Cryptographic processing device, cryptographic processing method, and cryptographic processing program

Abstract

This paper aims to speed up the calculations of full adders that realize fully homomorphic encryption. [Solution] The ciphertext processed by the cryptographic processing device 1 has two values ​​as plaintext, with a value corresponding to the symbol 0 or 1 plus an error with a predetermined variance, and is a fully homomorphic ciphertext that can be used for logical operations without decryption.By setting the error so that the overlap of errors between plaintexts is within a predetermined value, the number of operations using polynomials when performing full adder operations using fully homomorphic encryption is reduced.

Description

[Technical field]

[0001] The present invention relates to a cryptographic processing device, a cryptographic processing method, and a cryptographic processing program for processing ciphertext. [Background technology]

[0002] Homomorphic encryption is an encryption method that allows data processing to be performed on encrypted data without decrypting the data. Additive homomorphic encryption is an encryption in which there is an operation between ciphertexts that corresponds to the addition between plaintexts, and multiplicative homomorphic encryption is an encryption in which there is an operation between ciphertexts that corresponds to the multiplication between plaintexts. Additive homomorphic encryption, which treats finite cyclic groups as integers and performs only additive operations (addition and subtraction), and multiplicative homomorphic encryption, which performs only multiplicative operations (multiplication), have long been known. Finite cyclic groups allow integer multiplication by repeated addition, which means that plaintext can be multiplied by an integer, and repeated multiplication makes it possible to calculate the exponentiation of plaintext. There is also Fully Homomorphic Encryption (FHE), which processes both additive and multiplicative operations while keeping the data encrypted. One type of fully homomorphic encryption is based on the Learning with Errors (LWE) problem, which involves adding small errors to plaintext during encryption that do not affect decryption.

[0003] In fully homomorphic encryption based on the LWE problem, errors accumulate as calculations are performed, so bootstrapping is performed to reduce the error components while still encrypting the data before the errors become too large to make decryption possible. The computation time of bootstrapping accounts for most of the computation time involved in fully homomorphic encryption. In addition, because bootstrapping handles a huge amount of data, the amount of computation required is enormous. Therefore, in fully homomorphic encryption calculations, it may not be possible to obtain the results within a practical time frame. A technique that dramatically improves this problem is TFHE (Fast Fully Homomorphic Encryption over the Torus), which is shown in Non-Patent Document 1 (referred to as the above paper in the following description). [Prior art documents] [Patent documents]

[0004] [Non-Patent Document 1] TFHE:Fast Fully Homomorphic Encryption over the Torus. Journal of Cryptology, 33:34-91, 2020, I. Chillotti, N. Gama, M. Georgieva, and M. Izabachene Summary of the Invention [Problem to be solved by the invention]

[0005] Incidentally, there are two types of homomorphic encryption: bit-wise homomorphic encryption, which has two values ​​as plaintext and is based on logical operations, and integer-wise homomorphic encryption, which uses an entire integer as plaintext as one ciphertext. The TFHE described in Non-Patent Document 1 is of the bit-wise type. In bit-wise homomorphic encryption, one ciphertext can only contain 1 bit of information, so if you want to process a 32-bit integer, for example, you need to process 32 ciphertexts. Addition, subtraction, multiplication, and comparison of integers are frequently used in various data processing. When using ciphertext with 1 bit of information, the calculation is performed as if designing a logic circuit, but when adding and subtracting 32-bit integers, one half adder and 31 full adders are used. For multiplication, approximately 32 squared (1024) full adders are used. Therefore, in order to reduce the processing time of fully homomorphic encryption and to improve its efficiency, it is necessary to speed up the calculations of the full adder, including bootstrapping. The present invention has been made in consideration of the above circumstances, and one object of the present invention is to increase the speed of the calculations of a full adder required for fully homomorphic encryption and reduce the processing time of fully homomorphic encryption. [Means for solving the problem]

[0006] The present invention provides a cryptographic processing device for processing a ciphertext, comprising: the cryptographic processing device is a cryptographic processing device that performs a fully homomorphic encryption operation that processes values ​​on a cyclic group that cyclically ranges from 0 to a predetermined value while keeping the values ​​encrypted; A computation unit that performs homomorphic computations on three or more ciphertexts related to a predetermined computation, and a computation unit that calculates a new ciphertext by applying a first polynomial to the ciphertext resulting from the homomorphic computations, The three or more ciphertexts are a first ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 4 of the predetermined value, a second ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 4 of the predetermined value, and a third ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 4 of the predetermined value, and a third ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 4 of the predetermined value, and the calculation unit obtains a fifth ciphertext by adding the first ciphertext, the second ciphertext, and the third ciphertext while keeping them encrypted, and subtracting a fourth ciphertext of 1 / 8 of the predetermined value while keeping it encrypted, and the calculation unit obtains a second polynomial obtained by rotating coefficients of a first polynomial according to the fifth ciphertext. the calculation unit obtains a 6th ciphertext of a coefficient of the second polynomial by circulating a coefficient of the first polynomial in accordance with the 9th ciphertext, and extracts an 11th ciphertext of the coefficient of the third polynomial from the 10th ciphertext, and a plaintext corresponding to the 9th ciphertext is obtained from the 6th ciphertext. The calculation unit obtains a 9th ciphertext by adding the 5th ciphertext, the 5th ciphertext, and an 8th ciphertext that is 1 / 4 of the predetermined value while remaining encrypted. The calculation unit obtains a 10th ciphertext of a third polynomial by circulating a coefficient of the first polynomial in accordance with the 9th ciphertext, and extracts an 11th ciphertext of the coefficient of the third polynomial from the 10th ciphertext. The present invention also provides a cryptographic processing device for processing ciphertext, the cryptographic processing device performing a fully homomorphic encryption operation that processes values ​​on a cyclic group that cyclically cycles between 0 and a predetermined value while keeping them encrypted, the cryptographic processing device including: an arithmetic unit that performs a homomorphic operation related to a predetermined operation on three or more ciphertexts; and a calculation unit that calculates a new ciphertext by using a first polynomial on the ciphertext resulting from the homomorphic operation, the three or more ciphertexts being a first ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 8 of the predetermined value, a second ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 8 of the predetermined value, and a third ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 8 of the predetermined value, the calculation unit obtains a sixth ciphertext of a second polynomial obtained by circulating a coefficient of the first polynomial in accordance with the fifth ciphertext, and extracts a seventh ciphertext of a coefficient of the second polynomial from which a plaintext of a carry output corresponding to the fifth ciphertext is obtained, and the calculation unit obtains an eighth ciphertext of a fourth polynomial obtained by circulating a coefficient of a third polynomial in accordance with the fifth ciphertext, and extracts a ninth ciphertext of a coefficient of the fourth polynomial from which a plaintext of a sum output corresponding to the fifth ciphertext is obtained, Effect of the Invention

