Method for determining an encrypted message, associated refresh, extraction and aggregation methods

Abstract

The invention relates to a method for determining an encrypted message c(X) corresponding to an encrypted version of a message µ(X), the message µ(X) being in the form of a polynomial of degree less than or equal to N-1 whose coefficients have values ​​in . The process includes a step of encrypting the message µ(X) by totally homomorphic encryption, starting from a private key s(X), where the encrypted message c(X) is in the form of a polynomial belonging to a space Tq[X] with Tq[X] a space of polynomials of degree less than or equal to N-1 whose coefficients take values ​​in and a cyclotomic polynomial of order M, with t a prime number strictly greater than 3 and α a non-zero integer, or , with ti prime numbers and αi non-zero integers, at least one of the prime numbers ti being strictly greater than 3. Figure to be published with the abstract: Figure 1

Description

Title of the invention: Method for determining an encrypted message, associated refreshing, extraction and aggregation methods TECHNICAL FIELD OF THE INVENTION

[0001] The present invention relates generally to the field of homomorphic cryptography.

[0002] The invention relates more particularly to a method for determining an encrypted message.

[0003] It also relates to associated cooling, extraction and aggregation processes.

[0004] It also relates to a device for determining an encrypted message and a cryptographic system comprising such a device. TECHNOLOGICAL BACKGROUND OF THE INVENTION

[0005] Homomorphic cryptography, which allows calculations or processing to be carried out on encrypted data without decrypting it beforehand, has attracted a lot of attention lately.

[0006] Indeed, the digital processing of personal data has become ubiquitous in our daily lives. Protecting the confidentiality of this data, and the privacy of the individuals concerned, has therefore become critical, as this personal data tends to circulate more and more in the digital systems used daily.

[0007] In this context, homomorphic encryption and processing techniques appear as a very promising solution, because they allow data to be processed while preserving the privacy of this data in a particularly secure way, since the latter is not decrypted during its processing.

[0008] Homomorphic cryptography methods therefore address, among other things, the technical challenge of enabling: • to an external, generally remote, service and processing server to perform "blind" operations on encrypted data, without decrypting it, this server not even possessing the necessary key to decrypt the data, • the encrypted data being provided by another, separate entity (a client, in the IT sense), which has the encryption key.

[0009] These data processing operations may consist of performing individual operations, data by data, to format or filter them for example. They can also involve data comparison, sorting or aggregation operations.

[0010] Homomorphic cryptography can be based on the encryption scheme known as "learning with errors" (LWE, according to the commonly used Anglo-Saxon term), in which the encrypted message C— (a, b) is derived from the unencrypted message q according to the following formula: b=q+e+as, where: • s is a secret key, • a is a vector chosen at random to project the secret key s, and • e is a random noise component, added to q+as

[0011] To decrypt the message, a person possessing the secret key s can calculate the quantity ba.s (equal to q+e), then round the result to remove the noise component e and recover the message q. Of course, the noise term e must be and remain sufficiently small if one wants to be able to recover the message q.

[0012] Homomorphic operations, such as the addition of two encrypted messages, are performed on the encrypted messages to allow their processing without decryption. These operations can become particularly complex when dealing with messages in the form of long integers.

[0013] To perform homomorphic operations on a longer (plaintext) message, it is common practice to decompose the message into binary messages (classical binary decomposition). Each binary message is encrypted separately, and the operation is then performed homomorphically, bit by bit. However, this process requires taking into account the (encrypted) carry resulting from each binary addition and propagating this carry to the next binary operation. It is therefore a serial process, which is time-consuming. Furthermore, each binary operation is performed homomorphically, which multiplies the number of homomorphic operations (and thus complicates the complete implementation of the operation). Summary of the invention

[0014] In this context, the invention relates to a homomorphic encryption method which makes it possible to efficiently process messages longer than binary messages.

[0015] The invention relates to a method for determining an encrypted message c(X) corresponding to an encrypted version of a message q(X), the message q(X) being in the form of a polynomial of degree less than or equal to Nl whose coefficients have values ​​in a space T — I — modulol. k EZ) with P a non-1 integer P' J zero, where N is a non-zero integer, said process includes a step of encrypting the message q(X) by totally homomorphic encryption, using a private key s(X) in the form of a polynomial of degree less than or equal to N-1, in the encrypted message c(X) taking the form of a polynomial belonging to a space n . _ Tg W , with Let Tq[X] be a space of polynomials of degree less than or equal to Nl whose coefficients have values ​​in | |modlll()L k GZ] with Q a non-zero integer greater than p and fpM(X) a cyclotomic polynomial of order M, with M = t(\ t a prime number strictly greater than 3 and a a non-zero integer or M = fl with h prime numbers and a non-zero integers, at least one of the prime numbers f being strictly greater than 3.

[0016] Thus, the use of cyclotomic polynomials for the encrypted message improves the cryptographic processing of long messages. Indeed, the homomorphic processing of long messages is greatly facilitated by the properties of cyclotomic polynomials.

[0017] On the one hand, the use of cyclotomic polynomials for the ciphertext, considering a given set of parameters (i.e., with fixed values ​​of p and t), makes it possible to consider long messages, other than in binary form, for homomorphic cryptographic processing. On the other hand, in the case of messages of typical sizes, the use of cyclotomic polynomials for determining the ciphertext improves the performance of cryptographic processing (in particular, improves the speed of implementation of this cryptographic processing).

[0018] According to this aspect of the invention, the totally homomorphic encryption is implemented by a polynomial encryption function with coefficients in a space defined by a torus T.

[0019] The invention also relates to a method for transforming an encrypted message c(X) determined according to the method introduced previously into an encrypted element c / X), said encrypted element c£X) belonging to a subspace of the space Rq, comprising a step of determining said encrypted element c^X) by applying a linear transformation to the message p(X), said linear transformation being a trace operator Tracec defined as follows: TraceG( / / (X) ) = ErfeGWri(X) / z(Xrf) / ^ with G a subset of integers between 0 and Ml and coprime with M and Wd predefined weights.

[0020] Thus, the trace operator introduced allows the encrypted message to be transformed without decrypting it. The use of the trace operator allows, for example, the encrypted message to be "cleaned up" (without decrypting it) in order to retain only certain terms useful for the intended application.

