Method for performing operations in cryptographic applications - Patent Application 20070122997

Abstract

The present invention relates to a method for deriving one or more parameters that determine a representation of a variable used when performing an operation on input operands in a cryptographic application, the operation having one or more subtasks that output the variable as an input for a subsequent subtask or as an output of the operation, at least one of the subtasks receiving the input operands. The method comprises: determining one or more characteristics of the variable output by one of the subtasks based on a model of a noise source originating from one of the subtasks and / or at least one characteristic of an input to the one subtask, the one or more characteristics of the variable being characterized by one or more parameters; determining the representation by fixing at least one of the parameters to a value such that the one or more characteristics satisfy the one or more predefined constraints; and applying the representation of the variable to an implementation of the operation in the cryptographic application.

Description

[Technical Field]

[0001] The present invention relates generally to the field of cryptography, and more particularly to methods and devices for performing operations in cryptographic applications. [Background technology]

[0002] For example, in a cloud computing context, users take certain risks when uploading raw data to untrusted cloud servers. Therefore, sufficient security must be provided to protect users' data. A new and promising technique emerging in the field of data security is fully homomorphic encryption (FHE), which allows homomorphic computations to be performed on encrypted data (ciphertext) without learning any further information about the data. In other words, there is no need to decrypt the data first. Methods for performing FHE have been improved over the years to become practical.

[0003] FHE algorithms are often run on cloud computing servers. However, they are computationally slow. The ciphertext data on which computations are performed in FHE schemes is a large polynomial (length N) in a polynomial ring that depends on the particular scheme. Typical operations on these polynomials include addition and multiplication. Addition is linear in the length of the polynomial (O(N) operations), but multiplication is quadratic in cost (O(N)) using the common and straightforward technique known as textbook multiplication. 2 ) operation).

[0004] One of the main challenges in the practical application of FHE is computational overhead. One of the most costly operations in FHE schemes is polynomial multiplication, and speeding up polynomial multiplication can significantly reduce the computational overhead. This can be achieved by exploiting certain properties of polynomials. There are various well-studied algorithms available to speed up such multiplication, including number-theoretic transforms (NTT), Toom-Cook multiplication, or Karatsuba multiplication. Multiplication using NTT is generally the most efficient of these algorithms, but imposes the strictest requirements on the polynomial ring used. Therefore, it cannot be used for all FHE schemes.

[0005] FHE schemes typically use NTT for fast polynomial multiplication if the underlying ring structure allows it. Two notable exceptions, in which NTT is not applied, are the FHEW scheme disclosed in the paper “FHEW: Bootstrapping Homomorphic Encryption in Less Than a Second” (L. Ducas et al., Eurocrypt, pp. 617–640, 2015) and the TFHE scheme described in “TFHE: Fast Fully Homomorphic Encryption Over the Torus” (I. Chillotti et al., J. Cryptol. 33, 34–91, 2020). Both of these schemes have ring structures that prohibit the use of NTT. Instead, these schemes can use Toom-Cook multiplication, Karatsuba multiplication, or the fast Fourier transform (FFT) for fast polynomial multiplication, with the FFT usually being the fastest option. The latter transform is similar to the NTT transform but has less stringent requirements on the polynomial ring. Both FHEW and TFHE allow the use of isomorphic Boolean algebra, for example, NAND, XOR, and XNOR logic gates.

[0006] Each FHE operation introduces a certain amount of noise into the ciphertext, which is necessary for security. FHE tolerates this noise as long as it does not exceed a certain threshold level of noise. Therefore, FHE schemes must periodically invoke a bootstrap operation to reduce the amount of noise in the ciphertext and maintain it below the threshold noise level. TFHE and FHEW differ from traditional FHE schemes in that they invoke a bootstrap operation after every isomorphic Boolean gate. Bootstrap operations are preferably kept short in TFHE schemes.

[0007] To represent numbers in a computer architecture, one needs to choose a type of representation (e.g., fixed point / floating point / integer) along with a set of parameters (e.g., mantissa size, exponent size, ...). Precision and dynamic range are measures of how accurately a number can be represented. Precision defines how many bits are used to represent a number. Dynamic range defines the minimum or maximum value a number can be represented.

[0008] Real numbers can be represented with finite precision in various ways. In CPUs, a typical method is to use single- or double-precision floating-point numbers. Precision is defined by the size of the mantissa, and the dynamic range is defined by the size of the exponent. This approach is efficient due to the integration of floating-point units (FPUs) in CPUs, making it the representation generally preferred by software designers. Because single-precision FFTs have been found to introduce excessive noise, implementations of the TFHE and FHEW schemes described above are limited to double-precision floating-point FFTs. Double-precision floating-point FFTs have been found to keep the amount of noise introduced sufficiently small. Fixed-point representations are determined by the number of bits in the representation and the scaling factor. In fixed-point representations, the mantissa has a fixed number of bits.

