Key with special digits

Abstract

Some implementations involve cryptographic methods for performing cryptographic computations (600). Blind rotation can be applied to an input value encrypted based on a blind rotation input key, thereby obtaining a rotation polynomial encrypted based on a blind rotation output key of a key set. Furthermore, sample extraction can be applied to a polynomial encrypted based on a sample extraction input key, thereby obtaining the encryption coefficients of the polynomial, and / or key switching can be applied to a value or polynomial encrypted based on a key switching input key, thereby obtaining a key-switched output encrypted based on a key-switched output key. The keys are defined such that at least some keys have common bits, and / or at least some keys have more bits with predetermined values.

Description

Technical Field

[0001] The subject matter of this disclosure relates to a cryptographic method for performing cryptographic computation, to a corresponding cryptographic device, and to a computer-readable medium. Background Technology

[0002] Homomorphic cryptography allows a party to perform cryptographic computations on encrypted data even if that party cannot decrypt it: computations such as evaluating a circuit. For example, input data can be received in encrypted form, and the computation result can be returned. Intermediate data (e.g., the internal state of the computation) can also be in encrypted form.

[0003] Even if the computation result is returned in encrypted form, the expected output upon decryption is the same or very close, as if the operation were performed on unencrypted data. Homomorphic encryption can be used to protect privacy when outsourcing storage and computation. This allows data to be encrypted and outsourced to cloud environments for processing and / or storage, all within an encrypted context.

[0004] For example, homomorphic cryptography can be applied to fields such as healthcare, where privacy regulations make it difficult to share plaintext data but allow computation on encrypted medical data. For instance, a medical model developed to classify medical data, for example, can be configured to receive encrypted medical data from a third party (e.g., a hospital). The medical model can classify the medical data, for example, as normal or abnormal, or as having a specific medical syndrome, disease, or other disorder. Using homomorphic encryption, the medical model can be applied to the received medical data in encrypted form. This means that the party providing the medical model cannot access the plaintext medical data corresponding to the encrypted medical data. Users of the service can decrypt the results of the application of the medical model.

[0005] Specifically, existing homomorphic cryptography techniques can, at least in principle, be used to compute any function of encrypted data. This technique is known as "fully homomorphic encryption" (FHE).

[0006] For security reasons, known implementations of FHE use noisy ciphertext. For example, encrypting a data item may involve mapping the data item to a point in a key-related lattice, where noise is added to that point. Specifically, many known implementations of FHE use LWE-type ciphertext, the security of which depends on the cryptographic difficulty of the fault-tolerant learning problem or one of its variants (such as Ring-Tolerant Learning (RLWE) or Generalized Fault-Tolerant Learning (GLWE)). Such LWE-type ciphertext can be LWE ciphertext comprising one or more mask values ​​(e.g., values ​​modulo a specific modulus q, or toroidal elements) plus a body value derived from the mask values ​​and from the plaintext using an encryption key, and the body value containing noise. A generalized generalization of this ciphertext is GLWE ciphertext, which uses polynomials instead of scalar values ​​for encryption. RLWE ciphertext is another type of GLWE ciphertext. Other known implementations of FHE use NTRU-type ciphertext, and the same considerations generally apply to NTRU-type ciphertext.

[0007] When data items are first encrypted, the noise is low, and the encryption is recent. For example, the amount of noise is so low that it can be removed at some point during decryption (e.g., through rounding). On the other hand, the noise should be high enough to make it difficult to attack the system. For example, many homomorphic encryption schemes can be attacked by linear algebra or other efficient algorithms (e.g., latinization algorithms) assuming no noise. When data items are encrypted, noise is chosen to be added so that attacks are difficult while still being able to perform homomorphic operations and decrypt.

[0008] Most homomorphic operations amplify the noise inherent in homomorphically encrypted data items. When such operations are performed multiple times, the noise can reach levels that cannot be uniquely decrypted. Typically, a technique called bootstrapping is known to reduce noise in homomorphically encrypted values. Bootstrapping can be performed using a public key called a bootstrap key. By using bootstrapping to reduce noise when needed, homomorphic operations can, in principle, be computed any desired number of times.

[0009] A specific type of fully homomorphic encryption scheme is the TFHE-class homomorphic encryption scheme. This scheme is described in I. Chillotti et al., “Programmable bootstrapping enables efficient homomorphicinference of deep neural networks,” Cyber ​​Security Cryptography and Machine Learning (CSCML 2021), Lecture Notes in Computer Science, Vol. 12716, pp. 1–19, Springer, 2021 (included in this paper by reference). The TFHE-class scheme differs from other FHE schemes in that it supports a relatively very efficient bootstrapping technique; furthermore, it simultaneously implements the evaluation of the function during the bootstrapping operation (called programmable bootstrapping). Regular bootstrapping corresponds to programmable bootstrapping with an identity function. Interestingly, the amount of noise in the output of a programmable bootstrapping is independent of the noise in the input ciphertext. Therefore, by performing programmable bootstrapping, a function can be applied to the input ciphertext while reducing the noise in the input ciphertext to a fixed amount. By performing programmable bootstrapping an appropriate number of times, cryptographic computations with infinite multiplicative complexity can be performed.

[0010] Typically, cryptographic computation using a TFHE-like homomorphic encryption scheme involves encrypting a value and a polynomial based on a set of keys (e.g., a set of LWE and / or GLWE keys, or a set of NTRU keys). For example, blind rotation can be used, which acts on the encrypted value and can output a cryptographic polynomial. As another embodiment, key switching can be used, which converts between encryptions based on different keys.

[0011] The keys used in cryptographic computations are typically generated randomly according to a probability distribution. For example, the key for the input of a blind rotation can be generated randomly independently, and similarly, the keys for the input and output of a key switch are also generated randomly.

[0012] The method of randomly generating keys depends on the type of key. Many types of keys are known; for example, their digits can be generated based on independent probability distributions (e.g., uniform binary or Gaussian) or on a population probability distribution (e.g., with a fixed population Hamming weight). The type of key used can affect multiple aspects of cryptographic computation, including how the encryption is performed, the resulting computational complexity and noise increase, and the level of security. Summary of the Invention

[0013] While existing TFHE-based cryptographic computation techniques can perform various operations on encrypted values, there is still a need to improve their computational efficiency, the storage requirements for key materials used to perform cryptographic computations, and / or the flexibility of the cryptographic parameter values ​​used. The purpose of this invention is to address at least some of these problems.

[0014] According to one aspect of the invention, a cryptographic method for performing cryptographic computation as defined in claims is provided. According to another aspect, an apparatus corresponding to a computer-implemented method as defined in claims is provided. According to yet another aspect, a computer-readable medium as defined in claims is provided.

[0015] Cryptographic computation can involve encrypting values ​​and polynomials using one or more encryption keys. The encryption key used to encrypt values ​​is also referred to herein as a "value key." The encryption key used to encrypt polynomials is also referred to herein as a "polynomial key." These keys can collectively form a key set. The keys in the key set can support programmable bootstrapping operations; in other words, cryptographic computation can be performed within a "TFHE-class" setting. Specifically, the keys can be qualified according to lattice-based encryption; for example, the value key can be an LWE key, and the polynomial key can be a GLWE key.

[0016] Cryptographic computation can involve various "key-related" operations that transform between different types of encryption and / or encryption based on different keys. Specifically, cryptographic computation may include blind rotation operations, where an input value encrypted using a blind rotation input key of a key set is transformed into a rotation polynomial encrypted using a blind rotation output key of the key set. Blind rotation can evaluate the homomorphic decryption of the encrypted input value in the exponent of the polynomial. For example, the resulting rotation polynomial can represent the application of a lookup table to the input value. This blind rotation is often used as a step in programmable bootstrapping, see "Programmable bootstrapping enables efficient homomorphic inference of deep neural networks".

[0017] The encrypted computation may also include a sample extraction operation and / or a key switching operation, wherein in the sample extraction operation, a polynomial encrypted according to a sample extraction input key of a key set can be converted into encryption of the coefficients of the polynomial, and wherein in the key switching operation, a value or polynomial encrypted according to a key switching input key of a key set can be converted into a key switching output encrypted according to a key switching output key of a key set (e.g., different from the key switching input key).

[0018] When using existing techniques, the corresponding keys for the key set of cryptographic computations are typically generated independently and randomly, where the bits of the key are limited to, for example, iid (independent and identically distributed) random variables, or based on a joint probability distribution of multiple possible values ​​of the allowed bits. The term "bit" can generally refer to the scalar value that forms the key, such as the value that forms the LWE key or the coefficients of the polynomial that forms the GLWE key.

[0019] Interestingly, the inventors realized that by changing the way the keys forming the key set are used, the efficiency of various key-related operations can be improved, the storage requirements of the key materials used in cryptographic computation can be reduced, and the flexibility of cryptographic computation in terms of cryptographic parameters can be improved. In other words, the inventors envision using a key set in which the assumption that keys are generated independently and randomly is relaxed; specifically, by using keys with one or more common digits and / or by using keys with one or more digits having predetermined values.

[0020] By using this special type of key in the key set for cryptographic computation, various operations can be performed in a better manner. Specifically, by using keys with a common set of bits and / or keys with bits containing predetermined values, the storage requirements for key material can be reduced. That is, blind spin operations and key-switching operations typically use bootstrap keys and key-switching keys, respectively, which includes encryption based on the value of the input key. By using keys with a common set of bits, encryption can be shared between different bootstrap keys and key-switching keys. By using keys with bits containing predetermined values, the corresponding encryption can be eliminated, thus requiring less encryption and consequently reducing the key material. Using predetermined bits and common bits also results in fewer encryption operations, making the computation computationally more efficient and producing less noise in the output.

[0021] Similarly, for sample extraction, having an input key with a predetermined value makes the operation more efficient, while using an input key that shares the same number of bits as other keys in the cryptographic computation for sample extraction can reduce the cost of subsequent key switching, or even allow for complete elimination.

[0022] The provided technique effectively provides the party performing the cryptographic computation with some controllable knowledge about the key used, thereby allowing cryptographic computation to be performed in an improved manner. This offers greater flexibility in terms of the cryptographic parameters that can be used. Specifically, existing techniques in many cases rely on the modulo operation of a polynomial ring on a polynomial of order N, where N is a power of 2. This means that when increasing N to improve security, N needs to be doubled, thus doubling the key size and the computational cost of various operations. For example, in cryptographic polynomials... After taking the modulus of N, LWE-type sample extraction will yield LWE ciphertext. Thus, as N increases, its size effectively doubles. However, when sample extraction is performed using a key with a predetermined number of bits, the extraction of these bits can be skipped, allowing the number of elements in the resulting LWE ciphertext to be flexibly set to a value not equal to k·N+1 specified by the parameters encrypted by GLWE.

[0023] Alternatively, both a key sharing the same number of bits as other keys and a key with a predetermined value of bits can be used. Surprisingly, this combination has been found to be particularly effective; specifically, it allows for programmable bootstrapping operations to be performed particularly efficiently for cryptographic computation, where key switching (generating encryption based on a key switching output key, wherein the key switching output key has the same number of bits as the key used for subsequent operations and a key with a predetermined value) can be applied before sample extraction, instead of performing sample extraction first and then key switching in currently known PBS implementations.

[0024] It should be noted that the output key of the sample extraction (which is the same as the input key but is reinterpreted as a set of numbers rather than a set of polynomials) should not be considered a separate key from the sample extraction input key in the key set. Specifically, keys from the key set that share common digits and / or predetermined values ​​can be the input and output keys of blind rotation and / or key switching, as well as the input key of the sample extraction.

