Method for homomorphically determining the sign of a message by dilation, associated methods and devices

Abstract

The invention relates to a method for homomorphically determining the positive or negative character of a message μ from a corresponding encrypted message c, encrypted by a learning-with-errors type method, the message μ belonging to the discrete torus Tp or to a space in bijection with Tp, with formula (p), the integers pi being mutually prime, the encrypted message c being made up of q components Ci, with formula (c), vi being the Bézout coefficient associated with the integer pi. The method comprises at least one dilation of the encrypted message c in accordance with formula (c[1]), where p is an odd number greater than or equal to 3. The method also includes merging quantities representative of the sign of c and the sign of c[1].

Description

DESCRIPTION TITLE: Method for homomorphic determination of the sign of a message by dilation, associated methods and devices TECHNICAL FIELD

[0001] The technical field is that of homomorphic cryptography methods, devices and systems. TECHNOLOGICAL BACKGROUND

[0002] Homomorphic cryptography, which allows computations or data processing to be performed on encrypted data without first decrypting it, has received a lot of attention recently.

[0003] Indeed, the digital processing of personal data has become ubiquitous in our daily lives. Protecting the confidentiality of this data, and the privacy of the individuals concerned, has therefore become critical, as this personal data increasingly circulates in the digital systems environments we use every day.

[0004] In this context, homomorphic encryption and processing techniques appear to be a very promising solution, as they allow data to be processed while preserving the anonymity and privacy of this data in a particularly secure manner, as the latter are not decrypted during processing.

[0005] Homomorphic cryptography methods therefore respond, among other things, to the technical challenge of allowing: - an external, generally remote, service and processing server to perform "blind" operations on encrypted data, without decrypting it, this server not having the key necessary to decrypt the data, - the encrypted data being provided by another, distinct entity (a client, in the IT sense), which itself has the encryption key.

[0006] These data processing operations may consist of carrying out individual operations, data by data, to format them or filter them by example. But the most notable applications concern data comparison, sorting or grouping operations. It is therefore very useful to have a tool that allows efficient comparisons between encrypted data, and this in a homomorphic manner.

[0007] Homomorphic cryptography can be based on the so-called "learning with errors" (LWE) encryption scheme, in which the encrypted message c=(a,b) is derived from the unencrypted message µ according to the following formula: b=µ+e+as, where: - s is a secret key, - a is a randomly chosen vector, to project the secret key s, and - e is a random noise component, added to µ+as

[0008] To decrypt the message, a person with the secret key s can calculate the quantity ba.s (equal to µ+e), then round the result to remove the noise component e and recover the message µ. Of course, the noise term e must be and remain sufficiently small if the message µ is to be recovered.

[0009] When two encrypted messages are added together, we obtain an encrypted message, which is an encrypted version of the sum (of the two initial unencrypted messages, whose noise component is higher than for the two initial encrypted messages.

[0010] Thus, to prevent the noise term from increasing and growing during data processing, a refresh procedure, usually called "bootstrapping", is executed repeatedly. This procedure produces a refreshed version of c, i.e., an encrypted message c' which is also decrypted as µ (when decrypted using s), but whose noise component is smaller than that of c. This boostrapping procedure is extremely useful and ingenious, but it is also very computationally intensive (especially because the operations involved must be performed homomorphically), especially since it must be executed very regularly.

[0011] The homomorphic encryption scheme described above, which combines "learning with error" and bootstrapping, thus has the disadvantage of being generally very heavy to implement, requiring very significant power or computing time.

[0012] To facilitate the operations in question, it is then generally chosen to operate on binary messages (i.e. messages whose value is either 0 or 1). The complex tools (notably for boostrapping) which have been developed to implement this type of cryptographic scheme are therefore tools adapted to binary messages.

[0013] To perform homomorphic operations on a longer message, the message is decomposed into binary messages (classical binary decomposition), each binary message is encrypted separately, and the operation is then performed homomorphically, bit by bit. But in this process, the (encrypted) carry resulting from each addition or binary operation must be taken into account, and this carry must be propagated to the next binary operation. This is therefore a serial process, which is very consuming, in terms of computation time. In addition, each binary operation is performed homomorphically, which multiplies the number of homomorphic (and therefore time-consuming) operations.

[0014] In this context, it would therefore be useful to have a more computationally efficient homomorphic cryptography technique, particularly suited to database processing operations, for example comparison or sorting. SUMMARY

[0015] The present technology then relates to a method for homomorphic determination of the positive or negative character of a message μ from a corresponding encrypted message c, without decryption of the encrypted message c, the encrypted message c corresponding to the message μ encrypted by a learning type method with error, - the message μ belonging to the discrete torus or to a space in bijection with T p , with the integers pi being coprime, the encrypted message c being formed of q components ci, with vi being the Bézout coefficient associated with the integer pi, defined by u i p i + v i p / p i = 1 , - the method comprising: - a scaling step, comprising a determination of a dilated encrypted message c [1] according to the following formula is a odd number greater than or equal to 3, and - a merging step, comprising a calculation of the sum F0(c) + F1(c [1] ) where F0 and F1 respectively denote a homomorphic calculation operation of a quantity att[0].gε, and of a quantity att[1].gε, gε being a staircase function which is zero on a central interval ]-ε / 2, ε / 2[ and which has two distinct values ​​on either side of this central interval, the coefficient att[1] being less than the coefficient att[0].

[0016] The coefficients att[0] and att[1] are for example such that (att[0] + att[1]).gε remains between -1 / 2 and 1 / 2.

[0017] The decomposition of the encrypted message c into these q independent components ci, and the recomposition of the message c from these components ci is carried out by applying the Chinese remainder theorem.

[0018] The corresponding plaintext message, µ, can also be decomposed into q components µi (and recomposed from these), in the same way.

[0019] Many operations on the encrypted message c, for example a homomorphic addition (Figure 6), a homomorphic multiplication (Figure 7), or a bootstrapping operation, can be performed component by component, by treating the q components ci of the message c, independently of each other, without having to propagate any carry between them.

[0020] We thus take advantage of the particular decomposition of the Chinese theorem, to process in parallel, independently, the different components ci of the encrypted message c, which allows accelerated processing, compared to a binary decomposition with propagation of (encrypted) carryovers.

[0021] It is noted that the different components ci correspond to encrypted “sub-messages”, each associated (by encryption) with one of the “sub-messages” µi making up the total clear message µ (figure 5).

[0022] Planning to use such a decomposition to develop a more efficient homomorphic cryptography technique is far from immediate. Indeed, as mentioned above, most of the currently available homomorphic cryptography tools are specifically adapted to binary messages. Thus, to develop such a technique, it was necessary to go against usual practices and prejudices and develop specific (and elaborate) tools intended for messages longer than just binary (i.e.: to process µi sub-messages, which are not only binary, with two values, since they can take pi values, with pi = 3, 7, 11 or even 17, for example), without even knowing whether a direct homomorphic processing of "long" messages was actually possible or not, or whether it could be performed efficiently or not.In particular, the implementation of such an encryption scheme required the development of a new homomorphic multiplication scheme and a new boostrapping method. It was only once these new tools were developed that the inventors could be sure of the feasibility and interest of such a scheme, with decomposition via the Chinese remainder theorem.