[0009] Also, in the paper “MATCHA: A Fast and Energy-Efficient Accelerator for Fully Homomorphic Encryption over the Torus” (L. Jiang et al., 2015) th A paper (Annual Design Automation Conference 2022, July '22, prepublished online on February 17, 2022) related to the TFHE scheme described above is presented. A hardware accelerator for processing TFHE gates is presented, which is more efficient than accelerators that frequently invoke expensive double-precision floating-point FFT and IFFT kernels. To fully utilize the error-tolerance capabilities of TFHE, polynomial multiplications are accelerated using approximate multiply-free integer FFTs and IFFTs, which require only additions and binary shifts. Although the approximate FFTs and IFFTs introduce errors into each ciphertext, the errors can be rounded off along with noise during decryption, allowing the ciphertext to be decrypted accurately. The integer representation can be considered a version of the fixed-point representation scaled to remove the decimal point.

[0010] When determining the error caused by the limited precision of numerical representation in FFT and IFFT, this error is determined for a given numerical representation (e.g., floating point, fixed point) or a given precision (e.g., 32 bits). If the bit width or any other cryptographic parameter is changed, the error calculation must be started again from scratch. Therefore, it would be advantageous to have a technique that can pre-calculate the effect of parameter changes on the resulting error.

[0011] Therefore, a method is needed whereby the data representation can be adapted in a flexible way whenever a new error calculation is performed after a change in cryptographic parameters. This should apply not only to FFT-based multiplications, but generally to any operation performed on operands in cryptographic applications. Summary of the Invention

[0012] An object of embodiments of the present invention is to provide a method for determining parameter values ​​of variables when performing an operation on input operands in cryptographic applications, where one or more constraints are imposed on the output of said operation.

[0013] The above object is achieved by the solution according to the invention.

[0014] In a first aspect, the present invention relates to a method for deriving, by a device comprising processing means, one or more parameters determining the representation of variables to be used when performing an operation on input operands in a cryptographic application, wherein an output resulting from the execution of said operation satisfies one or more predefined constraints, said operation comprising one or more subtasks, each of said subtasks outputting a variable as an input for a subsequent subtask or as an output of the operation, at least one of said subtasks receiving said input operands. The method comprises: determining one or more characteristics of a variable output by one of the subtasks based on a model of a noise source from one of the subtasks and / or at least one characteristic of an input to the one subtask, wherein the one or more characteristics of the variable are characterized by one or more parameters; determining a representation of the variables by fixing at least one of the parameters to a value such that one or more characteristics satisfy one or more predefined constraints; Applying representations of variables to implement operations in cryptographic applications Equipped with.

[0015] The proposed method presents a procedure for pre-deriving one or more parameter values ​​for representing variables to be used when performing an operation. The proposed solution makes it possible to obtain a representation of a variable with parameters having optimal or near-optimal values, given the constraints imposed on the output of the operation. The variables may be intermediate variables resulting from a particular subtask of the operation, used as input for a subsequent subtask, or variables as the output of the operation. In a preferred embodiment, the steps of the method are repeated for all variables that play a role in the operation considered, as detailed below.

[0016] In a first step of the method, one or more properties of the variable obtained at the subtask output are determined, i.e., relevant parameters characterize the property of the variable. The one or more properties are related to the evaluation of predefined constraints. In some embodiments, this is done based on at least one property of the variable(s) at the input of the subtask. In other embodiments, the determination of the property is based on a model of a noise source originating from the considered subtask. In yet other embodiments, the two options are combined, i.e., both the noise model and one or more properties of the input to the subtask are used to determine one or more relevant properties (parameter(s)) of the considered variable. In a next step, one or more parameters for representing the variable are determined by fixing the parameter(s) value(s) such that the constraints imposed on the output of the operation are satisfied. In a preferred embodiment, this is achieved by solving an optimization problem. The representation of the variable by the parameter(s) fixed in the above method steps is applied to the actual implementation of the operation in a computer-implemented cryptographic application.

[0017] Compared to prior art solutions, the present invention offers several advantages. When determining an appropriate representation of a variable that satisfies one or more imposed constraints, it is possible to scan the search space of possible parameter values ​​significantly faster than conventional solutions. Indeed, in the prior art, an iterative approach is required, with each iteration testing a different parameter value. The proposed method also makes it possible to quickly find the optimal value of the parameter, or at least a good approximation of that optimal value. The method of the present invention is suitable for rapid prototyping.

[0018] In a preferred embodiment, a variable is characterized by one or more parameters from a set of parameters comprising: {bit width, dynamic range, integer part size, fractional part size, decimal point position, i.e., separation between integer and fractional parts}.

[0019] Preferably, one or more subtasks of the operation are multiplications and / or additions.

[0020] Advantageously, the method comprises the step of determining the total error introduced by one or more subtasks.

[0021] In some embodiments, one noise source comes from the removal of bits at the least significant side of the input of one subtask. In other embodiments, one noise source may come from the exclusion of bits at the most significant side of the input of a subtask. However, the input of a subtask can also be considered the output of a previous subtask.

[0022] Advantageously, the operations are multiplication or multiply-accumulate operations performed by a Fast Fourier Transform, and the input operands are sets of polynomials.

[0023] In another embodiment, determining a representation of a variable output by one of the subtasks may comprise finding a maximum value represented by the variable.

[0024] In one embodiment, some of the parameters are grouped together into parameter groups, which is particularly advantageous when there are a large number of parameters. Grouping can help reduce the number of parameters in the model.

[0025] In a preferred embodiment, the described method is applied in a fully homomorphic encryption scheme.

[0026] In another preferred embodiment, the operations are performed on a reconfigurable hardware device.

