g., an internal data bus.

[0115] In device 110, communication interface 150 can be used to send or receive digital data. For example, device 110 can be configured to receive or send data representing one or more encoded and encrypted values and / or LWE encryption (e.g., representing input and / or output of an encryption computation). As another example, communication interface 150 can be used to receive data representing a bootstrap key.

[0116] Execution of device 110 can be implemented in a processor system 130 (e.g., one or more processor circuits, e.g., microprocessors), embodiments of which are illustrated herein. Device 110 can include multiple processors, which can be distributed over different locations. For example, device 110 can use cloud computing.

[0117] Processor subsystem 130 can be configured to apply an encryption operation to at least one input value encoded and encrypted with carry to obtain an output value encoded and encrypted with carry. Processor subsystem 130 can be further configured to apply an encryption carry reduction to the output value encoded and encrypted with carry to obtain a further encoding and encryption of the output value, in which at least one carry-encoded subvalue is reduced to a no-carry subvalue.

[0118] Processor subsystem 130 can be configured to obtain an encryption computation one or more inputs, e.g., including one or more encoded and encrypted values, and / or including one or more encrypted but not encoded values, which processor subsystem 130 can optionally convert to encoded and encrypted values as described herein. Encoded and encrypted values provided as inputs are typically encoded and encrypted without carry, although in principle it is possible to obtain inputs with carry. In addition to the inputs, processor subsystem 130 can obtain bounds on the encrypted values, e.g., as a degree of integrity or the like.

[0119] The processor subsystem 130 can be configured to output one or more outputs of the cryptographic computation, e.g., including one or more encoded and encrypted values, and / or including one or more encrypted but unencoded values, the processor subsystem 130 having determined the one or more encrypted but unencoded values, e.g., by converting an encoded and encrypted value to an encrypted value as described herein. When outputting an encoded and encrypted value, the processor subsystem 130 can be configured to apply an encrypted carry-reducing operation to output an encrypted and encoded value without a carry.

[0120] For example, the processor subsystem 130 can obtain input from / to the memory 130 and / or from / to another party via the communication interface 150 and / or output output to / from the memory 130 and / or to / from another party.

[0121] Some of the functional units shown in the figures can be functional units of a processor system. For example, the figures can serve as a blueprint of a possible functional organization of a processor system. In most of the figures, the processor circuitry is not shown separately from the units. For example, the functional units shown in Figs. 2 to Figure 6 The functional units shown in Figs. 2 to 5 (see below) can be implemented, in whole or in part, in computer instructions stored at a device, such as the device 110, e.g., in an electronic flash memory of the device 110, and executable by a microprocessor of the device 110. In a hybrid implementation, the functional units are implemented, in part, in hardware, e.g., as a co-processor, e.g., an arithmetic and / or cryptographic co-processor, and in part in software stored and executed on the device 110.

[0122] For example, the device 110 can be a device for performing a cryptographic computation. The cryptographic computation can employ homomorphic encryption cryptography. For example, the device 110 can be used to perform a cryptographic computation, e.g., even if the data is received in encrypted form, e.g., from a data provider, and even if the device 110 is unable to decrypt the data, the device can perform the computation. The computation can involve an encrypted operation and / or a carry reduction as described herein.

[0123] For example, the memory 140 can store encrypted data items, e.g., data items received from one or more data providers, or data items generated as intermediate or final results (e.g., outputs) of a computation. Typically, most or all of the data items on which the device 110 performs a computation are encrypted with a key (or keys) unknown to the device 110 - i.e., the device 110 can not be configured to obtain the plaintext data items corresponding to the encrypted data items (e.g., stored in the memory 140). The decryption key in plaintext form is secret to the device 110, although the encryption / decryption key can be available in encrypted form.

[0124] For example, the processor system can be configured to perform a series of homomorphic encryption operations. The encryption operations can include linear operations, such as addition, subtraction, and / or scalar multiplication; multiplication; univariate function evaluation; etc. Interestingly, using the provided techniques, a plurality of encrypted arithmetic operations can be performed on a set of encoded and encrypted values, e.g., an arithmetic circuit with a multiplication depth of at least two, at least three, or at least five, wherein the performing does not include an encrypted carry reduction.

[0125] Figure lb schematically illustrates an embodiment of an embodiment of a compiler device 119 for compiling a computation into a homomorphic executable. The homomorphic executable is executable by an encrypted computation engine and causes the encrypted computation engine to perform an encrypted computation on a combination of one or more encoded and encrypted values, e.g., by the device 110 of Figure la, as described herein. The homomorphic executable can include one or more instructions to perform an encrypted carry reduction operation, e.g., as part of an encrypted operation or between execution of encrypted operations, as described herein. The device 119 can itself perform the encrypted computation, e.g., the device 110 of Figure la can be combined with the device 119 of Figure lb.

[0126] The device 110 can include a processor system 139, a memory 149, and a communication interface 159. The processor system 139, the memory 149, and the communication interface 159 can be implemented as discussed for the respective components of Figure la. The memory 149 can be used to store a description of a homomorphic computation to be compiled into a homomorphic executable, e.g., stored as program code, an instruction graph, etc. The communication interface 159 can be used to receive the computation to be compiled. The communication interface 159 can be used to send the homomorphic executable.

[0127] The processor subsystem 139 can be configured to generate the homomorphic executable by converting the operations into homomorphic computation instructions, as known per se in the art. Interestingly, the processor subsystem 139 can be configured to track a degree of completeness of a subvalue of an encoded and encrypted value used in the encrypted computation. In this way, an encrypted carry reduction operation can be included in the homomorphic executable when needed. In particular, the processor system 139 can be configured to, for a carry-in subvalue to be computed, determine a degree of completeness indicative of a bound of the carry-in subvalue. If the bound exceeds a respective carry-in message modulus, the processor subsystem 139 can generate an instruction that causes the encrypted computation engine to apply an encrypted carry reduction before computing the carry-in subvalue. The processor subsystem 139 can be configured to optimize one or more parameters of the encrypted computation, such as the number and values for the message and carry-in message moduli, in order to compile the encrypted computation into an executable.

[0128] Figure lc schematically illustrates an embodiment of an embodiment of an implementation of the encrypted computation system 100. The system 100 is configured to perform encrypted computations using homomorphic encryption, e.g., fully homomorphic encryption.

[0129] The system 100 in this embodiment comprises a compiler device 111, a data provider device 113, and an encrypted computation device 112. The compiler device 111 can be combined in a single device with the encrypted computation device 112 or the data provider device 113. The device 112 can be configured to receive encrypted data items from the data provider 113. At least one or more data items can be received in encrypted form. One or more other data items can be received in plaintext form. The device 112 can be configured to receive from the compiler device 111 a homomorphic executable for performing an encrypted computation.

[0130] The device 112 can perform computations as described herein on the received data items and also possibly on stored data items. Interestingly, computations can be performed on encrypted data by the device without decrypting the data, e.g., without converting the encrypted data items to data in plaintext form.

[0131] The device 112 in this embodiment can be based on the device 110 of Figure la, e.g., can comprise the processor system 130, the memory 140, and / or the communication interface 150 of Figure la. Each of the devices 111, 112, 113 can be based on the device 119 of Figure lb, e.g., can each comprise the processor system 139, the memory 149, and / or the communication interface 159 of Figure lb.

[0132] Optionally, the compiler device 111 or the data provider device 113 can be further configured to generate keying material for the encrypted computation device 112 to perform the encrypted computation, e.g., including a bootstrap key for performing programmable bootstrapping as discussed herein. The device generating the keying material can provide the bootstrap key 151 to the device 112, e.g., by sending it via the computer network 150, uploading it to a shared memory, etc. The keying material can also be generated by a separate key generation device (not shown in this figure).

[0133] Although not shown in this figure, the encrypted computation system 100 can comprise multiple encrypted computation devices, e.g., two, three, or more than three. The encrypted computation can be distributed among the multiple encrypted computation devices. The encrypted computation devices can exchange intermediate computation results (typically encrypted) among each other, e.g., as an encoded and encrypted value comprising multiple encrypted sub-values. Each encrypted multiplication device can be implemented like the encrypted computation device 112 and can perform encrypted operations and / or encrypted carry-reducing operations as described herein.

[0134] Homomorphic encryption schemes can be applied in many settings. For example, the encrypted computing device 112 can be operated by a cloud provider. The cloud provider can provide computing and storage services to its customers. By employing homomorphic encryption, the data provider device 113 (e.g., a client of the cloud provider) can send its data in encrypted form. The cloud provider can still perform the required computations and / or the required storage, but cannot know the corresponding plaintext data. For example, the data provider device 113 can encrypt the data items using an encryption key of a type corresponding to the particular homomorphic encryption system used. When the data provider 113 receives the computation results from the encrypted computing device 112, the encrypted data items can be decrypted using a corresponding decryption key. The encryption key and the decryption key can be the same - and often are.

[0135] For example, the encrypted computing system 100 can be configured to train a machine learning model (e.g., an image classifier, e.g., a medical model), without the encrypted computing device having access to the plaintext data items. For example, a linear regression can be performed on the input data, possibly even without bootstrapping. For example, backpropagation can be performed on the input data, possibly with bootstrapping. The resulting model parameters can be returned to an entity that has the decryption key. This enables multiple providers of medical data to pool their data by sending the data to a cloud provider. The cloud provider then returns the model parameters without needing to access the plaintext data. The encryption key can be equal to the decryption key.

[0136] After the model is trained, the encrypted computing system 100 can be used to provide the model, e.g., for use with medical data. This can be done using plaintext model parameters or encrypted model parameters - in both cases using encrypted data (e.g., encrypted input data, intermediate data, and output data). Using plaintext model parameters is typically more efficient. In both cases, one effect of the system is that computations (e.g., image classification, e.g., medical image classification) are performed without the computer knowing the plaintext data items. For example, a mammogram can be used to assess cancer without the image ever being presented in plaintext on the encrypted computing device 112 and without any encrypted computing device 112 or coalition of such devices knowing the result of the cancer assessment. From a privacy perspective, it can be acceptable to operate a plaintext model on encrypted privacy-sensitive data, while it can be unacceptable to operate on plaintext privacy-sensitive data.

[0137] Other applications involve database services, e.g., finding encrypted data in an encrypted database; e.g., computations can be comparisons between input terms and database terms. Multiple computations can be combined, e.g., to produce a database index that matches an index. The database can be a genomic database, e.g., and the input can be a genetic sequence. The system 100 can be used for protective control of a device, e.g. A device, even a large device such as a power plant, can send sensor values to an encrypted computation device 112 and receive an encrypted control signal as a return. The control signal is computed from the sensor signals. An attacker of the system can be able to determine the content of data going into and out of one or more encrypted computation devices 112, or even gain access to intermediate data of these devices, but this will not help him since the data is encrypted. Since the decryption keys are unknown to these devices, even if all of the encrypted computation devices 112 of the system 100 are completely broken, the data will not be compromised. The computations on the control signal can involve mathematical operations such as linear algebra, averaging, matrix multiplication, polynomial evaluation, etc., all of which can be performed with homomorphic encryption operations. In any case, such applications will involve computations that include arithmetic operations on relatively large numerical values, which can be efficiently implemented as described herein.

[0138] For example, a pool of encrypted data terms can be maintained in an encrypted computation system; a subset of them can be received, another subset can be the result of an encrypted computation, e.g., an intermediate result. For example, an encrypted computation device 112 can be configured to apply a homomorphic encryption operation to one, two, or more encrypted data terms in the pool, e.g., a set of input values and / or intermediate values and / or output values. The result can be a new encrypted data term that can be stored in the pool. For example, one or more values can be encoded and encrypted, while other zero or more values can be directly encrypted without encoding. The pool can be stored in a memory of the encrypted computation system. This can be local memory or distributed memory. In the latter case, it can happen that one or more encrypted data terms are represented multiple times in the pool. For example, if the value of an encrypted data term is needed elsewhere, the encrypted data term, in particular the encoded and encrypted data term, can be sent from one computation device to another. The pool can be implemented in a variety of ways, e.g., as a register file, an array, a variety of data structures, etc.