[0007] According to one aspect of the present invention, the processing time of fully homomorphic encryption can be reduced by increasing the speed of the calculation of a full adder. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram for explaining the configuration of a full adder circuit with the minimum number of logical operation elements. [Diagram 2] FIG. 2 is a diagram illustrating a functional configuration of the cryptographic processing device according to the present embodiment. [Diagram 3] FIG. 3 is a diagram (part 1) for explaining in detail the arithmetic process of a full adder based on the functional configuration of FIG. 2. [Figure 4] FIG. 3 is a diagram (part 2) for explaining in detail the arithmetic process of the full adder based on the functional configuration of FIG. 2. [Diagram 5] FIG. 1 is an image diagram for explaining a circular group that the TLWE cipher has as plaintext. [Figure 6] This is an image diagram of binary gate bootstrapping operation. [Figure 7] 1 is a flowchart (part 1) illustrating the flow of arithmetic processing by a full adder executed by a cryptographic processing device. [Figure 8]13 is a flowchart (part 2) illustrating the flow of arithmetic processing by a full adder executed by a cryptographic processing device. [Figure 9] FIG. 2 is a diagram illustrating an example of the configuration of an AOI gate. [Figure 10] FIG. 1 illustrates an example of the configuration of an OAI gate. [Figure 11] FIG. 2 is a diagram for explaining the functional configuration of a cryptographic processing device that realizes an AOI gate and an OAI gate. [Figure 12] 12 is a diagram for explaining in detail the calculation process of the AOI gate and the OAI gate based on the functional configuration of FIG. 11. [Figure 13] 11 is a flowchart illustrating the flow of computation processing of an AOI gate and an OAI gate executed by the cryptographic processing device. [Figure 14] 10 is a diagram showing ciphertexts input and output to Gate Bootstrapping of the present embodiment. FIG. [Figure 15] FIG. 1 is a block diagram illustrating an embodiment of a computing device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. In the following description, alphanumeric characters enclosed in [] indicate that it is a vector, and alphanumeric characters enclosed in {} indicate that it is a set. In addition, in this specification, the term "logical operation" refers to a binary or multi-valued logical operation.

[0010] The cryptographic processing device of this embodiment performs the calculation of a full adder using fully homomorphic encryption. It is known that an AND circuit unit and an XOR circuit unit constituting a full adder included in a cryptographic processing device perform operations for obtaining AND and XOR for bit-wise homomorphic encryption, respectively. However, in order to achieve fully homomorphic encryption, a process for reducing errors called Gate Bootstrapping, which is described below, is required after the calculation to obtain AND and the calculation to obtain XOR. This Gate Bootstrapping process took time, but the cryptographic processing device of this embodiment reduces the number of homomorphic operations that constitute a full adder by reducing the error range added to the plaintext and enabling binary multi-input logical operations (homomorphic operations). As a result, the encryption processing device of this embodiment can reduce the number of gate bootstraps performed after each homomorphic computation, and can speed up the computation of the full adder.

[0011] FIG. 1 is a diagram illustrating a full adder circuit with the minimum number of logical operation elements. Although Figure 1 illustrates a full adder as a hardware circuit using logical operation elements, it may also be thought of as a full adder program executed by a CPU in which the full adder is implemented in software. When implementing bit-wise homomorphic encryption processing in software, calculations are performed with the idea of ​​designing a logic circuit (logic gate) for the ciphertext. The same applies to the cryptographic processing device of this embodiment, which will be described with reference to FIG. 2 and subsequent figures. The full adder circuit 50 is composed of two half adders 51 and 52 and one OR circuit section (arithmetic processing section for obtaining OR) 53. The first half adder 51 includes an AND circuit section (arithmetic processing section for obtaining AND) 51A and an XOR circuit section (arithmetic processing section for obtaining XOR) 51B. The second half adder 52 includes an AND circuit section (arithmetic processing section for obtaining AND) 52A and an XOR circuit section (arithmetic processing section for obtaining XOR) 52B. Inputs A and B to be added are input to an AND circuit section 51A and an XOR circuit section 51B of a first half adder 51. The output of the AND circuit section 51A of the first half adder 51 and the output of the AND circuit section 52A of the second half adder 52 are input to the subsequent OR circuit section 53, and a carry output C0 (Carry out) is output from the OR circuit section 53. The output from the XOR circuit part 51B of the first half adder 51 and the carry input C i (Carry in) is input to the AND circuit section 52A and the XOR circuit section 52B of the second half adder 52. The output S (Sum) of the full adder circuit 50 is output from the XOR circuit portion 52B of the second half adder 52.