[0025] Therefore, the provided techniques offer greater choice in cryptographic parameters and allow for the use of less public-key material in a given use case. Furthermore, improved efficiency and less noise growth are achieved for a variety of cryptographic operations. Thus, more efficient computations can be obtained, for example, with Boolean circuits, arithmetic circuits, neural network inference, or functional circuits.

[0026] Typically, in various cryptographic computations, for performance reasons, it is advantageous to use a key set with multiple keys for encrypting plaintext and / or multiple keys for encrypting polynomials, switching between encryptions based on corresponding keys throughout the computation. For example, this allows for the use of different sets of parameters for corresponding blind rotations, depending on the desired precision or accuracy of the corresponding result. In this case, the provided technique is particularly advantageous by offering improved efficiency and reducing the size of the required public key material (e.g., key-switching keys and / or bootstrapping keys).

[0027] In one implementation, sample extraction can be applied based on an encrypted rotation polynomial (e.g., an encrypted rotation polynomial representing the application of a lookup table to the input values). The sample extraction input key can have one or more bits with predetermined values. Typically, sample extraction determines the obtained encryption of the coefficients of the encrypted input polynomial by determining the corresponding elements of the obtained encryption corresponding to the corresponding bits of the sample extraction input key. If the sample extraction input key has bits with predetermined values, the corresponding elements in the encryption result can be eliminated, making sample extraction faster and the encryption result smaller.

[0028] However, the advantages discussed herein also apply when sample extraction is not applied to the output of blind rotation. For example, a polynomial encrypted based on a sample extraction input key can be used to pack multiple values. The sample extraction input key can be a partial key with one or more bits of predetermined values. By applying the corresponding sample extraction to the cryptographic polynomial, encryption of the corresponding packed values ​​can be obtained. In this case, the encryption result is smaller due to the use of a partial key. As an example, 1024 messages can be packed into a cryptographic polynomial using a partial key (e.g., an RLWE key), where all coefficients except the first 600 are padded with zeros. This ciphertext can be unpacked into, for example, 1024 corresponding encryptions. Advantageously, the resulting ciphertext is smaller, for example, in this embodiment, the size is 601 instead of 1025.

[0029] In one implementation, the sample extraction input key can be the same as the blind rotation output key; for example, sample extraction can be applied to the encrypted rotation polynomial output of the blind rotation. This allows for a more efficient programmable bootstrapping operation. That is, the programmable bootstrapping operation can include modulus switching, followed by blind rotation, then sample extraction, and optionally, key switching. Improved sample extraction makes this programmable bootstrapping more efficient.

[0030] In one implementation, the sample extraction input key may also share one or more common bits with the blind rotation input key. Specifically, programmable bootstrapping can be applied to encryption based on the blind rotation input key and can produce encrypted output based on the same blind rotation input key. This output encryption can be determined particularly efficiently by using a sample extraction input key that shares common bits with the blind rotation input key. Specifically, key switching can be performed to obtain the encrypted output, which can be performed more efficiently due to the common bits. Specifically, the sample extraction input key can be limited such that its bit set consists only of bits from the blind rotation input key and a set of bits with predetermined values. In this case, sample extraction can directly produce the desired encrypted output and can even completely eliminate key switching, making this option particularly efficient in terms of computation and storage.

[0031] In one implementation, programmable bootstrapping can be performed by the following steps: performing a blind rotation; applying a key switch based on the polynomial obtained from the blind rotation; and applying sample extraction based on the output of the key switch. Sample extraction produces encryption based on a desired key (e.g., the key used to encrypt the input value of the blind rotation or another desired key). For this purpose, the key switch output key can be defined such that it includes one or more bits with predetermined values, and also includes bits of the desired key.

[0032] Therefore, the order of key switching and sample extraction can be interchanged compared to known programmable bootstrapping methods that involve blind rotation followed by sample extraction and then key switching. Furthermore, the key switching can be applied to the cryptographic polynomial rather than the encrypted value. Interestingly, this improves efficiency because key switching of the cryptographic polynomial can be implemented more efficiently than key switching of the encrypted value. Specifically, polynomial key switching can be implemented particularly efficiently using the Fast Fourier Transform (FFT) (also known in this context as the Number Theory Transform (NTT)). Moreover, because polynomial key switching is used instead of value key switching, the key switching key is smaller. This effect is especially strong if the encryption is RLWE encryption.

[0033] In one implementation, programmable bootstrapping can be improved to produce outputs with different desired keys by combining blind rotations with key switching of output keys with different key switching output keys. For example, another blind rotation can be applied based on the same blind rotation input key and output key, and its output can be used for another key switching and subsequent sample extraction. For example, one desired key can be the blind rotation input key, and the other desired key can be a different key (e.g., a key formed by a subset or superset of the bits of the blind rotation input key). This allows for efficient combination of bootstrapping with different input keys in homomorphic computation, and efficient use of polynomial key switching to switch between keys. Also, in this case, because polynomial key switching has a small key switching key (specifically, if RLWE key switching is used), a particularly small amount of key material can be used to perform cryptographic computations. This is particularly advantageous when the desired keys have common bits or even subsets of each other, as this allows for a reduction in the size of the bootstrap key, as described herein.

[0034] In one implementation, key switching can be performed when the key-switching input key and the output key share one or more common bits. This allows for particularly efficient key switching. Specifically, key switching typically involves combining corresponding key-switching contributions of corresponding key elements of the key-switching input key, said key-switching contributions being calculated based on corresponding components of the key-switching key. When the input and output keys share common bits, it is not necessary to determine these components, and instead, elements from the input ciphertext can be used. Furthermore, bits that appear in the key-switching output key but not in the key-switching input key can be efficiently handled, for example, by adding zeros corresponding to additional bits. Therefore, generally, using a smaller key-switching key allows for more efficient key switching with less noise.

[0035] In one implementation, key switching can be applied to one or more values ​​encrypted based on a common key switching input key to obtain an encrypted key-switched output polynomial based on said one or more values. Specifically, key switching can be a so-called packing key switching that combines ciphertext of values ​​into ciphertext of a polynomial. Furthermore, this key switching from numerical to polynomial can be improved by using common bits as described herein.

[0036] Specifically, the bits of the key-switching input key can be a subset of the bits of the key-switching output key. In this case, the key-switching can set the ciphertext elements in the key-switching output that correspond to bits in the key-switching output key that do not appear in the key-switching input key to zero. Therefore, this key-switching has very low computational cost, does not use a key-switching key, and does not introduce noise.

[0037] Similarly, the bits of the key-switching input key can be a superset of the bits of the key-switching output key. In this case, key switching may involve switching only the ciphertext elements in the encrypted input value or encrypted polynomial that correspond to bits in the key-switching input key that do not appear in the key-switching output key. Therefore, in this case, key switching has fewer key-switching keys, is faster to compute, and produces less noise.

[0038] In one implementation, a sequence of at least three keys can be used, where bits of one key are a subset of bits of subsequent keys. For example, bits of the first key may be a subset of bits of the second key, and bits of the second key may be a subset of bits of the third key, and so on. This setup allows for efficient key switching between different keys based on key switching between subsequent keys, as described herein. This enables cryptographic computations where corresponding parts are performed using the least possible key that provides the desired level of precision, thereby achieving more efficient cryptographic computation.

[0039] In one implementation, multiple blind rotations can be performed using corresponding blind rotation input and output keys that share one or more common bits. Similar to the key switching key, the blind rotation key may include encryption of corresponding bits of the blind rotation input key. Common encryption of bits can also be used when using common bits for the input keys. Specifically, the bits of the first blind rotation input key may be a subset of the bits of the second blind rotation input key. For compatibility, the encryption can use the same polynomial order N; the blind rotation output keys can be identical, and the bases can be compatible—either they are the same or one base is a power of another (e.g., base 8 = 2^3 has 6 levels, base 64 = 2^6 has 3 levels). In this case, the bootstrap key used for the first input and output keys can be included in the bootstrap key used for the second input and output keys. Therefore, the encryption computation can use less key material.

[0040] The improved techniques for computing encrypted data provided can be applied to a wide range of practical applications. These applications include encrypted evaluation of software programs without accessing plaintext data. For example, medical data on medical diagnostic software can be evaluated without actual access to the medical data itself. Medical data may include medical images. Medical images may include, for example, multidimensional image data, such as two-dimensional (2D), three-dimensional (3D), or four-dimensional (4D) images, acquired through various acquisition modes, such as, but not limited to: standard X-ray imaging, computed tomography (CT), magnetic resonance imaging (MRI), ultrasound (US), positron emission tomography (PET), single-photon emission computed tomography (SPECT), and nuclear medicine (NM).

[0041] In one implementation, the provided techniques can be used to evaluate a neural network with encrypted input. The party evaluating the neural network may or may not have plaintext access to the neural network's training parameters (e.g., weights and biases). Generally, the techniques provided herein improve the efficiency of evaluating neural networks and / or reduce the storage and transmission requirements of the ciphertext or key material used.

[0042] One embodiment of this method may be implemented on a computer as a computer-implemented method, or implemented in dedicated hardware, or a combination of both. Executable code for an embodiment of this method may be stored on a computer program product. Embodiments of the computer program product include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Preferably, the computer program product includes non-transitory program code stored on a computer-readable medium, which, when executed on a computer, performs an embodiment of the method.

[0043] In one embodiment, the computer program includes computer program code that, when run on a computer, is adapted to perform all or part of the steps of the embodiment of the method. Preferably, the computer program is implemented on a computer-readable medium. Attached Figure Description

[0044] Further details, aspects, and embodiments will be described by way of example only with reference to the accompanying drawings. Elements in the drawings are illustrated for simplicity and clarity and are not necessarily drawn to scale. In the drawings, elements corresponding to those already described may have the same reference numerals. In the drawings,

[0045] Figure 1a schematically illustrates an embodiment of one implementation of a cryptographic device;

[0046] Figure 1b schematically illustrates an embodiment of an implementation of an encrypted computing system;

[0047] Figure 2 An example of a key with a predetermined number of bits is shown;

[0048] Figure 3 An example of a key with a common number of bits is shown;

[0049] Figures 4a to 4e illustrate embodiments of programmable bootstrapping;

[0050] Figures 5a to 5e illustrate the conversion between encryption with different keys;

[0051] Figure 6 An embodiment of one implementation of a cryptographic method for performing cryptographic computation is illustrated schematically;

[0052] Figure 7 A computer-readable medium having a writable portion according to one embodiment is illustrated schematically;

[0053] Figure 8 A representation of a processor system according to one embodiment is shown schematically. Detailed Implementation

[0054] Although the subject matter of this disclosure allows for many different forms of implementation, one or more particular embodiments are shown in the accompanying drawings and will be described in detail herein. It should be understood that this disclosure should be regarded as an example of the principles of the subject matter of this disclosure and is not intended to limit it to the particular embodiments shown and described.

[0055] In the following text, for ease of understanding, several elements of the implementation scheme are described in operation. However, it will be clear that the corresponding elements are arranged to perform the functions described herein.

[0056] Furthermore, the subject matter of this disclosure is not limited to these embodiments, but includes every other combination of features described herein or recited in mutually different dependent claims.

[0057] First, some general information and notation applicable to several implementation schemes are provided. Throughout this specification, the parameter q represents the modulus used for the encrypted value, such as a positive integer. Indicator ring The parameter N represents the size of the multiple polynomials used, and is typically a power of 2. Indicator ring and Indicator ring Where p(X) is the cyclotomic polynomial; for example, if N is a power of 2, then p(X) = (XN+1). χ σ Indicates a Gaussian distribution with a mean of zero and a standard deviation of σ. The symbol || indicates concatenation.

