Polynomial multiplication of the encrypted value

Abstract

Some embodiments are directed to a computer-implemented cryptographic computation method (500). The method operates on a ciphertext that includes one or more random mask polynomials and a Bode polynomial, where the Bode polynomial is derived from the mask polynomial and the plaintext. The mask polynomial and the Bode polynomial of the ciphertext are multiplied with the respective multiplicand polynomials, for example as part of a programmable bootstrapping of a fully homomorphic encryption scheme similar to TFHE. To perform this multiplication efficiently, the ciphertext is stored by storing a seed for a pseudorandom number generator and a representation of the Bode polynomial in the Fourier domain of a number theoretic transform. To perform the multiplication, the ciphertext is expanded by generating a representation of the mask polynomial in the Fourier domain using a pseudorandom number generator according to the seed. The multiplication can then be efficiently performed in the Fourier domain.

Description

[Technical field]

[0001] The subject matter of this disclosure relates to computer-implemented cryptographic computation methods, computer-implemented methods for computing representations of ciphertext, corresponding devices, and computer-readable media. [Background technology]

[0002] Homomorphic encryption allows for cryptographic computations: computations, e.g., circuit evaluations, performed on data encrypted by a party that the party cannot decrypt. For example, input data and computation results may be received and returned in encrypted form. Intermediate data, e.g., the internal state of a computation, may also be in encrypted form.

[0003] Even though the computation result is returned in encrypted form, the output upon decryption is expected to be the same or very close to what it would be if the operation was performed on unencrypted data. Homomorphic encryption can be used for privacy-preserving outsourced storage and computation. It allows data to be encrypted and then outsourced to a cloud environment for processing and / or storage, all while encrypted.

[0004] For example, homomorphic encryption may be applied in areas such as healthcare where privacy regulations may make it difficult to share plain data, but computations on encrypted medical data may be permissible. For example, a medical model deployed to, for example, classify medical data may be configured to receive medical data in encrypted form from a third party, for example a hospital. The medical model may, for example, classify the medical data as, for example, normal or abnormal, or as having some particular medical syndrome, disease, or other disorder. Using homomorphic encryption, the medical model may be applied to the medical data received in encrypted form. This means that the party providing the medical model does not have access to the plain medical data corresponding to the encrypted medical data. A user of the service may decrypt the results of the medical model application.

[0005] In particular, homomorphic encryption techniques exist that, at least in principle, can be used to compute arbitrary functions on encrypted data. Such techniques are called "fully homomorphic encryption" (FHE) techniques.

[0006] Known embodiments of FHE use noisy ciphertexts for security reasons. For example, encryption of a data item may involve mapping the data item to a point in a key-dependent lattice, to which noise is added. In particular, many known embodiments of FHE use Generalized Learning With Errors (GLWE)-based ciphertexts, e.g., Ring Learning With Errors (RLWE) ciphertexts, whose security depends on the cryptographic hardness of the generalized learning with errors problem, in particular the RingLWE (RLWE) problem, of the RLWE-based ciphertext. Such "GLWE-based" or "GLWE-type" ciphertexts may include, in addition to one or more mask polynomials, a body polynomial derived from the mask polynomials and the plaintext, and including noise.

[0007] When a data item has just been encrypted, the noise is low and the encryption is fresh. For example, when the data item is decrypted, the noise at some point in the decryption process is low enough that it can be removed, for example, by rounding. On the other hand, the noise should be high enough to make attacks on the system difficult enough. For example, if there was no noise, many homomorphic encryption schemes could be attacked with linear algebra, or other efficient algorithms, such as lattice reduction algorithms. When a data item is encrypted, noise is added that is selected to be difficult to attack while homomorphic operations can still be performed.

[0008] Most homomorphic operations increase the noise inherent in homomorphically encrypted data items. When many such operations are performed, the noise may reach a level such that a unique decryption is no longer possible. It is commonly known to use a technique called bootstrapping to reduce the noise of homomorphically encrypted values. Bootstrapping may use a public key called a bootstrapping key. By using bootstrapping to reduce noise where necessary, it is in principle possible to compute any desired number of homomorphic operations.

[0009] A particular class of fully homomorphic encryption schemes are homomorphic encryption schemes similar to TFHE. Such schemes are described in I. Chillotti et al., "TFHE: Fast fully homomorphic encryption over the torus," J. Cryptol, 33(1):34-91, 2020 (incorporated herein by reference). TFHE-like schemes are differentiated from other FHE schemes by supporting a relatively highly efficient technique for bootstrapping. This bootstrapping technique can reduce noise in the LWE-encrypted input values ​​by homomorphically evaluating the LWE decryption of the exponent of a GLWE-encrypted monomial, resulting in an LWE-encrypted output value with an amount of noise independent of the noise in the LWE-encrypted input values. TFHE bootstrapping is also programmable in the sense that the output value can be the result of applying a function to the input value. An example of such programmable bootstrapping is described in I. Chillotti et al., “Programmable bootstrapping enables efficient homomorphic inference of deep neural networks,” Cyber ​​Security Cryptography and Machine Learning (CSCML 2021), vol. 12716 of Lecture Notes in Computer Science, pp. 1-19, Springer, 2021 (incorporated herein by reference).

[0010] TFHE programmable bootstrapping relies on the calculation of the so-called external product of a GGSW-type (generalized GSW-type, e.g., RGSW-type) ciphertext C using a GLWE-based ciphertext c. Generally, for example, as described in "Programmable bootstrapping enables efficient homomorphic inference of deep neural networks", the GGSW-type ciphertext C that encrypts a plaintext contains a plurality of GLWE-based ciphertexts c that encrypt respective values based on the plaintext. i The calculation of the external product involves multiplying each GLWE-based ciphertext c i with each multiplicand polynomial based on the GLWE-based ciphertext c (used to calculate the GGSW-type ciphertext). To perform these polynomial multiplications efficiently, TFHE employs a fast Fourier transform (FFT) for complex numbers using roots of unity ω j , where

Number

[0011] Because the bootstrapping key used for programmable bootstrapping contains a large number of GGSW-type ciphertexts and itself contains a large number of GLWE-based ciphertexts, the bootstrapping key is relatively large to store and transfer. For example, for typical TFHE parameters, the bootstrapping key may be approximately 62 MB in size. However, this size can be reduced by defining the coefficients of the mask polynomial as the output of a pseudorandom function. Only the seed of the pseudorandom function needs to be stored thereafter. When using the key, the pseudorandom function is then evaluated to obtain the coefficients of the mask polynomial, and this representation is converted to a complex evaluation of the mask polynomial to a complex root of 1 on which an FFT is performed. For example, using RingLWE, the size of the bootstrapping key can be reduced by a factor of about two to approximately 31 MB for typical parameters. [Prior art documents] [Patent documents]

[0012] [Patent Document 1] European Patent Application Publication No. 21290025 [Patent Document 2] European Patent Application Publication No. 21290080 [Non-patent literature]

[0013] [Non-Patent Document 1] I. Chillotti et al., “TFHE: Fast fully homomorphic encryption over the torus”, J. Cryptol, 33(1):34-91, 2020 [Non-Patent Document 2] I. Chilotti et al., “Programmable bootstrapping enables homomorphic inference of deep neural networks,” Cyber ​​Security Cryptography and Machine Learning (CSCML 2021), vol.12716 of Lecture Notes in efficient Computer Science, pp. 1-19, Springer, 2021. [Non-Patent Document 3] J. von zur Gathen and J. Gerhard, "Modern Computer Algebra", Cambridge University Press, 3rd edition, 2013, Chapter 8 [Non-Patent Document 4] DJ Bernstein, "Multidigit multiplication for mathematicians," Unpublished manuscript, available at https: / / cr.yp.to / papers.htmlsha-pum3, August 2001. [Non-Patent Document 5] R. Rothblum, "Homomorphic encryption: From private-key to public-key", Theory of Cryptography (TCC 2011), vol.6597 of Lecture Notes in Computer Science, pp. 219-234, Springer, 2011. [Non-Patent Document 6] M. Albrecht et al., “On the concrete hardness of Learning with Errors,” Journal of Mathematical Cryptology, 9(3):169-203, 2015. [Non-Patent Document 7] I. Chillotti et al., "CONCRETE: Concrete Operates on Ciphertexts Rapidly by Extending TfhE," available at https: / / homomorphicencryption.org / wp-content / uploads / 2020 / 12 / wahc20_demo_damien.pdf. Summary of the Invention [Means for solving the problem]

[0014] According to one aspect of the invention, there is provided a computer implemented cryptographic computation method as defined by the claims. According to a further aspect of the invention, there is provided a computer implemented method for computing a representation of a ciphertext as defined by the claims. According to a further aspect, there is provided a device for these computer implemented methods as defined by the claims. According to another aspect, there is provided a computer readable medium as defined by the claims.

[0015] The computational method may involve, for example, polynomial multiplication of the GLWE-based ciphertext as part of an outer product of a GGSW-type ciphertext in which the ciphertext is included. The ciphertext may include one or more random mask polynomials and a Body polynomial derived from the mask polynomials and the plaintext. The polynomial multiplication may involve multiplying the mask polynomials and the Body polynomials of the ciphertext with respective multiplicand polynomials, for example with a common multiplicand polynomial.

[0016] The ciphertext may be stored in memory as data. For example, the data may be retrieved from a persistent storage such as a hard drive, or the data may be received in advance from another party, e.g., the party that computed the ciphertext, and stored in a volatile memory, e.g., RAM. In either case, it is desirable if the stored data is as small as possible. As mentioned above, the ciphertext may be stored relatively efficiently if the party computing the ciphertext generates the coefficients of the mask polynomial using a pseudorandom number generator (PRNG; preferably a cryptographic PRNG). Rather than including the mask polynomial in the stored data, a seed may then be stored instead. However, in order to efficiently compute the polynomial multiplications using an FFT, the coefficients of the mask polynomial first need to be transformed into the Fourier domain, i.e., evaluations of these polynomials at complex roots of one.

[0017] The inventors have realized two important things. First, it is also possible to define the stored data of the ciphertext such that the PRNG does not generate a mask polynomial with regular coefficients representation, but instead generates a representation of the mask polynomial in the Fourier domain, e.g., as an evaluation of the polynomial in a set of evaluation values. To this end, upon encryption of the plaintext, the body polynomial can be calculated such that the ciphertext is a correct encryption of the plaintext with respect to a mask polynomial generated in the Fourier domain according to the PRNG, as opposed to with respect to a mask polynomial whose coefficients are obtained from the PRNG.

[0018] In particular, to perform the encryption, the PRNG may be applied according to a seed to generate a representation of the mask polynomial in the Fourier domain. These representations may be converted to their regular coefficient representation. The coefficient representation may be used to encrypt the plaintext based on the random mask polynomial, known per se, resulting in a Bode polynomial in the coefficient representation. The Bode polynomial may then be converted back to the Fourier domain and output together with the seed as a representation of the ciphertext.

[0019] To perform polynomial multiplication of the ciphertext represented in this way, it may be sufficient to expand the representation by generating a representation of the mask polynomial directly in the Fourier domain using a pseudorandom number generator according to the seed. The polynomial products of the mask polynomial and the body polynomial with the respective multiplicand polynomials may be efficiently computed in the Fourier domain. The polynomial products may result in a Fourier domain representation of the computed polynomial products. These representations may then be output in Fourier domain representation or converted back to the coefficient representation if desired. Interestingly, the conversion of the ciphertext in use to the Fourier domain is no longer mandatory, making it more efficient to use the ciphertext. This conversion is now efficiently performed during the encryption of the ciphertext. The ciphertext may still be efficiently stored by storing the seed. This is a worthwhile tradeoff, since once encrypted, such ciphertexts may be reused many times, such as when used for bootstrapping keys, and / or by many different parties.

