Method for extracting a homomorphic ciphertext from a homomorphic ciphertext list and method for inserting a homomorphic ciphertext into a homomorphic ciphertext list

Abstract

Method for extracting a homomorphic ciphertext from a homomorphic ciphertext list and method for inserting a homomorphic ciphertext into a homomorphic ciphertext list. Method for obtaining (100) a homomorphic ciphertext from a homomorphic ciphertext list, the elements of the list belonging to a torus T, the method comprising the following steps: Obtaining a homomorphic ciphertext (101) of a polynomial Q(X), Q(X) being an aggregation of the elements of the list; Obtaining a homomorphic ciphertext (102) of a monomial, being a function of the index associated with the element to be obtained; Determine a homomorphic cipher polynomial (103) as a homomorphic modular product between and ; Extract the coefficient k (104) of the homomorphic cipher polynomial, k being determined on the basis of the polynomial Q(X) and the function used in the monomial P(X), the coefficient k of the homomorphic cipher polynomial corresponding to the homomorphic cipher element to be obtained. Figure to be published with the abstract: Figure 1

Description

Title of the invention: Method for extracting a homomorphic encrypted element from a homomorphic encrypted list and method for inserting a homomorphic encrypted element into a homomorphic encrypted list Technical field

[0001] The technical field is that of methods, devices and systems of homomorphic cryptography. More particularly, the field of the invention is that of the manipulation of homomorphic encrypted lists. TECHNOLOGICAL BACKGROUND

[0002] Homomorphic cryptography, which allows calculations or data processing to be performed on encrypted data without first decrypting it, has attracted a lot of attention recently.

[0003] Indeed, the digital processing of personal data has become omnipresent in our daily lives. Protecting the confidentiality of this data, and the privacy of the individuals concerned, has therefore become critical, as this personal data tends to circulate more and more in the digital systems environments that we use on a daily basis.

[0004] In this context, homomorphic encryption and processing techniques appear to be a very promising solution, because they make it possible to process data while preserving the anonymity and privacy of this data in a particularly secure manner, the latter not being decrypted during processing.

[0005] Homomorphic cryptography can be based on the so-called "learning with errors" (LWE) encryption scheme, in which the encrypted message c(a, b) = is derived from the unencrypted message q according to the following formula: b=q+e+as, where:

[0006] s is a secret key,

[0007] a is a randomly chosen vector, to project the secret key s, and

[0008] e is a random noise component, added to q+as

[0009] To decrypt the message, a person with the secret key s can calculate the quantity ba.s (equal to q+e), then round the result to remove the noise component e and recover the message q. Of course, the noise term e must be and remain sufficiently small if we want to be able to recover the message q.

[0010] Homomorphic cryptography methods therefore respond, among other things, to the technical challenge of enabling: • to an external, generally remote, service and processing server to carry out “blind” operations on encrypted data, without decrypting it, this server not having the key necessary to decrypt the data, • the data, encrypted, being provided by another, distinct entity (a client, in the IT sense), which has the encryption key.

[0011] These data processing operations may consist of performing individual operations, data by data, to format or filter them for example. They may also concern operations of comparison between data, sorting or grouping.

[0012] The manipulation of homomorphic encrypted elements can be complex and requires the development of methods for performing mathematical operations in the space of the encrypted elements.

[0013] Among the known methods, also called cryptographic primitives, we can cite the following techniques (the symbols bra and ket < - > indicate a homomorphic cipher of the quantity between the symbols):

[0014] Homomorphic addition: if C = and are two ciphers ho homomorphic of two elements and ^2 belonging to the torus T, it is possible to obtain the sum of the ciphers using homomorphic addition

[0015] q ® q= / V

[0016] Homomorphic subtraction: if Ci = S / / > and q — < / t2> are two homomorphic ciphers of two elements and ^2 belonging to the torus T, it is possible to obtain the difference of the ciphers using homomorphic subtraction

[0017] qGcq^V'?

[0018] Homomorphic addition of polynomials: if r. —<y^Xj> and c, =< / / .^X^> are two homomorphic ciphers of two elements and ^2 belonging to the ring of polynomials of degree N, T^X] = TjXpÇY^ + 1), it is possible to obtain the sum polynomial in the space of ciphers using the homomorphic addition of the polynomials

[0019] q © q, = < ^)+ / q(x) >

[0020] Homomorphic subtraction of polynomials: if q — < ^X^ > and c7 — < / q(X) > are two homomorphic ciphers of two elements and ^2 belong to the ring of polynomials of degree N, T^X] = T^Xj / ^X^ + with P31 example N a power of 2, it is possible to obtain the difference polynomial in the space of ciphers using the homomorphic subtraction of polynomials:

[0021] q 0 q=<p!}(x) - ^x}>

[0022] Homomorphic modular product: If C = < m(X) > and c — < iXX) > are two homomorphic ciphers of two elements m(X) and / / (X) belonging to the ring of polynomials of degree N, 7^X] = T^Xj / ^X^ 4- 1), it is possible to obtain the polynomial product in the space of ciphers using the homomorphic modular product: CEI<m(X) ■ pi(X)>

[0023] These cryptographic primitives therefore make it possible to carry out several mathematical operations in the space of homomorphic ciphers, by reproducing the standard mathematical operations carried out in the clear space.

[0024] However, homomorphic cryptography has been applied very little to the manipulation of encrypted lists or sets. Some methods for homomorphic encryption of list elements have been recently proposed, for example in the article "Faster Amortized FHEW bootstrapping using Ring" by G. De Micheli et al., https: / / eprint.iacr.org / 2023 / 112, 2023). However, these techniques focus on the homomorphic encryption of individual elements of a list, without giving indications concerning, for example, complete manipulations of homomorphic lists.

