Keys with special digits

Abstract

Some embodiments relate to an encryption method (600) for performing encrypted computations. A blind rotation may be applied to an encrypted input value according to a blind rotation input key to obtain a rotated polynomial encrypted according to a blind rotation output key of a key set. Further, sampling may be applied to the encrypted polynomial according to a sample extraction input key to obtain encrypted coefficients of the polynomial, and / or key switching may be applied to the encrypted value or polynomial according to a key switching input key to obtain a key switching output encrypted according to a key switching output key. The keys are defined such that at least some keys have common digits and / or such that at least some keys have more digits with predefined values.

Description

[Technical Field]

[0001] The subject matter of this disclosure relates to encryption methods, corresponding encryption devices, and computer-readable media for performing encrypted calculations. [Background technology]

[0002] Homomorphic encryption allows for encrypted computations, i.e., computations performed on encrypted data without the parties being able to decrypt them, such as circuit evaluation. For example, input data and computation results may be received and returned in encrypted form. Intermediate data, such as the internal state of a computation, may also be in encrypted form.

[0003] Even though the result of a computation is returned in encrypted form, when decrypted the output is expected to be the same or very close to the same as if the operation had been performed on unencrypted data. Homomorphic encryption can be used for outsourced storage and computation while preserving privacy. This allows data to be encrypted and then outsourced to a cloud environment for processing and / or storage, all while remaining encrypted.

[0004] For example, homomorphic encryption may be applied in fields such as healthcare, where privacy regulations make sharing plaintext data difficult, but computations on encrypted medical data may be permitted. For example, a medical model developed to classify medical data may be configured to receive the medical data in encrypted form from a third party, such as a hospital. The medical model may, for example, classify the medical data as, for example, normal or abnormal, or as having some particular medical syndrome, disease, or other disorder. The medical model may be applied to the medical data received in encrypted form using homomorphic encryption. This means that the party providing the medical model does not have access to the plaintext medical data corresponding to the encrypted medical data. Users of the service can decrypt the results of applying the medical model.

[0005] In particular, homomorphic encryption techniques exist that can, at least in principle, be used to compute arbitrary functions on encrypted data: these are referred to as "fully homomorphic encryption" (FHE) techniques.

[0006] Known implementations of FHE use noisy ciphertexts for security reasons. For example, encrypting a data item may involve mapping the data item to a point in a key-dependent lattice to which noise is added. In particular, many known implementations of FHE use LWE-type ciphertexts, the security of which relies on cryptographic difficulties such as the Learning With Errors problem or one of its variants, Ring Learning With Errors (RLWE) or Generalized Learning With Errors (GLWE). Such LWE-type ciphertexts may be LWE ciphertexts that include one or more mask values ​​(e.g., values ​​modulo a particular modulus q or torus elements) and a noisy body value derived from the mask values ​​and plaintext using a cryptographic key. A generalization of this is the GLWE ciphertext, which encrypts and uses a polynomial instead of a scalar value. RLWE ciphertexts are another type of GLWE ciphertext. Other known implementations of FHE use NTRU-type ciphertexts, for which similar considerations apply.

[0007] When a data item has just been encrypted, the noise is low and the encryption is fresh. For example, the amount of noise is so low that when the data item is decrypted, the noise can be removed at some point in the decryption process, for example, by rounding. On the other hand, the noise must be high enough to make attacks on the system sufficiently difficult. For example, if noise were not present, many homomorphic encryption schemes could be attacked with linear algebra or other efficient algorithms, such as lattice-based algorithms. When a data item is encrypted, noise is added that is chosen to make attacks difficult, while homomorphic operations can still be performed and decryption is still possible.

[0008] Most homomorphic operations increase the noise inherent in a homomorphically encrypted data item. When many such operations are performed, the noise can reach a level where unique decryption is no longer possible. It is commonly known to use a technique called bootstrapping to reduce the noise in homomorphically encrypted values. Bootstrapping can use a public key, called a bootstrap key. By using bootstrapping to reduce noise as needed, it is in principle possible to compute any desired number of homomorphic operations.

[0009] A particular class of fully homomorphic encryption schemes is the TFHE-like homomorphic encryption scheme. Such schemes are described in I. Chillotti et al., "Programmable bootstrapping enables efficient homomorphic inference of deep neural networks," Cyber ​​Security Cryptography and Machine Learning (CSCML 2021), Lecture Notes in Computer Science, Vol. 12716, pp. 1-19, Springer, 2021 (incorporated herein by reference). TFHE-like schemes differentiate from other FHE schemes by supporting a relatively highly effective technique for bootstrapping. In addition, TFHE-like schemes allow simultaneous evaluation of functions during the bootstrap operation, which is called programmable bootstrapping. Regular bootstrapping corresponds to programmable bootstrapping using a discriminant function. Interestingly, the output of programmable bootstrapping has an amount of noise that is independent of the noise in the input ciphertext. Thus, by performing a programmable bootstrap, noise in the input ciphertext can be reduced by a constant amount, possibly while simultaneously applying a function to the input ciphertext. By performing the programmable bootstrap at the appropriate time, it is possible to perform encrypted computations with infinite multiplicative complexity.

[0010] In general, an encryption computation using a TFHE-like homomorphic encryption scheme involves a value and a polynomial encrypted under a set of keys, e.g., a set of LWE and / or GLWE keys, or a set of NTRU keys. For example, a blind rotation may be used that operates on the encrypted value and can output an encrypted polynomial. As another example, key switching may be used to convert encryption under different keys.

[0011] The keys used in encrypted computations are typically generated randomly according to a probability distribution. For example, the keys used as inputs to blind rotations may be independently randomly generated, as may the keys used for input and output key switching.

[0012] The way in which the key is randomly generated depends on the type of secret key. Various types of secret keys are known; for example, their digits may be generated according to an independent probability distribution (e.g., uniform binary or Gaussian) or according to an overall probability distribution (e.g., with a fixed overall Hamming weight). The type of secret key used can affect various aspects of the encrypted computation, including how the encrypted operation is implemented, the resulting computational complexity and noise increase, and the security level. [Prior art documents] [Non-patent literature]

[0013] [Non-Patent Document 1] I. Chillotti et al., "Programmable bootstrapping enables efficient homomorphic inference of deep neural networks", Cyber ​​Security Cryptography and Machine Learning (CSCML 2021), Lecture Notes in Computer Science, Vol. 12716, pp. 1-19, Springer, 2021. Summary of the Invention [Problem to be solved by the invention]

[0014] While existing TFHE-based cryptographic computation techniques are capable of performing a wide variety of operations on encrypted values, there remains a need for improvements in their computational efficiency, storage requirements for key material used to perform the encrypted computations, and / or flexibility regarding the values ​​of cryptographic parameters that can be used. It is an object of the present invention to address at least some of these issues. [Means for solving the problem]

[0015] According to one aspect of the present invention, there is provided an encryption method for performing an encrypted calculation, as defined by the claims. According to a further aspect, there is provided an apparatus corresponding to the computer-implemented method, as defined by the claims. According to another aspect, there is provided a computer-readable medium, as defined by the claims.

[0016] The encrypted computation may include a value and a polynomial encrypted according to one or more encryption keys. The encryption key for encrypting the value is also referred to herein as a "value key." The encryption key for encrypting the polynomial is also referred to herein as a "polynomial key." The keys may together form a key set. The keys of the key set may support a programmable bootstrap operation; in other words, the encrypted computation may be a "TFHE-like" configuration. In particular, the keys may be defined according to lattice-based encryption; for example, the value key may be an LWE key and the polynomial key may be a GLWE key.

[0017] The encrypted computation may include various "key-related" operations that convert between one and / or more encryptions of different types according to different keys. In particular, the encrypted computation may include a blind rotation operation in which an input value encrypted according to a blindly rotated input key of a key set is transformed into a rotation polynomial encrypted according to a blindly rotated output key of a key set. The blind rotation may evaluate homomorphic decoding of the encrypted input value at the exponent of the polynomial. For example, the obtained rotation polynomial may represent the application of a lookup table to the input value. Such blind rotation is often applied as a step in programmable bootstrapping. See "Programmable bootstrapping enables efficient homomorphic inference of deep neural networks."

[0018] The encrypted computation may also include a sampling operation, in which a polynomial encrypted according to a sampling input key of the key set may be converted into an encryption of the coefficients of the polynomial, and / or a key-switching operation, in which a value or polynomial encrypted according to a key-switching input key of the key set may be converted into a key-switching output encrypted according to a key-switching output key of the key set (e.g., different from the key-switching input key).

[0019] Using existing techniques, each key in a set of keys for an encrypted computation is typically generated independently and randomly, with the digits of the private key defined, for example, as independent and identically distributed random variables or based on a joint probability distribution that allows for multiple possible values ​​for the digits. The term "digit" may generally refer to a scalar value that forms the private key, e.g., a value that forms an LWE key, or a coefficient of a polynomial that forms a GLWE key.

[0020] Interestingly, the inventors have recognized that by modifying the way the keys in a key set are formed, it is possible to improve the efficiency of various key-related operations, reduce the storage requirements for key material used in encrypted calculations, and increase the flexibility of encrypted calculations with respect to cryptographic parameters. That is, the inventors have contemplated using key sets that relax the assumption that keys are independently randomly generated, and in particular by using keys that have one or more digits in common and / or by using keys that have one or more digits with predefined values.

[0021] By using such special types of keys for the key set of an encrypted calculation, various operations can be implemented in a better way. In particular, by using keys with common digits and / or digits with predefined values, the storage requirements for key material can be reduced. That is, blind rotation and key switching operations typically use bootstrap keys and key-switching keys, respectively, which involve encryption of a value based on an input secret key. By using secret keys with common digits, encryption can be shared between different bootstrap keys and key-switching keys. By using secret keys with digits with predefined values, the corresponding encryption can be eliminated, requiring less encryption and therefore less key material. Furthermore, using predefined values ​​and common digits reduces the number of encrypted operations, resulting in less noisy outputs and more computationally efficient operations.

[0022] Similarly, having an input key with a predefined value for sampling makes the computation more efficient, while using an input key for sampling that has digits in common with other keys in the encrypted calculation can make subsequent key switching less expensive, or even eliminate the need for a key altogether.

[0023] The provided techniques can effectively provide the party performing the encrypted computation with some controlled knowledge of the secret key used, allowing the encrypted computation to be performed in an improved manner. This allows for greater flexibility with regard to the cryptographic parameters that can be used. In particular, existing techniques often rely on polynomial rings modulo a polynomial of degree N, where N is a power of 2. This means that if N is increased to increase security, N must be doubled, doubling the key size and computational cost of various operations. For example, an encrypted polynomial modulo N

[0024]

number

[0025] It is also possible to use keys that both have digits in common with other keys and further have digits with predefined values. Surprisingly, this combination has been found to work particularly well. In particular, it allows a particularly efficient implementation of a programmable bootstrap operation for encrypted calculations, and key switching (resulting in encryption according to a key-switching output key that has digits in common with the key used for subsequent calculations as well as digits with predefined values) can be applied before sample extraction, instead of first sample extraction and then key switching as in today's known PBS implementations.