[0020] A second important realization made by the inventors is that for security reasons, instead of using the Fourier domain of a complex FFT as is currently done in a manner similar to TFHE, it is beneficial to use the Fourier domain of a number-theoretic transform. Number-theoretic transforms are techniques known per se for performing efficient multiplication in polynomial rings. To perform polynomial multiplication using NTT, a polynomial may be represented in a Fourier domain representation of NTT. Typically, a Fourier domain representation of a polynomial includes several respective evaluations of the polynomial at several respective evaluation points. When in Fourier domain representation, the polynomials may be efficiently multiplied, for example by pointwise multiplication of the evaluations. Furthermore, using NTT, it is possible to efficiently compute the Fourier domain representation of a polynomial from its coefficient representation (by applying the number-theoretic transform itself), and the coefficient representation may be efficiently computed from the Fourier domain representation (using an inverse number-theoretic transform).

[0021] Discrete Fourier transform (in standard form, the quotient polynomial X n Various number theoretic transformations are known per se, including the discrete Fourier transform (defined as n|q-1 for n-1 and n|q-1 for a prime power modulus q), see for example J. von zur Gathen and J. Gerhard, "Modern Computer Algebra", Cambridge University Press, 3rd Edition, 2013, Chapter 8 (incorporated herein by reference as far as the description of the discrete Fourier transform is concerned), and Schonhage's algorithm and Nussbaumer's algorithm, see for example DJ Bernstein, "Multidigit multiplication for mathematicians", Unpublished manuscript, available at https: / / cr.yp.to / papers.htmlsha-pum3, August 2001 (incorporated herein by reference as far as the description of these two algorithms is concerned). In this manner, performing polynomial multiplication "using a number theoretic transform" may generally refer to performing polynomial multiplication in the Fourier domain of a number theoretic transform, optionally combined with transforming from this Fourier domain representation to a polynomial and the polynomial to the Fourier domain using NTT and / or its inverse.

[0022] The advantage of using number theoretic transforms is that randomly generating the Fourier domain representation of the number theoretic transform and converting the Fourier domain representation to a polynomial may result in a random polynomial, in other words, a polynomial that is as random as when the coefficients are generated randomly separately. This is not true for complex FFTs, where the Fourier representation of a uniformly random polynomial is not uniformly distributed.

[0023] Thus, using a PRNG to generate a representation of the mask polynomial in the Fourier domain of a number-theoretic transform may result in a ciphertext with the same probability distribution as a ciphertext constructed in the normal way with randomly generated coefficients, which is not the case for complex FFTs. Thus, the problem that the distribution of the ciphertext may leak information about the underlying plaintext is avoided. In this way, a ciphertext is obtained that is both secure and compactly represented, further enabling efficient polynomial multiplication.

[0024] Generalizing from GLWE, the provided techniques apply to "GLWE-like" ciphertexts, by which is meant ciphertexts that include random mask polynomials and Body polynomials. The techniques are applicable to situations in which the mask polynomials and Body polynomials of such GLWE-like ciphertexts are multiplied with respective multiplicand polynomials. In particular, the provided techniques apply to cryptographic computation techniques that use stored keying material, where the keying material includes such ciphertext, and where the keying material is used by multiplying the keying material with the respective polynomials.

[0025] In an embodiment, the technique is applied to a "TFHE-like" encryption computation. Such a TFHE-like encryption computation is characterized by the use of a programmable bootstrapping operation based on evaluating the decryption at the exponent of an encrypted monomial. Specifically, the programmable bootstrapping may include a blind rotation resulting in an encrypted polynomial product of a test polynomial and a bootstrapping monomial, where the bootstrapping monomial represents the plaintext value as an exponent. This evaluation is computed using an outer product of a GGSW-type ciphertext with a bootstrapping key. Such a GGSW-type ciphertext may include multiple GLWE-like ciphertexts, and the computation of the outer product may involve multiplying each ciphertext of the GGSW-type ciphertext with a respective polynomial. In such a TFHE-like setting, since the bootstrapping keys are relatively large, it is important that they can be stored and transmitted more efficiently, and at the same time, since programmable bootstrapping is a non-trivial and relatively heavy operation, it is also important that it can be performed efficiently. Using the provided technique, the bootstrapping key may be stored more efficiently, further enabling efficient application of programmable bootstrapping.

[0026] In an embodiment, the technique is used to obliviously select a first GLWE ciphertext or a second GLWE ciphertext based on the GGSW ciphertext. This oblivious selection may be done by computing the outer product of the GGSW ciphertext and the difference of the first GLWE ciphertext and the second GLWE ciphertext. The first GLWE ciphertext may then be added to the computed product. This operation is also known as a controlled selector gate or controlled multiplexer CMux. The CMux operation may be part of programmable bootstrapping, but may also be used directly as a gate in homomorphic circuit evaluation, for example.

[0027] In an embodiment, the coefficients of each multiplicand polynomial may be obtained, and a number theoretic transformation may be applied to transform the coefficients of each multiplicand polynomial into the Fourier domain. In this way, the GLWE-based ciphertext may be multiplied with the multiplicand polynomial available in coefficient form. The Fourier domain multiplication, even if it involves such a transformation, may typically be implemented much more efficiently than the coefficient domain. There may be additional operations intermediate the transformation to the Fourier domain and the polynomial multiplication, for example, addition or multiplication (by a constant or a polynomial expressed in another Fourier domain) may be applied in the Fourier domain to the multiplicand polynomial before the multiplication.

[0028] In an embodiment, an inverse number theoretic transform may be applied to convert the Fourier domain representation of the computed polynomial product into coefficients of the computed polynomial product. In this way, a coefficient representation may be obtained that may be used in subsequent calculations, e.g., sample extraction, key switching, etc. Again, it is possible to perform additional operations in the Fourier domain, such as addition or multiplication, intermediate the calculation of the product and the application of the inverse number theoretic transform.

[0029] In an embodiment, the expanded stored data representing the GLWE-based ciphertext may be kept in memory. The expanded stored data may be used to calculate further polynomial products with the mask polynomial and further multiplicand polynomials of the body polynomial. Thus, for these further polynomial products, the expansion of the stored data does not need to be performed again, leading to increased efficiency. Nevertheless, when the GLWE-based ciphertext needs to be stored again or when it is desirable to reduce its memory footprint, this may be done by discarding the mask polynomials and storing only the seeds used to generate them.

[0030] In general, the polynomials described herein, e.g., the body polynomials and mask polynomials, may be defined as polynomials modulo a quotient polynomial p(X). For example, a polynomial may be defined as an element of the ring R[X] / (p(X)) of polynomial quotients,

number

number

number

number

number

number

number

number

number

number

[0031] In an embodiment, the quotient polynomial p(X) is a polynomial X for a positive integer M. M Divide -1, for example, X M Equal to -1 or X MA polynomial of degree lower than -1 that divides exactly.

number

number

number

[0032] For example, the quotient polynomial is X M For any quotient polynomial p(X) that divides -1, a Fourier representation of the polynomial may be defined as a set of evaluations of the polynomial in a set of powers of a primitive M-th root of 1. The Fourier representation may be multiplied by pointwise multiplication of the evaluations at each power of the primitive M-th root of 1. For the number theoretic transformation between the coefficient representation and the Fourier domain representation to be efficient, it is advantageous if M includes one or more powers of 2 and / or one or more powers of 3, e.g., if M is a power of 2 or M is a power of 3.

[0033] In some cases, the Fourier representation of a polynomial may involve evaluations at each of the powers of a root of unity. However, this is not required. In various cases, it is sufficient to use a subset of the powers, which leads to a more efficient Fourier domain representation. This is especially true when the quotient polynomial is (X M -1) / (X d -1), where M=hd and d=MN (and therefore N=Md=(h-1)d). For example, the quotient polynomial is (X 2d -1) / (X d -1)=(X d +1)=(X N +1), or for h=3, (X 3d -1) / (X d -1)=(X 2d +X d +1)=(X N +X N / 2 +1). In such cases, the Fourier domain representation of the polynomial can be expressed as a function of only a subset of the powers of a primitive M-th root of 1, e.g., ω, ω for h=2. 3 , ..., ω 2d-1 , for h=3, (ω,ω 2 ), (ω 4 ,ω 5 ), ..., (ω 3d-2 ,ω 3d-1 ), in which evaluation over this subset of powers of roots of unity is sufficient to multiply polynomials, leading to more efficient polynomial multiplication. Nevertheless, efficient number theoretic transformations and inverses are possible.

[0034] For example, the quotient polynomial X N +1 may be used in combination with a primitive 2Nth root of 1. For example, the number of elements, q, in the ring

number

number

[0035] quotient polynomial X N +X N / 2 +1 may be used in combination with an even factor q, for example a power of 2. This is beneficial because it allows for efficient operations and because using powers of 2 is required for some applications.

[0036] In an embodiment, multiple GLWE-based ciphertexts may be generated to generate GGSW-type ciphertexts. For example, multiple such GGSW-type ciphertexts may be generated to generate a bootstrapping key for TFHE-type programmable bootstrapping, for example, by generating respective GGSW-type ciphertexts that encrypt respective portions of a decryption key. In general, a GGSW-type ciphertext may be defined as a ciphertext that includes multiple GLWE-based ciphertexts that encrypt respective values ​​based on a plaintext. In such a case, the multiple GLWE-based ciphertexts may be based on the same seed, for example, the same seed may be used to generate respective different random mask polynomials for each ciphertext. Thus, it may be sufficient to store only a single seed per GGSW-type ciphertext or even per bootstrapping key, for example, thereby further reducing storage requirements.

[0037] The techniques provided for improved computation on encrypted data may be applied to a wide range of applications. Such applications include encrypted evaluation of software programs without having access to the plain data. For example, medical diagnostic software may be evaluated on medical data without actually having access to said medical data. The medical data may include medical images. The medical images may include, for example, multi-dimensional image data, for example, two-dimensional (2D), three-dimensional (3D), or four-dimensional (4D) images, acquired by various acquisition modalities, such as, but not limited to, standard X-ray imaging, computed tomography (CT), magnetic resonance imaging (MRI), ultrasound (US), positron emission tomography (PET), single photon emission computed tomography (SPECT), and nuclear medicine (NM).

[0038] In embodiments, the techniques provided may be used to evaluate neural networks against encrypted inputs. Parties evaluating the neural network may or may not have clear-text access to the neural network's trained parameters, such as, for example, weights and biases. In general, the techniques provided herein, such as improved polynomial multiplication, programmable bootstrapping, and outer products, improve the efficiency of neural network evaluation and / or reduce storage and transmission requirements for the ciphertext or keying material used.

[0039] The method embodiments may be implemented on a computer as a computer-implemented method, or in dedicated hardware, or a combination of both. Executable code for the method embodiments may be stored on a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, offline software, etc. Preferably, the computer program product includes non-transitory program code stored on a computer-readable medium for performing the method embodiments when said program product is run on a computer. In an embodiment, the computer program includes computer program code adapted to perform all or part of the steps of the method embodiments when the computer program is run on a computer. Preferably, the computer program is embodied on a computer-readable medium.

[0040] Further details, aspects and embodiments are described, by way of example only, with reference to the drawings in which elements are illustrated for simplicity and clarity and are not necessarily drawn to scale, and in which elements corresponding to elements already described may have the same reference numerals. [Brief description of the drawings]

[0041] [Figure 1a] FIG. 2 illustrates a schematic example of an embodiment of a device for performing cryptographic calculations and / or for computing a representation of a ciphertext; [Figure 1b] FIG. 1 is a schematic diagram illustrating an example embodiment of a cryptographic computing system. [Diagram 2] FIG. 2 is a schematic diagram of an example encryption unit; [Figure 3a] FIG. 2 illustrates a schematic diagram of an example of an encryption multiplication unit; [Figure 3b] FIG. 2 illustrates a schematic diagram of an example of an encryption multiplication unit; [Figure 4a] FIG. 2 illustrates a schematic diagram of an example of an outer product calculation unit; [Figure 4b] FIG. 2 illustrates a schematic diagram of an example of a bootstrapping unit. [Figure 5a] FIG. 1 illustrates a schematic diagram of an example embodiment of a computer-implemented cryptographic computation method. [Figure 5b] FIG. 2 illustrates a schematic diagram of an example embodiment of a computer-implemented method for computing a representation of a ciphertext. [Figure 5c] 1 is a schematic diagram of a computer readable medium having a writeable portion containing a computer program according to an embodiment; [Figure 5d] FIG. 2 is a schematic diagram illustrating a representation of a processor system according to an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0042] While the subject matter of the present disclosure is susceptible of embodiment in many different forms, one or more specific embodiments have been shown in the drawings and are described in detail herein, with the understanding that the disclosure is to be considered as an exemplification of the principles of the subject matter of the present disclosure and is not intended to be limited to the specific embodiments shown and described.