[0027] In another aspect, the present invention relates to a program executable on a programmable device, comprising instructions which, when executed, perform the method described above.

[0028] In yet another aspect, the present invention relates to a device configured to perform an input operand operation in a cryptographic application, wherein an output resulting from execution of the operation satisfies one or more predefined constraints, the operation comprising one or more subtasks, each subtask of the operation outputting a variable as an input for a subsequent subtask or as an output of the operation, at least one of the subtasks receiving the input operand, the device comprising processing means for determining one or more characteristics of the variable output by the one subtask, the variable being characterized by one or more parameters based on a model of a noise source originating from one of the subtasks and / or at least one characteristic of an input to the one subtask, determining the representation of the variable by fixing at least one of the parameters to a value such that the one or more parameters satisfy the one or more predefined constraints, and applying the representation of the variable when performing the linear operation in the cryptographic application.

[0029] In a preferred embodiment, the device is implemented as a hardware accelerated computing system.

[0030] Certain objects and advantages of the present invention have been described above for the purpose of summarizing the invention and the advantages achieved over the prior art. Of course, it is understood that not necessarily all such objects or advantages may be achieved in accordance with any particular embodiment of the invention. Thus, for example, one skilled in the art will recognize that the present invention may be embodied or carried out in a manner that achieves or optimizes one advantage or group of advantages taught herein, without necessarily achieving other objects or advantages that may be taught or presented herein.

[0031] These and other aspects of the invention will be apparent from and elucidated with reference to the embodiment(s) described hereinafter.

[0032] The invention will now be further described, by way of example only, with reference to the accompanying drawings, in which like reference numerals refer to like elements in the various views, and in which: [Brief explanation of the drawings]

[0033] [Figure 1] A block scheme for performing the linear operation ax+by+c is shown. [Figure 2] The intermediate and output variables in the scheme of Figure 1 are shown. [Figure 3] The introduction of additional building blocks into the scheme of FIG. 2 is shown. [Figure 4] 1 shows the partitioning scheme used for the calculations at the nodes in Example 2. [Figure 5] 1 shows a butterfly structure as commonly used in FFT implementations. [Figure 6] 10 shows additional building blocks for the division into subtasks and intermediate variables in the third example. [Figure 7] A scheme for polynomial multiplication using FFT is presented. DETAILED DESCRIPTION OF THE INVENTION

[0034] The present invention will be described with respect to particular embodiments and with reference to certain drawings but the present invention is not limited thereto but only by the claims.

[0035] Furthermore, terms such as first, second, etc. in this specification and claims are used to distinguish between similar elements and do not necessarily describe an order in time, space, hierarchy, or in any other way. Terms so used are interchangeable under appropriate circumstances, and it should be understood that the embodiments of the invention described herein are capable of operation in orders other than those described or illustrated herein.

[0036] It should be noted that the term "comprising" used in the claims should not be interpreted as being limited to the means listed thereafter, nor as excluding other elements or steps. Thus, the term "comprising" specifies the presence of the so-mentioned mentioned features, integers, steps, or components, but is not interpreted as excluding the presence or addition of one or more other features, integers, steps, or components, or groups thereof. Thus, the scope of the expression "a device comprising means A and B" should not be limited to a device consisting only of components A and B. The above means that, in the context of the present invention, the relevant components of the device are only A and B.

[0037] Throughout this specification, a reference to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment is included in at least one embodiment of the invention. Thus, the appearances of the phrase "in one embodiment" or "an embodiment" in various places throughout this specification do not necessarily all refer to the same embodiment, although they may. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner, as would be apparent to one of ordinary skill in the art from this disclosure, in one or more embodiments.

[0038] Similarly, in describing exemplary embodiments of the invention, it should be understood that various features of the invention may be grouped together in a single embodiment, figure, or description for the purpose of streamlining the disclosure and aiding in understanding one or more of the various inventive aspects. However, this method of disclosure is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in fewer than all features of a single foregoing disclosed embodiment. Accordingly, the claims that follow this specification are expressly incorporated herein, with each claim standing on its own as a separate embodiment of this invention.

[0039] Furthermore, although some embodiments described herein may include some features and not include some features included in other embodiments, combinations of features from different embodiments are intended to form different embodiments within the scope of the present invention, as will be understood by those skilled in the art. For example, in the following claims, any of the claimed embodiments may be used in any combination.

[0040] It should be noted that the use of a particular term when describing a particular feature or aspect of the present invention is not to be taken as suggesting that the term is redefined herein to be limited to including any particular characteristic of the relevant feature or aspect of the present invention.

[0041] In the description provided herein, numerous specific details are set forth. However, it will be understood that embodiments of the present invention may be practiced without these specific details. In other instances, well-known methods, structures, and techniques have not been shown in detail in order not to obscure an understanding of this specification.

[0042] The present invention discloses a novel method for deriving parameters that determine how to represent variables when performing an operation (such as an FFT) in cryptographic applications, e.g., a fully homomorphic encryption scheme, or how to represent the output variables resulting from that operation.