[0026] Note that the output keys of a sample extraction (which are the same as the input keys, but reinterpreted as a set of numbers rather than a set of polynomials) are not considered to be distinct keys of a key set, unlike the input keys of a sample extraction. In particular, keys from a key set that have common digits and / or predefined values ​​can be input and output keys for blind rotation and / or key switching, as well as input keys for a sample extraction.

[0027] Thus, by using the provided techniques, more choices are provided regarding cryptographic parameters, allowing for the use of less public key material for a given use case. Furthermore, improved efficiency can be obtained for various cryptographic operations, and less noise can be increased. Thus, for example, more efficient computation of Boolean circuits, arithmetic circuits, neural network inference, or functional circuits can be obtained.

[0028] In general, it can be beneficial for performance to use a key set with multiple keys for encrypting plaintexts and / or multiple keys for encrypting polynomials in various encrypted computations, and to switch encryption according to each key throughout the computation. For example, this allows for using a different set of parameters for each blind rotation depending on the desired accuracy or precision of each result. In such cases, the provided techniques are particularly advantageous by providing improved efficiency and a reduction in the size of the required public key material, e.g., key switching and / or bootstrap keys.

[0029] In one embodiment, sampling may be applied based on an encrypted rotation polynomial, e.g., an encrypted rotation polynomial representing the application of a lookup table to the input value. The sampled input key may have one or more digits with predefined values. In general, sampling may determine the resulting encryption of the coefficients of the encrypted input polynomial by determining each element of the resulting encryption corresponding to each digit of the sampled input key. If the sampled input key has a digit with a predefined value, the corresponding element of the resulting encryption may be eliminated, making sampling faster and resulting encryptions less complex.

[0030] However, the advantages discussed herein also apply when sampling is not applied to the output of the blind rotation. For example, a polynomial encrypted according to a sampling input key can be used to pack multiple values. The sampling input key can be a partial key having one or more digits with predefined values. The encryption of each packed value can be obtained by applying the respective sampling to the encrypted polynomial. In this case, due to the use of partial keys, the resulting encryption can be smaller. As an illustrative example, 1024 messages can be packed into an encrypted polynomial with a partial key, e.g., an RLWE key, in which all coefficients except the first 600 are filled with zeros. This ciphertext can be unpacked into, e.g., 1024 individual ciphertexts. Advantageously, the resulting ciphertext can be smaller, e.g., having a size of 601 instead of 1025 in this example.

[0031] In one embodiment, the sample extraction input key may be the same as the blind rotation output key; for example, sample extraction may be applied to the encrypted rotation polynomial output by the blind rotation. In this way, a more efficient programmable bootstrap operation may be obtained. That is, programmable bootstrap may include modulus switching, followed by blind rotation, followed by sample extraction, optionally followed by key switching. Improved sample extraction may make such programmable bootstrap more efficient.

[0032] In one embodiment, the sample extraction input key may further have one or more digits in common with the blind rotated input key. In particular, a programmable bootstrap may be applied to the encryption according to the blind rotated input key, and the output encryption may be produced according to that same blind rotated input key. By using a sample extraction input key that has digits in common with the blind rotated input key, this output encryption may be determined particularly efficiently. In particular, key switching may be performed to obtain the output encryption, which may be implemented more efficiently due to the common digits. In particular, the sample extraction input key may be defined such that its digit set consists only of digits that have predefined values ​​as the digits of the blind rotated input key. In this case, sampling may directly produce the desired output encryption, and key switching may be completely eliminated, making this option particularly efficient in terms of computation and storage.

[0033] In one embodiment, programmable bootstrap may be performed by performing a blind rotation, applying key switching based on a polynomial obtained by the blind rotation, and applying sampling based on the output of the key switching. The sampling may result in encryption according to a desired key, e.g., a key to which the input value of the blind rotation was encrypted, or another desired key. To this end, the key switching output key may be defined to include one or more digits having a predefined value and further include digits of the desired key.

[0034] Therefore, compared to known programmable bootstrapping, which involves blind rotation, followed by sample extraction, followed by key switching, the order of key switching and sample extraction may be reversed. Furthermore, the key switching may be key switching operating on an encrypted polynomial, as opposed to key switching operating on an encrypted value. Interestingly, this may lead to improved efficiency, as encrypted polynomial key switching can be implemented more efficiently than encrypted value key switching. In particular, polynomial key switching can be implemented particularly efficiently using the Fast Fourier Transform (FFT), also known in this context as the Number Theoretic Transform (NTT). Furthermore, due to the use of polynomial key switching instead of value key switching, the key switching key may be smaller. These effects are particularly strong when the encryption is RLWE encryption.

[0035] In one embodiment, by combining blind rotation with key switching having different key-switching output keys, an improved programmable bootstrap can result in an output having a different desired key. For example, additional blind rotations can be applied according to the same blind rotation input and output key, and the output can be used for additional key switching and subsequent additional sampling. For example, one desired key can be a blind rotation input key, and another desired key can be a different key formed, for example, from a subset or superset of the digits of the blind rotation input key. This allows for efficient combination of bootstrap with different input keys in homomorphic computations and effective use of polynomial key switching to switch keys. Again, because polynomial key switching results in small key-switching keys (especially when RLWE key switching is used), encrypted computations can be performed using a particularly small amount of key material. Because the size of the bootstrap key can be reduced as described herein, it is particularly beneficial for the desired keys to have common digits or even be subsets of each other.

[0036] In one embodiment, key switching may be performed when the key-switching input key and the output key have one or more digits in common. This allows key switching to be performed particularly efficiently. In particular, key switching may involve combining the key-switching contributions of the key-switching input key to each secret key element, typically calculated based on the key-switching key's respective components. When the input key and the output key have common digits, their components need not be determined; instead, an element of the input ciphertext may be obtained. Also, digits that occur in the key-switching output key but not in the key-switching input key may be handled efficiently, for example, by adding zeros corresponding to the additional digits. Thus, key switching may generally be processed more efficiently using smaller key-switching keys and with less noise.

[0037] In one embodiment, key switching can be applied to one or more values ​​encrypted according to a common key-switching input key to obtain a key-switching output polynomial encrypted based on the one or more values. In particular, the key switching can be so-called packing key switching, which combines value ciphertext(s) into a polynomial ciphertext. Also, such value-to-polynomial key switching can be improved by using common digits as described herein.

[0038] In particular, the digits of the key-switching input key may be a subset of the digits of the key-switching output key. In this case, key switching may be performed by setting ciphertext elements of the key-switching output key that correspond to digits of the key-switching output key that do not occur in the key-switching input key to 0. Therefore, such key switching has very low computational cost, does not use the key-switching key, and does not add noise.

[0039] Similarly, the digits of the key-switching input key may be a superset of the digits of the key-switching output key. In this case, key-switching may involve key-switching only those encrypted input values ​​or ciphertext elements of a polynomial that correspond to digits of the key-switching input key that do not occur in the key-switching output key. Thus, in this case, key-switching may result in a smaller key-switching key, faster computation, and less resulting noise.

[0040] In one embodiment, a sequence of at least three keys may be used, with the digits of a key being a subset of the digits of a subsequent key. For example, the digits of a first key may be a subset of the digits of a second key, which may be a subset of the digits of a third key, and so on. This configuration allows for efficient key switching between different keys based on key switching between subsequent keys, as described herein. In this manner, encrypted calculations can be performed in which each portion is performed with the smallest possible key that provides the desired level of precision, thus leading to more efficient encrypted calculations.

[0041] In one embodiment, multiple blind rotations may be performed using respective blind rotated input keys and output keys that share one or more digits in common. Similar to key-switching keys, blind rotated keys may include encryption of each digit of the blind rotated input keys. When common digits are used in the input keys, common encryption of those digits may also be used. In particular, the digits of the first blind rotated input key may be a subset of the digits of the second blind rotated input key. For compatibility, the encryption may use the same polynomial degree N, and the blind rotated output keys may be the same; the bases may be compatible in the sense that they are the same or one is a power of the other (e.g., 6 levels in base 8 = 2^3 and 3 levels in base 64 = 2^6). In such cases, the bootstrap key for the first input key and output key may be included in the bootstrap key for the second input key and output key. Thus, the encrypted calculation may use less key material.

[0042] The provided techniques for improved computation on encrypted data can be applied to a wide range of practical applications. Such practical applications include encrypting and evaluating software programs without accessing the plaintext data. For example, medical diagnostic software can be evaluated on medical data without actually accessing the medical data. Medical data can include medical images. Medical images can include multidimensional image data, such as two-dimensional (2D), three-dimensional (3D), or four-dimensional (4D) images, acquired by various acquisition modalities, such as, but not limited to, standard X-ray imaging, computed tomography (CT), magnetic resonance imaging (MRI), ultrasound (US), positron emission tomography (PET), single-photon emission computed tomography (SPECT), and nuclear medicine (NM).

[0043] In one embodiment, the provided techniques may be used to evaluate neural networks against encrypted inputs. The party evaluating the neural network may or may not have cleartext access to the neural network's trained parameters, such as weights and biases. In general, the techniques provided herein improve the efficiency of evaluating neural networks and / or reduce the storage and transmission requirements of the ciphertext or key material used.

[0044] An embodiment of the method may be implemented on a computer as a computer-implemented method, or on dedicated hardware, or a combination of both. Executable code of an embodiment of the method may be stored in a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Preferably, the computer program product includes non-transitory program code stored on a computer-readable medium for performing an embodiment of the method when the program product is run on a computer.

[0045] In one embodiment, the computer program comprises computer program code adapted to perform all or part of the steps of an embodiment of the method when the computer program is run on a computer. Preferably, the computer program is embodied on a computer readable medium.

[0046] Further details, aspects, and embodiments are described, by way of example only, with reference to the drawings, in which elements are illustrated for simplicity and clarity and are not necessarily drawn to scale, and in which elements corresponding to elements already described may have the same reference numerals. [Brief explanation of the drawings]

[0047] [Figure 1A] 1 illustrates a schematic diagram of an example of an embodiment of a cryptographic device. [Figure 1B] 1 illustrates a schematic diagram of an example of an embodiment of an encrypted computing system. [Figure 2] 1 shows an example of a key with digits having predefined values. [Figure 3] 1 shows an example of keys with common digits. [Figure 4A] Here is an example of a programmable bootstrap. [Figure 4B] Here is an example of a programmable bootstrap. [Figure 4C] Here is an example of a programmable bootstrap. [Figure 4D] Here is an example of a programmable bootstrap. [Figure 4E] Here is an example of a programmable bootstrap. [Figure 5A] Illustrates conversion between encryptions using different keys. [Figure 5B] Illustrates conversion between encryptions using different keys. [Figure 5C] Illustrates conversion between encryptions using different keys. [Figure 5D] Illustrates conversion between encryptions using different keys. [Figure 5E] Illustrates conversion between encryptions using different keys. [Figure 6] 1 illustrates a schematic diagram of an example of an embodiment of an encryption method for performing encrypted calculations. [Figure 7] 1 illustrates a schematic diagram of a computer-readable medium having a writable portion according to one embodiment. [Figure 8] 1 shows a schematic diagram of a processor system according to one embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0048] While the subject matter of the present disclosure is susceptible to embodiment in many different forms, as illustrated in the drawings and described in detail herein, one or more specific embodiments, it should be understood that the present disclosure is to be considered as an exemplification of the principles of the subject matter of the present disclosure and is not intended to be limited to the specific embodiments shown and described.