[0043] In the following, for purposes of understanding, elements of the embodiments are described in terms of operations, however it will become apparent that each element is configured to perform the functions that are described as being performed by it.

[0044] Moreover, the subject matter of the present disclosure is not limited to the embodiments only, but also includes any other combination of features described herein or recited in mutually different dependent claims.

[0045] The provided techniques use a ciphertext that includes one or more mask and body polynomials. The mask and body polynomials may be defined, for example, as polynomials modulo a quotient polynomial p(X) on R[X] / (p(X)), where R may be a ring or associated with a ring, for example:

number

number

[0046] For example, the ciphertext is:

number

number

number

number

[0047] In the above example, s' is a symmetric key, e.g., a key that can be used for both encryption and decryption. Throughout this specification, as an example, a symmetric private key is used, in which case the private key is used as both the encryption key and the decryption key. The ciphertext may be used in an asymmetric setting as well, e.g., by using s' as a private key, e.g., a decryption key, and providing an encryption of zero as a public key, e.g., an encryption key, e.g., using the techniques of R. Rothblum, "Homomorphic encryption: From private-key to public-key," Theory of Cryptography (TCC 2011), vol. 6597 of Lecture Notes in Computer Science, pp. 219-234, Springer, 2011. However, in such cases, a private decryption key s' is typically used to compute a compressed representation of the ciphertext from the plaintext according to the techniques provided.

[0048] For example, the ciphertexts may be GLWE-based ciphertexts in the sense that their security is based on the cryptographic strength of the Generalized Learning with Errors (GLWE) problem. The particular case where k=1, e.g., one mask polynomial is used, is also called the RingLWE (RLWE) problem. The dimension of the polynomial ring used is greater than 1, e.g., the GLWE-based ciphertexts used herein are not Learning with Errors (LWE) ciphertexts.

[0049] In particular, a polynomial can be written on a discretized torus, say for a positive integer q, as

number

number

number

number

number

number

number

[0050] Such polynomials on the discretized torus can be multiplied with a multiplicand polynomial from the corresponding ring of polynomial quotients. More precisely,

number

number

number

number

number

number

number

number

[0051]

number

number

number

number

number

number

number

number

number

number

[0052] Discretized tori are frequently used in so-called TFHE-like schemes, whereby the scheme is meant to support programmable bootstrapping operations. In such schemes, encryption computations may be performed on LWE-based ciphertexts, e.g., GLWE-based ciphertexts whose mask polynomials and body polynomials are scalar-valued. As part of such computations, programmable bootstrapping may be applied to such LWE-based ciphertexts, as described elsewhere. This programmable bootstrapping may involve a GGSW-type ciphertext encrypting digits, e.g., bits of an LWE private key, where the ciphertext may be defined on a discretized torus, e.g., as described above.

[0053] The programmable bootstrap operation in TFHE-like schemes makes them an attractive choice for a wide range of applications. Because bootstrapping is relatively efficient compared to many other FHE schemes, it is more suitable for performing relatively complex calculations, for example, with a depth of at least 10, at least 50, or at least 100 multiplications. In particular, the cryptographic parameters of TFHE-like schemes can be selected based on the required precision and the resulting computational cost, independent of the amount of homomorphic operations and the depth of their circuits. In contrast to other FHE schemes, bootstrapping can be very inefficient, so in practice these schemes are typically applied levelled, meaning that their parameters are selected according to a given calculation so that it can be performed without the need for bootstrapping. Such levelled approaches are not suitable for more complex calculations, and therefore TFHE-like schemes are particularly beneficial in such cases.

[0054] For example, a bootstrapping key for a TFHE-like encryption scheme may include n GGSW-type ciphertexts that encrypt key digits of an LWE private key, where typically n is at most 1000 or at most 640, e.g., n=630. The GGSW-type ciphertexts may include, for example, l=3 GLWE-based ciphertexts, each including k=1 mask polynomials (e.g., RLWE may be used) and one body polynomial. The dimension of the polynomial ring may be chosen as N=1024, and the cardinality q associated with the polynomials may be, for example, q=2 64 may be also possible.

[0055] However, other parameters are possible, as known per se. In general, the security of a GLWE-based ciphertext is based on the distribution of the secret key and on three main parameters: n=kN, where N is the dimension of the polynomial ring, k is the number of random elements in the ciphertext, n is the length of the secret key; q is the cardinality of the set on which the polynomial is defined; and σ is a statistical parameter of the noise, for example its standard deviation. Given these parameters, methods for estimating the degree of security provided are known per se, see for example M. Albrecht et al., "On the concrete hardness of Learning with Errors," Journal of Mathematical Cryptology, 9(3):169-203, 2015 (incorporated herein by reference).

[0056] In the embodiments herein, the parameters of the TFHE-like LWE-based and GLWE-based ciphertexts used may be selected based on the desired security level and the desired accuracy of operations such as linear combination of LWE ciphertexts and / or application of programmable bootstrapping, in other words, the noise level resulting from applying these operations. Interestingly, in the TFHE setting, the security parameters may be selected independently of the computational complexity, e.g., independently of the multiplication depth of the computation. This is not the case for non-TFHE-like schemes, in which case the security parameters are typically selected to limit or exclude bootstrapping.

[0057] In particular, the LWE-based ciphertext and / or GLWE-based ciphertext used in the TFHE setting herein may use a relatively small modulus, e.g., at most 32 bits, at most 64 bits, or at most 128 bits. This modulus is typically selected independently of the computation to be performed, e.g., selected according to the desired precision and / or efficiency. The parameters N, k, and / or σ may be selected to achieve a desired level of security, typically independent of the computation to be performed. For example, N may be set to at least 512, and / or at most 2048 or 4096, e.g., 1024. For example, in an embodiment, RLWE is used with N at least 512, and / or at most 2048 or 4096, e.g., 1024, and k=1. Such values ​​of N are typically not used in non-TFHE-like encryption schemes, as such values ​​would severely limit the computations that can be performed; instead, in non-TFHE-like schemes, q and N are typically both selected based on the desired level of security, such that q can be much larger.

[0058] FIG. 1a illustrates generally an example embodiment of a device 110 for use in cryptographic computations, for example for computing a representation of a ciphertext or for performing a cryptographic computation using such a ciphertext.

[0059] The device 110 may comprise a processor system 130, a storage 140, and a communication interface 150. The storage 140 may comprise local storage, e.g., a local hard drive or electronic memory. The storage 140 may comprise non-local storage, e.g., cloud storage. In the latter case, the storage 140 may comprise a storage interface to the non-local storage. For example, the storage 140 may be for storing data representing a plaintext to encrypt and / or a ciphertext that encrypts the plaintext. Such a ciphertext may include one or more random mask polynomials and a Bode polynomial derived from the mask polynomial and the plaintext. The ciphertext may be stored in the storage 140 in the form of a Fourier domain representation of a pseudorandom number generator seed and a Bode polynomial, as described in more detail elsewhere.

[0060] The device 110 may communicate internally with other devices, external storage, input devices, output devices, and / or one or more sensors via a computer network. The computer network may be the Internet, an intranet, a LAN, a WLAN, etc. The computer network may be the Internet. The device may optionally include a connection interface 150, which is configured to communicate with other devices as needed. For example, the connection interface may include a connector, e.g., a wired connector, e.g., an Ethernet connector, an optical connector, or a wireless connector, e.g., an antenna, e.g., a Wi-Fi, 4G, or 5G antenna. Communications, e.g., internal communications, may use other communication protocols or media, e.g., an internal data bus.

[0061] In device 110, communication interface 150 may be used to transmit or receive digital data. For example, device 110 may be configured to receive or transmit data representing ciphertext, such as a seed and a Bode polynomial expressed in the Fourier domain. For example, the device may be configured to generate and transmit the data or receive the data and use the data in a cryptographic calculation, such as as part of a bootstrapping key.

[0062] Execution of device 110 may be implemented in a processor system 130, e.g., one or more processor circuits, such as a microprocessor, examples of which are provided herein. Device 110 may include multiple processors, which may be distributed in different locations. For example, device 110 may use cloud computing.

[0063] The device 110 may be used to compute a representation of a ciphertext from the stored plaintext, in which case the processor system 130 may be configured to generate the ciphertext. To this end, the processor system 130 may be configured to obtain a seed for a pseudorandom number generator. The processor system 130 may be further configured to randomly generate a mask polynomial by generating a representation of the mask polynomial in the Fourier domain of a number theoretic transform using the pseudorandom number generator according to the seed. The processor system 130 may be further configured to apply an inverse of the number theoretic transform to an evaluation of the mask polynomial to determine coefficients of the mask polynomial. The processor system 130 may be further configured to use the plaintext and determine coefficients of a Bode polynomial such that the ciphertext encrypts the plaintext. The processor subsystem 130 may be further configured to apply a number theoretic transform to the coefficients of the Bode polynomial to determine a representation of the Bode polynomial in the Fourier domain. The processor system 130 may be further configured to output a representation of the ciphertext. The representation may include the seed and a representation of the Bode polynomial in the Fourier domain. For example, the representation may be output by storing the representation on storage 130 and / or transmitting the representation to another party via communications interface 150.

[0064] As an alternative to computing the representations, the device 110 may be used to perform cryptographic calculations using such representations. In this case, the processor system 130 may be configured to obtain respective multiplicand polynomials for multiplication with the mask polynomial and the Bode polynomial, e.g., as a result of a previous operation of the cryptographic calculation being performed. The processor system 130 may be further configured to unfold stored data representing the ciphertext. The stored data may include a seed for a pseudorandom number generator and a representation of the Bode polynomial in the Fourier domain of the number theoretic transformation. The unfolding may include generating a representation of the mask polynomial in the Fourier domain using the pseudorandom number generator according to the seed. The processor system 130 may be further configured to compute polynomial products of the mask polynomial and the Bode polynomial and the respective multiplicand polynomials. The polynomial products may be computed in the Fourier domain to result in a Fourier domain representation of the computed polynomial products. The processor system 130 may be further configured to output the computed polynomial products, e.g., for use in the remainder of the cryptographic calculation.

[0065] Some of the figures show functional units that may be functional units of a processor system. For example, the figures may be used as blueprints for possible functional organization of a processor system. The processor circuitry is not shown separately as a unit in most of the figures. For example, the functional units shown in Figures 2, 3a, 3b, 4a, and 4b (see below) may be implemented in whole or in part in a device such as device 110, e.g., computer instructions stored in an electronic memory of device 110 and executable by a microprocessor of device 110. In a hybrid embodiment, the functional units are implemented partly in hardware, e.g., as a coprocessor, e.g., a computational and / or cryptographic coprocessor, and partly in software stored and executed on device 110.

[0066] For example, device 110 may be a device for performing cryptographic calculations. The cryptographic calculations may use homomorphic encryption. For example, device 110 may be used to perform cryptographic calculations, e.g., the device may perform the calculations even though the data has been received in encrypted form, e.g., from a data provider, and even though device 110 is unable to decrypt the data. The calculations may involve multiplication of ciphertexts with respective polynomials as described herein, e.g., as part of programmable bootstrapping.