[0023] These new tools (new boostrapping, and new homomorphic multiplication for non-binary “long” sub-messages) are described in detail in the patent application PCT / IB2020 / 001147, not yet published, which was filed by the same applicant.

[0024] This advance, based on these new homomorphic calculation tools, and on this use of the Chinese remainder theorem, makes it possible to process long messages (which can take, for example, 7×11×13×17×19 = 323323 different values).

[0025] However, as indicated in the preamble, a very useful operation in the field of data processing (in particular for the processing of personal or private databases) is the comparison of two messages (of two data) with each other, for example to sort a database or to carry out extractions from it.

[0026] One way to compare two messages (to determine which is larger) is to calculate their difference, then determine the sign of the difference.

[0027] The homomorphic calculation of the difference of two messages, constructed as indicated above (from independent sub-messages, via the Chinese remainder theorem), does not pose any particular difficulty, and can be carried out component by component. On the other hand, the homomorphic determination of the sign of such a message presents difficulties.

[0028] Indeed, the sign of the "complete" message μ has no link with the respective signs of the different components μi which compose it. The sign of the message p cannot therefore be determined component by component.

[0029] This is illustrated by the following numerical example, where Both messages have a positive sign; Their The signs of the The components of the message are therefore (-1,1) for message 2 / 15, and (1,1) for message 7 / 15 while these messages are both positive, which clearly illustrates that the sign of the complete message cannot be deduced from the sign of its components.

[0030] However, determining the sign of the complete message p, directly from the complete encrypted message c (and without decryption of its components), poses difficulties, because of the discontinuity of the sign function at 0 and because of the noise component e present in the complete encrypted message c (with e = Err(μ ) = component which is clearly more important than for the messages individual pi. Thus, when μ is close enough to 0, due to this significant noise component for c, a reliable (homomorphic) determination of the positive or negative character of μ, directly from the encrypted message c, is no longer possible.

[0031] This difficulty is all the more marked since the values ​​of p, which belong to T p , p=p1x...xp q , can be significantly closer to 0 than the values ​​of the individual messages μ1 ... μ q , which belong to Tpi, or T Pi. In other words, the different elements of the discrete torus T p are much closer to each other than the elements of the discrete torus T p1 , or T pi (in addition to being affected by a larger noise component).

[0032] It should be noted that the difficulties in question arise when the value of p is close to 0 or to the ends 1 / 2 and -1 / 2 of the torus. On the other hand, for values ​​far from these points (for example for values ​​close to 1 / 4, or to -1 / 4), a reliable determination of the sign of the message p is possible directly, from its ciphertext c, via a bootstrapping operation including the evaluation of the sign function.

[0033] To overcome the above-mentioned difficulty, two ingenious techniques have been developed by the inventors.

[0034] The first technique allows to scale the message u, more precisely to expand it, by operating directly on its encrypted version c, without expanding the noise e. This expansion operation, possibly carried out for several increasingly large expansion coefficients, allows (if necessary) to take the message out of the neighborhood of 0 to bring it into a zone where its sign can be determined in a weak way, with a very low probability of error, as illustrated schematically in figure 8.

[0035] This dilation of the message value, but not of the associated noise, is achieved by computing the dilated ciphertext C[1] as follows: c [1] = where the expansion coefficient p is an odd number, greater than or equal to 3.

[0036] So in the sum rather than multiplying the sub-message encrypted Ci by (which would increase its noise component), it is the coefficient vi which we multiply by

[0037] And since the Bézout coefficients are each defined to within pi (i.e.: modulo pi), we can keep a reduced value for the 'coefficient' which multiplies Ci, in this sum, which allows to expand c (more precisely: expand p), while hardly expanding its noise component e.

[0038] This noiseless dilation operation is very useful if the value of the message p is close to 0, as explained above. On the other hand, if the value of p is already sufficiently large before dilation (for example close to 1 / 4), the dilation operation, by increasing the value of p, will modify its sign (due to the cyclicity of the torus), thus leading to an erroneous result. The message should therefore only be dilated if necessary.

[0039] But precisely, in a homomorphic cryptography protocol, the initial value of the message is not known, and the operations are executed in a sort of blind way, always in encrypted form. Thus, we cannot know, a priori, if it is necessary to expand the message, or if, on the contrary, we should refrain from expanding it.

[0040] A second technique, implemented in this process, then consists of summing: - the sign (in its encrypted version) of the unexpanded message p, knowing that 0 is attributed if the message p is located in an uncertainty zone, including in particular a central interval, centered on 0, of width e, with - the sign (in its encrypted version) of the expanded message pm, this sign being assigned an attenuation coefficient att[i] which reduces its contribution, compared to the sign of the initial message p.

[0041] Thus, if the initial message has a value large enough to determine its sign without error, it is the first term which will dominate, in this sum (thanks to the attenuation coefficient att[i]), and which will fix the sign of the whole of the sum (while the sign of the dilated, which is "false", will see its contribution crushed).

[0042] On the contrary, if the initial message is in the uncertainty zone in question (with a sign that cannot be reliably determined), then, in this sum, the first term is zero, and the sign of the sum is fixed by the sign of the dilated, which, this time, on the contrary, has a correct value, corresponding to the sign of c itself.

[0043] This procedure, of a sum weighted by increasingly smaller coefficients, can be generalized to the case where several successive expansions are necessary to exit the uncertainty zone.

[0044] To homomorphically determine the sign of the message p from its ciphertext c, but assigning the value 0 to this result when the message is in the uncertainty zone in question, we homomorphically apply a function ge or att[o].ge to p (this function being applied during boostrapping with integrated function calculation), where ge is a staircase function: - which is zero on a central interval ]-e / 2, e / 2[, which has two distinct values, for example -1 and +1 (case of figure 9), on either side of this central interval, and - which is zero near the ends of the torus, on the intervals ]1 / 2-e / 2, 1 / 2[ and [-1 / 2, -1 / 2+e / 2[.

[0045] The two techniques mentioned above allow a homomorphic determination of the sign of a message, decomposed into sub-messages on the basis of the Chinese remainder theorem. They more generally allow to apply any piecewise constant function to such a message (for example the Heaviside function, or another function having more than two distinct pieces, on the interval [-1 / 2, 1 / 2[.