[0058] Several implementations use LWE-type encryption. This encryption can be based on the cryptographic difficulty of a family of LWE problems (such as LWE or RLWE, or the more generalized GLWE that encompasses both LWE and RLWE). Typically, LWE ciphertext may include one or more mask values ​​and a body value derived from the mask values ​​and plaintext values. These values ​​are typically integers modulo a given modulus q. Several implementations also use GLWE (Generalized Fault-Tolerant Learning)-type ciphertext. GLWE ciphertext may include one or more mask polynomials and a body polynomial derived from the mask polynomial and plaintext polynomial. GLWE ciphertext may be limited to modulo q and the quotient polynomial p(X). LWE ciphertext can be considered a specific type of GLWE ciphertext where the quotient polynomial is of order one. GLWE ciphertexts other than LWE ciphertexts (e.g., GLWE ciphertexts using polynomials that do not have a constant order) are also called polynomial ciphertexts. Another specific type of ciphertext is RLWE (Ring Fault Tolerant Learning) ciphertext, where the number of mask polynomials is 1.

[0059] Specifically, based on the key information The GLWE ciphertext can be restricted as follows:

[0060]

[0061] Here, This is a GLWE key, where the coefficients are sampled from, for example, a uniform binary distribution, a uniform ternary distribution, or a Gaussian distribution. Key elements can be indicated as... The polynomial coefficients s of the corresponding polynomial of the key i，jThe digits are called the key. In the specific case of LWE, the polynomial is a zero-order polynomial, for example, the constant term (as the value itself) is the only digit.

[0062] also, This can be an appropriate scaling of the input message. Mask element. yes The polynomial in, where the coefficients are, for example, from Sampling is performed from a uniform distribution in the matrix, and B is also referred to as the principal element. E is... The noise (error) polynomial in the equation is such that its coefficients are derived from a Gaussian distribution χ. σ Sampling is performed in the middle. The parameter k is a positive integer and represents the number of polynomials in the GLWE key.

[0063] To simplify the notation, the notation S is sometimes used. k+1 =-1. However, this value or polynomial S k+1 This should not be considered part of the GLWE key. The GLWE key may only include the corresponding mask element A. i The corresponding secret element S, rather than the main element B i Therefore, the GLWE key may consist of only the bits in these secret elements (values ​​or polynomials) that correspond to the main elements (values ​​or polynomials).

[0064] In this embodiment, the LWE ciphertext is an N=1 GLWE ciphertext. In this case, the parameter n=k can be considered for the size of the LWE key, and both the ciphertext and the key can be indicated using lowercase letters, such as ct. q And s. In this embodiment, the RLWE ciphertext is the GLWE ciphertext where k = 1 and N > 1 (e.g., powers of 2).

[0065] Although the integer q is used throughout this instruction manual to indicate the ciphertext modulus, it should be noted that multiple ciphertext moduli can be used in encrypted multiplication. For example, modulus switching can be used to align ciphertexts based on the same q when needed.

[0066] However, in principle, LWE-type ciphertext is not required. Furthermore, for other types of ciphertext (e.g., NTRU-based ciphertext), the key can be limited to digits with common bits and / or predetermined values, and many of the advantages described herein also apply to this setup.

[0067] The above embodiments describe key, symmetric encryption variants. The techniques presented herein are equally applicable to public-key variants known per se. In, for example, the latter case, the above key can be used as a private key, where the public key comprises one or more encryptions of zeros, see, for example, R. Rothblum, “Homomorphic encryption: From private-key to public-key,” Theory of Cryptography (TCC 2011), Lecture Notes in Computer Science, Vol. 6597, pp. 219–234, Springer, 2011 (incorporated herein by reference).

[0068] The provided technique can also be used in cryptographic computations based on multi-key fully homomorphic encryption (FHE). In this setup, multiple counterparties can have multiple counterparty keys (e.g., generated as regular FHE keys) and can perform cryptographic computations on ciphertext encrypted according to the counterparty keys. Specifically, multi-key FHE can be based on a transformation operation, where ciphertext encrypted according to one of the counterparty keys is transformed into (typically, a larger) ciphertext that encrypts the same message according to a combination of said keys. For example, given a counterparty key... and The concatenation key can be limited to, for example: Based on the corresponding key (e.g., The ciphertext can be converted according to the concatenation key. Ciphertext that encrypts the same message. The techniques described herein can be used to perform cryptographic calculations on ciphertext encrypted using a combined key.

[0069] Multiple implementations operate within the TFHE setup, meaning they utilize ciphertext supported by Programmable Bootstrapping (PBS). A programmable bootstrapping system takes ciphertext as input and outputs either ciphertext of the same message or a function of that message (in other words, a lookup table applied to that information) with noise independent of the input. PBS may include blind rotations for evaluating homomorphic decryption of the input ciphertext in a polynomial exponent.

[0070] Specifically, the programmable bootstrap can take the following as input: ciphertext for encrypting message m; bootstrap key; and encryption of lookup table L. The programmable bootstrap can output encryption of message L[m] with a fixed noise level. Such programmable bootstrap using blind rotation is known, for example, from the following literature: I. Chillotti et al., “TFHE: fastfully homomorphic encryption over the torus”, J. Cryptol, 33(1):34-91, 2020, or L. Ducas et al., “FHEW: bootstrapping homomorphic encryption in less than a second”, procedures EUROCRYPT 2015. Blind rotation is also known as an update of accumulator, see, for example, D. Micciancio et al., “Bootstrapping in FHEW-like Cryptosystems”, https: / / eprint.iacr.org / 2020 / 086 (incorporated hereby by reference).

[0071] Programmable bootstrapping in this art is typically implemented by performing the following steps: analog-to-digital switching; followed by blind rotation; and then converting the result of the blind rotation into value ciphertext, for example by means of optional key switching after sample extraction. Sample extraction is also known as extraction from an accumulator. This implementation is described, for example, in “Programmable bootstrapping enables efficient homomorphic inference of deep neural networks” and in the LWE setting in “Bootstrapping in FHEW-like Cryptosystems”. Programmable bootstrapping in the NTRU setting is known from “FINAL: Faster FHE instantiated with NTRU and LWE” and “NTRU-v-um: Secure Fully Homomorphic Encryption from NTRU with SmallModulus”.

[0072] Modulus-to-digital switching (MDS) essentially scales a programmable bootstrap encrypted input to produce a scaled input that is encrypted with the same key as the original input. Since blind rotation typically follows MDS, and MDS does not change the key used to encrypt the value, mode switching is sometimes implicit in this specification. Blind rotation can evaluate the homomorphic decryption of the encrypted input value in the exponent of a polynomial, for example, by calculating X. -μ′ +V, where μ′ is a scaling of the encrypted input value and v is a polynomial encoded in the lookup table. Blind rotations can also be applied to backgrounds other than programmable bootstrap backgrounds. For example, blind rotations without using lookup v are also known as monomial lifts.

[0073] Programmable bootstrapping typically utilizes gadget ciphertexts. Specifically, programmable bootstrapping can be based on computing the outer product of a cryptographic polynomial and such gadget ciphertexts. Typically, gadget ciphertexts can be defined as ciphertexts comprising multiple component ciphertexts that encrypt corresponding values ​​based on plaintext and defined by a gadget matrix. For LWE / GLWE, the gadget ciphertext can be a GGSW ciphertext, known for example from "Programmable bootstrapping enables..." (incorporated herein by reference for the purpose of describing GGSW). In an NTRU setup, gadget encryption can be, for example, NGS encryption as described in C. Bonte et al.'s "FINAL: Faster FHE instantiated with NTRU and LWE", https: / / ia.cr / 2022 / 074 (NGS is incorporated herein by reference for the sake of limitation); or gadget NTRU encryption as described in K. Kluczniak's "NTRU-v-um: Secure Fully Homomorphic Encryption from NTRU with Small Modulus", https: / / ia.cr / 2022 / 089 (NTRU is incorporated herein by reference for the sake of limitation). As is known per se, NTRU bootstrapping can be applied to LWE encrypted values, for example, NTRU bootstrapping can be used to perform encrypted computations on LWE encrypted values. This is described, for example, in C. Bonte et al.'s "FINAL: Faster FHE instantiated with NTRU and LWE", https: / / ia.cr / 2022 / 074. Typically, a secure set of cryptographic parameters can be selected from TFHE-class schemes to minimize computational costs while meeting the required precision. Interestingly, these parameters can be chosen independently of the amount of homomorphic operations and the depth of the circuit being evaluated.

[0074] The keys used in this specification can be sparse keys. Hamming weights A sparse binary (or ternary) key can be constrained such that its polynomial coefficients are in the range {0,1} (or {-1,0,1}) and contain exactly h non-zero coefficients. When using such a key, the dimension k, the polynomial ring... The polynomial order N, distribution (binary or ternary), and Hamming weight h can all be known. Sparse keys can be beneficial for homomorphic computation, see, for example, JHCheon et al., “Homomorphic encryption for arithmetic of approximate numbers,” proceedings ASIACRYPT 201 (incorporated hereby).

[0075] More typically, various types of keys can be used, where the corresponding parameters are, for example, publicly known to the party performing the cryptographic computation. These parameters typically include the key size (e.g., the dimension k and the polynomial ring of the key elements) and the ring used for the cryptographic computation. For example, the following types of keys can be used, where public knowledge is indicated:

[0076]

[0077] Throughout this instruction manual, the text can be explicitly stated as "to press". Modulo integers. Equivalently, these values ​​can be considered as originating from the real torus. The discretized values ​​are as described in the references mentioned above. That is, positive numbers modulo a given modulus and discrete torus elements can be used interchangeably; specifically, and There is isomorphism between them, as mentioned in the literature, for example, see C. Boura et al., “CHIMERA: Combining Ring-LWE-based FullyHomomorphic Encryption Schemes”, J.Math.Cryptol, 14(1): 316-338, 2020.

[0078] The programmable bootstrapping operations in TFHE-class schemes make them an attractive option for widespread application. Bootstrapping is relatively efficient compared to many other FHE schemes, and it is more feasible when performing relatively complex computations (e.g., with multiplication depths of at least 10, 50, or 100). Specifically, the cryptographic parameters of TFHE-class schemes can be chosen based on the desired precision and the computational cost incurred, independent of the amount of homomorphic operations and their circuit depth. Conversely, bootstrapping can be very inefficient in other FHE schemes, so in practice, these schemes are typically applied in a hierarchical manner, meaning their parameters depend on the given computation, allowing them to be performed without bootstrapping. However, this hierarchical approach is not feasible for more complex computations, in which case TFHE-class schemes are particularly advantageous.

[0079] Specifically, in the LWE setting, the security of GLWE-based ciphertext is based on the key distribution and on three main parameters: n = kN, where N is the order of the quotient polynomial, k is the number of random mask polynomials in the ciphertext, and n is the key length; q, the modulus; and σ, a statistical parameter of the noise, such as the standard deviation of the noise. Given these parameters, it is known how to assess the level of security provided, see, for example, M. Albrecht et al., “On the concrete hardness of Learning with Errors,” Journal of Mathematical Cryptology, 9(3):169-203, 2015 (included in this paper by reference).

[0080] In the embodiments described herein, the parameters of the TFHE-type ciphertext used can be selected based on the desired security level and the desired computational precision (such as linear combinations of the ciphertext and / or the application of programmable bootstrapping) (in other words, the noise level generated by applying these operations). Interestingly, in the TFHE setting, the security parameters can be selected independently of computational complexity, for example, independently of the multiplication depth of the computation. This differs from non-TFHE-type schemes, in which security parameters are typically selected to limit or eliminate bootstrapping.