[0021] The invention also relates to a method for refreshing the encrypted message c corresponding to an encrypted version of a message p, said message p being defined in the torus T, said refresh process comprising a step of determining a refreshed encrypted message c', the refreshed encrypted message c' comprising a noise component e' smaller than a noise component e of the encrypted message c, the refreshed encrypted message c' being determined on the basis of a polynomial obtained according to the determination process as introduced previously.

[0022] According to this aspect of the invention, the step of determining the refreshed ciphertext message c' includes a step of calculating a zero-order coefficient of the polynomial y(X)mod <PM avec v(X) un polynôme de rafraîchissement fonctionnel appartenant à l’espace » _ , avec T — R / z, la notation I x 1 correspondant à <W) the integer closest to the number x and the notation mor / corresponding to the modulo operator.

[0023] The invention also relates to a method for extracting a homomorphic ciphertext Cp from a ciphertext c(X) in the form of a polynomial belonging to the space Æg, the ciphertext c(X) being determined by a determination method as introduced previously, the homomorphic ciphertext Cp being obtained by determining the zeroth coefficient of a polynomial ) being a cyclotomic polynomial of order M, with M = ï'\ t being a prime number strictly greater than 3 and a a non-zero integer, / 1 being a non-zero integer, said homomorphic ciphertext Cp corresponding to a ciphertext element of a linear combination of coefficients of the message h(X).

[0024] According to this aspect of the invention, the extraction process includes a step of determining the non-zero integer [3] so as to verify the following inequality: 0 < fimodM said homomorphic ciphered element cp corresponding to an element encrypted with a coefficient of order [3 of the message p(X).

[0025] The invention also relates to a method for aggregating a plurality of encrypted messages c®, i being a natural number, each encrypted message c® belonging to a space Tn+1, n being a non-zero natural number, each encrypted message c® corresponding to an encrypted version of an associated message p®, this encryption being implemented via a private encryption key s, the aggregation method comprising steps of: - determination of an encrypted key J according to the determination method as previously introduced, and - aggregation of said plurality of encrypted messages c® so as to obtain an encrypted message C in the form of a polynomial.

[0026] According to this aspect of the invention, the encrypted message C, which is in the form of a polynomial, is determined on the basis of a polynomial cipher with coefficients in the space defined by the torus T.

[0027] The invention further relates to a device for determining an encrypted message c(X) corresponding to an encrypted version of a message p(X), the message p(X) being in the form of a polynomial of degree less than or equal to Nl whose coefficients have values ​​in a space ^p = |^modulol, k GZ] with P a non-zero integer, N being a non-zero integer, the determination device comprising at least a processor and a storage device, the processor comprising: - a message encryption module p(X) using totally homomorphic encryption, based on a private key s(X) in the form of a polynomial of degree less than or equal to Nl, with the encrypted message c(X) in the form of a polynomial belonging to a space [■ _ t4.y], with [TJX] a space of polynomials of degree less than or equal to Nl whose coefficients have values ​​in Tq = |^modulol, k GZJ with q a non-zero integer greater than p and ) a cyclotomic polynomial of order M, with M = tc\ t a prime number strictly greater than 3 and a a non-zero integer or M — FI with prime numbers and a; non-zero integers, at least one of the prime numbers t, being strictly greater than 3.

[0028] The invention also relates to a cryptographic system comprising: - a device for determining an encrypted message c(X) as introduced previously, and - a cryptographic processing server configured to implement at least one cryptographic processing operation on the encrypted message c(X).

[0029] The invention finally relates to a computer program comprising instructions executable by a processor and designed to implement a process as introduced previously when these instructions are executed by said processor.

[0030] The invention and its various applications will be better understood upon reading the following description and examining the accompanying figures. BRIEF DESCRIPTION OF THE FIGURES

[0031] Other features and advantages of the invention will become clear from the description given below, by way of example and not limitation, with reference to the accompanying figures, among which:

[0032] [Fig.1] schematically represents an example of a cryptographic system in accordance with the invention,

[0033] [Fig.2] represents, in the form of a logic diagram, an example of a method for determining transmission of an encrypted message conforming to the invention,

[0034] [Fig.3] represents, in the form of a flowchart, an example of an extraction process in accordance with the invention,

[0035] [Fig.4] represents, in the form of a flowchart, an example of an aggregation process in accordance with the invention, and

[0036] [Fig.5] represents, in the form of a flowchart, an example of a refreshing process chissement conforming to the invention. DETAILED DESCRIPTION

[0037] The present invention aims to improve the homomorphic processing of messages. More particularly, the present invention relates to a homomorphic encryption method that subsequently allows operations to be performed on encrypted messages without decrypting them. According to the present invention, these encrypted messages are associated with plaintext messages (i.e., unencrypted messages), each of which is longer than a single bit, and which are processed homomorphically without being decomposed into individual binary messages.

[0038] By definition in this description, the expression "plaintext message" refers to an unencrypted message. In other words, a plaintext message can be used (for example during its transmission or storage) without requiring decryption or a homomorphic processing technique.

[0039] To implement this method, the invention relates first of all to a cryptographic system 1. [Fig.1] represents, schematically, an example of such a cryptographic system 1.

[0040] As shown in this figure, the cryptographic system 1 comprises an entity 2, a cryptographic processing server 3 and a recipient entity 4.

[0041] Entity 2 is configured to encrypt one or more messages (and, optionally, to collect these messages beforehand), with a private encryption key s. This entity 2 includes, for example, a device 2A for determining an encrypted message c(X) as described below. The device 2A for determining the encrypted message c(X) includes, for example, a processor and a storage device (not shown).

[0042] This entity 2 is also configured to transmit the encrypted message(s) corresponding to the cryptographic processing server 3. The encrypted message(s) transmitted are, for example, accompanied by a processing request (destined in particular for the cryptographic processing server 3).

[0043] For this purpose, entity 2 includes, for example, a set of functional modules. Each of the different modules is for example made using computer program instructions stored in a memory of entity 2 and designed to implement the module concerned when these instructions are executed by a processor of entity 2.

[0044] In practice, entity 2 is distinct from the cryptographic processing server 3. This entity 2 is for example an external database, or a client (in the computer sense).

