Cryptographic calculations involving blind rotations

Abstract

Some embodiments are directed to a cryptographic encryption computation method (400). The method involves performing a blind rotation of ciphertext according to a test polynomial. The blind rotation results in an encrypted polynomial product of the test polynomial and a bootstrapping monomial modulo modulo modulo modulo modulo modulo modulo modulo modulo q, where the bootstrapping monomial represents the plaintext values ​​as exponents. The quotient polynomial p(X) is multiplied by an NTT polynomial X that allows for number theoretic transformations modulo modulo q. M Divide -1, for example, q is a power of 2, and p(X)=X N +X N / 2 +1. Blind rotation is made more efficient by using NTT, where the test polynomial is defined such that the polynomial product is programmed to have the desired output value for each plaintext value as fixed coefficients.

Description

[Technical field]

[0001] The subject matter of this disclosure relates to cryptographic encryption computation methods, methods for determining test polynomials, corresponding devices, and computer-readable media. [Background technology]

[0002] Homomorphic encryption allows for cryptographic computations: computations, e.g., circuit evaluations, performed on data encrypted by a party that the party cannot decrypt. For example, input data and computation results may be received and returned in encrypted form. Intermediate data, e.g., the internal state of a computation, may also be in encrypted form.

[0003] Even though the computation result is returned in encrypted form, the output upon decryption is expected to be the same or very close to what it would be if the operation was performed on unencrypted data. Homomorphic encryption can be used for privacy-preserving outsourced storage and computation. It allows data to be encrypted and then outsourced to a cloud environment for processing and / or storage, all while it is encrypted.

[0004] For example, homomorphic encryption may be applied in areas such as healthcare where privacy regulations may make it difficult to share plain data, but computations on encrypted medical data may be permissible. For example, a medical model deployed to, for example, classify medical data may be configured to receive medical data in encrypted form from a third party, for example a hospital. The medical model may, for example, classify the medical data as, for example, normal or abnormal, or as having some particular medical syndrome, disease, or other disorder. Using homomorphic encryption, the medical model may be applied to the medical data received in encrypted form. This means that the party providing the medical model does not have access to the plain medical data that corresponds to the encrypted medical data. A user of the service may decrypt the results of the medical model application.

[0005] In particular, homomorphic encryption techniques exist that, at least in principle, can be used to compute arbitrary functions on encrypted data. Such techniques are called "fully homomorphic encryption" (FHE) techniques.

[0006] Known implementations of FHE use noisy ciphertexts for security reasons. For example, encryption of a data item may involve mapping the data item to a point in a key-dependent lattice, to which noise is added. In particular, many known implementations of FHE use LWE-type ciphertexts, the security of which depends on the strength of the cipher in the Learning With Errors problem. Such LWE-type ciphertexts may include one or more mask values ​​(e.g., values ​​modulo some modulus q, or torus elements), plus noisy body values ​​derived from the mask values ​​and derived from the plaintext using an encryption key. A variant of this is the GLWE-type ciphertext, which uses encrypted polynomials instead of scalar values. Other known implementations of FHE use NTRU-type ciphertexts, for which most of the same considerations apply.

[0007] When a data item has just been encrypted, the noise is low and the encryption is fresh. For example, when the data item is decrypted, the noise at some point in the decryption process is low enough that it can be removed, for example, by rounding. On the other hand, the noise should be high enough to make attacks on the system difficult enough. For example, if there was no noise, many homomorphic encryption schemes could be attacked with linear algebra, or other efficient algorithms, such as lattice reduction algorithms. When a data item is encrypted, homomorphic operations can still be performed, and noise selected to be difficult to attack is added, while decryption is still possible.

[0008] Most homomorphic operations increase the noise inherent in homomorphically encrypted data items. When many such operations are performed, the noise may reach a level such that a unique decryption is no longer possible. It is commonly known to use a technique called bootstrapping to reduce the noise of homomorphically encrypted values. Bootstrapping may use a public key called a bootstrapping key. By using bootstrapping to reduce noise where necessary, it is in principle possible to compute any desired number of homomorphic operations.

[0009] A particular class of fully homomorphic encryption schemes are homomorphic encryption schemes similar to TFHE. Such schemes are described in I. Chillotti et al., "Programmable bootstrapping enables efficient homomorphic inference of deep neural networks," Cyber ​​Security Cryptography and Machine Learning (CSCML 2021), vol. 12716 of Lecture Notes in Computer Science, pp. 1-19, Springer, 2021 (incorporated herein by reference). TFHE-similar schemes are differentiated from other FHE schemes by supporting relatively highly efficient techniques for bootstrapping; in addition, they allow for simultaneously evaluating a function during the bootstrap operation, which is called programmable bootstrapping. Regular bootstrapping corresponds to programmable bootstrapping with an identity function.

[0010] This programmable bootstrapping technique can reduce noise in ciphertexts (e.g., LWE-type ciphertexts) by performing so-called blind rotations.

number

number

number

number

number

number

number

number

[0011] Interestingly, the output of a blind rotation has an amount of noise that is independent of the noise in the input ciphertext. Thus, by performing programmable bootstrapping that includes a blind rotation, the noise in the input ciphertext can be reduced to a fixed amount while simultaneously applying a function to the input ciphertext as much as possible. By performing programmable bootstrapping at the appropriate time, it is possible to perform cryptographic calculations with unlimited multiplication complexity.

[0012] Known programmable bootstrapping, and in particular its blind rotation, has several limitations. First, blind rotations typically require that the most significant bit of the scaled plaintext value be set to 0, i.e., the proportion of plaintext whose values ​​can be programmed is only 1 / 2. Second, known blind rotations require that the most significant bit of the scaled plaintext value be set to 0, i.e., the proportion of plaintext whose values ​​can be programmed is only 1 / 2. Ω and polynomial X N This requires computing a large number of polynomial multiplications modulo +1, where N is a power of 2. Such polynomial multiplications are computationally expensive, and performing blind rotations, and thus programmable bootstrapping, is also relatively computationally expensive. [Prior art documents] [Patent documents]

[0013] [Patent Document 1] European Patent Application Publication No. 21290025 [Non-patent literature]

[0014] [Non-Patent Document 1] I. Chilotti et al., “Programmable bootstrapping enables homomorphic inference of deep neural networks,” Cyber ​​Security Cryptography and Machine Learning (CSCML 2021), vol.12716 of Lecture Notes in efficient Computer Science, pp. 1-19, Springer, 2021. [Non-Patent Document 2] J. von zur Gathen and J. Gerhard, "Modern Computer Algebra", Cambridge University Press, 3rd edition, 2013, Chapter 8 [Non-Patent Document 3] DJ Bernstein, "Multidigit multiplication for mathematicians," Unpublished manuscript, available at https: / / cr.yp.to / papers.html#m3, August 2001. [Non-Patent Document 4] C. Bonte et al., “FINAL:Faster FHE instantiated with NTRU and LWE”, https: / / ia.cr / 2022 / 074 [Non-Patent Document 5] K. Kluczniak, “NTRU-ν-um:Secure Fully Homomorphic Encryption from NTRU with Small Modulus”, https: / / ia.cr / 2022 / 089 [Non-Patent Document 6] R. Rothblum, "Homomorphic encryption: From private-key to public-key", Theory of Cryptography (TCC 2011), Lecture Notes in Computer Science vol. 6597, pp. 219-234, Springer, 2011. [Non-Patent Document 7] M. Albrecht et al., “On the concrete hardness of Learning with Errors,” Journal of Mathematical Cryptology, 9(3):169-203, 2015. [Non-Patent Document 8] I. Chillotti et al., "CONCRETE: Concrete Operates on Ciphertexts Rapidly by Extending TfhE," available at https: / / homomorphicencryption.org / wp-content / uploads / 2020 / 12 / wahc20_demo_damien.pdf. [Non-Patent Document 9] H. Nussbaumer, "Fast polynomial transform algorithms for digital convolution," IEEE Transactions on Acoustics, Speech, and Signal Processing, 28(2):205-215, 1980. Summary of the Invention [Means for solving the problem]

[0015] According to one aspect of the invention, there is provided a cryptographic encryption computation method, as defined by the claims. According to a further aspect of the invention, there is provided a method for determining a test polynomial for use in such an encryption computation method, as defined by the claims. According to a further aspect, there is provided a device corresponding to these computer-implemented methods, as defined by the claims. According to another aspect, there is provided a computer-readable medium, as defined by the claims.

[0016] The encryption computation may include performing a blind rotation of a ciphertext, e.g., an LWE-type ciphertext, e.g., as part of programmable bootstrapping. The ciphertext may be a combination of a plaintext,

number

number

number

number

number

[0017] A blind rotation may involve computing several polynomial products in a polynomial ring. In the prior art, this polynomial ring is defined as a polynomial product of a modulus q and a quotient polynomial X. N Ring modulo +1

number

[0018] A technique known per se for performing efficient multiplication in polynomial rings is the number-theoretic transform (NTT). To perform polynomial multiplication using NTT, a polynomial may be represented in a so-called Fourier domain representation of NTT. Typically, a Fourier domain representation of a polynomial includes several respective evaluations of the polynomial at several respective evaluation points. When in the Fourier domain representation, the polynomials may be efficiently multiplied, for example by pointwise multiplication of the evaluations. Furthermore, using NTT, it is possible to efficiently compute the Fourier domain representation of a polynomial from its coefficient representation (by applying the number-theoretic transform itself) and the coefficient representation from the Fourier domain representation (using the inverse number-theoretic transform). Various number-theoretic transformations are known per se and are disclosed, for example, in J. von zur Gathen and J. Gerhard, "Modern Computer Algebra", Cambridge University Press, 3rd Edition, 2013, Chapter 8 (in so far as the description of DFT is concerned, it is incorporated herein by reference) (for a quotient polynomial X, in its standard form, with n|q-1, n -1 and a prime power modulus q), as well as the Schonhage and Nussbaumer algorithms disclosed, for example, in DJ Berstein, "Multidigit multiplication for mathematicians", Unpublished manuscript, available at https: / / cr.yp.to / papers.html#m3, August 2001 (in so far as the description of the Schonhage and Nussbaumer algorithms is concerned, the algorithms are incorporated herein by reference).