[0046] In addition to the features mentioned above, the method just presented may include one or more of the following optional features, considered individually or in any technically conceivable combination: - the scaling step includes determinations of several dilated encrypted messages c [k] , the integer k varying from 1 to K-1 , each dilated encrypted message being determined according to the following formula c [k] = , and in which the positive or negative character of the message p is determined as a function of c and as a function of the different dilated encrypted messages - the merging step includes a packet merging step during which the following sum is calculated: Fm(c [m] ), where Fk denotes a homomorphic calculation operation of the quantity att[k].ge, where att[k] is an attenuation coefficient less than 1, the sequence of coefficients att[k], k=0..m being decreasing and such that: the sum of the attenuation coefficients, successive to one of the given attenuation coefficients of the sequence, is less than said given attenuation coefficient; for example, it is a geometric sequence with a ratio less than - m is less than K; - the fusion step includes the following steps S1: packet mergers, each packet grouping m terms, each merger of a packet corresponding to the calculation of the intermediate result i being the packet number, - S2: packet merges of intermediate results resi, each merge of a packet of m' intermediate results corresponding to the calculation of a new intermediate result res'j = being the packet number, designating a calculation operation homomorphic of a quantity - step S2 being repeated until only one result is obtained, to which the operation is applied , which provides a final result which is an encrypted version of the sign of the message μ. - the number K-1 of dilated encrypted messages taken into account is such that - which the width ε of the central interval is less than

[0047] The present technology also relates to a method for homomorphically applying the Heaviside function H, which is zero for negative values ​​and equal to 1 otherwise, the method comprising performing the method for determining the positive or negative character of the message μ as described above, the function gε being chosen to be zero for negative values ​​and equal to 1 for positive values.

[0048] The present technology also relates to a method for homomorphically applying a piecewise constant function f to a message μ, the function f having t distinct pieces, the method comprising: - a decomposition of the function f in the form of a linear combination of translated Heaviside functions, i.e. where the coefficients αj are integers and where the abscissas points of discontinuity belong to the interval [-1 / 4, 1 / 4], - a calculation of the quantity each term being determined, homomorphically, in accordance with the method for homomorphically applying the Heaviside function H which has just been presented.

[0049] The present technology also relates to a method for homomorphically determining the maximum of two messages µa and µb, from the corresponding encrypted messages ca and cb, without decrypting the encrypted messages ca and cb, the method comprising: - a homomorphic determination of the quantity H(µa - µb), the Heaviside function H being applied as indicated above, the encrypted version of H(µa - µb) thus determined being denoted h, and - the calculation of the quantity Maxh=h.ca+(1-h).cb - or, a homomorphic determination of the quantity H(µb - µa), the Heaviside function H being applied as indicated above, the encrypted version of H(µb - µa) thus determined being denoted h', and the calculation of the quantity h'.cb+(1-h').ca .

[0050] The present technology also relates to a method for homomorphically determining the minimum of two messages µa and µb, from the corresponding encrypted messages ca and cb, without decrypting the encrypted messages ca and cb, the method comprising: - a homomorphic determination of the quantity H(µa - µb), the Heaviside function H being applied as indicated above, the encrypted version of H(µa - µb) thus determined being denoted h, and - the calculation of the quantity Minh=h.cb+(1-h).ca - or, a homomorphic determination of the quantity H(µb - µa), the Heaviside function H being applied as indicated above, the encrypted version of H(µb - µa) thus determined being denoted h', and the calculation of the quantity h'.ca+(1-h').cb .

[0051] The present technology also relates to a method for sorting a database, the database comprising at least, in a first location of the database, a first encrypted message ca, and in a second location of the database, a second encrypted message cb, the method comprising at least one writing, in the first location, of the quantity Maxh determined in accordance with the method presented above, or of the quantity Minh, determined in accordance with the method presented above.

[0052] According to one aspect of the present technology, any of the methods presented above is executed by a computer (programmed or otherwise arranged to execute the method in question), i.e. an electronic device or system (possibly distributed among several remote devices, remotely) comprising at least one processor for executing logical operations, and a memory device for storing data.

[0053] The present technology also relates to a method of encrypted communication and processing, comprising the following steps: - encryption of at least one message µ, with a private key s, by a client, in the form of an encrypted message c, by a method of the learning type with error, the message µ belonging to the discrete torus or to a space in bijection with with , the integers pi being coprime, the encrypted message c=(c1,...ci,...cq) being formed of q components ci, with being the Bézout coefficient associated with the integer pi , defined by - transmission of the encrypted message c, or of an encrypted database containing the encrypted message c, by the client, to a server separate from the client and not having the private key s, via a communication channel, - processing of the encrypted message c, or of a difference between the encrypted message c and another encrypted message, or of the encrypted database containing the encrypted message c, by the server, in a homomorphic manner, in accordance with any of the methods described above, - transmission of the result of said homomorphic processing, by the server.

[0054] In this method, the encryption step is optional. Furthermore, the transmission step or the emission step could be omitted in this method.

[0055] The present technology also relates to a cryptographic processing server, comprising at least one communication module and one calculation module: - the communication module being configured to receive, from an entity external to the server, an encrypted message c or an encrypted database containing the encrypted message c, the encrypted message c corresponding to a message µ encrypted by a learning type method with error, the message µ belonging to the discrete torus p or to a space in bijection with the integers pi being coprime, the encrypted message c=(c1,...ci,...cq) being formed of q components ci, with being the coefficient of Bézout associated with the integer pi, defined by - the computing module being programmed to process the encrypted message c, or a difference between the encrypted message c and another encrypted message, or the encrypted database containing the encrypted message c, in a homomorphic manner, without decrypting the message c, in accordance with any of the (processing) methods described above.

[0056] The communication module can be configured to also emit the result of said homomorphic processing.

[0057] The present technology also relates to a cryptographic system comprising: - the cryptographic processing server as described above, - a client, configured to encrypt at least the message µ, in the form of the encrypted message c, and to communicate the encrypted message c, or an encrypted database containing the encrypted message c, to the server via a communication channel.

[0058] This technology and its various applications will be better understood by reading the following description and examining the accompanying figures. BRIEF DESCRIPTION OF THE FIGURES

[0059] The figures are presented for information purposes only and are not intended to be limiting.

[0060] [Fig. 1] schematically represents a cryptographic system implementing the present technology.

[0061] [Fig. 2] schematically represents an exemplary embodiment of a cryptographic processing server that can be used in the system of Figure 1.

[0062] [Fig.3] schematically represents another example of the implementation of a cryptographic processing server which can be used in the system of Figure 1.

[0063] [Fig. 4] schematically represents yet another example of the embodiment of a cryptographic processing server which can be used in the system of Figure 1, in particular to carry out encrypted database processing operations.

[0064] [Fig.5] schematically represents an encryption operation implemented in such a system.

[0065] [Fig. 6] schematically represents a homomorphic addition operation, component by component, for two messages that have been encrypted using the encryption operation of Figure 5.