[0067] For example, storage 140 may store encrypted data items, e.g., received from one or more data providers or generated as intermediate or final results of computations, e.g., output. Typically, most or all data items on which device 110 performs computations are encrypted with a key(s) unknown to device 110. That is, device 110 may not be configured to obtain plain data items corresponding to encrypted data items, e.g., those stored in storage 140. The encryption / decryption keys may be available in encrypted form, while the decryption key in plaintext form is secret to device 110. For example, the processor system may be configured to perform a sequence of homomorphic encryption operations, which may include arithmetic operations, such as addition and multiplication, on encrypted values, but may also include arithmetic operations on encrypted polynomials. The homomorphic operations may also include operations such as key switching, bootstrapping, etc.

[0068] Figure 1b illustrates generally an example embodiment of a cryptographic computation system 100. System 100 is configured to perform cryptographic computations using homomorphic encryption, for example fully homomorphic encryption.

[0069] The system 100 of this example comprises a key generation device 111, a data provider device 160, and an encryption computing device 112. The key generation device 111 and the data provider device 160 may be combined into a single device. The device 112 may be configured to receive encrypted data items from the data provider 160. At least one or more data items may be received in encrypted form. One or more data items may be received in plain format. Computations may be performed on the received data items and may also be performed on the stored data items. Interestingly, computations may be performed on the encrypted data without decrypting the data, e.g., without converting the encrypted data items to data in plain format.

[0070] Devices 111 and / or 112 in this example may each be based on device 110 of FIG. 1a and may, for example, each include processor system 130, storage 140, and / or communication interface 150 of FIG. 1a.

[0071] In this example, device 111 includes a key generation unit 131 implemented, for example, by a processor system of device 111. Key generation unit 131 is configured to generate a bootstrapping key 156 for use by cryptographic computing device 112. Bootstrapping key 156 may include a number of GLWE-type cryptograms. Key generation unit 131 may be configured to generate these cryptograms to determine bootstrapping key 156 using techniques provided herein. Device 111 may provide bootstrapping key 156 to device 112, for example, by transmitting bootstrapping key 156 over computer network 150, uploading bootstrapping key 156 to shared storage, etc.

[0072] In this example, the device 112 includes an encryption calculation unit 132 implemented, for example, by a processor system of the device 112. The encryption calculation unit 132 may be configured to perform encryption calculations. The encryption calculations may involve bootstrapping of the encrypted values, in particular programmable bootstrapping. To perform bootstrapping, the encryption calculation unit 132 may use a bootstrapping key 156 that the encryption calculation unit 132 obtained from the device 111, for example received via the network 150, or retrieved from a shared storage. The bootstrapping may involve multiplying the mask polynomial and the body polynomial of the GLWE-based ciphertext of the bootstrapping key 156 with the respective multiplicand polynomials. The encryption calculation unit may perform these multiplications as described herein. The encryption calculations may include many other operations as known per se, for example the device 112 may be configured to evaluate an arithmetic circuit, evaluate a neural network on the encrypted data, etc.

[0073] Although not shown in this figure, the cryptographic computation system 100 may include multiple cryptographic computing devices, for example, two, three, or more than three. The cryptographic computation may be distributed among the multiple cryptographic computing devices. The cryptographic computing devices may typically exchange encrypted intermediate computation results with each other. Each cryptographic multiplication device may be implemented like the cryptographic computing device 112 and may perform multiplication of ciphertext by a polynomial as described herein.

[0074] Homomorphic encryption schemes may be applied in many settings. For example, the encrypting computing device 112 may be operated by a cloud provider. The cloud provider may provide computation and storage services to its clients. By employing homomorphic encryption, the data provider device 160 of FIG. 1b, e.g., the clients of the cloud provider, may transmit their data in encrypted form. The cloud provider may still perform the necessary computations and / or necessary storage, but may not know what corresponds to the plain data. For example, the data provider device 160 may use a type of encryption key that corresponds to the particular homomorphic encryption system used to encrypt the data item. When the computation results are received by the data provider 160 from the encrypting computing device 112, the corresponding decryption key may be used to decrypt the encrypted data item. The encryption key and the decryption key may be, and typically are, the same.

[0075] For example, the cryptographic computing system 100 may be configured to train a machine learning model, such as an image classifier, for example a medical model, even though the cryptographic computing device does not have access to the plain data items. For example, linear regression may be performed on the input data, perhaps without bootstrapping. For example, backpropagation may be performed on the input data, perhaps with bootstrapping. The resulting model parameters may be returned to the entity that owns the decryption key. This allows multiple providers of medical data to pool their data by sending the data to a cloud provider. The cloud provider then returns the model parameters even though the cryptographic computing device does not have access to the plain data. The encryption key may be equal to the decryption key.

[0076] After the model has been trained, the encryption computing system 100 may be used to provide the model for use with, for example, medical data. This may be done with plain model parameters or encrypted model parameters, and in both cases may be done with encrypted data, e.g., encrypted input, intermediate and output data. Using plain model parameters is usually much more efficient. In both cases, the effect of the system is that computations, such as image classification, e.g., medical image classification, may be done without the computer knowing the plain data items. For example, a mammogram may be evaluated for cancer without the image even being plain in the encryption computing device 112, and without any encryption computing device 112 or cooperation of such devices knowing what the outcome of the cancer evaluation is. From a privacy perspective, it may be permissible to operate a plain model on encrypted privacy-sensitive data, but not on plain privacy-sensitive data.

[0077] Other applications involve, for example, database services that look up encrypted data in an encrypted database, where the calculation may be, for example, a comparison between an input item and a database item. For example, multiple calculations may be combined to produce a database index that matches the index. For example, the database may be a genomic database and the input may be a gene sequence. For example, the system 100 may be used for secured control of devices. For example, a device, even a large-scale device such as a power plant, may send sensor values ​​to the encrypted computing device 112 and receive an encrypted control signal in return. The control signal is computed from the sensor signal. An attacker of the system may be able to determine the content of the data going into one or more of the encrypted computing devices 112 and the content of the data coming from one or more of the encrypted computing devices 112, and may even be able to access intermediate data of these devices, but that does not help the attacker because the data is encrypted. Since the decryption keys are unknown to these devices, even a complete break of all of the encrypted computing devices 112 of the system 100 would not reveal the data. Computing the control signal may involve mathematical operations such as linear algebra, averaging, matrix multiplication, polynomial evaluation, etc. All of this can be performed together with homomorphic encryption operations.

[0078] For example, a pool of encrypted data items may be maintained in the cryptographic computing system; a subset of these may be received and another subset may be the result of the encrypted computation, e.g., intermediate results. For example, the cryptographic computing device 112 may be configured to apply a homomorphic encryption operation to one, two, or more encrypted data items in the pool, which may be, for example, a collection of input values ​​and / or intermediate values ​​and / or output values. The result may be a new encrypted data item that may be stored in the pool. The pool may be stored in the storage of the cryptographic computing system, which may be a local storage or a distributed storage. In the latter case, it may happen that one or more encrypted data items are represented multiple times in the pool. The encrypted data items may be transmitted, for example, from one computing device to another computing device when their values ​​are needed elsewhere. The pool may be realized in various ways, for example, as a register file, an array, various data structures, etc.

[0079] The encrypted data items may represent all kinds of data. For example, the encrypted data items may represent numbers that need to be averaged, or used for linear regression, etc. For example, the encrypted data items may represent an image. For example, each pixel of the image may correspond to one or more encrypted data items. For example, a grayscale pixel may be represented by a gray level, which may in turn be represented by a single encrypted data item. For example, 256 gray levels may be encoded with a single encrypted data item. For example, a color pixel may be represented as multiple color levels, e.g., RGB levels, which may in turn be represented by a tuple of encrypted data items. For example, three 256 levels of color may be encoded with three encrypted data items. How many encrypted data items are used to represent a certain type of data depends on the capabilities of the homomorphic encryption scheme. For example, a more restrictive homomorphic encryption scheme may only be able to encode one bit per encrypted data item. In that case, one color pixel may require 24 encrypted data items.

[0080] A set of homomorphic encryption operations may be defined for a computation. For example, from the homomorphic encryption operations, a network or circuit of operations that perform the computation together may be constructed, for example, by an external compiler device or the computing device itself. For example, the operations may include Boolean operations. The way in which the homomorphic encryption operations are combined, e.g., which operations are applied to which operands in the pool, determines the computation being performed. For example, a computation may be represented as a list of homomorphic encryption operations on which the operation should be performed, along with an indication of the encrypted data items on which the operation should be performed. The network or circuit may indicate to the encryption computing device 112 when to perform programmable bootstrapping, or the encryption computing device 112 may initiate programmable bootstrapping when it finds that the encrypted values ​​are, or will be, too noisy.

[0081] FIG. 2 shows a schematic example of an embodiment of a method for computing the polynomial product of two polynomials f(X) and g(X). The two polynomials in this example are defined modulo the quotient polynomial p(X). Some examples described in connection with this diagram are known per se and are described, for example, in J. von zur Gathen and J. Gerhard, "Modern Computer Algebra", Cambridge University Press, 2003, Chapter 8 (incorporated herein by reference). This diagram shows the multiplication of polynomials in coefficient form, which results in a product of polynomials in coefficient form. This multiplication has several components: a number-theoretic transformation, an inverse of the number-theoretic transformation, and a multiplication in the Fourier domain. Various embodiments of other diagrams may use the components of this diagram, although in different configurations.

[0082] For example, the figure shows f(X)=Σ i f i X i Coefficient f of mod p(X) i and g(X)=Σ i g i X i Coefficient g of mod p(X) i , where f is the coefficient domain, and g is the coefficient domain.

[0083] To multiply polynomials, a number theoretic transform NTT 233 may be applied to transform the polynomials into the Fourier domain. The diagram shows a Fourier domain representation 242 of polynomial 241 and a Fourier domain representation 244 of polynomial 243. Typically, the Fourier domain representation of polynomials 241, 243 involves evaluation of the polynomials at powers of a primitive root of unity from a finite ring, e.g., from which the coefficients of polynomials 241, 243 are selected or to which they correspond. As demonstrated in the examples below, the Fourier domain representation may include all M powers of the primitive M-th root of unity, e.g., or may include only a strict subset of the powers. In some examples, there is a one-to-one correspondence between the coefficient representation 241 and the Fourier representation 242 of polynomial mod p(X), although this is not required, e.g., NTT 233 may map a set of coefficients to a subset of possible Fourier representations 242.

[0084] Given the Fourier domain representations 242, 244, the polynomial product of the polynomials can be computed in the Fourier domain in operation Mul 238. This is typically implemented as a point-wise multiplication of the evaluations of the polynomials. Point-wise multiplication is performed by multiplying the polynomial X for a value n, which corresponds to the quotient polynomial, as highlighted in the following example: M may correspond to respective multiplications modulo −1. As a result, a Fourier domain representation 246 of the product of polynomials f and g may be obtained, for example, as the evaluation of the quotient polynomial in a set of powers of a primitive root of 1.

[0085] The inverse INTT234 of number theoretic transform 233 is the coefficient form h(X)=Σ i h i X i mod p(X), may be applied to a Fourier domain representation 246 of the product polynomial to obtain a representation 245 of the product polynomial of X. Interestingly, the INNT 234 may be applied to a Fourier domain representation 246 of the product polynomial to obtain a representation 245 of the product polynomial of X mod p(X). Interestingly, the INNT 234 may be applied to a Fourier domain representation 246 of the product polynomial to obtain a representation 245 of the product polynomial of X mod p(X). iquotient polynomial, and may have the property that it results in random polynomials 245 with the same distribution as randomly generating p(X). This may be particularly true when there is a one-to-one mapping between the Fourier domain representation 246 and the coefficient representation 245, e.g., when the Fourier domain representation contains a number of elements equal to the number of coefficients of the polynomial, e.g., equal to the degree of the quotient polynomial, and as shown in the example below, this may also be true when the Fourier domain representation is larger. For example, the number of Fourier domain representations 246 that map to a given polynomial 245 mod p(X) in the coefficient representation may be the same for each polynomial 245.