[0012] As shown in FIG. 1, the full adder 50 includes two AND circuit units, two XOR circuit units, and an OR circuit unit, and thus includes a total of five logical operation elements (processing units corresponding to logical operation elements). Therefore, the calculation time of five logic operation elements is required for each operation of one full adder. In the case of the TFHE shown in the above paper, the calculation time of one logic operation element is approximately 16 ms, and the calculation time of the entire full adder 50 equipped with five logic operation elements is approximately 80 ms. When used for fully homomorphic encryption calculations using TFHE, gate bootstrapping must be performed in the latter stages of the front-stage calculations (homomorphic operations) of the five logic operation elements. Note that gate bootstrapping takes up almost the entire processing time of the homomorphic logic operation. Therefore, it may be considered that the calculation time for the fully homomorphic encryption by the full adder circuit 50 in FIG. 1 is equivalent to five Gate Bootstrapping operations. In addition, since there is no dependency between the operations of the AND circuit section and the XOR circuit section that constitute the half adder 51 and the half adder 52, when the full adder is configured by software, parallel operations can be performed by a method such as multithreading. By using parallel operations, the calculations of a half adder can be performed in the calculation time of one logical operation element. Therefore, the operation of one full adder shown in Figure 1 can be performed in the operation time of three logic operation elements. However, even in this case, the operation of one full adder requires 48 ms of operation time, which is almost the same as the operation time for three Gate Bootstrapping operations.

[0013] TFHE is a bit-wise encryption scheme based on logic gates such as AND and XOR circuits. By using a full adder, it is possible to handle all of the four arithmetic operations (addition, subtraction, multiplication, and division) of integers, as well as comparison operations. However, in bit-wise encryption, one ciphertext can only contain one bit of information. Addition, subtraction, multiplication, division and comparison (where comparison is equivalent to checking the positive or negative result of a subtraction) of integers are frequently used in various data processing operations, but the data handled is usually large in bit length. For example, if you want to process a 32-bit integer, you need to process 32 ciphertexts.

[0014] For bit-wise fully homomorphic encryption, one half adder and 31 full adders are used to perform addition and subtraction of 32-bit integers. For multiplication, approximately 32 squared (1024) full adders are used. In order to make the calculations of fully homomorphic encryption (compared to arithmetic operations) more practical, it is important to increase the speed of the full adder, which is frequently used in fully homomorphic encryption calculations. As described below, the cryptographic processing device of this embodiment reduces the number of homomorphic operations by enabling binary multi-input logical operations (homomorphic operations) by reducing the error range added to the plaintext, particularly in a full adder used for fully homomorphic encryption operations. As a result, the encryption processing device of this embodiment can reduce the number of gate bootstraps that require a long computation time in the latter stage of homomorphic computation, and can significantly reduce the processing time of fully homomorphic encryption.

[0015] FIG. 2 is a diagram illustrating the functional configuration of the cryptographic processing device of this embodiment. The cryptographic processing device 1 includes a control unit 10, a storage unit 20, a communication unit 25, and an input unit . The control unit 10 includes a reception unit 11, a first calculation unit 12, a second calculation unit 13, a third calculation unit 14, a first bootstrap unit (first calculation unit) 15, a second bootstrap unit (second calculation unit) 16, a third bootstrap unit (third calculation unit) 17, and an output unit 18. The first calculation unit 12, the second calculation unit 13, the first calculation unit 15, and the second calculation unit 16 relate to [Example 1] and [Example 2] described below, and the third calculation unit 14 and the third calculation unit 17 relate to [Example 3] and [Example 4] described below. The reception unit 11 receives an input of a ciphertext to be subjected to an operation via the communication unit 25 and the input unit 26 . In relation to the later-described first and second embodiments, the first arithmetic unit 12 performs a first homomorphic operation on the binary three-input ciphertext accepted by the acceptance unit 11. The second arithmetic unit 13 performs a second homomorphic operation on the ciphertexts output from the first arithmetic unit 12 . In relation to a third embodiment described later, the third arithmetic unit 14 performs a third homomorphic operation on the binary three-input ciphertext received by the reception unit 11. The first arithmetic unit 12, the second arithmetic unit 13, and the third arithmetic unit 14 are arithmetic processing units that realize, by software, the arithmetic operations (homomorphic operations) of the full adder using the logic gates (AND circuit unit, XOR circuit unit) described in Fig. 1. At least one of the first arithmetic unit 12, the second arithmetic unit 13, and the third arithmetic unit 14 may be realized by hardware.

[0016] In the first and second embodiments, the first bootstrap unit 15 performs a binary gate bootstrap process described below on the calculation result of the first calculation unit 12, and generates a carry output C O The new ciphertext, which can take two values, is output as: The second Bootstrapping unit 16 performs a binary gate bootstrap process, which will be described below, on the calculation result of the second calculation unit 13, and outputs as an output S a new ciphertext that can take two values. Regarding [Example 3], the third bootstrap unit 17 performs a binary gate bootstrap process described below on the calculation result of the third calculation unit 14, and outputs S and a carry output C. O The new encrypted texts are output, each of which indicates

[0017] The output unit 18 outputs the final calculation result to the outside of the cryptographic processing device 1 or to another processing process executed by the cryptographic processing device 1. The storage unit 20 can store input ciphertext, temporary files and temporary data used in the calculations of the full adder, and output ciphertext. Furthermore, the storage unit 20 can store an encrypted database 60 . The communication unit 25 connects the cryptographic processing device 1 to a network, enabling communication with external devices. The cryptographic processing device 1 can function as a database server by storing the encrypted encrypted database 60 in the memory unit 20 and including the communication unit 25. In this case, the cryptographic processing device 1 can receive an encrypted query from a terminal device serving as an external device, perform a search on the encrypted encrypted database 60, and respond with an encrypted search result to the terminal device. The input unit 26 inputs to the cryptographic processing device 1 a ciphertext to be processed.

[0018] FIG. 3 is a diagram for explaining in detail the arithmetic process of the full adder based on the functional configuration of FIG. 2 in relation to the first and second embodiments. In the explanation of FIG. 3, ciphertexts ca, cb, and cc input to the cryptographic processing device 1 are all TLWE ciphertexts shown in the above paper. As will be described in detail below, the TLWE encryption is a bit-wise fully homomorphic encryption that has a plaintext value of 0 or μ (non-zero). A variety of operations can be performed by logical operations using logic gates. As described later, the TLWE ciphertext has two values, with the plaintext being a specified value corresponding to the binary symbols 0 or 1 with an error having a specified variance, and logical operations can be performed on it without decryption.