[0139] The encrypted data items can represent various data. For example, the encrypted data items can represent numbers that need to be averaged, or numbers used for linear regression, etc. For example, the encrypted data items can represent images. For example, each pixel of an image can correspond to one or more encrypted data items. For example, a grayscale pixel can be represented by a grayscale level, which in turn can be represented by a single encrypted data item. For example, 256 grayscale levels can be encoded in a single encrypted data item. For example, a color pixel can be represented as multiple color levels, e.g. RGB levels, which in turn can be represented by a tuple of encrypted data items. For example, three 256-level colors can be encoded as respective encoding values or encoded and encrypted values.

[0140] A set of homomorphic encryption operations can be defined for the computation. For example, from the homomorphic encryption operations, a network or circuit of operations can be constructed that implements the computation together, e.g. by a compiler device as described for Fig. lb or by the computing device itself. For example, the operations can include Boolean operations. The way the homomorphic encryption operations are combined (e.g. which operation is applied to which operand in the pool) determines the computation being performed. For example, the computation can be represented as a list of homomorphic encryption operations to be performed and an indication of on which encrypted data item to perform. The network or circuit can indicate to the encrypted computing device 112 when to do an encrypted carry reduction, and / or the encrypted computing device 112 can determine whether to do an encrypted carry reduction computation based on tracking how complete the sub-values being computed are.

[0141] Figs. 2a, 2b schematically illustrate embodiments of programmable bootstrapping lookup tables.

[0142] In various embodiments, the encrypted computation is an encrypted computation in a TFHE setting. In this setting, the encryption scheme used (e.g. LWE encryption) can support programmable bootstrapping operations. As known per se, such programmable bootstrapping can evaluate LWE decryption in the exponent of a GLWE encryption monomial. As known per se, by using a respective test polynomial in the programmable bootstrapping operation, programmable bootstrapping can be used to evaluate various functions on the LWE encryption to which it is applied. As also described elsewhere, programmable bootstrapping can be used to do encrypted carry reduction, as well as various other operations, such as single variable function evaluation.

[0143] One embodiment of a programmable bootstrapping operation is now discussed. The bootstrapping can evaluate a single variable function and simultaneously reduce the noise of the input ciphertext. Throughout this entire specification, the notation PBS is used to indicate programmable bootstrapping. The function that evaluates on the input can be represented as a lookup table (LUT). The lookup table can correspond to a test polynomial that can be multiplied with a GLWE encryption monomial. By computing the GLWE encryption monomial and multiplying it by the test polynomial, the lookup table can be effectively rotated to output the correct element in the table.

[0144] A visual representation of a polynomial storing a LUT is shown in Fig. 2a. In this embodiment, an array is shown whose respective elements 201-204 represent the respective coefficients of the polynomial The function can be the identity function, in which case programmable bootstrapping can implement regular bootstrapping.

[0145] In various cases, a redundant lookup table can be used. Specifically, for a given value r, an r-redundant LUT can be used, in which the coefficients are repeated r times in succession. This is illustrated in Fig. 2b. In this embodiment, the LUT for the function f is represented as an array comprising 16 repeated respective blocks 210, 211, 212 of each output value. The PBS can be used with redundancy to reduce noise in the input ciphertext.

[0146] The PBS can use a bootstrapping key. The bootstrapping key can comprise GGSW encryption of respective elements of a secret key used to encrypt the input LWE ciphertext of the PBS. Bootstrapping can comprise a modulus switching operation in which the input LWE ciphertext in is converted to a scaled ciphertext, e.g. an element from The public bootstrapping key can be used to apply a blind rotation to the LWE ciphertext resulting from the modulus switching to effectively rotate the GLWE encryption of the redundant LUT. A sample extraction operation can be applied to extract fixed coefficients (e.g. constant coefficients) of the GLWE encryption as LWE ciphertext.

[0147] Throughout this specification, the following notation can be used to indicate the performance of a programmable bootstrapping operation:

[0148] ct out ← PBS (ct in , BSK, P f ),

[0149] where

[0150] The PBS can be performed with a computational complexity of

[0151]

[0152] where

[0153]

[0154] Various existing implementations of programmable bootstrapping operations, such as the implementation of “Programmable bootstrapping enables efficient homomorphic inference of deep neural networks”, can operate on input ciphertexts for which the most significant bit is zero.

[0155] As an example, NTRU-type encryption can be used for the input ciphertext and / or for the encrypted polynomial product. More generally, the provided techniques can be applied to any blind rotation of an encrypted polynomial product of a test polynomial and a bootstrapping polynomial modulo a quotient polynomial different from X N + 1, such as any accumulator-based blind rotation.

[0156] In particular, with respect to using NTRU for the encrypted polynomial product, it is noted that the “blind rotation” algorithm as discussed itself uses an abstract accumulator ACC. While this accumulator can be based on GLWE as discussed, this is not necessary. Other types of accumulators are possible, such as an NTRU-based accumulator. Based on the NTRU ciphertext, a gadget encryption similar to GGSW encryption can be defined, and using this an outer product can be defined. Detailed embodiments can be found in C. Bonte et al., “FINAL: Faster FHE instantiated with NTRU and LWE”, Cryptology ePrint Archive, Report 2019 / 1280, https: / / eprint.iacr.org / 2019 / 1280. https: / / ia.cr / 2022 / 074 Thus, the accumulator can be implemented based on NTRU, where its value can for example contain elements of and CMux can be defined.

[0157] As an example, applying the blind rotation to an LWE ciphertext c that encrypts μ using such a type of NTRU-based accumulator can result in an encrypted polynomial product of a bootstrapping monomial in for some scaled plaintext m' · Δ and a test polynomial P f In this case, the encrypted polynomial can be an NTRU ciphertext of the form Using an appropriate key-switching key, it is optionally possible to extract from this encrypted polynomial an LWE ciphertext that encrypts the constant term of as discussed in the “FINAL” reference.

[0158] ​Instead or in addition to the encryption polynomial, the input ciphertext does not have to be of LWE type. In particular, blind rotation can be applied to NTRU type ciphertexts, as discussed in the “FINAL” reference. It is also possible to obtain the input LWE ciphertext by converting from an NTRU ciphertext, as described in the “FINAL” reference.

[0159] Also in this case, it is desirable to define the test polynomial P f such that the encryption polynomial multiplication contains the desired output value of the fixed coefficient.

[0160] Interestingly, it is also possible to use the techniques provided in this specification in combination with a programmable bootstrapping without padding, which means that the programmable bootstrapping can operate on input ciphertexts with arbitrary most significant bits. Such programmable bootstrapping is provided for example in I. Chillotti et al., “Improved programmable bootstrapping with larger precision and efficient arithmetic circuits for TFHE”, proceedings ASIACRYPT 2021. In this case, when using Encode as described elsewhere in this document, one can use instead of

[0161] Yet another way of performing programmable bootstrapping is by extracting the respective bits of the ciphertext and converting them into GGSW ciphertexts, e.g. using a circuit that bootstraps itself; and applying a lookup table to the respective GGSW ciphertexts. The latter can be performed particularly efficiently using hybrid padding, e.g. horizontal and / or vertical padding, as known per se. Moreover, with this technique for performing programmable bootstrapping, it is possible that no padding bits are needed, e.g. the most significant bits can hold arbitrary values. This technique will be discussed in more detail with respect to Figure 4 .

[0162] In general, programmable bootstrapping can include a key-switching operation that is performed such that the output ciphertext is encrypted under the same key as the input ciphertext. Throughout this entire specification, the notation PBS-KS can be used to indicate such programmable bootstrapping that includes key-switching. In this case, the key material PUB for the programmable bootstrapping can include a key-switching key for performing this key-switching. In general, performing key-switching is optional. The complexity of PBS-KS is where denotes the complexity of the key-switching.

[0163] Fig. 3a schematically illustrates an embodiment with carry-in subvalues.

[0164] In various embodiments, a value can be encoded and encrypted as an encryption of a plurality of respective sub-values, e.g. corresponding to respective digits of a base-β base decomposition of the value. In accordance with this correspondence, the respective sub-values can be associated with a certain modulus, referred to as the message modulus. For example, when using a base-β base decomposition, the message modulus can be set to β. Thus, a value can be encoded and encrypted by encoding the value as sub-values modulo the message modulus and encrypting these sub-values.

[0165] Interestingly, however, in various embodiments described herein, the sub-values can be stored with a carry. This means that the sub-values are defined modulo a carry message modulus p which is larger than the message modulus. Thus, the sub-values can be larger than the message modulus.

[0166] The respective sub-values can each be encrypted according to the same encryption key, but this is not required. In the latter case, various operations on the encoded and encrypted value, such as the carry propagation described herein, can use the key switching as required, e.g. from the encryption key of one sub-value to the encryption key of another sub-value.

[0167] For example, as exemplified in Fig. 3a, a ciphertext can encrypt a value which is characterized by:

[0168] - optionally padding bits 301 which are set to zero as their most significant bits;

[0169] - a carry message modulus p, 302 and a message modulus β, 303, e.g. a base decomposition base, such that β≤p (note that p and β need not be powers of 2);

[0170] - a value x, e.g. a non-carry value x which is smaller than β or a carry value which is larger than or equal to β and smaller than p.

[0171] For example, the carry message modulus p can be at least four times the message modulus β, at least eight times the message modulus, or at least 32 times the message modulus. For example, the carry message modulus can be at most 128, at most 256, or at most 512. Given a message of a certain size, e.g. at most 8 bits or at most 16 bits, the remaining space of the carry message modulus can be used for carries.

[0172] For example, Fig. illustrates a value with a message modulus β = 4 = 2 2 and a carry message modulus p = 16 = 2 2+2 Encryption using this message modulus and carry message modulus can have 2-bit carries which are set to 0 for non-carry values and can be advantageously used in encryption operations.

[0173] For example, a non-carry value m can be scaled according to the following algorithm and then the scaled version For example, The LWE encryption is performed on a non-carry value m. This example algorithm takes an integer between 0 and p, while providing a padding bit and more space to compute the hierarchical operations.

[0174]

[0175] The encryption operations can result in an encrypted value that increases, in particular, becomes larger than the message modulus. In particular, the most significant part (e.g., the most significant bit) of the encrypted value that corresponds to dividing the encrypted value by the message modulus can represent a carry, and can be referred to herein as a “carry buffer”.

[0176] Two embodiments of this are illustrated with respect to Figures 3b and 3c. Figure 3b illustrates the encryption of the addition of two values 311, 312 that do not have a carry encryption (e.g., the carry buffer and padding bit are set to zero). As illustrated in the figure, the value encrypted by the resulting ciphertext 313 can exceed the message modulus, i.e., the value can be a carry-in subvalue. In this particular case, as shown in the figure, one carry bit 314 can be consumed by the addition.

[0177] Figure 3c illustrates another embodiment. This figure illustrates the encryption 321 of a non-carry value with a scalar multiplication by a scalar (i.e., non-encrypted value) μ<β, resulting in an encrypted value 322. In this case, the number of carry bits 323 that can be affected is proportional to the size of the constant.

[0178] Returning to Figure 3a. As illustrated in Figures 3b and 3c, various encryption operations can result in a carry-in encoded and encrypted value; that is, a value that has a carry-in subvalue that is larger than or equal to the corresponding message modulus. Or at least, for some subvalues, it can not be guaranteed that they do not contain a carry. While an encryption carry reduction operation can be performed directly on such a carry-in value to reduce its value below the message modulus, the inventors realized that this is not always needed. In some cases, the carry-in encrypted subvalue can be kept, and this carry-in encoded and encrypted value used as input for another encryption operation.