[0086] In general, various number theoretic transforms are known per se and may be used in combination with the techniques described herein, for example the discrete Fourier transform, in its standard form; Schönhage's algorithm, and Nussbaumer's algorithm.

[0087] Some specific examples of number theoretic transforms and their corresponding Fourier domain representations are provided here. In general, these examples relate to polynomials over finite rings or tori. As illustrated below, there may be a correspondence between random polynomials and random Fourier domain representations. On the other hand, when using classical Fourier transforms instead of number theoretic transforms, such as TFHE schemes such as "fast fully homomorphic encryption over the torus", the infinitely sized field of complex numbers is not possible.

number

[0088] Example 1: Quotient polynomial X M -1 In general, let R be a ring. Let ω∈R be a primitive M-th root of unity for integers M>1. Let f, g∈R[X] / (X MWhen (-1) is given, their product can be calculated by the number-theoretic transform, also known as the discrete Fourier transform. Details can be found in Chapter 8 of "Modern Computer Algebra".

[0089] When applying the number-theoretic transform, for a polynomial f := f(X) = f 0 + f 1 X + ··· + f M-1 X M-1 ∈ R[X], it can be identified with its coefficient vector (f 0 , f 1 ,..., f M-1 ) ∈ R M . The number-theoretic transform 233 of the polynomial f regarded as a vector in R M can calculate the vector including the evaluation of f at successive powers of ω:

Number

[0090] Here, consider polynomials f, g ∈ R[X] / (X M - 1) (thus of degree < M). Since multiplication modulo X M - 1 is convolution (e.g., fg ≡ f * g (mod X M - 1)), the product h := fg ∈ [X] / (X M - 1) can be obtained as h = DFT ω -1 (DFT ω (f) · DFT ω (g)) Here, DFT ω -1 denotes the inverse number-theoretic transform, and DFTω (f)·DFT ω (g) is the pointwise multiplication Mul238. Interestingly, the inverse DFT can be computed for any polynomial h ∈ R[X] of degree < M as

Number

[0091] In this example, when the ring R is finite, there is a one-to-one correspondence between polynomials and their Fourier domain representations

Number

[0092] Example 2: Quotient polynomial p(X)|X M -1 In this example, the quotient polynomial p := p(X) can be any polynomial p(X) that divides X M - 1. Here again, ω ∈ R can be a primitive M-th root of unity. In this case, the product of two polynomials f, g ∈ R[X] / (p) is: - Perform NTT233 as in the above example, where f and g are considered as polynomials in R[X] / (X M - 1); - Perform Mul238 as in the above example and compute the Fourier representation of h’ := fg (mod X M - 1) as h’ = DFT ω -1 (DFT ω (f)·DFT ω (g)) - Perform INTT234 by computing the coefficient representation of h’ as above and return h = h’ mod p as the product of f and g in R[X] / (p) can be obtained by.

[0093] There is no need to perform a reduction h=h' mod p in INNT234. For example, M The coefficients may be returned modulo -1, in which case for security purposes it may be desirable to randomize the returned coefficient representation by adding a random multiple r(X)p(X) of the quotient polynomial.

[0094] Furthermore, it should be noted that when performing NTT 233 on polynomials f, g, it is possible to randomize the obtained Fourier domain representations 242, 243 by adding random multiples of the quotient polynomial to f and / or g.

[0095] In this example, p(X) is the M It may be an exact divisor of −1, e.g., it may have a degree smaller than M, but p(X)=X M -1 can also be considered as an example in this case.

[0096] Denote the degree of p(X) as N, then the coefficient representation of the polynomial may contain N elements, and the Fourier domain representation may contain M elements. If M=N, then there is a one-to-one mapping between the Fourier domain representation and the coefficient representation of the polynomial modulo p(X). If M>N, then there is a one-to-one mapping between the Fourier domain representation and the polynomial mod (X M -1), but not between the Fourier domain representation and the polynomial mod p(X). Interestingly, however, the operation h=h' mod p in INTT 234 may ensure that each coefficient representation 245 of the polynomial mod p(X) has an equal number of corresponding Fourier domain representations 246.

[0097] In the following example, (X M -1) / (X d-1), where M=hd and d=MN. As mentioned above, in the following examples, R may be finite and ω may be a primitive M-th root of 1. For such quotient polynomials, the techniques of the above examples may be used, but interestingly, more efficient polynomial multiplication is also possible by defining a Fourier representation that includes evaluations at only a subset of the powers of the primitive n-th root of 1. This is demonstrated below for the cases h=2 and h=3, but the example easily generalizes to higher values ​​of h. However, the greater the size reduction of the Fourier representation, the smaller the value of h, which is why the cases h=2 and h=3, and especially the case h=2, are preferred.

[0098] Example 3: M=2N, p(X)=X N +1 f, g ∈ R[X] / (X N +1), f j ∈R

number

number

number

number

number

[0099]

number

number

[0100] Thus, in this example, the NTT operation 233 is the operation

number

number

number

number

[0101] In this example, there is a one-to-one correspondence between the coefficient representations 241, 243, 245 and the Fourier domain representations 242, 244, 246:

number

[0102] Example 4: M=3N / 2 (N is an even number), p(X)=X N +X N / 2 +1 f, g ∈ R[X] / (X N +X N / 2 +1), f j ∈R

number

number

number

number

[0103] Similarly, g 1,j * =g j ω j +g N / 2+j ω N / 2+j ∈R

number

number

[0104] η:=ω 3 which is a primitive (N / 2)th root of 1. For i∈{1,2}, h i * :=f i * g i * mod (XN / 2 -1) is h i * =DFT η -1 (DFT η (f i * )·DFT η (g i * )) The polynomial h can be calculated as i :=f i g i mod ((ω 3-i X) N / 2 -1) for i ∈ {1,2}: h i,j =h i,j * (ω i ) -j ∈R,

number

number

[0105] Therefore, in this case, the number theoretic transformation operation 233 is

number

number

number

number

[0106] In this example, there is again a one-to-one correspondence between the coefficient representations 241, 243, 245 and the Fourier domain representations 242, 244, 246:

number

[0107] 3a shows a schematic example of an embodiment of an encryption unit 331 for computing a representation of a ciphertext 344-345 by encrypting a given plaintext. For example, the encryption unit 331 may be used in a key generation unit 131 of a key generation device 111 or in another encryption computing device 110.

[0108] The ciphertext may include one or more mask polynomials and a Bodie polynomial. For example, the ciphertext may be a GLWE-based ciphertext. The computed representations 344-345 may be for use in an encryption computation method, for example, as described with respect to Figures 1b, 3b, 4a, and 4b. As described elsewhere, such encryption computation methods may involve multiplying the mask polynomials and the Bodie polynomials with respective multiplicand polynomials. As demonstrated in the example of Figure 2, such polynomial multiplications may be performed efficiently if the mask polynomials and the Bodie polynomials are represented in the Fourier domain of number theoretic transformations. It is therefore desirable to provide a representation of the ciphertext that is compressed but can be efficiently expanded into such a Fourier domain representation while still ensuring that the ciphertext follows the probability distribution of the encryption scheme. Such a representation may be provided by the encryption unit 331.

[0109] The figure shows the plaintext m347 to be encrypted. The plaintext may be a polynomial from the polynomial ring in which the mask polynomial and the body polynomial are defined. For example, the plaintext may be an encoding of one or more numbers, bits, characters, strings, etc. as a polynomial.

[0110] The figure also shows an encryption unit Enc 336, which receives as input a mask polynomial a in coefficient form 1 , ..., a k The encryption unit 336 may take as input a mask polynomial 341 and plaintext m 347 and may determine a body polynomial b 343. The encryption unit 336 may also take as input a secret key (not shown in this figure) to encrypt the plaintext 347. The encryption unit 336 may determine the coefficients of the body polynomial 343 such that the ciphertext formed by the mask polynomial 341 and the body polynomial 343 encrypts the plaintext 347. The encryption unit 336 may be a conventional encryption unit. For example, the unit may

number

[0111] Additionally, a pseudorandom number generator seed S345 is shown. The seed 345 may be included in the representation of the ciphertext being determined. As shown in the figure, the seed may be randomly generated by a random number generator Rnd 337, e.g., a hardware random number generator or a pseudorandom number generator (preferably a cryptographic PRNG). However, the seed may also be obtained differently, e.g., the seed may be received from another device, or the seed may represent the state of the pseudorandom number generator, e.g., after having previously been used to generate other random numbers.

[0112] A pseudo-random number generator (PRNG) Gen 335 is also shown. The PRNG 335 may be configured to determine a sequence of random values ​​given a seed 345. The PRNG is preferably a cryptographic pseudo-random number generator (CPRNG). The PRNG may be used according to the seed 345 to randomly select a mask polynomial, for example by uniformly randomly generating a representation 342 of a mask polynomial of a Fourier domain of a number-theoretic transform from the Fourier domain. For example, the representation of the mask polynomial may include several mask polynomial evaluations in a set of evaluation values. The PRNG 335 may generate each evaluation sequentially. An example of a Fourier domain representation of a number-theoretic transform is described, for example, with respect to FIG. 2. The PRNG may be used to sample the Fourier domain representation using techniques known per se, for example by sampling bits from the PRNG and deriving random evaluations from those bits, for example by rejection sampling. Any cryptographically secure pseudorandom number generator may be used, for example a stream cipher, a counter model block cipher, the Yarrrow or Foruna PRNG.

[0113] Also shown is an INTT unit 334. The INNT unit 334 may be configured to apply an inverse number theoretic transform (INTT) to the mask polynomial evaluation 342 to determine the mask polynomial coefficients 341, for example, as described with respect to FIG. 2. Interestingly, the inverse number theoretic transform generates a uniformly random Fourier domain representation, and applying INNT may have the property that it leads to a uniformly random polynomial, in other words a polynomial with uniformly random coefficients. For example, there may be a one-to-one mapping between the polynomial's Fourier domain representation 342 and the coefficient representation 341. Thus, generating 335 the Fourier domain representation and applying INNT 334 may lead to a mask polynomial with the same random properties as randomly generating each of the mask polynomial's coefficients, which may be done conventionally.

[0114] The diagram further shows an NTT unit 333. The NTT unit 333 may be configured to apply a number theoretic transform (NTT) to the coefficients 343 of the Body polynomial to determine a Fourier domain Body polynomial representation 344, for example, as described with respect to FIG. 2. The Fourier domain representation 344 and a seed 345 may be used to represent the ciphertext. By storing the Body polynomial in the Fourier domain, it may be used directly for Fourier domain multiplication. It is also possible to store the Body polynomial in coefficient form, in which case a conversion to the Fourier domain may be performed at a later time when multiplication is required.

[0115] By repeatedly using the encryption unit 331, multiple ciphertexts may be generated. For example, the encryption unit 331 may be used to generate a GGSW-type ciphertext including multiple generated ciphertexts, as also described with respect to FIG. 4a. In such a case where multiple ciphertexts are generated, these ciphertexts may be based on the same seed 345. For example, a random seed generated or obtained by the unit 337 may be used to initialize the PRNG 335 once, and the PRNG may then be used to generate a mask polynomial 342 for each ciphertext based on the same seed 345. Thereby, the representations of the multiple ciphertexts in such a case share a common seed 345 that needs to be stored and / or transmitted only once when storing and / or transmitting a set of multiple ciphertexts, leading to further reducing storage and transmission bandwidth requirements.

[0116] Some detailed examples of determining the representations 344-345 are now given. The examples explain the generation of encryptions representing a bootstrapping key, but can be easily adapted to the generation of encryptions representing any other value.

[0117] First Example: Quotient Polynomial X N +1 This example is based on the corresponding example described with respect to FIG.

number

number

number

[0118] This example uses a primitive 2N-th root ω of 1. In this case, a particularly efficient multiplication based on number-theoretic transformations is possible, as will be explained with respect to FIG.