[0043] The inventors of the present invention made the following observations while searching for an efficient way to perform FFT operations in cryptographic applications. Certain cryptographic applications require computations that contain deterministic mathematical "noise." Therefore, these applications can tolerate approximate computations that also contain deterministic algorithmic noise. The cipher works with uniformly random values, limiting the dynamic range of the calculated coefficients, which makes it easier to predict the bit representation range, or word length, required to represent the coefficients. The noise tolerated by the FFT in cryptographic applications depends on the (freely chosen) cryptographic parameter set, not on the application constraints. The cryptographic parameter set can be chosen to tolerate more or less noise. These observations provide an opportunity to perform FFT operations such that the intermediate variables applied in performing the operations have optimized representations, and in turn, these observations led to the invention as presented herein.

[0044] Specifically, the present invention presents a method for establishing one or more parameters that determine how variables are represented when performing operations on input operands in cryptographic applications. While the mathematical descriptions of algorithms that perform such operations assume infinite precision for the variables, hardware and software implementations must determine the specific representation type of the variables, e.g., fixed-point, floating-point, block-floating-point, etc., and the precision of the selected representation. This choice affects implementation cost and accuracy.

[0045] Once the representation type for each variable has been selected, the exact parameters of this representation need to be determined. For example, in the case of a fixed-point representation, the least significant bit (LSB) and most significant bit (MSB) to be represented need to be determined. Floating-point representations are parameterized by the minimum and maximum values ​​(and thus the bit size (word length)) of both the mantissa and the exponent. For example, the MSB value characterizes whether overflow can occur or not. In this invention, a method is presented to determine efficient values ​​for one or more of these representation parameters for use in implementing cryptographic applications.

[0046] As an example, the parameterization of MSB and LSB is shown below. Assume a value a with 8 integer bits and 16 fractional bits and a value b with 4 integer bits and 8 fractional bits. Then the full precision result c=a×b has 8+4=12 integer bits and 16+8=24 fractional bits. In this case, we say that the MSB of c is at position 12 and the LSB is at position -24. In the implementation, the parameterization is done for the variables c:MSBc and LSBc. By truncating the bits at the MSB, i.e. by rescaling (for example by choosing MSBc=11), we can achieve a certain overflow probability P overflow This value depends on the distribution of the values ​​a and b, and in practice it is best to have all MSBs equal to, say, P overflow <2 -64 By truncating the bits on the LSB side, some noise due to quantization is introduced, which adds to the output noise, although any form of rounding could be considered instead of truncation.

[0047] Importantly, the representation of the variables affects the implementation cost, with a larger range of possible values ​​resulting in a more accurate implementation at the expense of higher computational costs. In a typical implementation, there are design constraints on the precision of the output variable(s). These constraints are known a priori and may, for example, be the maximum noise variance introduced or the maximum probability of having a variable overflow (e.g., 2 -20 or 2 -40) The goal is to determine parameters that allow for an efficient implementation while satisfying the above design constraints.

[0048] A general overview of the proposed approach is now provided. The method applies to a specific algorithm (e.g., FFT) being implemented, which performs an operation on input operands in cryptographic applications. The input operands consist of one or more variables, depending on the operation being considered. For example, if a subtask performs a multiplication of two variables supplied to it, the two variables may form the input operands. One or more constraints are imposed on certain characteristics of the output resulting from the operation (e.g., a maximum value for the variance of the introduced noise). The goal is to determine efficient parameters for the representations of the intermediate and output variables in the implementation. At a high level, the method comprises three main steps. First, a model of the noise source(s) affecting one or more constraints on the characteristics of the output is constructed as a function of the parameters of the determined representation(s). In a next step, a specific value is determined for each parameter of the representation such that all constraints are satisfied. Preferably, the values ​​of these parameters are determined in an optimal manner, i.e., according to an appropriate optimization function. The parameter values ​​are then used to implement the operation on a programmable (hardware) device.

[0049] In some embodiments, the operations are linear operations, i.e., an operation f such that f(x+y)=f(x)+f(y) and f(cx)=cf(x), for all x and y, where c is a constant.

[0050] Execution of an operation involves the execution of one or more subtasks of the operation (e.g., addition, multiplication), where at least one of the subtasks receives at its input the input operands of the operation. One of the subtasks outputs a variable that is the resulting output of the operation. Any subtask that does not produce an output of the operation under consideration produces a variable, referred to herein as an intermediate variable. Any intermediate variable is then used as an input to one or more subsequent subtasks.

[0051] The construction of a model can be done as follows: The algorithm performing the calculations is divided into various subtasks and intermediate variables are identified. For each subtask, the characteristic input-output behavior is determined, subject to constraints (e.g., noise to be introduced, scaling coefficients from input to output, ...). For each of these variables, a type of representation (i.e., fixed-point, floating-point, ...) is selected. The parameters of this representation (e.g., maximum representable value, minimum representable value, ...) are left undetermined and initially remain symbolic, i.e., variables that do not yet have specific values.

[0052] To analyze the execution of the algorithm, an extra building block is introduced into the scheme of operations at each intermediate variable. This building block represents the effect of the limited precision of the variable's representation, but does not affect the algorithm itself. To achieve this, the extra building block has an input-output behavior that links the symbolic parameters to the imposed constraints.

[0053] The algorithm is then passed from input to output, and a model is built for each constraint. For this, one or more relevant characteristics (e.g., noise variance, input variance, maximum possible value, ...) at the input of a subtask or input operand are determined, and these characteristics are then propagated to the output. For each subtask, the input-output behavior is used to convert the input characteristics into the corresponding output characteristics. As a result, for each constraint, a model of the constrained characteristics is obtained as a function of the symbolic parameters.