[0025] There is therefore a need to develop techniques for performing complex operations on homomorphic encrypted lists, for example by extracting a homomorphic encrypted element from a homomorphic encrypted list or by modifying a homomorphic encrypted list by deleting or adding a homomorphic encrypted element. Furthermore, it is necessary to develop methods for manipulating homomorphic encrypted lists that are reliable, fast and inexpensive in terms of computing resources. Summary of the invention

[0026] To at least partially resolve the problems mentioned above, a first aspect of the invention relates to a method for extracting a homomorphic encrypted element < from a homomorphic encrypted list <l>, the homomorphic encrypted element < A, > being associated with an index hi being between 0 and Nl, the elements of the list L belonging to a torus T, the list L and the index i being encrypted using the same key, said method comprising the following steps: • Obtain a homomorphic cipher < Q(X) > of a polynomial Q(X), Q(X) being an aggregation of the elements Lj of the list L , j being between 0 and Nl, each coefficient of the polynomial Q(X) being a linear combination of elements of the list A, Q(X) belonging to a quotient space TfX] / ^M(X),r[X] being a space of polynomials of degree Nl with coefficients with values ​​in the torus T and &M(X) being a cyclotomic polynomial of order M; • Obtain a homomorphic cipher < P(X) > of a monomial p(x) = Xr, being a function of the index f associated with the element <lj>to obtain, P(X) belonging to a quotient space Z[ X ] / 0 w ( X ), Z[ X ] being a set of polynomials with coefficients in the integers; • Determine a homomorphic encrypted polynomial < C(X) > as a homomorphic modular product between < P(X) > and < Q(X) >; • Extract the coefficient k from the homomorphic encrypted polynomial<C(X)> ,k being determined on the basis of the polynomial Q(X) and the function f used in the monomial P(X), the coefficient k of the homomorphic encrypted polynomial < C(X) > corresponding to the homomorphic encrypted element < > to be obtained.

[0027] The symbols bra and ket <... > indicate a homomorphic cipher of a quantity. For example, the symbol indicates a homomorphic cipher of an integer i.

[0028] By homomorphic modular product, also indicated by the symbol □ , is meant an operation between two homomorphic ciphers, and , such that El = <ab>In other words, the homomorphic modular product H reproduces, in the space of ciphertexts, the result of a product of two elements in plaintext.

[0029] By homomorphic cipher of Xy, we mean a homomorphic cipher of the quantity X^mod V mod M being between 0 and Ml.

[0030] By cyclotomic polynomial of order M is meant, in a known manner, the unitary polynomial whose complex roots are exactly the M-th primitive roots of unity. The order M is defined by M = t" with t any prime and has any integer.

[0031] By aggregation, or "packing" according to English terminology, is meant a representation of the list L in the form of a polynomial. In the case of the method according to one aspect of the invention, each coefficient of the polynomial Q(X) representing the list L comprises a linear combination of elements of the list L. Each linear combination may comprise one or more elements of the list L.

[0032] The method according to the first aspect of the invention is a general method for extracting a homomorphic encrypted element from a homomorphic encrypted list from the homomorphic encrypted < P (X) > of the index i corresponding to the element of interest<L,> . The extraction of the homomorphic encrypted element is performed in a completely homomorphic way, i.e. without the need to decrypt the elements of the list or the index.

[0033] In other words, the method according to the first aspect of the invention performs a function of the homomorphic extractor type, or “homomorphic getter” according to English terminology.

[0034] It is important to note that the method according to the first aspect of the invention is a general method which can be implemented for any list of elements belonging to the torus T and indexed according to an integer i.

[0035] The extraction method according to one aspect of the invention therefore makes it possible to extract a homomorphic encrypted element from a homomorphic encrypted list without the need to decrypt the element or the list. This is possible thanks to the prior preparation of the polynomial Q(x) as an aggregation of elements of the list L and the monomial P(X) representing the index i corresponding to the element to be extracted. In other words, the encrypted polynomial < Q (X) > is an encrypted representation of the list L and the encrypted monomial < P (X) > is an encrypted representation of the index i.

[0036] It is important to note that < Q (X) > and < P (X) > can be obtained homomorphically from the encrypted elements of the list < L > and the encrypted index without the need for prior decryption. Indeed, one of the advantages of the method according to the first aspect of the invention is to be able to extract an encrypted element from the encrypted list without the need for decryption of the list or the index associated with the element to be extracted.

[0037] The polynomial produced<C(X)> then contains the encrypted element to be extracted in the form of its k-th coefficient. The coefficient k is determined from the aggregation used to obtain the polynomial Q and the function y used in the monomial P(X). In other words, the prior construction of P(X) and Q(X) uniquely identifies the coefficient k of < C(X) > containing the element of the homomorphic encrypted list to be extracted. The inventors have therefore developed a technique for extracting an element from a homomorphic encrypted list which is both simple and quick to implement and which is based on the prior preparation of the aggregation Q(X) and the monomial P(X) representing respectively the list L and the index i associated with the homomorphic encrypted element to be extracted from the list.

[0038] In one or more embodiments: • each coefficient of the polynomial Q(X) is a linear combination obtained according to the following formula ? r with 0 < p < t - 2 0 < / < f - 1, and • the coefficient of the polynomial < C(X) > corresponding to the homomorphic encrypted element to be extracted is the coefficient k = 0, y being equal to M - i.

[0039] This construction of the polynomial Q(X) makes it possible to position the element of the list to be extracted in correspondence with the coefficient k = 0 of the product polynomial < C(X) > . Furthermore, this choice for the coefficients of the polynomial Q(X) makes it possible to efficiently extract the homomorphic cipher of the desired element of the list for a wide range of values ​​of the parameters t, M and y. Indeed, the inventors have succeeded in finding constructions of the polynomial Q(X) and the monomial P(X) which are particularly suitable for extracting the element<L}> . Such constructions are not obvious to those skilled in the art, especially since if the aggregation Q(X) and the polynomial P(X) are not chosen appropriately, there is a high probability of coming across a linear combination of elements from the list < L > and not the element of interest .

[0040] In one or more embodiments, the extraction method according to the first aspect of the invention may further comprise a step of receiving the index and the list < L >, < Q(X) > and < P(X) > being obtained from the ciphertexts < t > and <l>.