[0049] In the following, for the sake of understanding, elements of the embodiments are described in terms of operation, however it will be apparent that each element is arranged to perform the functions described as being performed by it.

[0050] Furthermore, the presently disclosed subject matter is not limited to the embodiments only, but also includes any other combination of features described herein or recited in mutually different dependent claims.

[0051] First, some general information and notation that applies to some embodiments is provided. Throughout this specification, the parameter q represents the modulus of the encrypted value, e.g., a positive integer. Z q denotes the ring Z / qZ. The parameter N denotes the size of the various polynomials used, typically a power of 2. R denotes the ring Z[X] / p(X), and R q is Ring Z q [X] / p(X), where p(X) is a cyclotomic polynomial, e.g., if N is a power of 2, then p(X)=(XN +1). σ denotes a Gaussian distribution with mean 0 and standard deviation σ. || denotes connectivity.

[0052] Various embodiments use LWE-type encryption. Such encryption can be based on the cryptographic hardness of an LWE family problem, such as Learning With Errors (LWE) or Ring Learning With Errors (RLWE), or the more general Generalized Learning With Errors (GLWE), which covers both LWE and RLWE. In general, an LWE ciphertext can include one or more mask values ​​and a body value derived from the mask values ​​and a plaintext value. The values ​​are typically integers modulo a given modulus q. Various embodiments also use GLWE-type ciphertexts. GLWE ciphertexts can include one or more mask polynomials and a field polynomial derived from the mask polynomials and plaintext polynomials. GLWE ciphertexts can be defined modulo a modulus q and a quotient polynomial p(X). LWE ciphertexts can be considered a specific type of GLWE ciphertext in which the quotient polynomial has degree 1. For example, GLWE ciphertexts that are not LWE ciphertexts, using polynomials that are not of constant degree, are also called polynomial ciphertexts. Another specific type of ciphertext is the Ring Learning With Errors (RLWE) ciphertext, where the mask polynomial is 1.

[0053] In particular, private key S∈R k Message M∈R under q The GLWE ciphertext of can be defined as follows:

[0054]

number

[0055]

number

[0056] moreover,

[0057]

number

[0058]

number

[0059] For simplicity of notation, S k+1 =-1 is sometimes used. However, this value or the polynomial S k+1 are not considered to be part of the GLWE private key. The GLWE private key is contained in each mask element A, not in body element B. i Each secret element S corresponding to iTherefore, the digits of the GLWE private key may only include the digits of those private elements (values ​​or polynomials) that correspond to the body elements (values ​​or polynomials).

[0060] In this example, the LWE ciphertext is a GLWE ciphertext with N=1. In this case, a parameter n=k can be considered for the size of the LWE secret key, and both the ciphertext and the secret can be calculated, e.g., ct q and s. The RLWE ciphertext in this example is a GLWE ciphertext with k=1 and N>1, e.g., a square.

[0061] Note that although the integer q is used throughout this specification to denote the ciphertext modulus, multiple ciphertext moduli may be used within the encrypted multiplication, e.g., modulus switching may be used to align ciphertexts according to the same q as needed.

[0062] However, in principle, it is not necessary to use LWE-type ciphertexts: for other types of ciphertexts, e.g., NTRU-based ciphertexts, keys with common digits and / or predefined values ​​can be defined, and the various advantages described herein also apply in such settings.

[0063] The above example describes a variant of private key, symmetric encryption. The techniques provided herein equally apply to the public key variant, as known per se. In the latter case, for example, the private key described above can be used as the private key, and the public key comprises the encryption of one or more zeros; see, for example, R. Rothblum, "Homomorphic encryption: From private-key to public-key," Theory of Cryptography (TCC2011), Lecture Notes in Computer Science, Vol. 6597, pp. 219-234, Springer, 2011 (incorporated herein by reference).

[0064] The provided techniques can also be used for encrypted computations based on multi-key fully homomorphic encryption. In this setting, each party may have a respective private key (e.g., generated as a normal FHE private key), and the encrypted computation may be performed on a ciphertext encrypted according to each private key. In particular, multi-key FHE may be based on a transformation operation in which a ciphertext encrypted according to one of the respective keys is transformed into a (usually larger) ciphertext that encrypts the same message according to a combination of secret keys. For example, each private key

[0065]

number

[0066]

number

[0067]

number

[0068]

number

[0069]

number

[0070] Various embodiments operate in a TFHE setting, which means that ciphertext that supports programmable bootstrap (PBS) is used. Programmable bootstrap can take a ciphertext as input and output a ciphertext of the same message, or a function of that message (in other words, a lookup table applied to that message), using noise that is independent of the input. PBS can involve blind rotations that evaluate homomorphic decoding of the input ciphertext at the exponent of a polynomial.

[0071] In particular, a programmable bootstrap can take as input a ciphertext that encrypts a message m, a bootstrap key, and an encryption lookup table. The programmable bootstrap can output an encryption with a fixed level of noise that encrypts a message L[m]. Such programmable bootstraps using blind rotations are known, for example, from I. Chillotti et al., "TFHE: Fast Fully Homomorphic Encryption over the Torus," J. Cryptol., 33(1):34-91, 2020, or L. Ducas et al., "FHEW: Bootstrapping Homomorphic Encryption in Less Than a Second," Proceedings EUROCRYPT 2015. Blind rotations are also known as accumulator updates; see, for example, D. Micciancio et al., "Bootstrapping in FHEW-like Cryptosystems," https: / / eprint.iacr.org / 2020 / 086 (incorporated herein by reference).

[0072] Programmable bootstrapping is typically implemented in the art by performing modulus switching, followed by a blind rotation, and then converting the blind rotation result into a value ciphertext, e.g., by sample extraction followed by optional key switching. Sample extraction is also known as extraction from an accumulator. Such implementations are described, for example, in the LWE setting in "Programmable bootstrapping enables efficient homomorphic inference of deep neural networks" and "Bootstrapping in FHEW-like Cryptosystems." Programmable bootstrapping in the NTRU setting is known from "FINAL: Faster FHE instantiated with NTRU and LWE" and "NTRU-ν-um: Secure Fully Homomorphic Encryption from NTRU with Small Modulus."

[0073] Modulus switching essentially scales the encrypted input of a programmable bootstrap, resulting in a scaled input encrypted with the same key as the original input. Modulus switching is sometimes left implicit in this specification because it is typically applied immediately before a blind rotation and does not change the key with which the value is encrypted. A blind rotation can be applied, for example, to X -μ’ Homomorphic decryption of encrypted input values ​​at the exponent of a polynomial can be evaluated by computing v, where μ' is the scaling of the encrypted input value and ν is the polynomial encoding the lookup table. Blind rotations may also be applied outside the context of programmable bootstrap. For example, blind rotations without a lookup ν are also called monomial lifts.

[0074] Programmable bootstrapping typically utilizes gadget ciphertexts. In particular, programmable bootstrapping may be based on computing the outer product of a polynomial encrypted with such gadget ciphertext. In general, a gadget ciphertext is defined as a ciphertext that includes multiple component ciphertexts, each encrypting a value based on a plaintext, and may be defined based on a gadget matrix. In the case of LWE / GLWE, the gadget ciphertext may be, for example, a GGSW ciphertext, as known from "Programmable bootstrapping enables..." (which is incorporated herein as far as the description of GGSW is concerned). In an NTRU setting, the gadget encryption can be, for example, the NGS encryption of C. Bonte et al., "FINAL: Faster FHE instantiated with NTRU and LWE," https: / / ia.cr / 2022 / 074 (incorporated herein by reference, insofar as the definition of NGS is concerned), or the gadget NTRU encryption of K. Kluczniak, "NTRU-ν-um: Secure Fully Homomorphic Encryption from NTRU with Small Modulus," https: / / ia.cr / 2022 / 089 (incorporated herein by reference, insofar as the definition of gadget NTRU is concerned). As known per se, NTRU bootstrapping can be applied to LWE-encrypted values, e.g., encrypted computations may be performed on LWE-encrypted values ​​using NTRU bootstrapping. This is described, for example, in C. Bonte et al., "FINAL: Faster FHE instantiated with NTRU and LWE," https: / / ia.cr / 2022 / 074. In general, in TFHE-like schemes, it is possible to select a set of secure cryptographic parameters to minimize computational cost while meeting the required accuracy. Interestingly, such parameters can be selected independently of the amount of homomorphic operations and the depth of the circuit being evaluated.

[0075] A private key as used herein may be a sparse private key. A sparse binary (respectively ternary) private key of Hamming weight h∈N can be defined as a private key such that its polynomial coefficients lie in {0,1} (respectively {-1,0,1}) and contain exactly h non-zero coefficients. When using such a key, the polynomial ring R q The polynomial order N, distribution (binary or ternary), and Hamming weight h may be known. Sparse secret keys may be beneficial for homomorphic computation, see, e.g., JH Heon et al., "Homomorphic encryption for arithmetic of approximate numbers," proceedings ASIACRYPT 2017 (incorporated herein by reference).

[0076] More generally, various types of private keys may be used, with respective parameters known, for example, to the parties performing the encrypted computation. Such parameters typically include the size of the private key (e.g., the dimension k and polynomial ring of the elements of the private key) and the ring used in the encrypted computation. For example, the following types of private keys with the indicated public knowledge may be used:

[0077] [Table 1]

[0078] Throughout this specification, plaintext is referred to as Z q Similarly, such values ​​can be considered as values ​​from a discretization of the real torus T = R / Z, as is done in some of the references mentioned above. That is, integers modulo a given modulus and discretized torus elements can be used interchangeably, and in particular, as is also mentioned in the literature, Z q and

[0079]

number

[0080] The programmable bootstrap operation in TFHE-like schemes makes them an attractive choice for a wide range of applications. Because bootstrapping is relatively efficient compared to many other FHE schemes, it is much more feasible to perform relatively complex computations, for example, with a multiplication depth of at least 10, at least 50, or at least 100. In particular, the cryptographic parameters of TFHE-like schemes can be selected based on the desired precision and resulting computational cost, independent of the amount of homomorphic operations and their circuit depth. In contrast, because bootstrapping can be highly inefficient in other FHE schemes, in practice these schemes are typically applied in a leveled manner, meaning that their parameters are selected for a given computation so that it can be performed without the need for bootstrapping. Such a leveled approach is not feasible for more complex computations, in which case TFHE-like schemes are particularly beneficial.

[0081] In particular, in the LWE setting, the security of a GLWE-based ciphertext depends on the distribution of the secret key and three key parameters: n = kN, where N is the degree of the quotient polynomial, k is the number of random mask polynomials in the ciphertext, n is the length of the secret key, q is the modulus, and σ is a statistical parameter of the noise, e.g., its standard deviation. Given these parameters, methods for estimating the degree of security provided are known per se; see, e.g., M. Albrecht et al., "On the concrete hardness of learning with errors," Journal of Mathematical Cryptology, 9(3):169-203, 2015 (incorporated herein by reference).