[0019] Thus, performing polynomial multiplication "using a number theoretic transform" may generally refer to performing polynomial multiplication in the Fourier domain of a number theoretic transform, optionally in combination with converting from this Fourier domain representation to a polynomial and from the polynomial to a Fourier domain representation using NTT and / or vice versa.

[0020] Unfortunately, the prior art blind rotation itself is not made more efficient by applying number theoretic transformations. For efficiency reasons, the prior art Ω , for example, q=2 32 or q=2 64 At the same time, the quotient polynomial X N +1 is used because this is k =-X k+N holds in the polynomial ring, which is necessary for the blind rotation of the prior art to work. However, with these parameters it is not possible to apply number theoretic transformations, because this means that N +1 is the polynomial X M This is because it requires divisibility by −1, where M is relatively prime to q. With the parameters used in the prior art, both N and q are powers of 2, so no multiple of N can be relatively prime to q.

[0021] Furthermore, using the prior art, it is not possible to fully benefit from the improved performance offered by number theoretic transformations by simply changing the parameters of the polynomial ring used. k =-X k+N From the relationship, the quotient polynomial X N +1 is required. Modulus q=2 Ω allows efficient modular arithmetic.

[0022] Interestingly, the inventors have discovered a way to do blind rotations that are compatible with number theoretic transformations. They use X to make multiplication with a test polynomial work. k =-X k+NInstead, it is possible to define a test polynomial such that, given a modulus and a quotient polynomial, multiplication of the test polynomial with a bootstrapping monomial for a plaintext value has as fixed coefficients the desired output value for that plaintext value. In such cases, it is no longer the case that each coefficient of the test polynomial corresponds to a respective desired output value, as was the case in the prior art; for example, the test polynomial may be

number

[0023] By using this improved test polynomial, it is possible to perform blind rotations in the polynomial ring to which the number-theoretic transformation is applied. In particular, the polynomial ring is expanded by a modulus q, which may be, for example, a power of 2, and by a polynomial ... X N +1, where the quotient polynomial can be divisible by an NTT polynomial, i.e., a polynomial that allows number theoretic transformations modulo q. Typically, this is the case when the NTT polynomial is divisible by X. M −1, meaning that M is relatively prime to q. Given such a modulus and such a quotient polynomial, polynomial multiplication modulo the quotient polynomial can be implemented as polynomial multiplication in the Fourier domain of number theoretic transforms, e.g., polynomial multiplication modulo the NTT polynomial. Indeed, computing a polynomial multiplication modulo the NTT polynomial and reducing the result modulo the quotient polynomial gives the same result as doing a multiplication modulo the quotient polynomial, e.g., a(X)b(X) mod p(X)=(a(X)b(X) mod (X M −1) mod p(X).

[0024] Thus, the blind rotation may be performed modulo the modulus q and modulo the quotient polynomial p(X) that divides the NTT polynomial, and accordingly the polynomial multiplication of the blind rotation may be implemented using number-theoretic transformations. In this way, the efficiency of the blind rotation is improved compared to known blind rotations. Furthermore, because polynomial multiplication modulo the modulus and quotient polynomial may occur in other operations of cryptographic computations as well, for example in key switching, which may optionally be performed as part of programmable bootstrapping, these other operations may also use number-theoretic transformations and may be made more efficient thereby.

[0025] In an embodiment, the modulus is a power of 2, e.g., the modulus is 2 32 , 2 64 , or 2 128 Therefore, the calculation is

number

[0026] In an embodiment, the NTT polynomial is X for an integer M. MM may be a power of 2 or a product of powers of 2 and / or powers of 3. For such values ​​of M, efficient number theoretic transformations are known. The quotient polynomial p(X) is N +1, N may not be equal to M / 2. In this case, X k =-X k+N does not hold, NTT can still be used, advantageously by using the test polynomials described herein. For example, the quotient polynomial p(X) can be expressed as N It may be a cyclotomic polynomial not equal to +1, but it is also possible to use a quotient polynomial not equal to a cyclotomic polynomial.

[0027] In an embodiment, the degree N of the quotient polynomial is strictly greater than half the degree M of the NTT polynomial. For example, the quotient polynomial is N +X N / 2 +1 or X N -X N / 2 +1, and the NTT polynomial is X for M=3N / 2. M -1. This is particularly advantageous as it allows blind rotations, and consequently also the programmable bootstrapping of which blind rotations can be a part, to work for a wider range of plaintext values.

[0028] Specifically, the ciphertext to which the blind rotation is applied is typically defined modulo the degree M of the NTT polynomial, e.g., the plaintext can take M possible values. For example, the ciphertext can be obtained by a blind rotation in which the input ciphertext is scaled to the degree M of the NTT polynomial. The blind rotation can be able to provide a desired output value for N out of these M possible values. This is because the blind rotation is based on polynomial multiplication modulo the quotient polynomial, which has degree N. For example, in the prior art, with M=2N, the blind rotation typically assumes that the most significant bit of the input plaintext is not set.

[0029] By choosing a degree N strictly greater than M / 2, a fraction of plaintexts greater than one in two can be programmed by blind rotation. For example, if the quotient polynomial X N ±X N / 2 +1 (e.g., N is 2×(power of 3) or 4×(power of 3)) allows the fraction of programmable ciphertext to be increased from one-half to two-thirds. Thus, blind rotation and programmable bootstrapping can work for a wider range of input ciphertexts. For example, additional operations required to ensure that the most significant bit of the input plaintext is not set in the encryption computation may be avoided, making the encryption computation more efficient.

[0030] In an embodiment, the degree of the NTT polynomial is a product of powers of 2 and / or powers of 3. In such cases, number theoretic transformations are particularly efficient and it becomes particularly advantageous to use number theoretic transformations. For example, the degree of the NTT polynomial may be a power of 2. This is particularly efficient. The degree of the NTT polynomial may also be a power of 3, which means that the degree of the quotient polynomial p(X) is set to two-thirds the degree of the NTT polynomial, e.g., p(X)=X N +X N / 2 +1 is NTT polynomial X 3N / 2 Advantageously, it can divide by −1, allowing a large percentage of the plaintext value to be programmed.

[0031] In an embodiment, the modulus q is a prime number, and the degree M of the NTT polynomial divides the modulus minus 1. In this case, the field of integers modulo q contains a primitive M-th root of 1, allowing particularly efficient NTT techniques such as the discrete Fourier transform to be used. Depending on the modulus q, modular arithmetic may also be implemented efficiently, e.g., 2 31 <q=10·3 18 +1<2 32 OR 2 63 <q=4·3 39 +1<2 64Calculations based on the law may be performed using 32-bit, 64-bit, and / or 128-bit operations relatively efficiently, which is convenient because they conform to a common data type.

[0032] In an embodiment, the quotient polynomial is X N + X N / 2 + 1 or X N - X N / 2 + 1. As will be explained elsewhere, this choice of quotient polynomial is advantageous because it allows a relatively large percentage of plaintext values to be programmed. Further, for this choice of quotient polynomial, it is possible to determine the test polynomial for a given set of desired output values particularly efficiently. In particular, as described herein, each coefficient of the test polynomial can be calculated from at most two desired output values, particularly as a sum where two desired output values may cancel each other out. Further, interestingly, the desired output values can be efficiently programmed at any fixed coefficient, for example, the coefficient can be different from the leading coefficient and the constant coefficient. This can be beneficial for further operations in the encrypted calculation where further operations are applied to the encrypted polynomial resulting from the blind rotation before extracting the coefficients.

[0033] The test polynomial can be determined based on a lookup table that defines the desired output values for each plaintext value. The inventors have noticed that given the modulus, the quotient polynomial p(X), and the NTT polynomial, it is generally possible to determine a test polynomial suitable for a given lookup table. In particular, the inventors have noticed that for a quotient polynomial p(X) that divides X M - 1 for M, the inverse of the polynomial X, X -1 exists in R[X] / (p(X)) and can be represented as a polynomial of degree < N with coefficients in R. This means that for a given polynomial

Number

Number

[0034] In an embodiment, the fixed coefficients are constant or leading coefficients. In this case, it is possible to determine a test polynomial particularly efficiently for a given look-up table by calculating the respective coefficients of the test polynomial from the respective desired output values, e.g. the coefficients of the test polynomial are

number

number

[0035] In an embodiment, the ciphertext to which the blind rotation is applied may be an LWE ciphertext. For example, the blind rotation may be part of an encryption computation being performed on the LWE ciphertext (e.g., not including the NTRU ciphertext). Or, the LWE ciphertext may be obtained by transformation from the NTRU ciphertext, e.g., as part of an encryption computation being performed on the NTRU ciphertext. It is also possible to apply the blind rotation directly to the NTRU ciphertext, without transformation to LWE. More generally, the ciphertext may be a lattice ciphertext, whose security depends on the strength of the cipher for the lattice problem, of which LWE and NTRU are two examples.

[0036] In an embodiment, performing the blind rotation may include computing one or more external products of the ciphertext with a gadget ciphertext. Such a gadget ciphertext may include multiple constituent ciphertexts defined based on a gadget matrix. In an LWE / GLWE setting, the gadget ciphertext may be a GGSW-type ciphertext. In an NTRU setting, the gadget encryption is also referred to as NGS encryption or gadget NTRU. The gadget ciphertext may be included in a bootstrapping key and may represent digits, such as bits of a decryption key that decrypts the ciphertext to which the blind rotation is applied. Computing such external products typically involves a significant amount of polynomial multiplications modulo the modulus and quotient polynomials. By using the provided techniques, these polynomial multiplications may be performed using number theoretic transformations, thereby leading to significant efficiency improvements.

[0037] In an embodiment, the encryption computation method may include performing programmable bootstrapping. Modulus switching may be applied to the input ciphertext to obtain a further ciphertext, for example an LWE-type ciphertext. This may involve scaling the input ciphertext to the degree of the NTT polynomial, as known per se. A blind rotation may be performed on this further ciphertext. The blind rotation may be followed by a sample extraction, in which a fixed modulus encryption is extracted from the polynomial product computed by the blind rotation. Optionally, key switching may be performed after the sample extraction. In particular, the encryption computation method may be a "TFHE-like" encryption computation method, of which programmable bootstrapping is a core operation. Improving the blind rotation this entails leads to important efficiency improvements in this setting.