[0041] In one or more embodiments: • The homomorphic encrypted polynomial < Q > is obtained from the list L comprising the elements Lj, j being an integer between 0 and N -1, the homomorphic encrypted polynomial < Q > being in the form of a homomorphic cipher of yN-1 va(j), a(J) being a function with values ​​in j = (A;A the set of whole numbers between 0 and Nl and M = 2"; • The homomorphic encrypted monomial is obtained from the index i, being in the form of a homomorphic cipher of x^ -, ffi) being a function with values ​​in the set of integers between 0 and Nl • The homomorphic encrypted polynomial < C(X) > is obtained according to the formula < C^xj > = < / ^x) > □ < q(x) > = < X~KiT^ > ; • The coefficient k of the polynomial < C(X) > to be extracted is given by k = akï)-lXî).

[0042] By homomorphic cipher of , we mean a homomorphic cipher of the quantity

[0043] This embodiment illustrates an example of cooperation between the aggregation of elements of the list in the form of a polynomial Q(X) and the encryption of the monomial P(X). This is possible due to the fact that the elements of the list are encrypted as coefficients of a polynomial of degree Nl, the list being a homomorphic cipher of tv^- In this case the coefficients of the polynomial Q(X) are simply the j = A elements of the list L (linear combinations each include a single element).

[0044] The function «( / ) is a function of the integer j with values ​​in the integers between 0 and NL. The function a is for example a function of type a(j) = (j + cr) mod N, with 0 an integer. Another example of a function is «(j) = (cr* / ) mod N with odd.

[0045] Furthermore, the index i is the homomorphic cipher of xThe function fi(i) is a function of the integer i with values ​​in the integers between 0 and N-1. The function P is for example a function of type / Xy) =( j + cr) mod N, with G an integer. Another example of a function is 0 = (j) = (°- * / ) tnod N with G odd. By combining these two homomorphic encryption techniques, the inventors discovered that it is possible to extract the sought element by calculating the homomorphic modular product < / y □<£> — < X~^L > •

[0046] Advantageously, this homomorphic modular product results in a rotation of the coefficients of the starting polynomial Q(X). The coefficient of interest, namely the element of the list to be extracted, then becomes the coefficient of order a(f) - / ?( / ) of the polynomial determined using the homomorphic modular product. It is therefore possible to extract the element of the homomorphic encrypted list by calculating the coefficient of order a(i) - 0(i) of the polynomial co.

[0047] According to one or more embodiments, the functions a(i) and fi(i) are chosen as being the identity function, namely a(i) = i and X0 = The coefficient to be extracted is then simply the zero order coefficient of the polynomial < C(X) > .

[0048] Extracting a coefficient of a given order from an encrypted polynomial is a known primitive in homomorphic cryptography. Moreover, extracting the zero coefficient from a homomorphic cipher of a polynomial is particularly simple to implement.

[0049] The combination of the encryption of the elements of the list as coefficients of a polynomial of degree Nl and the encryption of the exponent i as an exponent of a monomial X'^ is far from obvious. The combination of these characteristics has never been used in homomorphic cryptography and makes it possible to obtain a general method for extracting a homomorphic encrypted element from a homomorphic encrypted list.

[0050] Advantageously, the use of these two different homomorphic ciphers for the elements of the list and the index makes it possible to simplify the extraction of the sought element, which can be carried out as a calculation of the zero coefficient of a polynomial obtained by homomorphic modular product. The extraction of an element from a homomorphic encrypted list using the method according to the first aspect of the invention is therefore general, reliable and fast.

[0051] According to one embodiment of the method according to the first aspect of the invention: • The homomorphic encrypted polynomial < Ô(X) > is obtained according to the following formula < = TRLWE^^LfX^ ' • The homomorphic encrypted monomial is determined according to the following formula < py = TRGSW(X~tKi)) .

[0052] TLWE Encryption Definition

[0053] By TLWE encryption, “Torus Learning with Errors” according to English terminology, we mean a known method of homomorphic encryption of an element t belonging to the torus T.

[0054] The cipher TLWE(t) is determined according to the following formula:

[0055] TLWE(t) = (a^ b )

[0056] With , y4 U — / / + C + 7 . . _

[0057] The vector s is the encryption key, the vector a is a projection vector of the key s, or mask, and the quantity e is random noise.

[0058] TRLWE Encryption Definition

[0059] By TRLWE encryption, "Torus Ring Learning With Errors" according to English terminology, we mean a known method of homomorphic encryption of a polynomial belonging to the ring of polynomials Tf{X] — 7^X] / C(X), where C is a cyclotomic polynomial and for example = XN + 1 with N being a power of 2. Here we mean by ring of polynomials the space of polynomials of degree N with coefficients in the torus T.. The encryption key s and its projection vector a are vectors belonging to the set

[0060] The cipher TRLWE( / i) is determined according to the following formula:

[0061] TRLWEijj) = a2(XVqx), HX))

[0062] With = + +

[0063] The polynomial e(X) is a polynomial of the same degree as / / (X) whose coefficients represent the random noise added to the ciphertext of the message / / (X). For example, the coefficients of e(X) can have a Gaussian distribution centered around zero with a variance o2.

[0064] TRGSW Encryption Definition

[0065] By TRGSW encryption, "Gentry, Sahai, Waters Torus Ring encryption” according to English terminology, we mean a known method of homomorphic encryption of a polynomial m(X) belonging to the ring of polynomials Z[X] / ^^X) with a key s, s being a vector belonging to the set (Z[X])Â-

[0066] The TRGSW cipher of m is then determined as follows:

[0067] TRGSW(nï) = Z + mH with

[0068] / \, where Zj, j=l.. .1(K+1), are 1(K+1 ) encrypted version of 0, the value z= ; \Zl(K+l)l null 0 being encrypted with s', 1 being a given positive integer; and

[0069] Hb is a matrix whose dimension is (X + 1) X (K + 1) x / and whose coefficients- ficients belong to the torus T, being equal to:

[0070] / 'to Ô «.A with / 1 x k! I

[0071] B being an integer greater than or equal to 2.

[0072] Definition of homomorphic modular product S between a TRGSW and a TRLWE

[0073] By homomorphic modular product 0 we mean an operation between two homomorphic ciphers, and , such that □ = < AB > . In other words, the homomorphic modular product B reproduces, in the space of ciphertexts, the result of a product between plaintext elements.