[0119] The modulus q is

number

number

[0120] The following shows how the encryption unit 331 can be used to generate a bootstrapping key for TFHE programmable bootstrapping. Such a bootstrapping key can include a GGSW-type ciphertext of a portion of a private key. The GGSW-type ciphertext itself is indexed by (i,r), with each value

number

[0121] 1.

number

[0122] 2. In Rnd operation 337, {0,1} к Draw a common seed σ345 uniformly at random in , where κ is a security parameter;

[0123] 3. In Gen 335, a cryptographic pseudorandom number generator

number

number

[0124] 4. For 1≦i≦n, 1≦r≦(k+1)l: - Polynomial Mask

number

number

number

number

number

number

[0125] 5. Representation of the common seed σ345 and Bodie polynomials

number

[0126] Second Example: Quotient Polynomial X N +X N / 2 +1 This example is based on the corresponding example described with respect to FIG. 2. In this example, the body polynomial and mask polynomial are

number

number

number

[0127] An advantage of using this quotient polynomial is that it can be used in combination with even values ​​of q, especially where q is a power of 2. This is advantageous for a variety of cryptographic applications.

[0128] In this example, q is chosen such that 3 is an identity in R, and the primitive root of 1, ω, is chosen as a primitive (3N / 2)th root of 1, e.g., N / 2 is a power of 3. In this case, R[X] / (X N +X N / 2 +1) allows particularly efficient multiplication of polynomials.

[0129] Using the notation from the previous example, a representation of the bootstrapping key can be generated as follows:

[0130] 1. Choose a positive integer q such that R contains a primitive (3N / 2)th root of 1: N is even. Choose a (3N / 2)th power primitive root ω modulo q. For example, q may be chosen such that λ(q) ∝ 3N / 2, where λ is the Carmichael totient function; gcd(q,3N / 2)=1.

[0131] 2. In Rnd operation 337, {0,1} к Draw a seed σ345 uniformly at random in

[0132] 3. Cryptographic pseudorandom number generator 335;

number

number

[0133] 4. For 1≦i≦n, 1≦r≦(k+1)l, - Polynomial mask by applying reciprocal theoretic transformation 334

number

number

number

number

number

number

[0134] 5. Representation of each ciphertext in terms of the seed and the Fourier domain representation of the Bodie polynomial, all with a common seed σ344

number

number

[0135] Example 3: Quotient polynomial p(X)|X M -1 In this example, the technique of the corresponding example of FIG. 2 may be used. When performing INNT 334, the coefficient representation a iIt is possible to obtain b(X) 341 mod p(X) and to compute the encryption Enc 336 mod p(X). As described with respect to Figure 2, when performing NTT 333, it is possible, but not required, to add a random multiple of p(X) to b(X) to randomize the Fourier domain representation 344.

[0136] Alternatively, INTT 334 can avoid the reduction modulo p(X). Thus, the polynomial 341 returned by INNT is a polynomial 342 modulo p(X). M Alternatively, the encryption Enc336 may be a polynomial modulo -1, which may be more computationally efficient in some cases. In this case, the encryption Enc336 is also the body polynomial b(X)343 mod X M X to get -1 M The Bode polynomial may be computed modulo −1 and NTT 333 may be applied to this Bode polynomial. In this case, it is desirable to randomize the Fourier domain representation 344, which is obtained by adding a random multiple of p(X) to b(X), either in the coefficient domain before applying NTT or in the Fourier domain after applying NTT.

[0137] FIG. 3 b illustrates generally an example of an embodiment of an encryption multiplication unit 332 , for use in, for example, the encryption computing device 110 .

[0138] The encryption multiplication unit 332 may operate on a ciphertext that includes one or more random mask polynomials and a Bode polynomial derived from the mask polynomials and the plaintext. For example, the ciphertext may be a GLWE-based ciphertext as described herein. The encryption multiplication unit 332 may operate on a ciphertext that is represented in a compressed manner by a pseudorandom number generator seed 345 and by a representation 344 of the Bode polynomial in the Fourier domain of a number theoretic transform. For example, the representation 344-345 of the ciphertext may be determined in advance by the encryption unit 331 of FIG. 3a, typically a part of a device different from the encryption multiplication unit 332.

[0139] The encryption multiplication unit 332 may be for multiplying the mask polynomial and the body polynomial of the ciphertext with the respective multiplicand polynomials. For example, the encryption multiplication unit 332 may be used in the encryption calculation to calculate the outer product, as also described in connection with FIG. 4a, or in various other operations of the encryption calculation, such as multiplication of a known polynomial with the ciphertext. The figure shows the respective multiplicand polynomials 351 multiplied with the mask polynomial and the body polynomial of the ciphertext. The respective multiplicand polynomials 351 may all be distinct, or the respective multiplicand polynomials 351 may all be equal to one common multiplicand polynomial, for example.

[0140] In the example shown in the figure, the multiplicand polynomials are obtained in coefficient representation 351 and a number theoretic transformation unit NTT 333 is used to apply a number theoretic transformation to convert the coefficients 351 of the respective multiplicand polynomial into a Fourier domain representation 352. The NTT unit may be as described with respect to Figure 2 or Figure 3a. Unit 332 is not required, for example the multiplicand polynomial may already be available in a Fourier domain representation, for example as a previous output of multiplication unit 332 or otherwise.

[0141] The representations 344-345 may be expanded to obtain a representation of the ciphertext 344-345 on which the multiplication may be performed. For this purpose, a pseudorandom number generator (PRNG) Gen 335 may be used according to a seed 335 to generate a representation 342 of the mask polynomial in the Fourier domain. The PRNG may be as described with respect to FIG. 2 or FIG. 3a.

[0142] Given the Fourier domain representations of the mask polynomial 342, the Body polynomial 344, and the multiplicand polynomial 352, the multiplication unit 338 may be used to calculate polynomial products of the mask polynomial 342 and the Body polynomial 344 with the respective multiplicand polynomial 352 in the Fourier domain. As a result, a Fourier domain representation 354 of the calculated polynomial products in the Fourier domain may be obtained. For example, the multiplication unit 338 may be the multiplication unit 238 of FIG. 2. Typically, the Fourier domain representation includes an evaluation of each polynomial in the set of evaluation values, and the multiplication 338 may be performed by point-wise multiplication of the polynomial evaluations, as known per se.

[0143] The encryption multiplication unit 332 may output the computed polynomial products in various formats as desired. For example, the polynomial products may be output in their Fourier domain representation 354, or, as shown in the figure, an INNT unit 334 may be used to apply an inverse number theoretic transform to convert some or all of the Fourier domain representations 354 of the computed polynomial products into coefficient representations 353. The INTT unit 334 may be, for example, as described with respect to FIG. 2 or FIG. 3a.

[0144] In cases where there is no one-to-one correspondence between the Fourier domain representation 354 and the coefficient domain representation 353, in some cases, extra randomization may be performed as also described with respect to FIG. 2. In particular, when the encryption multiplication unit 332 outputs a Fourier domain representation 354, randomization may be performed such that a random Fourier domain representation 354 of the product is output. For example, if the quotient polynomial p(X)|X M When using −1, this can be done by adding a random multiple r(X)p(X) of the quotient polynomial p(X) to the Fourier domain representation, e.g., generating the random multiple in the coefficient domain and transforming it to the Fourier domain using an FFT.

[0145] As explained for INTT234 in Figure 2, the quotient polynomial p(X)|X MIf -1 is used, there is no reduction modulo p(X), so X M It is also possible to output a coefficient domain representation 353 represented by a polynomial modulo -1. In this case, it is also desirable to randomize the output coefficient domain representation 353 by adding a random multiple r(X)p(X) of the quotient polynomial. The random multiple may be added in the Fourier domain before applying INTT 334 or in the coefficient domain after applying INTT.

[0146] The encryption multiplication unit 332 may be used to repeatedly perform polynomial multiplications on the same encryption 344-345. In such cases, the expanded representations 342, 344 of the ciphertext may be kept in memory and then used to compute further polynomial multiplications without having to apply the PRNG 335 again at this point, thus improving the efficiency of the further multiplications. However, to save memory, it is also possible to remove the Fourier domain representations 342 of the mask polynomials and regenerate them as needed.

[0147] 4a, for example, illustrates generally an example of an encryption multiplication unit 432 for use in the encryption computing device 110. The encryption multiplication unit 432 is used in this illustration to compute the outer product of a GGSW-type ciphertext 456 and a GLWE-based multiplicand ciphertext 455.

[0148] In general, a GGSW-based ciphertext 456 that encrypts a plaintext M(X) may include a collection of respective GLWE-based ciphertexts that encrypt respective values ​​based on the plaintext. A GGSW-based ciphertext that includes an RLWE-based ciphertext may also be referred to as an RGSW ciphertext.

number

[0149] For example, under private key s'

number

number

[0150] Note that in the literature, GGSW-type ciphertexts are also sometimes described as being based on a GLWE encryption of zeros, to which a value based on the plaintext is added. Such GGSW-type ciphertexts can also be considered to be GGSW-type ciphertexts that contain GLWE-based ciphertexts. For example, the TGGSW ciphertext of "TFHE: fast fully homomorphic encryption over the torus" is a GGSW-type ciphertext that contains a GLWE ciphertext. That is, a TGGSW-type ciphertext is

number

number

number

[0151]

number

number

number

number

[0152] For 1.1 ≤ h ≤ k,

number

number

[0153] Thus, the TGGSW ciphertext C may be viewed as a sequence of (k+1)l TGLWE ciphertexts, the value of which depends on the plaintext m being encrypted:

number

[0154] The diagram shows a representation 456 of the GGSW-type ciphertext. The GLWE-based ciphertext of the GGSW-type ciphertext may be represented by respective seeds 445 of a pseudorandom number generator (RPNG) and Fourier domain Bode polynomial representations 444 of number theoretic transforms, as described elsewhere. For example, the representations may have been determined by the encryption unit 331 of FIG. 3a. As shown in the diagram, the GLWE-based ciphertexts may share a common seed 445, e.g., the PRNG may be seeded by the seed 445.

[0155] To compute the outer product, the GLWE-based ciphertext representations 444-445 of the GGSW-type ciphertext 456 may be unfolded. For this purpose, a pseudorandom number generator 435, e.g., the PRNG 335 of Fig. 3a-b, may be used according to a common seed 445 or according to the respective seeds to generate a mask polynomial representation of the GLWE-based ciphertext 444 in the Fourier domain. This may be done as described in relation to Fig. 3b. As shown in the figure, an unfolded representation of the GGSW-type ciphertext in the Fourier domain may be obtained including the Fourier representations 442 of the respective mask polynomials and the Fourier representations 444 of the respective body polynomials.

[0156] As is known per se, the outer product of the GGSW-type ciphertext 456 with the GLWE-based multiplicand ciphertext 455 may be calculated by multiplying the mask polynomial and the body polynomial of the respective GLWE-based ciphertext 444 with the respective multiplicand polynomial 451 based on the GLWE-based multiplicand ciphertext 455.

[0157] The determination of the multiplicand polynomial 451 is shown in detail in the figure for the outer product case described, for example, in "CONCRETE: Concrete Operates on Ciphertexts Rapidly by Extending TfhE". In this case, the multiplicand polynomial is obtained by determining a so-called gadget decomposition GDec 439 of the GLWE-based multiplicand ciphertext 455. Computing the gadget decomposition may involve applying a coefficient-wise radix decomposition to the polynomial of the ciphertext 455, thereby obtaining a multiplicand polynomial with small coefficients, for example, in the range [-B / 2, B / 2]. This is shown in the figure, where the mask polynomial a of the ciphertext 455 is 1 is the polynomial a 1,1 , ..., a 1,l The body polynomial b is decomposed into polynomial b 1 , ..., b l In general, each multiplicand polynomial 451 can be obtained for each GLWE encryption of the GGSW-type ciphertext 456.