[0082] In embodiments herein, the parameters of the TFHE-like ciphertexts used may be selected based on the desired security level and the desired precision of operations such as linear combinations of ciphertexts and / or application of programmable bootstrap, in other words, the noise level resulting from the application of these operations. Interestingly, in a TFHE setting, the security parameters can be selected independently of the computational complexity, e.g., independently of the multiplication depth of the computation. This differs from non-TFHE-like schemes, where security parameters are typically selected to limit or eliminate bootstrap.

[0083] In particular, LWE-based ciphertexts and / or GLWE-based ciphertexts used in the TFHE setting herein can use a relatively small modulus, e.g., at most 32 bits, at most 64 bits, or at most 128 bits. This modulus is typically selected independently of the computations being performed, e.g., depending on the desired precision and / or efficiency. The parameters N, k, and / or σ can typically be selected to achieve a desired security level independently of the computations being performed. For example, N may be set to at least 512 and / or at most 2048 or 4096, e.g., 1024. For example, in one embodiment, RLWE is used with N at least 512 and / or at most 2048 or 4096, e.g., 1024, and k=1. Such values ​​of N are typically not used in non-TFHE-like encryption schemes, as such values ​​severely limit feasible computations. Instead, in non-TFHE-like schemes, q and N are typically both selected based on the desired security level, such that q can be much larger.

[0084] Figure 1a illustrates schematically an example of a cryptographic computation device 110. The device 110 may be for performing cryptographic computations.

[0085] The device 110 may include a processor system 130, a storage device 140, and a communication interface 150. The storage device 140 may include local storage, such as a local hard drive or electronic memory. The storage device 140 may include non-local storage, such as cloud storage. In the latter case, the storage device 140 may include a storage interface to the non-local storage. For example, the storage device 140 may be for storing values ​​and polynomials encrypted according to one or more cryptographic keys. The keys form a key set. The device 110 typically does not have access to the keys of the key set in plaintext form. The storage device 140 may contain additional data, such as bootstrap and / or key switching keys, as described elsewhere.

[0086] The device 110 can communicate internally with other devices, external storage devices, input devices, output devices, and / or one or more sensors via a computer network. The computer network may be the Internet, an intranet, a LAN, a WLAN, etc. The computer network may be the Internet. The device may optionally include a connection interface 150 arranged to communicate with other devices as needed. For example, the connection interface may include a connector, such as a wired connector, e.g., an Ethernet connector, an optical connector, etc., or a wireless connector, e.g., an antenna, e.g., a Wi-Fi, 4G, or 5G antenna. Communications, e.g., internal communications, may use other communication protocols or media, e.g., an internal data bus.

[0087] In device 110, communications interface 150 may be used to transmit or receive digital data. For example, device 110 may be configured to receive or transmit data representing one or more encrypted values ​​and / or encrypted polynomials, e.g., representing inputs and / or outputs of an encrypted calculation. As another example, communications interface 150 may receive data representing one or more bootstrap keys and / or one or more key switching keys.

[0088] Execution of device 110 can be implemented in one or more processor circuits, such as a processor system 130, e.g., a microprocessor, examples of which are shown herein. Device 110 can include multiple processors that can be distributed across different locations. For example, device 110 can use cloud computing.

[0089] The processor subsystem 130 may be configured to apply a blind rotation to an input value encrypted according to a blind rotated input key of the key set to obtain a rotation polynomial encrypted according to a blind rotated output key of the key set. The rotation polynomial may represent, for example, the application of a lookup table to the input value.

[0090] Processor subsystem 130 may be further configured to perform sampling and / or key switching. Processor subsystem 130 may be configured to apply sampling to a polynomial encrypted according to a sampling input key of a key set to obtain encrypted coefficients of the polynomial. Alternatively, or in addition, processor subsystem 130 may be configured to apply key switching to a value or polynomial encrypted according to a key switching input key of a key set to obtain a key switching output encrypted according to a key switching output key of the key set.

[0091] The first key and the second key of the key set may have one or more digits in common, and / or at least one key of the key set has one or more digits with a predefined value. While the keys themselves are typically unknown to device 110, information regarding which digits are common or predefined may be known to device 110, and device 110 may therefore be configured to utilize this information regarding the common and predefined digits to perform encrypted calculations, allowing the calculations to be performed in an improved manner as described herein.

[0092] Processor subsystem 130 may be configured to obtain one or more inputs to the encrypted computation, e.g., one or more encrypted input values ​​and / or one or more encrypted input polynomials. Processor subsystem 130 may be configured to output one or more outputs of the encrypted computation, e.g., including one or more encrypted output values ​​and / or one or more encrypted output polynomials. For example, processor subsystem 130 can obtain inputs and / or output outputs from / to storage device 140 and / or from / to another party via communication interface 150.

[0093] Some of the figures show functional units that may be functional units of a processor system. For example, the figures may be used as possible blueprints of the functional configuration of a processor system. The processor circuit(s) are not shown separately from the units in most of the figures. For example, the functional units shown in Figures 2-5 (see below) may be implemented in whole or in part in a device such as device 110, e.g., computer instructions stored in electronic memory of device 110 and executable by a microprocessor of device 110. In hybrid embodiments, the functional units are implemented partially in hardware, e.g., as a coprocessor, e.g., an arithmetic and / or cryptographic coprocessor, and partially in software stored and executed by device 110.

[0094] For example, device 110 may be a device for performing encrypted computations. The encrypted computations may use homomorphic encryption. For example, device 110 may be used to perform encrypted computations, e.g., the device may perform computations even if the data is received in encrypted form, e.g., from a data provider, and even if device 110 cannot decrypt the data. The computations may include blind rotation, key switching, and / or sampling, as described herein. The computations may include various other homomorphic encryption operations, e.g., linear operations, e.g., addition, subtraction, and / or scalar multiplication, multiplication, univariate function evaluation, etc.

[0095] For example, storage device 140 may store encrypted data items, e.g., received from one or more data providers, or generated as intermediate or final results, e.g., the output of a computation. Typically, most or all of the data items on which the computations of device 110 are performed are encrypted with a key (or keys) that is not known to device 110, i.e., device 110 may not be configured to obtain the plaintext data items corresponding to the encrypted data items, e.g., stored in storage device 140. The encryption / decryption keys may be available in encrypted form, while the decryption keys in plaintext form are secret to device 110.

[0096] Figure 1b illustrates a schematic diagram of an example of an embodiment of an encrypted computing system 100. System 100 is configured to perform encrypted computations using homomorphic encryption, for example fully homomorphic encryption.

[0097] System 100 in this example includes key generation device 111, data provider device 113, and cryptographic device 112. Key generation device 111 may be combined with data provider device 113 in a single device. Device 112 may be configured to receive encrypted data items from data provider 113. At least one or more data items may be received in encrypted form. One or more additional data items may be received in plaintext form. Device 112 may be configured to receive key material, such as bootstrap and / or key-switching keys, for performing encrypted calculations from key generation device 111.

[0098] The device 112 can perform the computations described herein on received data items, and possibly also on stored data items. Interestingly, the computations may be performed by the device on encrypted data without decrypting the data, e.g., without converting the encrypted data items into a plaintext form of the data.

[0099] Device 112 in this example may be based on device 110 of Figure 1a and may include, for example, processor system 130, storage device 140, and / or communication interface 150 of Figure 1a. Each of devices 111, 112, 113 may generally be based on the hardware configuration of device 110 of Figure 1a and may each include, for example, a processor system, storage device, and / or communication interface as in Figure 1a.

[0100] Although not shown in this figure, encrypted computing system 100 may include multiple cryptographic devices, e.g., two, three, or more than three cryptographic devices. The encrypted computation may be distributed among multiple cryptographic devices. The cryptographic devices may exchange intermediate computation results, typically encrypted, with each other. Each cryptographic device may be implemented like cryptographic device 112 and may perform encrypted operations as described herein.

[0101] Homomorphic encryption schemes can be applied in many settings. For example, the encrypted cryptographic device 112 may be operated by a cloud provider. The cloud provider may provide computation and storage services to its clients. Using homomorphic encryption, the data provider device 113, e.g., a client of the cloud provider, can transmit their data in encrypted form. The cloud provider can still perform the necessary computations and / or storage, but cannot see the corresponding plaintext data. For example, the data provider device 113 may use an encryption key type that corresponds to the particular homomorphic encryption system used to encrypt the data item. Once the computation results are received by the data provider 113 from the encrypted computing device 112, the corresponding decryption key can be used to decrypt the encrypted data item. The encryption key and decryption key may be, and typically are, the same.

[0102] For example, the encrypted computing system 100 may be configured to train a machine learning model, e.g., an image classifier, e.g., a medical model, without the encrypted computing device having access to the plaintext data items. For example, linear regression may be performed on the input data, possibly even without bootstrapping. For example, backpropagation may be performed on the input data, perhaps with bootstrapping. The resulting model parameters may be returned to an entity in possession of a decryption key. This allows multiple providers of medical data to pool their data by submitting the data to a cloud provider. The cloud provider then returns the model parameters without accessing the plaintext data. The encryption key may be equal to the decryption key.

[0103] After the model is trained, the encrypted computing system 100 can be used to provide the model for use with, for example, medical data. This can be done using either plaintext model parameters or encrypted model parameters, and in either case, it can be done using encrypted data, e.g., encrypted input, intermediate, and output data. Using plaintext model parameters is typically much more efficient. In both cases, the effect of the system is that the computation, e.g., image classification, e.g., medical image classification, is performed without the computer knowing the plaintext data items. For example, a mammogram can be evaluated for cancer without the image being in the clear at the cryptographic device 112, or without the cryptographic device 112, or a combination of such devices, knowing what the results of the cancer evaluation are. From a privacy perspective, it may be acceptable to run a plaintext model on encrypted privacy-sensitive data, but not on plaintext privacy-sensitive data.

[0104] Other applications include database services, such as searching for encrypted data in an encrypted database, where the computation may be a comparison between an input item and a database item. For example, multiple computations may be combined to generate a database index that matches the index. For example, the database may be a genome database, and the input may be a gene sequence. For example, the system 100 may be used for the protection and control of equipment. For example, a large piece of equipment, such as a power plant, may transmit sensor values ​​to a cryptographic device 112 and receive an encrypted control signal. The control signal is computed from the sensor signal. An attacker of the system may be able to determine the content of data flowing to or from one or more cryptographic devices 112, or even access intermediate data from these devices, but they would not be aided by the encryption of the data. Even a complete decryption of all cryptographic devices 112 in the system 100 would not reveal the data because the decryption key is unknown to these devices. The computation of the control signal may involve mathematical operations such as linear algebra, averaging, matrix multiplication, and polynomial evaluation, all of which can be performed using homomorphic encryption operations.