[0066] [Fig. 7] schematically represents a component-by-component homomorphic multiplication operation between two messages that have been encrypted using the encryption operation of Figure 5.

[0067] [Fig. 8] schematically represents the effect of a scaling operation on a message whose sign we are trying to determine.

[0068] [Fig. 9] schematically represents a function used to determine, in a homomorphic manner, the positive or negative character of such a message.

[0069] [Fig.10] schematically represents a packet fusion method, used to determine, in a homomorphic manner, the positive or negative character of such a message.

[0070] [Fig. 11] shows an algorithm (in pseudocode) implementing this packet merging method.

[0071] [Fig.12] groups together, in the form of a table, values ​​of Bézout coefficients, and of “dilated” Bézout coefficients used to determine, in a homomorphic manner, the positive or negative character of such a message, for an example of realization. DETAILED DESCRIPTION

[0072] Figure 1 represents, in a synoptic manner, a cryptographic system 1 comprising: - a cryptographic processing server, 3, and - an entity 2, distinct from the server 3, configured to transmit to the server 3 one or more messages, in encrypted form, for example in the form of an encrypted database DB.

[0073] Server 3 is configured to perform processing operations (function application, comparison, sorting) on ​​the received encrypted message(s), and this in a homomorphic manner, i.e. without decrypting the messages. Server 3 does not have the private encryption key used to produce the encrypted message(s), from one or more unencrypted plaintext messages.

[0074] The entity in question, 2, distinct from the processing server, may be an external database, or a client (in the IT sense), configured to encrypt one or more messages (and, possibly, to collect these messages beforehand), with a private key s, before transmitting the corresponding encrypted message(s) to the server 3, the message(s) being for example accompanied by a processing request.

[0075] A communication channel 5 connects the entity 2 and the server 3. This is, for example, a communication channel for which the transmitted data is likely to be intercepted. It may be a wireless communication channel, or a wired communication channel. The entity 2 and the server 3 may be distant from each other, for example, located in different buildings. But they may also be entities belonging to the same computer system, for example within the same electronic device (for example within the same computer, or the same portable electronic device).

[0076] The cryptographic system 1 can also comprise a recipient entity 4, distinct from the server 3, the result of the homomorphic processing carried out by the server 3 (result which is itself encrypted) being transmitted to this recipient entity 4, via a communication channel 6. The recipient entity 4 can be the entity 2 itself, and the communication channels 5 and 6 can form the same bidirectional communication channel.

[0077] The server 3 comprises a communication module, for receiving and / or transmitting data (in practice one or more encrypted messages, grouped for example in the form of the encrypted database DB), and a calculation module, for carrying out the homomorphic processing operations mentioned above.

[0078] The modules in question may take the form of a dedicated electronic circuit, such as a communication card (for the communication module), or a cryptographic computing circuit comprising at least one processor or programmable circuit, and a memory (for the computing module). The server itself may thus take the form of its own electronic device.

[0079] The modules in question may also each take the form of a set of instructions whose execution by a computer system (for example by a computer) leads to the performance of steps of receiving and / or transmitting data (for the communication module), or of processing data (for the cryptographic calculation module). The server 3 may in particular take the form of delocalized IT services, available, via a communication network (for example via the internet, or via an intranet), in a delocalized IT structure, for example of the “cloud” type (delocalized structure on several separate electronic support devices, distant from each other, networked).

[0080] Server 3 can be programmed to perform different processing operations homomorphically.

[0081] For example, it can be programmed to apply a piecewise function to a message. This is the case for the server 30 corresponding to the example embodiment of Figure 2. The piecewise function in question can, for example, be the sign function Sign (which is equal to +1 if the message is positive, -1 if it is negative, and 0 if the message is zero), or the Heaviside function H (which is equal to 0 if the message is zero or negative, and +1 otherwise), or a piecewise function f with more than two pieces.

[0082] The server can also be programmed to compare two encrypted messages ca and cb, determining the maximum or minimum of these two messages. This is the case for the server 31 corresponding to the example embodiment in Figure 3.

[0083] The server can also be programmed to perform sorting (classification) of such messages, in order to sort an encrypted DB database (without decrypting it), to produce a fully or partially sorted DB' database, for example. This is the case for the server 32 corresponding to the example embodiment in figure 4.

[0084] These different applications are based on a common tool, which is a process for homomorphic determination of the positive or negative character of a message (for example via the homomorphic calculation of the sign function, or of the heaviside function), or, more generally, of determination of the position of this message in relation to a discontinuity of a piecewise function.

[0085] In the following, we describe: - the encryption scheme used, based on the encryption method known as "learning with error", and on a decomposition based on the Chinese remainder theorem, then - the process of homomorphic determination of the positive or negative character of a message.

[0086] Finally, additional details are given regarding the applications in question.

[0087] Encryption scheme

[0088] As mentioned above, the encryption scheme used is based on a decomposition into components, or in other words into sub-messages, based on the Chinese remainder theorem.

[0089] In this scheme, each initial message x, unencrypted, belongs to with the integers pi being first among themselves.

[0090] This message can therefore be broken down into q components xi, each belonging to with xi=x mod(pi) (i.e. modulo(pi)), for i=1…q. This decomposition is carried out during step D, in figure 5.

[0091] For each component xi, a reduced component µi = xi / pi belonging to the discrete torus Tpi is then calculated, here.

[0092] The message (in clear) µ=x / p, associated with x, and which belongs to the discrete Torus Tp, can thus be decomposed into these q components µi, with

[0093] Conversely, it is possible to reconstruct the complete message µ from its components µi, by calculating the following quantity: being the Bézout coefficient associated with the integer pi, defined by

[0094] Each component µi is then encrypted, during step E, according to the so-called learning with error method, with a private key s, to determine an encrypted component ci. The encrypted component ci=(ai,bi) is determined as follows: - random selection of a vector ai, and - calculation of the quantity bi=µi+ei+ai.s where ei is a noise component, added to µi+ai.s.

[0095] When µi belongs, as here, to Tpi, the noise component ei belongs to the torus T=[-1 / 2,1 / 2[.

[0096] The complete ciphertext can be represented by its q components ci, i=1…q, in the form C=(c1,...ci,...cq). The complete ciphertext can also be reconstructed explicitly, from these components, in the form which corresponds directly to an encrypted version of µ (encryption by learning with error, with the same key s). The term b of the encrypted message c=(a,b) belongs to the torus T=[-1 / 2, 1 / 2[, as do the terms bi of its different components ci=(ai,bi).

[0097] To decipher c (or, equivalently, C) each component ci is deciphered (to obtain the plaintext component µi), before recomposing the complete plaintext message µ.

[0098] Each component ci is decrypted, by a decryption module having the private key s, by calculating the quantity bi-ai.s (which is equal to µi+ei), and by rounding the result to the nearest value of the discrete torus Tpi, thus removing the noise component ei to finally obtain µi.