[0179] However, at some point, an encryption carry reduction can be needed, e.g., if the encryption operation or sub-operation to be applied can potentially result in a value that exceeds the corresponding carry message modulus. Thus, it can be determined whether to perform an encryption carry reduction on a carry-in value at some point during the encryption computation.

[0180] Interestingly, to determine whether to perform an encrypted carry reduction, the inventors envision keeping track of a degree of integrity of the carry-in subvalue computed as part of an encrypted operation. The degree of integrity can indicate a bound on the carry-in subvalue. The degree of integrity can be considered as metadata related to the ciphertext. The degree of integrity can indicate whether an encrypted (e.g., leveled) homomorphic operation can be applied to the ciphertext, or whether the carry-in needs to be first flushed. The degree of integrity can quantify the number of leveled operations that can still be performed when a leveled operation can still be computed.

[0181] The degree of integrity is typically computed dynamically while performing an encrypted computation, although it can also be computed by a compiler device, as also discussed elsewhere. Keeping track of the degree of integrity during computation can be referred to here as a "smart" variant of performing an encrypted computation with encrypted carry reduction. The smart encrypted computation can verify certain conditions to automatically decide whether the carry-in buffer must be flushed or whether another leveled operation can still be performed. In that sense, the smart encrypted computation can be seen as an improvement over a setup in which subvalues do not need to be binary and carry-in can be preserved between encrypted operations to perform more leveled operations between bootstraps. Interestingly, it can not be necessary to determine when to perform encrypted carry reduction during design time of an encrypted computation, as the smart encrypted computation can automatically determine whether to perform encrypted carry reduction.

[0182] In particular, the ciphertext can be used to encrypt a subvalue within a particular interval defined by the degree of integrity. The encrypted subvalue can be used as input to a leveled homomorphic operation, which can result in a different, typically larger, interval. In particular, the most significant part of the subvalue can be padded with a carry-in. This part of the encrypted subvalue can be referred to as a carry-in buffer.

[0183] In particular, an encrypted value m (e.g., a subvalue of an encoded and encrypted value) encrypted under a key s can be represented together with its related degree of integrity as a so-called Arith ciphertext defined as

[0184]

[0185] where

[0186] In particular, the degree of integrity can be defined as follows. Let be a carry-in message modulus, and let be a message modulus (which can or can not be a power of 2), e.g., a radix decomposition base, such that β≤p. Let ct be a ciphertext encrypting a value m<p. Let μ be a known worst case for m, e.g., m can be the largest integer such that 0≤m≤μ. (where The degree of integrity of a ciphertext ct can be defined as the following value:

[0187]

[0188] Using this definition, if the degree of a ciphertext ct reaches 1, it means that this ciphertext is likely encrypting the value p - 1, which is the largest integer that can be stored by such a ciphertext without consuming padding bits (or without overlapping, if no padding bits are used). Thus, when deg ~ 1, a carry reduction can be performed. In other words, for a carry-in subvalue to be computed, it is possible to determine the degree of integrity that it would produce, and if it is greater than 1, then a cryptographic carry reduction can be performed before computing the carry-in subvalue.

[0189] Although the above is used throughout this specification as an illustrative definition of the degree of integrity, other definitions are possible. For example, the degree of integrity can be defined by the overall size of the interval of possible values of the value, or by the minimum and maximum possible values of the encrypted value, etc. In any case, the degree of integrity can indicate the bounds of a carry-in subvalue, and if it is determined that its bounds exceed the corresponding carry-in message modulus of the carry-in subvalue to be computed, then a cryptographic carry reduction can be applied before computing said carry-in subvalue.

[0190] In particular, the degree of integrity of an encrypted value can be finer than indicating whether the value contains a carry or not, or finer than counting the overall number of carry bits that the value has. Thereby, a tighter worst-case estimate of the level of consumption of carry bits can be obtained, allowing an increased number of staged arithmetic operations before performing a carry extraction.

[0191] It is now exemplified how the degree of integrity can be computed for various homomorphic arithmetic operations on encrypted values, in particular for addition, subtraction, and scalar multiplication. In general, the degree of integrity can be determined by determining the bounds of the output of the operation based on the bounds of the respective inputs. Such bounds can generally depend on how the operation is implemented, and in many cases can be derived from the implementation.

[0192] It is further shown how a permission check can be defined for a homomorphic operation to determine whether the operation can be performed without exceeding the carry-in message modulus. As discussed elsewhere in this specification, an operation on encoded and encrypted values can be implemented in terms of such operations on encrypted values.

[0193] In the following discussion, two Arith ciphertexts and are said to be “compatible” when:

[0194]

[0195] In particular, the degree of integrity of an encrypted addition can be computed. The following illustrates the homomorphic addition of two ciphertexts and with degrees of integrity deg1 and deg2, respectively. The output is a new ciphertext that encrypts the addition of the two original messages with updated degrees of integrity

[0196]

[0197] This algorithm can be applied if the inputs are compatible and The computational complexity of the addition algorithm can be

[0198] As another example, the degree of integrity of an encrypted negation can be determined. In particular, the following illustrates the homomorphic negation of a ciphertext that encrypts a message m. The output is a new ciphertext that encrypts the negation of the original message with an updated degree of integrity deg out . Let ζ be defined as:

[0199]

[0200] This value is useful for the Neg algorithm. By defining the degree such that 0≤m≤μ. Then, there is no sign:

[0201]

[0202] Thus, z can represent the smallest multiple of β such that μ≤z. This value can represent the worst case for the negation.

[0203]

[0204] This algorithm can be applied if The computational complexity can be

[0205] Another example is the computation of the degree of integrity of an encrypted subtraction. The following illustrates the homomorphic subtraction of two LWE ciphertexts and with degrees of integrity deg1 and deg2, respectively. The output is a new ciphertext that encrypts the subtraction of the two original messages with updated degrees of integrity.

[0206]

[0207]

[0208] If the input is compatible, and then the algorithm can be applied. The computational complexity of the subtraction may be

[0209] Another embodiment is the encrypted scalar multiplication, in other words multiplication by a value known to the party performing the encrypted multiplication. The homomorphic scalar multiplication between ciphertext and a known integer μ is exemplified below. The output is a new ciphertext which encrypts the product of the original message with μ.

[0210]

[0211] If then this algorithm can be applied. The computational complexity of the scalar multiplication algorithm may be

[0212] An alternative way of performing multiplication is by using programmable bootstrapping. Programmable bootstrapping typically resets the degree of integrity to a value that does not keep the carry.

[0213] Figure 3d schematically illustrates an embodiment of an implementation of an encrypted multiplication operation of a first encrypted value and a second encrypted value. The values may, for example, be subvalues of respective encrypted and encoded values whose product is being computed. It also illustrates how the degree of integrity is computed.

[0214] This technique of computing an encrypted multiplication of two ciphertexts can have independent interest, for example it can also be used for encrypted computations that do not involve carry-encoding and encrypted values, or even for encrypted computations that do not involve encoded and encrypted values at all. Thus, such an encrypted computation can comprise accessing a set of encrypted values and performing an encrypted computation, including computing one or more encrypted multiplications, as discussed in relation to this figure.

[0215] The encrypted multiplication operation can be used to compute the most significant part of the product of two encrypted values 331, 332, for example the product of two values x y mod β defined by β taking or the least significant part of the product of two values x y mod β defined by β taking

[0216] The encrypted multiplication operation can be performed by first determining a combined encryption 333 containing both the first and second sub-values; then applying a programmable bootstrap 334 to the combined encryption 333 to obtain a result 335. In particular, to obtain the combined encryption 333, the first encrypted value 331 can be scaled, or in other words, shifted; and the shifted ciphertext 336 can be added to the un-scaled second encrypted value 332.

[0217] In particular, the least significant part of the product can be computed:

[0218]

[0219]

[0220] This technique can be applied to compatible ciphertexts, where The computational complexity of the LSB multiplication algorithm Can be

[0221] A similar algorithm can be used to compute the MSB rather than the LSB. Different lookup tables are used for the final programmable bootstrap:

[0222]

[0223]

[0224] As noted above, the computational complexity of this algorithm can be

[0225] More generally, one or more input ciphertexts (e.g., encrypted sub-values) can be evaluated for a multi-variate function by determining a combined encryption representing the respective encrypted input values; and applying a single-variate function to the combined encryption, e.g., by a programmable bootstrap. MulLSB and MulLSB are examples of this, but this technique is applicable to other multi-variate (e.g., bi-variate) functions as well. Interestingly, in this way, a multi-variate function can be evaluated efficiently using a single programmable bootstrap.

[0226] In particular, consider a bivariate function, e.g. a lookup table l(m1, m2). In this case, the two messages m1, m2 can be combined by, e.g., shifting one of the two ciphertexts. Thus, the messages can effectively be moved to higher positions in the MSB. The shifted ciphertext can be added to the other ciphertext. For example, the ciphertext ct2 can be multiplied by (μ1+1) and then added to ct1. In this way, no information is mixed even in the worst case scenario. This can be possible if the degree of the ciphertexts and the result of the combination (e.g. multiplication by a constant and addition) are both degree and noise compliant. Once the two messages are combined into a single ciphertext, the bivariate function l can be evaluated as a univariate LUT l' in the concatenation.

[0227] The same technique can be applied to multivariate functions with more than two inputs if the degree of the ciphertexts participating in the computation and their amount of errors allow the steps leading to the concatenation to be performed. The output degree can also be computed in the same way as for univariate functions when the function is multivariate.

[0228] Returning to Figure 3a.

[0229] An alternative to the encryption multiplication of Figure 3d is now discussed, which is less efficient but can be preferred in some cases due to its lower required precision. For this alternative, it is also illustrated how the degree of integrity can be determined.

[0230] In this embodiment, the LSB result of the homomorphic multiplication of two ciphertexts and is determined. The output is a new ciphertext which encrypts the LSB part of the product of the two original messages with their updated degree of integrity. Interestingly, the two input messages only need to contain enough space to compute the LWE addition / subtraction. This implementation relies on the relation

[0231]

[0232] Thus, the multiplication can be performed in terms of LWE addition, LWE subtraction, evaluation of an appropriate univariate function using programmable bootstrap (in this case, the function ), further LWE subtraction, and optional programmable bootstrap procedure to reduce the result:

[0233]

[0234] The above procedure can be applied to compatible inputs where the parameters of Arith::Sub fit the algorithm, and The computational complexity of this version of the LSB multiplication algorithm can be

[0235] Another embodiment of the operation that can determine the degree of integrity is extracting the carry from the ciphertext. This operation can be used to implement cryptographic carry reduction, as discussed elsewhere. Specifically, the algorithm below takes Arith ciphertext with a certain degree of integrity as input and performs PBS to extract the portion of the message that overflows the base β into another Arith ciphertext.

[0236]

[0237] if This process can then be applied. The computational complexity can be...

[0238]

[0239] Another operation that can determine the integrity level is message extraction modulo the message modulo. Specifically, the algorithm below takes an Arith ciphertext with a certain integrity level as input and performs PBS to extract the portion of the message that does not overflow β into another Arith ciphertext.

[0240]

[0241]

[0242] if Then the above process can be applied. The computational complexity can be...

[0243] The underlying operations can be defined. In some cases, it may be necessary to change them during cryptographic computation. The basis of ciphertext, for example, is to ensure compatibility between ciphertexts. For this purpose, an algorithm can be defined that will... and basic (p) out ,β out Take m as input and return the ciphertext encrypted in the new foundation. This algorithm can be implemented via a programmable bootstrap and can be specified as follows:

[0244]

[0245] if This algorithm can then be used and has computational complexity.

