Multi-key fully homomorphic encryption scheme based on fast blind rotation bootstrap

Abstract

The invention relates to the technical field of network space security, and discloses a multi-key fully homomorphic encryption scheme based on fast blind rotation bootstrap, which is realized based on NTRU hypothesis and by using the fast blind rotation bootstrap technology, and is mainly composed of five PPT algorithms: a parameter generation algorithm, a key generation algorithm, a scalar encryption algorithm and a vector encryption algorithm. A parameter generation algorithm instantiates various parameters used in a homomorphic encryption algorithm by receiving security parameters and outputting tuples. The key generation algorithm is used for generating public keys and private keys for encryption and decryption, and the generated private keys are used for generating encrypted random polynomials and performing polynomial operation in the decryption process. A scalar encryption algorithm encrypts a given plaintext polynomial using a private key for a single data unit. A vector encryption algorithm encrypts a given plaintext polynomial for a plurality of data blocks using a private key. Compared with the prior art, the scheme has higher calculation efficiency and smaller evaluation key size in the ciphertext expansion process.

Description

Technical Field

[0001] The present application relates to the field of cyberspace security technology, and specifically to a multi-key fully homomorphic encryption scheme based on fast blind rotation bootstrapping. Background Art

[0002] Multi-Key Fully Homomorphic Encryption (MKFHE) is an encryption technology that supports homomorphic evaluation of ciphertexts encrypted with different keys and ensures data privacy in the presence of multiple non-trusting parties. Obviously, this good feature of multi-key fully homomorphic encryption enables it to be directly applied to many real-world scenarios, such as multi-party collaborative computing.

[0003] Nowadays, the mainstream multi-key fully homomorphic encryption mainly realizes multi-key homomorphic calculation of LWE encrypted ciphertext through bootstrapping technology, because vector-based LWE ciphertext has advantages of small storage space and fast calculation compared to matrix-based GSW ciphertext. Therefore, the time efficiency and storage complexity of expanding single-key ciphertext into multi-key ciphertext are always related to bootstrapping technology, because in the process of bootstrapping technology, not only a large number of homomorphic evaluation keys are required, but also extremely complex calculations need to be performed. Therefore, how to realize multi-key fully homomorphic encryption based on better bootstrapping technology has become a key issue in this research direction. Summary of the invention

[0004] The purpose of this application is to provide a multi-key fully homomorphic encryption scheme based on fast blind rotation bootstrapping to solve the technical problems raised in the background technology.

[0005] To achieve the above objectives, the present application discloses the following technical solution: a multi-key fully homomorphic encryption scheme based on fast blind rotation bootstrapping, comprising the following steps:

[0006] S1, the parameter generation algorithm instantiates the parameters used in the homomorphic encryption algorithm by receiving the security parameters and outputting a tuple;

[0007] S2. Generate a key using a key generation algorithm, wherein the key includes a public key and a private key for encryption and decryption, wherein the private key is used to generate a random polynomial for encryption and to perform polynomial operations in the decryption process;

[0008] S3, using a scalar encryption algorithm to perform plaintext encryption on a given plaintext polynomial, wherein the plaintext encryption includes: sampling a small coefficient polynomial, and using the private key to encrypt the plaintext to generate a plaintext ciphertext;

[0009] S4. The scalar encryption algorithm performs scalar encryption on the given scalar value, wherein the scalar encryption includes: converting the scalar into a scalar ciphertext using a small coefficient polynomial and a private key;

[0010] S5. A vector encryption algorithm performs vector encryption on the vector data. The vector encryption includes: encrypting each element in the vector in combination with a small coefficient polynomial and a private key to generate a vector ciphertext.

[0011] Preferably, the S1 specifically includes:

[0012] Receive security parameter λ;

[0013] Output Tuple Where N is defined as the length of the polynomial, Q is defined as the modulus of the polynomial, is defined as the key parameter of the polynomial, and B is defined as the basis for decrypting the decrypted text. is the value calculated based on the modulus of the polynomial, l:=[log B (Q)].