[0099] The encrypted component ci, obtained by thus encrypting the component µi can also be noted

[0100] The encryption scheme is presented above in the case where the message µ belongs to the discrete torus Tp. This encryption scheme can however also be applied when the message µ belongs to a discrete set in bijection with Tp, for example when the message belongs to

[0101] In any case, as indicated in the "summary" section, this encryption scheme, based on a decomposition according to the Chinese remainder theorem, allows to perform very efficiently operations on the message µ (or, equivalently, on the message x), in a homomorphic manner, directly from the encrypted message C=(c1,...ci,...cq), without decrypting C. Indeed, several operations, including addition, subtraction, multiplication, and boostrapping (or "refreshing") can be performed directly from the message C, by processing the components ci of c independently of each other (and therefore, possibly, in parallel with each other), and without having to propagate carry.

[0102] The homomorphic addition of two messages C1 and C2 as described above, each in encrypted form, is thus carried out as follows (figure 6): the quantity being equal to the term-by-term sum of

[0103] Similarly, the homomorphic multiplication of such messages C1 and C2 as described above, each in encrypted form, is performed as follows (Figure 7):

[0104]

[0105] Or denotes a homomorphic multiplication operation of two messages belonging to Tpi×Tpi, described in detail in the patent application PCT / IB2020 / 001147, not yet published, and which was filed by the same applicant (paragraphs 118 to 134, and initial claim 6 of this earlier application; in this earlier application, the notations are generally identical to the notations used here, but the notation µ replaces the notation m, and the notation q replaces the notation r).

[0106] Similarly, a "refreshed" version C' of the encrypted message C can be determined by calculating, component by component, the following quantity where G denotes a bootstrapping operation for messages belonging to Tpi (and which at the same time applies a function g to the clear message). This boostrapping operation is described in more detail in the aforementioned patent application PCT / IB2020 / 001147, in paragraphs 85 to 117, and in the initial claim 3 of this earlier application.

[0107] Homomorphic determination of the positive or negative character of a message

[0108] As explained in the "summary" section, unlike addition, subtraction, multiplication and boostrapping operations, the sign of the message µ cannot be determined from the respective signs of the components of this message.

[0109] And directly determining the sign of the message µ, from its encrypted version c, presents difficulties (explained in detail in the "summary" section), because the encrypted message c is affected by a significant noise component , which prevents a reliable determination of the sign when µ is close to 0.

[0110] Moreover, more generally, as the elements of Tp are close (closer to each other than those of Tpi), and as the noise component e is large (larger than the noise component ei affecting the component ci), it is generally not possible to directly decipher, in a reliable manner, the encrypted message c (the decipherment involves a decipherment of each component ci, then a recomposition of µ).

[0111] For example, - for 23, - and for individual noise components ei whose amplitude is chosen so as to obtain a correct decipherment for each component ci, with a probability of 1-10 -10 , - it can be shown that the probability of an erroneous decryption of a message µ belonging to Tp is greater than 0.65, which clearly shows that a direct and reliable decryption of c (or a direct and reliable determination of its sign) is not possible in practice.

[0112] As explained in the "summary" section, two original techniques are proposed to overcome this difficulty, and in order to determine in a homomorphizes the positive or negative character of the message μ, reliably, directly from its full encrypted version c. This involves a scaling technique with no (or little) added noise, and a sign merging technique, presented in more detail below.

[0113] Noiseless scaling

[0114] When the message p is close to 0, or to the edges 1 / 2 and -1 / 2 of the torus T, it is in an uncertainty zone, where its sign cannot be reliably determined.

[0115] A scaling operation, more precisely dilation, which remarkably does not increase the noise affecting the message, can then make it possible to take the value of the message out of this uncertainty zone (figure 8). The uncertainty zone in question corresponds to the intervals: ]-e / 2,e / 2[, ]1 / 2-e / 2, 1 / 2[ and [- 1 / 2, -1 / 2+e / 2[ (where e is a parameter, presented later).

[0116] This scaling operation consists of calculating a dilated encrypted message c [1] , from the message c (more precisely, from its components Ci), in accordance with the following formula where the coefficient of expansion p is an odd number greater than or equal to 3, and less than p.

[0117] As explained above, this operation allows the message μ to be expanded, but without increasing (or only slightly increasing) the associated noise component.

[0118] It is understood that such an expansion allows, for certain values ​​of p, to take the value in question out of the uncertainty zone. But, for other smaller values, a greater expansion may be necessary to get out of this uncertainty zone.

[0119] Remarkably, considering the following we shows that, for - If then there exists an integer such that for everything we while in other words, in the sequel there is indeed a coefficient of expansion for which the expanded message is outside the zone of uncertainty (i.e.: of determinable sign) and of same sign as µ (in the following it is the first expansion coefficient for which it leaves the uncertainty zone), and - If then there exists an integer such as for all we have while

[0120] Demonstration of the existence of k* and framing of its value

[0121] This result can be demonstrated as follows.

[0122] First of all, we note that:

[0123] Furthermore, if / ∈ 1 / 2 ^ a′, 1 / 2 , then 1 / 2 ^ / ∈!0, a′!, and, as above, we have:

[0124] Taking the symmetric modulo 1, we then obtain that if so mod

[0125] Now suppose that , Either the largest integer such that p"0 / ∈!0, a′ for all k=1..k*-1. Such an integer exists since ∞ if k → ∞. Then, as p"0 / ` a′, we have

[0126] So, using that we obtain that exists, and is worth where denotes the entire value immediately superior.

[0127] A symmetric demonstration shows that, when also exists and is worth

[0128] Considering the smallest value of µ on Tp, namely 1 / (2p), as well as the value closest to 1 / 2, namely 1 / 2 – 1 / (2p), we also obtain the following framework for k*:

[0129] And, more particularly, considering the largest value of e' adapted to this protocol, namely we also have:

[0130] Since the value of the message p is not known (since it is encrypted), it is planned, during the scaling step, to calculate several dilated encrypted messages c [k] , with a coefficient of expansion larger and larger, until it is certain that the value of the expanded message has left the uncertainty zone.

[0131] In other words, we calculate several dilated encrypted messages c [k] , with a coefficient of expansion for k=1 ...K-1 , with K chosen large enough so that K-1 is greater than or equal to the integer k* presented above (ie: so as to be sure that, in the sequence k=1 ...K-1 , we leave the uncertainty zone at some point).

[0132] For this, given the framework of the value of k* established above, we choose K here so that

[0133] K can thus be chosen as follows: or even as suit .

[0134] In the scaling step, each dilated ciphertext is determined according to the following formula k=1 ...K-1 .

[0135] As explained in the "summary" section, in the following for k <k*, le signe de ne peut généralement pas être déterminé de reliably from its encrypted version c [k] , for k=k*, the sign of can be reliably determined from its encrypted version c [k] , and it is equal to the sign of the message μ, and for k > k*, the sign of can be false, that is to say no longer be equal to the p sign.