[0038] In general, additional operations are possible between each step of programmable bootstrapping, such as, for example, several modulus switched ciphertexts may be added together; the outputs of several blind rotations may be added before sampling; and the like. Various such operations may include, for example, polynomial multiplications modulo the quotient polynomial or other polynomials that divide the NTT polynomial. In particular, the output of the blind rotation may include a polynomial modulo the quotient polynomial to which an additional polynomial multiplication may be applied before sampling. In such cases, using a blind rotation as described herein also allows NTT to be used for such additional polynomial multiplications, further improving the efficiency of programmable bootstrapping.

[0039] In an embodiment, when performing blind rotation using a number-theoretic transformation, polynomials of the bootstrapping key may be used that are obtained in the Fourier domain representation of the number-theoretic transformation rather than the coefficient representation. The blind rotation then does not involve converting these polynomials of the bootstrapping key from the coefficient representation to the Fourier domain representation. For example, the polynomials may be received from another party or accessed from a storage of the Fourier domain representation. This makes the blind rotation particularly efficient since the conversion can be done in advance. Since the bootstrapping key is typically generated once and then used many times, determining the Fourier domain representation of the bootstrapping key is much more efficient to determine when generating the bootstrapping key than when using the bootstrapping key.

[0040] The encryption computation may be a "TFHE-like" encryption computation. Such a TFHE-like encryption computation is characterized by the use of a programmable bootstrapping operation, where an encrypted polynomial product is computed from a bootstrapping monomial and a test polynomial that expresses the plaintext value as an exponent. In other words, programmable bootstrapping may involve evaluating the decryption of a ciphertext at the exponent of the encrypted monomial. This evaluation may be computed using an outer product of a bootstrapping key with a gadget ciphertext, such as, for example, a GGSW-type ciphertext, an NGS ciphertext, or a gadget NTRU ciphertext. Such a gadget ciphertext may include multiple constituent ciphertexts (e.g., GLWE-like ciphertexts in the case of GGSW), and the computation of the outer product may involve multiplying each of the constituent ciphertexts of the gadget ciphertext with a respective polynomial. This programmable bootstrapping is performed more efficiently and / or more flexibly with respect to the accepted input plaintexts, as described herein.

[0041] The techniques provided for computational improvement on encrypted data may be applied to a wide range of practical applications. Such practical applications include encrypted evaluation of software programs without having access to the plain data. For example, medical diagnostic software may be evaluated against medical data without actually having access to said medical data. The medical data may include medical images. The medical images may include, for example, multi-dimensional image data, for example, two-dimensional (2D), three-dimensional (3D), or four-dimensional (4D) images acquired by various acquisition modalities, such as, but not limited to, standard X-ray imaging, computed tomography (CT), magnetic resonance imaging (MRI), ultrasound (US), positron emission tomography (PET), single photon emission computed tomography (SPECT), and nuclear medicine (NM).

[0042] In embodiments, the techniques provided may be used to evaluate neural networks against encrypted inputs. Parties evaluating the neural network may or may not have clear-text access to the neural network's trained parameters, such as, for example, weights and biases. In general, the techniques provided herein, such as improved polynomial multiplication, programmable bootstrapping, and outer products, improve the efficiency of neural network evaluation and / or reduce storage and transmission requirements for the ciphertext or key material used.

[0043] The method embodiments may be performed on a computer as a computer-implemented method, or in dedicated hardware, or a combination of both. Executable code for the method embodiments may be stored on a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, offline software, etc. Preferably, the computer program product includes non-transitory program code stored on a computer-readable medium for performing the method embodiments when said program product is executed on a computer.

[0044] In an embodiment, the computer program comprises computer program code configured to perform all or part of the steps of the method embodiments when the computer program is run on a computer. Preferably, the computer program is embodied on a computer readable medium.

[0045] Further details, aspects and embodiments are described, by way of example only, with reference to the drawings in which elements are illustrated for simplicity and clarity and are not necessarily drawn to scale, and in which elements corresponding to elements already described may have the same reference numerals. [Brief description of the drawings]

[0046] [Figure 1a] FIG. 1 illustrates a schematic diagram of an example embodiment of a cryptographic computing device. [Figure 1b] FIG. 1 illustrates a schematic example of an embodiment of a device for determining a test polynomial for use in cryptographic calculations; [Figure 1c] FIG. 1 is a schematic diagram illustrating an example embodiment of a cryptographic computing system. [Diagram 2] FIG. 2 illustrates a schematic diagram of an example embodiment of a programmable bootstrapping unit; [Diagram 3] FIG. 2 illustrates a schematic diagram of an example embodiment of an accumulation unit; [Figure 4] FIG. 2 is a schematic diagram illustrating an example of an embodiment of a cryptographic computation method; [Diagram 5] FIG. 2 illustrates generally an example embodiment of a method for determining a test polynomial for use in a cryptographic calculation; [Figure 6] 1 is a schematic diagram of a computer readable medium having a writeable portion containing a computer program according to an embodiment; [Figure 7] FIG. 2 is a schematic diagram illustrating a representation of a processor system according to an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0047] While the subject matter of the present disclosure is susceptible of embodiment in many different forms, one or more specific embodiments have been shown in the drawings and are described in detail herein, with the understanding that the disclosure is to be considered as an exemplification of the principles of the subject matter of the present disclosure and is not intended to limit it to the specific embodiments shown and described.

[0048] In the following, for the sake of understanding, elements of the embodiments are described in terms of operations, however it will be apparent that each element is configured to perform the functions that are described as being performed by it.

[0049] Moreover, the subject matter of the present disclosure is not limited to the embodiments only, but also includes any other combination of features described herein or recited in mutually different dependent claims.

[0050] In general, various embodiments relate to Learning With Errors (LWE)-type ciphertext. In particular, programmable bootstrapping may take as input an LWE-type input ciphertext that encrypts a plaintext value and output an LWE-type output ciphertext that encrypts a desired output value for the plaintext. The LWE-type ciphertext may include one or more mask values ​​and a body value derived from the mask values ​​and the plaintext value.

[0051] The LWE-based input and output ciphertexts may be defined modulo q. As disclosed in "Programmable Bootstrapping Enables Efficient Homomorphic Inference of Deep Neural Networks," the values ​​of the LWE-based ciphertexts are expressed as a function of the discretized torus.

number

number

number

number

number

number

number

number

[0052] It should be noted that the LWE type ciphertext to which the blind rotation described herein is applied is typically defined modulo a modulus M equal to the degree of the NTT polynomial used in the blind rotation. For example, this ciphertext may be obtained by performing modulus switching to scale the LWE type input ciphertext modulo a further modulus q (e.g., corresponding to the modulus of the coefficients of the polynomial used in the blind rotation) to this modulus M.

[0053] Various embodiments also relate to Generalized Learning With Error (GLWE)-type ciphertexts. GLWE-type ciphertexts may include one or more mask polynomials and a body polynomial derived from the mask polynomials and the plaintext polynomials. GLWE-type ciphertexts may be defined modulo a modulus q and a quotient polynomial p(X) of degree greater than 1, for example. For example,

number

number

number

number

number

number

[0054] Instead of using LWE / GLWE type ciphertexts, it is also possible to use different lattice encryptions. For example, the ciphertext to which the blind rotation is applied and / or the encrypted polynomial product resulting therefrom may be an NTRU ciphertext. For example, the NTRU encryption of a message μ may be defined by adding the quotient of a noise polynomial g and a private key polynomial f to the message, e.g.

number

number

[0055] In particular, NTRU may be used in combination with the techniques provided by using a blind rotation that results in an NTRU-encrypted polynomial product of a test polynomial and a bootstrapping monomial, and / or by applying a blind rotation to the NTRU ciphertext as input. Examples of suitable NTRU encryption are defined in C. Bonte et al., "FINAL: Faster FHE instantiated with NTRU and LWE", https: / / ia.cr / 2022 / 074; and K. Kluczniak, "NTRU-ν-um: Secure Fully Homomorphic Encryption from NTRU with Small Modulus", https: / / ia.cr / 2022 / 089.

[0056] Various embodiments also relate to gadget ciphertexts. In general, a gadget ciphertext may be defined as a ciphertext that includes multiple constituent ciphertexts that encrypt respective values ​​based on a plaintext, which may be defined based on a gadget matrix. In the case of LWE / GLWE, the gadget ciphertext may be, for example, a GGSW-type ciphertext, as defined in the reference "Programmable bootstrapping enables..." (which is incorporated herein as far as the description of GGSW is concerned). In an NTRU setting, gadget encryption such as the NGS encryption of C. Bonte et al., "FINAL: Faster FHE instantiated with NTRU and LWE", https: / / ia.cr / 2022 / 074 (incorporated herein by reference insofar as the definition of NGS is concerned), or the gadget NTRU encryption of K. Kluczniak, "NTRU-ν-um: Secure Fully Homomorphic Encryption from NTRU with Small Modulus", https: / / ia.cr / 2022 / 089 (incorporated herein by reference insofar as the definition of gadget NTRU is concerned), may be used, for example.

[0057] Although the above example describes (G)LWE / NTRU / ... ciphertexts according to a symmetric encryption scheme (e.g., one private key is used for both encryption and decryption), it is also possible that the ciphertexts used are according to an asymmetric encryption scheme (e.g., different public and private keys are used for encryption and decryption, respectively). For example, the private key may be used as the private key, and the public key contains one or more encryptions of zero. See, for example, R. Rothblum, "Homomorphic encryption: From private-key to public-key", Theory of Cryptography (TCC 2011), vol. 6597, Lecture Notes in Computer Science, pp. 219-234, Springer, 2011 (incorporated herein by reference).

[0058] Various embodiments use number theoretic transformations to perform polynomial multiplication modulo a modulus q and a quotient polynomial p(X) that divides the NTT polynomial. Typically, the NTT polynomial is M -1, the quotient polynomial divides the NTT polynomial, i.e., it is trivial to divide it by equality, i.e., exactly. The modulus q is given by M = -1.

number

number

[0059] For example, the quotient polynomial is X M For any quotient polynomial p(X) that divides -1, a Fourier representation of the polynomial may be defined as a set of evaluations of the polynomial at a set of powers of a primitive M-th root of unity. The Fourier representation may be multiplied by pointwise multiplication of the evaluations at each power of the primitive M-th root of unity. For efficient conversion between the coefficient representation and the Fourier domain representation of the polynomial, it is advantageous if M includes one or more powers of two and / or one or more powers of three, e.g., if M is a power of two or M is a power of three.