[0019] In the configuration shown in FIG. 3, the (binary) Gate Bootstrapping presented in the paper of Non-Patent Document 1 (the above paper) is used. The TFHE Gate Bootstrapping presented in the above paper is described in detail below. In the first and second embodiments, the input ciphertexts ca, cb, and cc are input to the first calculation unit 12 to perform homomorphic calculation, and the calculation result (ciphertext ct = ciphertext ca + cb + cc) is input to the first Bootstrapping unit 15 which performs binary gate bootstrapping. The output of the first bootstrap unit 15 is a carry output C that can take one of two values ​​(0, μ) as a plaintext. O is the ciphertext cy of The ciphertext ct = ciphertext ca + cb + cc is input to the second calculation unit 13, a homomorphic operation is performed between ct, and the output is input to the second calculation unit 16, where binary gate bootstrapping is performed to output the ciphertext cz of the output S. The time required for the homomorphic calculation by the first calculation unit 12 and the homomorphic calculation by the second calculation unit 13 is negligible. Gate Bootstrapping consumes almost all of the processing time when processing a full adder using homomorphic arithmetic.

[0020] When performing full adder calculations using binary gate bootstrapping, such as in the full adder circuit 50 shown in FIG. 1, it is necessary to execute gate bootstrap once each in the downstream stages of the AND circuit sections 51A and 52A, the XOR circuit sections 51B and 52B, and the OR circuit section 53, for a total of five times. In contrast, in the cryptographic processing device 1 of Examples 1 and 2, in the calculation of the full adder, three binary ciphertexts are input to the first calculation unit 12, and the number of homomorphic calculation processes is reduced to two in total by improving the Gate Bootstrapping. As a result, in the cryptographic processing device 1, the total number of gate bootstraps, which account for almost all of the homomorphic arithmetic processing, can be reduced to 2. Therefore, compared with the full adder circuit 50 shown in Fig. 1, the cryptographic processing device 1 can reduce the calculation processing time by approximately 60%.

[0021] Furthermore, the cryptographic processing device 1 may execute the processing of the first bootstrapping unit 15 and the processing of the second bootstrapping unit 16 in parallel by multi-thread processing. In this case, the cryptographic processing device 1 can reduce the number of stages of bootstrapping, which occupies most of the processing time in the calculation of the full adder, to one stage. In contrast, the full adder circuit 50 shown in FIG. 1 can execute the AND circuit unit 51A and the XOR circuit unit 51B, and the AND circuit unit 52A and the XOR circuit unit 52B in parallel, respectively, but the number of stages of bootstrapping as a whole is three stages. Therefore, even when parallel processing is used, the cryptographic processing device 1 can reduce the calculation processing time by about 66% compared to the full adder circuit 50 shown in FIG. 1. As described above, since gate bootstrapping takes up almost the entire operation time of the full adder in fully homomorphic encryption, the cryptographic processing device 1 can significantly speed up the operation of the full adder by reducing the number of times gate bootstrapping is performed.

[0022] This section provides details on Gate Bootstrapping as explained in TFHE. Gate Bootstrapping is a technique for making fully homomorphic encryption practical, which was previously considered impractical due to the enormous amount of data and computation time required. The TFHE in the above paper uses a cryptosystem called TLWE cryptosystem, which is an LWE (Learning with Errors) cryptosystem constructed on a circular group, to realize various homomorphic logical operations (and ultimately any operation such as addition and multiplication) between TLWE ciphertexts at high speed and with small data size while reducing errors during calculation.

[0023] The input for Gate Bootstrapping in TFHE is a TLWE ciphertext encrypted with a private key. In TFHE, fully homomorphic encryption (FHE) is realized based on TLWE ciphertext. TLWE cryptography is a special case of LWE cryptography, which is a type of lattice cryptography (LWE cryptography defined on a circular group). It is known that TLWE encryption is additively homomorphic, and additive operations between TLWE-encrypted plaintexts can be performed without decrypting the ciphertext.

[0024] FIG. 5 is an image diagram for explaining a circular group that the TLWE cipher has as a plaintext. TLWE encryption has as plaintext the real number μ corresponding to point 0 of the circular group {T} shown in Figure 5, which progresses from 0 with real number precision and returns to 0 when it reaches 1, or any point other than 0 (non-zero) on the circular group {T}. The TLWE encryption itself uses any point on the circular group as plaintext, and uses the vicinity of 0 (including error) and the vicinity of μ (including error) as plaintext. Points on the circle group {T} are also referred to herein as "elements." A cryptographic processing device that handles TFHE performs common homomorphic operations such as additive operations between such TLWE ciphertexts, and by using Gate Bootstrapping to keep the error in the operation results within an appropriate range, it realizes fully homomorphic encryption (FHE) that allows logical operations to be performed again (at a later stage).

[0025] [TLWE cipher] Explain the TLWE cipher. As an element on the circle group {T}, prepare a vector [a] of N uniformly distributed random numbers. Also prepare a secret key [s] of N binary values, 0 and 1. If the mean is the plaintext μ and e is a random number with a Gaussian (normal) distribution and a predetermined variance α, then the set ([a],[s]·[a]+e) is an example of a TLWE ciphertext. The average value of e when an infinite number of TLWE ciphertexts are generated for the same plaintext μ is the plaintext μ, where μ is a plaintext without errors and e is a plaintext with errors. Note that "·" represents the inner product of vectors. The same applies hereafter. If we define the above [s]·[a]+e as b, the TLWE ciphertext can be expressed as ([a], b). φ s (([a],b))=b-[s]·[a]=e is the function that decrypts TLWE ciphertext. Since TLWE ciphertext encrypts plaintext by adding the inner product of the secret key vector and random number vector and an error, it is possible to decrypt the TLWE ciphertext with an error by calculating the inner product of the secret key vector and random number vector. At this time, if the secret key vector is unknown, the components that make up the inner product cannot be calculated, and therefore decryption is not possible.