[0081] Specifically, the LWE-based and / or GLWE-based ciphertexts used in the TFHE settings described herein can use relatively small moduli, such as up to 32 bits, up to 64 bits, or up to 128 bits. This moduli is typically chosen independently of the computation to be performed, for example, based on desired precision and / or efficiency. Parameters N, k, and / or σ can be chosen to achieve the desired level of security, also typically independent of the computation to be performed. For example, N can be set to at least 512 and / or up to 2048 or 4096 (e.g., set to 1024). For example, in one implementation, N for the RLWE used is at least 512 and / or up to 2048 or 4096 (e.g., 1024), and k = 1. Such values ​​of N are typically not used in non-TFHE-class encryption schemes because such values ​​severely limit the computations that can be performed; instead, in non-TFHE-class schemes, both q and N are typically chosen based on the desired level of security, allowing q to be much larger.

[0082] Figure 1a schematically illustrates an embodiment of a cryptographic computing device 110. Device 110 can be used to perform cryptographic computations.

[0083] Device 110 may include a processor system 130, memory 140, and a communication interface 150. Memory 140 may include local memory, such as a local hard disk drive or electronic memory. Memory 140 may also include non-local memory, such as cloud storage. In the latter case, memory 140 may include a storage interface connected to non-local memory. For example, memory 110 may be used to store values ​​and polynomials encrypted according to one or more encryption keys. The keys form a key set. Device 110 typically cannot access the keys in the key set in plaintext form. Memory 140 may store additional data, such as bootstrapping keys or key switching keys, as discussed elsewhere.

[0084] Device 110 is capable of internal communication, communicating with other devices, external storage, input devices, output devices, and / or one or more sensors via a computer network. The computer network can be the Internet, an intranet, a LAN, a WLAN, etc. Optionally, the device includes a connection interface 150 arranged to communicate with other devices as needed. For example, the connection interface may include connectors, such as wired connectors (e.g., Ethernet connectors, fiber optic connectors, etc.) or wireless connectors (e.g., antennas (e.g., Wi-Fi, 4G, or 5G antennas)). Communication (e.g., internal communication) may use other communication protocols or media, such as an internal data bus.

[0085] In device 110, communication interface 150 can be used to send or receive digital data. For example, device 110 can be configured to receive or send data representing one or more encrypted values ​​and / or encrypted polynomials (e.g., representing inputs and / or outputs of encrypted calculations). As another embodiment, communication interface 150 can be used to receive data representing one or more bootstrap keys and / or one or more key switching keys.

[0086] Execution of device 110 may be implemented in processor system 130 (e.g., one or more processor circuits, such as microprocessors, embodiments of which are shown herein). Device 110 may include multiple processors, which may be distributed in different locations. For example, device 110 may use cloud computing.

[0087] The processor subsystem 130 can be configured to apply blind rotation to an input value encrypted with a blind rotation input key based on a key set, thereby obtaining a rotation polynomial encrypted with a blind rotation output key based on the key set. The rotation polynomial may, for example, represent the application of a lookup table to the input value.

[0088] The processor subsystem 130 can also be configured to perform sample extraction and / or key switching. The processor subsystem 130 can be configured to apply sample extraction to a polynomial encrypted with a sample extraction input key based on a key set, thereby obtaining the encryption coefficients of the polynomial. Alternatively or additionally, the processor subsystem 130 can be configured to apply key switching to a value or polynomial encrypted with a key switching input key based on a key set, thereby obtaining a key switching output encrypted with a key switching output key based on a key set.

[0089] The first and second keys of the key set may have one or more common bits, and / or at least one key of the key set may have one or more bits with predetermined values. Although device 110 typically does not know the keys themselves, device 100 may know information about which bits are common bits or predetermined bits, so device 110 can be configured to use this information about common bits and predetermined bits to perform cryptographic computations, which allows computations to be performed in the improved manner described herein.

[0090] Processor subsystem 130 may be configured to receive one or more inputs to cryptographic computation (e.g., one or more cryptographic input values ​​and / or one or more cryptographic input polynomials). Processor subsystem 130 may be configured to output one or more outputs to cryptographic computation (e.g., including one or more cryptographic output values ​​and / or including one or more cryptographic output polynomials). For example, processor subsystem 130 may receive inputs from memory 140 and / or from another party via communication interface 150, and / or output the outputs to memory 140 and / or to another party.

[0091] Some of the functional units shown in the diagrams may be functional units of a processor system. For example, the diagram can be used as a blueprint for the possible functional organization of a processor system. In most diagrams, the processor circuitry is not shown separately from the units. For example, Figure 2 The functional units shown in Figure 5 (see below) can be implemented, in whole or in part, in the form of computer instructions stored at a device such as device 110, for example, stored in the electronic memory of device 110, and executable by the microprocessor of device 110. In a hybrid embodiment, the functional units are implemented in part in hardware (e.g., as a coprocessor (e.g., an arithmetic and / or cryptographic coprocessor)) and in part in software (which is stored on and executed on device 110).

[0092] For example, device 110 may be a device for performing cryptographic computations. The cryptographic computations may use homomorphic cryptographic ciphers. For example, device 110 may be used to perform cryptographic computations, such as even if data is received in encrypted form from, for example, a data provider, and even if device 110 cannot decrypt the data, the device can still perform the computations. The computations may involve blind rotations, key switching, and / or sample extraction as described herein. The computations may include a variety of other homomorphic cryptographic operations, such as linear operations (e.g., addition, subtraction, and / or scalar multiplication; multiplication; univariate function evaluation; etc.).

[0093] For example, memory 140 may store encrypted data items, which may be received from one or more data providers, or generated as an intermediate or final result (e.g., output) of a computation. Typically, most or all data items (on which computations of device 110 are performed) are encrypted using a key (or multiple keys) unknown to device 110; that is, device 110 may be configured not to receive plaintext data items corresponding to the encrypted data items, such as plaintext data items stored in memory 140. The decryption key in plaintext form is a secret to device 110, although the encryption / decryption key may be available in encrypted form.

[0094] Figure 1b schematically illustrates an embodiment of an implementation of the cryptographic computing system 100. The system 100 is configured to perform cryptographic computing using homomorphic encryption (e.g., fully homomorphic encryption).

[0095] In this embodiment, system 100 includes a key generation device 111, a data provider device 113, and a cryptographic device 112. The key generation device 111 may be combined with the data provider device 113 in a single device. Device 112 may be configured to receive encrypted data items from the data provider device 113. At least one or more data items may be received in encrypted form. One or more other data items may be received in plaintext format. Device 112 may be configured to receive key material from the key generation device 111 for performing cryptographic calculations, such as a bootstrap key and / or a key switching key.

[0096] Device 112 can perform the computations described herein on received data items and possibly also on stored data items. Interestingly, the device can perform computations on encrypted data without decrypting the data, for example, without converting the encrypted data items into plaintext format.

[0097] In this embodiment, device 112 may be based on device 110 of FIG1a, and may include, for example, the processor system 130, memory 140 and / or communication interface 150 of FIG1a. Each of devices 111, 112, and 113 is generally based on the hardware configuration of device 110 of FIG1a, and may each include, for example, the processor system, memory and / or communication interface of FIG1a.

[0098] Although not shown in this figure, the cryptographic computing system 100 may include multiple cryptographic devices, such as two, three, or more. Cryptographic computations may be distributed across multiple cryptographic devices. The cryptographic devices may exchange intermediate computation results (typically encrypted) with each other. Each cryptographic device may be implemented as cryptographic device 112 and may perform the cryptographic operations described herein.

[0099] Homomorphic encryption schemes can be applied in various settings. For example, cryptographic device 112 can be operated by a cloud provider. The cloud provider can provide computing and storage services to its clients. By employing homomorphic encryption, data provider device 113 (e.g., a client of the cloud provider) can send its data in encrypted form. The cloud provider can still perform the necessary computations and / or storage, but cannot know the correspondence with the plaintext data. For example, data provider device 113 can use an encryption key of the type corresponding to a specific homomorphic encryption system used to encrypt the data item. When data provider 113 receives the computation result from cryptographic computing device 112, the corresponding decryption key can be used to decrypt the encrypted data item. The encryption key and decryption key can be the same, and typically are.

[0100] For example, the encrypted computing system 100 can be configured to train machine learning models (e.g., image classifiers, such as medical models) without requiring the encrypted computing device to access plaintext data items. For example, linear regression can be performed on the input data, possibly even without bootstrapping. For example, backpropagation can be performed on the input data, possibly with bootstrapping. The resulting model parameters can be returned to the entity possessing the decryption key. This allows multiple providers of medical data to aggregate their data by sending it to a cloud provider. The cloud provider then returns the model parameters without accessing the plaintext data. The encryption key can be equal to the decryption key.

[0101] After training the model, the encrypted computing system 100 can be used to provide the model, for example, for use with medical data. This can be done by using plaintext model parameters or encrypted model parameters, in both cases using encrypted data (e.g., encrypted input), intermediate data, and output data. Using plaintext model parameters is generally more efficient. In both cases, the system performs computations (e.g., image classification, such as medical image classification) without the computer knowing the plaintext data items. For example, cancer assessment can be performed on mammograms, where the images are never in plaintext form at the cryptographic device 112, and neither the cryptographic device 112 nor a combination of these devices knows the results of the cancer assessment. From a privacy perspective, it is acceptable to run a plaintext model on encrypted privacy-sensitive data, but unacceptable to run a plaintext model on plaintext privacy-sensitive data.

[0102] Other applications involve database services (e.g., searching for encrypted data in an encrypted database); for example, a computation could be a comparison between an input item and a database item. Multiple computations could be combined to produce a database index that matches an index. For example, the database could be a genomic database, and the input could be gene sequences. System 100 could be used for protected control of devices. For example, a device (even a large device such as a power plant) could send sensor values ​​to cryptographic devices 112 and receive encrypted control signals in return. The control signals are calculated from the sensor signals. An attacker might be able to determine the data content leading to or from one or more cryptographic devices 112, or even access intermediate data from these devices, but would not benefit from this because the data is encrypted. Even if all cryptographic devices 112 of system 100 were completely compromised, no data would be leaked because these devices do not know the decryption key. Computations on the control signals might involve mathematical operations such as linear algebra, averaging, matrix multiplication, and polynomial evaluation, all of which can be performed using homomorphic encryption.

[0103] For example, a pool of encrypted data items can be maintained within a cryptographic computing system; a subset of the encrypted data items can be received, while another subset can be the result of a cryptographic computation (e.g., an intermediate result). For example, cryptographic device 112 can be configured to apply homomorphic encryption to one, two, or more encrypted data items in the pool (e.g., a series of input values ​​and / or intermediate values ​​and / or output values). The result may be a new encrypted data item that can be stored in the pool. The pool can be stored in the memory of the cryptographic computing system. This can be local memory or distributed memory. In the latter case, it is possible that one or more encrypted data items may be represented multiple times in the pool. If, for example, the value of an encrypted data item is needed elsewhere, the encrypted data item can be sent from one computing device to another. The pool can be implemented in various ways, such as register files, arrays, various data structures, etc.

[0104] Encrypted data items can represent all kinds of data. For example, an encrypted data item can represent numbers that need to be averaged or used for linear regression, etc. For example, an encrypted data item can represent an image. For example, each pixel of an image can correspond to one or more encrypted data items. For example, grayscale pixels can be represented by grayscale levels, which can in turn be represented by a single encrypted data item. For example, 256 grayscale levels can be encoded into a single encrypted data item. For example, colored pixels can be represented by multiple color levels (e.g., RGB levels), which can in turn be represented by tuples of encrypted data items. For example, three 256-level colors can be encoded into corresponding encrypted values.