[0246] In further operations, the encrypted value can be multiplied by a scalar (i.e., a value known to the party performing the encryption computation), while simultaneously changing the basis (β, p) of the ciphertext. This operation can be implemented as follows:

[0247]

[0248] If then this algorithm can be used and can have a computational complexity

[0249] In general, for a carry-in value to be computed during an encrypted computation, such as a carry-in subvalue of an encoded and encrypted value, an integrity degree can be determined, and if the integrity degree so indicates, an encrypted carry reduction can be applied to the input used to compute the carry-in value.

[0250] To this end, it can be verified whether a carry buffer will overflow when computing a carry-in value, and if so, the carry can be reduced by clearing (e.g. for a CRT representation) or carrying (e.g. for a radix representation representation), as the case can be. For an encoded and encrypted value to be computed, zero, one or more, or all subvalues can be subject to carry reduction, as the case can be. In case of an operation (e.g. addition) with multiple input values, carry reduction can generally be applied to zero, one or more, or all input values. The encrypted operation thus obtained can be referred to as a “smart version” of the encrypted operation, which corresponds to the original operation, but verifies for the respective suboperations whether a carry buffer can possibly overflow, and performs a carry reduction in such a case.

[0251] Figure 4 Embodiments of encoded and encrypted values based on a radix decomposition (also referred to as RadModInt representation) are schematically illustrated.

[0252] In particular, a value can be encoded into a plurality of respective subvalues m according to the relation i The vector is referred to as the basis of the radix decomposition. As in a conventional radix decomposition, the basis elements can all be equal to the same value b, in which case the radix decomposition can also be referred to as a radix-b radix decomposition. However, it is also possible that not all basis elements are the same. This is also referred to as a mixed-radix representation. This increases the flexibility of the moduli that can be represented. In any case, an encoded value can be defined as a value modulo the total modulus of the radix decomposition (or a smaller modulus discussed with respect to Figure 6 ).

[0253] In particular, a value 0≤m<M can be encoded and encrypted by encoding the value 0≤m<M according to the following steps and encrypting the resulting encoded subvalues:

[0254]

[0255]

[0256] Notably, such encoding can be combined with programmable bootstrapping using padding bits or PBS without padding, as desired.

[0257] By using a radix decomposition, one can perform cryptographic computations on values defined modulo a total modulus M, where M is a product of base elements. The base elements can be, for example, at most 32, or at most 64, or at most 128. The base elements need not be powers of 2. One or more or all of the base elements can be at least 3, at least 5, or at least 10. For example, one can use bases of size κ that are at least 2, at least 4, or at least 8. Using such base elements allows relatively efficient implementation of the computation of subvalues. The overall modulus can be, for example, at least 256, at least 512, or at least 1024. Thus, one can perform computations on values that would not be efficiently implemented if not decomposed into subvalues.

[0258] Using a radix decomposition, the modulus integer can be implemented as a chain of κ encrypted blocks modulo β i (where 0 ≤ i < κ). For one block, one can define a pair of which includes a message modulus and a carry message modulus. The pair may be referred to as a base associated with the modulus integer. In this way, one can implement computations on integers modulo .

[0259] Figure 4 This is illustrated by example. In this example, three respective blocks 401-403 are used, i.e., κ = 3. For all 0 ≤ i < κ, β i = 4 and p i = 16; and M = 4 3 . In this figure, a new RadModlnt is shown, whose subvalues do not contain a carry. In particular, one can see that the plaintext of block 401 involves padding bits 404; a carry message modulus 405; and a message modulus 406.

[0260] Interestingly, when using a radix decomposition, various parameters of the cryptographic computation can vary, including but not limited to the modulus M and the base Thus, one can reduce the overall computational cost by optimizing these parameters for a particular use case, e.g., by having a compiler device automatically optimize these parameters.

[0261] Several examples of cryptographic operations that can be performed on values encoded and encrypted using a radix decomposition are now discussed in detail. First, some notation is introduced. Let For example, m = m0+ (where ) decomposed into encrypted ciphertext ​In terms of the key s can be indicated as:

[0262]

[0263] In the following, The encoding and encryption of the ciphertext The encryption sub-values can be indicated as And similarly for the base elements (where i < j) are In short, and for Similar. The size of the

[0264] As also noted elsewhere, the respective encryption sub-values Can be encrypted according to different encryption keys, with key switching being used to switch between encryption keys as required.

[0265] Furthermore, The compatibility of the ciphertexts can be defined as follows. Let be two RadModInt ciphertexts. If The two RadModInt ciphertexts and can be defined as compatible, and

[0266]

[0267] Let be a base, then and The following functions will be used in the examples that follow. The function is defined recursively for as:

[0268]

[0269] and as

[0270]

[0271] and as

[0272]

[0273] The following illustrates an operation in which the ciphertext is decomposed into with base In other words, in which the encoding and encryption of the value using base number decomposition is determined according to the encryption of the value. Determining the encoding and encryption can comprise using the PBS to pass the base The corresponding members are used to continuously calculate the Euclidean division of the input ciphertext, where the remainder is the stored non-carry sub-value encrypted as Arith ciphertext. The remainder can be determined based on the modulus p of the corresponding carry message. i Perform a shift operation to match the carry message modulo. The set remains consistent.

[0274]

[0275] If μ ≤ p-1, then this algorithm can be used and has computational complexity.

[0276] The following example illustrates an operation using radix factorization to increase the number of subvalues ​​used to encode and encrypt a value. For this purpose, zero-encryption can be used to expand the encoding and encryption. Interestingly, this operation is very efficient for radix-based encoding. This operation can be specified as RadModIntCT::Padding, and can be... Size from Change to Therefore, it is possible to utilize For example, simple encryption with zeros can be used to complete the ciphertext. This is useful, for instance, in conjunction with the Decompose algorithm, as it outputs ciphertext. It may not have a length k. This operation can be indicated as:

[0277]

[0278] if The elements of the base are equal to those from the exponent α, therefore κ out ≥κ+α For elements that are not elements, this operation can be used. Formally, let and Then for [α∈0,κ] out -κ], for all i∈[0,κ-1], β i =β out,α+i And p i =p out,α+i .

[0279] The following example illustrates the use of radix factorization. and This operation performs addition between two encoded and encrypted values. Addition can be performed by summing the corresponding subvalues. Interestingly, this operation can therefore be parallelized. Specifically, Arith::Add can perform addition for each i... and Call between them.

[0280]

[0281] If the inputs are compatible and then this operation can be used. The computational complexity can be

[0282] The following illustrates the subtraction of two values that are encoded and encrypted using a radix decomposition and The encoding and encryption. Similar to addition, this operation can be implemented as the subtraction of the respective subvalues, and thus can be parallelized. Specifically, this operation can be implemented by computing Arith::Sub between each and for each i.

[0283]

[0284]

[0285] If the inputs are compatible with each other and

[0286] then this operation can be used. The computational complexity can be

[0287] The following illustrates the carry-reduce operation on encrypted values, which can be used to reduce a carry-in subvalue of an encoded and encrypted value to a no-carry subvalue. To do so, the carry-in subvalue can be decomposed into the encryption of the respective subvalues of that subvalue. The resulting encryptions can then be added to the encryption of the corresponding subvalue of the output value. In this way, the carry of that subvalue can be propagated to the higher-exponent subvalues. Specifically, let be the ciphertext. The carry-reduce operation can be applied to an encrypted subvalue

[0288]

[0289]

[0290] If or even the internal state of the algorithm If then this operation can be applied. The computational complexity can be

[0291] The following illustrates an encrypted carry-reducing operation by which an encoded and encrypted value with carry can be converted into an encoded and encrypted value without carry. To this end, the encrypted carry-reduction can be applied to the respective subvalues starting from the least significant subvalue. In this way, the respective carry can be propagated. If a subvalue does not hold a carry even after the previous carry-reduction, its carry-reduction can be skipped. Specifically, let become ciphertext. The following algorithm can be used:

[0292]

[0293] If the parameter allows the use of ClearCarry, this operation can be used. The computational complexity can be

[0294] The following illustrates an encrypted operation in which an encoded and encrypted value is multiplied with a scalar, e.g. a known integer λ. In this example, this is done by multiplying the respective subvalues with the scalar, possibly in parallel. This algorithm is suitable for relatively small λ.

[0295]

[0296] If this operation can be applied. The computational complexity can be

[0297] The following illustrates an encrypted operation in which an encrypted but not encoded value, e.g. a subvalue of an encoded and encrypted value, is multiplied with a scalar λ. Interestingly, this operation can be used for relatively large scalars. The operation can result in an encoded and encrypted product. The respective subvalues of the encoded and encrypted product can be computed by respective programmable bootstrap operations corresponding to the respective subvalues of the scalar. Specifically, the integers in the scalar λ and ciphertext between the ciphertext and the ciphertext This can be achieved as follows.

[0298]

[0299]

[0300] If μ ≤ p - 1, this operation can be used. The computational complexity can be

[0301] An encryption operation is illustrated below in which a value that is encoded and encrypted using radix decomposition is multiplied by a scalar λ. This operation can be implemented by performing scalar multiplication of the respective subvalues with the scalar λ, resulting in respective encoded and encrypted products, and combining the resulting encoded and encrypted products. Interestingly, this operation can also be used for relatively large scalars. Specifically, let and This operation can be implemented as follows:

[0302]

[0303]

[0304] This operation can be used if the subroutines RadModIntCT::ScalarMulDecomp and RadModIntCT::Add can be applied to their respective inputs.

[0305] The computational complexity can be

[0306]

[0307] An encryption multiplication between respective values that are encrypted but not encoded is illustrated below, e.g., between subvalues of one or two different encoded and encrypted values. The encryption multiplication can result in an encoded and encrypted value. The respective subvalues of the encoded and encrypted value can be determined by scaling and addition of the input values into a single encrypted value, and by applying a respective programmable bootstrap. Specifically, two compatible ciphertexts and are multiplied. The result can be decomposed into ciphertexts having bases such that

[0308]

[0309]

[0310] This operation can be used if Arith::ScalarMul can be applied to

[0311] The computational complexity can be

[0312]

[0313] ​​The following illustrates an encrypted multiplication between an encrypted but not encoded value and an encoded and encrypted value. This operation can be implemented by multiplying the respective sub-values of the encoded and encrypted value by the encrypted but not encoded value, resulting in respective encoded and encrypted products; and combining the encoded and encrypted products. In particular

[0314] In particular, let and then the homomorphic multiplication of ml and m2 can be implemented as follows:

[0315]

[0316]

[0317] If RadModIntCT::MulDecomp and RadModIntCT::Add can be applied to their respective arguments, this operation can be used. The computational complexity can be

[0318]

[0319] The following illustrates an encrypted multiplication of a first encoded and encrypted value and a second encoded and encrypted value. This multiplication can be implemented by multiplying the respective sub-values of the first encoded and encrypted value and the second encoded and encrypted value, these multiplications resulting in encoded and encrypted results; and combining (e.g., adding) the encoded and encrypted results. In particular, the encrypted multiplication can be implemented by multiplying the respective sub-values of the first encoded and encrypted value by the second encrypted value, e.g., in the case of the operation OneBlockMul discussed above. In particular, given two ciphertexts and the multiplicative decomposition between the pair of blocks (where ) can be computed. It is worth noting that the encoded and encrypted inputs and do not need to be compatible.

[0320] In this example, the result of the multiplication is expressed in the base

[0321]

[0322] If If the parameters RadModIntCT::OneBlockMul and RadModIntCT::Add can be applied to their respective arguments, this operation can be used.