[0026] This TLWE encryption is additively homomorphic, meaning that addition operations between TLWE ciphertexts can be performed without decrypting the ciphertexts. Add the two TLWE ciphertexts ([a],b) and ([a'],b') as is to obtain ([a]+[a'],b+b'), and then use the above decryption function φ s If you enter φ s (([a]+[a'],b+b'))=(b+b')-[s]·([a]+[a'])=(b-[s]·[a])+(b'-[s]·[a'])=φ s ([a],b)+φ s ([a'],b') This gives us the sum of the two plaintexts. This proves that the TLWE ciphertext is an "additively homomorphic encryption". In the TFHE described in the above paper, various calculations are achieved by repeatedly performing additive operations on the TLWE ciphertext with errors added to the plaintext, and reducing the errors by gate bootstrapping.

[0027] In what follows, a "trivial ciphertext" such as ([0],μ) is a TLWE ciphertext that can be decrypted with any private key, i.e., a ciphertext that can be decrypted with any private key to decrypt the same plaintext. In ([0],μ), [0] represents the zero vector. "Trivial ciphertext" can be treated as TLWE ciphertext, but it essentially contains the plaintext as is. The TLWE ciphertext ([0],μ) is decrypted by the decryption function φ s When multiplied by φ s Since (([0],μ))=μ-[s]·0=μ, and the secret key [s] is multiplied by the zero vector [0] and disappears, the plaintext μ can be easily obtained. Such a ciphertext is nothing but a trivial ciphertext for the plaintext μ.

[0028] We explain the finite cyclic groups used in Gate Bootstrapping of TFHE. In Gate Bootstrapping, the quotient ring of a polynomial ring is used as a finite cyclic group. Explain that the quotient ring of a polynomial ring is a finite cyclic group. A polynomial of degree n is generally n x n +a n-1 x n-1 It is expressed as +...+a0. All these sets form a commutative group for the sum of polynomials f(x) + g(x). Also, the product of polynomials, f(x)g(x), has properties similar to a commutative group, except that an inverse does not necessarily exist. Such a group is called a monoid. The distributive law holds for sums and products of polynomials as follows: f(x){g(x)+g'(x)}=f(x)g(x)+f(x)g'(x) Therefore, if we define the sum and product of polynomials as elements, they form a "ring", which is called a polynomial ring.

[0029] In TFHE, we use a polynomial ring whose coefficients are the circle group {T}, and denote such a polynomial ring as T[X]. Let T(X) be a polynomial ring, and let T[X](X n If we decompose it into the form X+T[X] and collect only the remainders, we obtain the remainder ring of the polynomial ring, since this is also a "ring". In TFHE, the quotient ring of a polynomial ring is defined as T[X] / (X n +1).

[0030] The polynomial ring T[X] / (X n +1), use any coefficient μ(μ∈T) to express the polynomial F(X)=μX n-1 +μX n-2 +···+μX+μ Take out. When we multiply an element F(X) in the quotient ring of a polynomial ring by X, we get μX n-1 +μX n-2 It becomes +···+μX-μ, and the coefficient of the top term changes from positive to negative and appears as a constant term. Multiplying it by X again gives us μX n-1 +μX n-2 +···+μX 2 The same thing happens again: -μX-μ (the coefficient of the top term flips from positive to negative and appears as a constant term). Repeat this process n times to get -μX n-1 -μX n-2 ...-μX-μ and the coefficients of all terms are negative.

[0031] If we continue multiplying by X, -μX n-1 -μX n-2 -μX+μ -μX n-1 -μX n-2 +μX+μ The coefficient of the top term flips from negative to positive and appears as a constant term. If you repeat this 2n times, you get the element F(X)=μX n-1 +μX n-2Returning to +···+μX+μ, in this way, the top-order coefficient (μ) appears in the bottom-order constant term with its sign inverted (-μ), resulting in an overall shift of one term. That is, polynomial F(X)=μX n-1 +μX n-2 +···+μX+μ is the quotient ring T[X] / (X n +1), it is a finite cyclic group of order 2n. In TFHE, the cryptographic processing device realizes fully homomorphic encryption by utilizing the properties of a polynomial F(X) based on a remainder ring of such a polynomial ring.

[0032] [TRLWE cipher] In addition to the TLWE cipher, Gate Bootstrapping uses a cipher called the TRLWE cipher. This section explains the TRLWE encryption. The R in TRLWE stands for ring, and TRLWE is an LWE encryption scheme built on rings. Like TLWE, TRLWE is also an additively homomorphic encryption scheme. The ring in TRLWE cryptography is the remainder ring T[X] / (X n +1). To obtain the TRLWE encryption, we use the polynomial ring T[X] / (X n +1) at random. In practice, the n coefficients of the n-1 degree polynomial are selected from the circle group {T} as uniformly distributed random numbers. If the degree of the polynomial is n-1, then X n Let polynomial a(X) be a polynomial of degree n-1, since it cannot be divided by +1 and there is no need to consider the remainder.

[0033] Randomly collect n values ​​from the binary values ​​0 and 1 and construct the polynomial s(X) that will become the secret key below. s(X)=s n-1 X n-1 +s n-2 X n-2 +···s1X+s0 n random numbers e i The average value is the plaintext μ iLet the random numbers be Gaussian (normal) distributed with variance α, and then construct the following polynomial e(X) from these. e(X)=e n-1 X n-1 +e n-2 X n-2 +···e1X+e0 s(X) a(X) + e(X) is expressed as f(X)(X n +1)+b(X) to obtain b(X). As a result, the TRLWE ciphertext obtained is (a(X), b(X)). Like the TLWE encryption, the TRLWE encryption uses random numbers for encryption, so an infinite number of ciphertexts can be generated for the same secret key and plaintext. In addition, the TRLWE encryption code has the same structure as the TLWE encryption code. s ((a(X),b(X))=b(X)-s(X)·a(X)+g(X)(X n +1), φ s T[X] / (X n +1), serves as the decoding function.