[0105] A set of homomorphic encryption operations can be defined for computation. For example, a network or circuit of operations can be built from homomorphic encryption operations to jointly perform the computation, for example, through a compiler device as described in Figure 1b or through the cryptographic device itself. For example, the operations may include Boolean operations. The way homomorphic encryption operations are combined (e.g., which operation is applied to which operand in a pool) determines which computation is being performed. For example, a computation may be represented as a list of homomorphic encryption operations to be performed along with an indication of which encrypted data item to perform these homomorphic encryption operations on. The network or circuit may instruct the cryptographic device 112 when to perform blind rotations, sample extractions, and / or key switching. For example, the network or circuit may indicate whether the bits of the key used in the corresponding operation are common bits or bits with predetermined values, so that the cryptographic device can perform cryptographic computations appropriate to the shape of the key used.

[0106] Figure 2Detailed, but non-limiting, embodiments of keys having one or more bits with predetermined values ​​are shown. Keys with predetermined bits are also referred to herein as partial keys, specifically partial GLWE keys, partial LWE keys, partial NTRU keys, etc. This contrasts with keys known in the prior art, where each bit typically has at least two possible values, which acquire non-zero probabilities when the key is generated.

[0107] Specifically, the illustration shows a partial key 200 comprising two polynomials (e.g., a GLWE key), where, for illustrative purposes, the coefficients of the polynomials are flattened into an array of coefficients. Key 200 is defined as follows:

[0108] in and Wherein, the number s of the first polynomial 1,0 ,…,s 1,N-1 ,210 and the subset of digits of the second polynomial It is random, for example, selected from a uniform binary distribution; and the remaining digits... It is set to a predetermined value, such as zero.

[0109] More typically, in a partial key, only a predetermined portion of the bits of the partial key may be disclosed from a probability distribution (e.g., a joint distribution or...). The random elements are from a distribution. The remaining digits can be filled with publicly predetermined elements. It is likely known that the positions of these predetermined elements, as well as the positions of each random element from a distribution, are known.

[0110] Mathematically, a portion of a key can be limited to a key parameterized by the following:

[0111] • Common vector of exponents This represents the portion of the key filled with random elements, for example...

[0112] ·and Common vector of associated distributions

[0113] • Common vector of exponents This represents the portion of the key filled with predetermined elements, such as...

[0114] ·and Common vector of associated values For example

[0115] In this mathematical description, some keys can satisfy... and (For example, there exists at least one digit with a predetermined value); as well as

[0116] For example, consider partial key 200. This key comprises two polynomials, where the second polynomial includes a first half 221 filled with random coefficients and a second half 222 (a predetermined part) filled with zeros. Based on the mathematical description above, this key can be represented as: in in in as well as in

[0117] Figure 3 A detailed, but non-limiting, embodiment of a key with one or more common digits is shown. This key is also referred to herein as a shared randomness key. In other words, this key has public knowledge regarding the shared coefficients.

[0118] The figure illustrates this embodiment, showing three different keys, such as the GLWE key: [Figure showing...] 311; 312; and 313.

[0119] Specifically, as illustrated in the figure, keys 311 to 313 can be LWE keys, for example, N1 = N2 = N3 = 1. As illustrated in the figure, the keys in this embodiment... 313 includes All coefficients of 312 (in this case, as the key) 313 (leader coefficient); and 312 includes All coefficients of 311 (in this case, in the key) (in the leading coefficient of 312).

[0120] In mathematics, a multi-key set with a common number of bits can be defined as a structure SRSK with a shared random key, including:

[0121] • List of keys as well as

[0122] • A set of sharing relationships between keys

[0123] For dimension k x and the polynomial of size Nx key The digits (coefficients) of the key can be indicated as: Equivalently, in

[0124] The set of shared relationships can be limited to a form A non-empty set of elements, wherein: v i ∈{1,…,k x}×{0,…,N x -1}, This element means: Specifically, f can be, and in many cases is, the identity function.

[0125] Specifically, the embodiments illustrated in this figure can be mathematically described as a list. Where N = 1, gather It can be limited as follows:

[0126]

[0127] in, express 311 and The sharing coefficient between 312, and among them express 312 and The sharing coefficient between 313.

[0128] Specifically, by using a shared randomness key, key switching between the key switching input key and the key switching output key can be implemented more efficiently. Examples will now be given regarding... Figure 3 The key shown is an LWE-type key (e.g., an LWE key for encrypting values, and / or a GLWE key for encrypting polynomials).

[0129] Specifically, a shared randomness key can be used (e.g., 311 and A key switch is performed between 312) and another key, where the set of digits of one key is a subset of the set of digits of the other key. Specifically, as illustrated in the figure, the key can be an LWE secret key, for example, N=1. For the purposes of the discussion below, key 311 can be indicated as And key 312 can be indicated as Where n1 < n2 and

[0130] As a first embodiment, a key switch from a smaller key 311 to a larger key 312 can be performed. The bits of the key switch input key 311 can be a subset of the bits of the key switch output key 312. In this case, the key switch can be performed by setting the ciphertext elements in the key switch output corresponding to the bits in the key switch output key 312 that do not appear in the key switch input key 311 to zero.

[0131] Specifically, based on the key 311 ciphertext The key can be switched by adding zeros to the end of the ciphertext. 312, thus outputting

[0132] This improves computational efficiency because it avoids regular key switching on ciphertext of size n1; and it reduces noise because it avoids linear combinations that add noise.

[0133] As a second embodiment, a key switch from a larger key 312 to a smaller key 311 can be performed. The bits of the key switch input key 312 can be a superset of the bits of the key switch output key 311. This key switch is also referred to as a "block key switch." In this case, the key switch may include switching only the ciphertext elements in the encrypted value or cryptographic polynomial that correspond to bits in the key switch input key 312 that do not appear in the key switch output key 311.

[0134] Specifically, consider based on the key 312 ciphertext Key to Key 311 can be improved because of the following shared randomness. The b′ part can be recombined into a temporary ciphertext: Some keys can be switched using, for example, conventional key-switching procedures. For example, ciphertext... You can switch keys from key to key. Key switch 311. The result can be added to ct″ to obtain the final result.

[0135] In this embodiment, the key switching key can be smaller, for example, proportional to n2-n1 rather than proportional to n2; the computation can be faster, for example, corresponding to a regular key switching for ciphertext of size n2-n1+1 rather than corresponding to a regular key switching for ciphertext of size n2+1; the noise in the output may be smaller, for example, because the algorithm involves smaller linear combinations.

[0136] The same approach described above can be used to improve packet key switching (e.g., key switching from one or more value ciphertexts to polynomial ciphertexts). In this case, key switching can be applied to one or more values ​​encrypted based on the key switching input key, thereby obtaining an encrypted key switching output polynomial based on one or more values. Similarly, the above technique is applicable when the key switching input key and the key switching output key share a common number of bits, but one key is not a subset of the other key. Also in this case, key switching operations used for the common bits (as discussed above) can be avoided, resulting in a smaller, more efficient, and less noisy key switching key.

[0137] Combination Figure 2 and Figure 3 In some embodiments, the key may include both bits with a predetermined value and bits that share bits with another key. This combination is called a shared randomness partial key. Specifically, the shared randomness partial key can be defined as follows: as per [reference to...] Figure 2 The described partial key list has, for example Figure 3 The described public knowledge regarding the sharing coefficients. This key can be obtained through, for example, regarding... Figure 3 The structure discussed is defined by SRSK, where the key is as follows: Figure 2 The specified partial key.

[0138] Figure 4a illustrates a detailed, but non-limiting, embodiment of a programmable bootstrap (PBS). This embodiment exemplifies a PBS in an LWE setup as known in the art.

[0139] PBS is known to include three operations: MS (analog-to-digital switching), BR (blind rotation), and SE (sample extraction). This diagram illustrates the input of the LWE key based on blind rotation. The encrypted ciphertext 410 is then processed into the MS+BR step 420 to output the RLWE key based on blind rotation. The RLWE ciphertext 430 is encrypted. Then, SE 440 outputs the ciphertext based on the LWE key. The LWE ciphertext is encrypted (450), and finally, an LWE key switch (460) is performed to return to the original blind spin input LWE key.

[0140] In this case, programmable bootstrapping and the key used to return to the original LWE key are used. The key switching 460 combination. It should be noted that this is usually unnecessary. Furthermore, while this diagram uses RLWE ciphertext as an example, another type of GLWE ciphertext can also be used.

[0141] Figure 4b illustrates a detailed, but non-limiting, embodiment of a programmable bootstrap. This programmable bootstrap is based on the embodiment of Figure 4a, but extracts the input key using samples with one or more bits having predetermined values.

[0142] More specifically, analog-to-digital switching and blind rotation 421 can be applied to the input value 410 encrypted according to the blind rotation input key 421, thereby obtaining a rotation polynomial encrypted according to the blind rotation output key 431. The rotation polynomial can represent the application of a lookup table to the input value. Sample extraction 441 can be applied to encrypt the rotation polynomial to obtain the encryption coefficients of the polynomial, which represent the output of the lookup table, wherein the sample extraction input key 431 in this embodiment is the same as the blind rotation output key. Additionally, key switching 461 can be applied to the encryption coefficients to obtain a key switching output. In this embodiment, the key switching returns to the key 410 used to encrypt the input value. Therefore, encryption of the result of applying a lookup table to the input value can be obtained, wherein the noise level of the resulting encryption is independent of the noise level of the input value.

[0143] As illustrated, in this case, the output key 431 of the blind rotation (which is equal to the input key of the sample extraction) is a partial key. That is, it contains bits 432 that do not have a predetermined value and bits 433 that have a predetermined value.

[0144] The result of using this partial key is that the LWE ciphertext output by sample extraction 441 can be smaller than that in Figure 4a, because it is based on a smaller LWE key. The LWE key is encrypted using 451. 451 corresponds to a partial RLWE key. As a result, the computational cost of key switching 461, noise growth, and storage requirements for the key switching key all decrease. Furthermore, the noise growth during blind rotation 421 is also smaller because the key polynomial includes zeros.

[0145] The illustrated embodiments can be generalized in several ways. Typically, one or more operations (e.g., linear homomorphic operations) can be applied to the ciphertext before applying sample extraction 441 and / or before applying key switching 461. As shown in Figure 4a, key switching 461 can also be omitted or delayed.

[0146] Predetermined values ​​other than zero can also be used. For example, a predetermined value can be all zeros or all one, or it can combine zeros and ones; for example, a predetermined value can be a hash of a preimage. Typically, ciphertext can be efficiently converted between keys that differ only in their predetermined values, for example, by calculating ct′=(a1, a2, a3, a4, b-a3-a4), based on partial keys. The ciphertext ct = (a1, a2, a3, a4, b) can be converted based on a partial key. Ciphertext that encrypts the same message.

[0147] Figure 4c illustrates a detailed, but non-limiting, embodiment of the programmable bootstrapping. This embodiment is also based on the embodiment of Figure 4a. Similar to Figure 4b, it involves applying sample extraction using a sample extraction input key having one or more bits with predetermined values.

[0148] In this embodiment, the order of key switching and sample extraction is the reverse of that in Figures 4a and 4b. That is, key switching is performed before sample extraction, not after sample extraction.

[0149] Specifically, in this figure, analog-to-digital switching and blind rotation 420 are applied to input encryption based on input key 410, thereby generating an encrypted rotation polynomial. The rotation polynomial can be encrypted based on key 430, which is independent of the input key. Key switching 470 (in this embodiment, RLWE key switching) is applied based on the encrypted rotation polynomial to obtain a key-switched output, which is encrypted based on key-switched output key 480.

[0150] Interestingly, the key switching output key 480 can be selected to cause the subsequent sample extraction 490 to produce encryption based on the desired key. To this end, as illustrated, the key switching output key 480 (in this embodiment, the same as the sample extraction input key) may include one or more bits 482 with predetermined values, and may also include bits 481 of the desired key. Thus, the sample extraction 490 can indeed produce the desired output, see Figure 4b.