[0045] The cryptographic processing server 3 is configured to perform processing operations (function application, extraction, refresh, sorting) on ​​the received encrypted message(s). This cryptographic processing is implemented homomorphically, that is, without decrypting the messages. Furthermore, the cryptographic processing server 3 does not possess the private encryption key s used to produce the encrypted message(s) from one or more unencrypted plaintext messages. In other words, the cryptographic processing server 3 is programmed to implement different processing operations homomorphically.

[0046] The cryptographic processing server 3 includes, for example, a communication module, for receiving and / or sending data (in practice one or more encrypted messages), and a calculation module, for carrying out the homomorphic cryptographic processing operations mentioned above.

[0047] The modules in question are, for example, in the form of a dedicated electronic circuit, such as a communication card (for the communication module), or a cryptographic computing circuit comprising at least one processor or programmable circuit, and a memory (for the computing module). The cryptographic processing server 3 itself can thus take the form of a separate electronic device.

[0048] Alternatively, the modules of the cryptographic processing server can each take the form of a set of instructions whose execution by a computer system (for example, by a computer) leads to the completion of data reception and / or transmission steps (for the communication module), or data processing steps (for the cryptographic calculation module). The cryptographic processing server 3 can, in particular, take the form of decentralized computing services, available via a communication network (for example, via the internet or via an intranet), in a decentralized computing infrastructure, for example, a "cloud" type infrastructure (a decentralized infrastructure spread across several distinct and geographically distant electronic devices connected by a network).

[0049] A communication channel 5 connects entity 2 and the cryptographic processing server 3. This is, for example, a communication channel for which the transmitted data is susceptible to interception. It may be a channel of wireless communication, or wired communication.

[0050] In practice, entity 2 and cryptographic processing server 3 may be remote from each other, for example be located in different buildings.

[0051] Alternatively, it may also refer to elements belonging to the same computer system, for example within the same electronic device (for example within the same computer, or the same portable electronic device).

[0052] As shown in [Fig. 1], the cryptographic system 1 also includes the recipient entity 4. This recipient entity 4 is configured to receive the result of the cryptographic processing implemented by the cryptographic processing server 3 (a result which is itself encrypted because the processing performed is homomorphic cryptographic processing). The recipient entity 4 is here distinct from the cryptographic processing server 3.

[0053] A communication channel 6 connects the cryptographic processing server 3 and the recipient entity 4. This communication channel 6 is configured to transmit the result of the cryptographic processing from the cryptographic processing server 3 to the recipient entity 4. This is, for example, a communication channel for which the transmitted data is susceptible to interception. It could be a wireless communication channel or a wired communication channel.

[0054] Alternatively, the receiving entity 4 can be entity 2 itself, and the communication channels 5 and 6 can form a single bidirectional communication channel.

[0055] The present invention relates first of all to a method for determining an encrypted message c(X). This determination method is implemented, for example, by the device 2A for determining the encrypted message c(X) of entity 2 of the cryptographic system 1. In general, the determination method is implemented by computer.

[0056] Fig. 2 is a logic diagram representing an example of a method for determining the encrypted message c(X) implemented by the cryptographic system 1 described above.

[0057] In general, this determination method aims to determine the ciphertext c(X) corresponding to an encrypted version of a plaintext p(X).

[0058] As shown in Figure 2, the process begins at step E2, during which entity 2 receives the plaintext message p(X). Here, this plaintext message p(X) is in the form of a polynomial of degree less than or equal to N1, where N is a non-zero integer. This polynomial has coefficients whose values ​​are taken from a space Tp called the "discrete torus," where p is a non-zero integer. More specifically, the discrete torus Tp is defined as follows: = {^modulol £eZ]-

[0059] The process then continues in step E4. During this step, entity 2 receives a private encryption key s(X). This private encryption key s(X) is also a polynomial of degree less than or equal to NL. The coefficients of the polynomial representing the private encryption key s(X) have values ​​in the Z space.

[0060] It is important to note here that the private encryption key s(X) is known only to entity 2 (in the cryptographic system 1). In particular, this private encryption key s(X) is, for example, not known to the cryptographic processing server 3 which implements the various processing operations on the encrypted message c(X).

[0061] The determination process then includes step E6 of determining the ciphertext message c(X). In other words, this step E6 corresponds to a step of encrypting the plaintext message p(X), from the private encryption key s(X), so as to determine the ciphertext message c(X).

[0062] Advantageously according to the invention, the encryption implemented during this step E6 is a fully homomorphic encryption (or FHE for "Fully Ho-momorphic Encryption" according to the commonly used Anglo-Saxon term of origin.

[0063] In this description, the expression "totally homomorphic encryption" means an encryption system which allows analytical functions to be executed directly on encrypted data without limitation on the number of executions, while obtaining the same encrypted results as if the functions were executed on plaintext.

[0064] Advantageously, according to the invention, the encrypted message c(X) takes the form of a polynomial belonging to a space Rq defined as follows: ∑[X] . The space Tq[X] is a space of polynomials of degree less than or equal to to Nl whose coefficients have values ​​in the discrete torus T = ( -moduloL k £ zi with 9 a non-zero integer greater than p (introduced earlier to define the discrete torus used for the values ​​of the coefficients of the polynomial defining the plaintext message p(X)).

[0065] The notation ) denotes a cyclotomic polynomial of order M. By definition, and in a known way, the cyclotomic polynomial of order M corresponds to the monic polynomial whose complex roots are exactly the primitive M-th roots of unity.

[0066] It should be noted that the degree of the cyclotomic polynomial of order M is equal to N = (ffM) . This degree tffM} corresponds to the number of non-negative integers less than M and coprime with M. The degree ip(M) then corresponds to the usual Euler indicator function.

[0067] Advantageously according to the invention, the order M is defined by M — t'\ with t a a prime number strictly greater than 3 and a a non-zero integer or M = flt”', with b prime numbers and a non-zero integers, at least one of the prime numbers t, being strictly greater than 3. The symbol II corresponds to the product operation.

[0068] Thus, the use of cyclotomic polynomials for the ciphertext improves the cryptographic processing of long messages. Indeed, the homomorphic processing (i.e., by applying homomorphic operations to the ciphertext according to the method of the invention) of long messages is greatly facilitated by the properties of cyclotomic polynomials.

[0069] On the one hand, the use of cyclotomic polynomials for the ciphertext, considering a given set of parameters (i.e., with fixed values ​​of p and t), makes it possible to consider long messages, other than in binary form, for homomorphic cryptographic processing. On the other hand, in the case of messages of typical sizes, the use of cyclotomic polynomials for determining the ciphertext improves the performance of cryptographic processing (in particular, improves the speed of implementation of this cryptographic processing).