[0105] For example, a pool of encrypted data items may be maintained in an encrypted computing system, a subset of which may be received, and another subset may be the result of an encrypted computation, e.g., an intermediate result. For example, cryptographic device 112 may be configured to apply a homomorphic encryption operation to one, two, or more encrypted data items in the pool, e.g., a set of input values ​​and / or intermediate values ​​and / or output values. The result may be a new encrypted data item that may be stored in the pool. The pool may be stored in a storage device of the encrypted computing system, which may be local storage or distributed storage. In the latter case, it may occur that one or more encrypted data items are represented multiple times in the pool. Encrypted data items may be transmitted from one computing device to another, e.g., if their values ​​are needed elsewhere. The pool may be implemented in various ways, e.g., as a register file, an array, various data structures, etc.

[0106] Encrypted data items can represent any kind of data. For example, encrypted data items can represent numbers that need to be averaged or used in linear regression, etc. For example, encrypted data items can represent an image. For example, each pixel of the image can correspond to one or more encrypted data items. For example, a grayscale pixel can be represented by a grayscale, and the grayscale can be represented by a single encrypted data item. For example, 256 grayscales can be encoded with a single encrypted data item. For example, a color pixel can be represented as multiple color levels, such as RGB levels, which can be represented by a set of encrypted data items. For example, if there are three colors with 256 levels of color, each can be encoded as a separate encrypted value.

[0107] A set of homomorphic encryption operations can be defined for a computation. For example, from the homomorphic encryption operations, a network or circuit of operations that together perform the computation may be constructed, e.g., by a compiler device such as that described with respect to FIG. 1b, or by the cryptographic device itself. For example, the operations may include Boolean operations. The way in which the homomorphic encryption operations are combined, e.g., which operations are applied to which operands in the pool, determines the computation performed. For example, a computation may be represented as a list of homomorphic encryption operations to be performed along with instructions for the encrypted data items on which the homomorphic encryption operations are performed. The network or circuit may indicate to the cryptographic device 112 when to perform blind rotation, sampling, and / or key switching. For example, the network or circuit may indicate that key digits used in each operation are common or have predefined values, allowing the cryptographic computation to be performed according to the shape of the key used in the cryptographic device.

[0108] Figure 2 shows a detailed, but non-limiting, example of a key having one or more digits with predefined values. Keys having digits with predefined values ​​are also referred to herein as partial secret keys, specifically partial GLWE keys, partial LWE keys, partial NTRU keys, etc. This contrasts with keys known in the art, where each digit typically has at least two possible values ​​that have a non-zero probability when generating the key.

[0109] In particular, the figure shows a partial secret key 200, e.g., a GLWE key, that includes two polynomials, where the coefficients of the polynomials have been flattened into an array of coefficients for illustrative purposes. Key 200 is defined as follows:

[0110]

number

[0111]

number

[0112]

number

[0113]

number

[0114]

number

[0115] More generally, in a partial secret key, only a predetermined portion of the digits that are publicly available is known to be distributed over a probability distribution, e.g., a joint distribution or distribution D i The remaining digits may be filled with publicly known predetermined elements. The locations of these predetermined elements and each random element from the distribution may be known.

[0116] Mathematically, a partial private key is A public vector of indices R = (R1, R2, . . . ) representing a portion of the private key filled with random elements, e.g., R i ⊆{1,...,k}×{0,...,N-1}, · The public vector of distribution D = (D1, D2, ···) associated with R, A public vector with index K=(K1, K2, . . . ) representing a portion of the private key filled with predetermined elements, e.g., K i ⊆{1,...,k}×{0,...,N-1}, A public vector of values ​​V = (V1, V2, ) associated with K, e.g., V i ∈Z q , It can be defined as a private key parameterized by

[0117] In this mathematical description, the partial secret key is given by |R|=|D| and |K|=|V|, U x∈R∪K x={1,...,k}×{0,...,N-1},U x∈K x≠φ (e.g., there is at least one digit with a predefined value),

[0118]

number

[0119] For example, consider partial secret key 200. This key contains two polynomials, the first half 221 of which is filled with random coefficients, and the second part 222 (the predetermined part) is filled with zeros. This key is

[0120]

number

[0121]

number

[0122] Figure 3 shows a detailed, non-limiting example of a key that has one or more digits in common. Such a key is also referred to herein as a shared random secret key. In other words, such a key has publicly known information about the shared modulus.

[0123] An example of this is shown in the figure, where three different private keys, e.g., GLWE keys, i.e.

[0124]

number

[0125]

number

[0126]

number

[0127] In particular, as shown in this figure, keys 311-313 may be LWE private keys, e.g., N1=N2=N3=1. As shown in the figure, the keys in this example

[0128]

number

[0129]

number

[0130]

number

[0131]

number

[0132] Mathematically, a set of keys that share a common digit is Private key list

[0133]

number

[0134] dimension k x and polynomial size N x Private key with

[0135]

number

[0136]

number

[0137]

number

[0138]

number

[0139] A set of shared relationships is of the form

[0140]

number

[0141]

number

[0142]

number

[0143] In particular, the example shown in this figure shows that when N=1,

[0144]

number

[0145]

number

[0146] A set S can be defined as follows:

[0147]

number

[0148]

number

[0149]

number

[0150]

number

[0151]

number

[0152]

number

[0153] [Number] represents the sharing coefficient between 313.

[0154] In particular, by using a shared randomness secret key, key switching between a key-switching input key and a key-switching output key can be implemented more efficiently. This is shown for the keys shown in FIG. 3 for LWE-type keys (e.g., an LWE key for encrypting a value and / or a GLWE key for encrypting a polynomial).

[0155] In particular, a shared randomness secret key, such as

[0156] [Number] and 311

[0157] I [Number] Key switching may be performed between 312, and the set of digits of one key is a subset of the set of digits of the other key. In particular, as shown in the figure, the key may be an LWE secret key, for example N = 1. For the purposes of the following description, key 311 is

[0158] [Number] may be represented as, and key 312 is

[0159] [Number] 3] may be represented as, where n1 < n2, and when 1 ≤ i ≤ n1, s i (1) = s i (2) is.

[0160] As a first example, key switching may occur from a smaller key 311 to a larger key 312. The digits of the key switching input key 311 may be a subset of the digits of the key switching output key 312. In this case, key switching may be performed by zeroing out ciphertext elements of the key switching output that correspond to digits of the key switching output key 312 that do not occur in the key switching input key 311.

[0161] In particular, the private key

[0162]

number

[0163]

number

[0164]

number

[0165]

number

[0166] This may avoid regular key switching of ciphertext of size n1, thereby improving computational efficiency, and may avoid adding linear combinations of noise, thereby reducing noise.

[0167] As a second example, key switching may occur from a larger key 312 to a smaller key 311. The digits of the key switching input key 312 may be a superset of the digits of the key switching output key 311. Such key switching is also referred to as "chunked key switching." In this case, key switching may involve key switching only those ciphertext elements of the encrypted input value or polynomial that correspond to digits of the key switching input key 312 that do not occur in the key switching output key 311.

[0168] In particular, the private key

[0169]

number

[0170]

number

[0171]

number

[0172]

number

[0173]

number

[0174]

number

[0175]

number

[0176]

number

[0177]

number

[0178] In this example, the key-switching key may be smaller, e.g., proportional to n2-n1 instead of n2, the computation may be faster, e.g., corresponding to regular key-switching of ciphertext of size n2-n1+1 instead of n2+1, and the output may be less noisy, e.g., because the algorithm involves smaller linear combinations.

[0179] In the same manner as above, packing key switching, for example, proceeding from one or more value ciphertext to a polynomial ciphertext, can also be improved. In this case, key switching can be applied to one or more values ​​encrypted according to a key-switching input key to obtain a key-switching output polynomial encrypted based on the one or more values. Similarly, the above technique may also be applied when the key-switching input and output keys have common digits, but one is not a subset of the other. Again, as described above, key-switching operations on the common digits may be avoided, making the key-switching key smaller, more efficient, and less noisy.

[0180] Combining the examples of Figures 2 and 3, it is also possible for a private key to include both digits with predefined values ​​and digits that are common to another private key. This combination is called a shared random partial private key. In particular, a shared random partial private key may be defined as a list of partial private keys as described with respect to Figure 2, with public knowledge of the shared modulus as described with respect to Figure 3. Such a key may be defined by the structure SRSK as described with respect to Figure 3, and the private key is the partial private key defined with respect to Figure 2.

[0181] 4a shows a detailed but non-limiting example of a programmable bootstrap (PBS). This example shows PBS in an LWE setting as known in the art.

[0182] The known PBS consists of three operations: MS (Modulus Switch), BR (Blind Rotation) and SE (Sample Extraction). This figure shows the blind rotation input LWE key.

[0183]

number

[0184]

number

[0185]

number

[0186]

number

[0187] In this case, the programmable bootstrap is responsible for storing the original LWE private key

[0188]

number

[0189] Figure 4b shows a detailed, but non-limiting, example of a programmable bootstrap that builds on the example of Figure 4a but uses a sampled input key with one or more digits with predefined values.

[0190] More specifically, modulus switching and blind rotation 421 may be applied to an input value 410 encrypted according to a blind rotated input key 421 to obtain a rotation polynomial encrypted according to a blind rotated output key 431. The rotation polynomial may represent the application of a lookup table to the input value. Sampling 441 may be applied to the encrypted rotation polynomial to obtain encrypted coefficients of a polynomial representing the output of the lookup table, where in this example the sampled input key 431 is the same as the blind rotated output key. Furthermore, key switching 461 may be applied to the encrypted coefficients to obtain a key switching output. In this example, key switching returns the input value to the encrypted key 410. Thus, an encryption resulting from applying the lookup table to the input value may be obtained, where the resulting encryption has a noise amount independent of the noise in the input value.

[0191] As shown in the figure, in this case, the output key 431 of the blind rotation, which is the same as the input key for sample extraction, becomes a partial secret key. That is, it includes a digit 432 that does not have a pre-defined value and a digit 433 that has a pre-defined value.

[0192] As a result of using this partial secret key, the LWE ciphertext output by sample extraction 441 is a partial RLWE secret key where n’ < N

[0193]

Number

[0194]

Number

[0195] The illustrated example can be generalized in several ways. In general, one or more operations (e.g., linear homomorphic operations) may be applied to the ciphertext before applying sample extraction 441 and / or to the ciphertext before applying key switching 461. As in Figure 4a, it is also possible to omit or delay key switching 461.

[0196] It is also possible to use pre-defined values other than 0. For example, all the pre-defined values may be 0, or all may be 1, or 0 and 1 may be combined. For example, the pre-defined value may be the hash of a specific preimage. In general, it is possible to efficiently convert ciphertexts between secret keys that differ only in the pre-defined values. For example, the partial secret key

[0197]

number

[0198]

number

[0199] Figure 4c shows a detailed, but non-limiting, example of programmable bootstrap, and this example builds on the example of Figure 4a. As with Figure 4b, this involves applying a sample extraction using a sample extraction input key with one or more digits having predefined values.

[0200] In this example, the order of key switching and sampling is reversed compared to Figures 4a and 4b, i.e., key switching occurs before sampling instead of after.

[0201] In particular, in this figure, modulus switching and blind rotation 420 is applied to an input cipher encrypted according to an input key 410 to obtain an encrypted rotation polynomial. The rotation polynomial may be encrypted according to a secret key 430 that is unrelated to the input key. Key switching 470 (in this example, RLWE key switching) is applied based on the encrypted rotation polynomial to obtain a key switching output, which is encrypted according to a key switching output key 480.