[0014] Preferably, in S2, the generation of the key specifically includes:

[0015] sampling Ensure the security and effectiveness of the encryption process;

[0016] Set f: = 1 + 4 · f' until f -1 Exists in the rest ring R Q , ensuring that the generated polynomial f is in the ring R modulo Q Q is reversible so that the correct polynomial operation can be performed during the decryption process, R Q The coefficients of any polynomial in the circular ring used in the key generation algorithm are constrained to be in the modulo Q space;

[0017] Output key sk:=f, used for polynomial operations in the decryption process.

[0018] Preferably, in S2, R Q The calculation formula is:

[0019]

[0020] Among them, Z[X] represents all polynomials with integer set Z as coefficient and X as indeterminate variable, and f(x) takes the 2Nth cyclotomic polynomial

[0021] Preferably, in S3, the plaintext encryption specifically includes the following steps:

[0022] Input a plaintext polynomial m;

[0023] Sample a polynomial g from distribution χ;

[0024] Output plaintext ciphertext

[0025] Preferably, in S4, the scalar encryption specifically includes the following steps:

[0026] Input scalar NTRU encryption u∈R q In a key f∈R Q ;

[0027] Sample f,g∈R Q So that its coefficients come from a ternary distribution;

[0028] calculate By calculating the ratio of the noise polynomial and the key polynomial, the basis for subsequent encryption operations is provided;

[0029] Output scalar ciphertext NTRU Q,f .

[0030] Preferably, in S5, the vector encryption specifically includes the following steps:

[0031] Input key f∈R,v∈R Q and integer parameter B;

[0032] Determine the decomposition base and vector length d;

[0033] Sampling noise polynomial g0,…,g d-1 The coefficients are from a ternary distribution;

[0034] Calculating vector components

[0035] For a∈R Q , perform bit decomposition BitDecom B (a), we get

[0036] Calculate the outer product ⊙ of c and c';

[0037] Output vector ciphertext c⊙c'=NTRU Q,f (u)⊙NTRU' Q,f (v) = NTRU Q,f (uv).

[0038] Compared with the prior art, this application has the following technical effects:

[0039] This application proposes a multi-key fully homomorphic encryption scheme for LWE ciphertext based on fast blind rotation bootstrapping technology. Compared with other multi-key fully homomorphic encryption schemes based on bootstrapping technology, this application has higher computational efficiency and smaller evaluation key size in the ciphertext expansion process. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0041] Figure 1 A schematic diagram of a multi-key fully homomorphic encryption scheme based on fast blind rotation bootstrapping provided in an embodiment of the present application;

[0042] Figure 2 A schematic diagram of the algorithm content executed by the multi-key fully homomorphic encryption scheme based on fast blind rotation bootstrapping provided in an embodiment of the present application. DETAILED DESCRIPTION

[0043] The technical solutions in the embodiments of the present application are described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0044] In this article, the term "comprising" is intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of more restrictions, the elements defined by the sentence "comprising..." do not exclude the presence of other identical elements in the process, method, article or device that includes the elements.

[0045] This embodiment provides a multi-key fully homomorphic encryption scheme based on fast blind rotation bootstrapping. It is mainly composed of five PPT algorithms: parameter generation algorithm, key generation algorithm, scalar encryption algorithm, and vector encryption algorithm. The parameter generation algorithm instantiates various parameters used in the homomorphic encryption algorithm by receiving security parameters and outputting tuples. The key generation algorithm is used to generate public keys and private keys for encryption and decryption. The generated private key will be used to generate encrypted random polynomials and polynomial operations in the decryption process. The scalar encryption algorithm uses a private key to encrypt a given plaintext polynomial for a single data unit. The vector encryption algorithm uses a private key to encrypt a given plaintext polynomial for multiple data blocks.

[0046] First, the relevant knowledge in this solution is introduced as follows:

[0047] (1) Ring: Where Z[X] represents all polynomials with integer set Z as coefficient and X as indeterminate variable, and f(x) takes the 2Nth cyclotomic polynomial is irreducible on Z[X]. Its corresponding residue class ring is The coefficients of any (polynomial) element in the ring are constrained to lie in the modulo Q space. Note that R and R Q have the same basis, since there exists a bijection X→a such that R, R Q Isomorphism with Z[a], Z Q [a], where a is A 2Nth primitive root of unity, so using the indefinite element X as a generator can abstractly generate a cycle, namely {1,X 1 ,X 2 ,...,X N-1 ,-1,...,-X N-1}.