[0060] The Fourier representation of a polynomial may involve evaluations at each of the powers of a root of unity, but this is not required. In various cases, it is sufficient to use a subset of the powers, which leads to a more efficient Fourier domain representation. This is especially true when the quotient polynomial is (X M -1) / (X d -1), where M=hd and d=MN (and therefore N=Md=(h-1)d). For example, the quotient polynomial is (X 2d -1) / (X d -1)=(X d +1)=(X N +1), or for h=3 (X 3d -1) / (X d -1)=(X 2d +X d+1)=(X N +X N / 2 +1). In such cases, the Fourier domain representation of the polynomial may be a subset of the powers of a primitive M-th root ω of unity, e.g., the powers ω, ω for h=2. 3 , ..., ω 2d-1 , for h=3, the power (ω,ω 2 ), (ω 4 ,ω 5 ), ..., (ω 3d-2 ,ω 3d-1 ), in order to multiply polynomials, evaluations over only a subset of the powers of this root of unity are sufficient, which leads to more efficient polynomial multiplication. Nevertheless, efficient number theoretic transformations and inverses are possible.

[0061] The described technique involves blind rotation using a bootstrapping key. Cryptographic computation techniques that support such blind rotation may be referred to as "TFHE-like" homomorphic encryption schemes.

[0062] The programmable bootstrapping operations in TFHE-like schemes make them an attractive choice for a wide range of applications. Because bootstrapping is relatively efficient compared to many other FHE schemes, it is more suitable for performing relatively complex calculations, for example, with a depth of at least 10, at least 50, or at least 100 multiplications. In particular, the cryptographic parameters of TFHE-like schemes can be selected based on the required precision and the resulting computational cost, independent of the amount of homomorphic operations and the depth of their circuits. In other FHE schemes, in contrast, bootstrapping can be very inefficient, so in practice these schemes are typically applied in a levelled manner, meaning that the parameters of the schemes are selected according to a given calculation so that it can be performed without the need for bootstrapping. However, such levelled approaches are not suitable for more complex calculations, so in such cases TFHE-like schemes are particularly beneficial.

[0063] For example, a bootstrapping key for a TFHE-like encryption scheme may include n gadget ciphertexts, e.g., GGSW type, encrypting key digits of an LWE private key, typically n being at most 1000 or at most 640, e.g., n=630. A gadget ciphertext may include, for example, l=3 ciphertexts, each including k=1 mask polynomials (e.g., RLWE may be used) and one body polynomial in the case of GLWE. Further example parameters are described throughout. In general, the security of a GLWE-based ciphertext is based on the distribution of the private key and three main parameters: n=kN, where N is the degree of the quotient polynomial, k is the number of random mask polynomials of the ciphertext, n is the length of the private key; q is the modulus; and σ is a statistical parameter of the noise, e.g., its standard deviation. Given these parameters, methods for estimating the degree of security provided are known per se, see for example M. Albrecht et al., "On the concrete hardness of Learning with Errors," Journal of Mathematical Cryptology, 9(3):169-203, 2015, incorporated herein by reference. Similarly, for NTRU-based ciphertexts, which are typically made from a single polynomial, the security is based on the distribution of the secret key and two main parameters: the degree N of the quotient polynomial, and the statistical parameter σ of the noise.

[0064] In embodiments herein, the parameters of the TFHE-like (e.g., LWE / GLWE) ciphertexts used may be selected based on the desired security level and the desired accuracy of operations such as linear combination of ciphertexts and / or application of programmable bootstrapping, i.e., the noise level resulting from applying these operations. Interestingly, in a TFHE setting, the security parameters may be selected independently of the computational complexity, e.g., independently of the multiplication depth of the computation. This is not the case for non-TFHE-like schemes, in which case the security parameters are typically selected to limit or exclude bootstrapping.

[0065] In particular, the LWE-based ciphertext and / or the GLWE-based ciphertext used in the TFHE setting herein may use a relatively small modulus, e.g., at most 32 bits, at most 64 bits, or at most 128 bits. This modulus is typically selected independently of the computation to be performed, e.g., selected according to the desired accuracy and / or efficiency. The parameters N, k, and / or σ may be selected to achieve a desired security level, and may typically also be independent of the computation to be performed. For example, N may be set to at least 512, and / or at most 2048 or 4096, e.g., 1024. For example, in an embodiment, RLWE is used with N at least 512, and / or at most 2048 or 4096, e.g., 1024, k=1. Such values ​​of N are not typically used in non-TFHE-like schemes, as such values ​​would severely limit the computations that can be performed; instead, in non-TFHE-like schemes, q and N are typically both selected based on the desired security level, such that q can be quite large.

[0066] FIG. 1 a illustrates a schematic of an example embodiment of a cryptographic computing device 110 .

[0067] Device 110 may include a processor system 130, storage 140, and a communication interface 150. Storage 140 may include local storage, such as a local hard drive or electronic memory. Storage 140 may include non-local storage, such as cloud storage. In the latter case, storage 140 may include a storage interface to the non-local storage. For example, storage 140 may be for storing LWE-based ciphertext with programmable bootstrapping or blind rotation.

[0068] Storage 140 may also be for storing a bootstrapping key for use in the blind rotation, which may use the bootstrapping key to perform LWE decryption on the exponent of the bootstrapping polynomial. The bootstrapping key may be stored in a Fourier domain representation of the number theoretic transform used in the blind rotation, thereby improving efficiency.

[0069] As an alternative to LWE, for example, NTRU may also be used.

[0070] The device 110 may communicate internally with other devices, external storage, input devices, output devices, and / or one or more sensors via a computer network. The computer network may be the Internet, an intranet, a LAN, a WLAN, etc. The computer network may be the Internet. The device may optionally include a connection interface 150, which is configured to communicate with other devices as needed. For example, the connection interface may include a connector, e.g., a wired connector, e.g., an Ethernet connector, an optical connector, or a wireless connector, e.g., an antenna, e.g., a Wi-Fi, 4G, or 5G antenna. Communications, e.g., internal communications, may use other communication protocols or media, e.g., an internal data bus.

[0071] In device 110, communication interface 150 may be used to transmit or receive digital data. For example, device 110 may be configured to receive or transmit data representing an LWE-type ciphertext, such as an input to or an output of a blind rotation or programmable bootstrapping. Communication interface 150 may also be used to receive data representing a bootstrapping key. The bootstrapping key may be received in a Fourier domain representation of the NTT used in the blind rotation.

[0072] Execution of device 110 may be implemented in a processor system 130, e.g., one or more processor circuits, such as a microprocessor, examples of which are provided herein. Device 110 may include multiple processors, which may be distributed in different locations. For example, device 110 may use cloud computing.

[0073] The processor system 130 may be configured to obtain an LWE-type ciphertext that encrypts a plaintext value, for example, to receive an LWE-type ciphertext by performing an encryption calculation, or to calculate an LWE-type ciphertext. The processor system 130 may be configured to perform a blind rotation of the LWE-type ciphertext according to a test polynomial. The blind rotation may result in an encrypted polynomial product of the test polynomial and a bootstrapping monomial modulo the modulus and modulo the quotient polynomial. The bootstrapping monomial may represent the plaintext value as an exponent. The quotient polynomial may divide an NTT polynomial that allows for a number-theoretic transformation modulo the modulus. The processor subsystem 130 may be configured to perform a polynomial multiplication of the blind rotation using a number-theoretic transformation. The test polynomial may be defined such that the polynomial product has a desired output value for the plaintext value as a fixed coefficient. The processor system 130 may be further configured to output the calculated encrypted polynomial product, for example, for use in an encryption calculation. For example, processor system 130 may calculate an LWE encryption representing the output of the encryption calculation based on the calculated encrypted polynomial product and output the LWE encryption, for example, by storing it on storage 130 and / or transmitting it to another party via communications interface 150.

[0074] As an alternative to LWE, for example, NTRU may also be used.

[0075] Some of the figures show functional units that may be functional units of a processor system. For example, the figures may be used as blueprints for possible functional organization of a processor system. The processor circuitry is not shown separately as a unit in most of the figures. For example, the functional units shown in Figures 2 and 3 (see below) may be implemented in whole or in part in computer instructions stored in a device such as device 110, e.g., in an electronic memory of device 110 and executable by a microprocessor of device 110. In a hybrid embodiment, the functional units are implemented partly in hardware, e.g., as a coprocessor, e.g., as an arithmetic and / or cryptographic coprocessor, and partly in software stored and executed on device 110.

[0076] For example, device 110 may be a device for performing cryptographic computations. The cryptographic computations may use homomorphic encryption. For example, device 110 may be used to perform cryptographic computations, e.g., the device may perform the computations even though the data is received in encrypted form, e.g., from a data provider, and even though device 110 cannot decrypt the data. The computations may involve blind rotations as described herein, e.g., as part of programmable bootstrapping.

[0077] For example, storage 140 may store encrypted data items, e.g., received from one or more data providers or generated as intermediate or final results, e.g., output, of a computation. Typically, most or all data items on which computations of device 110 are performed are encrypted with a key unknown to device 110. That is, device 110 may not be configured to obtain plain data items corresponding to encrypted data items, e.g., those stored in storage 140. The encryption / decryption keys may be available in encrypted form, while the decryption key in the plain form is secret to device 110. For example, the processor system may be configured to perform a sequence of homomorphic encryption operations. The homomorphic encryption operations may include arithmetic operations, such as addition and multiplication, on encrypted values, and may further include one or more blind rotations, e.g., as part of a respective programmable bootstrapping operation.

[0078] Figure 1b shows a schematic example of an embodiment of a device 119 for determining a test polynomial to use in an encryption computation, e.g., a test polynomial used by device 110 of Figure 1a. The encryption computation may involve computing a polynomial product of a bootstrapping monomial and the test polynomial modulo the modulus and a quotient polynomial, where the quotient polynomial divides the NTT polynomial. Device 119 may perform the encryption computation itself, e.g., device 110 of Figure 1a may be combined with device 119 of Figure 1b.

[0079] The device 110 may include a processor system 139, a storage 149, and a communication interface 159. The processor system 139, the storage 149, and the communication interface 159 may be implemented as described for the respective components of FIG. 1a. The storage 149 may be for storing a lookup table that defines a desired output value for each plaintext value. The lookup table may be stored, for example, by storing each output value, each pair of input values, or another representation, for example a symbolic or executable representation, of a function that maps an input to an output.