[0136] The various dilated encrypted messages c [k] , k=1..K-1 are then taken into account in a particular way, during the fusion step, to deduce from these messages encrypted the sign of the message p (sign which is also obtained in encrypted form, since it is a homomorphic calculation process).

[0137] Merger

[0138] In the following c [k] , k=0..K-1 (where c [0]=c), we do not know which dilated ciphertext is the one allowing a reliable sign determination (i.e.: corresponds to a dilated message located outside the uncertainty zone), and identical to the sign of p. Also, all of these messages are taken into account, here, to determine the sign of p: - a) by assigning the value 0 to the sign (or a function representing the sign) of each dilated message, if it is in the uncertainty zone, and - b) by weighting the sign (or a function representing the sign) of each dilated message with a weighting coefficient att[k] which decreases when k increases, to give more weight to the sign of the first dilated ciphertext whose "sign" is non-zero (i.e.: first dilated message which is outside the uncertainty zone), compared to the signs of subsequent dilated ciphertexts (whose sign can be "false", i.e. different from that of p).

[0139] The calculation of a weighted sum of these signs (or of values ​​representative of these signs) then makes it possible to obtain, in a homomorphic manner, a result which is positive, negative or zero (for example of value +1 / 4, -1 / 4, 0; or +1 / 3, - 1 / 3, 0), depending on whether the message μ is positive, negative or zero.

[0140] Indeed, in this sum: - the terms corresponding to k <k* sont nuis ; - le premier terme non nul, associé au message dilaté (en pratique, un term Fk*(c [k * ]), presented below), has a sign which is that of μ, and - the following terms, corresponding to k>k*, possibly have arbitrary signs, but do not modify the sign of the sum, due to the decreasing nature of the attenuation coefficients att[k] (more precisely, due to the fact that the sequence of coefficients att[k] is such that: the sum of the attenuation coefficients, successive to any one of the attenuation coefficients of the sequence, is less than said attenuation coefficient, which can be obtained for example with a geometric sequence with a ratio less than 1 / 2).

[0141] In practice, to implement this fusion technique, we calculate, for each dilated encrypted message c [k] a quantity Fk(c [k]), where Fk denotes a homomorphic calculation operation of the quantity ge, or even directly, as here, a homomorphic calculation operation of the quantity att[k].ge, where ge is a step function: - which is zero on a central interval ]-e / 2, e / 2[, - which has two distinct values, for example -1 and +1 (case of figure 9), on either side of this central interval, and - which is zero near the ends of the torus, on the intervals ]1 / 2-e / 2, 1 / 2[ and [-1 / 2, -1 / 2+e / 2[.

[0142] Choosing this ge function (rather than the sign function Sign) allows the value 0 to be assigned to a dilated message located in the uncertainty zone, in the sum mentioned above.

[0143] In practice, the quantity Fk(c [k] ) is evaluated during a bootstrapping operation (during which the noise is refreshed, and, in addition, the function considered is evaluated).

[0144] As for the calculation of the sum, that is to say the fusion itself, it could possibly be carried out directly, by calculating the quantity F0(c) + F1(c [1] )+...+ Fk(c [k] )+...+ FK-I (C [K-1 ] ), especially when K is small.

[0145] In this case, when the two distinct values ​​of ge (for a positive and negative message respectively) are -1 and +1, the attenuation coefficients a(k) are preferably chosen such that their sum att[o],+...+ att[kj+... att[Ki] is less than 1 / 2. The result of this sum calculation then belongs to the torus T (which facilitates its later use, in the encryption scheme employed here). This condition, as well as the particular decay condition mentioned above, can be obtained for example by choosing, for the coefficients att[k], the value AR k, where the reason R of this geometric sequence is less than 1 / 2, and where A is less than (1 -R) / 2.

[0146] So, for example, we could choose R=1 / 2, and A=1 / 4, or att[k]=1 / 2 2+k . We could also choose R=1 / 3, and A=1 / 3, or att[kj=1 / 3 1+k .

[0147] However, a difficulty arises when calculating such a sum (especially if K is large). When the first non-zero term of the sequence Fk(c [k] ), k=0...K- 1 corresponds to a fairly large value of k, it is multiplied by a small attenuation coefficient att[k], and therefore itself has a small value which is then drowned in noise (noise which, inherently, affects this sum, since it is the result of a homomorphic calculation, and is therefore provided in encrypted form, and therefore noisy). This effect can prevent a correct determination of the sign of the sum, and therefore of the sign of the message μ.

[0148] To solve this difficulty, we can, as here, merge the terms in packets of only a few terms (so that, in each packet, the attenuation coefficients remain relatively large), and this several times in a row to achieve this fusion progressively. Each packet can, for example, include from 2 to 5 terms.

[0149] More precisely, this packet fusion can be carried out by executing the following steps: - S1: packet fusions, each packet grouping m terms, each fusion of a packet corresponding to the calculation of the intermediate result i being the packet number, - S2: packet merges of intermediate results resi, each merge of a packet of m' intermediate results corresponding to the calculation of a new intermediate result j being the packet number, denoting a homomorphic computation operation of a quantity - step S2 being repeated until only one result is obtained, to which the operation is applied which provides a final result which is an encrypted version of the sign of the message p.

[0150] For example, we can have m'=m.

[0151] This method of progressive packet merging is shown schematically in Figure 10 for a case where K=8 and where each packet comprises two terms, i.e. m=m'=2 (step S2 then being executed twice).

[0152] In this figure, each arrow represents a boostrapping operation, with evaluation of the quantity att[k].ge for terms of type Fk(), or with evaluation of the quantity for terms of type

[0153] s is another uncertainty width, used to merge the intermediate results mentioned above (the function is defined in the same way than ge, but replacing ε with is for example equal to 1 / (2N), where N-1 is the degree of the specific bootstrapping polynomial W g [X] (see claim 3 of application PCT / IB2020 / 001147,), also noted v[X].

[0154] The structure of this packet fusion calculation remains the same as that of Figure 10 when K has a different value (different from 8), and when the number m of terms per packet is different (different from 2).

[0155] Thus, as an example, a pseudo-code algorithm for performing this packet merging, for an example implementation in which K=27 and m=3 (step S2 also being executed twice, and step S1 once) is shown in Figure 1 1.

[0156] In any case, during such a packet fusion, for each packet of m terms, the attenuation coefficients of the weighted sum, att[k], k=0..m-1 satisfy the same conditions as before (decreasing with k, sum of the coefficients following a given coefficient less than this given coefficient, complete sum, from 0 to m-1, less than 1 / 2).

[0157] For convenience, we can assume that K=m r (in the example of the figure 10, m=2 and r = 3, for example), and m'=m. In this case, step S2 is executed r-1 times.