[0034] [Gadget Decomposition] Explain Gadget Decomposition. The coefficients of the polynomial used in the TRLWE ciphertext are real numbers between 0 and 1, which are elements of the circle group {T} in FIG. 5, and have only a decimal part. The operation of decomposing this into several bits in binary notation is defined as Gadget Decomposition (Dec) in TFHE of the above paper. For example, if the degree n of the polynomial F(X) of the TRLWE ciphertext is n=2, then one unit of division is Bg=2. 2 Then, decompose it into l=3 elements, where each element is between -Bg / 2 and Bg / 2. The TRLWE ciphertext is a combination of two polynomials, such as (a(X), b(X)) above. Therefore, the TRLWE ciphertext d can be regarded as a two-dimensional vector whose elements are polynomials that are the elements of the remainder ring of the polynomial ring. For example, d=[0.75X 2 +0.125X+0.5,0.25X 2 +0.5X+0.375] Therefore, in the following, each element is written as Bg -1 =Decompose into the form of a sum of powers of 0.25.

[0035] On the circle group {T}, 0.75=-0.25, so d=[0.75X 2 +0.125X+0.5,0.25X 2 +0.5X+0.375] =[-0.25X 2 +0.125X+0.5,0.25X 2 +0.5X+0.25+0.125] = [0.25 × (-X 2 +2)+0.25 2 ×2X+0.25 3 ×0,0.25×(X 2 +2X+1)9+0.25X 2 ×2+0.25 3 ×0] It can be broken down as follows. Therefore, when Gadget Decomposition is performed, Dec(d) = [-X 2 +2,2X,0,X 2 +2X+1,2,0] This becomes the vector.

[0036] We also define an operator H that converts a vector back to a ciphertext. Based on the above example, The matrix TIFF0007597400000001.tif3034 is the inverse transform operator H. By calculating Dec(d) H, the TRLWE ciphertext d' is obtained. The lower bits are rounded off.

[0037] For a TRLWE ciphertext d, the operation of obtaining [v] such that ||d-[v]·H|| is the minimum value can also be said to be a gadget decomposition, where || is the norm (length) of the vector. All coefficients of e(X) have a mean of 0 and a variance of α, so 2l ciphertexts Zi=(a(X),b(X)) are generated. Then, the plaintext μ is encrypted as follows to obtain the following ciphertext k. TIFF0007597400000002.tif2643This ciphertext k is defined as the TRGSW ciphertext BK. The TRGSW ciphertext BK constitutes the Bootstrapping Key used below.

[0038] Explain Bootstrapping Key. The Bootstrapping Key is used to encrypt a private key for use in Gate Bootstrapping. In addition to the secret key [s] (Nth degree) used for the TLWE ciphertext, each element of the secret key [s'] for encrypting the secret key [s] for use in Gate Bootstrapping is selected as a binary value of 0 or 1. The degree of the private key [s'] must be the same as the degree n of the polynomial used in the TRLWE encryption. Create a TRGSW ciphertext BK for each element of the private key [s]. When decrypted with the private key [s'], φ s’ Create 2l (el) TRLWE ciphertexts Zj such that (Zj)=0. And, according to the structure of the TRGSW ciphertext above, Let's say TIFF0007597400000003.tif2539. A set of N TRGSW ciphertexts, the same number as the degree of the secret key [s], is called a Bootstrapping Key.

[0039] The cross product of the TRGSW ciphertext BKi and the TRLWE ciphertext d is BKi×d=Dec(d)·BKi It is defined as: Gadget Decomposition is an operation to obtain [v] such that ||d-[v]·H|| is the minimum value for the TRLWE ciphertext d. Therefore, [v] = Dec(d) and the error (ε a (X),ε b Using (X), [v] H=d+(ε a (X),ε b (X)). As a result, BKi×d=Dec(d)·BKi The result is TIFF0007597400000004.tif2243. The left half calculates the dot product, and the right half calculates [v] H=d+(ε a (X),ε b Substituting (X), we get The result is TIFF0007597400000005.tif1490, which is the same as calculating the sum of the three ciphertexts c1, c2, and c3 below. TIFF0007597400000006.tif1945TRLWE encryption is an additively homomorphic encryption method, so adding two ciphertexts together is the same as adding two plaintexts together. C1 is Z j Since it is the sum of several times, the plain text φ s’ The expected value of (c1) is 0. Also, the decoded φ s’ In (c3), since the magnitude of the absolute value of the plaintext can be restricted by system parameters, it is set to be sufficiently small, including the subsequent calculations.

[0040] Then, φ s’ (BKi×d)=φ s’ (s i × d), but s i Whether s is 0 or 1, the calculation result is the sum of the three ciphertexts c1, c2, and c3. i It is not possible to determine whether it is 0 or 1. Assuming there are two TRLWE ciphertexts d0 and d1 corresponding to plaintexts μ0 and μ1, and substituting d=d1-d0 and finally adding d0, the CMux function shown below is completed. CMux(BK i ,d0,d1)=BKi×(d1-d0)+d0=Dec(d1-d0)·BKi +d0 The CMux function is i If μ0 is 0, the ciphertext of the plaintext μ0 is output without being decrypted, and s i If is 1, the ciphertext of plaintext μ1 is output without decrypting it. The CMux function can compute the ciphertext of either the plaintext μ0 or the plaintext μ1, but it does not know which one it chose.

[0041] TFHE's binary gate bootstraping is performed using the various pieces of information described above. Binary Gate Bootstrapping consists of three steps: (1) BlindRotate, (2) SampleExtract, and (3) KeySwitching, as described below.