[0080] The communications interface 159 may be used to receive the lookup table and / or one or more system parameters such as the modulus, quotient polynomial, and NTT polynomial, etc. The communications interface 159 may be used to transmit the calculated test polynomial.

[0081] The processor system 139 may be configured to obtain the modulus, the quotient polynomial, and the NTT polynomial. The processor system 139 may be further configured to calculate a test polynomial such that the polynomial products have respective desired output values ​​as fixed coefficients for respective plaintext values.

[0082] 1c illustrates generally an example embodiment of a cryptographic computation system 100. System 100 is configured to perform cryptographic computations using homomorphic encryption, for example fully homomorphic encryption.

[0083] The system 100 of this example includes a key generation device 111, a data provider device 113, and an encryption computing device 112. The key generation device 111 and the data provider device 113 may be combined into a single device. The device 112 may be configured to receive encrypted data items from the data provider 113. At least one or more data items may be received in encrypted format. One or more further data items may be received in plain format. Computations are performed on the received data items and possibly also on the stored data items. Interestingly, computations may be performed on the encrypted data, but without decrypting that data, e.g., without converting the encrypted data items to data in plain format.

[0084] Device 112 in this example may be based on device 110 of Figure 1a and may include, for example, processor system 130, storage 140, and / or communications interface 150 of Figure 1a. Each device 111, 112, 113 may be based on device 119 of Figure 1b and may include, for example, processor system 139, storage 149, and / or communications interface 159 of Figure 1b, respectively.

[0085] In this example, the device 111 includes a key generation unit 131 implemented, for example, by a processor system of the device 111. The key generation unit 131 is configured to generate a bootstrapping key 151 for use by the cryptographic computing device 112. The bootstrapping key may enable performing a blind rotation as described herein. The device 111 may provide the bootstrapping key 151 to the device 112, for example, by transmitting it over the computer network 150, uploading it to a shared storage, etc. The device 111 may provide a polynomial of the bootstrapping key in a Fourier domain representation of a number theoretic transformation.

[0086] In this example, the device 112 includes an encryption calculation unit 132 implemented, for example, by a processor system of the device 112. The encryption calculation unit 132 may be configured to perform an encryption calculation. The encryption calculation may involve, for example, a blind rotation of an LWE-type ciphertext, for example, as described for the device 110 of FIG. 1a. To perform the blind rotation, the encryption calculation unit 132 may use a bootstrapping key 151 received from the device 111, for example, via the network 150 or retrieved from a shared storage. The blind rotation may use a test polynomial. The test polynomial may be determined from a look-up table by the device 111, the device 112, or the device 113, for example, as described for the device 119 of FIG. 1b. The encryption calculation may include many other operations, as known per se, for example the device 112 may be configured to evaluate an arithmetic circuit, to evaluate a neural network on the encrypted data, etc.

[0087] Although not shown in this figure, the cryptographic computation system 100 may include multiple cryptographic computing devices, for example, two, three, or more than three. The cryptographic computation may be distributed among the multiple cryptographic computing devices. The cryptographic computing devices may typically exchange encrypted intermediate computation results with each other. Each cryptographic multiplication device may be implemented like the cryptographic computing device 112 and may perform multiplication of ciphertext by a polynomial as described herein.

[0088] Homomorphic encryption schemes may be applied in many settings. For example, the encrypting computing device 112 may be operated by a cloud provider. The cloud provider may provide computational and storage services to its clients. By employing homomorphic encryption, the data provider device 113, e.g., a client of the cloud provider, may transmit data in an encrypted form. The cloud provider may still perform the necessary computations and / or the necessary storage, but may not know what corresponds to the plain data. For example, the data provider device 113 may use a type of encryption key that corresponds to the particular homomorphic encryption system used to encrypt the data item. When the computation results are received by the data provider 113 from the encrypting computing device 112, the corresponding decryption key may be used to decrypt the encrypted data item. The encryption key and the decryption key may be, and typically are, the same.

[0089] For example, the cryptographic computing system 100 may be configured to train a machine learning model, such as an image classifier, for example a medical model, even though the cryptographic computing device does not have access to the plain data items. For example, linear regression may be performed on the input data, perhaps without bootstrapping. For example, backpropagation may be performed on the input data, perhaps with bootstrapping. The resulting model parameters may be returned to the entity that owns the decryption key. This allows multiple providers of medical data to pool their data by sending the data to a cloud provider. The cloud provider then returns the model parameters even though the cryptographic computing device does not have access to the plain data. The encryption key may be equal to the decryption key.

[0090] After the model is trained, the encrypted computing system 100 may be used to provide a model for use with, for example, medical data. This may be done using plain model parameters or encrypted model parameters, and in both cases may be done using encrypted data, e.g., encrypted input, intermediate and output data. Using the plain model parameters is usually much more efficient. In both cases, the effect of the system is that computations, such as image classification, e.g., medical image classification, may be done without the computer knowing the plain data items. For example, a mammogram may be evaluated for cancer without the image even being plain in the encryption computing device 112, and without any encryption computing device 112 or cooperation of such devices knowing what the results of the cancer evaluation are. From a privacy perspective, it may be permissible to operate a plain model on encrypted privacy-sensitive data, but not on plain privacy-sensitive data.

[0091] Other applications involve, for example, database services that look up encrypted data in an encrypted database; for example, the calculation may be a comparison between an input item and a database item. For example, multiple calculations may be combined to produce a database index that matches the index. For example, the database may be a genomic database and the input may be a gene sequence. For example, the system 100 may be used for secured control of devices. For example, the device may transmit sensor values ​​to the encrypted computing device 112 and receive encrypted control signals in return, even large-scale devices such as power plants. The control signals are computed from the sensor signals. An attacker of the system may be able to determine the content of the data going into one or more of the encrypted computing devices 112 and the content of the data coming from one or more of the encrypted computing devices 112, and may even be able to access intermediate data of these devices, but that does not help the attacker because the data is encrypted. Since the decryption keys are unknown to these devices, even a complete break of all of the encrypted computing devices 112 of the system 100 would not reveal the data. Computing the control signals may involve mathematical operations such as linear algebra, averaging, matrix multiplication, polynomial evaluation, etc. All of this can be performed together with homomorphic encryption operations.

[0092] For example, a pool of encrypted data items may be maintained in the cryptographic computing system; a subset of these may be received and another subset may be the result of the encrypted computation, e.g., intermediate results. For example, the cryptographic computing device 112 may be configured to apply a homomorphic encryption operation to one, two, or more encrypted data items in the pool, which may be, for example, a collection of input values ​​and / or intermediate values ​​and / or output values. The result may be a new encrypted data item that may be stored in the pool. The pool may be stored in a storage of the cryptographic computing system, which may be a local storage or a distributed storage. In the latter case, it may happen that one or more encrypted data items are represented multiple times in the pool. The encrypted data items may be transmitted, for example, from one computing device to another computing device when their values ​​are needed elsewhere. The pool may be implemented in various ways, for example, as a register file, an array, various data structures, etc.

[0093] The encrypted data items may represent all kinds of data. For example, the encrypted data items may represent numbers that need to be averaged, or are used for linear regression, etc. For example, the encrypted data items may represent an image. For example, each pixel of the image may correspond to one or more encrypted data items. For example, a grayscale pixel may be represented by a gray level, which may then be represented by a single encrypted data item. For example, 256 gray levels may be encoded with a single encrypted data item. For example, a color pixel may be represented as multiple color levels, e.g., RGB levels, which may then be represented by a tuple of encrypted data items. For example, three 256 levels of color may be encoded with three encrypted data items. How many encrypted data items are used to represent any kind of data depends on the capabilities of the homomorphic encryption scheme. For example, a more restrictive homomorphic encryption scheme may only be able to encode one bit per encrypted data item. In that case, one color pixel may require 24 encrypted data items.

[0094] A set of homomorphic encryption operations may be defined for a computation. For example, from the homomorphic encryption operations, a network or circuit of operations that together perform the computation may be constructed, for example, by an external compiler device or the computing device itself. For example, the operations may include Boolean operations. The way in which the homomorphic encryption operations are combined, e.g., which operations are applied to which operands in the pool, determines the computation being performed. For example, a computation may be represented as a list of homomorphic encryption operations on which the operation should be performed, along with an indication of which encrypted data items the operation should be performed on. The network or circuit may indicate to the encryption computing device 112 when to perform blind rotation and / or programmable bootstrapping, and may include test polynomials, or lookup tables from which test polynomials may be calculated as described herein.

[0095] FIG. 2 illustrates a schematic of an example embodiment of a programmable bootstrapping unit 200 .

[0096] n mask values

number

number

number

[0097] Further shown is a modulus switching unit 220. The modulus switching unit may be configured to perform modulus switching on the input ciphertext 210 to obtain the LWE type ciphertext 211. This may involve scaling each value of the input ciphertext 210 to the degree M of the NTT polynomial described below, for example by scaling by a factor M / q and then rounding. Modulus switching may be implemented as disclosed in the reference "Programmable bootstrapping enables...". As a specific example, modulus switching may be implemented by applying modulus switching to the scaled plaintext value

number

number

[0098] An initialization unit 240 and an accumulation unit 260 are also shown. Units 240 and 260 may be configured together to perform a blind rotation of the LWE type ciphertext 211. Units 240 and 260 may use GLWE encryption modulo modulus q and modulo quotient polynomial p(X). Typically, modulus q is identical to that of the LWE type input ciphertext, but in principle this is not required. Interestingly, the quotient polynomial p(X) may be a NTT polynomial that allows number theoretic transformations modulo modulus q, e.g., M In particular, q may be a power of 2, in which case X N Quotient polynomials other than +1 may be used. Further examples are given below.

[0099] The blind rotation may use a bootstrapping key 270. The bootstrapping key 270 may enable a blind rotation of the LWE ciphertext 211 to be performed.

[0100] The blind rotation may further use a test polynomial v 230 . The quotient polynomial, as used in the prior art, is N +1, so that it is no longer possible to use a test polynomial that has each desired output value as its respective coefficient. However, interestingly, the test polynomial is a polynomial product modulo the modulus q and the quotient polynomial p(X).

number

number

[0101] Blind rotation is the process of

number

number

number

number

number

number

[0102] As shown in the figure, the blind rotation is a GGSW encryption GGSW(s) of the bootstrapping key 270 that encrypts each bit of the decryption key for the input ciphertext. i ), by performing a sequence of respective accumulation operations 260 on the current GLWE encryption 250. The accumulation operations may selectively add the current random mask value of the LWE ciphertext 211 to the current GLWE encryption 250 depending on whether a bit of the bootstrapping key is set.