[0054] In the next step of the method, values ​​are determined for each of the symbolic parameters such that the constraints are satisfied. Preferably, these values ​​are selected so that the implementation cost is as low as possible. One way to achieve this is to select, for each symbolic parameter, a cost function that models the implementation cost for a given value of this parameter. The solution can then be found by solving an optimization problem to determine values ​​that reduce, preferably minimize, the overall cost function while respecting all constraints.

[0055] Finally, the selected values ​​for the parameters are applied to instantiate the design of an algorithm for performing linear operations in cryptographic applications. First example

[0056] In a first example, a simple algorithm is considered to compute the value of the expression ax+by+c for input operands with x and y values, where the intermediate variables are expressed as fixed-point numbers and a, b, and c denote constants. The exact subtask sequence of this linear operation is shown in Figure 1. The goal is to select the value of the least significant bit (LSB) position of each intermediate variable. The constraint is the maximum noise variance σ of the output variable. 2 maxnoise For simplicity, this example assumes that the input variances are distributed with a given variance and a mean of zero, and that if the precision of the variables is reduced, this reduction is performed using rounding operations.

[0057] As mentioned above, first a model is developed that allows the evaluation of constraints. As shown in Figure 1, the computation is divided into subtasks and intermediate variables are identified. For each subtask, the input-output behavior must be determined with respect to properties related to one or more imposed constraints. In this example, the relevant properties are the least significant bit (LSB), noise, and signal variance. in1 and σ 2 noise,in1 and a first input x having LSB in2 and σ 2 noise,in2For the subtask f(x,y)=x+y, which is an addition with a second input having LSB out =min(LSB in1 ,LSB in2 ) and noise σ 2 noise,out =σ 2 noise,in1 +σ 2 noise,in2 There is. Multiplication of two inputs f(x,y)=x * For y, input-output behavior LSB out =LSB in1 +LSB in2 and σ 2 noise,out =σ 2 noise,in1 * σ 2 in2 +σ 2 in1 * σ 2 noise,in2 +σ 2 noise,in1 * σ 2 noise,in2 (based on the assumption that the inputs have zero mean, assumed here for simplicity). For each intermediate variable v (see Figure 2, intermediate variables are given subscripts indicating the operation from which they were derived), the least significant bit LSB v It is necessary to introduce a symbolic parameter, which is written in bold to distinguish it from other parameters or properties.

[0058] Next, intermediate variables are introduced into the scheme as additional building blocks, as shown in Figure 3. These blocks model the imprecision due to limited range representation. A model is constructed for the noise introduced by truncating the least significant bits with a uniform distribution, i.e., the truncated LSB bits are independently and uniformly distributed. For each additional building block, the following input-output behavior is obtained: LSB out =LSB v and σ 2 noise,out =σ 2 noise,in +ramp(2 2LSBv -2 2LSBin ) / 12 where the input is the least significant bit LSB in and the noise distribution σ 2 noise,in where the latter term represents the noise level increased by the loss of precision. The ramp() function returns 0 for negative input values ​​and the input value for positive input values. The reason for having this function is that the LSB v <LSB in This is because there is additional noise only if the relevant bits are discarded, which occurs when

[0059] Once the input-output behavior is described, the model can be walked through to determine the properties associated with the constraints as a function of the symbolic parameters. The intermediate calculations at various nodes can then be noted. For example, after multiplying a by x, LSB=LSB a +LSB x σ 2 =σ 2 a +σ 2 x σ 2 noise =0 The additional building blocks and intermediate variables V ax Considering the imprecision in the representation of LSB=LSBax σ 2 =σ 2 a +σ 2 x σ 2 noise =ramp(2 2LSBax -2 2(LSBa+LSBx) ) / 12 A similar formula can be written down for the other branch where b and y are multiplied. After adding by to ax, LSB=min(LSB ax ,LSB by ) σ 2 =σ 2 a * σ 2 x +σ 2 b * σ 2 y σ 2 noise =ramp(2 2LSBax -2 2(LSBa+LSBx) ) / 12+ramp(2 2LSBby -2 2(LSBb+LSBy) ) / 12 and the intermediate variable V ax+by Considering the inaccurate representation of LSB=LSB ax+by σ 2 =σ 2 a * σ 2 x +σ 2 b * σ 2 y σ 2 noise =ramp(2 2LSBax -2 2(LSBa+LSBx) ) / 12+ramp(2 2LSBby -2 2(LSBb+LSBy) ) / 12+ramp(2 2LSBax+by -2 2min(LSBax,LSBby) ) / 12 This process finally gives the symbol parameter LSB ax , LSB by , LSB ax+by , and LSB out σ as a function of 2 noise,out This value yields the maximum noise variance σ at the output. 2 maxnoise Remember that we are constrained to be:

[0060] In the next step of the method, values ​​of the symbolic parameters are determined. 2 noise,out (LSB ax ,LSB by ,LSB ax+by ,LSB out )≦σ 2 maxnoise where the parameters must each be fixed to a value such that this constraint is satisfied. One way to do this is to construct a cost function, e.g., a function in which all parameters are costed equally according to their bit width, resulting in a cost function: LSB ax +LSB by +LSB ax+by +LSB out Efficient parameter values ​​can then be found using an optimizer that optimizes the cost function under the given constraints. Of course, in some embodiments of the method, it is possible to change the cost function to one that more closely represents the implementation cost.