[0323] The computational complexity can be

[0324] ​

[0325] Radix factorization can also be used to perform cryptographic evaluations of univariate functions on encoded and encrypted values. For example, the univariate function being evaluated could be an inverse function or a division function. This operation can be implemented in several ways.

[0326] One approach to evaluating univariate functions is to apply tree-programmable bootstrapping. Using tree-programmable bootstrapping to evaluate large lookup tables on multiple ciphertexts encoded from a single input can itself be derived from A. This information is known from "Revisiting the functional bootstrap in TFHE" by [Authors' Name], IACR Trans. Cryptogr. Hardw. Embed. Syst., 2021(2):229-253, 2021 (included in this paper by reference). This reference uses plaintext integers encrypted using the same radix β. Interestingly, the inventors realized that these techniques could also be applied to the current setup, particularly when the radix factors are not all identical. This allows for programmable bootstrap for multi-radix trees.

[0327] Specifically, let It has A lookup table for elements. This lookup table can be applied to elements with multi-basic representations. The encrypted and encoded value of x. Using univariate functions of multi-baseline PBS for evaluation can... The ciphertext and a large lookup table P are taken as input and returned. Ciphertext, and can be indicated as:

[0328]

[0329] Multi-base tree programmable bootstrapping can be iteratively implemented by selecting the maximum remaining base element in the iteration, splitting the remaining lookup table based on the maximum remaining base element, applying programmable bootstrapping to the corresponding lookup table components using the subvalues ​​corresponding to the maximum remaining base element as selectors, and combining the results into an updated lookup table.

[0330] Specifically, let B = {β} i |i∈0,κ-1} and let θ(β) be the component of x related to β. In the iteration, define β max =max(β∈B). Split P into... Smaller lookup tables, each containing β of P max Different elements. Using θ(β) max) the ciphertext that is encrypted is used as a selector to compute PBS for each of the v look-up tables. The new large look-up table P consists of the v iterations of PBS. From B: B = B - β max Delete β max This iteration process can be repeated until B is empty. In the first iteration, the plaintext look-up table P can be split; in the following iterations, the split can be done using key switching.

[0331] Regarding computational complexity, in the worst case, for all i ∈ [0, k - 1], β i = β max Thus, the worst case complexity can be

[0332]

[0333] A particularly efficient technique for performing function evaluation on encoded and encrypted values is now discussed. This technique is run by extracting the bits required by the evaluation function from the respective encrypted sub-values; converting the extracted bits to GGSW ciphertext; and applying a look-up table to the respective GGSW ciphertext. This technique is applicable to single variable function evaluation, but also to multi-variable function evaluation.

[0334] The inventors are aware that this approach has multiple advantages over directly using programmable bootstrap based on blind rotation in the current setup (although it will be appreciated that this approach can also indirectly use programmable bootstrap based on blind rotation, e.g. for conversion to GGSW).

[0335] By operating on a per-bit basis at the level of individual sub-values, the use of blind rotation with polynomials that are exponentially scaled in the size of the message modulus and / or carry message modulus is avoided. Thus, the proposed single variable function evaluation can operate on sub-values with a larger message modulus and / or carry message modulus, e.g. the size of the message modulus and / or carry message modulus of the sub-values can be at least 10 bits, at least 13 bits, at least 15 bits, or at least 16 bits. By using larger moduli for the sub-values, the efficiency of the computation of the encoded and encrypted values can be greatly improved. In particular, fewer carry reductions can be required, as the encrypted sub-values can have more space for carry and / or fewer encrypted sub-values can be required to represent a given value.

[0336] Furthermore, the proposed univariate function evaluation also provides a significant improved scaling of the encrypted value size at the level of the overall encoded and encrypted value, since the lookup table can be applied more efficiently to the respective GGSW ciphertext, e.g. using hybrid padding, compared to using a Tree-PBS. In particular, while a Tree-PBS can scale exponentially in the number of subvalues, applying a lookup table to a bit-wise GGSW ciphertext can be performed more efficiently, e.g. even linearly, in the number of subvalues.

[0337] Another advantage of the proposed univariate function evaluation is that no padding bits on the most significant bits of the encrypted value are needed, e.g. no need to ensure that the most significant bits remain zero, as is the case for some existing implementations of programmable bootstrapping. This means that a higher precision can be obtained given a ciphertext modulus q.

[0338] Further efficiency improvements are provided by the improved univariate function evaluation, since the respective encrypted subvalue can be rounded to the required precision before applying the LUT. Furthermore, multiple univariate function evaluations can be performed on the same input using the same GGSW encrypted bit, such that multiple functions are applied particularly efficiently.

[0339] The proposed WoP-PBS can take as input a bootstrapping key and a LUTL which can or can not be encrypted. The WoP-PBS can output a homomorphic evaluation of the LUT on an input message, e.g. an LWE or GLWE encryption of L[m].

[0340] In particular, a bit can be extracted from an encrypted subvalue by using the scaled programmable bootstrapping to extract the respective least significant bit, such that it operates on the respective bit as the least significant bit. This operation can be performed efficiently using a generalized programmable bootstrapping, e.g. as proposed in I. Chillotti et al., “Improved programmable bootstrapping with larger precision and efficient arithmetic circuits for TFHE”, incorporated herein by reference. In particular, the generalized programmable bootstrapping can include a direct read modulo switching next to the bit to be extracted, and can use this to evaluate the sign function rescaled to the j-th bit.

[0341] In many cases, all bits of an input value can be extracted, but if a function does not depend on one or more bits, e.g. the function only uses the multiple least significant bits, these bits can be avoided from being extracted, thereby further improving efficiency.

[0342] Further improvements can be made when using the described generalized programmable bootstrapping by choosing a value of 0 > 0 and using the PBSmanyLUT implementation as described in “Improved programmable bootstrapping with larger precision and efficient arithmetic circuits for TFHE”. Programmable bootstrapping also does not need to be applied to every bit, e.g. if the extracted bits are already in the correct rescaling (or close to it) when extracting information from the input.

[0343] To convert bits to GGSW ciphertexts, one can use circuit bootstrapping for example, see I. Chillotti et al., “Faster packed homomorphic operations and efficient circuit bootstrapping for TFHE”, proceedings of ASIACRYPT 2017 (incorporated herein by reference). For circuit bootstrapping, it is worth noting that its second step can be improved similarly to H. Chen et al., “Onion ring ORAM: efficient constant bandwidth oblivious RAM from (leveled) TFHE”, proceedings CCS 2019” (incorporated herein by reference). Namely, one can apply an initial non-functional LWE-to-GLWE KS to the output of the programmable bootstrapping, and one can perform a GGSW encryption of the outer product multiplication by a GLWE key. This way one can reduce the size of the evaluated public key, and one can improve the efficiency by means of using FFT.

[0344] Lookup tables can be applied efficiently to GGSW ciphertexts by using packed lookup table evaluation, see for example I. Chillotti et al., “Faster packed homomorphic operations and efficient circuit bootstrapping for TFHE”, proceedings of ASIACRYPT 2017 (incorporated herein by reference). In general, such packed LUT evaluation can employ hybrid packing, with horizontal packing and vertical packing being two specific examples.

[0345] Interestingly, the above approach applies to encoded and encrypted values whether or not a carry is used; and it also applies to values that are encrypted as corresponding sub-values but not encoded. In the latter case, many of the discussed advantages apply. Thus, a method of performing an encryption computation and an encryption computation device are contemplated that use the described univariate function evaluation without necessarily also using a carry or encoded and encrypted values. Overall, it is noted that while the improved univariate function evaluation generally uses programmable bootstrap based on blind rotation internally (e.g., circuit bootstrap can involve a constant number of programmable bootstraps, etc.), at a higher level, the improved univariate function evaluation can be used to replace programmable bootstraps performed in an encryption computation, especially when applied to large message moduli.

[0346] In particular, the bit-based univariate function evaluation can be implemented as follows:

[0347]

[0348]

[0349] While the above example illustrates vertical packing, horizontal or mixed packing can also be used. Also, instead of LWE ciphertexts as illustrated above, GLWE ciphertexts can also be output. Further, the above example can be generalized to multivariate function evaluation with multiple encoded and encrypted inputs (e.g., at least two or at least three) by extracting the required bits from the respective inputs and applying the lookup table to the bits from the respective inputs.

[0350] As discussed elsewhere, performing an encryption computation can include tracking the degree of completeness of the respective carry-in sub-values. If the degree of completeness of a carry-in sub-value to be computed indicates that it can exceed the corresponding carry-in message modulus, then an encryption carry reduction can be applied prior to computing the carry-in sub-value. In particular, the encryption carry reduction operation can be performed as needed prior to or during the encryption operation. An operation configured to automatically perform carry reduction when needed to ensure that the carry buffer does not overflow is referred to as a “smart” operation.

[0351] Figure 5 Embodiments of encoded and encrypted values based on a residue system representation are illustrated schematically. It is demonstrated how various encryption operations can be applied to such encoded and encrypted values in an encryption computation.

[0352] Such an encryption computation can involve the use of carries in the encoded and encrypted values, but this is not required, e.g., a carry reduction can be applied directly after each operation or sub-operation described here, such that the encryption operation is only applied to encoded and encrypted values without a carry.

[0353] In particular, the mapping between a value and its sub-values can be represented according to a residue system, in particular based on the Chinese Remainder Theorem (CRT). An encoded and encrypted value can be encrypted to have respective message moduli β i (i = 0,..., k-1) of the k sub-values. Typically, the moduli β i , β j (i≠j) are pairwise coprime, so that the CRT can be used to reconstruct the value from the sub-values. In general, any moduli can be used as carry message moduli, e.g. the sub-values can take a common carry message modulus. To encrypt a value to an encoded and encrypted value, a CRT representation of the value can be computed, and then the respective elements of the representation are encrypted. Similarly, an inverse CRT can be used to decode an encoded and encrypted value.

[0354] Interestingly, encoding using a residue system can provide particularly efficient encryption of carry reductions. In particular, a carry reduction can be performed by performing respective modulus reductions on the respective sub-values, e.g. a carry cannot be forwarded from one sub-value to the next. This makes the carry reduction faster and suitable for multi-threading. For example, one, more or all message moduli can be at least 2 and / or at most 32. For example, one, more or all message moduli can be at least 3, at least 5 or at least 10. In particular, the figure illustrates an encryption of a value encoded into three respective sub-values 501, 502, 503 positioned to be modulo the respective message moduli 504, 505, 506 equal to 25, 29 and 32, respectively. Thus, the encoded and encrypted value can be defined to be modulo M = 32 x 29 x 25, with k = 3. A common carry message modulus 507 equal to 64 is used in this example.

[0355] In particular, encoding a value into sub-values can be determined as follows:

[0356]

[0357]

[0358] Some notation regarding encoding based on a residue system is now introduced. Let be a CRT base, such that for all 0≤i,j<κ, the integer pair (β i ,β j ) is coprime when i≠j. The relevant total CRT modulus τ can be defined as

[0359] To encode and encrypt a value m mod τ, its respective remainders modulo the respective base are computed i = m mod β iThe κ different Arith ciphertexts can be encrypted.

[0360] To decrypt a value m encoded and encrypted using this CRT over multiple Arith ciphertexts, first, the Arith ciphertexts encrypting the sub-values can be decrypted. Then, the encrypted integers can be decoded modulo the modulus τ, as is known per se.

[0361] Thus, depending on the CRT base in which the integer is encrypted by the CrtModInt ciphertext can be defined as where for all 0≤i<κ, and and m≡m i modβ i . The i-th Arith ciphertext can be indicated as As discussed elsewhere, the ciphertexts may each be according to a public encryption key, but this is not strictly required.

[0362] If and if

[0363]

[0364] then the two CrtModInt ciphertexts and may be called compatible.