[0158] As in Figures 2 and 3b, to perform the multiplication by the multiplicand polynomial 451, the multiplicand polynomial may be converted by the NTT unit 433 into a Fourier domain representation of a number theoretic transformation 452. The multiplication may then be performed in the Fourier domain by the multiplication unit 438. The multiplication unit 438 may be based on the multiplication unit of Figures 2 and 3b, but in this case is configured to perform a matrix-vector multiplication of a 1x(k+1)l size vector of the multiplicand polynomial 452 and a (k+1)lx(k+1) size matrix of the polynomials 442, 444 representing the GGSW ciphertext 456.

[0159] In this example, the mask polynomials and body polynomials of a given GLWE-based encryption 444 are all multiplied by a common multiplicand polynomial of multiplicand polynomials 452, although different multiplicand polynomials could be used for different polynomials of GLWE-based encryption 442, 444 if desired.

[0160] The multiplication 438 may result in a mask polynomial and a body polynomial of the GLWE-based ciphertext 454 expressed in the Fourier domain. The ciphertext 454 may represent an encryption of the product of values ​​encrypted by the GLWE-based ciphertext 455 and the GGSW-type ciphertext 456. This product is also referred to as an outer product. The encryption may optionally be converted to a coefficient form 453 by the INTT unit 434 applying an inverse of a number theoretic transformation as in Figures 2, 3a, and 3b.

[0161] The outer product has a variety of uses, for example it may be used in the evaluation of a GGSW encryption circuit against a GLWE encrypted value, for example using circuit bootstrapping as described in "TFHE: Fast Fully Homomorphic Encryption over the Torus".

[0162] Another important application is to compute the cryptographic CMux gate, also known as the controlled selector gate or controlled multiplexer. The CMux gate may select a first GLWE-based ciphertext or a second GLWE-based ciphertext to an oblivious adversary based on a GGSW-type ciphertext by computing the product of the GGSW-type ciphertext and the difference of a first GLWE ciphertext and a second GLWE ciphertext, and adding the first GLWE ciphertext to the computed product. Mathematically, this is

number

number

[0163] In particular, the outer product may be used in a programmable bootstrapping operation of a homomorphic encryption scheme similar to TFHE. Programmable bootstrapping may use a bootstrapping key that includes a GGSW-type ciphertext 456. The provided technique is particularly advantageous in this case, since the bootstrapping key typically includes many of the GGSW-type ciphertexts used in such outer products. A particular example of programmable bootstrapping is described with respect to FIG. 4b.

[0164] In general, the TFHE bootstrapping key may include a portion of the secret key, e.g., a TGGSW encryption of each bit. Programmable bootstrapping may evaluate a decryption function that uses this secret key under encryption by computing the outer product of the TGGSW encryption. This is described, for example, in "Programmable Bootstrapping Enables Efficient Homomorphic Inference of Deep Neural Networks." As a detailed example,

number

number

number

number

number

number

number

[0165] The improved storage and bandwidth requirements of the compressed representation 456 of the GGSW ciphertext are shown based on the above bootstrapping key. In the above example, the bootstrapping key is

number

number

number

number

number

number

number

[0166] The compressed representation allows GLWE-based ciphertext to be represented using less storage. A GLWE-based ciphertext is represented using k+1 elements:

number

number

number

number

number

[0167] A pseudorandom number generator 435 may be used to recover the mask from the seed. For example,

number

number

number

[0168] Therefore, if we use the same seed σ445 to generate the Fourier domain representations of the n·(k+1)l TGLWE ciphertexts that form the n bootstrapping keys, they roughly divide the initial memory requirement by a factor of (k+1),

number

[0169] FIG. 4b illustrates, for example, a schematic example of a bootstrapping unit 460 for use in the cryptographic computing device 110. The bootstrapping unit 460 may apply a programmable bootstrapping operation to the LWE encryption 461 to obtain an output LWE encryption 469. The output LWE encryption 459 may contain an amount of noise that is independent of the noise in the input encryption 461. The unit 460 may therefore be used to reduce the noise in the input encryption 461. The output encryption 469 may encrypt the same value of the input encryption, but interestingly may also encrypt the result of applying a function to the input encryption 461. Such programmable bootstrapping is known, for example, from “Programmable bootstrapping enables efficient homomorphic inference of deep neural networks” (section “Programmable Bootstrapping” of that paper, which is incorporated herein by reference).

[0170] As shown in the figure, the programmable bootstrapping may include a blind rotation operation 464. The blind rotation operation may evaluate the LWE decryption on the exponent of a GLWE encrypted monomial, referred to herein as a bootstrapping monomial. In particular, the blind rotation may result in an encrypted polynomial product of the test polynomial and the bootstrapping monomial. The bootstrapping monomial may represent the plaintext value as an exponent. The blind rotation operation 464 may be performed in terms of an outer product, which may be computed as described herein, for example, by the encryption multiplication unit 432 of FIG. 4a. In particular, the blind rotation 464 may include computing an outer product of one or more GGSW-type ciphertexts included in the bootstrapping key 456, such as encryption of bits or other portions of the decryption key of the input encryption 461, with a GLWE-based multiplicand ciphertext based on the input encryption 461. By using the provided techniques, the computation of the outer product may be improved as described herein. The outer product may be computed as part of the controlled multiplexer of the blind rotation 464, for example, using the GGSW encryption of the bits of the LWE decryption key of the bootstrapping key 456 to obliviously select a GLWE-based ciphertext for a zero bit of the LWE decryption key or a GLWE-based ciphertext for a one bit of the LWE decryption key.

[0171] As shown, the blind rotation 464 may be preceded by a modulus switching operation in which the input encryption 461 is scaled to obtain a scaled input encryption 463. For example, as known per se, a quotient polynomial p(X)=X N Scaling to the domain [0,2N) may be applied using +1. For example, the components of the ciphertext may be scaled by 2N / q, e.g., each component may have the form

number

[0172] As known per se, the blind rotation 464 may use a test polynomial. In essence, the function being evaluated by programmable bootstrapping may be identified as a lookup table, with the pair (i, T[i]) for 0≦i≦N−1. The lookup table may be a test polynomial, e.g. ν i =T[i], and ν(X)=ν 0 +ν 1 X+···+ν N-1 X N-1 can be used to define the plaintext

number

number

[0173] Programmable bootstrapping, described in "Programmable bootstrapping enables efficient homomorphic inference of deep neural networks," uses a cyclotomic polynomial X N +1 polynomial, where N is a power of 2. Interestingly, the inventors have realized that programmable bootstrapping can also be used in combination with other quotient polynomials. To this end, the test polynomial can be used in a blind rotation 464 that is configured such that multiplying the test polynomial modulo the quotient polynomial with the bootstrapping monomial corresponding to the plaintext has as its constant (or other fixed) coefficient the desired function output for that plaintext.

[0174] In particular, to determine the test polynomial, techniques disclosed in European Patent Application EP21290080.7, filed July 12, 2021 by Zama, SAS, entitled "ENCRYPTED COMPUTATION COMPRISING A BLIND ROTATION" (incorporated herein by reference) may be used. As described therein, general techniques may be used to determine a test polynomial given a quotient polynomial, for example as described in the reference in section "Example test polynomial 4. Other quotient polynomials / coefficient" (incorporated by reference). As also described in the reference, a test polynomial may be used when the fixed coefficients are primal or constant coefficients and / or when the quotient polynomial is a trinomial X N ±εX N / 2 +1 can be determined particularly efficiently.

[0175] In particular, to program fixed coefficients, the coefficients of the test polynomial are

number

Number

[0176] When the quotient polynomial p(X) is a trinomial of the form p(X) = X N + εX N / 2 + 1 for an even N and ε ∈ {-1, 1}, the s-th coefficient for s < N / 2 is the following coefficient:

Number

[0177] Additional details and other examples of performing programmable bootstrapping where the quotient polynomial is not equal to X N + 1 are found in the above references and are incorporated by reference insofar as they relate to determining the quotient polynomial.

[0178] FIG. 5a schematically shows an example of an embodiment of a computer-implemented cryptographic computing method 500.

[0179] The method 500 may include storing data representing the ciphertext. The ciphertext may include one or more random mask polynomials and a Bode polynomial derived from the mask polynomials and the plaintext. The method 500 may include obtaining 520 respective multiplicand polynomials for multiplication with the mask polynomials and the Bode polynomials. The method 500 may include expanding 530 the stored data representing the ciphertext. The stored data may include a seed for a pseudorandom number generator and a representation of the Bode polynomial in a Fourier domain of a number theoretic transform. The expanding may include generating a representation of the mask polynomial in a Fourier domain using the pseudorandom number generator according to the seed. The method 500 may include calculating 540 polynomial products of the mask polynomials and the Bode polynomials and the respective multiplicand polynomials. The polynomial products may be calculated in the Fourier domain. The calculation may result in a representation of the calculated polynomial products in a Fourier domain. The method 500 may include outputting 550 the calculated polynomial product.

[0180] FIG. 5b illustrates in schematic form an example of an embodiment of a computer-implemented method 600 for computing a representation of a ciphertext. The representation may be for use in an encryption computation method according to any one of the preceding claims. The method 600 may include obtaining 610 a plaintext to encrypt. The method 600 may include generating 620 the ciphertext. The ciphertext may include one or more mask polynomials and a body polynomial. The generating 620 may include obtaining 621 a seed for a pseudorandom number generator. The generating 620 may include randomly selecting 622 a mask polynomial by generating a representation of the mask polynomial in a Fourier domain of a number theoretic transform using the pseudorandom number generator according to the seed. The generating 620 may include applying 623 an inverse of the number theoretic transform to an evaluation of the mask polynomial to determine coefficients of the mask polynomial. The generating 620 may include determining 624 a coefficient of a body polynomial using the plaintext such that the ciphertext encrypts the plaintext. Generating 620 may include applying a number theoretic transform to the coefficients of the Bode polynomial to determine a representation of the Bode polynomial in the Fourier domain 625. The method 600 may include outputting 630 a representation of the ciphertext, the representation including the seed and the representation of the Bode polynomial in the Fourier domain.

[0181] As will be apparent to one of ordinary skill in the art, many different ways of performing the methods 500, 600 are possible. For example, although the order of steps may be performed in the order shown, the order of steps may vary or some steps may be performed in parallel. Furthermore, other method steps may be inserted between the steps. The inserted steps may represent improvements to the method as described herein or may not be related to the method. For example, some steps may be performed, at least in part, in parallel. Furthermore, a given step may not be completely finished before the next step is started.

[0182] The method embodiments may be performed using software, the software including instructions that cause a processor system to perform the method 500 or 600. The software may include only those steps performed by a particular subentity of the system. The software may be stored on a suitable storage medium such as a hard disk, floppy, memory, optical disk, etc. The software may be transmitted as a signal along a wired or wireless line, or using a data network, such as the Internet. The software may be made available for download and / or remote use on a server. The method embodiments may be performed using a bitstream configured to configure a programmable logic, such as a field programmable gate array (FPGA), to perform the method.

[0183] The subject matter of the present disclosure should also be understood to extend to computer programs adapted to practice the subject matter of the present disclosure, in particular computer programs on or in a carrier wave. The programs may be in the form of object code, such as source code, object code, code intermediate source, and partially compiled form, or in any other form suitable for use in implementing the method embodiments. An embodiment relating to a computer program product includes computer executable instructions corresponding to each of at least one processing step of the described method. These instructions may be subdivided into subroutines and / or stored in one or more files that may be statically or dynamically linked. Another embodiment relating to a computer program product includes computer executable instructions corresponding to each of at least one device, unit, and / or part of the described system and / or product.

[0184] Typically, the devices described herein, for example in Figures 1a-1c, include one or more microprocessors that execute appropriate software stored in the system. For example, the software may be downloaded and / or stored in a corresponding memory, for example a volatile memory such as RAM or a non-volatile memory such as Flash. Alternatively, the system may be realized, in whole or in part, in programmable logic, for example a field programmable gate array (FPGA). The system may be realized, in whole or in part, as so-called application specific integrated circuits (ASICs), for example integrated circuits (ICs) customized for their specific application. For example, the circuits may be realized in CMOS, for example using hardware description languages ​​such as Verilog, VHDL, etc. In particular, the system may include circuits for evaluation of cryptographic primitives. The processor circuit may be realized in a distributed manner, for example as multiple sub-processor circuits. The storage may be distributed across multiple distributed sub-storages. Part or all of the memory may be electronic memory, magnetic memory, etc. For example, the storage may have volatile and non-volatile parts. Part of the storage may be read-only.