[0070] In a first preferred embodiment of the present invention, the order M is defined as follows: Af = ta^ with t a prime number strictly greater than 3 and a a non-zero integer. Preferably, the prime number t is greater than 23. For example, the prime number t is equal to 31.

[0071] In this case, the following relationship is verified: [00721 ​​¢,, (X) = = 1 + X'*' + 2 '" 4 + ... +

[0073] In practice, the cyclotomic polynomial of order M is defined here (for the case M = / “) in the following manner: ( X ) = Xk^ ' ^ar aiUeurs' 'a following relation is verified: 0W( X) - 1 ) = XM - 1-

[0074] Moreover, in this case, the degree of the cyclotomic polynomial is given by: N = <p(M) = (f-1)^1.

[0075] This embodiment is particularly advantageous because the use of a prime number t greater than or equal to 3 and the choice of a message size p that coincides with t (P ~ z) makes it possible to disregard the compatibility condition mentioned below (usually known as the nega-cyclicity condition in the case where t = 2). The absence of this compatibility condition in the case of the present invention allows, as previously indicated, for improved cryptographic processing of longer messages (for given parameters) or for improved performance of cryptographic processing implemented on messages of typical sizes. Such

[0076]

[0077]

[0078]

[0079]

[0080]

[0081]

[0082]

[0083]

[0084]

[0085] advantages cannot be obtained in the case where t - 2 without restricting ourselves solely to the processing of binary messages (p = 2). Furthermore, the fact that the degree of the cyclotomic polynomial QV = (t - 1)f⁴) depends on the two parameters (' and H) allows for its optimal adjustment to target a more suitable encryption security value. This advantage cannot be obtained when t = 2 or when the degree is a power of 2. This adjustment of the two parameters also improves the performance of the implemented cryptographic processes. In a second preferred example of an implementation of the present invention, the order M is defined as follows: M — with ti ct prime numbers strictly greater than 3 and ai, a2 non-null integers. Preferably, the prime numbers h and t2 are greater than 23. In this case, the following relationships are verified, with b and t2 being distinct prime numbers strictly greater than 3: In practice, fully homomorphic encryption is implemented by applying a polynomial encryption function with coefficients in the space defined by the torus T to the plaintext message p(X) (using the private encryption key s(X)). In other words, fully homomorphic encryption is implemented by a polynomial encryption function based on the so-called "learning with errors" (LWE) method. Put another way, fully homomorphic encryption is implemented by applying a TRLWE (Torus Ring Learning With Errors) type function. Advantageously, according to the present invention, the use of the cyclotomic polynomial of order M allows for a practical expression of the modulo (also denoted mod <PM dans la présente description). We consider a polynomial j _ Y^'^rX' ET [xj degree less than or equal to Ml. According to the first preferred example introduced earlier, with M = t'\ and noting N ~ (p( M ) = ( t - l)?®'1 , the following expression, corresponding to the result of the polynomial R modulo is verified: (Rmod) <PM ) ( X ) = ( ri - rN+i )X1- According to the second preferred example introduced earlier, with M = and denoting yy — the following expression, corresponding to the The result of the polynomial R modulo is verified:

[0086]

[0087]

[0088]

[0089] (Rmod) M ) ( X ) ■ with W u" Poly>'6th * ** In the case where ai = a2 = 1, the polynomial Â(X) is expressed as follows: — zx [" I1) / y”^ê / x \ ; ( ^ / =0 ( 7 (inwdt2)-j-ty ) y In practice, the operations of multiplication, Q(X) = R(X) X^_1 j, and division by 1 are, for example, implemented directly. Alternatively, they can be implemented using a Fourier transform modulo XM - 1-

[0090] As previously stated, the cryptographic system 1 (and more particularly the cryptographic processing server 3) is configured to implement, in a homomorphic manner, different operations for processing encrypted messages.

[0091] These different processing operations all rely on a common tool, namely the method for determining an encrypted message as introduced previously. In other words, whatever the processing operation considered, it relies on an encrypted message determined according to the method described previously (that is to say, an encrypted message defined from the cyclotomic polynomial of order M, with the properties defined previously).

[0092] Cryptographic system 1 is configured for example to implement extraction, aggregation (or "packing" according to the commonly used Anglo-Saxon terminology) and refresh (or "boostrapping" according to the commonly used Anglo-Saxon terminology) operations as described below.

[0093] Extraction operation

[0094] This processing operation aims to extract a homomorphic ciphertext cp associated with a ciphertext c(X). This ciphertext c(X) is obtained by implementing the determination process described previously. In other words, the ciphertext c(X) takes the form of a polynomial belonging to the space Rq introduced previously (the coefficients of this polynomial having values ​​in Tq).

[0095] [3 is defined as a non-zero integer less than or equal to the degree of the polynomial representing the ciphertext c(X) (|3 is therefore less than or equal to Nl). By convention in this description, we note that if fi GZ, fimodM E {0, 1, ..., M - 1} (in other words, with this convention, we define Xp as

[0096] Here we consider the cyclotomic polynomial of order M, with M = ta, with t a prime number strictly greater than 3 and has a non-zero integer.

[0097] The present invention relates here to a method for extracting the homomorphic ciphertext Cp from the ciphertext c(X). Figure 3 represents, in the form of a lo- gigramme, an example of an extraction process according to the invention.

[0098] This extraction process is implemented for example by the cryptographic processing server 3 of the cryptographic system 1. In general, the extraction process is implemented by computer.

[0099] As shown in Figure 3, the extraction process begins at step E10. During this step, the cryptographic system 1 (and more specifically the cryptographic processing server 3) determines a polynomial X'^c (X ) mod(p notation mod corresponds to the modulo operator.

[0100] The extraction process then includes step E12. During this step, the cryptographic system 1 determines the zero-order coefficient of the polynomial X ^c(X)mod <P^- L’élément chiffré homomorphe cp est en lien avec ce coefficient d’ordre zéro du polynôme X^c(X)mod(PM-

[0101] Then, the extraction process continues at step E14 during which the cryptographic system 1 compares the quantity fl to the quantity y-. In particular, the cryptographic system 1 evaluates whether the quantity fl is greater than or equal to the quantity .