[0158] In this case, the result of the entire progressive packet merging operation (result which is the sign of μ, encrypted) can be expressed directly as:

[0159] Noise Considerations

[0160] A detailed demonstration proves that the method presented above actually allows a homomorphic determination of the sign of a message p, directly from the corresponding encrypted message c, with a very low probability of error.

[0161] For example, in a case where: - the message μ belongs to T p , with p8 = 7 x 11 x 13 x 17 x 19 x 23 x 25 x 27 (i.e. p=5,019,589,575 > 2 32 ), by choosing the following values ​​for the parameters of the sign determination process: we show that the probability of error in the homomorphic determination of the sign of μ is less than 1.03.10 -9 (which is very low), - the parameters of the encryption scheme being: n=412 (n is the number of components of the secret key s, which belongs to B n, where B={0,1}, a collapsing parameter I worth l=4), N=1024, and a standard deviation σ(ei) of the noise component affecting each component Ci which is worth (which corresponds to a noise level allowing 200 homomorphic additions without boostrapping between them).

[0162] Figure 12 is a table which, for this example, groups together the values ​​of the Bézout coefficients Vj, the values ​​of the “dilated” Bézout coefficients (which also illustrates that these values ​​remain advantageously small, although allowing for message expansion), and values ​​of the quantity involved in calculating the noise affecting encrypted messages dilated.

[0163] Details about the q function ε , and its emulation by boostrappinq

[0164] The details below are presented for an example of realization for which the attenuation coefficients are att[kj=1 / (2 2+k ). They can be transposed to other values ​​of the attenuation coefficients.

[0165] First, we assume that: where the δ [k] of are defined by

[0166] The inventors then demonstrated that there exists k* such that

[0167] Emulation of the gε function

[0168] As detailed in patent application PCT / IB2020 / 001147, the goal is to construct a polynomial v[X] such that, to emulate the gε function in encrypted form during a boostrapping operation.

[0169] Choice of parameter ε

[0170] By construction, the function is a piecewise constant function with possible discontinuities at points such that either

[0171] Since the function gε is odd with discontinuities on the right at ε / 2 and at 1 / 2-ε / 2, a natural choice for the parameter ε is under duress either

[0172] Construction of the polynomial v[X] For any function F from Z to T, 2N-periodic, and such that there exists a unique polynomial v of The coefficients vj of this polynomial are given by 3 , For a given k, it is therefore sufficient to define F on {0,…,N-1}, as follows: so that either For this choice of polynomial and parameter ε, relation (2) above is effectively satisfied, without error. Rounding During a boostrapping operation, the value taken by µ in relation (2) is obtained from For by rounding the values ​​of and in as follows and replacing with It should be noted that other variants are possible to achieve these roundings. The rounding process in question introduces errors, which are taken into account via the terms δ [k] , in formula (1). We thus have, taking into account relation (2) and the definition of δ [k] :

[0179] The full boostrapped function, which provides a numerical value of is

[0180] It will be noted that the definition of δ [k]can be changed as follows so that relation (3) remains valid.

[0181] Boostrapping the sign function

[0182] In a case where 1 / 2 k+2 is not too small (attenuation coefficients not too small), the sign of p can be obtained for example by calculating the following quantity (which corresponds to a direct fusion, and not a progressive one by packets):

[0183] Application examples

[0184] Homomorphic calculation of the Heaviside function

[0185] To homomorphically apply the Heaviside function H to the message p, we apply the homomorphic sign determination procedure presented above, but choosing, for the function g ε , the values ​​0 on [-1 / 2+e / 2, -e / 2], and +1 on [e / 2,1 / 2-e / 2] (instead of -1 and +1).

[0186] Homomorphic calculation of any piecewise constant function

[0187] To apply any piecewise constant function f to the message p, the function f having t distinct pieces, the server 3 will for example be programmed to execute the following operations: - decomposition of the function f in the form of a linear combination of translated Heaviside functions, i.e. where the coefficients αj are integers and where the abscissas of the points of discontinuity belong to the interval [-1 / 4, 1 / 4], - calculation of the quantity each term being determined, homomorphically, as indicated above for the Heaviside function H.

[0188] Comparison: homomorphic determination of the maximum and minimum

[0189] Let μa and μb be two messages, with c a etc b the corresponding encrypted messages, obtained with the encryption scheme presented above.

[0190] We note h the encrypted version of determined as explained above- above (calculation of the Heaviside function).

[0191] Due to the linearity of the encryption operations employed here, the quantity hc a +(1 -h).c b is an encrypted version of which is none other than the maximum max

[0192] Calculate the quantity Maxh=hc a +(1 -h). c b therefore allows us to obtain, in a homomorphic manner, an encrypted version of

[0193] Similarly, calculate the quantity Minh=hc b +(1 -h).c a allows to obtain, in a homomorphic manner, a minimum encrypted version of

[0194] The server 31 of the exemplary embodiment of Figure 3 is programmed to perform these operations. The module 310 of this server performs the homomorphic subtraction. Then the module 30 determines the quantity h from Cd. The module 311 then performs the operations and delivers the corresponding results, Maxh and Minh.

[0195] Alternatively, the quantities Maxh and Minh could be determined by - homomorphically determining a numerical version of denoted h', then - by calculating the quantity h'.c b +(1 -h').c a (for the maximum) and h'.c a +(1 -h').c b (for the minimum).

[0196] Alternatively, the quantities Maxh and Minh could each be determined from a numerical version of the difference sign

[0197] Sorting a database

[0198] Being able to determine in a homomorphic manner the maximum and / or minimum of two messages is particularly interesting because it allows us to carry out, in a homomorphic manner, a sorting (a classification, for example in ascending or descending order) of a set of encrypted messages.

[0199] Many sorting algorithms are in fact based on an elementary (repeated) step of comparing message by message, that is to say between two messages, among those to be sorted. One of the two messages is then replaced by the maximum of the two messages, while the other message is replaced by the minimum of these two messages.

[0200] The server 32 of the exemplary embodiment of FIG. 4 is programmed to execute a method of sorting an encrypted database DB.

[0201] This database comprises at least, in a first location of the database, a first encrypted message c a, and in a second location in the database, a second encrypted message c b .

[0202] This sorting process includes at least: - writing, in the first location, the quantity Maxh presented above, determined from c a etc b , or, respectively, of the quantity Minh presented above (determined from c a etc b ), and - a writing, in the second location, of the quantity Minh, or, respectively, of the quantity Maxh.

[0203] The first and second locations in question may, for example, each be identified, in the database, by an indexing number associated with the location in question (for example, a line number, in a matrix-based database).