[0074] The method of calculating the homomorphic modular product B depends on the properties of the encrypted elements to be multiplied. For example, in the case of a product between C = T RG SW(fri) and c = TRLWEfji) we obtain:

[0075] CHc = TRLWE (m • / / )

[0076] The advantage of this embodiment is that the calculation of the homomorphic modular product c _ < / > □ < £ > = < > can be carried out in a known manner, using the technique for the product of a TRLWE encrypted quantity and a TRGSW encrypted quantity. The polynomial produced is then a TRLWE encrypted quantity whose zeroth-order coefficient is the element of the list to be extracted.

[0077] Another aspect of the invention relates to a computer program comprising instructions executable by a processor and designed to implement a method according to the first aspect of the invention when these instructions are executed by said processor.

[0078] A second aspect of the invention relates to a method of inserting a homomorphic encrypted element < > into a homomorphic encrypted list < L > so as to obtain a modified homomorphic encrypted list < L' >, in which: • The homomorphic encrypted element is obtained by homomorphic encryption of a plaintext element belonging to a torus T; • The homomorphic encrypted list <l>is obtained from a plaintext list L comprising the elements L^ j being an integer between 0 and N -1, N being an integer greater than or equal to 1, the elements Lj belonging to the torus T, the homomorphic encrypted list < L > being in the form of a homomorphic cipher of yN-1; • The modified homomorphic ciphertext < L' > is a homomorphic ciphertext of a plaintext list L' comprising the elements — [^. for j & i and / U — for j = i, i being an integer between 0 and Nl; Said method comprising the following steps: • Receive the homomorphic encrypted element < R > , the homomorphic encrypted list <l>and a homomorphic cipher in the form of a homomorphic cipher of <l>and being encrypted using the same key s ; • Extract, in accordance with the method according to the first aspect of the invention, the element = from the homomorphic encrypted list <l>; • Calculate homomorphically the difference dY — < jli> © d0 = ; • Obtain a homomorphic number of the quantity ' • Obtain the modified homomorphic encrypted list < L'> by calculating in a way homomorphic addition <^ _ £.^X^> ® <l>■

[0079] The operations homomorphic subtraction, denoted by the symbol ©, and homomorphic addition, denoted by the symbol ®, are known cryptographic primitives.

[0080] In the case of the difference < E > © do =< / . / -£,> , the symbol © indicates the difference between two elements belonging to the torus T.

[0081] In the case of the sum ® <£>, the symbol ® indicates the sum between two polynomials whose coefficients have a value in the torus T or in space

[0082] The method according to the second aspect of the invention makes it possible to introduce a homomorphic ciphertext < R > into a homomorphic ciphertext < L >. This method, in combination with the method according to the first aspect of the invention, provides a complete technique for manipulating homomorphic ciphertext lists.

[0083] In other words, thanks to the methods according to the first and second aspects of the invention, the reading of a list, namely the extraction of one of its elements, as well as its modification, namely the replacement of one of its elements, are possible.

[0084] In one or more embodiments of the method according to the second aspect of the invention, the step of extracting the element d0 = < Lj > from the homomorphic encrypted list <l>is carried out using the method according to the first aspect of the invention.

[0085] In one or more embodiments of the method according to the second aspect of the invention: The homomorphic ciphertext is a homomorphic ciphertext calculated according to the formula TRIXVE^'=^ ' The homomorphic encrypted element 5 p > is calculated according to the formula TLWE( / i) The homomorphic cipher is calculated according to the formula TRGSW^JC^'^-

[0086] In one or more embodiments of the method according to the fourth aspect of the invention, the step of obtaining a homomorphic figure of the quantity understand : • Calculate a homomorphic number of the quantity / z _ Ei according to the formula TRLWE(^ - Q ; • Calculate the homomorphic modular product < z > El<jj - Lt> according to the formula TRLWE^i - ' • Obtain, from the quantity TRRWR^jj - a homomorphic number of the quantity under the assertion of TRLWE(fa - L^Xa^

[0087] If the function / î(z) is of the type X0 — and ^(i) = Z '*z, and E being prime with M, the step of obtaining the quantity RRRWE^A - L is carried out by applying an automorphism.

[0088] In one or more embodiments of the insertion method according to the second aspect of the invention, the functions a(i) and XO are the identity function so as to have a(i) = i and ^(z) = i.

[0089] Another aspect of the invention relates to a computer program comprising instructions executable by a processor and designed to implement a method according to the second aspect of the invention when these instructions are executed by said processor.

[0090] A third aspect of the invention comprises a cryptographic processing server for processing a homomorphic encrypted list comprising a communication module and a calculation module: • The communication module being configured to receive, from an entity external to the server, a homomorphic encrypted index < z > or ; • The calculation module being configured to extract, from a homomorphic encrypted list < L >, a homomorphic encrypted element <lt>associated with the homomorphic encrypted index < Z > OR , in accordance with the method according to the first aspect of the invention.

[0091] According to one embodiment, the calculation module of the processing server according to the first aspect of the invention determines the homomorphic modular product < Z > □ < L > = < X'^L > ct in appropriately chosen extract so as to obtain a figure of the element of the list sought.

[0092] According to one embodiment, the communication module is further configured to receive, from an entity external to the server, an encrypted element ho- momorphic < .

[0093] According to one embodiment, the calculation module is programmed to introduce the homomorphic encrypted element S > into a homomorphic encrypted list < L > in accordance with the method according to the second aspect of the invention.

[0094] A fourth aspect of the invention relates to a client configured to encrypt the index i in the form of a homomorphic encrypted index Or < / lt> < / l> < / l> < / l> < / l> < / l> < / l> and / or the message in the form of a homomorphic encrypted message < / / > and to communicate the homomorphic encrypted index or and / or the homomorphic encrypted message to the server according to the third aspect of the invention via a communication channel. The encrypted index is for example in the form of an encrypted monomial < Ô(X) > .

[0095] A fifth aspect of the invention relates to a cryptographic system comprising: • A cryptographic processing server according to the third aspect of the invention; • A client according to the fourth aspect of the invention.

[0096] Thanks to the cryptographic system according to the fifth aspect of the invention, the cryptographic processing server only receives homomorphic encrypted quantities and extracts an element from the list without needing to perform decryption.