[0102] If, at step E14, the cryptographic system 1 identifies that the quantity fl is greater than or equal to the quantity, the process continues at step E16. At this step E16, the cryptographic system 1 determines the homomorphic ciphertext cp as corresponding to a linear combination of coefficients of the message p(X). In other words, the zeroth-order coefficient determined (at step E12) corresponds to the result obtained by encrypting a linear combination of several coefficients of the message p(X).

[0103] Thus, during this step E16, the cryptographic system 1 extracts, as a homomorphic ciphertext cp, this linear combination (via the zero-order coefficient of the polynomial X^cÇX\mod^j^-

[0104] If at step E14, the cryptographic system 1 identifies that the quantity fl is less than the quantity , the process continues at step E18. Here, the cryptographic system 1 more specifically identifies that the quantity fl satisfies the following inequality: 0 < / î < ^ - 1.

[0105] At step E18, the cryptographic system 1 then determines the homomorphic ciphertext Cp as corresponding to a ciphertext of the order coefficient [3] of the plaintext message p(X) on the basis of the zeroth order coefficient of the polynomial X~$ c (X^moddd determined at step E12. In other words, the determined zeroth order coefficient corresponds to the result obtained by encrypting the order coefficient [3] of the plaintext message p(X). Put another way, the cryptographic system 1 extracts, from the ciphertext message c(X) (via the zeroth order coefficient of the polynomial X ^c{X )mod(I>^' the homomorphic ciphered element cp corresponding to the result obtained by encryption of the order coefficient [3 of the plaintext message p(X).

[0106] Alternatively, in the case of any number [3], the extraction process provides, as output, a ciphered element of the linear combination dp " ^N+p :

[0107] Aggregation (or "packing") operation

[0108] This aggregation operation aims to group together different scalar cipher elements obtained by a known method of homomorphic encryption in the torus T (or TLWE cipher for "Torus Learning With Errors") into an element encrypted in polynomial form (associated with a TRLWE cipher).

[0109] The present invention relates to an aggregation method implementing the application in question. Figure 4 shows, in the form of a flowchart, an example of an aggregation method according to the invention.

[0110] This aggregation process is implemented for example by the cryptographic processing server 3 of the cryptographic system 1. In general, the aggregation process is implemented by computer.

[0111] As shown in Figure 4, the process begins at step E20 in which the cryptographic system 1 (and more particularly the cryptographic processing server 3) receives a plurality of encrypted messages c®, with i a natural number defined such that 0 < i < d - 1 and 1 d < N - 1.

[0112] Each ciphertext c® belongs to the set Tn+1, n being a non-zero natural number (that is to say that ..., )).

[0113] In practice, each ciphertext c® corresponds to the result of the homomorphic encryption in the torus T, of a corresponding scalar plaintext p®. This encryption is implemented via a private encryption key s defined in the space S" (i.e. that .v = , s / r) e S").

[0114] In other words, each encrypted message c® corresponds to a TLWE encryption of the corresponding scalar plaintext message p®, using the private encryption key s.

[0115] The process then continues in step E22. In this step, the private encryption key s is encrypted homomorphically using a key l. The key l is in the form of a polynomial of degree less than or equal to Nl belonging to the space Z[x] (with <pM (X) le polynôme cyclotomique d’ordre M). Cette clé This allows the aggregation of different c® encrypted messages obtained using TLWE encryption into a single encrypted element in polynomial form. In other words, this polynomial key S enables the implementation of TRLWE encryption.

[0116] As shown in Figure 4, the process then includes step E24 in which a plurality of ciphertext messages c® are grouped into a polynomial of degree less than or equal to Nl so as to obtain a ciphertext message C in the form of a polynomial. This ciphertext polynomial C is constructed in such a way as to correspond to a polynomial cipher with coefficients in the torus T (TRLWE cipher) of a message p (X) ~ y'en c^a^r se Presenting in polynomial form. This TRLWE cipher is implemented using the cipher key S determined in step E22. In other words, c(X) = TRLWE^(^X)).

[0117] The coefficients P, are defined in the set {0, ..., Nl}. The quantity L is a matrix intended to modify the plaintext messages p® scalars such that if an extraction operation (as described above) is implemented after the aggregation operation, the result obtained corresponds to a ciphertext element of the corresponding plaintext message p® scalar.

[0118] In the case where M = C, this matrix L is, for example, a linear operator which associates elements with: ~ _ V* , with 0 < k < t - 2 and +1 0 < / < ^ - L

[0119] In practice, each ciphertext c® is defined as follows: e 1. We also define / 1 — Lp — Lb - LAs - Le with c^\ , yy and leW\

[0120] For the aggregation operation, a KPac aggregation key is also defined: (KPac).G TRLWE-,(sy!), with B > 2, 1 < j < n, 1 < t < l. This aggregation key KPac is constructed in such a way that it allows obtaining the encrypted polynomial C with the desired properties (described previously).

[0121] The following notation is used: z = Lb - LAs - Le ■ = b - As - ë-

[0122] Thus, the decomposition of the d^n components of element A is written: y') _ with y a usual remainder associated with this decomposition in base B. This remainder satisfies | y | < K..

[0123] We then obtain the following relationship: =OA® O! ,(O;'X'Vx - ZO»

[0124] Furthermore, by construction of the aggregation key, the following relation can be written: s ( KPac) ( - S 1) T + Ejt avcc- the notation AT denoting the transpose of any matrix A (here the transpose operator is applied to the vector ( - £ 1 ) ), and corresponding to an encryption error of SjB1 ■

[0125] Thus:

[0126] By identification, it can then be deduced: a(X) = (KPac)

[0127] Thus, the aggregation operation proposed according to the invention is such that it allows, if an extraction operation is subsequently applied, to directly arrive at the result of an encrypted element corresponding to the result of the encryption of a coefficient of the plaintext message.

[0128] Alternatively, it is possible to omit the matrix L in the definition of the message jü(X)- In this case, the aggregation operation allows us to obtain, if an extraction operation is subsequently applied, an encrypted element of Coef f 0( X* ) = - fi■

[0129] Aggregation operation (“packing”1 using the “trace” operators

[0130] This other aggregation operation aims to transform a scalar ciphered element obtained by a known method of homomorphic encryption in the torus T (or TLWE cipher for "Torus Learning With Errors") into an element ciphered in polynomial form (associated with a TRLWE cipher), using trace operators.