[0103] In particular, the blind rotation may be performed as follows.

[0104] [Table 1]

[0105] This algorithm actually performs the following operations under key s':

number

[0106] In this example,

number

number

[0107] 3, accumulation unit 260 may compute the outer product of GLWE ciphertext 250 with GGSW ciphertext 270, where computing the outer product involves performing polynomial multiplications. As shown in the figure, these polynomial multiplications may be performed more efficiently by computing the polynomial multiplications using modular multiplication unit 261, which uses number theoretic transformations to perform the polynomial multiplications.

[0108] This example uses a series of accumulation operations 260 on a bootstrapping key 270 that includes a GGSW encryption of bits of a private key, where the accumulation operations use outer products. The techniques provided are easily generalized to other variations of blind rotations. In general, any blind rotation that includes computing an outer product with a GGSW encryption of a bootstrapping key can be improved, such as a blind rotation where the bootstrapping key 270 includes non-binary numbers as disclosed in European Patent Application EP21290025 (incorporated herein by reference), or a blind rotation that processes multiple key digits simultaneously. Even in such cases, performance can be improved by performing polynomial multiplications of the blind rotations by unit 162 using number theoretic transformations. More generally, any polynomial multiplications that are performed as part of a blind rotation can be made more efficient by using number theoretic transformations.

[0109] Further shown is a sampling unit 280. The sampling unit 280 may be configured to take as input a GLWE encrypted polynomial product 250 having a desired output value as a fixed coefficient, and may be configured to perform a sampling to extract a LWE encryption 290 of this fixed coefficient from the encryption 250. For example, the sampling may be as known from the reference "Programmable bootstrapping enables ...".

[0110] We now return to the way in which the test polynomial 230ν is defined such that the encrypted polynomial product 250 has the desired output values ​​as coefficients. M We realized that it was possible to "program" a test polynomial to have this property for any quotient polynomial p(X) that divides -1.

[0111] In particular, the test polynomial ν∈R[X] / (p(X))230 is

number

Number

Number

[0112] In the following, the following notation is used. Let R be a ring having 1. Defined over R, let p(X) be a monic polynomial of degree N that divides the NTT polynomial X M - 1 as the quotient polynomial p(x) = X N + p N-1 X N-1 + p N-2 X N-2 + ··· + p 0 For convenience,

Number

Number

[0113] The inventor was able to calculate the test polynomial ν based on the recognition that when the quotient polynomial p(X) divides the NTT polynomial X M - 1, X -1 exists in R[X] / (p(X)). Specifically, X -1 can be represented as a polynomial of degree < N with coefficients in R. This, in turn, allows for obtaining an expression for

Number

Number

[0114] In particular, in R[X] / (p(X)),

Number

Number

[0115] This assumes that p 0 is invertible in R. This is shown by the fact that the quotient polynomial p(X) divides the NTT polynomial X M - 1. In fact, for the polynomial

Number

[0116] polynomial

number

number

number

[0117] So, effectively, X -1 Multiplication with may result in adding a scaled version of the constant term in v(X) to the other coefficients, where the scaling depends on the index and shift of the coefficients.

[0118] Based on the relationship (*), a test polynomial 230 can be calculated. Some examples are given. A preferred embodiment defines a set of values ​​X -t This involves embedding in either constants or leading coefficients of ν(X). In these examples, the inventors have been able to derive expressions for the test polynomials that are particularly efficient to determine.

[0119] Test polynomial example 1: Fixed coefficients are constant coefficients N desired output values

number

number

number

number

[0120] For example, the following algorithm can be used to compute the test polynomial:

[0121] [Table 2]

[0122] Test polynomial example 2: Fixed coefficients are leading coefficients N desired output values

number

number

number

number

[0123] For example, the following algorithm can be used to calculate the test polynomial:

[0124]

Table 3

[0125] Test polynomial example 3: If the quotient polynomial is X N ±X N / 2 +1 In this example, the quotient polynomial p(X) is a trinomial of the form p(X) = X N + εX N / 2 + 1 for even N and ε ∈ {-1, 1}. In particular, this means that for all i ∈ {0,..., N} \ {0, N / 2, N}, p 0 = p N = 1, p N / 2 = ±1, and p i = 0. For this choice of the quotient polynomial, the test polynomial can be efficiently programmed for any fixed coefficient s, for example, as K t = (X -t ν(X)) s by determining each coefficient as the sum of at most two desired output values.

[0126] For example, when s < N / 2, the coefficients can be calculated as follows:

Equation

[0127] The above relational expression can be derived as follows. The relation (*) for this case is:

Equation

Number

Number

[0128]

Number

Number

[0129] The solution can be verified as follows: When 0 ≦ t < N / 2 - s: This is

Number

[0130] When N / 2 - s ≦ t < N / 2: This corresponds to the second case of the above (X -t ν(X)) s . Thus: (X -t ν(X)) s =(ν(X)) t+s -ε(ν(X)) t+s-N / 2 is. The conditions are

Number

Number

[0131]

Number

Number

Number

[0132] When N - s ≤ t < N: In this case

Number

[0133] As another example, when s ≥ N / 2, the coefficients can be calculated as follows:

Number

[0134] For example, the following algorithm may be used to determine the test polynomial 230:

[0135] [Table 4]

[0136] Test Polynomial Example 4: Other Quotient Polynomials / Coefficients In general, to determine test polynomials for other quotient polynomials, follow the procedure of Example 3 and iterate over ((X -t ν(X)) s One can write out an explicit expression for θ and solve the resulting system. This approach is suitable for sparse polynomials, e.g., with at most 3, at most 5, or at most 10 nonzero coefficients.

[0137] Another way to determine the test polynomial is to use the polynomial R[X] / (p(X)) as the -1 The key to understanding this is to view the multiplication of a polynomial v(X) by as a matrix multiplication with a vector of coefficients of v(x). This can be solved using techniques known per se, resulting in a system of N linear equations and N variables whose solutions correspond to the coefficients of the test polynomial. In many cases the system can be solved; if not, then fixed coefficients can be chosen, for example, to determine the test polynomial.

[0138] Modulus / quotient polynomial / NTT polynomial example Below, some particularly advantageous choices for the modulus, quotient polynomial, and NTT polynomial are described to allow efficient polynomial multiplication using number theoretic transformations.

[0139] In general, the following example shows the rings for different values ​​of the integer q.

number

[0140] One particularly good choice, which combines good cryptographic security with efficient computation, is M=3 7 = 2187, and N = 2 3 6 = 1458. Note that N / M = 2 / 3 > 1 / 2, so this example benefits from the fact that the blind rotation is capable of processing more than half of the input plaintext values.

[0141] Specifically, as described above, the quotient polynomial and the desired output value K=(K 0 ,...,K N-1 )∈R N For a given lookup table, the value of K is a fixed coefficient, -t It can be programmed with a constant coefficient of ν(X). In this case, the test polynomial

number

number

[0142] Modulus of a Prime Number For example, as a number theoretic transformation, a conventional number theoretic transformation may be used, e.g., as described in "Modern Computer Algebra" and in more detail elsewhere herein. This number theoretic transformation is also known as the discrete Fourier transform. It is a method of solving a ring modulo a modulus and a quotient polynomial.

number

number

number

number

[0143] Modulus of power of 2 As explained elsewhere, it is often very beneficial to choose a modulus that is a power of 2. A common choice is q=2 32 or q=2 64 If M is chosen to be a power of three, then M and q are relatively prime.

number

number

number

number

[0144] FIG. 3 illustrates generally an example embodiment of an accumulator unit 360, for use, for example, in the blind rotation of FIG.

[0145] The accumulator unit 360 may be configured to perform an accumulation operation to selectively add the current random mask value 311 of the LWE type ciphertext to the current GLWE encryption 350 depending on whether the GGSW encrypted current bit 371 of the bootstrapping key is set.

[0146] The accumulator unit 360 may be configured to obliviously select either the current GLWE encryption 350 or the current GLWE encryption multiplied by a monomial representing the current random mask value 311, depending on whether the current bit 371 of the bootstrapping key is set. Such an operation of obliviously selecting the first or second GLWE ciphertext is also known as a controlled selector gate or controlled multiplexer operation CMux. In general, a GGSW ciphertext C that encrypts a bit b ∈ {0,1} and two GLWE ciphertexts c 0 and c 1 Given, the CMux operation is b It can output a ciphertext that encrypts the same plaintext as

number

number

number

number

[0147] To make an oblivious selection between the two GLWE encryptions, accumulator unit 360 may calculate a GLWE encrypted difference 363 between the desired output when bit 371 is set and the desired output when bit 371 is not set. The difference 363 may be performed by calculating a polynomial multiplication ModMul 362. The polynomial multiplication multiplies the current GLWE encryption ACC 350 by a polynomial derived from the current random mask value 311, e.g.

number

number

[0148] Given encrypted difference 363, accumulator unit 360 may calculate the outer product of the difference with GGSW encrypted bit 371. This may result in GLWE encryption 368, which encrypts a zero if encrypted bit 371 is zero and encrypts difference 363 if the bit is a one.

[0149] As known per se, performing such an outer product of the GLWE encryption 363 and the GGSW encryption 371 may involve computing multiple respective polynomial products. In general, the GGSW encryption 371 of a given plaintext may involve multiple respective GLWE encryptions of values ​​that depend on the plaintext. For example, see the GGSW encryption described in "Programmable bootstrapping enables efficient homomorphic inference of deep neural networks" at

number

number

[0150] In particular, computing the outer product may include computing a gadget decomposition GDec 364 of the GLWE encryption 363, as known per se. The gadget decomposition may result in a vector 365 of polynomials defined based on the GLWE encryption 363. The gadget decomposition is typically computed for polynomials in coefficient representation. The outer product may be computed by multiplying the gadget decomposition vector 365 with the GGSW encryption 371, which is considered as a matrix of polynomials. The matrix multiplication may be computed modulo the modulus q and the quotient polynomial q(x), as described herein, and may thus include a polynomial multiplication of the respective polynomial based on the GLWE encryption 363 with the polynomial of the GGSW encryption 371.