[0097] The present technology and its various applications will be better understood by reading the following description and examining the accompanying figures. BRIEF DESCRIPTION OF THE FIGURES

[0098] The figures are presented for information purposes only and are not limiting.

[0099] [Fig. 1] illustrates a flowchart of an embodiment of the method for extracting a homomorphic encrypted element from a homomorphic encrypted list according to the first aspect of the invention.

[0100] [Fig.2a] schematically illustrates the aggregation of a list according to an embodiment of the first aspect of the invention.

[0101] [Fig.2b] schematically illustrates the extraction of a homomorphic encrypted element from a homomorphic encrypted list according to an embodiment of the first aspect of the invention.

[0102] [Fig.3] illustrates a flowchart of an embodiment of the method of inserting a homomorphic encrypted element into a homomorphic encrypted list according to the second aspect of the invention.

[0103] [Fig.4a] schematically illustrates certain steps of an embodiment of the method according to the second aspect of the invention.

[0104] [Fig.4b] schematically illustrates the insertion of a homomorphic encrypted element into a homomorphic encrypted list according to an embodiment of the method according to the second aspect of the invention.

[0105] [Fig.5] illustrates an embodiment of a cryptographic system for the processing a homomorphic encrypted list according to one aspect of the invention. DETAILED DESCRIPTION

[0106] Figure 1 [Fig. 1] schematically represents an embodiment of the method 100 for extracting a homomorphic encrypted element from a homomorphic encrypted list < L >.

[0107] The method 100 according to the embodiment illustrated in Figure 1 comprises a step 101 of obtaining a homomorphic cipher < Q(X) > of a polynomial Q(X). The polynomial Q(X) belongs to the set T[X] / cfiM(X). is a space of polynomials of degree Nl with coefficients with values ​​in the torus T. is a cy- polynomial clotomic of order M and degree N. Each coefficient of the polynomial Q(X) is a linear combination of elements from the list L.

[0108] The method 100 as illustrated in FIG. 1 further comprises a step 102 of obtaining a homomorphic cipher < P(X)> of a monomial P(X) = being a function of the index i associated with the element < / l> to obtain. The monomial P(X) belongs to Z [ X ] / (PM ( X ), Z [ X ] being a set of polynomials with coefficients in the integers.

[0109] In step 103, the homomorphic encrypted polynomial<C(X)> is determined as a homomorphic modular product between < P(X) > and < Q(X) > .

[0110] The extraction step 104 of the coefficient k of<C(X)> allows you to obtain the element < > to extract from the list < L > .

[0111] The homomorphic encrypted monomial < P(X) > is obtained from a plaintext index i, i being an integer between 0 and X -1. According to one embodiment, the homomorphic encrypted monomial < P(X) > is obtained as a homomorphic cipher of the quantity ■

[0112] According to one embodiment, the homomorphic encrypted polynomial < Q > is obtained from the plaintext list L comprising the elements Lj, j being an integer between 0 and N- 1. The elements Pj belong to the torus T. In this embodiment the homomorphic encrypted polynomial < Q > is obtained as a homomorphic cipher of the quantity of other terms, the elements of the plaintext list are encoded as coefficients of a polynomial which is then homomorphically encrypted.

[0113] In this embodiment, the homomorphic modular product calculated during step 103 is calculated according to the following formula C(X) = □ < Q> . The quantity C(X) is a polynomial of degree N with coefficients with values ​​in the torus T.

[0114] It is therefore possible to obtain a homomorphic cipher of the element, namely < L(> , during a step 104 of extracting the coefficient of order a(i)- / Tï) from the polynomial C(X).

[0115] Figures 2a and 2b illustrate in more detail certain steps of an embodiment of the method 100 according to the first aspect of the invention.

[0116] According to the embodiment illustrated in Figure 2a, the plaintext list L is a sorted set of elements Ljj being between 0 and Nl. In this case, the boxed element L{ corresponds to the element that we want to extract from the list. The homomorphic encrypted polynomial < Q > is obtained as:

[0117] TRLWe(^\-EjXj 1 = TRLWE (Lo + + L^X1 + ... + )

[0118] The homomorphic encrypted monomial of the index is obtained according to the formula — TRGSW(X^y In this case the function a(î) is the identity function, a(f) = i. The function is also chosen to be equal to the identity function, / î(ï) — i

[0119] The choice of a TRLWE cipher for the polynomial Q encoding the elements of the list and a TRGSW cipher for the monomial P encoding the index makes it possible to calculate the homomorphic modular product El < Q > as:

[0120] TRLWE ( ) = TRLWE (L0X'1+ Lix"+1 + ... + LiX1+,+ • • ■ LNMXN4)= TRLWE Li 2C'+1 + ... +

[0121] As illustrated in Figure 2b, the term of interest Li becomes, in the product polynomial C, the zero coefficient. It is therefore possible to extract a homomorphic cipher of the element of interest as the zero coefficient of the polynomial resulting from the homomorphic modular product.

[0122] Figure 3 illustrates a flowchart of an embodiment of the method 400 for inserting a homomorphic encrypted element 5 p > into a homomorphic encrypted list <l>so as to obtain a modified homomorphic encrypted list<L'> .

[0123] The homomorphic encrypted element< / l> is obtained by homomorphic encryption of a plaintext element belonging to a torus T. The homomorphic encrypted list <l>is obtained from a plaintext list L comprising the elements L^ j being an integer between 0 and X - 1, N being an integer greater than or equal to 1.

[0124] According to the example illustrated in Figure 3, the elements Lj belong to the torus T and the homomorphic encrypted list <l>is in the form of a homomorphic cipher of Ej = .