[0365] Various operations on values encoded and encrypted using CRT are now discussed. It is interesting that, when using CRT representation, in many cases, an encrypted operation can be applied by applying the corresponding sub-operation separately to the respective encryptions of the sub-values of the input value. This makes for an efficient implementation of the operation and can be parallelized. This is especially true for addition, subtraction, and multiplication.

[0366] In particular, homomorphic addition can be implemented by adding the blocks of the same exponent together, e.g.

[0367]

[0368] If the inputs are compatible, and Arith::Add can be applied, then this operation can be applied. The computational complexity can be

[0369] Homomorphic subtraction can also be implemented by subtracting the blocks of the same exponent, e.g.:

[0370]

[0371] If the input is compatible, and Arith::Sub can be applied, this operation can be applied. The computational complexity can be

[0372]

[0373] By performing multiplication of scalars known by the party performing the encrypted multiplication, the operation can be performed by multiplying the respective block by the scalar u modulo the respective message modulus β i modulo, e.g.:

[0374]

[0375] If , Arith::ScalarMul can be applied, this operation can be applied. The computational complexity can be

[0376] Another way of implementing scalar multiplication is e.g. by applying programmable bootstrapping.

[0377] Interestingly, when using CRT representation, e.g. by reducing the carry-in subvalue modulo the corresponding message modulus modulo by applying programmable bootstrapping, encrypted carry reduction can be applied to the carry-in subvalue. This can not affect the other subvalues, thus, carry reduction of multiple or all subvalues of an encoded and encrypted value can be performed separately and can be performed in parallel. No propagation can be needed. For example, a single carry-in subvalue can be carry-reduced as follows:

[0378]

[0379]

[0380] If this operation can be applied and can have computational complexity

[0381] The multiple subvalues can be carry-reduced by performing, for each component CrtModInt, extraction of the message modulo β i modulo, e.g.:

[0382]

[0383] If this operation can be applied. The computational complexity can be

[0384] Homomorphic multiplication can be performed by multiplying the respective block by the scalar u modulo the respective message modulus β ithe corresponding sub-values x mod β, y mod β i , y mod β i together, e.g.:

[0385]

[0386]

[0387] If Arith::MulLSB can be applied, this operation can be applied. The computational complexity can be Arith::MulLSB can be applied. The computational complexity can be Other techniques for multiplication of sub-values can also be used, e.g. Arith::MulLSB 3PBS .

[0388] Various techniques can be used to apply a univariate function to a value encoded and encrypted using CRT In particular, tree programmable bootstrapping, or applying a lookup table to the extracted bits of a GGSW encryption, can be used, e.g. both in combination Figure 4 Further discussed. Depending on the function, it can also be evaluated by separately applying the univariate function to the corresponding sub-values. For example, this is the case for functions that can be expressed in terms of sums and products over In this case, the univariate function can be applied as follows, e.g.:

[0389]

[0390] If for all i with 0 < i < κ, CrtModInt[i] :: deg < 1 and the function This operation can be applied if the element is split over the CRT representation. The computational complexity can be

[0391] Figure 6 Embodiments are illustrated that are based on encoding and encrypting a value based on a prime factorization. In this case, it is of interest that the value is defined using a modulus M that is smaller than the maximum value that can be represented by the prime factorization. This has the advantage that the modulus M does not need to be equal to the product of the base elements.

[0392] In particular, to encode and encrypt a value modulo M, the base can be chosen such that the modulus M is smaller than the maximum value that can be represented by the prime factorization The base can be chosen as discussed with respect to Figure 4

[0393] ​For example, the figure illustrates the case where the modulus 601 is M = 1433. Notably, 1433 is a prime number, and thus cannot be directly decomposed using a base or CRT representation for this modulus. The figure illustrates a base with a common base element β = 2 5 , 602, where κ = 3, and with a common carry message modulus where p = 2 7 Thus, in this case, the value can be encoded and encrypted as three encrypted sub-values 606-608.

[0394] The encryption operations can be performed as discussed with respect to Figure 4 , with the difference that the carry reduction can involve applying a correction due to the modulus reduction by M. The latter can be performed by encrypted modulus reduction of the most significant sub-value of the output value. Specifically, as also discussed elsewhere, the carry and message can be extracted from the most significant block, and the modulus can be homomorphically computed by re-distribution over the remaining blocks. Several approaches can be taken for this, as discussed in more detail elsewhere.

[0395] In more detail, the encoded and encrypted ciphertext encrypted under a secret key s can be indicated as where the integer is decomposed according to a base

[0396]

[0397] where the i-th Arith ciphertext consisting of can be defined as

[0398] In the above definition, the modulus Q is set to lie in the most significant block κ-1. Notably, one or more Arith ciphertext blocks can be added in the MSB of the RadModInt + structure. The algorithms described herein that perform homomorphic modulus reduction can be adapted to perform modulus reduction on the RadModInt + ciphertext using the additional Arith ciphertext blocks.

[0399] If

[0400]

[0401] then two RadModInt + ciphertexts and can be defined as compatible, where​​ And

[0402]

[0403] For example, a ciphertext and may be compatible.

[0404] Various operations as discussed with respect to Figure 4 may be performed. Several embodiments of this are now discussed.

[0405] In particular, modular addition can be computed like for RadModInt ciphertexts. To this end, a RadModInt + ciphertext can be considered as a RadModInt ciphertext. This operation can be indicated as

[0406] Modular subtraction can also be performed like for RadModInt ciphertexts, considering a RadModInt + ciphertext as a RadModInt ciphertext. This operation can be indicated as

[0407] Modular padding can also be performed like for RadModInt ciphertexts, considering a RadModInt + ciphertext as a RadModInt ciphertext. Typically the input from the decomposition can be a RadModInt. This operation can be indicated as

[0408] Applying encryption carry reduction to a carry-in subvalue can also be performed like for RadModInt ciphertexts, considering a RadModInt + ciphertext as a RadModInt ciphertext. This operation can be indicated as

[0409] When performing carry reduction on the most significant subvalue, modular reduction can be performed. Two possible methods of performing modular reduction are now discussed. Their relative efficiency can depend on the distance between the modulus M and the bound M max .

[0410] A first method of performing modular reduction is to apply a programmable bootstrap to the most significant encryption subvalue to propagate this subvalue to the corresponding encryption subvalues, thereby obtaining a reduced value modulo Q.

[0411] In particular, the carry reduction can involve clearing and propagating the carry of the subvalues of the encoded and encrypted value, except for the most significant subvalue. Thus, all carries can be empty except for the carry in the most significant block. If the carry of the most significant block can support the carry propagation without exceeding, then this can be done. In the most significant block, programmable bootstrapping can be used to extract and transform both the carry and the message. The extracted carry and message after transformation can be redistributed into the respective blocks.

[0412] Now with respect to Figure 6 The example parameters give a detailed embodiment, namely Q = 1433, K = 3, where β = 2 5 , and where p = 2 7 . The most significant block can encrypt the message m <2 p , rescaled to the quantity β 2 . The modulus reduction can use the respective PBS to reduce the quantity mβ 2 modulo Q and simultaneously factor it in base powers to redistribute it to the respective blocks. Say m' = mβ 2 mod Q. Then m' can be factored as

[0413]

[0414] The PBS LUTs can be constructed so as to take the encryption of m as input and output the encryption of these factored values (m'2, m'1, m'0), then the reduction ciphertext can be obtained as follows:

[0415] - in block 0: by addition between the encryption of the previous block 0 and m'0;

[0416] - in block 1: by addition between the encryption of the previous block 1 and m'1;

[0417] - in block 2: by the encryption of m'2 which has a smaller degree than the original.

[0418] As a detailed embodiment, the modulus reduction can be implemented as follows:

[0419]

[0420] If satisfies and Arith::Add can be applied to the ciphertexts ct j and then this operation can be applied.

[0421] The computational complexity can be

[0422] It is worth noting that the respective programmable bootstrap can be evaluated as a single programmable bootstrap using the "PBS many LUT" technique disclosed in "Improved programmable bootstrapping with larger precision and efficient arithmetic circuits for TFHE".

[0423] An alternative technique to perform the modulo reduction is based on a linear relation between the subvalue corresponding to the most significant base element and a set of subvalues corresponding to the remaining base elements taken modulo a smaller modulus Q. Based on this relation, the encoded and encrypted value can be modulo reduced to an encoded and encrypted value with the most significant subvalue being zero. Specifically, to obtain the linear relation, the product of the base elements except the one taken modulo Q k-1 can be decomposed in the base = (β0, β1,..., β κ-1 ) as follows:

[0424]

[0425] If in the decomposition v κ-1 = 0, this method can be used. In this case, the most significant block is multiplied by the constant v j can be added to the j-th block and the new most significant block is set to zero. If the elements of the decomposition v0, v1,..., v κ-2 are small or even zero, this technique is particularly efficient and for certain applications, a suitable modulus Q can be chosen such that this modulo reduction is efficient, resulting in a particularly efficient encrypted computation.

[0426] As an example, reference is made to the parameters exemplified in "Improved programmable bootstrapping with larger precision and efficient arithmetic circuits for TFHE": a smaller modulus Q = 1433, a number of subvalues K = 3, a base of the message modulus Figure 6 where β = 2 5 , and a carry message modulus where p = 2 7 . In this example, it can be observed that (2 5 ) 2 mod 1433 = -409 = -12 · 2 5 -25, so the modulo reduction can be performed by adding the previous least significant block 608 to the most significant block 606 and multiplying by -25 in the least significant block 608, adding the previous intermediate block 607 to the previous most significant block 606 and multiplying by -12 in the intermediate block 607, and setting the most significant block 606 to zero.

[0427] ​​Another embodiment in which the current RadModInt is particularly efficient is where Q = 1087, K = 3, where β = 2 5 , where p = 2 7 , as before. In this case, it can be observed that (2 5 ) 2 mod 1087 = -63 = -2 · 2 5 + 1, so the RadModInt can be implemented by a scalar multiplication with a small scalar.

[0428] Notably, this technique can be implemented efficiently without programmable bootstrapping. The carry propagation can then optionally be performed by bootstrapping. For example, this technique can be implemented as follows:

[0429]

[0430] If, in the decomposition v, the coefficients v κ-1 = 0, and for all j e [0; K - 2], Arith::ScalarMul can be applied to the ciphertext and the scalar v j ; the decomposition does not overflow the decomposition base; and RadModInt + ::Padding, RadModInt + ::Sub, and RadModInt + ::Add can be applied to their respective inputs, then this procedure can be applied. Let K + < K be the number of positive elements in the decomposition, and let K - < K be the number of negative elements in the decomposition. Then, the computational complexity of this technique can be It can be noted that if a coefficient v j is equal to zero, the loop for this coefficient can be skipped, and this technique is particularly efficient if the choice of parameters is such that one or more coefficients v j are zero.

[0431] To perform the encrypted carry reduction operation on all subvalues of a value encoded and encrypted using RadModInt + , this operation can be performed by applying the encrypted carry reduction to the respective subvalues except the most significant subvalue, and applying the encrypted modulus to the most significant subvalue. Specifically, this operation can be implemented as follows:

[0432]

[0433] Notably, although RadModInt +:: ClearCarry can reduce carry-in sub-values to no-carry-in sub-values, but RadModInt + :: The overall result of ClearAllCarries can have carry-in sub-values due to the additions performed in the modular reduction. Optionally, further carry-in reduction can be applied, e.g. using RadModInt + :: ClearCarry, e.g. if this allows performing one or more next operations.