[0202] Interestingly, the key-switching output key 480 can be selected such that the subsequent sample extraction 490 results in encryption according to a desired key. To this end, as shown, the key-switching output key 480, which in this example is the same as the sample extraction input key, can include one or more digits 482 having a predefined value and can further include a digit 481 of the desired key. In this way, the sample extraction 490 can actually provide the desired output (see FIG. 4b).

[0203] For example, as also shown, the desired key can be the same key 410 that the input is encrypted with, i.e., the blind rotation's blind rotation input key 420. In this way, we can continue to perform computations encrypted according to this key after the blind rotation. However, it is also possible to switch to a different LWE key if desired.

[0204] Thus, using sample extraction 490 with a shared random partial secret key results in faster programmable bootstrap with key switching. Performing key switching 470 before sample extraction allows for key switching 470 on the encrypted polynomial (in this example, RLWE key switching) to be used instead of key switching on the encrypted value. This is particularly advantageous because polynomial key switching can utilize FFT / NTT to speed up computations, thereby improving efficiency. Also, the size of the key material can be reduced compared to value key switching.

[0205] Similar to Fig. 4b, in general, it is possible to perform additional operations, such as linear homomorphic operations, before key switching 470 or before sample extraction 490, if desired. It is also possible to perform multiple programmable bootstraps using the same blind rotation 420 but different key switching 470. In this way, it is possible to use the proposed programmable bootstrap to obtain resulting encryptions according to multiple respective output keys.

[0206] Figure 4d shows a detailed, non-limiting example of a programmable bootstrap, and this example is based on the example of Figure 4a. As in Figures 4b and 4c, a sample extraction 490 is used in which the sample extraction input key has one or more digits with predefined values.

[0207] As shown in the example, modulus switching and blind rotation 422 may be performed on the input ciphertext. In this example, interestingly, the blind rotation is performed such that a blind rotated output key 480, which is also a sampled input key, is composed of one or more digits 482 having a predefined value and a digit 481 of the desired output key. Thus, applying sample extraction 490, as described with respect to FIG. 4c, may result in encryption according to the desired output key. For example, as shown, the desired output key may be the same key 410 (i.e., the blind rotated input key) with which the input ciphertext is encrypted, or any other desired key.

[0208] In other words, a partial secret key may be used that shares randomness with the input secret key, such that modulus switching and blind rotation 422 and sampling 490 directly have the same secret key as input and output. Interestingly, in this example, no key switching computation is required to get back to the input secret key, making this programmable bootstrap particularly efficient and also eliminating the need for a key switching key in this example.

[0209] FIG. 4e shows a detailed, but non-limiting example of a programmable bootstrap.

[0210] This example is similar to the example of Figure 4d in that modulus switching and blind rotate 423 are used, with the blind rotate having an output key 435 that includes digits 436 of the desired output key as well as digits 438 with predefined values. In this example, sample extract 442 is also used, with the sample extract input key equal to the blind rotate output key 435. For example, sample extract may be applied directly to the output of the blind rotate, or there may be one or more operations in between.

[0211] However, the blind rotated input key in this case includes not only the desired output key digits 436 and the predefined value digits 438, but also one or more additional digits 437. Thus, the output of sample extraction 442 may also be encrypted according to key 455, which includes the desired output key digits 436 and the additional digits 437.

[0212] Thus, key switching 461 may be used to convert the output of the sample extraction into an encryption according to a desired output key 436. This output key may be the same as the blind rotated input key 410 to which the input encryption is encrypted, as shown, but this is not required. Interestingly, the key switching in Figure 4e is from an input key whose digit set 436, 437 includes digit 436 of the output key. Thus, key switching 461 may be efficiently implemented as chunked key switching (see Figure 3).

[0213] More generally, it is also advantageous if the sampled output key 455 has one or more digits in common with the desired output key, as this allows key switching 461 to be implemented more efficiently than the general key switching performed in, for example, FIG. 4a, as described herein.

[0214] In particular, additional randomness 437 with a known value in addition to the input secret key 410 and a polynomial partial secret key 435 that shares the randomness with digits 438 may be used, thereby improving the efficiency of key switching 461.

[0215] 5a shows a detailed, but non-limiting, exemplary transformation between keys. In general, an encrypted computation, or a portion thereof, may be performed based on a value key s, 511, e.g., an LWE key, and an associated polynomial key S, 521, e.g., a GLWE key. The key material associated with this portion of the encrypted computation may be referred to herein as a key set.

[0216] As shown, such portions of the encrypted computation may include one or more programmable bootstraps 520 that proceed from a value key 511 to a polynomial key 521. For example, the programmable bootstraps may include modulus switching, blind rotation, and sampling, as in Figure 4a. The programmable bootstraps, such as those blind rotations, may use a bootstrap key 529.

[0217] Additionally, part of the encrypted computation may include one or more key switches 560 going from the polynomial key 521 to the value key 511. The key switching may use a key switching key 569.

[0218] Part of the calculation may include further operations on the ciphertext encrypted according to the key 511, 521, for example linear operations such as addition between ciphertexts or multiplication of the ciphertext with a known integer.

[0219] Thus, the set of keys associated with this portion of the encrypted computation may include value key 511, polynomial key 521, bootstrap key 529, and key-switching key 569. Note that the party performing the encrypted computation only uses bootstrap key 529 and key-switching key 569 and does not normally have access to value key 511 and polynomial key 521.

[0220] In particular, the key set is a value secret key

[0221]

number

[0222] 511, for the purpose of key switching 560, the value secret key

[0223]

number

[0224]

number

[0225] 521, Value Private Key

[0226]

number

[0227] Bootstrap key BSK 529 going from 511 to polynomial private key S 521, and polynomial private key S 521 (interpreted as value key) going to value private key

[0228]

number

[0229] The Key Switching Key (KSK) 569 can be defined as the set consisting of the Key Switching Key (KSK) 569 going to 511.

[0230] Polynomial Key

[0231]

number

[0232] Typically, polynomial key 521 has, for example, at least two, at least four, or at least eight times more orders of magnitude than value key 511. Thus, polynomial key 521 may be referred to as the "major key" of the key set, and value key 511 may be referred to as the "minor key" of the key set.

[0233] By using the key set as shown, encrypted calculations having any number of operations can be performed, e.g., there is no limit to the number of operations that can be applied (e.g., addition or multiplication).

[0234] In general, the overall key set for homomorphic encryption may include multiple key sets, e.g., multiple value keys and associated polynomial keys, as described with respect to this figure. Interestingly, by using keys 511, 521 in this overall key set that have common digits and / or digits with predefined values, it is possible to have a smaller amount of public information for, e.g., the key switching key 569 and / or the bootstrap key 529, improving computational efficiency. Various examples are provided herein.

[0235] FIG. 5b shows a detailed but non-limiting example of transformations between keys.

[0236] As also described with respect to Figure 5a, in general, the overall key set used in the encrypted multiplication may include multiple key sets defined with respect to Figure 5a. In particular, the overall key set may include multiple value keys, e.g., LWE keys, and associated polynomial keys, e.g., GLWE keys. By using different keys, typically with different parameters (e.g., N, k), for different parts of the encrypted computation, the encrypted computation can efficiently address different precision requirements for different parts.

[0237] For example, an encrypted computation may involve at least two key sets, at least three key sets, or at least five key sets of associated values ​​and polynomial keys. An encrypted computation may include one or more operations that proceed from one key set to another. The key material used in these operations may be called bridge key sets.

[0238] For example, this diagram shows that each value key s (1) ,511,s (2) , 512, and s (3) , 513. The six arrows represent key switching between value keys. In such a case, the bridge key set may comprise six respective key-switching keys for the six respective key switches. More generally, the key set may comprise a key-switching key for performing key switching from each value key to each of the other value keys.

[0239] Interestingly, the techniques provided allow for the use of smaller bridge key sets and / or more efficient transformations. Various examples are given herein.

[0240] FIG. 5c shows a detailed but non-limiting example of transformations between keys.

[0241] This example shows how by using keys with common digits, especially for LWE / GLWE keys, we can have a smaller bridge key set and more efficient conversion between encryptions according to their respective keys. This example shows key switching for value keys used in encrypted calculations (and therefore not polynomial keys used in programmable bootstrap, for example).

[0242] That is, the diagram illustrates key switching between a first key 511, a second key 512, and a third key 513, where the digits of the first key 511 are a subset of the digits of the second key 512, and the digits of the second key 512 are a subset of the digits of the third key 513. The dotted arrows represent key switching from a smaller key to a larger key. The solid arrows represent key switching from a larger key to a smaller key. While the diagram illustrates three keys, the example can be generalized to more than three keys, for example, at least five keys.

[0243] In this example, because the digit sets overlap, as described in the LWE setting with respect to Figure 3, key switching from a smaller key to the next larger key (e.g., from key 511 to key 512, or from key 512 to key 513), or from a larger key to the next smaller key (e.g., from key 513 to key 512, or from key 512 to key 511), can be efficiently performed. Key switching from a key to another key that is not subsequent can be performed by performing respective key switching between subsequent keys, e.g., from key 511 to key 512 and then from key 512 to key 513, or from key 513 to key 512 and then from key 512 to key 511.

[0244] In particular, for LWE-type keys, converting data from key set (1), 511 to one of the other two key sets 512, 513 may be performed by padding the ciphertext with zeros. Converting data from key set (2), 512 to key set (1), 511 may include computing a smaller key switch only for the portion of the ciphertext that does not correspond to key 511. Such type of key switching is also referred to herein as chunked key switching. Similarly, converting data from key set (3), 513, to key set (1), 511 may be performed by first converting to key set (2), 512, with key switching of the portion of key 513 that is not included in key 512, and then converting to key set (1), 511, as described above.

[0245] Thus, the bridge key set in this case may be formed solely from key-switching keys from subsequent larger to smaller keys, e.g., from key 513 to key 512 and from key 512 to key 511. In other words, the use of shared random secret keys 511-513 may allow some key-switching keys to be factorized, thereby reducing the total amount of data required for the key-switching keys. This, in turn, may generate less noise, as described, allowing for a more efficient procedure for switching ciphertext keys.

[0246] FIG. 5d shows a detailed but non-limiting example of transformations between keys.

[0247] In this example, similar to FIG. 5c, three value keys 511, 512, and 513 (e.g., LWE keys) are shown, with the digits of value key 511 being a subset of the digits of value key 512, and the digits of value key 512 being a subset of the digits of value key 513.

[0248] As described with respect to Figure 5a, typically, the encrypted computation generally includes a polynomial key, e.g., a GLWE key, corresponding to each value key. In particular, the encrypted computation may include first, second, and third polynomial keys corresponding to first, second, and third value keys.

[0249] Interestingly, in this example, the polynomial keys are also shared randomness keys. In particular, the digits of the third value key 513 are a subset of the digits of the first polynomial key 521, which are a subset of the digits of the second polynomial key 522, which are a subset of the digits of the third polynomial key 523. As in Figure 5c, this example can be generalized to a number of value / polynomial key sets different from three, for example, at least five such key sets.