[0151] For example, as illustrated in the figure, it is desirable that the key be the same as key 410 used to encrypt the input, that is, the blind rotation input key of blind rotation 420. This allows encryption calculations to continue using this key after the blind rotation. However, depending on the desired outcome, a different LWE key can be switched.

[0152] By using sample extraction 490 with a shared random partial key in this manner, a faster programmable bootstrapping with key switching is achieved. By performing key switching 470 before sample extraction, key switching 470 can be used on the cryptographic polynomial (in this embodiment, RLWE key switching) instead of on the cryptographic value. This is particularly advantageous because polynomial key switching can utilize FFT / NTT to accelerate computation, thereby improving efficiency. Additionally, the size of the key material can be reduced compared to value key switching.

[0153] Similar to Figure 4b, additional operations (e.g., linear homomorphic operations) can typically be performed before key switching 470 or sample extraction 490, as desired. Multiple programmable bootstraps can also be performed, using the same blind rotation 420 but different key switching 470; thus, the proposed programmable bootstraps can be used to obtain encryption based on multiple corresponding output keys.

[0154] Figure 4d illustrates a detailed, but non-limiting, embodiment of the programmable bootstrapping. This embodiment is also based on the embodiment of Figure 4a. As in Figures 4b and 4c, sample extraction 490 is used, wherein the sample extraction input key has one or more bits with predetermined values.

[0155] As illustrated in the embodiment, analog-to-digital conversion and blind rotation 422 can be performed on the input ciphertext. Interestingly, in this embodiment, a blind rotation is performed such that the blind rotation output key 480 (which is also the sample extraction input key) includes one or more bits 482 with predetermined values ​​and bits 481 of the desired output key. Thus, as discussed with respect to FIG. 4c, applying sample extraction 490 produces encryption based on the desired output key. For example, as illustrated, the desired output key can be the same key 410 on which the input ciphertext is encrypted (i.e., the blind rotation input key), or any other desired key.

[0156] In other words, a partial key that shares randomness with the input key can be used, so that the analog-to-digital conversion, blind rotation 422, and sample extraction 490 directly have the same key as input and output. Interestingly, in this embodiment, there is no need to compute a key switch to return to the input key, making this programmable bootstrapping particularly effective and also eliminating the need for a key switch key in this embodiment.

[0157] Figure 4e illustrates a detailed, but non-limiting, embodiment of a programmable bootstrapping system.

[0158] This embodiment is similar to the embodiment of Figure 4d in that it uses analog-to-digital conversion and blind rotation 423, wherein the blind rotation has an output key 435, which includes digits 436 of the desired output key and digits 438 with predetermined values. Also in this embodiment, sample extraction 442 is used, wherein the sample extraction input key is equal to the blind rotation output key 435. For example, sample extraction can be applied directly to the output of the blind rotation, or one or more operations can exist between them.

[0159] However, in this case, the blind rotation input key includes not only the expected output key digit 436 and the digit 438 with a predetermined value, but also one or more additional digits 437. Therefore, the output of sample extraction 442 can also be encrypted according to key 455, which includes the expected output key digit 436 and the additional digits 437.

[0160] Therefore, key switching 461 can be used to convert the output of sample extraction into encryption based on the desired output key 436. As illustrated in the figure, this output key can be the same as the blind rotation input key 410 used to encrypt the input, but this is not necessary. Interestingly, the key switching in Figure 4e comes from an input key, the set of digits 436, 437 of which includes the digits 436 of the output key. Therefore, key switching 461 can be effectively implemented as a block key switching, see [reference needed]. Figure 3 .

[0161] More generally, it is also advantageous if the output key 455 extracted from the sample has one or more common bits with the desired output key, because as described herein, this allows for a more efficient implementation of the key switch 461 compared to, for example, the general key switch in Figure 4a.

[0162] Specifically, a polynomial partial key 435 can be used, which shares randomness with the input key 410, and also includes additional randomness 437 and bits 438 with known values. This improves the efficiency of key switching 461.

[0163] Figure 5a illustrates a detailed, but non-limiting, example transformation between keys. Typically, cryptographic computation, or a portion thereof, can be based on a value key s,511 (e.g., an LWE key) and an associated polynomial key. 521 (e.g., the GLWE key) is used to perform this. The key material associated with the cryptographic calculations in this part can here be referred to as the key set.

[0164] As illustrated in the figure, this part of the cryptographic computation may include one or more programmable bootstraps 520, ranging from value key 511 to polynomial key 521. For example, as shown in Figure 4a, the programmable bootstrap may include analog-to-digital switching, blind rotation, and sample extraction. The blind rotation of the programmable bootstrap, for example, may use bootstrap key 529.

[0165] Furthermore, the encrypted computation may include one or more key switches 560 from a polynomial key 521 to a value key 511. The key switches may use a key switch key 569.

[0166] The computation may include other operations performed on the ciphertext encrypted according to keys 511 and 521, such as linear operations, like addition between ciphertexts, or multiplication between ciphertext and a known integer.

[0167] Therefore, the key set associated with this part of the cryptographic computation may include: value key 511; polynomial key 521; bootstrap key 529; and key switching key 569. It should be noted that the party performing the cryptographic computation uses only the bootstrap key 529 and the key switching key 569, and typically does not have access to value key 511 and polynomial key 521.

[0168] Specifically, the key set can be limited to a set including the following keys: value keys. 511; Polynomial Key 521, wherein the polynomial key is used for key switching 560. 521 can also be interpreted as a value key. From value key 511 to polynomial key 521's bootstrap key BSK, 529; and, from the polynomial key 521 (interpreted as value key) to value key Key switching key KSK for 511, 569.

[0169] It should be noted that polynomial keys And its interpretation as a value key They are considered to be the same key, and not as separate keys in the key set.

[0170] Typically, the number of digits in the polynomial key 521 is greater than the number of digits in the value key 511, for example, at least twice, at least four times, or at least eight times. Therefore, the polynomial key 521 is sometimes referred to as the "big key" in the key set, and the value key 511 is sometimes referred to as the "small key" in the key set.

[0171] By using the key set as illustrated, cryptographic computations with any number of operations can be performed; for example, there is no limit to the number of operations that can be applied (e.g., addition or multiplication).

[0172] Typically, the overall key set for homomorphic encryption may include multiple key sets as described in this diagram, such as multiple value keys and associated polynomial keys. Interestingly, by using keys 511, 521 with common digits and / or digits with predetermined values ​​in this overall key set, less common material, such as that used for key switching key 569 and / or bootstrapping key 529, can be used, and computational efficiency can be improved. Several embodiments are given herein.

[0173] Figure 5b illustrates a detailed, but non-limiting, embodiment of the key conversion.

[0174] As discussed with reference to Figure 5a, the overall key set used in cryptographic multiplication typically includes multiple key sets as defined with reference to Figure 5a. Specifically, the overall key set may include multiple value keys (e.g., LWE keys) and associated polynomial keys (e.g., GLWE keys). By using different keys, typically with different parameters (e.g., N, k), for different parts of the cryptographic computation, the cryptographic computation can efficiently handle the different precision requirements of different parts.

[0175] For example, cryptographic computation may involve at least two key sets, at least three key sets, or at least five key sets associated with a value key and a polynomial key. Cryptographic computation may include one or more operations from one key set to another. The key material used for these operations may be referred to as a bridging key set.

[0176] For example, the diagram illustrates the cryptographic computation of three key sets, each with a corresponding value key s. (1) ,511;s (2) ,512; and s (3) 513. The six arrows represent key switching between value keys. In this case, the bridging key set may include six corresponding key switching keys for the six corresponding key switching operations. More typically, the key set may include key switching keys for performing key switching from each value key to each other value key.

[0177] Interestingly, the provided technique allows for the use of a smaller bridging key set and / or a more efficient transformation. Several embodiments are given in this paper.

[0178] Figure 5c illustrates a detailed, but non-limiting, embodiment of the key conversion.

[0179] This embodiment illustrates how, by using keys with a common number of bits, it is possible to have a smaller bridging key set and a more efficient conversion between encryption based on corresponding keys (specifically, LWE / GLWE keys). This embodiment demonstrates key switching for the value key used in cryptographic computation (and therefore not, for example, the polynomial key used in programmable bootstrapping).

[0180] In other words, the diagram illustrates key switching between a first key 511, a second key 512, and a third key 513, where the digits of the first key 511 are a subset of the digits of the second key 512, and the digits of the second key 512 are a subset of the digits of the third key 513. Dashed arrows indicate key switching from a smaller key to a larger key. Solid arrows indicate key switching from a larger key to a smaller key. The diagram shows three keys, but this embodiment can be extended to more than three keys, such as at least five keys.

[0181] In this embodiment, due to the overlapping sets of digits, key switching can be efficiently performed from a smaller key to a subsequent larger key (e.g., from key 511 to key 512, or from key 512 to key 513), or from a larger key to a subsequent smaller key (e.g., from key 513 to key 512, or from key 512 to key 511), as per [the relevant context]. Figure 3 As described in the LWE settings. A key switch from one key to another key that is not a subsequent key can be performed by performing a corresponding key switch between subsequent keys (e.g., from key 511 to key 512, then from key 512 to key 513; or from key 513 to key 512, then from key 512 to key 511).

[0182] Specifically, for LWE-type keys, data can be converted from key set (1), 511 to either of the other two key sets 512 and 513 by padding the ciphertext with zeros. Converting data from key set (2), 512 to key set (1), 511 may include a computation of a smaller key switch only on the portion of the ciphertext that does not correspond to key 511. This type of key switch is also referred to herein as block key switch. Similarly, data conversion from key set (3), 513 to key set (1), 511 can be performed as follows: first, by switching the portion of key 513 that is not included in key 512 to convert to key set (2), 512, and then converting to key set (1), 511, as described above.

[0183] Therefore, the bridging key set in this case can be formed solely through key switching from subsequent larger keys to smaller keys (e.g., from key 513 to key 512, and from key 512 to key 511). In other words, using shared randomness keys 511 to 513 allows for factorization of several key-switching keys, resulting in a smaller total data volume required for the key-switching keys. It also produces lower noise and implements a more efficient key-switching ciphertext procedure as described.

[0184] Figure 5d illustrates a detailed, but non-limiting, embodiment of the key conversion.

[0185] In this embodiment, as shown in FIG5c, three value keys 511, 512, and 513 (e.g., LWE keys) are shown, wherein the digits of value key 511 are a subset of the digits of value key 512, and the digits of value key 512 are a subset of the digits of value key 513.

[0186] As described with respect to Figure 5a, cryptographic computation typically involves a polynomial key (e.g., a GLWE key) corresponding to a corresponding value key. Specifically, cryptographic computation may involve a first polynomial key, a second polynomial key, and a third polynomial key corresponding to a first value key, a second value key, and a third value key.

[0187] Interestingly, in this embodiment, the polynomial key is also a shared randomness key. Specifically, the bits of the third value key 513 are a subset of the bits of the first polynomial key 521; the bits of the first polynomial key 521 are a subset of the bits of the second polynomial key 522; and the bits of the second polynomial key 522 are a subset of the bits of the third polynomial key 523. As shown in Figure 5c, this embodiment can be extended to different numbers of value / polynomial key sets than three, for example, at least five such key sets.

[0188] This setup is beneficial because it provides an efficient way to transfer data between key sets using a small amount of key material.

[0189] Specifically, as discussed with respect to Figure 5a, the cryptographic computation may include key switching from polynomial keys in a key set to corresponding value keys (e.g., from key 521 to key 511; from key 522 to key 512; and / or from key 523 to key 513). In this embodiment, these key switching are performed from one key to another key that includes this key as a subset, thus allowing for efficient implementation, as discussed with respect to... Figure 3 The LWE settings discussed. Furthermore, by implementing these key switching operations as key switching between subsequent keys 511, 512, 513, 521, 522, and 523 (e.g., key switching from key 521 to key 513; key switching from key 513 to key 512; and key switching from key 512 to key 511), the total amount of key material used for key switching keys can be greatly reduced.