[0125] The objective of the insertion method 400 is to obtain a new homomorphic encrypted list<L’> which is the homomorphic ciphertext of a plaintext list L'. The plaintext list L' is identical to the starting list L except for the element L. which has been replaced by the element

[0126] To do this, the embodiment of the method 400 according to the second aspect of the invention comprises: • Receive 401 the homomorphic encrypted element 5 p > , the homomorphic encrypted list <l>and a homomorphic ciphertext < ? > in the form of a homomorphic ciphertext of x~^, < , < L> and being encrypted using a same key s; • Extract, using the method 100 according to the first aspect of the invention, the element = 402 from the homomorphic encrypted list <l>; • Calculate 403 homomorphically the difference d^ — < / j > Q dG — ; • Obtain 404 a homomorphic cipher of the quantity; • Get the modified homomorphic encrypted list<L' > 405 by calculating homomorphically the sum <^ - ® <l>•

[0127] Step 402 of extracting the element d^ =<L{> of the homomorphic encrypted list <l>therefore includes the implementation of the method 100 according to the first aspect of the invention.

[0128] Figure 4a illustrates in detail certain steps of an embodiment of the method 400 according to the fourth aspect of the invention, the functions «(f) and / 7(z) being in this case the identity functions.

[0129] According to the embodiment illustrated in Figure 4a, the starting list <l>is obtained from the plaintext list L by calculating a homomorphic ciphertext of type TRLWE ^^qLjX^ = TRLWE (Lo + Lix + L2X2+ ... + LiX'+ ... L^X^1)-

[0130] The homomorphic encrypted element is calculated according to the formula TLWE(jj) and the homomorphic encrypted index according to the formula TRGSW^X'1^- These last two elements are not shown in Figure 4a. In the case illustrated in Figure 4a, the function a(i) is chosen to be equal to a(i) = i.

[0131] This choice of encryption techniques makes it possible to calculate the homomorphic modular product < z > S <l>as a cipher of a polynomial: [0!32] TRLWE ( X^E^^LjX^ = TRLWE (L0X~!+ LiX-'+1 + ... + LiX'1+'+ • • ■ L^X^) = = TRLWE (£^+ X~i+i + ... +L{+ ... L^X^)

[0133] The element Lt to be replaced in the list L can for example be extracted as co zero efficient of the homomorphic encrypted polynomial obtained by calculating the homomorphic modular product G] < L> .

[0134] Step 405 of obtaining the homomorphic encrypted list<L' > is carried out, according to the embodiment illustrated in figure 4b, by calculating the homomorphic cipher TRLWE ((fi - L / )X1^® <l>which can be expressed as follows:

[0135] TRLWE (( / / - L^X + L} = TRLWE (( / j - L^X1 + = TRLWE + + L2X2 + ...+fi X+ ■ ■ • L^x^)

[0136] The last equation shows that the element has been replaced in the new homomorphic cipher by the element P.

[0137] According to this embodiment, step 405 comprises the conversion of TLWE(fi - L,) to TRLWE(ji - L:)- Indeed P and belonging to the torus T, the homomorphic cipher of their difference is a TLWE type cipher. The conversion of a TLWE type cipher into TRLWE is carried out using primitives known in homomorphic cryptography.

[0138] It is important to note that during step 405 of the method 400 according to the second aspect of the invention, the quantity TRLWE [(fi - L-^X^^ must be evaluated, while the homomorphic cipher of the index is in the form of a homomorphic cipher of X^, TRGSWfr^).

[0139] According to one embodiment of the method 400, the quantity TRLWE [ (fi - L-^X^^ Can then be obtained in the following way: Calculate a homomorphic cipher of the quantity fi - L^ according to the formula TRLWE(fi - L^ ; Calculate the homomorphic modular product El < fj - L^ according to the formula TRLWE^fi - L^C^ and • Obtain, from the quantity TRLWE - L^X^^ 'a quantity ((p -

[0140] If the function ^(z) is of the type ^(0 = À i, À being prime with M, M being the order of the cyclotomic polynomial, the step of obtaining the quantity TRLWE((li - cst achieved by applying an automorphism.

[0141] Here, automorphism is understood to mean a primitive known in homomorphic cryptography, the definition of which is as follows:

[0142] If a — TRLWE(Ô(Xy) and u is a prime integer with N, the automorphism Aut performs the following operation AuKa, u) = TRLWE^X1^).

[0143] [Fig.5] illustrates an embodiment of a cryptographic system 500 for manipulating a homomorphic encrypted list according to one aspect of the invention.

[0144] The cryptographic system 500 comprises a cryptographic processing server for extracting a homomorphic encrypted element from a homomorphic encrypted list 501. The cryptographic server 501 comprises a communication module 502 and a calculation module 503. The calculation module 502 is configured to receive, from an entity external to the server, a homomorphic encrypted index. .

[0145] The calculation module 503 is configured to extract, from a homomorphic encrypted list, a homomorphic encrypted element < L, > associated with the homomorphic encrypted index in accordance with the method 100 according to the first aspect of the invention.

[0146] The cryptographic system 500 further comprises a client 504 configured to encrypt the index i in the form of a homomorphic encrypted index , for example in the form of a homomorphic encrypted monomial and to communicate the homomorphic encrypted index to the server via a communication channel 504c.

[0147] According to one embodiment of the cryptographic system 500, the client 504 is configured to calculate the ciphertext of the index in the form TRGSW(X^''^ ■

[0148] According to one embodiment of the cryptographic system 500, the server 501 is configured to implement the method 400 of inserting a homomorphic encrypted element into a homomorphic encrypted list. The client 504 is then configured to encrypt the element p so as to obtain a homomorphic encrypted element SR > . The client 504 is further configured to transmit the homomorphic encrypted element < / 7 > to the server 501 via a communication channel 504c.

[0149] Description of the procedure for refreshing a homomorphic cipher

[0150] When two encrypted messages are added together, an encrypted message is obtained, which is an encrypted version of the sum of the two initial unencrypted messages, the noise component of which is higher than for the two initial encrypted messages.

[0151] Thus, to prevent the noise term from increasing and growing during data processing, a refresh procedure, generally called "bootstrapping", is repeatedly performed. This procedure produces a refreshed version of c, i.e., an encrypted message c' which is also decrypted as q (when decrypted using s), but whose noise component is smaller than that of c.