[0434] If for all i e [0, K-2], RadModInt + :: ClearCarry can be applied, and if RadModInt + :: ModularReduction 1,2 can be applied to the result, then the above procedure can be applied. Depending on the used modular reduction, the computational complexity can be or

[0435] Scalar multiplication can be performed using the SmallScalarMul operation as discussed for RadModInt ciphertexts. This can be particularly suitable for relatively small scalars. To this end, RadModInt + ciphertexts can be considered as RadModInt ciphertexts. This operation can be indicated as

[0436] Scalar multiplication can be performed using the ScalarMulDecomp operation as discussed for RadModInt ciphertexts, considering RadModInt + ciphertexts as RadModInt ciphertexts. In particular, the respective sub-values of the encoded and encrypted values can be multiplied, and the resulting encoded and encrypted combination can be combined. Scalar multiplication can also include performing a modular reduction. The overall scalar multiplication operation can be indicated as

[0437] In this case, one way to implement the modular reduction is to include one or more additional sub-values in the encoded and encrypted product, such that exact multiplication is supported, in other words such that the encoded and encrypted product can be computed without performing a modular reduction (the number of sub-values to add is chosen to fit the scalar to be multiplied with); exact multiplication is performed; and a respective added sub-value and the initially most significant sub-value, e.g. from most significant to least significant, a respective modular reduction is applied.

[0438] An alternative approach is to perform the respective modular reduction in an iterative manner before combining the resulting encoded and encrypted values. In this case, the addition of extra sub-values can be avoided.

[0439] Multiplication of encoded and encrypted values can be performed as discussed for RadModInt ciphertexts, with RadModInt + ciphertexts being treated as RadModInt ciphertexts. In particular, the respective sub-values of a first encoded and encrypted value can be multiplied with the respective sub-values of a second encoded and encrypted value, and the results can be combined. The multiplication can include modular reduction. The overall multiplication can be indicated as

[0440] To perform the modular reduction, one or more sub-values can be included in the encoded and encrypted product, such that an exact multiplication of the encoded and encrypted values can be performed (the number of sub-values is chosen to fit the values to be multiplied); the exact multiplication can be performed; and the respective modular reduction can be applied to the added blocks and the originally most significant sub-value, e.g. from most significant to least significant.

[0441] Another approach to perform the modular reduction is to perform the modular reduction iteratively during the calculation, e.g. before the results are overlaid in the most significant block. In this way, there is no need to add extra sub-values.

[0442] Figure 7 Embodiments of values that are encoded and encrypted based on a residue system representation and further based on a prime factorization of the elements of the residue system representation are illustrated schematically. Such a representation is referred to herein as "hybrid" encoding and encryption. In particular, an encoded and encrypted value can comprise one or more respective encodings and encryptions according to the residue system representation of the respective sub-values defined in terms of the residue system representation.

[0443] Interestingly, in this way, the advantages of the residue system representation can be combined, i.e. the avoidance of multiple carry propagation, while there is no problem of requiring many small co-prime numbers. In particular, by using the hybrid approach, encryption calculations can be performed relatively efficiently using particularly large modulus, e.g. a modulus of at least 2 10 , at least 2 20 , or at least 2 30 . For example, the number of residues of the residue system representation can be at most or at least three, at most or at least six, or at most or at least ten.

[0444] For example, a hybrid encoding and encryption using a modulus of (4 5 ) x 1433 x 17 x (3 4 ) is illustrated in the figure. This modulus can be decomposed into four residues 4 5 , 710; 1433, 720; 17, 730; and 34 ,740. For the corresponding remainder of the remainder systematic factorization, the encoding and encryption of a given value may include a corresponding combination of one or more encrypted values ​​representing the corresponding elements of the remainder systematic factorization of that value.

[0445] Specifically, for zero or one remainders in the remainder system, the corresponding element can be encrypted into an encrypted but unencoded value, whose message modulus equals the remainder, such as regarding... Figure 5 The remainder 17,730 in the diagram is an example of this, which can be encrypted as 740 modulo the remainder itself.

[0446] For zero, one, or more other remainders, the corresponding element can be encoded into an encoded and encrypted value based on the radix factorization of the element. Here, the remainder can be equal to the maximum value represented by the radix factorization, for example, using... Figure 4 The encoding and encryption; and / or the remainder can be less than the maximum value represented by the radix factorization, for example, using... Figure 6 It is encoded and encrypted.

[0447] As shown in the example, where the remainder is 4 5 Elements modulo 710 can be encoded and encrypted into five sub-values ​​modulo 4, 711-715, for example, as in the context of... Figure 4 The subject under discussion; and, according to remainder 3 4 The element modulo 740 can be encoded and encrypted into four sub-values ​​741-743 modulo 3. In this embodiment, the element modulo 720 with remainder 1433 can be encoded and encrypted into a modulo 2... 5 Take the three sub-values ​​of modulo 721-723, for example, as about Figure 6 The subject of discussion.

[0448] Specifically, given a set of coprime integers (Q0, ..., Q... κ-1 A list of values ​​can be encoded and encrypted using a hybrid method, where... The value can be determined by m mod Q. i The corresponding elements of the CRT representation of i∈[0,κ-1] are used to encode and encrypt the value, wherein the corresponding value can be encrypted, encoded and encrypted as RadModInt, and / or encoded and encrypted as in EadModInt. + Encryption is used.

[0449] A detailed embodiment is now provided, in which RadModInt + This is used for all remainders. This embodiment can be applied to cases where RadModInt or a single encryption is used for one, multiple, or all remainders. In this embodiment, based on the CRT radix (Q0,…,Q... k-1 For integers m∈ where The encrypted ModInt ciphertext can be indicated as:

[0450]

[0451] where for all 0≤i≤k-1, such that m≡m i modQ i In this embodiment, the ith RadModInt component of the RadModInt + ciphertext can be indicated as Then, and

[0452] If then the ModInt ciphertext and can be defined as compatible, where and if the ciphertexts and are compatible,

[0453] In general, various computations can be performed, including encrypted operations and encrypted carry reduction, as discussed for conventional residue system-based encoding and encryption of Figure 5 For example, encrypted addition, subtraction, scalar multiplication, carry reduction, clear all carries, multiplication, and / or univariate function evaluation can be applied.

[0454] In cases where performing such computations includes performing subcomputations on one or more elements of a CRT representation, the techniques discussed with respect to Figure 4 or Figure 6 can be used to apply the subcomputations to the corresponding encoded and encrypted elements. For example, operations on ModInts can be computed individually on the corresponding components RadModInt + (m mod Q i ), i∈[0,κ-1], where instead of using Arith-based algorithms, RadModInt + -based algorithms described herein can be used to compute the ModInt

[0455] Figure 8Embodiments of an example of an encryption method 800 that performs an encryption computation on a set of one or more encoded and encrypted values are illustratively shown. The method 800 can be implemented by a computer. A value can be encoded and encrypted as a plurality of respective subvalues of encryption. The subvalues can have a corresponding message modulus and a carry message modulus that is greater than the message modulus. The value can be encoded and encrypted without carry by non-carry subvalues that are less than the corresponding message modulus. The value can be encoded and encrypted with carry by at least one carry subvalue that is greater than or equal to the corresponding message modulus.

[0456] The method 800 can include accessing 810 one or more encoded and encrypted values. The method 800 can include applying 820 an encryption operation to at least one carry encoded and encrypted input value to obtain a carry encoded and encrypted output value. The method 800 can include applying 830 an encryption carry reduction to the carry encoded and encrypted output value to obtain a further encoding and encryption of the output value, wherein at least one carry subvalue is reduced to a non-carry subvalue.

[0457] Figure 9 Embodiments of an example of a compiler method 900 that compiles a computation into a homomorphic executable are illustratively shown. The homomorphic executable can be executed by an encryption computation engine and can cause the encryption computation engine to perform an encryption computation on a set of one or more encoded and encrypted values described herein, e.g., according to the method 800 of Figure 8 The homomorphic executable can include one or more instructions for performing an encryption carry reduction operation described herein, e.g., as part of an encryption operation or between execution of encryption operations. The compiler method 900 can be implemented by a computer.

[0458] The compiler method 900 can include determining 910, for a carry subvalue to be computed, a degree of completeness representing a bound of the carry subvalue and generating 930, if 920 the bound exceeds a corresponding carry message modulus, an instruction that causes the encryption computation engine to apply an encryption carry reduction prior to computing the carry subvalue.

[0459] Many different ways of executing the methods 800, 900 are possible, as will be apparent to those skilled in the art. For example, the order of the steps can be executed in the order shown, but the order of the steps can be varied, or some steps can be executed in parallel. In addition, other method steps can be inserted between the steps. The inserted steps can represent a refinement of the method, as described herein, or can be unrelated to the method. For example, some steps can be executed at least partially in parallel. Furthermore, a given step can not have completed before a next step is started. The methods 800, 900 can also be combined, e.g., the method 800 of performing an encryption computation can be performed from a homomorphic executable that was previously compiled according to the method 900.

[0460] Embodiments of the method can be executed using software, including instructions for causing a processor system to perform the method 800 or 900. The software can include only those steps taken by a particular sub-entity of the system. The software can be stored in a suitable storage medium, such as a hard disk, floppy disk, memory, optical disc, etc. The software can be sent wired or wirelessly as a signal, or using a data network, e.g., the Internet. The software can be available for download and / or remote use on a server. Embodiments of the method can be executed using a bitstream, arranged to configure programmable logic, e.g., a field-programmable gate array (FPGA), to perform the method.

[0461] It will be understood that the presently disclosed subject matter also extends to computer programs, particularly computer programs on or in a carrier, adapted to put the presently disclosed subject matter into practice. The program can be in the form of a source code, an object code, a code intermediate source and an object code such as a partially compiled form, or in any other form suitable to employ the presently disclosed subject matter in one embodiment of the method. An embodiment relating to a computer program product comprises computer-executable instructions corresponding to each of the steps of at least one of the methods set forth. These instructions can be subdivided into subroutines and / or stored in one or more files that can be linked statically or dynamically. Another embodiment relating to a computer program product comprises computer-executable instructions corresponding to each of the apparatus, means and / or parts of the systems and / or products set forth.

[0462] Typically, the devices described herein (e.g. the devices in Figures la-c) comprise one or more microprocessors which execute appropriate software stored in the system; for example, the software can have been downloaded and / or stored in a corresponding memory, e.g. a volatile memory such as RAM or a non-volatile memory such as flash memory. Alternatively, the system can be implemented in whole or in part in programmable logic, e.g. as a field programmable gate array (FPGA). The system can be implemented in whole or in part as a so-called application-specific integrated circuit (ASIC), e.g. an integrated circuit (IC) customized for a particular use. For example, the circuitry can be implemented in CMOS, e.g. using a hardware description language such as Verilog, VHDL, etc. In particular, the system can comprise circuitry for evaluating cryptographic primitives.

[0463] The processor circuitry can be implemented in a distributed fashion, e.g. as a plurality of sub-processor circuits. The storage can be distributed over a plurality of distributed sub-storages. Part or all of the storage can be electronic storage, magnetic storage, etc. For example, the storage can have volatile and non-volatile parts. Part of the storage can be read-only.

[0464] Figure 10 A computer readable medium 1000 is shown having a writable portion 1010. The computer readable medium 1000 is shown in the form of an optically readable medium. The computer readable medium 1000 can store data 1020, where the data can represent instructions that, when executed by a processor system, cause the processor system to perform an embodiment of the method for performing an encryption computation and / or an embodiment of the compiler method according to one embodiment.

[0465] Alternatively or additionally, the data 1020 can represent a homomorphic executable file compiled according to the compiler method described herein.

[0466] Alternatively or additionally, the data 1020 can represent a group of one or more encoded and encrypted values, including zero or more non-carrying encoded and encrypted values and one or more carrying encoded and encrypted values, as described herein.