[0190] Specifically, in this embodiment, the key switching key (whether from the key set or the bridging key set) can be factored into a list of block key switching keys because the digits of the keys are subsets of each other in the key sequences formed by the value keys and polynomial keys 511 to 523. For example, in this embodiment, the key switching key used for cryptographic computation can be stored by storing the following keys:

[0191] ·from 523 to 522 block key switching key;

[0192] ·from 522 to 521 block key switching key;

[0193] ·from 521 to 513 block key switching key;

[0194] ·from 513 to 512 block key switching key;

[0195] ·from 512 to 511 block key switching key.

[0196] Compared to storing data separately without using a shared randomness key... arrive from arrive And from arrive The key material required for key switching can be much smaller.

[0197] Another advantage of using value keys and polynomial keys with shared randomness is that it allows for smaller bootstrap keys. Specifically, a first blind rotation can be applied using a first blind rotation input key 511 and an output key 521, and a second blind rotation can be applied using a second blind rotation input key 512 and the same blind rotation output key 521. If the blind rotation input keys 511 and 512 have common bits (e.g., the bits of key 511 are a subset of the bits of key 512), the blind rotation keys can be stored more efficiently because they contain common encryption. Similarly, blind rotation keys from keys 511-513 to key 522 and from keys 511-513 to key 523 can be stored more efficiently using common encryption.

[0198] Therefore, by using a shared randomness key, several bootstrap keys can be factored by a common factor. Specifically, the bootstrap key may include multiple gadget ciphertexts that encrypt corresponding key bits of blindly rotated input keys 511-513. If an input key 511 is included in another key 512, the bootstrap key of the larger input key 512 may include the bootstrap key of the smaller input key 511. The gadget encryption may use the same polynomial size and the same base, or one base may be divided by other bases.

[0199] Figure 5e illustrates a detailed, but non-limiting, embodiment of the key conversion.

[0200] This embodiment is based on the embodiment of FIG4c. That is, programmable bootstrapping from value key 512 (e.g., LWE key) to the same key can be implemented by performing modulus-to-digital switching and blind rotation 520 to obtain encryption based on polynomial key 532 (e.g., GLWE key); performing key switching 572 (in this embodiment: RLWE key switching; but this is not necessary) to obtain encryption polynomial based on key 580, key 580 including digits of key 512 and digits 582 with predetermined values; and applying sample extraction 592 based on key 580.

[0201] This embodiment illustrates how such programmable bootstrapping can be used in cryptographic computations that employ multiple different sets of keys, including associated value keys and polynomial keys. That is, as illustrated in the figure, programmable bootstrapping can be efficiently performed, whereby the programmable bootstrapping takes a value encrypted according to one key as input and a value encrypted according to another key as output. For this purpose, instead of performing key switching 572 to a key comprising digits 512 of the value input key, key switching 571, 537 can be performed to a key comprising digits of another desired value key. Subsequently, corresponding sample extractions 591, 593 can be applied to obtain the encrypted value based on the desired key.

[0202] Specifically, in this setup, the value key 512 and the polynomial key 532 can be independent of each other. Key switching 571-573 can be polynomial key switching, resulting in a partially randomized key 572, enabling subsequent sample extraction 591-593. This will produce a bridging key set different from that shown in Figure 5d. Interestingly, key switching 571, 572, and 573 can be polynomial key switching, specifically RLWE key switching, thus allowing for small key switching keys (e.g., the RLWE key switching key may only include the number of RLWE ciphertexts equal to the level) and permitting efficient implementations of FFT.

[0203] To convert between value encryptions based on different keys, the value keys 512 can be defined such that their bits are subsets of each other, as discussed with respect to Figure 5c. As explained, this enables efficient conversions, especially in LWE settings. However, this is not necessary in this embodiment, for example, because conversions between value encryptions can be performed via programmable bootstrapping, as described herein.

[0204] Similar to Figure 5d, the blind rotation key can also be factored by making the corresponding input keys of the blind rotation 520 subsets of each other and having the same output key, which further reduces the size of the key material.

[0205] Figure 6 An embodiment of one implementation of a cryptographic method 600 for performing cryptographic computation is illustrated schematically. Method 600 may be computationally implemented.

[0206] Method 600 may include storing 610 values ​​and polynomials encrypted according to one or more encryption keys. The keys may form a key set. A first key and a second key in the key set may share one or more common bits. Alternatively or additionally, at least one key in the key set may have one or more bits with predetermined values.

[0207] Method 600 may include applying 620 blind rotation to an input value encrypted with a blind rotation input key based on a key set, thereby obtaining a rotation polynomial encrypted with a blind rotation output key based on the key set.

[0208] Method 600 may include applying 630 sample extraction to a polynomial that encrypts an input key based on a set of keys, thereby obtaining the encryption coefficients of the polynomial. Alternatively or additionally, method 600 may also include applying 640 key switching to a value or polynomial that encrypts a key-switching input key based on a set of keys, thereby obtaining a key-switching output that encrypts a key-switching output key based on a set of keys.

[0209] Many different ways of performing method 600 are possible, as will be apparent to those skilled in the art. For example, the steps may be performed in the order shown, but the order of the steps may be changed, or some steps may be performed in parallel. Furthermore, other method steps may be inserted between steps. The inserted steps may represent an improvement to the method described herein, or may be unrelated to the method. For example, some steps may be performed at least partially in parallel. Moreover, a given step may not be completely finished before the next step begins.

[0210] Implementations of the method may be executed using software, which includes instructions for causing a processor system to execute method 600. The software may only include those steps taken by a specific sub-entity of the system. The software may be stored on a suitable storage medium (e.g., hard disk, floppy disk, memory, optical disk, etc.). The software may be transmitted as a signal via wired, wireless, or data network (e.g., the Internet). The software may be available on a server for download and / or remote use. Implementations of the method may be executed using a bitstream configured to configure programmable logic (e.g., a field-programmable gate array (FPGA)) to execute the method.

[0211] It will be understood that the subject matter of this disclosure is also extended to computer programs suitable for implementing the subject matter of this disclosure, specifically computer programs on or in a carrier. Programs may be in the form of source code, object code, intermediate source code, and object code such as partially compiled form, or any other form suitable for implementing the methods. Embodiments relating to a computer program product include computer-executable instructions corresponding to each processing step of at least one of the stated methods. These instructions may be subdivided into subroutines and / or stored in one or more files that can be statically or dynamically linked. Another embodiment relating to a computer program product includes computer-executable instructions corresponding to each device, unit, and / or portion of at least one of the stated systems and / or products.

[0212] Typically, the devices described herein (e.g., the devices in Figures 1a and 1b) include one or more microprocessors for executing appropriate software stored in the system; for example, the software may have been downloaded and / or stored in corresponding memory, such as volatile memory like RAM or non-volatile memory like Flash. Alternatively, the system may be implemented wholly or partially as programmable logic (e.g., as a field-programmable gate array (FPGA)). The system may be implemented wholly or partially as a so-called application-specific integrated circuit (ASIC), such as an integrated circuit (IC) tailored for its specific purpose. For example, the circuitry may be implemented in CMOS, for example using a hardware description language such as Verilog, VHDL, etc. Specifically, the system may include circuitry for evaluating cryptographic primitives.

[0213] The processor circuitry can be implemented in a distributed manner (e.g., as multiple sub-processor circuits). The memory can be distributed across multiple distributed sub-memories. Some or all of the memory can be electronic memory, magnetic memory, etc. For example, the memory can have volatile and non-volatile portions. A portion of the memory can be read-only.

[0214] Figure 7 A computer-readable medium 1000 having a writable portion 1010 is shown. The computer-readable medium 1000 is shown in the form of an optically readable medium. The computer-readable medium 1000 can store data 1020, wherein the data can indicate instructions that, when executed by a processor system, cause the processor system to perform an embodiment of a method for performing cryptographic computation according to one embodiment.

[0215] Alternatively or additionally, data 1020 may represent one or more key switching keys and / or one or more bootstrap keys, said key switching keys and / or one or more bootstrap keys being used to perform cryptographic calculations on values ​​encrypted according to one or more encryption keys and polynomials, as described herein. The keys may form a key set. A first key and a second key of the key set have one or more common bits, and / or at least one key of the key set may have one or more bits with predetermined values.

[0216] Data 1020 may be implemented on the computer-readable medium 1000 as a physical marker or by magnetization of the computer-readable medium 1000. However, any other suitable implementation is also contemplated. Furthermore, it will be understood that although the computer-readable medium 1000 is shown herein as an optical disc, the computer-readable medium 1000 may be any suitable computer-readable medium, such as a hard disk, solid-state memory, flash memory, etc., and may be non-recordable or recordable.

[0217] Figure 8 A schematic representation of a processor system 1140 according to one embodiment of a device for performing cryptographic computation is shown. The processor system includes one or more integrated circuits 1110. The architecture of the one or more integrated circuits 1110 is schematically shown in the figure. Circuit 1110 includes a processing unit 1120 (e.g., CPU) for running computer program components to perform a method according to one embodiment and / or implement its modules or units. Circuit 1110 includes memory 1122 for storing programming code, data, etc. A portion of memory 1122 may be read-only. Circuit 1110 may include a communication element 1126, such as an antenna, a connector, or both. Circuit 1110 may include an application-specific integrated circuit 1124 for performing some or all of the processing defined in the method. Processor 1120, memory 1122, application-specific integrated circuit 1124, and communication element 1126 may be connected to each other via interconnect 1130 (e.g., a bus). Processor system 1110 may be arranged for contact and / or contactless communication, using an antenna and / or connector, respectively.

[0218] For example, in one embodiment, the processor system 1140 (e.g., a device for performing cryptographic calculations) may include processor circuitry and memory circuitry, the processor being configured to execute software stored in the memory circuitry. For example, the processor circuitry may be an Intel Core i7 processor, an ARM Cortex-R8, etc. In one embodiment, the processor circuitry may be an ARM Cortex M0. The memory circuitry may be ROM circuitry or non-volatile memory (e.g., flash memory). Alternatively, the memory circuitry may be volatile memory (e.g., SRAM memory). In the latter case, the device may include a non-volatile software interface (e.g., a hard disk, a network interface, etc.) configured to provide the software.

[0219] The following terms include advantageous embodiments.

[0220] Clause 1. A cryptographic method for performing cryptographic computation, comprising:

[0221] - Stores values ​​and polynomials encrypted using one or more encryption keys, wherein the one or more encryption keys form a key set;

[0222] - Apply blind rotation to the input value encrypted with a blind rotation input key based on the key set, thereby obtaining a rotation polynomial encrypted with a blind rotation output key based on the key set; and

[0223] - Apply sample extraction to a polynomial that is encrypted with a sample extraction input key based on the key set, thereby obtaining the encryption coefficients of the polynomial, and / or apply key switching to a value or polynomial that is encrypted with a key switching input key based on the key set, thereby obtaining a key switching output that is encrypted with a key switching output key based on the key set.

[0224] Wherein, the first key and the second key of the key set have one or more common digits, and / or at least one key implementing the key set has one or more digits with predetermined values.

[0225] Clause 2. The method according to Clause 1 includes sample extraction based on a cryptographic rotation polynomial, wherein the sample extraction input key has one or more bits with predetermined values.

[0226] Clause 3. The method according to Clause 2, wherein the sample extraction input key is a blind rotation output key.

[0227] Clause 4. The method according to Clause 2 or 3, wherein the sample extraction input key also has one or more bits common to the blind rotation input key.