[0061] Another cost function that may be considered is, for example, an FPGA implementation where multiplications are performed in dedicated DSP blocks. In this case, there is an 18-bit multiplication available, which can be expanded to more bits at the cost of using these DSP block multiplications. Multiplications may then be costed as 1 if the bit width (MSB-LSB) is between 1 and 18, and as 3 if the bit width is between 19 and 36.

[0062] In embodiments that run the risk of exploding the number of noise sources, noise sources with (roughly) similar characteristics can be combined by adding them together, thereby reducing the number of variables to be considered. Second Example

[0063] To calculate ax+by+c, the same algorithm as in the first example is considered, but here another constraint is added, namely no overflow of variables, and the most significant bit MSB is used as the symbol parameter that needs to be determined. v In the following we will explain the additional steps required in the method to take this additional constraint into account.

[0064] Input-output behavior related to overflow constraints is added. Two additional properties are recorded: the maximum absolute value (MAV) of the variable and a list of all previous overflow conditions. Such a list is created for each intermediate variable, representing the conditions on the variable that must be satisfied to avoid overflow. The input-output behavior with respect to these properties is then as follows: For addition, the MAV out =MAV op1 +MAV op2 and the list of overflow conditions of the inputs are combined into a new combined list of overflow conditions. out =MAV op1 * MAV op2 and as before, the input's list of overflow conditions is combined into a new list with the overflow conditions.

[0065] Next, we need to add the input-output behavior of the intermediate variable building block. out =MAV in There is a condition MSB v ≧log2(MAV in ) is added to the list of overflow conditions.

[0066] Figure 4 shows the calculation of some properties. After multiplication of a and x, MAV=MAVa * MAV x list = [] Including the additional building block vax, MAV=MAV a * MAV x list=[MSB ax ≧log2(MAV a * MAV x )] Again, a similar formula can be written down for the branch where b is multiplied by y. When a.x+by is summed, we get: MAV=MAV a * MAV x +MAV b * MAV y list=[MSB ax ≧log2(MAV a * MAV x ), MSB by ≧log2(MAV b MAV y )] v ax+by After an additional block on MAV=MAV a * MAV x +MAV b * MAV y list=[MSB ax ≧log2(MAV a * MAV x ), MSB by ≧log2(MAV b MAV y )] LSB ax+by ≧log2(MAV a * MAV x +MAV b * MAV y )] This becomes:

[0067] Next, the values ​​of the symbolic parameters are again determined, which can be done by constructing a cost function as already described above.

[0068] The method described above can be generalized to other constraints, input distributions, or situations. For example, the maximum probability of overflow for each variable, P overflow,max Other constraints can be considered, such as: In this case, the distribution of variables is recorded throughout the algorithm, and for each intermediate variable v, P[v>2 MSBv ] <P overflow,max A simplified version of this condition is to track only the variance (and possibly the mean) of the variables and make assumptions on their distribution, usually a Gaussian distribution due to the central limit theorem. Third Example

[0069] One notable application of the method of the present invention is when polynomial multiplication is performed using the Fast Fourier Transform (FFT). By employing an FFT scheme, polynomial multiplication can be performed in an accelerated manner. FFT-based multiplication is a well-known technique and is based on the convolution integral theorem: c=a×b=FFT -1 (FFT(a).FFT(b)) where c, a, and b denote polynomials. FFT-based multiplication is also nowadays used in cryptographic applications, such as fully homomorphic encryption (FHE). FFT-based multiplication works by transforming the input polynomial into another representation using an FFT. In this domain, the multiplication operation can be performed pointwise (N operations). The result must then be transformed back to the initial representation using an inverse FFT (IFFT). The FFT and IFFT transform operations are typically the most expensive operations of FFT-based multiplication, requiring O(N.log(N)) operations, where N is the number of coefficients in the polynomial. The number of coefficients determines the depth and width of the FFT, as well as other parameters.

[0070] FFT-based multiplication operates on complex numbers, where both the real and imaginary parts are real, while other multiplication algorithms use integers. When finite precision is used to represent real numbers, the multiplication calculation is not always exact and may contain noise, i.e., a small error δ may be introduced. FFT -1 (FFT(a).FFT(b))=c+δ This is due to the inherent nature of FHE, which can tolerate a certain level of noise introduced by the FFT. In FHE, the (mathematical) noise required for safety is already present in the equation. FHE can inherently tolerate a certain level of this mathematical noise, and can also tolerate up to a certain level of additional noise due to the use of the FFT. This means that the magnitude of the noise δ must be considered very carefully. FHE implementations impose strict limits on the noise introduced. If the noise introduced into the polynomial multiplication by the FFT is too large, the calculation will fail and give incorrect results.

[0071] NTT is an exact variant of FFT with δ=0, but as mentioned above, imposes constraints on the parameters of the encryption scheme.