[0042] FIG. 6 is a conceptual diagram of the operation of binary gate bootstrapping. Binary Gate Bootstrapping reduces the error of the homomorphic operation result between TLWE ciphertexts with respect to the plaintext through the three steps described below. In the following explanation, unless otherwise specified, the plaintext refers to the result of an operation between plaintexts that is the result of an operation between TLWE ciphertexts. In the circle group {T} in Figure 5, plaintexts in the ranges 0 to 0.25(1 / 4) and 0.75(3 / 4) to 1 are converted into a TLWE ciphertext of 0, and plaintexts in the range 0.25(1 / 4) to 0.75(3 / 4) are converted into a ciphertext of 0.25(1 / 4). During this conversion, the error added to the plaintext is within the range of ±1 / 16.

[0043] (1) BlindRotate BlindRotate is performed as the first step in Gate Bootstrapping. BlindRotate is the process that creates the TRLWE ciphertext. In BlindRotate, we convert the trivial TRLWE ciphertext (0,T(X)) with polynomial T(X) as plaintext into X-φs(c’) The TRLWE ciphertext multiplied by is obtained without decryption. 0 indicates the 0th degree polynomial 0. Here, φs(c') is the plaintext obtained by applying the LWE ciphertext c' below to the decryption function. In BlindRotate, the following polynomial F(X) is used as a test vector, which is a finite cyclic group as described above. F(X)=μX n-1 +μX n-2 +…μX+μ where μ=1 / 8 X n / 2 The following polynomial T(X) is obtained by multiplying T(X)=F(X) X n / 2 Prepare the following.

[0044] Suppose there is a TLWE ciphertext c obtained by encrypting plaintext μ1 with a secret key [s]. Each element of this TLWE ciphertext c = ([a], b) is multiplied by 2n and rounded off to obtain the LWE ciphertext c' = ([a'], b'). When the LWE ciphertext c'=([a'],b') is decrypted, μ1'=φ s (c') ≒ 2n × φ s (c) = 2nμ1. The larger n is, the smaller the error becomes relatively. Prepare a trivial TRLWE ciphertext (0,T(X)) with polynomial T(X) as plaintext, A0=X -b’ ×(0,T(X))=(0,X -b’ × T(X)). 0 indicates the 0th degree polynomial 0. In this case, b' is an integer, so the power can be naturally defined. Hereafter, the above-mentioned Bootstrapping Key, BK i Using, in order, A i =CMux(BK i ,A i-1 ,X a’i A i-1 ) is calculated. Here again, since a'i is an integer, the power of X can be naturally defined.

[0045] Then, s iWhen is 0, the plaintext remains unchanged, and s i When is 1, X a’i are multiplied in order. Therefore, If you repeat this with TIFF0007597400000007.tif2849, The result is TIFF0007597400000008.tif749. Where: TIFF0007597400000009.tif629 is equal to the decoding function φs(c') with the sign inverted, so The result is TIFF0007597400000010.tif741. Here, φ s’ (A n ) is the polynomial T(X) plus X -1 This is the ciphertext of a polynomial obtained by multiplying μ1' times. For each plaintext μ1 of the TLWE ciphertext c related to BlindRotate, a unique value (up to 2n values ​​using n coefficients and their sign inversion) is obtained according to the number of times μ1' (=2nμ1) that X is multiplied by the polynomial T(X). This can be regarded as a kind of lookup table.

[0046] (2)SampleExtract TRLWE ciphertext A obtained by BlindRotate in (1) n The plaintext polynomial φ obtained by decrypting s’ (A n ), counting from the lower terms, we get n / 2-φ s The coefficient of the (c')th term is -μ, and if it becomes negative, the coefficient of the term from the top down will be -μ. TRLWE Ciphertext A n The plaintext polynomial φ obtained by decrypting s’ (A n ), if we look only at the constant term of φ s (c') is greater than or equal to n / 2 and less than 3n / 2, i.e., φ s If (c) is 1 / 2±1 / 4, the constant term is μ. Otherwise, if φs(c) is ±1 / 4, the constant term is -μ. SampleExtract is the TRLWE ciphertext A obtained by BlindRotate in (1). n From this, we can obtain the plaintext polynomial φ without decrypting it. s’ (A n ) to obtain the TLWE ciphertext cs.

[0047] The process for obtaining the TLWE ciphertext cs will now be described. All TRLWE ciphertexts have degree n, Taking TIFF0007597400000011.tif1134 and a polynomial, it can be expressed as (A(X),B(X)). When this is decrypted with the private key [s'], the polynomial of the private key is TIFF0007597400000012.tif636, It can be expanded as TIFF0007597400000013.tif7116.

[0048] For this, the following calculation is carried out: I get TIFF0007597400000014.tif82136. Since it is a "modulus ring of a polynomial ring", (X n +1), we get the remainder The result is TIFF0007597400000015.tif18156.

[0049] moreover, If you put TIFF0007597400000016.tif1046, The file becomes TIFF0007597400000017.tif38143. The coefficients of each term of the plaintext polynomial can be found from TIFF0007597400000018.tif776. Of these, what we need is the coefficient of the constant term, so if we extract the coefficient for j=0, we get The result is TIFF0007597400000019.tif638. If you put TIFF0007597400000020.tif620, It can be transformed into a TLWE cipher decryption function, such as TIFF0007597400000021.tif8114.