[0228] Clause 5. The method according to Clause 4, wherein the set of digits of the sample extraction input key consists only of the digits of the blind rotation input key and the set of digits with predetermined values.

[0229] Clause 6. The methods described pursuant to Clause 2, including

[0230] - Apply blind rotations to obtain encrypted rotation polynomials;

[0231] - Applying the key switching based on the encryption rotation polynomial, thereby obtaining a key-switched output encrypted according to the key-switched output key, and

[0232] - Apply the sample extraction based on the key switching output to obtain encryption based on the desired key.

[0233] The key switching output key includes digits with a predetermined value, and also includes digits of the desired key.

[0234] Clause 7. The method according to Clause 6, wherein the desired key is the blind rotation input key.

[0235] Clause 8. The method according to Clause 6 or 7 further comprises: applying another blind rotation based on the same blind rotation input key and blind rotation output key; applying another key switch based on said other blind rotation and according to said other key switch output key; and applying another sample extraction based on said other key switch to obtain another encryption based on said other desired key.

[0236] Clause 9. The method according to any of the preceding clauses includes applying the key switching, wherein the key switching input key and the key switching output key have one or more common digits.

[0237] Clause 10. The method according to Clause 9 includes applying the key switching to one or more values ​​encrypted based on the key switching input key, thereby obtaining an encrypted key switching output polynomial based on the one or more values.

[0238] Clause 11. The method described pursuant to Clause 9 or 10, wherein:

[0239] - The digits of the key switching input key are a subset of the digits of the key switching output key, and the key switching includes setting the ciphertext element in the key switching output corresponding to the digits in the key switching output key that do not appear in the key switching input key to zero, and / or

[0240] - The number of digits in the key switching input key is a superset of the number of digits in the key switching output key, and the key switching includes switching the key only on the ciphertext elements in the encrypted value or encrypted polynomial that correspond to the digits in the key switching input key that do not appear in the key switching output key.

[0241] Clause 12. The method according to Clause 11, wherein the digits of the first key are a subset of the digits of the second key, and the digits of the second key are a subset of the digits of the third key, wherein the method includes applying a key switch between the first key and the second key, and applying a key switch between the second key and the third key.

[0242] Clause 13. The method according to any of the preceding clauses includes applying blind rotation with the first blind rotation input key and the second blind rotation input key, respectively, wherein the first blind rotation input key and the second blind rotation input key have one or more common bits.

[0243] Clause 14. A cryptographic device (110) for performing cryptographic computation, comprising:

[0244] - Memory (140) for storing values ​​and polynomials encrypted according to one or more encryption keys, wherein the one or more encryption keys form a key set;

[0245] - The processor subsystem (130) is configured as follows:

[0246] - Apply blind rotation to the input value encrypted with a blind rotation input key based on the key set, thereby obtaining a rotation polynomial encrypted with a blind rotation output key based on the key set; and

[0247] - Apply sample extraction to a polynomial that is encrypted with a sample extraction input key based on the key set, thereby obtaining the encryption coefficients of the polynomial, and / or apply key switching to a value or polynomial that is encrypted with a key switching input key based on the key set, thereby obtaining a key switching output that is encrypted with a key switching output key based on the key set.

[0248] Wherein, the first key and the second key of the key set have one or more common digits, and / or at least one key of the key set has one or more digits with predetermined values.

[0249] Clause 15. A temporary or non-temporary computer-readable medium (1000) comprising data (1020), said data representing:

[0250] - Instructions, when executed by the processor system, causing the processor system to perform the methods described in any one of clauses 1-13; and / or

[0251] - One or more key switching keys and / or bootstrap keys for performing cryptographic calculations on values ​​and polynomials encrypted according to one or more encryption keys, the one or more encryption keys forming a key set, wherein a first key and a second key of the key set have one or more common bits, and / or at least one key of the key set has one or more bits with predetermined values.

[0252] Although device 1110 is shown as including one of each described component, multiple components may be repeated in multiple embodiments. For example, processor 1120 may include multiple microprocessors configured to independently perform the methods described herein, or configured to perform steps or subroutines of the methods described herein, such that multiple processors cooperate to achieve the functionality described herein. Furthermore, in the case where device 1110 is implemented in a cloud computing system, multiple hardware components may belong to separate physical systems. For example, processor 1120 may include a first processor in a first server and a second processor in a second server.

[0253] It should be noted that the embodiments mentioned above are illustrative and not limiting of the subject matter of this disclosure, and those skilled in the art will be able to devise many alternative embodiments.

[0254] In the claims, any reference numerals enclosed in parentheses shall not be construed as limiting the claims. The use of the verb 'comprise' and variations thereof does not exclude the presence of elements or steps other than those recited in the claims. The article 'a' or 'an' preceding an element does not exclude the presence of a plurality of such elements. When an expression such as 'at least one' precedes a list of elements, it indicates the selection of all elements or any subset thereof from the list. For example, the expression 'at least one of A, B, and C' should be understood to include only A, only B, only C, both A and B, both A and C, both B and C, or all of A, B, and C. The subject matter of this disclosure can be implemented by hardware comprising several different elements, as well as by a suitably programmed computer. In device claims enumerating several parts, several of these parts can be implemented by the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to exert an advantage.

[0255] In the claims, the reference numerals enclosed in parentheses refer to reference numerals in the drawings illustrating the embodiments or formulas of the embodiments, thereby improving the comprehensibility of the claims. These reference numerals should not be construed as limiting the claims.

Claims

1. A cryptographic method (600) for performing cryptographic computations in fully homomorphic encryption supporting programmable bootstrapping, comprising: -Storing (610) values ​​and polynomials encrypted according to one or more encryption keys, the one or more encryption keys forming a key set, the encryption keys having multiple digits; - Apply (620) blind rotation to the input value encrypted according to the blind rotation input key of the key set, thereby obtaining a rotation polynomial encrypted according to the blind rotation output key of the key set; as well as - A polynomial is encrypted using a sample extraction input key based on the key set (630) sample extraction to obtain the encryption coefficients of the polynomial, and / or a value or polynomial is encrypted using a key switching input key based on the key set (640) key switching to obtain a key switching output encrypted using a key switching output key based on the key set; Wherein, the digits of the first key are a subset of the digits of the second key in the key set, and / or at least one key in the key set has one or more digits with predetermined values.

2. The method (600) of claim 1, comprising applying sample extraction based on a cryptographic rotation polynomial, wherein the sample extraction input key has one or more bits with predetermined values.

3. The method (600) according to claim 2, wherein the sample extraction input key is the blind rotation output key.

4. The method (600) according to claim 2 or 3, wherein the sample extraction input key further has one or more bits common to the blind rotation input key.

5. The method (600) according to claim 4, wherein the set of digits of the sample extraction input key consists only of the digits of the blind rotation input key and the set of digits with predetermined values.

6. The method (600) according to claim 2, comprising: - Applying the key switching based on the encryption rotation polynomial, thereby obtaining a key switching output encrypted according to the key switching output key, and - Apply the sample extraction based on the key switching output to obtain encryption based on the desired key. The key switching output key includes one or more digits with predetermined values, and also includes digits of the desired key.

7. The method (600) of claim 6, wherein the desired key is the blind rotation input key.

8. The method (600) according to claim 6 or 7, further comprising: Apply another blind rotation using the same blind rotation input key and blind rotation output key; Based on the other blind rotation and according to the other key switching output key, another key switch is applied; and based on the other key switch, another sample extraction is applied to obtain another encryption based on another expected key.

9. The method (600) according to any one of claims 1 to 3, comprising applying the key switching, wherein the bits of the key switching input key are a subset of the bits of the key switching output key, or the bits of the key switching input key are a superset of the bits of the key switching output key.

10. The method (600) of claim 9, further comprising applying the key switching to one or more values ​​encrypted based on the key switching input key, thereby obtaining an encrypted key switching output polynomial based on the one or more values.

11. The method (600) according to claim 10, wherein: - The digits of the key switching input key are a subset of the digits of the key switching output key, and the key switching includes setting the ciphertext element in the key switching output corresponding to the digits in the key switching output key that do not appear in the key switching input key to zero, and / or - The number of digits in the key switching input key is a superset of the number of digits in the key switching output key, and the key switching includes switching the key only on the ciphertext elements in the encrypted value or encrypted polynomial that correspond to the digits in the key switching input key that do not appear in the key switching output key.

12. The method of claim 11, wherein the digits of the first key are a subset of the digits of the second key, and wherein the digits of the second key are a subset of the digits of the third key, wherein the method includes applying a key switch between the first key and the second key, and applying a key switch between the second key and the third key.

13. The method (600) according to any one of claims 1 to 3, comprising applying blind rotation with a first blind rotation input key and a second blind rotation input key, wherein the digits of the first blind rotation input key are a subset or superset of the digits of the second blind rotation input key.

14. The method (600) according to any one of claims 1 to 3, wherein the first key comprises digital... The second key includes digits Where n1 < n2, and for 1 ≤ i ≤ n1, Where n1 represents the dimension of the first key and n2 represents the dimension of the second key.

15. The method (600) according to any one of claims 1 to 3, wherein the first key is composed of digital... Composed of, the second key consists of digits Composition, where n1 < n2, and for 1 ≤ i ≤ n1, Where n1 represents the dimension of the first key and n2 represents the dimension of the second key.

16. The method (600) according to any one of claims 1 to 3, wherein the number of digits of the second key is at least twice the number of digits of the first key.

17. The method (600) according to any one of claims 1 to 3, wherein the number of digits of the second key is at least four times the number of digits of the first key.

18. The method (600) according to any one of claims 1 to 3, wherein the number of digits of the second key is at least 8 times the number of digits of the first key.

19. The method (600) according to any one of claims 1 to 3, wherein the key set comprises a value key (S, 511) and an associated polynomial key ( 521), wherein the digits of the value key (511) are a subset of the digits of the polynomial key (521), and / or the value key (511) and the polynomial key (521) have digits with predetermined values, wherein the number of digits of the polynomial key (521) is at least twice the number of digits of the value key (511).

20. The method (600) according to claim 19, wherein the number of digits of the polynomial key (521) is at least four times the number of digits of the value key (511).

21. The method (600) according to claim 19, wherein the number of digits of the polynomial key (521) is at least 8 times the number of digits of the value key (511).

22. The method (600) according to any one of claims 1 to 3, wherein the bits include scalar values ​​forming an encryption key.

23. The method (600) according to any one of claims 1 to 3, wherein the bits include values ​​forming the LWE key, or coefficients of a polynomial forming the GLWE key.

24. A cryptographic device (110) for performing cryptographic computations in fully homomorphic encryption supporting programmable bootstrapping, comprising: - Memory (140) for storing values ​​and polynomials encrypted according to one or more encryption keys, wherein the one or more encryption keys form a key set and the encryption keys have multiple digits; - The processor subsystem (130) is configured as follows: - Apply blind rotation to the input value encrypted with the blind rotation input key according to the key set, thereby obtaining a rotation polynomial encrypted with the blind rotation output key according to the key set; as well as - Apply sample extraction to a polynomial that is encrypted with a sample extraction input key based on the key set, thereby obtaining the encryption coefficients of the polynomial, and / or apply key switching to a value or polynomial that is encrypted with a key switching input key based on the key set, thereby obtaining a key switching output that is encrypted with a key switching output key based on the key set. Wherein, the digits of the first key are a subset of the digits of the second key in the key set, and / or at least one key in the key set has one or more digits with predetermined values.

25. A temporary or non-temporary computer-readable storage medium (1000) including data (1020), wherein the data represents: - An instruction that, when executed by a processor system, causes the processor system to perform the method according to any one of claims 1 to 23.

Images