[0048] (2) NTRU problem: (NTRU) Let N>0, Q>1 integers, Let σ>0 be a real number g, And f in R Q Reversible.

[0049] (3) Calculation of (N, Q, σ)NTRU problem: Given h: = g·f -1 In the case of modQ, f and g are restored.

[0050] (4) Decision (N, Q, σ) NTRU problem: It is the problem of distinguishing between uniform random polynomials randomly drawn from and .

[0051] (Matrix NTRU) Let n>0, q>1 be integers, σ>0 be real numbers, and And F is reversible modulo q.

[0052] (5) Calculate the (n, q, σ) matrix NTRU problem: Given H: = G·F -1 In the case of modq, F and G are restored.

[0053] (6) Decision (n, q, σ) matrix NTRU problem: is to distinguish H from The problem between uniform random matrices randomly drawn from .

[0054] (7) LWE problem: (Decision-LWE) For positive integers n and q, and The error distribution χ on LWE n,q,χ The question asks to determine the given sample Is it distributed in the following way: (1) for a vector Conduct sampling e←χ and output (b=<a,s> +e modq,a), called the key; (2) Uniform distribution. LWE n,q,χ Assuming LWE n,q,χ The problem is computationally difficult.

[0055] (8) RLWE problem: (Decision-RLWE) For positive integers n and q, let R be a ring of dimension n and be the error distribution on R. RLWE n,q,χ The problem is to distinguish the given samples The following distribution: (1) For s∈R q is called the key, sampling a←R q , e←χ, then output (b=a·s+emodq,a); (2) Uniform distribution on RLWE n,q,χ Assume that RLWE n,q,χ The problem is computationally difficult.

[0056] (9) Informally, m∈R q The RLWE encryption of the key s∈R q Next, m∈R q Among k keys s1,...,s k The multi-key RLWE ciphertext under k ∈R q The form is

[0057] Secondly, some symbols and algorithm definitions involved in this solution are explained:

[0058] N: length of the polynomial

[0059] Q: modulus of the polynomial

[0060] Key parameters of the polynomial

[0061] B: cardinality of the polynomial

[0062] The results obtained according to Q

[0063] Based on the above, if Figure 1 As shown, the multi-key fully homomorphic encryption scheme based on fast blind rotation bootstrapping of this embodiment includes the following steps:

[0064] S1. The parameter generation algorithm instantiates the parameters used in the homomorphic encryption algorithm by receiving security parameters and outputting tuples. In detail, NTRU.ParamGen(1 λ): used to generate encryption parameters, receive security parameters λ, and output a tuple Among them, the parameters of the NTRU encryption system include the size N of the polynomial ring, the modulus Q, and the noise parameter The base B used to decipher the ciphertext and

[0065] S2. The key generation algorithm generates keys, which include public and private keys for encryption and decryption. The private key is used to generate random polynomials for encryption and to perform polynomial operations in the decryption process. In detail, NTRU.KeyGen: The process of generating keys first samples a polynomial f' from a discrete Gaussian distribution, sets f:=1+4·f' until f -1 Exists in R Q , output private key sk:=f.

[0066] S3, scalar encryption algorithm performs plaintext encryption on a given plaintext polynomial, the plaintext encryption includes: sampling a small coefficient polynomial, using the private key to encrypt the plaintext to generate a plaintext ciphertext. In detail - NTRU.EncS(f,m): scalar encryption is performed on a given plaintext polynomial m, first a random polynomial g is sampled from a discrete Gaussian distribution, then the ciphertext c = g / f + m is calculated and the ciphertext is output.