[0250] This setup is beneficial because it provides an efficient way to transfer data between key sets while using very little key material.

[0251] In particular, as described with respect to Figure 5a, the encrypted computation may include key switching from a polynomial key in the key set to a corresponding value key, e.g., from key 521 to key 511, from key 522 to key 512, and / or from key 523 to key 513. In this example, these key switches proceed from one key to another key that has this key as a subset, and thus can be implemented efficiently as described for the LWE setting with respect to Figure 3. Also, by implementing these key switches as key switching between subsequent keys 511, 512, 513, 521, 522, 523 (e.g., key switching from key 521 to key 513, from key 513 to key 512, and from key 512 to key 511), the total amount of key material for the key switching keys may be significantly reduced.

[0252] In particular, in this example, the values ​​and polynomial keys 511-523 form a set of keys whose digits are subsets of each other, so that the key-switching keys from both the key set and the bridge key set can be factorized into a list of chunked key-switching keys. For example, in this example, the key-switching keys used by the encrypted calculation are ·S (3) 523 to S (2) Key switching keys chunked to 522, ·S (2) 522 to S (1) Key switching keys chunked to 521, ·S (1) From 521

[0253]

number

[0254] Key switching keys chunked to 513, ·

number

[0255] From 513

[0256]

number

[0257] Key switching keys chunked to 512, ·

number

[0258] From 512

[0259]

number

[0260] Key switching keys chunked to 511, can be stored by storing

[0261] This key material can be, for example, S (3) from

[0262]

number

[0263]

number

[0264]

number

[0265] An additional benefit of using shared randomness values ​​and polynomial keys is that it allows for smaller bootstrap keys. In particular, a first blind rotation may be applied with a first blind rotated input key 511 and output key 521, and a second blind rotation may be applied with a second blind rotated input key 512 and the same blind rotated output key 521. If blind rotated input keys 511, 512 have common digits, e.g., if the digits of key 511 are a subset of the digits of key 512, as in this example, the blind rotated keys may be stored more efficiently because they include a common encryption. Similarly, the blind rotated keys going from keys 511-513 to key 522 and from keys 511-513 to key 523 may be stored more efficiently using a common encryption.

[0266] Thus, using a shared random secret key, several bootstrap keys can be factored together. In particular, the bootstrap keys can include multiple gadget ciphers that encrypt the secret key digits of each of the blind rotated input keys 511-513. If one input key 511 is included in the other key 512, the bootstrap key for the larger input key 512 can incorporate the bootstrap key for the smaller input key 511. Gadget encryption can use the same polynomial size and the same radix, or one radix dividing the other.

[0267] Figure 5e shows a detailed but non-limiting example of transformations between keys.

[0268] This example builds on the example of Figure 4c. That is, programmable bootstrapping from a value key 512, e.g., an LWE key, to the same key may be implemented by performing modulus switching and blind rotation 520, resulting in encryption according to a polynomial key 532, e.g., a GLWE key, performing key switching 572 (in this example, RLWE key switching, but this is not required) resulting in a polynomial encrypted according to key 580 including digits of key 512 and digits 582 having a predefined value, and applying sampling 592 according to key 580.

[0269] This example shows how such programmable bootstrap can be used in encrypted computations using multiple different key sets of associated values ​​and polynomial keys. That is, as the figure shows, a programmable bootstrap can be efficiently performed that has as input the encryption of a value under one key and as output the encryption of a value under a different key. To this end, instead of performing key switching 572 to a key containing digits 512 of the value input key, key switching 571, 573 to a key containing digits of another desired value key may be performed. Corresponding sampling 591, 593 may then be applied to obtain the encrypted value under the desired key.

[0270] Notably, in this configuration, value key 512 and polynomial key 532 may be independent of each other. Key switching 571-573 may be polynomial key switching, resulting in a partial and shared randomness key 572 that enables subsequent sampling 591-593. This results in a different bridge key set than in Figure 5d. Interestingly, key switching 571, 572, 573 may be polynomial key switching, particularly RLWE key switching, and thus may have small key switching keys (e.g., an RLWE key switching key may only contain a number of RLWE ciphertexts equal to the number of levels), allowing for efficient implementation using FFTs.

[0271] To convert between value encryptions according to different keys, it is possible to define value keys 512 such that their digits are subsets of each other, as described with respect to Figure 5c. As explained, this allows for efficient conversion, especially in an LWE setting. However, this is not necessary in this example, as, for example, conversion between value encryptions can be performed via a programmable bootstrap as described herein.

[0272] Similar to FIG. 5d, by having each input key to blind rotation 520 be a subset of each other and have the same output key, the blind rotation key can also be factored, further reducing the size of the key material.

[0273] 6 illustrates an example of an embodiment of an encryption method 600 for performing encrypted calculations. The method 600 can be computer-implemented.

[0274] The method 600 may include storing 600 values ​​and polynomials encrypted with one or more encryption keys. The keys form a key set. A first key and a second key of the key set may have one or more digits in common. Alternatively, or in addition, at least one key of the key set may have one or more digits with a predefined value.

[0275] The method 600 may include applying 620 a blind rotation to an input value encrypted according to a blind rotated input key of the key set to obtain a rotation polynomial encrypted according to a blind rotated output key of the key set.

[0276] The method 600 may include applying 630 sampling to the encrypted polynomial according to a sampling input key of the key set to obtain encrypted coefficients of the polynomial. Alternatively, or in addition, the method 600 may include applying 640 key switching to the encrypted value or polynomial according to a key switching input key of the key set to obtain a key switching output encrypted according to a key switching output key of the key set.

[0277] Those skilled in the art will appreciate that many different ways of performing the method(s) 600 are possible. For example, while the order of steps may be performed in the order shown, the order of steps may be changed, or some steps may be performed in parallel. Furthermore, steps of other methods may be inserted between steps. The inserted steps may represent improvements to the methods as described herein or may be unrelated to the methods. For example, some steps may be performed at least partially in parallel. Furthermore, a given step may not be completely finished before the next step begins.

[0278] Method embodiments may be implemented using software including instructions for causing a processor system to perform method 600. The software may include only steps taken by a particular sub-entity of the system. The software may be stored on a suitable storage medium such as a hard disk, floppy, memory, optical disk, etc. The software may be transmitted via wire or wirelessly or as a signal using a data network, e.g., the Internet. The software may be made available for download and / or remote use on a server. Method embodiments may be implemented using a bitstream arranged to configure programmable logic, e.g., a field programmable gate array (FPGA), to perform the method.

[0279] It will be understood that the subject matter of this disclosure also extends to computer programs, particularly computer programs on or in a carrier, adapted to carry out the subject matter of this disclosure. The program may be in the form of object code, such as source code, object code, code intermediate source, and partially compiled form, or any other form suitable for use in implementing embodiments of the present method. One embodiment of a computer program product includes computer-executable instructions corresponding to each of the processing steps of at least one of the described methods. These instructions may be subdivided into subroutines and / or stored in one or more files that may be statically or dynamically linked. Another embodiment of a computer program product includes computer-executable instructions corresponding to each of at least one device, unit, and / or component of the described systems and / or products.

[0280] Generally, the devices described herein, e.g., in Figures 1a-1b, comprise one or more microprocessors executing appropriate software stored in the system, which may be downloaded and / or stored in corresponding memory, e.g., volatile memory such as RAM or non-volatile memory such as flash. Alternatively, the system may be implemented, in whole or in part, as programmable logic, e.g., a field programmable gate array (FPGA). The system may also be implemented, in whole or in part, as so-called application-specific integrated circuits (ASICs), e.g., integrated circuits (ICs) customized for their specific application. For example, the circuitry may be implemented in CMOS using, e.g., a hardware description language such as Verilog or VHDL. In particular, the system may comprise circuitry for evaluating cryptographic primitives.

[0281] A processor circuit may be implemented in a distributed manner, for example as multiple sub-processor circuits. A storage device may be distributed across multiple distributed sub-storage devices. Some or all of the memory may be electronic memory, magnetic memory, etc. For example, a storage device may have a volatile portion and a non-volatile portion. Some of the storage device may be read-only.

[0282] 7 illustrates a computer-readable medium 1000 having a writable portion 1010. The computer-readable medium 1000 is shown in the form of an optically readable medium. The computer-readable medium 1000 may store data 1020, which, when executed by a processor system, may represent instructions that cause the processor system to perform an embodiment of a method for performing encrypted computations according to one embodiment.

[0283] Alternatively, or in addition, the data 1020 may represent one or more key switching and / or bootstrap keys for performing encrypted calculations on values ​​and polynomials encrypted according to one or more encryption keys, as described herein. The keys may form a key set. A first key and a second key of the key set may have one or more digits in common, and / or at least one key of the key set may have one or more digits with a predefined value.

[0284] The data 1020 may be embodied on the computer-readable medium 1000 as physical marks or by magnetization of the computer-readable medium 1000. However, any other suitable embodiment is contemplated. Furthermore, although the computer-readable medium 1000 is shown here as an optical disk, it will be understood that the computer-readable medium 1000 may be any suitable computer-readable medium, such as a hard disk, solid-state memory, flash memory, etc., and may be non-recordable or recordable.

[0285] FIG. 8 shows a schematic diagram of a processor system 1140 according to one embodiment of an apparatus for performing encrypted computations. The processor system includes one or more integrated circuits 1110. The architecture of the one or more integrated circuits 1110 is shown schematically in the figure. The circuit 1110 includes a processing unit 1120, e.g., a CPU, for executing computer program components to perform a method according to one embodiment and / or implement its modules or units. The circuit 1110 includes a memory 1122 for storing programming code, data, etc. A portion of the memory 1122 may be read-only. The circuit 1110 may include a communication element 1126, e.g., an antenna, a connector, or both. The circuit 1110 may include a dedicated integrated circuit 1124 for performing some or all of the processing defined in the method. The processor 1120, the memory 1122, the dedicated IC 1124, and the communication element 1126 may be connected to each other via an interconnect 1130, e.g., a bus. The processor system 1110 may be arranged for contact and / or contactless communication using an antenna and / or connector, respectively.

[0286] For example, in one embodiment, the processor system 1140, e.g., a device for performing encrypted calculations, may include a processor circuit and a memory circuit, where the processor is configured to execute software stored in the memory circuit. For example, the processor circuit may be an Intel Core i7 processor, an ARM Cortex-R8, or the like. In one embodiment, the processor circuit may be an ARM Cortex M0. The memory circuit may be a ROM circuit or a non-volatile memory such as a flash memory. The memory circuit may also be a volatile memory, e.g., an SRAM memory. In the latter case, the device may include a non-volatile software interface, e.g., a hard drive, a network interface, or the like, arranged to provide the software.

[0287] The following list of clauses includes advantageous examples:

[0288] Clause 1. A cryptographic method for performing an encrypted computation, comprising: storing the values ​​and polynomials encrypted according to one or more encryption keys forming a key set; applying a blind rotation to the encrypted input value according to a blind rotated input key from the set of keys to obtain a rotation polynomial encrypted according to a blind rotated output key from the set of keys; applying sampling to the encrypted polynomial according to a sampling input key of the key set to obtain encrypted coefficients of the polynomial, and / or applying key switching to the encrypted values ​​or polynomial according to a key-switching input key of the key set to obtain a key-switching output encrypted according to a key-switching output key of the key set; A method wherein a first key and a second key of a key set have one or more digits in common and / or at least one key of the key set has one or more digits with a predefined value.