Claims

CLAIMS

1. Method for homomorphic determination of the positive or negative character of a message µ from a corresponding encrypted message c, without decryption of the encrypted message c, the encrypted message c corresponding to the message µ being encrypted by a learning type method with error, the message µ belonging to the discrete torus p or to a space in bijection with Tp, with the integers pi being coprime, the message encrypted c being formed of q components ci, with being the Bézout coefficient associated with the integer pi, defined by the method comprising: - a scaling step, comprising a determination of a dilated encrypted message c[1] in accordance with the following formula is an odd number greater than or equal to 3, and - a merging step, comprising a calculation of the sum F0(c) + F1(c[1] ) where F0 and F1 respectively denote a homomorphic calculation operation of a quantity att[0].gε, and of a quantity att[1].gε, gε being a staircase function which is zero on a central interval ]-ε / 2, ε / 2[ and which has two distinct values on either side of this central interval, the coefficient att[1] being less than the coefficient att[0].

2. Method according to the preceding claim, in which the scaling step comprises determinations of several dilated encrypted messages c [k] , the integer k varying from 1 to K-1, each dilated ciphertext being determined according to the following formula and in which the positive or negative character of the message µ is determined as a function of c and as a function of the different dilated encrypted messages c [k], k=1..K-1.

3. Method according to the preceding claim, in which the merging step comprises a step of merging a packet during which the following sum is calculated: F0(c) + F1(c [1] )+…+ Fk(c [k] )+…+ Fm(c [m] ), where Fk denotes a homomorphic calculation operation of the quantity att[k].gε, where att[k] is an attenuation coefficient less than 1, the sequence of coefficients att[k], k=0..m being decreasing and such that: the sum of the attenuation coefficients, successive to one of the given attenuation coefficients of the sequence, is less than said given attenuation coefficient.

4. Method according to the preceding claim, in which m is less than K, and in which the merging step comprises the following steps: - S1: merging by packets, each packet grouping m terms, each merging of a packet corresponding to the calculation of the intermediate result resi=F0(c [(i-1).m]) + F1(c[(i-1).m+1])+…+ Fk(c[(i-1).m+k])+…+ Fm-1(c [i.m-1] ), i being the packet number, - S2: packet merges of the intermediate results resi, each merge of a packet of m' intermediate results corresponding to the calculation of a new intermediate result j being the packet number, designating a homomorphic calculation operation of a quantity - step S2 being repeated until only one result is obtained, to which the operation is applied which provides a final result which is an encrypted version of the sign of the message µ.

5. Method according to one of claims 2 to 4, in which the number K-1 of dilated encrypted messages taken into account is such that

6. Method according to one of the preceding claims, in which the width ε of the central interval is less than

7. A method for homomorphically applying the Heaviside function H, which is zero for negative values and equal to 1 otherwise, the method comprising executing the method for determining the positive or negative character of the message µ according to any one of the preceding claims, the function gε being chosen to be zero for negative values and equal to 1 for positive values.

8. A method for homomorphically applying a piecewise constant function f to a message µ, the function f having t distinct pieces, the method comprising: - a decomposition of the function f in the form of a linear combination of translated Heaviside functions, i.e. where the coefficients αj are integers and where the abscissas βj of the discontinuity points belong to the interval [-1 / 4, 1 / 4], - a calculation of the quantity each term being determined, in a homomorphic manner, in accordance with the method of the preceding claim.

9. A method for determining in a homomorphic manner the maximum of two messages µa and µb, from the corresponding encrypted messages ca and cb, without decrypting the encrypted messages ca and cb, the method comprising: - a homomorphic determination of the quantity H(µa - µb), in accordance with the method according to claim 7, the encrypted version of H(µa - µb) thus determined being denoted h, and the calculation of the quantity Maxh=h.ca+(1-h).cb, - or, a homomorphic determination of the quantity H(µb - µa), in accordance with the method according to claim 7, the encrypted version of H(µb - µa) thus determined being denoted h', and the calculation of the quantity h'.cb+(1-h').ca.

10. Method for homomorphically determining the minimum of two messages µa and µb, from the corresponding encrypted messages ca and cb, without decrypting the encrypted messages ca and cb, the method comprising: - a homomorphic determination of the quantity H(µa - µb), in accordance with the method according to claim 7, the encrypted version of H(µa - µb) thus determined being denoted h, and the calculation of the quantity Minh=h.cb+(1-h).ca, - or, a homomorphic determination of the quantity H(µb - µa), in accordance with the method according to claim 7, the encrypted version of H(µb - µa) thus determined being denoted h', and the calculation of the quantity h'.ca+(1-h').cb.

11. A method of sorting a database, the database comprising at least, in a first location of the database, a first encrypted message ca, and in a second location of the database,. a second encrypted message cb, the method comprising at least one writing, in the first location, of the quantity Maxh determined in accordance with the method of claim 9, or of the quantity Minh, determined in accordance with the method of claim 10.

12. Method of encrypted communication and processing, comprising the following steps: - Encryption of at least one message µ, with a private key s, by a client (2), in the form of an encrypted message c, by a method of the learning type with error, the message µ belonging to the discrete torus or to a bijection space with Tp, with the integers pi being coprime, the encrypted message c=(c1,...ci,...cq) being formed of q components ci, with being the Bézout coefficient associated with the integer pi, defined by - Transmission of the encrypted message c, or of an encrypted database containing the encrypted message c, by the client (2), to a server (3; 30; 31; 32) distinct from the client (2) and not having the private key s, via a communication channel (5), - Processing of the encrypted message c, or of a difference between the encrypted message c and another encrypted message, or of the encrypted database (DB) containing the encrypted message c, by the server (3; 30; 31; 32), in a homomorphic manner, in accordance with the method according to any one of the preceding claims, - Emission of the result (res, DB') of said homomorphic processing, by the server (3; 30; 31; 32).

13. Server (3; 30; 31; 32) for cryptographic processing, comprising at least one communication module and one calculation module: - The communication module being configured to receive, from an entity external to the server, an encrypted message c or an encrypted database (DB) containing the encrypted message c, the encrypted message c corresponding to a message µ encrypted by a type method. learning with error, the message µ belonging to the discrete torus or to a bijection space with Tp, with the integers pi being coprime, the message encrypted c=(c1,...ci,...cq) being formed of q components ci, with being the Bézout coefficient associated with the integer pi, defined by - The calculation module being programmed to process the encrypted message c, or a difference between the encrypted message c and another encrypted message, or the encrypted database (DB) containing the encrypted message c, in a homomorphic manner, without decrypting the message c, in accordance with the method according to any one of claims 1 to 11, - The communication module also being configured to transmit the result (res, DB') of said homomorphic processing.

14. Cryptographic system (1) comprising: - the server (3; 30; 31; 32) for cryptographic processing according to the preceding claim, - a client (2), configured to encrypt at least the message µ, in the form of the encrypted message c, and to communicate the encrypted message c, or an encrypted database (DB) containing the encrypted message c, to the server (3; 30; 31; 32) via a communication channel (5).

Images