[0067] S4, scalar encryption algorithm performs scalar encryption on a given scalar value, the scalar encryption includes: using a small coefficient polynomial and a private key to convert the scalar into a scalar ciphertext. In detail - NTRU.EncV(f,u): used to perform NTRU encryption on a scalar u, for u∈R q And the random polynomial g given the key f∈R Q (In R Q is reversible), generating NTRU Q,f Ciphertext.

[0068] S5. Vector encryption algorithm performs vector encryption on vector data. The vector encryption includes: encrypting each element in the vector with a small coefficient polynomial and a private key to generate a vector ciphertext. In detail, NTRU.EncG(f,v): It is used to perform NTRU encryption on a vector v. First, the decomposition length of the encrypted vector v is calculated. Sample a random polynomial f'∈R Q , sample d random polynomials g0,…,g d-1 ∈R Q , calculate the ciphertext vector NTRU' q,f' (v), where each element is (g0 / f'+B 0 ·v,…,g d-1 / f'+Bd-1 v), by Decompose the vector It is expressed as a with base B such that Now, we define a polynomial c∈R Q and a vector NTRU ciphertext The outer product "⊙" as and c'=(c'0,…,c' d-1 ). The dot product between:

[0069] Note: If c∈NTRU Q,f (u) is an NTRU ciphertext, and v has a small coefficient, then the result of c⊙c' is a scalar NTRU ciphertext encrypted with uv, i.e., c⊙c' = NTRU Q,f (u)⊙NTRU′ Q,f (v) = NTRU Q,f (uv).

[0070] Based on the above, the construction of the multi-key fully homomorphic encryption scheme based on fast blind rotation bootstrapping in this embodiment includes the following steps:

[0071] BSKGen: Given an input s∈{0,1} and a key f∈R, each party generates a small coefficient polynomial vector required for encryption Key f i , and for the LWE key s j Encryption is performed and an NTRU ciphertext is output as the Bootstrapping key (where j∈[n]), which is defined as follows:

[0072] The above bootstrap key is defined as EVK k,n =(evk k,0 ,…,evk k,n ,{evk k,j} j∈S ), because EVK k,n Every element in R Q There are d elements in R, so we only need to store kd(n+q) R Q element.

[0073] In this step, each participant generates the small coefficient polynomial vector g required for encryption i , and generate a key f for each participant i , for each LWE key f i, each participant encrypts and outputs the NTRU ciphertext as the bootstrapping key. These ciphertexts are used for subsequent homomorphic computations. The generated bootstrap key EVK k,n Used to perform ciphertext multiplication operations during the bootstrapping process.

[0074] Acc: Given a multi-key LWE ciphertext First, for a=(a0,...,a nk ) calculate And let w' n =1, cloud settings initialization According to the Bsk disclosed by each participant i,j Perform cumulative calculations:

[0075] Acc k,i =Acc k,i ⊙evk k,i

[0076] And after each accumulation, Acc k,i Perform blind rotation and output

[0077]

[0078] If w i w' i+1 Not equal to 1, calculate again

[0079]

[0080] When all calculations are completed, the final output Acc k,i Perform calculations

[0081] Acc=Acc k,nk-1 ⊙evk 1,n+1

[0082] Get the final

[0083]

[0084] in That is, Acc is a key in the multi-key f i Because the NTRU ciphertext EncS encrypted under different keys f(m) and EncV f'(m') Multiplying the ciphertext yields EncS f,f'(mm') At this point, it is necessary to convert the multi-key NTRU ciphertext into the multi-key LWE ciphertext from the above NTRU ciphertext Acc.

[0085] In this step, given a multi-key LWE ciphertext, it is first preprocessed. Then, the bootstrap key EVK publicly disclosed by each participant is used to generate the ciphertext. k,n Perform cumulative calculations and perform blind rotation on the result after each accumulation. Finally, a binary NTRU key f is obtained. i The RLWE ciphertext.

[0086] ·Acc R :Set Acc to an RLWE ciphertext as follows

[0087]

[0088] The RLWE ciphertext Acc R The NTRU key contained in f i Just eliminate it.

[0089] In this step, random noise is added to the RLWE ciphertext obtained in the previous step to form a new RLWE ciphertext. The purpose of this step is to eliminate the NTRU key f in the RLWE ciphertext. i , in preparation for the next step of homomorphic computation.