[0152] The "bootstrapping" procedure usually includes a homomorphic evaluation of the quantity with:

[0153] v(X) is a functional refresh polynomial of degree less than or equal to Nl whose coefficients are chosen according to the characteristics of the space of messages and a target function;

[0154] and a is the integer closest to 2N(ba.s):

[0155] [ 2N(b-as)]

[0156] Here, homomorphic evaluation is understood to mean a calculation carried out using encrypted quantities, without prior decryption (without knowing the key s). Here, target function is understood to mean a mathematical function applied to the encrypted message at the same time as the refresh. In the case of a simple refresh, the target function is the identity function.

[0157] For a suitably chosen polynomial v( X), the constant term of Xa.v ( X ) mod ( XN + 1 ), namely coef0 ( X".v ( X ) ), is a refreshed version of c, i.e. an encrypted version of p with a limited noise component e' (generally smaller than the noise component of c, when c comes from previous - homomorphic - data processing operations; in any case, e' is small enough to allow decryption of c', with a low error rate).

[0158] In a known manner, the homomorphic calculation of the quantity coef ( Xav ( X ) ) = X^.v ( X ) mod ( XN + 1 ) can be decomposed into a calculation of a sequence of modular products given by: X".y(X) ... (X^'.(xAv(X) ))...)

[0159] Where a „ b-^k=[âksk « [ 2N(ba.s)] l and ak- [ •

[0160] Where the sk are the n components of the vector s. In the above equation, when calculated homomorphically, each product is a modular product: the term on the left, for example x-* or belongs to Z^[X] =Z[X] / (X^+ the term on the right, for example v(X) or ^xAv(X)}, belongs to TN[X]. Here we define TN[X] = T[X] / (XN+1). Such a product is similar to the product yp;, y being an integer and p belonging to T (except that we are working on polynomial fields, instead of number fields).

[0161] The homomorphic computation of coef(Xa.v(X) ) is not immediate because of the presence of the secret key s, which is not known. However, it is known that a modular product such as yp; or Xfv(X) can be computed homomorphically in de-_ c is the version ciphertext of the message p,. The quantity (^) is the "TRGSW" ciphertext of z (the acronym TRGSW comes from the English "Gentry, Sahai, Waters Torus Ring en- finishing the exterior product encryption”, adapted from an encryption method that was proposed in the article “Homomorphic encryption from learning with errors: Conceptually-simpler, asymp-totically-faster, attribute-based”, by C. Gentry, A. Sahai, and B. Waters, InCrypto' 13, 2013).

[0162] Furthermore, in a known manner, it is possible to calculate the product (X ) El ) without knowing the components sk, k = 1.. .n of the secret key and therefore without knowing the secret key s.

[0163] Indeed, as the components sk, k = 1.. .n each belong to B={0,l} (ie: are each binary), the quantity xa^k is equal to ^X°k - 1)^+ 10^ is encrypted as

[0164] It follows that an encrypted version of Xa.v(X )mod( XN + 1 ) can be computed without having access to the secret key s by using the encrypted version (¾) of the components sk. These encrypted versions of the components of s are sometimes called Bootstrap keys BK / t = X (¾) Bootstrap key " in English). Bootstrap keys (usually public) are encrypted versions of the components sk of the secret key s encrypted using another key s'.

[0165] x ,( y) is defined as being equal to Z + yH# with:

[0166] \, where Zj, j=l.. .1(K+1), are 1(K+1 ) encrypted version of 0, the value Z = ■ \Zl(K+ùl null 0 being encrypted with s', 1 being a given positive integer; and

[0167] Hb is a matrix whose dimension is ( K 4-1 ) X (K + 1) x / and whose coefficients belong to the torus T, Hg being equal to:

[0168]

[0169] B being an integer greater than or equal to 2.

[0170] The external product C El c, between: • An encrypted message c = cp (m)' ce T"+f- corresponding to a message p belonging to the torus TN[X] and • The encrypted version C = X$( V ) of a polynomial with integer coefficients y, C e M (T^[X]),

[0171] is calculated according to the method detailed below.

[0172] The K+l components Cj, j=l..K+l of the encrypted message c = (p ( / r) are in some

[0173]

[0174]

[0175]

[0176]

[0177]

[0178]

[0179]

[0180]

[0181]

[0182] sort of decomposed using a base B system (like the one used to calculate *5) cj ~ mod (l),0<|t"| <B-l Then it is possible to calculate CSc = Ew(c)C in which c)C is the row-column matrix product and is a matrix of dimension (n+l)xl whose form is as follows: ™ ( «Eu(%)> * - > ^4 CW ) With The result C □ c belongs to T"+1 and is an encrypted version of yp In other words, by decrypting this quantity with the key s' we find yp This calculation method can be applied to any message belonging to the torus T. Using the BK keys; introduced above, we obtain for the homomorphic calculation of coef0(X".v(X)), namely tp^X^^X) ) the following equation: El El | ~ 1Xxy(1¾) -f .¾ El The above equation therefore allows refreshing or bootstrapping the encrypted message without needing to know the encryption key. < / l> < / l> < / l> < / l> < / l> < / l> < / l> < / l> < / l> < / ab> < / lj> < / l>

Claims

Claims

1. Method for obtaining (100) a homomorphic encrypted element < > of a homomorphic encrypted list <l>, the homomorphic cipher element < Lj > being associated with an index i, i being between 0 and Nl, the elements of the list L belonging to a torus T, the list L and the index i being ciphered using the same key, said method comprising the following steps: - Obtaining a homomorphic cipher < Q(X) > (101) of a polynomial Q(X), Q(X) being an aggregation of the elements Lj of the list L , j being between 0 and Nl, each coefficient of the polynomial Q(X) being a linear combination of elements of the list L, Q(X) belonging to a quotient space T [X] / (py ( X ), T[X] being a space of polynomials of degree Nl with coefficients with values ​​in the torus T and ( X) being a cyclotomic polynomial of order M; - Obtaining a homomorphic cipher<P(X)> (102) of a monomial p^x) = X?3 being a function of the index i associated with the element < Lj > to be obtained, P(X) belonging to a quotient space Z [ X ] / ( X ), Z [ X ] being a set of polynomials with coefficients in the integers;- Determine a homomorphic encrypted polynomial < C(X) > (103) as a homomorphic modular product between<P(X)> And<Q(X)> ; - Extract the coefficient k (104) from the homomorphic encrypted polynomial < C(X) > , k being determined on the basis of the polynomial Q(X) and the function k used in the monomial P(X), the coefficient k of the homomorphic encrypted polynomial < C(X) > corresponding to the homomorphic encrypted element < L, > to be obtained.;

2. Method for obtaining (100) a homomorphic encrypted element < Lj > of a homomorphic encrypted list <l>according to the preceding claim in which - each coefficient of the polynomial Q(X) is a linear combination obtained according to the following formula f „ ~ VP ju with0 <p< f-2,0< / <^--l, et LP&+1- Lj=^+i 1 - the coefficient of the polynomial < C(X) > corresponding to the homomorphic encrypted element <lj>to be extracted is the coefficient k = 0, y being equal to M - i.