[0131] A trace operator (also called a "trace" in this description) is a linear transformation on polynomials, of the form:

[0132] Tracec(P) = X)P(Xd) mod&M, with P a polynomial defined in the space QM. G a subset of the integers between 0 and Ml and Wd of predefined weights. The Trace notation corresponds, in this description, to the trace operator. Alternatively, the subset G can be defined on the basis of integers between 0 and M-1 that are coprime to M.

[0133] The weights Wd and the subset G depend on the desired transformation of the polynomial P. Here, we want to obtain an encryption of the transformed polynomial P obtained. The encryption of this result obtained by the transformation of the polynomial P is done in a homomorphic manner, from the expression of the trace TraceG(P) indicated previously.

[0134] In practice, these traces are used to “clean” certain polynomials, that is to say to obtain a ciphered element of the polynomial in which only certain terms are kept (namely, the terms useful for the intended application).

[0135] To this end, the present invention relates to a method for transforming an encrypted message c(X) obtained according to the determination method described above. This transformation method aims to transform the encrypted message c(X) into a transformed message c^X. Advantageously, this method is implemented without noise amplification, despite the presence of a multiplicative factor in the trace (as defined above).

[0136] This transformation process then includes a step of determining the transformed element c^X) by applying a linear transformation to the message p(X). Advantageously, according to the invention, this linear transformation is the trace operator TraceG as defined above, with p(X) as a polynomial P.

[0137] The transformation process then makes it possible to obtain the transformed element ct(X), which is a transformed version of the ciphertext c(X). • The transformed element <?XX) appartient à l’espace Rq.

[0138] This transformation process then allows, through the set G of values ​​of d (i.e. the elements chosen in the sum), to select only certain terms of the polynomial defining the encrypted message c( X) .

[0139] Traces are generally expressed within the framework of Galois theory concerning field extensions. The sets G correspond in this case to groups called "Galois groups". These traces have several applications: in particular, as intended in the present invention, they allow the implementation of a TRLWE encryption of a scalar message A from a TLWE ciphertext element of V.

[0140] Here, we consider that M = ta, with t a prime number strictly greater than 3. Moreover, n < N = cp^M).

[0141] The present invention relates to a variant of the aggregation process, based on the determination of traces. An example of this variant of the aggregation process (also referred to as an alternative aggregation process hereafter) is described below.

[0142] This other aggregation method is implemented for example by the cryptographic processing server 3 of the cryptographic system 1. In general, the other aggregation method is implemented by computer.

[0143] This other aggregation process begins with a first step in which the

[0144]

[0145]

[0146]

[0147]

[0148]

[0149]

[0150]

[0151]

[0152]

[0153] Cryptographic system 1 (and more specifically cryptographic processing server 3) receives an encrypted message c = ( a, b) GT” x T- This encrypted message c is obtained by encrypting a plaintext message using a key 5- = (¾ .S j, ..., 5w.i), with n < N = By definition, we write , v”'1 , , n- b - + d0 mod 1 We also define: a(x) = It is observed that c ( X ) = (â(X),b(X)) does not correspond to an element encrypted in polynomial form (associated with a TRLWE encryption) of the element G) (in the Rq space defined previously). However, it is observed that: Coeff0( ( 1 - X^ ) fi ( X ) with fi{X)=b(X)-s(X}a{XY The second step of this alternative aggregation process aims to evaluate an encrypted element (according to the encryption method introduced previously) of the zeroth coefficient of the polynomial ^fi(Xymodd\I ^ans l'esPace Rq. Here, the goal is to succeed in Encrypt the zeroth order coefficient using polynomials (i.e., with a TRLWE cipher). Traces are a suitable tool for doing this. This second step is therefore implemented using traces. More specifically, the following relationship is given: Tracec((x <X^"’^ =pi In this equality, the subset G is the set of integers d between 0 and M-1 that are coprime to M. And, relating this to the definition of the trace introduced earlier, here, the weights Wd are equal to: Using this equality for i = 0 allows us to obtain a TRLWE encryption of the zeroth order coefficient, that is, the coefficient ^o- Advantageously, thanks to Galois theory, the previous trace TraceG can be decomposed into partial traces Traced, in the following way, with Gcor corresponding to a subset of the set G: Tracer = Tracee5° ... °TraceGi°TraceG0. For example, it is possible to choose <5 = a- 1 and ( / JL \ nn] and Go= , ^ = 0, f-2| xr n, and where is a generator of the group G; = (g / » / J , £ = 0, f -1 , 1 < j (the notation Z^ denotes the group of invertible elements for the multi plication, that is, integers that are prime to M). In practice, this decomposition is as fine as possible so that it can be carried out ​to the maximum. Advantageously, the use of this partial trace decomposition reduces the computational cost associated with the aggregation operation, speeds up the aggregation operation, and reduces the error obtained at the end of the operation.

[0154] The factor a / m present in the equation indicated in paragraph

[00149] can be distributed over each of the partial traces Trace^ so as to obtain a ciphered element of the coefficient of order 0, that is to say of the coefficient For example, in the given expression of the partial trace decomposition introduced, the factor involved in each of the partial traces is Vt, Advantageously, the encryption error is thus not increased.

[0155] Refreshing operation (or “bootstrapping”)

[0156] The refresh operation (generally called "bootstrapping") aims to prevent the increase of a noise term during the processing of ciphertexts. The present invention therefore relates to a method for refreshing a ciphertext c. This ciphertext c is a ciphertext obtained by encrypting the plaintext p (scalar). More particularly, the plaintext p is defined in the torus Tp, while the ciphertext c is defined in the space rpn+l

[0157] In a known manner, the ciphertext c is defined by c = ( a, b ) ■ This ciphertext is derived from the plaintext p by means of the following formula: b=p+e+as, where e is the (random) noise component associated with the ciphertext c and s is the private encryption key.

[0158] In practice, the ciphertext c is obtained by a known method of homomorphic encryption in the torus T (or TLWE encryption for "Torus Leaming With Errors") applied to the plaintext message p and via the private encryption key s. It is important to note that the cryptographic processing server 3 does not possess the private encryption key s (and is therefore unable to decrypt the ciphertext c).