[0090] HybridProduct: Randomly select a∈R l , key Z∈R, noise e, output b0=-z·a+e∈R l , randomly select r∈R, noise e, output b1=r·a+f·g∈R l , where the NTRU key of the participant. Randomly select d∈R d , noise e, output b2 = -z·d+r·g+e∈R d , given b i,0 , b i,1 , b i,2 and j , where j∈[k], k represents the number of participants, and the calculation

[0091]

[0092] And output

[0093]

[0094] So given a RLWE ciphertext E encrypted under k multi-keys Z RLWE (u), calculate:

[0095]

[0096] Where is the NTRU key of each participant. At the same time, the above formula shows that The output ciphertext is still an RLWE ciphertext ERLWE (f i ·u) so its output can be compared with D i Perform iterative multiplication.

[0097] In this step, it is the key step to perform homomorphic multiplication operation. By combining the RLWE ciphertext under multi-key and multi-key D i Homomorphic computation is performed, and the output result is the plaintext product under the NTRU key of each participant.

[0098] Extract: For the input multi-key RLWE ciphertext where c i,j is the polynomial c i ∈R Q The j-th coefficient of and obtain a new multi-key LWE ciphertext:

[0099]

[0100] Sample extraction: In this step, the constant part of the input multi-key RLWE ciphertext is extracted as the multi-key LWE ciphertext. This is to retain the important information in the RLWE ciphertext and convert it into LWE ciphertext for subsequent processing.

[0101] ModSwitch: Parse the input multi-key LWE ciphertext as For i = 1, ..., kN, and calculate

[0102]

[0103] where B∈{0,1} is sampled from a Bernoulli distribution, and the probability of "success" during sampling is Output

[0104]

[0105] Modulus-to-Digital Conversion: In this step, the LWE ciphertext can be converted from any modulus Q to another q, and the same is true for multi-key LWE ciphertext with little change.

[0106] KSKGen: Given two LWE keys of (potentially) different lengths and Sampling Matrix and Where j = 1, ..., N, calculate

[0107]

[0108] And output the conversion key:

[0109] ksk={(b j ,A j )} 1≤j≤N

[0110] In this step, a key switching key is generated. ksk is a special key used to convert ciphertext from one key to another. In this step, a series of (b j ,A j ) Yes, where b j is generated by the LWE key s and is used to transform the ciphertext from the original key to the target key. j It is obtained by combining the original key s with random noise. The generated ksk contains multiple such (b j ,A j ) pairs, used for different ciphertext conversion operations.

[0111] KeySwitch: Parses the input multi-key LWE ciphertext into For each participant i=1,...,k, a i =(a i,1 ,...,a i,N ) and the conversion key ksk used to represent the participating parties i =(b i,j ,A i,j ).calculate

[0112] ksk={(b j ,A j )} 1≤j≤N

[0113] as well as

[0114]

[0115] let And output the resulting multi-key LWE ciphertext

[0116]

[0117] Multi-key conversion: This process generalizes the LWE key conversion algorithm to the case of multiple keys. Here, express The key distribution on B ks and Parameterized Vector

[0118] In this step, the input multi-key LWE ciphertext is parsed into a new multi-key LWE ciphertext. In this step, the key of each participant in the input ciphertext is converted into the target key using the previously generated ksk. Specifically, the key a of each participant is converted into the target key using ksk. i Convert to a new key a' i , and then combine the new keys of all participants with the random noise part b' to form a new multi-key LWE ciphertext This makes it possible to convert between different keys and enable more complex homomorphic computations.