[0467] The data 1020 can be implemented on the computer readable medium 1000 as physical marks or by magnetization of the computer readable medium 1000. However, any other suitable implementation is conceivable. Furthermore, it will be appreciated that, although the computer readable medium 1000 is shown here as an optical disc, the computer readable medium 1000 can be any suitable computer readable medium, such as a hard disk, solid state memory, flash memory, etc., and can be non-recordable or recordable.

[0468] Figure 11A processor system 1140 according to one embodiment of a device for performing an encryption computation or determining a test polynomial is shown in schematic representation. The processor system comprises one or more integrated circuits 1110. The architecture of the one or more integrated circuits 1110 is shown in schematic in the figure. The circuit 1110 comprises a processing unit 1120, e.g. a CPU, for running computer program components to perform the methods according to one embodiment and / or to implement its modules or units. The circuit 1110 comprises a memory 1122 for storing programming code, data and the like. A part of the memory 1122 can be read-only. The circuit 1110 can comprise a communication element 1126, e.g. an antenna, a connector or both. The circuit 1110 can comprise an application specific integrated circuit 1124 for performing part or all of the processing defined in the method. The processor 1120, the memory 1122, the application specific integrated circuit 1124 and the communication element 1126 can be connected to each other by an interconnect 1130, e.g. a bus. The processor system 1110 can be arranged for contact and / or contactless communication, using the antenna and / or the connector, respectively.

[0469] For example, in one embodiment, the processor system 1140, e.g. a device performing an encryption computation or a compilation, can comprise a processor circuit and a memory circuit, the processor being arranged to execute software stored in the memory circuit. For example, the processor circuit can be an Intel Core i7 processor, an ARM Cortex-R8 or the like. In one embodiment, the processor circuit can be an ARM Cortex M0. The memory circuit can be a ROM circuit, or a non-volatile memory, e.g. a flash memory. The memory circuit can be a volatile memory, e.g. an SRAM memory. In the latter case, the device can comprise a non-volatile software interface, e.g. a hard disk, a network interface or the like, arranged for providing the software.

[0470] Although the device 1110 is shown to comprise one of each described component, multiple components can be replicated in multiple embodiments. For example, the processor 1120 can comprise multiple microprocessors configured to independently execute the methods described herein, or configured to execute steps or subroutines of the methods described herein, such that the multiple processors cooperate to achieve the functionality described herein. Further, in cases where the device 1110 is implemented in a cloud computing system, multiple hardware components can belong to separate physical systems. For example, the processor 1120 can comprise a first processor in a first server and a second processor in a second server.

[0471] It is noted that the embodiments mentioned above illustrate rather than limit the presently disclosed subject matter, and that those skilled in the art will be able to design many alternative embodiments without departing from the presently disclosed subject matter.

[0472] In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word comprising” and variations thereof do not exclude the presence of elements other than those listed in a claim. The articles “a”, “an” and “the” preceding the disclosure of elements do not exclude the presence of a plurality of such elements. Recitation of ranges of values herein are merely intended to serve as a shorthand method of referring individually to each separate value falling within the range. Unless otherwise indicated herein, each individual value is incorporated into the specification as if it were individually recited. The term “about” when used before a numerical designation, has its ordinary meaning, for example, can include numbers that are nearly the same as a recited number, but exclude numbers that are exactly the same as the recited number. The foregoing detailed description has set forth various embodiments of the devices and / or methods via the use of specific terminology. However, embodiments thereof can be practiced without the specific details (e.g., quantities, materials dimensions, types, etc.) set forth in the specification. In some instances, well-known methods, procedures, components and networks have not been described in detail so as not to unnecessarily obscure aspects of the devices and methods. It is to be understood that the foregoing description is exemplary of the general inventive concepts and that specific embodiments thereof are shown by way of example, but not limitation. It is the following claims, including all equivalents thereof, that are intended to define the scope of these general inventive concepts. Unless otherwise set forth herein, the terms “comprise”, “comprising”, “include”, “including”, “have” and “having” are used broadly and are considered to be equivalent to the term “consist of’ and “consisting of”. Accordingly, use of any of the foregoing terms in the claims is not intended to exclude addition of other elements or steps to those claimed but, rather, is intended to cover all possible combinations of claimed elements and steps used in association with other elements and steps. It is intended that each element or step recited in a claim can be comprised of one or more individual elements or steps, and that such individual elements or steps can be combined in any and all ways consistent with the disclosure. It is further intended that the disclosure encompass all such individual elements and steps, and all combinations thereof.

[0473] In the claims, reference signs placed in parentheses within a claim shall not be construed as limiting the claim. The phrase “and / or” means and or, and encompasses any and all possibilities of combinations of this feature with the other stated features.

Claims

1. An encryption method (800) of performing an encryption computation on a set of one or more encoded and encrypted values, wherein: - an encryption of a value into a plurality of respective subvalues, wherein a subvalue has a corresponding message modulus and a carry message modulus that is larger than the message modulus; - an encoding and encryption of a value without carry by a non-carrying subvalue that is smaller than the corresponding message modulus; and - an encoding and encryption of a value with carry by at least one carrying subvalue that is larger than or equal to the corresponding message modulus, wherein the method comprises: - accessing (810) the one or more encoded and encrypted values; - applying (820) an encryption operation on at least one input value that is encoded and encrypted with carry to obtain an output value that is encoded and encrypted with carry; - applying (830) an encryption carry reduction on the output value that is encoded and encrypted with carry to obtain a further encoding and encryption of the output value, wherein at least one carrying subvalue is reduced to a non-carrying subvalue.

2. The method (800) of claim 1, wherein the encryption of a subvalue is LWE encryption, wherein the LWE encryption supports a programmable bootstrap operation, wherein the programmable bootstrap evaluates an LWE decryption in an exponent of a GLWE encryption monomial, and wherein the encryption carry reduction uses the programmable bootstrap operation.

3. The method (800) of claim 1 or 2, comprising computing the output value by performing a plurality of encryption arithmetic operations on a set of encoded and encrypted values, wherein the performing does not include an encryption carry reduction.

4. The method (800) of claim 1 or 2, wherein the encryption operation is applied by separately applying respective encryption operations to respective encryptions of subvalues of the input values, wherein the separately applied encryption operations are at least partially performed in parallel.

5. The method (800) of claim 1 or 2, wherein encoding a value into non-carrying subvalues is based on a residue system representation of the value.

6. The method (800) of claim 5, wherein the encoding is further based on a prime factorization of elements of the residue system representation.

7. The method (800) of claim 1 or 2, wherein encoding a value into non-carrying subvalues is based on a prime factorization of the value.

8. The method (800) of claim 6, wherein applying the encryption carry reduction comprises factoring a carrying subvalue of the output value into encryptions of respective subvalues of the subvalue, and adding the encryptions of subvalues of the subvalue to encryptions of corresponding subvalues of the output value.

9. The method (800) of claim 6, comprising performing an encryption multiplication of an encoded and encrypted value and a scalar by computing respective encrypted subvalues of a multiplication of subvalues of the encoded and encrypted value and the scalar.

10. The method (800) of claim 6, comprising performing an encryption multiplication of a first encoded and encrypted value and a second encoded and encrypted value by performing an encrypted encryption multiplication of encryptions of subvalues of the first encoded and encrypted value and the second encoded and encrypted value, wherein an encrypted encryption multiplication result of subvalues is an encoded and encrypted value.

11. The method (800) of claim 6, wherein the residue system’s elements or non-carrying encoded and encrypted values are defined as modulo a modulus smaller than a largest value representable in a decomposition smaller than the base.

12. The method (800) of claim 1 or 2, wherein applying the encryption operation comprises, for a carrying subvalue to be computed, determining a degree of completeness indicating a bound of the carrying subvalue; and, if the bound exceeds a corresponding carry message modulus, applying the encryption carry reduction before computing the carrying subvalue.

13. The method (800) of claim 1 or 2, wherein a message modulus is not a power of 2.

14. The method (800) of claim 1 or 2, wherein a message modulus is at least 3.

15. The method (800) of claim 14, wherein a message modulus is at least 5.

16. The method (800) of claim 15, wherein a message modulus is at least 10.

17. The method (800) of claim 1 or 2, wherein a carry message modulus is at least 4 times a corresponding message modulus.

18. The method (800) of claim 17, wherein a carry message modulus is at least 8 times a corresponding message modulus.

19. The method (800) of claim 18, wherein a carry message modulus is at least 32 times a corresponding message modulus.

20. The method (800) of claim 1 or 2, comprising performing one or more encrypted linear operations and / or one or more encrypted multiplications and / or one or more univariate function evaluations.

21. The method (800) of claim 1 or 2, comprising applying a function evaluation to one or more encoded and encrypted values by: extracting one or more bits from one or more subvalues of the encoded and encrypted values; converting the extracted bits to GGSW ciphertext; and applying a lookup table to the GGSW ciphertext.

22. A computer-implemented compiler method (900) of compiling a computation into a homomorphic executable, wherein the homomorphic executable is executed by an encrypted computation engine, and causes the encrypted computation engine to perform an encrypted method according to any one of claims 1 to 21, wherein the compiler method comprises: - for a carrying subvalue to be computed, determining (910) a degree of completeness indicating a bound of the carrying subvalue; and - if (920) the bound exceeds a carry message modulus of the carrying subvalue, generating (930) instructions causing the encrypted computation engine to apply an encrypted carry reduction before computing the carrying subvalue.

23. An encrypted device (110, 112) for performing an encrypted computation on a set of one or more encoded and encrypted values, wherein: - values are encoded and encrypted into a plurality of respective subvalues, with subvalues having a corresponding message modulus and a carry message modulus larger than the message modulus; - values are non-carrying encoded and encrypted by non-carrying subvalues smaller than the corresponding message modulus; and - - encoding and encrypting a value with carry by at least one carry-in subvalue greater than or equal to the corresponding message modulus of the value, and wherein the device (110, 112) comprises: - a memory (140) for storing one or more encoded and encrypted values; - a processor subsystem (130) configured to apply an encryption operation on at least one input value encoded and encrypted with carry to obtain an output value encoded and encrypted with carry; and to apply an encryption carry reduction on the output value encoded and encrypted with carry to obtain a further encoding and encryption of the output value, wherein at least one carry-in subvalue is reduced to a non-carry-in subvalue.

24. A compiler device (119) for compiling a computation into a homomorphic executable, wherein the homomorphic executable is executed by an encryption computation engine, and causes the encryption computation engine to perform the encryption method according to any one of claims 1 to 21, wherein the device comprises: - a memory (149) for storing data representing a computation to be compiled into a homomorphic executable; - a processor subsystem (139) configured to, for a carry-in subvalue to be computed, determine a degree of completeness indicating a bound of the carry-in subvalue; and if the bound exceeds a carry message modulus of the carry-in subvalue, generate an instruction causing the encryption computation engine to apply an encryption carry reduction before computing the carry-in subvalue.

25. A transitory or non-transitory computer readable storage medium (1000) comprising data (1020) representing: - instructions that, when executed by a processor system, cause the processor system to perform the method according to any one of claims 1 to 21; and / or - instructions that, when executed by a processor system, cause the processor system to perform the method according to claim 22; and / or - a set of one or more encoded and encrypted values for use in the method according to any one of claims 1 to 21, the set of one or more encoded and encrypted values comprising zero or more encoded and encrypted without carry values and one or more encoded and encrypted with carry values, wherein: - a value is encoded and encrypted as a plurality of respective subvalues of an encryption, wherein a subvalue has a corresponding message modulus and a carry message modulus greater than the message modulus; - a value is encoded and encrypted without carry by a non-carry-in subvalue less than the corresponding message modulus; and wherein a value is encoded and encrypted with carry by at least one carry-in subvalue greater than or equal to the corresponding message modulus of the value.

Images