[0072] An important part of the FFT transform is the butterfly operation, as shown in the diagram in Figure 5. In implementing the FFT algorithm, a butterfly operation with two inputs and two outputs is well known, which recursively decomposes a discrete Fourier transform of composite size n=rm into r smaller transforms of size m, where r is the base of the transform. These smaller DFTs are then combined via a butterfly of size r, which is itself a DFT of size r pre-multiplied by a power of 1 known as a twiddle factor (performed m times on the corresponding output of the sub-transform).

[0073] Therefore, the variables in the Fast Fourier Transform and the variables in the butterfly operation are complex numbers. However, it is usually possible to assume that the distribution and properties of the real and imaginary parts are the same. In such a scenario, the analysis can focus on the properties of the real part only.

[0074] In the example considered here, a maximum noise variance constraint is imposed on the butterfly structure (as in the first example). Again, the algorithm is first divided into subtasks. Then, the intermediate variables v at , v c , v d Additional building blocks are added to the scheme regarding:

[0075] The multiplication subtask can be simplified by utilizing knowledge of the rotation input properties. real and the imaginary part t imag An interesting property of any twiddle factor t with t real 2 +t imag 2 = 1. Given a number x with real and imaginary parts of the same variance, multiplying x by a twiddle factor t does not change the variance, i.e., var(xt) = var(x). This can be easily derived as follows: var(real((x real +i·x imag )·(t real +i·t imag ))) =var(x real ·t real -x imag ·t imag ) =t 2 real var(x real )+t 2 imag var(x imag ) =var(x real ) Therefore, for multiplication, the input-output behavior is at =LSB a +LSB t and σ 2 noise,out =σ 2 noise,x +σ 2 x σ 2 noise,t(again, based on the assumption that the inputs have zero mean), where the input-output behavior of the additional block when in1 and in2 are added is the same as before, i.e. LSB out =min(LSB in1 ,LSB in2 ) and σ 2 noise,out =σ 2 noise,in1 +σ 2 x σ 2 noise,in2 is.

[0076] The model can then be calculated starting from the rotated inputs, which are reduced in precision by the finite representation (except for rotates 1 and -1). LSB=LSB t σ 2 =1 σ 2 noise =2 2LSBt / 12

[0077] Thus, after an additional building block on the intermediate variable vat, the real part of the product is obtained. LSB=LSB at σ 2 =σ 2 a σ 2 noise =σ 2 noise,a +2 2LSBt / 12 * σ 2 a +ramp(2 2LSBat -2 2(LSBa) ) / 12 A similar formula is obtained for the imaginary part.

[0078] After an additional building block on the intermediate variable vc, LSB out =LSB c σ 2c =σ 2 a +σ 2 b σ 2 noise,out =σ 2 noise,c =σ 2 noise,a +2 2LSBt / 12 * σ 2 a +σ 2 noise,b +ramp(2 2LSBat -2 2(LSBa) ) / 12+ramp(2 2LSBc -2 2min(LSBat、LSBb) ) / 12 Fourth Example

[0079] In a fourth example, polynomial multiplication using an FFT is considered, along with a specific use case of a fully homomorphic encryption scheme. The goal of this operation is to compute the dot product of the input (a vector of polynomials) and the bootstrap key (also a vector of polynomials). To efficiently handle such multiplication, a three-step procedure can be used: an FFT, coefficient-wise multiplication and accumulation, and an inverse FFT. Such a procedure is shown in Figure 7. However, unlike typical FFT-based multiplications, in the figure the second multiplication term (i.e., the bootstrap key) does not undergo an explicit FFT operation. This is because the input is known in advance, so the FFT can be precomputed with very high accuracy, meaning that this particular FFT does not need to be considered in the method.

[0080] First, the multiply-accumulate operation is considered. Because this operation is performed coefficient-by-coefficient, it can be modeled using multiplication and addition operations similar to those described in Examples 1 and 2. The FFT and inverse FFT operations are primarily composed of several layers of butterfly operations. Therefore, applying the analysis of Example 3 to these butterflies yields a model of the FFT and IFFT operations. In some embodiments of polynomial multiplication, the implementation may use different types of butterfly operations (radix-2, radix-4, ...), but the analysis of these butterflies can be performed similarly to the analysis of Example 3. By combining the building blocks described above, a noise model based on a full FFT-based polynomial multiplication can be constructed.

[0081] One challenge is that the substantial number of operations leads to a substantial number of parameters that need to be determined. To reduce the number of parameters in the model, similar parameters may be grouped together. In this example, there is a high degree of parallelism and structure that can be used to do this. For example, one may combine similar parameters for variables that are in the same "layer" of the FFT (i.e., variables that have undergone the same number of butterfly operations) or variables after multiplication operations in a multiply-accumulate. This reduces the number of parameters from approximately O((V+1)N / 2log2(N / 2)), where V is the vector length and N is the number of coefficients in the polynomial, to approximately (2log2(N / 2)), which is close to the number of layers in the proposed algorithm.

[0082] Furthermore, it should be noted that typical cryptographic applications, such as FHE, require the implementation of negative circular convolution rather than conventional circular convolution. In circular convolution (with N coefficients), out-of-bounds coefficients (at positions i>N) are cycled up to the first coefficient (at position iN). In contrast, in negative circular convolution, these coefficients are not only cycled but also nullified. To achieve this, many implementations of cryptographic applications include a so-called twist-and-fold step at the beginning and end of the algorithm that takes into account the negative convolution behavior. This twist-and-fold step involves an additional compression of the input and multiplication with a complex number. The compression takes two integers a and b and combines them to form the complex number a+b. This operation does not typically introduce noise. The additional multiplication operation can be modeled using the approach in Examples 1 and 2.