[0119] Correspondingly, such as Figure 2 As shown, the specific algorithm implementation of the multi-key fully homomorphic encryption scheme based on fast blind rotation bootstrapping in this embodiment includes the following steps:

[0120] enter:

[0121] Output:

[0122] 1

[0123] 2 Calculate w i ,w′ i according to a=(a0,...,a nk )

[0124] 3

[0125] 4 for i=1,…,k do

[0126] 5 for j=0,…,n-1 do

[0127] 6

[0128] 7 end

[0129] 8 end

[0130] 9 ACC N ←Acc N ⊙evk 1,n+1

[0131] 10

[0132] 11

[0133] 12for i=1,…,k do

[0134] 13

[0135] 14 end

[0136] 15

[0137] 16

[0138] 17

[0139] Finally, it should be noted that the above are only preferred embodiments of the present application and are not intended to limit the present application. Although the present application has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments, or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A multi-key fully homomorphic encryption scheme based on fast blind rotation bootstrapping, characterized in that: The following steps are involved: S1, the parameter generation algorithm instantiates the parameters used in the homomorphic encryption algorithm by receiving the security parameters and outputting a tuple; S2. Generate a key using a key generation algorithm, wherein the key includes a public key and a private key for encryption and decryption, wherein the private key is used to generate a random polynomial for encryption and to perform polynomial operations in the decryption process; S3, using a scalar encryption algorithm to perform plaintext encryption on a given plaintext polynomial, wherein the plaintext encryption includes: sampling a small coefficient polynomial, and using the private key to encrypt the plaintext to generate a plaintext ciphertext; S4. The scalar encryption algorithm performs scalar encryption on the given scalar value, wherein the scalar encryption includes: converting the scalar into a scalar ciphertext using a small coefficient polynomial and a private key; S5. A vector encryption algorithm performs vector encryption on the vector data. The vector encryption includes: encrypting each element in the vector in combination with a small coefficient polynomial and a private key to generate a vector ciphertext.

2. The multi-key fully homomorphic encryption scheme based on fast blind rotation bootstrapping according to claim 1 is characterized in that: The S1 specifically includes: Receive security parameter λ; Output tuple (N,Q, B,l), where N is defined as the length of the polynomial and Q is defined as the modulus of the polynomial. is defined as the key parameter of the polynomial, B is defined as the basis for decrypting the decrypted text, l is the value calculated based on the modulus of the polynomial, l:=[log B (Q)].

3. The multi-key fully homomorphic encryption scheme based on fast blind rotation bootstrapping according to claim 2 is characterized in that: In S2, the generation of the key specifically includes: sampling Set f: = 1 + 4 · f' until f -1 Exists in the rest ring R Q , R Q The coefficients of any polynomial in the circular ring used in the key generation algorithm are constrained to be in the modulo Q space; Output key sk:=f.

4. The multi-key fully homomorphic encryption scheme based on fast blind rotation bootstrapping according to claim 3 is characterized in that: In S2, R Q The calculation formula is: Among them, Z[X] represents all polynomials with integer set Z as coefficient and X as indeterminate variable, and f(x) takes the 2Nth cyclotomic polynomial 5. The multi-key fully homomorphic encryption scheme based on fast blind rotation bootstrapping according to claim 4 is characterized in that: In S3, the plaintext encryption specifically includes the following steps: Input a plaintext polynomial m; Sample a polynomial g from distribution χ; Output plaintext ciphertext 6. The multi-key fully homomorphic encryption scheme based on fast blind rotation bootstrapping according to claim 5 is characterized in that: In S4, the scalar encryption specifically includes the following steps: Input scalar NTRU encryption u∈R q In a key f∈R Q ; Sample f,g∈R Q So that its coefficients come from a ternary distribution; calculate By calculating the ratio of the noise polynomial and the key polynomial, the basis for subsequent encryption operations is provided; Output scalar ciphertext NTRU Q,f .

7. The multi-key fully homomorphic encryption scheme based on fast blind rotation bootstrapping according to claim 6 is characterized in that: In S5, the vector encryption specifically includes the following steps: Input key f∈R,v∈R Q and integer parameter B; Determine the decomposition base and vector length d; Sampling noise polynomial g0,…,g d-1 The coefficients are from a ternary distribution; Calculating vector components For a∈R Q , perform bit decomposition BitDecom B (a), we get Calculate the outer product ⊙ of c and c'; Output vector ciphertext c⊙c'=NTRU Q,f (u)⊙NTRU' Q,f (v) = NTRU Q,f (uv).

Images