[0185] 5c shows a computer readable medium 1000 having a writable portion 1010 and a computer readable medium 1001 also having a writable portion. The computer readable medium 1000 is shown in the form of an optically readable medium. The computer readable medium 1001 is shown in the form of an electronic memory, in this case a memory card. The computer readable media 1000 and 1001 may store data 1020 which, when performed by a processor system, may represent instructions that cause the processor system to perform an embodiment of a method of performing calculations on LWE encrypted values ​​according to an embodiment.

[0186] Alternatively or in addition, the data 1020 may represent a ciphertext. The ciphertext may include one or more mask polynomials and a Bode polynomial derived from the mask polynomial and the plaintext. The data 1020 may include a seed for a pseudorandom number generator for generating a Fourier domain mask polynomial representation of a number theoretic transform, and a Fourier domain Bode polynomial representation. In particular, the data 1020 may represent a bootstrapping key for use in programmable bootstrapping, the bootstrapping key including a plurality of respective such ciphertexts, e.g., encrypting respective values ​​based on a programmable bootstrapping secret key.

[0187] The data 1020 may be embodied on the computer readable medium 1000 as a physical mark or by magnetization of the computer readable medium 1000. However, any other suitable embodiment is contemplated. Furthermore, while the computer readable medium 1000 is illustrated here as an optical disk, it should be understood that the computer readable medium 1000 may be any suitable computer readable medium, such as a hard disk, solid state memory, flash memory, etc., and may be non-recordable or recordable. The computer program 1020 includes instructions that cause a processor system to perform the method of performing calculations on LWE encrypted values.

[0188] Fig. 5d shows a schematic representation of a processor system 1140 according to an embodiment of a device for performing cryptographic calculations or for computing a representation of a ciphertext. The processor system comprises one or more integrated circuits 1110. The architecture of the one or more integrated circuits 1110 is shown in Fig. 6b. The circuit 1110 comprises a processing unit 1120, e.g., a CPU, for executing computer program components to perform the method according to the embodiment and / or to implement the modules or units thereof. The circuit 1110 comprises a memory 1122 for storing programming code, data, etc. Part of the memory 1122 may be read-only. The circuit 1110 may comprise a communication element 1126, e.g., an antenna, a connector, or both. The circuit 1110 may comprise a dedicated integrated circuit 1124 for performing part or all of the processing defined in the method. The processor 1120, the memory 1122, the dedicated IC 1124, and the communication element 1126 may be interconnected via an interconnect 1130, e.g., a bus. The processor system 1110 may be configured for contact and / or contactless communication using antennas and / or connectors, respectively.

[0189] For example, in an embodiment, the processor system 1140, e.g., a device for performing cryptographic calculations or for computing a representation, may comprise a processor circuit and a memory circuit, the processor being configured to execute software stored in the memory circuit. For example, the processor circuit may be an Intel Core i7 processor, an ARM Cortex-R8, etc. In an embodiment, the processor circuit may be an ARM Cortex M0. The memory circuit may be a ROM circuit, or a non-volatile memory, e.g., a flash memory. The memory circuit may be a volatile memory, e.g., an SRAM memory. In the latter case, the device may comprise a non-volatile software interface, e.g., a hard drive, a network interface, etc., configured to provide the software.

[0190] Although device 1110 is shown as including one of each of the described components, various components may be duplicated in various embodiments. For example, processor 1120 may include multiple microprocessors configured to independently execute the methods described herein, or configured to perform steps or subroutines of the methods described herein such that the multiple processors cooperate to achieve the functions described herein. Furthermore, when device 1110 is implemented in a cloud computing system, various hardware components may belong to separate physical systems. For example, processor 1120 may include a first processor in a first server and a second processor in a second server.

[0191] It should be noted that the above-described embodiments are illustrative rather than limiting of the subject matter of the present disclosure, and that those skilled in the art can design many alternative embodiments.

[0192] In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. Use of the verb "comprise" and its conjugations does not exclude the presence of elements or steps other than those defined in the claim. The article "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. Expressions such as "at least one of", when preceding a list of elements, denote the selection of all or any subset of the elements from the list. For example, the expression "at least one of A, B, and C" is to be understood as including A only, B only, C only, both A and B, both A and C, both B and C, or all of A, B, and C. The subject matter of the present disclosure may be implemented by hardware comprising several distinct elements, and by a suitably programmed computer. In device claims reciting several parts, several of these parts may be embodied by one and the same item of hardware. The mere fact that certain means are recited in mutually different dependent claims does not indicate that a combination of these means cannot be used to advantage.

[0193] In the claims, references in parentheses refer to the reference signs in the drawings of exemplary embodiments or to formulas of embodiments, thus increasing the clarity of the claims. These references should not be construed as limiting the claims.

Claims

1. A computer-implemented cryptographic computation method (500), comprising: storing (510) data representative of a ciphertext, the ciphertext including one or more random mask polynomials and a Bodie polynomial derived from the mask polynomials and the plaintext; obtaining (520) respective multiplicand polynomials for multiplication with the mask polynomial and the body polynomial; - expanding (530) stored data representing the ciphertext, the stored data including a seed for a pseudorandom number generator and a Fourier domain Bode polynomial representation of a number theoretic transform, the expanding including generating a Fourier domain mask polynomial representation using the pseudorandom number generator according to the seed; - calculating (540) polynomial products of the mask polynomial and the body polynomial with the respective multiplicand polynomials, the polynomial products being calculated in the Fourier domain to obtain a representation of the calculated polynomial products in the Fourier domain; outputting (550) the calculated polynomial products; The method (500).

2. 2. The method of claim 1, wherein the method includes performing programmable bootstrapping according to a bootstrapping key, the bootstrapping key comprising a GGSW type ciphertext, and wherein performing the programmable bootstrapping comprises computing an outer product.

3. The performing of programmable bootstrapping includes performing a blind rotation according to a test polynomial, the blind rotation computing a GLWE-type encryption of a monomial multiplied by the test polynomial modulo a quotient polynomial, the quotient polynomial being: Ｎ The method (500) of claim 2, wherein the first number is different from +1.

4. 4. The method (500) of claim 1, further comprising: computing an outer product of a GGSW-type ciphertext and a GLWE-based multiplicand ciphertext, the GGSW-type ciphertext comprising a plurality of GLWE-based ciphertexts, the method comprising multiplying a mask polynomial and a body polynomial of each GLWE-based ciphertext with a respective multiplicand polynomial that is based on the GLWE-based multiplicand ciphertext.

5. 5. The method (500) of claim 4, wherein the method includes obliviously selecting the first GLWE-based ciphertext or the second GLWE-based ciphertext based on the GGSW-type ciphertext by computing an outer product of the GGSW-type ciphertext and a difference of the first GLWE-based ciphertext and the second GLWE-based ciphertext, and adding the first GLWE-based ciphertext to the computed product.

6. 6. The method (500) of any one of claims 1 to 5, comprising taking the coefficients of each multiplicand polynomial and applying a number theoretic transformation to transform the coefficients of each multiplicand polynomial to the Fourier domain and / or applying an inverse number theoretic transformation to transform a representation of the computed polynomial product in the Fourier domain to the coefficients of the computed polynomial product.

7. 7. The method (500) of any one of claims 1 to 6, further comprising: retaining in a memory the expanded stored data representing the ciphertext; and computing further polynomial products of the mask polynomial and the body polynomial with a further multiplicand polynomial using the expanded stored data.

8. The polynomial is defined modulo the quotient polynomial, and the quotient polynomial is X Ｍ The method (500) of any one of claims 1 to 7, further comprising dividing by -1.

9. The quotient polynomial is (X Ｍ −1) / (X ｄ −1), where M=hd and d=M−N, e.g., the quotient polynomial is X Ｎ +1 or X Ｎ＋Ｎ／２＋１ 9. The method of claim 8, wherein:

10. The polynomial has a cardinality of 2 ６４ -2 ３２ 10. The method of claim 9, wherein the set is defined on a set whose cardinality is +1 or a power of two.

11. A computer implemented method (600) for computing a representation of a ciphertext, the representation being for use in a cryptographic computation method according to any one of claims 1 to 10, the method comprising: - obtaining a plaintext to encrypt (610); generating (620) a representation of a ciphertext, the ciphertext comprising one or more mask polynomials and a body polynomial; - Obtain a seed for the pseudorandom number generator (621); randomly selecting (622) a mask polynomial by generating a representation of the mask polynomial in the Fourier domain of a number theoretic transform using a pseudorandom number generator according to a seed; applying an inverse number theoretic transform to the evaluation of the mask polynomial to determine the coefficients of the mask polynomial (623); Using the plaintext, determine (624) the coefficients of a body polynomial such that the ciphertext encrypts the plaintext, Applying a number theoretic transformation to the coefficients of the Bode polynomial to determine a representation of the Bode polynomial in the Fourier domain (625); generating 620 a representation of the ciphertext by - outputting (630) a representation of the ciphertext, the representation including the seed and a representation of the Bode polynomial in the Fourier domain; The method (600).

12. 12. The method (600) of claim 11, comprising generating a GGSW-type ciphertext by generating a plurality of ciphertexts including one or more mask polynomials and a body polynomial, the plurality of ciphertexts optionally based on the same seed.

13. A device (110, 112) for performing cryptographic calculations, comprising: a storage (140) for storing data representative of a ciphertext, the ciphertext including one or more random mask polynomials and a body polynomial derived from the mask polynomials and the plaintext; a processor system (130), obtaining respective multiplicand polynomials for multiplication with the mask polynomial and the body polynomial; - expanding stored data representing the ciphertext, the stored data including a pseudorandom number generator seed and a Fourier domain Bode polynomial representation of a number theoretic transform, the expanding including generating a Fourier domain mask polynomial representation using the pseudorandom number generator in accordance with the seed; - calculating polynomial products of the mask polynomial and the body polynomial with the respective multiplicand polynomials, the polynomial products being calculated in the Fourier domain to obtain a representation of the calculated polynomial products in the Fourier domain; - Prints the calculated polynomial product A processor system (130) configured to A device (110, 112).

14. A device (110, 111) for computing a representation of a ciphertext, the representation being for use in a cryptographic computation method according to any one of claims 1 to 10, the device comprising: a storage (140) for storing the plaintext to be encrypted; a processor system (130), - obtaining a seed for a pseudorandom number generator; randomly selecting a mask polynomial by generating a representation of the mask polynomial in the Fourier domain of a number theoretic transform using a pseudorandom number generator according to a seed; applying an inverse number theoretic transform to the evaluation of the mask polynomial to determine the coefficients of the mask polynomial; using the plaintext to determine coefficients of a Bode polynomial such that the ciphertext encrypts the plaintext; Applying number theoretic transformations to the coefficients of the Bode polynomials to determine a representation of the Bode polynomials in the Fourier domain generating a representation of the ciphertext comprising one or more mask polynomials and a body polynomial by A processor system (130) configured to output a representation of the ciphertext, the representation including a seed and a Fourier domain Bode polynomial representation. A device (110, 111).

15. A temporary or non-transitory computer-readable storage medium (1000), comprising: instructions which, when executed by a processor system, cause the processor system to perform the method according to any one of claims 1 to 10 and / or the method according to claim 11 or 12; and / or a ciphertext, the ciphertext including one or more mask polynomials and a body polynomial derived from the mask polynomials and the plaintext; containing data representing A transitory or non-transitory computer-readable storage medium (1000) in which data includes a seed for a pseudorandom number generator for generating a Fourier domain mask polynomial representation of a number theoretic transform and a Fourier domain Bode polynomial representation.

Images