3. Method for obtaining (100) a homomorphic encrypted element < Lj > of a homomorphic encrypted list <l>according to claim 1 in which: • The homomorphic encrypted polynomial < Q > is obtained from the list L comprising the elements L / , j being an integer between 0 and N -1, the homomorphic encrypted polynomial < Q > being in the form of a homomorphic cipher of ti), a(j) being a function with values ​​in = QLjA the set of integers between 0 and Nl and and M = 2"; • The homomorphic encrypted monomial is obtained from the index / , being in the form of a homomorphic cipher of being a function with values ​​in the set of integers between 0 and Nl; • The homomorphic cipher polynomial < C(X) > is obtained according to the formula<c(x)> =<p(x|> q<q(x)> = • The coefficient k of the polynomial < C(X) > to be extracted is given by / c = a(i)-0^)-

4. Method according to the preceding claim in which: • The homomorphic encrypted polynomial < Q > is determined according to the following formula <q> = TRLWjX^V • The homomorphic encrypted monomial is determined according to the following formula< / q> _ TRGSW(X

5. A method according to claim 3 or claim 4 wherein the functions a(i) and P(i) are the identity function so as to have ali) = i and — i and the coefficient k of the polynomial < C > to be extracted is the co- efficient k = 0.

6. A computer program comprising instructions executable by a processor and designed to implement a method according to any one of claims 1 to 5 when these instructions are executed by said processor.

7. Method of inserting (400) a homomorphic encrypted element < > into a homomorphic encrypted list <l>so as to obtain a modified homomorphic encrypted list < L' > , in which: - The homomorphic encrypted element is obtained by homomorphic encryption of a plaintext element / 7 belonging to a torus T; - The homomorphic encrypted list <l>is obtained from a plaintext list L comprising the elements Lj, j being an integer between 0 and N -1, N being an integer greater than or equal to 1, the elements Lj belonging to the torus T, the homomorphic encrypted list <l>being in the form of a homomorphic cipher of; - The modified homomorphic cipher list<L'> is a homomorphic cipher of a plaintext list L' comprising the elements = for j & i and = for j — i, / being an integer between 0 and Nl; Said method comprising the following steps: • Receiving (401) the homomorphic cipher element < , the homomorphic cipher list <l>and a homomorphic ciphertext in the form of a homomorphic ciphertext of , <l>and being encrypted using the same key s; • Extract, in accordance with the method according to any one of claims 1 to 5, the element < Lé> (402) from the homomorphic encrypted list <l> ; • Calculate homomorphically the difference d} =< / l> < / l> < / l> < / l> < / l> < / l> © dQ =< / / - L{> (403); • Obtain (404) a homomorphic cipher of the quantity ((a / - l^) ' • Obtain the modified homomorphic cipher list < L'> (405) by homomorphically calculating the sum <(y - l'^> ® <l>■

8. Method for inserting (400) a homomorphic encrypted element < into a homomorphic encrypted list < L > according to the preceding claim in which: • The homomorphic encrypted list is a homomorphic cipher calculated according to the formula y / yy WE^£N 3 L ' • The homomorphic encrypted element < > is calculated according to the formula TLWE(u); • The homomorphic cipher < z > is calculated according to the formula trgsw^xt^}

9. Method for inserting (400) a homomorphic encrypted element into a homomorphic encrypted list < L > according to the preceding claim in which the step (404) of obtaining a homomorphic encrypted element of the quantity comprises: • Calculating a homomorphic encrypted element of the quantity " L, according to the formula TRLWE(p - ; • Calculating the homomorphic modular product EJ < - Lj > according to the formula TREWE^jj - L^X^ ; • Obtain, from the quantity TRLWE((jj - L}X a homomorphic cipher of the quantity in the form of TRLWE^fi -

10. Method of inserting (400) a homomorphic encrypted element into a homomorphic encrypted list <l>according to one of claims 7 to 9 in which the functions a(i) and are the identity function so as to have a(ï) = i and 0(ï) = i.

11. Computer program comprising instructions executable by a processor and designed to implement a method according to one of any of claims 7 to 10 when these instructions are executed by said processor.

12. Cryptographic processing server (501) for processing a homomorphic encrypted list comprising a communication module (502) and a calculation module (503): • The communication module (502) being configured to receive, from an entity external to the server, a homomorphic encrypted index; • The calculation module (503) being configured to extract, from a homomorphic encrypted list < L >, a homomorphic encrypted element < L, > associated with the homomorphic encrypted index' in accordance with the method according to one of claims 1 to 5.

13. Cryptographic processing server (501) for processing a homomorphic encrypted list according to the preceding claim, wherein: - The communication module (502) is further configured to receive a homomorphic encrypted element S p >; - the calculation module (503) is further configured to introduce the homomorphic encrypted element S > into a homomorphic encrypted list < L> in accordance with the method according to one of claims 7 to 10.

14. Client (504) configured to encrypt the index i as a homomorphic encrypted index and / or an element in the form of a homomorphic encrypted element < and to communicate the homomorphic encrypted index <z>and / or the homomorphic encrypted element to a server (501) according to claim 7 or 8 via a communication channel (504c).

15. Cryptographic system (500) for processing a homomorphic encrypted list comprising: - A cryptographic processing server (501) for processing a homomorphic encrypted list according to claim 7 or claim 8; - A client (504) according to claim 9.< / z> < / l> < / l> < / l> < / lj> < / l> < / l>

Images