[0151] Interestingly, these polynomial multiplications can be efficiently performed using number-theoretic transformations. For this, the gadget decomposition 365 is typically calculated 364 in the coefficient representation and can be transformed into a Fourier domain representation by applying the number-theoretic transformation NTT 320. The result is a gadget decomposition 366 in the Fourier domain representation, shown in dashed lines in the figure. The gadget decomposition 366 can then be multiplied with the GGSW encryption 371, also in the Fourier domain representation, by applying a Fourier domain polynomial multiplication FFTMul 330. This multiplication 330 can include a point-wise multiplication of the evaluations of each polynomial in the set of evaluation points, as explained in more detail elsewhere. The result can be the GLWE encryption 367, obtained from the outer product, of the Fourier domain representation. By transforming the Fourier domain representation 367 using the inverse number-theoretic transformation INTT 340, the GLWE encryption can be obtained in the coefficient representation 368.

[0152] As shown in the figure, the GGSW encryption 371 may be obtained in a Fourier domain represented form, for example received from another party or storage in a Fourier domain representation, but may also be converted to a Fourier domain represented form by applying NTT 320 as part of accumulation 360.

[0153] Converting to a Fourier domain representation 320 and converting from a Fourier domain representation 340, as well as a detailed example of performing polynomial multiplication 330 in the Fourier domain, are given here. This example shows the discrete Fourier transform, which may also be called the "ordinary" or "standard" number-theoretic transform.

[0154] In this example, assume that R is a ring with 1. Also, let ω be a primitive M-th root of 1 for an integer M > 1. The NTT polynomial X M -1 modulo 2 polynomials f, g ∈ R[X] / (X M -1) is described. This is known per se, for example, from Chapter 8 of "Modern Computer Algebra".

[0155] For a polynomial, f := f(X) = f 0 + f 1 X + ··· + f M-1 X M-1 ∈ R[X] with degree < M can be represented in coefficient form as a coefficient vector, for example, (f 0 , f 1 ,..., f M-1 ) ∈ R M . The discrete Fourier transform of the polynomial f (seen as a vector in R M ) can include the evaluation of f at each power of ω. For example:

Number

[0156] For two polynomials f, g ∈ R[X] with degree < M, DFT ω (f * g) = DFT ω (f) · DFT ω (g) holds. Here, * denotes polynomial convolution, and · denotes pointwise multiplication of vectors.

[0157] Given polynomials f, g ∈ R[X] / (X M -1) with degree < M, X MMultiplication modulo -1 is convolution (e.g., fg≡f*g(mod X M -1)), so the polynomial product h := fg ∈ R[X] / (X M -1) can, in this example, be obtained by applying the DFT 320, point - by - point multiplication 330, and inverse DFT 340: h = DFT ω -1 (DFT ω (f)·DFT ω (g)) where DFT ω -1 denotes the inverse discrete Fourier transform. Interestingly, for any polynomial h ∈ R[X] of degree < M,

Number

[0158] In general, given a quotient polynomial q(X) that divides the NTT polynomial X M -1, the polynomial product modulo the quotient polynomial can be obtained by computing h(X) mod q(X).

[0159] For some quotient polynomials q(X), it is possible to perform NTT - based polynomial multiplication particularly efficiently based on a Fourier - domain representation using, for example, the number of elements equal to the degree of q(X) rather than the degree of the NTT polynomial. In such cases, the Fourier - domain representation may only include a subset of the set of powers of a primitive M - th root of unity.

[0160] For example, if f, g ∈ R[X] / (X N +X N / 2 +1) are given, then f j ∈ R and

Number

Number

number

number

[0161] Similarly,

number

number

number

number

[0162] η:=ω 3Let h be the primitive (N / 2)th root of 1. For i∈{1,2}, i * :=f i * g i * mod (X N / 2 -1) is h i * =DFT η -1 (DFT η (f i * )·DFT η (g i * )) The polynomial h can be calculated as i :=f i g i mod ((ω 3-i X) N / 2 -1) for i ∈ {1,2},

number

number

[0163] Thus, in this case, the number theoretic transform operation 320 is:

number

number

number

number

[0164] In the above example, a primitive M-th root of 1 was used, where M was the degree of the NTT polynomial.

number

[0165] The GLWE encryption 368 uses the output of the accumulator unit, e.g.

number

number

[0166] Variations on the above technique are possible, for example, the roles of the zeros and ones in the encryption key 371 may be reversed by appropriate adaptation to the difference 363 and the values ​​added to the GLWE encryption 368; the addition 369 may be performed in the Fourier domain; etc. Also, in such other cases, in general, the accumulator unit 360 may compute the outer product of the GLWE-type ciphertext with the GGSW-type ciphertext of the bootstrapping key, which may be made more efficient by using number theoretic transformations for that polynomial multiplication as described above.

[0167] In the examples of Figures 2 and 3, the proposed technique is described based on (G)LWE encryption and its gadget variant GGSW. In particular, in the above description, the ciphertext 211 to which the blind rotation is applied is an LWE ciphertext, the encrypted polynomial product 250 of the blind rotation is a GLWE encryption, and the accumulator is implemented using the GGSW encryption of the bootstrapping key.

[0168] However, it is not necessary to use LWE, and in particular it is possible to use NTRU-type encryption on the input ciphertext 211 and / or the encrypted polynomial product 250. In the latter case, the bootstrapping key may include gadget NTRU encryption. More generally, the technique provided involves the decryption of a test polynomial and X M It may be applied to any blind rotation that results in an encrypted polynomial product with a bootstrapping polynomial modulo a quotient polynomial different from +1, for example any accumulator-based blind rotation.

[0169] In particular, with regard to the use of NTRU for the encrypted polynomial product 250, it is noted that the described “blind rotation” algorithm itself makes use of an abstract accumulator ACC. As mentioned above, this accumulator may be implemented based on GLWE, but this is not required. Other kinds of accumulators are possible, for example based on NTRU. Based on the NTRU ciphertext, a gadget encryption similar to the GGSW encryption may be defined, with which the outer product may be defined. A detailed example may be found in C. Bonte et al., “FINAL: Faster FHE instantiated with NTRU and LWE”, https: / / ia.cr / 2022 / 074. Thus, the accumulator may be implemented based on NTRU, whose value is, for example,

number

[0170] As an example, applying a blind rotation to the LWE ciphertext c that encrypts μ using this kind of NTRU-based accumulator yields the bootstrapping monomial

number

number

number

number

[0171] Instead of or in addition to the encrypted polynomial, the input ciphertext 211 does not have to be an LWE ciphertext either. In particular, blind rotations can be applied to NTRU ciphertexts, as described in the reference "FINAL". It is also possible to obtain the input LWE ciphertext 211 by converting it from an NTRU ciphertext, as described in the reference "FINAL".

[0172] In such a case, the encrypted polynomial product

number

[0173] 4 illustrates generally an example embodiment of an encryption computation method 400. The encryption computation method 400 may be computer-implemented.

[0174] The method 400 may include encrypting 410 the plaintext value, for example obtaining LWE type ciphertext.

[0175] The method 400 may further include performing 420 a blind rotation of the ciphertext according to the test polynomial. The blind rotation may result in an encrypted polynomial product of the test polynomial and a bootstrapping monomial modulo q and modulo a quotient polynomial p(X). The bootstrapping monomial may represent the plaintext values ​​as exponents. The quotient polynomial p(X) may be a NTT polynomial that allows for number theoretic transformations modulo modulo q, e.g., X M The blind rotation may include performing polynomial multiplication using a number theoretic transformation 425. The test polynomial may be defined such that the polynomial product has the desired output value for the plaintext value as a fixed coefficient.

[0176] 5 illustrates generally an example embodiment of a method 500 for determining a test polynomial. The method 500 may be computer-implemented.

[0177] The test polynomial may be for use in a cryptographic computation as described herein. The cryptographic computation method may include computing a polynomial product of the bootstrapping monomial and the test polynomial modulo a modulus q and modulo a quotient polynomial p(X). The quotient polynomial p(X) may divide the NTT polynomial.

[0178] The method 500 may include obtaining 510 a lookup table that defines a desired output value for each plaintext value. The method 500 may include obtaining 520 a modulus, a quotient polynomial, and an NTT polynomial. The method 500 may include calculating 530 a test polynomial such that a polynomial product has each desired output value as a fixed coefficient for each plaintext value.

[0179] As will be apparent to one skilled in the art, many different ways of performing the methods 400, 500 are possible. For example, the order of steps may be performed in the order shown, but the order of steps may vary or some steps may be performed in parallel. Furthermore, other method steps may be inserted between the steps. The inserted steps may represent improvements to the method as described herein or may not be related to the method. For example, some steps may be performed, at least partially, in parallel. Furthermore, a given step may not be completely finished before the next step is started. The methods 400, 500 may also be combined, for example the method 400 of performing cryptographic calculations using a test polynomial may be performed after the calculation of the test polynomial by the method 500.

[0180] The method embodiments may be performed using software, the software including instructions that cause a processor system to perform the method 400 or 500. The software may include only those steps performed by a particular subentity of the system. The software may be stored on a suitable storage medium such as a hard disk, floppy, memory, optical disk, etc. The software may be transmitted as a signal along a wired or wireless line, or may be transmitted using a data network, e.g., the Internet. The software may be made available for download and / or remote use on a server. The method embodiments may be performed using a bitstream configured to configure a programmable logic, e.g., a field programmable gate array (FPGA), to perform the method.

[0181] The subject matter of the present disclosure should also be understood to extend to computer programs, particularly those configured to practice the subject matter of the present disclosure, and in particular computer programs on or in a carrier wave. The programs may be in the form of object code, such as source code, object code, code intermediate sources, and partially compiled forms, or any other form suitable for use in implementing the method embodiments. An embodiment relating to a computer program product includes computer executable instructions corresponding to each of at least one processing step of the described method. These instructions may be subdivided into subroutines and / or stored in one or more files that may be statically or dynamically linked. Another embodiment relating to a computer program product includes computer executable instructions corresponding to each of at least one device, unit, and / or part of the described system and / or product.