[0159] The refresh process therefore aims to produce a refreshed version of the ciphertext c, that is to say another ciphertext c' (hereafter referred to as the "refreshed ciphertext c'"). This refreshed ciphertext c' is also decrypted as a plaintext p (when decrypted using the private encryption key s), but whose associated noise component is smaller than the noise component e of the ciphertext c.

[0160] Moreover, if we introduce, beforehand, a function / acting on the message space defined in the torus Tp, then the refresh operation can also provide a refreshed ciphertext c' of / (p).

[0161] Figure [Fig. 5] represents, in the form of a flowchart, an example of the refreshing process according to the invention.

[0162] This refresh process is implemented for example by the cryptographic processing server 3 of the cryptographic system 1. In general, the refresh process is implemented by computer.

[0163] As shown in [Fig.5], the refresh process begins at step E30 when the cryptographic system 1 (and more specifically the cryptographic processing server 3) receives the ciphertext c. As previously stated, the ciphertext ca was obtained, prior to the implementation of the refresh process, by encrypting the plaintext p, using the private encryption key s.

[0164] During this step E30, the cryptographic processing server 3 also receives a public encrypted version BK (or "Bootstrap key" according to the commonly used Anglo-Saxon terminology) of the private encryption key s (using a different encryption key). More specifically, the public encrypted version BK is obtained by encrypting the private encryption key s according to the encryption method described above.

[0165] Then, the process continues at step E32. During this step, the cryptographic processing server 3 determines a polynomial defined by the following expression: Af^z] v^x)mod(pM- The polynomial v(X) is here a functional refresh polynomial that belongs to the space n _ IDG _ with y = R / z. In this expression, p corresponds to the plaintext message (and therefore belongs to the torus T). In the present description, the notation [ x] corresponds to the integer closest to the number x and the notation mod corresponds to the modulo operator. <pM ( X) est le polynôme cyclotomique d’ordre M (comme introduit précédemment).

[0166] In practice, this functional refresh polynomial v(X) is determined according to a specific algorithm (described below). This algorithm allows the coefficients of the functional refresh polynomial v(X) to be determined as a function of values ​​f(k / p) of a function f (introduced below). The algorithm according to the invention covers the cases P ~ T and P *

[0167] In practice, determining the functional refresh polynomial y(X) is equivalent to determining a function g(p), called the refresh function, defined by the following expression: ■ = Coeff0(x4 v(X)mod <PM\ si la refresh function g(p) satisfies the two properties described in the following paragraphs (

[00167] and

[00168] ).

[0168] By construction, this refresh function g(p) is a function by pieces: g(p) = g^-^ )' with pe ][, i=O, ■■■■> Ml.

[0169] Moreover, the refresh function satisfies the following relation (called "compatibility condition): / ■ 7 \ _ nw T-The cooling polynomial- t J ~ " VjUtl functional change v(X) is then determined on the basis of the refresh function g.

[0170] The values ​​of the refresh function g(p) must coincide with the values ​​of the function f defined in the space Tp. In other words, the following relation must be satisfied: = Ap)' replace the function f with the function f -S / p1 with

[0171] Two cases can then be distinguished.

[0172] If P ~ the compatibility condition satisfied by g imposes constraints on the quantities / • / j \ F(j) , with F a function defined in the space Z and taking values ​​in J \ P / " P the Z space. This can then be written in the following form: _ n- In practice, \p ) This last relation is satisfied by a large class of functions but not for all functions f. To satisfy it automatically, it suffices to Lp-Y

[0173] In this case (P ~ f), an optimal choice for the functional refresh polynomial v( X) is given, as a function of the values ​​taken by the function f, by the following expression: J ) in IMI ns * i- vk^+l = Lj^[-),

[0174] The refresh function g is in this case a step function whose width of each step around messages k[ p is M / p.

[0175] If p and t are coprime, there are no particular constraints on the quantities f(j / p). The task then becomes finding a refresh function g that satisfies the following expression: y^! / i}' \ _ nw • y. More precisely, it (m ' t J " Z, The question then becomes one of determining all the values ​​of g(-LQ). <i < m-1^ partir des relations suivantes ± + 7j - q v e z'tout en pcrmcttant a ia fonction escalier g d’avoir les paliers plus larges possibles.

[0176] The described step E32 aims to determine the functional refresh polynomial v(X).

[0177] According to one embodiment of the invention, determining this functional refresh polynomial v(X) amounts to optimally determining the coefficients of the functional refresh polynomial v(X) (involved in the definition of the refresh function g) such that:

[0178]

[0179]

[0180]

[0181]

[0182]

[0183]

[0184]

[0185]

[0186]

[0187]

[0188]

[0189] V£ = 0, . i, with dk, s'k values positive as large as possible. This then amounts to determining the values ​​of the refresh function g at points j = ..., Ml- If P = t, the optimal solution is obtained for . If p and t are coprime, the determination of the coefficients of the functional refresh polynomial y( X) can be broken down into the following sub-steps. The first substep aims to express the compatibility condition introduced previously in the form of M compatibility relations obtained for J / _ f. The system formed by these M compatibility relations sa- satisfied by the refresh function g is equivalent to the following M / 1 relations: y ) =0' For 0 < / < -^ - 1- i mody-=j The second substep aims to use the M11 relations determined in the previous step to determine the function g. In other words, it involves solving the system of equations in such a way as to determine the values ​​taken by the refresh function g at all points i = Q, M- 1- For each fixed index j, with 0 < j < -L, the algorithm determines the index i between 0 and Ml, among the set of indices i that satisfy the relation i mod^- = j and that is furthest from the nearest k / p message. We denote this index O. In other words, the index O achieves the following maximum: I [ip / M] / I max p..........- -v CE&W-l I ' ' I i mody-=j The values ​​of the refresh function g taken at all points l / M are then given by the following relations: i \ l \ „ dlj for j mod~- = j and i * ej and _y / mod—^ This second substep is repeated for all equivalent relations j, with Q < j < ^f -1. This then allows us to obtain the values ​​taken by the refresh function g at all points J_? / = (f _,, ? M -1- Then, in a third substep, the cryptographic system 3 determines the coefficients of the functional refresh polynomial v(X) according to the following expression: / -M . ? \, with 0 <æ<r-let0< <^-l Vk^+l-+1) 1

[0190] Advantageously, this implementation allows us to determine the optimal functional refresh polynomial y(X) satisfying the conditions stated above.