[0289] Clause 2. The method of clause 1, including applying sampling based on an encrypted rotation polynomial, wherein the sampling input key has one or more digits with predefined values.

[0290] Clause 3. The method of clause 2, wherein the sampled input key is a blind rotated output key.

[0291] Clause 4. The method of clause 2 or 3, wherein the sample extraction input key further has one or more digits in common with the blind rotation input key.

[0292] Clause 5. The method of clause 4, wherein the set of digits of the sampled input keys consists only of the set of digits of the blind rotated input keys and digits having predefined values.

[0293] Article 6. applying a blind rotation to obtain an encrypted rotation polynomial; applying key switching based on the encrypted rotation polynomial to obtain an encrypted key switching output according to a key switching output key; applying sampling based on the key switching output to obtain encryption according to a desired key; 3. The method of claim 2, wherein the key switching output key includes one or more digits having predefined values ​​and further includes a digit of a desired key.

[0294] Clause 7. The method of clause 6, wherein the desired key is a blind rotated input key.

[0295] Clause 8. The method of clause 6 or 7, further comprising applying a further blind rotation according to the same blind rotation input key and output key, applying further key switching based on the further blind rotation and according to the further key switching output key, and applying further sampling based on the further key switching, thereby obtaining further encryption according to a further desired key.

[0296] Clause 9. The method of any of clauses 1 to 8, including applying key switching, wherein the key switching input key and output key have one or more digits in common.

[0297] Clause 10. The method of clause 9, comprising applying key switching to one or more values ​​encrypted in accordance with a key switching input key to obtain a key switching output polynomial encrypted based on the one or more values.

[0298] Article 11. the digits of the key-switching input key are a subset of the digits of the key-switching output key, and the key-switching comprises setting to zero ciphertext elements of the key-switching output key that correspond to digits of the key-switching output key that do not occur in the key-switching input key; and / or 11. The method of clause 9 or 10, wherein the digits of the key-switching input key are a superset of the digits of the key-switching output key, and the key-switching includes key-switching only ciphertext elements of the encrypted value or polynomial that correspond to digits of the key-switching input key that do not occur in the key-switching output key.

[0299] Clause 12. The method of clause 11, wherein the digits of the first key are a subset of the digits of the second key and the digits of the second key are a subset of the digits of the third key, and the method includes applying key switching between the first key and the second key and applying key switching between the second key and the third key.

[0300] Clause 13. A method according to any of clauses 1 to 12, comprising applying a blind rotation using a first blind rotation input key and a second blind rotation input key, respectively, wherein the first and second blind rotation input keys have one or more digits in common.

[0301] Clause 14. A cryptographic device (110) for performing encrypted calculations, comprising: a storage device (140) for storing values ​​and polynomials encrypted according to one or more encryption keys forming a key set; A processor system (130), comprising: applying a blind rotation to the encrypted input value according to a blind rotated input key from the key set to obtain a rotation polynomial encrypted according to a blind rotated output key from the key set; a processor system (130) configured to apply sampling to the encrypted polynomial according to a sampling input key of the key set to obtain encrypted coefficients of the polynomial, and / or apply key switching to the encrypted values ​​or polynomial according to a key switching input key of the key set to obtain a key switching output key encrypted according to a key switching output key of the key set; A cryptographic device (110) in which a first key and a second key of a key set have one or more digits in common and / or at least one key of the key set has one or more digits with a predefined value.

[0302] Clause 15. A temporary or non-transitory computer-readable storage medium (1000) containing data (1020), instructions which, when executed by a processor system, cause the processor system to carry out a method according to any one of clauses 1 to 13; and / or A computer-readable storage medium (1000) representing one or more key-switching and / or bootstrap keys for performing encrypted calculations on encrypted values ​​and polynomials according to one or more cryptographic keys forming a key set, wherein a first key and a second key of the key set have one or more digits in common and / or at least one key of the key set has one or more digits with a predefined value.

[0303] Although device 1110 is shown as including one of each of the described components, in various embodiments, various components may be duplicated. For example, processor 1120 may include multiple microprocessors configured to independently perform the methods described herein, or configured to perform steps or subroutines of the methods described herein such that the multiple processors cooperate to achieve the functionality described herein. Furthermore, if device 1110 is implemented in a cloud computing system, the various hardware components may reside in separate physical systems. For example, processor 1120 may include a first processor in a first server and a second processor in a second server.

[0304] It should be noted that the above-described embodiments are illustrative rather than limiting of the subject matter of this disclosure, and that those skilled in the art will be able to design many alternative embodiments.

[0305] In the claims, any reference signs placed between parentheses shall not be construed as limiting the scope of the claim. Use of the verb "comprise" and its conjugations does not exclude the presence of elements or steps other than those stated in a claim. The article "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The use of phrases such as "at least one of," when preceding a list of elements, denotes the selection of all or any subset of the elements from the list. For example, the phrase "at least one of A, B, and C" should be understood as including A only, B only, C only, both A and B, both A and C, both B and C, or all of A, B, and C. The subject matter of the present disclosure may be implemented by means of hardware comprising several distinct elements and by a suitably programmed computer. In device claims reciting several parts, several of these parts may be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

[0306] In the claims, reference signs in parentheses refer to the reference signs in the drawings of exemplary embodiments or formulas of embodiments, thus facilitating the understanding of the claims. These references should not be construed as limiting the claims.

Claims

1. 1. An encryption method (600) for performing a computation encrypted with Fully Homomorphic Encryption [FHE] that supports programmable bootstrap, comprising: Storing (610) values ​​and polynomials encrypted according to one or more encryption keys having a plurality of digits, the encryption keys forming a key set; applying a blind rotation to the encrypted input value according to a blind rotated input key of the set of keys to obtain a rotation polynomial encrypted according to a blind rotated output key of the set of keys (620); applying sampling to the encrypted polynomial according to a sampling input key of the key set to obtain encrypted coefficients of the polynomial (630), and / or applying key switching to the encrypted values ​​or polynomial according to a key-switching input key of the key set to obtain a key-switching output encrypted according to a key-switching output key of the key set (640); 1. A method of encryption (600) in which the digits of a first key are a subset of the digits of a second key of a key set and / or at least one key of the key set has one or more digits with a predefined value.

2. 10. The method of claim 1, comprising applying sampling based on an encrypted rotation polynomial, wherein the sampling input key has one or more digits with predefined values.

3. 3. The method (600) of claim 2, wherein the sampled input key is a blind rotated output key.

4. 4. The method (600) of claim 2 or 3, wherein the sample extraction input key further has one or more digits in common with the blind rotation input key.

5. 5. The method (600) of claim 4, wherein the set of digits of the sampled input keys consists solely of the set of digits of the blind rotated input keys and digits having predefined values.

6. applying a blind rotation to obtain an encrypted rotation polynomial; applying key switching based on the encrypted rotation polynomial to obtain an encrypted key switching output according to a key switching output key; applying sampling based on the key switching output to obtain encryption according to a desired key; 3. The method (600) of claim 2, wherein the key-switching output key includes one or more digits having predefined values, further including a digit of a desired key.

7. 7. The method (600) of claim 6, wherein the desired key is a blind rotation entry key.

8. 8. The method (600) of claim 6 or 7, further comprising: applying a further blind rotation according to the same blind rotation input key and output key; applying further key switching based on the further blind rotation and according to a further key switching output key; and applying further sampling based on the further key switching, thereby obtaining further encryption according to a further desired key.

9. The method (600) of any one of claims 1 to 8, comprising applying key switching, wherein key switching input keys and output keys have one or more digits in common.

10. 10. The method (600) of claim 9, comprising applying key-switching to the one or more values ​​encrypted according to a key-switching input key to obtain a key-switching output polynomial encrypted based on the one or more values.

11. the digits of the key-switching input key are a subset of the digits of the key-switching output key, and the key-switching comprises setting to zero ciphertext elements of the key-switching output corresponding to digits of the key-switching output key that do not occur in the key-switching input key; and / or 11. The method (600) of claim 9 or 10, wherein digits of the key-switching input key are a superset of digits of the key-switching output key, and key-switching comprises key-switching only ciphertext elements of the encrypted value or polynomial that correspond to digits of the key-switching input key that do not occur in the key-switching output key.

12. 12. The method (600) of claim 11, wherein the digits of a first key are a subset of the digits of a second key, and the digits of the second key are a subset of the digits of a third key, and the method includes applying key switching between the first key and the second key and applying key switching between the second key and the third key.

13. 13. The method (600) of any one of claims 1 to 12, comprising applying a blind rotation using a first blind rotation input key and a second blind rotation input key, respectively, the first and second blind rotation input keys having one or more digits in common.

14. The first key is the digit [Equation 1] and the second key is n １ <n ２ is, digit [Equation 2] and 1≦i≦n １ In the case of s ｉ （１） =s ｉ （２） The method (600) of any one of claims 1 to 13, wherein

15. The method (600) of any one of claims 1 to 14, wherein the second key has at least two, at least four, or at least eight times more digits than the first key.

16. The method (600) according to any one of the preceding claims, wherein the digits comprise scalar values ​​forming a cryptographic key, for example values ​​forming an LWE key or coefficients of a polynomial forming a GLWE key.

17. The first key is the digit [Equation 3] and the second key is a digit [Equation 4] Including, [Equation 5] in the case of [Equation 6] and [Equation 7] That is, [Equation 8] The method (600) of any one of claims 1 to 16, wherein indicates a common digit between the first key and the second key.

18. A cryptographic device (110) for performing fully homomorphic encryption [FHE] encrypted computations that support programmable bootstrap, comprising: a storage device (140) for storing values ​​and polynomials encrypted according to one or more encryption keys having a plurality of digits, the encryption keys forming a key set; A processor subsystem (130), comprising: applying a blind rotation to the encrypted input value according to a blind rotated input key from the key set to obtain a rotation polynomial encrypted according to a blind rotated output key from the key set; applying sampling to the encrypted polynomial according to a sampled input key from the key set to obtain encrypted coefficients of the polynomial; and / or a processor subsystem (130) configured to apply key switching to the encrypted value or polynomial according to a key-switching input key of the key-set to obtain a key-switching output encrypted according to a key-switching output key of the key-set; A cryptographic device (110) in which the digits of a first key are a subset of the digits of a second key of a key set and / or at least one key of the key set has one or more digits with a predefined value.

19. A transient or non-transitory computer-readable storage medium (1000) containing data (1020), Instructions which, when executed by a processor system, cause the processor system to perform the method of any one of claims 1 to 17; and / or A computer-readable storage medium (1000) representing one or more key-switching and / or blind-rotation keys for performing encrypted calculations on encrypted values ​​and polynomials according to one or more cryptographic keys forming a key set, wherein a first key and a second key of the key set have one or more digits in common and / or at least one key of the key set has one or more digits with a predefined value.

Images