[0182] Typically, the devices described herein, e.g., in Figs. 1a-1c, include one or more microprocessors that execute appropriate software stored in the system. For example, the software may be downloaded and / or stored in a corresponding memory, e.g., a volatile memory such as RAM or a non-volatile memory such as Flash. Alternatively, the system may be implemented, in whole or in part, in programmable logic, e.g., a field programmable gate array (FPGA). The system may be implemented, in whole or in part, as a so-called application specific integrated circuit (ASIC), e.g., an integrated circuit (IC) customized for their specific application. For example, the circuit may be implemented in CMOS, e.g., using a hardware description language such as Verilog, VHDL, etc. In particular, the system may include a circuit for evaluation of cryptographic primitives.

[0183] The processor circuit may be implemented in a distributed manner, e.g., as multiple sub-processor circuits. The storage may be distributed across multiple distributed sub-storages. Some or all of the memory may be electronic memory, magnetic memory, etc. For example, the storage may have volatile and non-volatile portions. Some of the storage may be read-only.

[0184] 6 illustrates a computer readable medium 1000 having a writable portion 1010. The computer readable medium 1000 is shown in the form of an optically readable medium. The computer readable medium 1000 may store data 1020, which, when executed by a processor system, may represent instructions that cause the processor system to perform an embodiment of a method for performing a cryptographic computation method and / or a method for determining a test polynomial, according to an embodiment.

[0185] Alternatively, or in addition, the data 1020 may represent a test polynomial for use in a cryptographic computation method according to an embodiment. The test polynomial may be determined in advance according to an embodiment.

[0186] The data 1020 may be embodied on the computer readable medium 1000 as a physical mark or by magnetization of the computer readable medium 1000. However, any other suitable embodiment is also contemplated. Furthermore, although the computer readable medium 1000 is illustrated here as an optical disk, it should be understood that the computer readable medium 1000 may be any suitable computer readable medium, such as a hard disk, a solid state memory, a flash memory, etc., and may be non-recordable or recordable. The computer program 1020 includes instructions that cause a processor system to perform the above method of performing a calculation on an encrypted value, e.g., an LWE encrypted value, or the above method of determining a test polynomial.

[0187] FIG. 7 shows a schematic representation of a processor system 1140 according to an embodiment of a device for performing cryptographic calculations or for determining a test polynomial. The processor system includes one or more integrated circuits 1110. The architecture of the one or more integrated circuits 1110 is shown diagrammatically in the figure. The circuit 1110 includes a processing unit 1120, e.g., a CPU, for executing computer program components to perform the method according to the embodiment and / or to implement the modules or units thereof. The circuit 1110 includes a memory 1122 for storing programming code, data, etc. Part of the memory 1122 may be read-only. The circuit 1110 may include a communication element 1126, e.g., an antenna, a connector, or both. The circuit 1110 may include a dedicated integrated circuit 1124 for performing part or all of the processing defined in the method. The processor 1120, the memory 1122, the dedicated IC 1124, and the communication element 1126 may be interconnected via an interconnect 1130, e.g., a bus. The processor system 1110 may be configured for contact and / or contactless communication using antennas and / or connectors, respectively.

[0188] For example, in an embodiment, the processor system 1140, e.g., a device for performing cryptographic calculations or determining a test polynomial, may include a processor circuit and a memory circuit, the processor configured to execute software stored in the memory circuit. For example, the processor circuit may be an Intel Core i7 processor, an ARM Cortex-R8, etc. In an embodiment, the processor circuit may be an ARM Cortex M0. The memory circuit may be a ROM circuit, or a non-volatile memory, e.g., a flash memory. The memory circuit may be a volatile memory, e.g., an SRAM memory. In the latter case, the device may include a non-volatile software interface, e.g., a hard drive, a network interface, etc., configured to provide the software.

[0189] Although device 1110 is shown as including one of each of the described components, various components may be duplicated in various embodiments. For example, processor 1120 may include multiple microprocessors configured to independently execute the methods described herein, or configured to perform steps or subroutines of the methods described herein such that the multiple processors cooperate to achieve the functions described herein. Furthermore, when device 1110 is implemented in a cloud computing system, various hardware components may belong to separate physical systems. For example, processor 1120 may include a first processor in a first server and a second processor in a second server.

[0190] It should be noted that the above-described embodiments are illustrative rather than limiting of the subject matter of the present disclosure, and that those skilled in the art can design many alternative embodiments.

[0191] In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. Use of the verb "comprise" and its conjugations does not exclude the presence of elements or steps other than those defined in the claim. The article "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. Expressions such as "at least one of", when preceding a list of elements, denote the selection of all or any subset of the elements from the list. For example, the expression "at least one of A, B, and C" is to be understood as including A only, B only, C only, both A and B, both A and C, both B and C, or all of A, B, and C. The subject matter of the present disclosure may be implemented by hardware comprising several distinct elements, and by a suitably programmed computer. In device claims reciting several parts, several of these parts may be embodied by one and the same item of hardware. The mere fact that certain means are recited in mutually different dependent claims does not indicate that a combination of these means cannot be used to advantage.

[0192] In the claims, references in parentheses refer to the reference signs in the drawings of exemplary embodiments or to formulas of embodiments, thus increasing the clarity of the claims. These references should not be construed as limiting the claims.

Claims

1. A cryptographic encryption computation method (400), comprising: obtaining (410) a ciphertext for encrypting a plaintext value; performing a blind rotation (420) of the ciphertext according to a test polynomial, the blind rotation producing an encrypted polynomial product of the test polynomial and a bootstrapping monomial modulo the modulus (q) and modulo the quotient polynomial (p(X)), the bootstrapping monomial expressing the plaintext value as an exponent (420); Including, The quotient polynomial (p(X)) is the NTT polynomial (X) that allows number theoretic transformations modulo the modulus (q). Ｍ -1) and performing a blind rotation includes performing polynomial multiplication using a number theoretic transform (425), and a test polynomial is defined such that the polynomial product has as fixed coefficients the desired output value for the plaintext value.

2. 2. The method of claim 1, wherein the ciphertext is an LWE type ciphertext.

3. 3. The method (400) of claim 2, wherein the ciphertext is obtained by transformation from an NTRU ciphertext.

4. 2. The method of claim 1, wherein the ciphertext is an NTRU ciphertext.

5. 5. The method (400) of any one of claims 1 to 4, comprising performing programmable bootstrapping by obtaining an input ciphertext, performing modulus switching on the input ciphertext to obtain a ciphertext, performing blind rotation, and performing sampling to extract an encryption of a fixed coefficient from a computed encrypted polynomial product.

6. 6. The method (400) of claim 1, wherein performing the blind rotation comprises computing an outer product of the ciphertext with a gadget ciphertext included in the bootstrapping key, and the polynomial multiplication to compute the outer product is performed using a number theoretic transformation.

7. The quotient polynomial is X Ｎ The method (400) of any one of claims 1 to 6, wherein the first factor is not equal to +1.

8. The method (400) of any one of claims 1 to 7, wherein the degree (N) of the quotient polynomial is strictly greater than half the degree (M) of the NTT polynomial.

9. 9. The method (400) of any one of claims 1 to 8, wherein the modulus (q) is a power of two.

10. 9. The method (400) of any one of claims 1 to 8, wherein the modulus (q) is a prime number and the degree (M) of the NTT polynomial divides the modulus minus one.

11. The modulus is 10.3 １８ +1 or 4.3 ３９ 11. The method (400) of claim 10, wherein the first bit is equal to +1.

12. The quotient polynomial is X Ｎ +X Ｎ／２ +1 or X Ｎ -X Ｎ／２ The method (400) of any one of claims 1 to 11, wherein the arithmetic unit 100 is equal to +1.

13. 13. The method (400) of any one of claims 1 to 12, wherein the degree of the NTT polynomial is a power of three and the degree of the quotient polynomial is two-thirds of the degree of the NTT polynomial.

14. The method (400) of any one of claims 1 to 13, wherein the fixed coefficient is a constant coefficient or a leading coefficient.

15. 15. A method (500) for determining a test polynomial for use in a cryptographic computation method according to any one of claims 1 to 14, the cryptographic computation method comprising: computing a polynomial product of a bootstrapping monomial and a test polynomial modulo a modulus (q) and modulo a quotient polynomial (p(X)), where the quotient polynomial (p(X)) divides the NTT polynomial, the method comprising: Obtaining (510) a look-up table that defines the desired output value for each plaintext value; Obtaining (520) the modulus, the quotient polynomial and the NTT polynomial; Computing (530) a test polynomial such that the polynomial product has each desired output value as a fixed coefficient for each plaintext value; The method (500).

16. A cryptographic computing device (110, 112) comprising: a storage (140) for storing ciphertexts obtained by encrypting plaintext values; a processor subsystem (130) configured to perform a blind rotation of the ciphertext according to a test polynomial, the blind rotation producing an encrypted polynomial product of the test polynomial and a bootstrapping monomial modulo a modulus (q) and modulo a quotient polynomial (p(X)), the bootstrapping monomial expressing plaintext values ​​as exponents; Equipped with The quotient polynomial (p(X)) is the NTT polynomial (X) that allows number theoretic transformations modulo the modulus (q). Ｍ -1) and performing a blind rotation includes performing polynomial multiplication using a number theoretic transformation, and a test polynomial is defined such that the polynomial product has a desired output value for the plaintext value as a fixed coefficient.

17. A device (111, 112, 113, 119) for determining a test polynomial for use in a cryptographic computation method according to any one of claims 1 to 14, the cryptographic computation method comprising: computing a polynomial product of a bootstrapping monomial and a test polynomial modulo a modulus (q) and modulo a quotient polynomial (p(X)), where the quotient polynomial (p(X)) divides the NTT polynomial, the device comprising: - a storage (149) for storing a look-up table defining the desired output value for each plaintext value; a processor subsystem (139), - Obtain the modulus, quotient polynomial and NTT polynomial; - Compute test polynomials such that the polynomial products have each desired output value as a fixed coefficient for each plaintext value. A processor subsystem (139) configured to A device (111, 112, 113, 119).

18. A temporary or non-transitory computer-readable storage medium (1000), comprising: instructions which, when executed by a processor system, cause the processor system to perform the method according to any one of claims 1 to 14 and / or the method according to claim 15; and / or A test polynomial for use in the cryptographic computation method according to any one of claims 1 to 14. A transitory or non-transitory computer-readable storage medium (1000) containing data representing.

Images