[0191] The refreshed ciphertext c' is then derived (step E34). This refreshed ciphertext c' is obtained by a known homomorphic encryption method in the torus T (or TLWE encryption) of the zeroth coefficient of this polynomial y-[ v(X)mod <pm- ce chiffrement homomorphe est mis en œuvre utilisant la version publique chiffrée bk de clé privée s.

[0192] The use of the cyclotomic polynomial of order M in this refresh method is particularly advantageous because it significantly improves the performance of processing operations (especially homomorphic calculations) involving longer messages (not processed in binary format). Indeed, the known refresh method cannot process messages in the form of long integers without using the binary format. Here, thanks to the use of cyclotomic polynomials, it is possible to perform this processing for messages in the form of long integers. In particular, the use of the cyclotomic polynomial of order M allows the homomorphic calculation and the refresh of the ciphertext c to be performed during the same operation on these messages in the form of long integers.

[0193] The refresh process ends with step E36. During this step, the cryptographic processing server 3 extracts the refreshed encrypted message c'.

[0194] Advantageously, the refreshed ciphertext c' has a smaller noise component e' than the noise component e associated with the ciphertext c.

Claims

Claims

1. Method for determining an encrypted message c(X) corresponding to an encrypted version of a message p(X), the message p(X) being in the form of a polynomial of degree less than or equal to Nl whose coefficients have values ​​in a space | ^modulol, k EZ} with p a non-zero integer, N being a non-zero integer, said method comprising a step of encrypting the message p(X) by totally homomorphic encryption, from a private key s(X) in the form of a polynomial of degree less than or equal to N-1, in the encrypted message c(X) in the form of a polynomial belonging to a space p ■ _ Tg W , with TJX] a space of polynomials of degree less than or equal to Nl whose coefficients have values ​​in T — J-niodulol k EZ) with 4 a non-zero integer greater than p and X ) a cyclotomic polynomial of order M,with M = tc\ t a prime number strictly greater than 3 and a a non-zero integer or M —fl t?', with h prime numbers and a; non-zero integers, at least one of the prime numbers h being strictly greater than 3.,

2. A determination method according to claim 1, wherein the fully homomorphic encryption is implemented by a polynomial encryption function with coefficients in a space defined by a torus T.

3. Method for transforming an encrypted message c(X) determined according to claim 1 or 2 into an encrypted element ct(X), said encrypted element c^X) belonging to a subspace of the space Rq, comprising a step of determining said encrypted element c^X) by applying a linear application to the message p(X), said linear application being a trace operator TraceG defined in the following manner: TraceG( / / (X) ) = ^deGWd{X^i{Xd)modcPM, with G a subset of the integers between 0 and Ml and prime with M and Wd of the predefined weights.

4. Method for refreshing the encrypted message c corresponding to an encrypted version of a message p, said message p being defined in the torus T, said refreshing method comprising a step of determining a refreshed encrypted message c', the refreshed encrypted message c' comprising a noise component e' smaller than a noise component e of the encrypted message c, the refreshed encrypted message c' being determined on the basis of a polynomial obtained according to the determination method according to claim 1 or 2.

5. A refreshing method according to claim 4, wherein the step of determining the refreshed encrypted message c' comprises a step of calculating a zero-order coefficient of the polynomial %~l Wd y(X )mod <PM avec v(X) un polynôme de rafraîchissement fonctionnel appartenant à l’espace o _ . avec T — R / z, la notation [ x ] correspondant à l’entier le plus proche du nombre x et la notation mod correspondant à l’opérateur modulo.

6. Method for extracting a homomorphic encrypted element cp from an encrypted message c(X) in the form of a polynomial belonging to the space Rq, the encrypted message c(X) being determined by a determination method according to claim 1 or 2, the homomorphic encrypted element Cp being obtained by determining the coefficient of order 0 of a polynomial X^inodM being a cyclotomic polynomial of order M, with M = ta, t being a prime number strictly greater than 3 and a non-zero integer, / ' being a non-zero integer, said homomorphic encrypted element cp corresponding to an encrypted element of a linear combination of coefficients of the message p(X).

7. Extraction method according to claim 6, comprising a step of determining the non-zero integer [3 so as to verify the following inequality: 0 S fimodM ~ - 1, said homomorphic encrypted element Cp corresponding to an encrypted element of a coefficient of order [3 of the message p(X).

8. Method for aggregating a plurality of encrypted messages c®, i being a natural integer, each encrypted message c® belonging to a space Tn+1, n being a non-zero natural integer, each encrypted message c® corresponding to an encrypted version of an associated message p®, this encryption being implemented by means of a private encryption key s, the aggregation method comprising steps of: - determining an encrypted key S according to the determination method according to claims 1 or 2, and - aggregating said plurality of encrypted messages c® so as to obtain an encrypted message C in the form of a polynomial.

9. The aggregation method of claim 8, wherein the encrypted message C in the form of a polynomial is determined on the basis of a polynomial encryption with coefficients in the space defined by the torus T.

10. Device (2A) for determining an encrypted message c(X) corresponding to an encrypted version of a message p(X), the message p(X) being in the form of a polynomial of degree less than or equal to Nl whose coefficients have values ​​in a space Tp = | ~ modulol, k GZ} with P a non-zero integer, N being a non-zero integer, the determination device (2A) comprising at least one processor and a storage device, the processor comprising: - a module for encrypting the message p(X) by totally homomorphic encryption, from a private key s(X) being in the form of a polynomial of degree less than or equal to Nl, in the encrypted message c(X) being in the form of a polynomial belonging to a space „ ._ T,;[x] , with TJX] a space of polynomials of degree less than or equal to Nl whose coefficients have values ​​in modulo 1, ke Z} with 9 a non-zero integer greater than p and <pM ( X) un polynôme cyclotomique d’ordre M, avec M = t'1. t un nombre premier strictement supérieur à 3 et a un nombre entier non nul ou M — I"I avec h des nombres premiers et a;des entiers non nuis, au moins l’un des nombres premiers h étant strictement supérieur à.

11. Cryptographic system (1) comprising: - a device (2A) for determining an encrypted message c(X) according to claim 11, and - a cryptographic processing server (3) configured to implement at least one cryptographic processing operation on the encrypted message c(X).

12. Computer program comprising instructions executable by a processor and designed to implement a method according to any one of claims 1 to 9 when these instructions are executed by said processor.

Images