[0083] As already mentioned above, it is necessary to select the representation type of the variables. For example, in an FFT scheme for performing polynomial multiplication, a fixed-point representation is advantageously selected. The above-mentioned method can then be applied to determine the parameters of the fixed-point representation of the variables that will occur when performing the operation while satisfying the imposed constraints.

[0084] Given the optimal parameters obtained by the method of the present invention, a hardware circuit can be constructed using fixed-point calculations on these parameters. In practice, it may be advantageous to have a library of parameterized hardware circuit implementations where the fixed-point bit width is a generic parameter. The circuit can be chosen to match the input type, and these parameters are set at "circuit synthesis time" to match the required output noise δ.

[0085] Given the optimal parameters, a hardware circuit can be simulated with this parameter setting. The output noise δ can be measured and compared to a floating-point reference implementation. The output noise can be verified to meet the noise bounds (e.g., 2 standard deviations) determined above. An FPGA bitstream can be created for the circuit with the optimal fixed-point parameter set determined in the manner described above. The FPGA bitstream can accelerate the FHE bootstrap procedure, which involves many (thousands) of iterations of polynomial-vector multiplication.

[0086] While the invention has been illustrated and described in detail in the drawings and foregoing description, such illustration and description are illustrative or exemplary and not restrictive. The foregoing description details particular embodiments of the invention. However, even though the foregoing is set forth in detail below in this document, it will be understood that the invention can be practiced in many ways. The invention is not limited to the disclosed embodiments.

[0087] Other variations to the disclosed embodiments can be understood and effected by those skilled in the art in practicing the claimed invention, from a study of the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other elements or steps, and the indefinite articles "a" or "an" do not exclude a plurality. A single processor or other unit may fulfill the functions of several items recited in the claims. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage. A computer program may be stored / distributed on a suitable medium, such as, for example, an optical storage medium or a solid-state medium, provided together with or as part of other hardware, or may be distributed in other forms, such as, for example, via the Internet or other wired or wireless communication systems. Any reference signs in the claims should not be construed as limiting the scope.

Claims

1. 1. A method for deriving, by a device comprising processing means, one or more parameters determining representations of variables to be used when performing an operation on input operands in a cryptographic application, wherein an output resulting from the execution of said operation satisfies one or more predefined constraints, said operation comprising one or more subtasks, each subtask of said operation outputting said variable as an input for a subsequent subtask or as an output of said operation, at least one of said subtasks receiving said input operands; determining one or more characteristics of the variable output by one of the subtasks based on a model of a noise source originating from one of the subtasks and / or at least one characteristic of an input to the one subtask, wherein the one or more characteristics of the variable are characterized by the one or more parameters; determining the representation of the variable by fixing at least one of the parameters to a value such that the one or more characteristics satisfy the one or more predefined constraints; applying the representation of the variable to an implementation of the operation in the cryptographic application; A method for providing

2. The method of claim 1 , wherein the variable is characterized by one or more parameters from a set of parameters comprising: {bit width, dynamic range, integer part size, fractional part size, decimal point position}.

3. 3. The method of claim 1, wherein the one or more subtasks comprise one or more of a group of subtasks comprising: {multiplication, addition}.

4. A method according to any preceding claim, comprising determining the total error introduced by the one or more subtasks involved in the operation.

5. The method of any one of claims 1 to 4, wherein one noise source comes from the removal of bits at the least significant bit side of the input of said one subtask.

6. The method of any one of claims 1 to 5, wherein one noise source comes from the exclusion of bits at the most significant bit side of the input of the one subtask.

7. The method of any one of claims 1 to 6, wherein the operations are multiplication or multiply-accumulate operations performed by a Fast Fourier Transform, and the input operands are a set of polynomials.

8. A method according to any preceding claim, wherein determining the representation of the variable output by one of the subtasks comprises finding the maximum value represented by the variable.

9. The method according to any one of claims 1 to 8, wherein some of the parameters are grouped into parameter groups.

10. The method of any of claims 1 to 9, applied in a fully homomorphic encryption scheme.

11. The method of any one of claims 1 to 10, wherein the calculation is performed on a reconfigurable hardware device.

12. A program executable on a programmable device comprising instructions which, when executed, perform the method according to any one of claims 1 to 11.

13. 1. A device configured to perform an operation on input operands in a cryptographic application, wherein an output resulting from execution of the operation satisfies one or more predefined constraints, the operation comprising one or more subtasks, each subtask of the operation outputting a variable as input for a subsequent subtask or as an output of the operation, at least one of the subtasks receiving the input operand, the device comprising: processing means for: determining one or more characteristics of the variable output by one of the subtasks, the variable being characterized by the one or more parameters based on a model of a noise source originating from one of the subtasks and / or at least one characteristic of an input to the one subtask; determining the representation of the variable by fixing at least one of the parameters to a value such that the one or more characteristics satisfy the one or more predefined constraints; and applying the representation of the variable when executing the operation in the cryptographic application.

14. The device of claim 13 implemented as a hardware accelerated computing system.

Images