[0050] In other words, the TRLWE ciphertext A obtained by BlindRotate in (1) n =(A(X),B(X)), the coefficients are When extracted as TIFF0007597400000022.tif1055, the original TRLWE ciphertext A n A new TLWE ciphertext ([a”], b1) is obtained, whose plaintext is the same as the constant term of the plaintext polynomial corresponding to a. This new TLWE ciphertext is the output of SampleExtract, and has two plaintexts: -μ or μ. The obtained TLWE ciphertext is added to the trivial ciphertext ([0],μ) whose plaintext is μ to obtain the TLWE ciphertext cs=([a”],b1)+([0],μ). Specifically, since μ=1 / 8 in the polynomial F(X) serving as the test vector, ciphertexts of −1 / 8 and 1 / 8 are obtained at this stage. Adding to this the trivial TLWE ciphertext ([0],1 / 8) with plaintext μ=1 / 8, we get -1 / 8+1 / 8=0 1 / 8+1 / 8=1 / 4 From this, a new TLWE ciphertext cs is obtained, which has one of the two plaintext values ​​0 or 1 / 4.

[0051] (3) Key switching The TLWE ciphertext cs obtained by SampleExtract in (2) is encrypted with the private key [s'], not the private key [s]. Therefore, it is necessary to replace the key of the TLWE ciphertext cs with the secret key [s] without decrypting the TLWE ciphertext cs, and return it to a state encrypted with the secret key [s]. Therefore, a key switching technique will be explained. The secret key [s] of the TLWE ciphertext used in the NAND operation was an N-th order vector. This is used to encrypt the secret key [s'] of the n-th vector used when creating the Bootstrapping Key. That is, TIFF0007597400000023.tif746 and the elements of the circle group {T}, real numbers between 0 and 1, are encrypted as shifted values ​​for each digit when expressed in binary. The private key is [s]. The "number of digits" t is a system parameter. When decrypted with the private key [s], The result is TIFF0007597400000024.tif737. This is the "key switching key". As mentioned above, the TLWE ciphertext cs = ([a], b) obtained in (2) is a value of 0 or 1 / 4 encrypted with the private key [s']. The number of elements of [a] is n, the same as the private key [s']. If we convert each of these into a t-bit fixed-point number, we get It can be written in the format TIFF0007597400000025.tif735. At this stage the error increases, but the maximum absolute value can be constrained by system parameters. As the main process of key switching, the following TLWE ciphertext cx is calculated. The term TIFF0007597400000026.tif862([0],b) is a trivial ciphertext, so when decrypted it gives b. When the result of decrypting the TLWE ciphertext cx is calculated, The file is TIFF0007597400000027.tif8118. s' i Since is a constant for j, we can factor it out as Enter TIFF0007597400000028.tif749 and substitute the formula obtained by decomposing it into fixed decimal points above. TIFF0007597400000029.tif977As a result, The file will be TIFF0007597400000030.tif530, which means the key change was successful.

[0052] The TLWE ciphertext cx obtained here is encrypted with the same secret key [s] as the TLWE ciphertext c that was input to Gate Bootstrapping. By performing key switching, the TLWE ciphertext is restored to the TLWE ciphertext encrypted with the secret key [s], and φ s If (c) is within ±1 / 4, then the plain text φ s (cx) is 0, φ s If (c) is in the range of 1 / 2±1 / 4, then the plaintext φ s (cx) is now 1 / 4. Through the above process, the result of Gate Bootstrapping was a TLWE ciphertext that was one of two values, 0 or 1 / 4, with an error within ±1 / 16. The maximum error does not depend on the input TLWE ciphertext c, but is fixed by the system parameters. Therefore, the system parameters are set so that the maximum error value is within ±1 / 16 of the input TLWE ciphertext. This makes it possible to perform NAND operations any number of times, making all kinds of operations possible, including addition and multiplication.

[0053] The errors in the "plaintext" of the TLWE cipher output from Gate Bootstrapping are the error added when the TLWE ciphertext is converted to an integer, the error added by CMux, the error when it is converted to a fixed-point number by key switching, etc. All of these errors can be constrained by the system parameters, and the system parameters can be adjusted so that the error taking all of these into account is ±1 / 16. This completes the TFHE Gate Bootstrapping process.

[0054] In this embodiment, the system parameters of the TFHE presented in the above paper are improved so as to reduce the error variance range from ±1 / 16 to ±1 / 24. According to this embodiment, three binary inputs can be processed with one homomorphic addition. In other words, three ciphertexts that can take two values ​​can be input as plaintexts to perform homomorphic operations. By performing gate bootstrapping on the homomorphic addition result, a three-input logic element can be configured along with the homomorphic operation. It is possible to create two logic elements that obtain the lower bit and the upper bit (carry) of the sum, respectively. The number of gate bootstraps, which account for almost all of the calculation time of a full adder, can be reduced from five to two. The two three-input logic elements have no dependency on each other, so two calculations can be processed in parallel.

[0055] [Example 1] The following description will be based on FIG. Suppose there are TLWE ciphertexts ca, cb, and cc corresponding to the inputs A, B, and C of the full adder, respectively. These ciphertexts are TLWE ciphertexts based on specially set system parameters, and are either generated by Gate Bootstrapping or newly encrypted. The TLWE ciphertexts ca, cb, and cc all have 0 or 1 / 4 as plaintext, and the error added to the plaintext is within the range of ±1 / 24. By using three binary inputs, there is a possibility that the error ranges will overlap, but the error added to the plaintext is smaller than ±1 / 16 in the above paper, and is set to within ±1 / 24. However, as described below, this does not apply if problems caused by overlapping errors are tolerable, and the error of ±1 / 24 in the embodiment or ±1 / 16 in the above paper may be adopted. The cryptographic processing device 1 calculates ca+cb+cc-(0,1 / 8) and obtains a TLWE ciphertext ct as the calculation result. (0,1 / 8) is a trivial ciphertext whose plaintext is 1 / 8.

[0056] The result of the calculation ca+cb+cc-(0,1 / 8) is as follows. ca is 0, cb is 0, cc is 0 (ca+cb+cc is the binary symbol 0+0+0=0) ⇒0+0+0-1 / 8=-1 / 8(7 / 8) ca is 0, cb is 0, cc is 1 / 4 (ca+cb+cc is the binary symbol, 0+0+1=1) ⇒0+0+1 / 4-1 / 8=1 / 8 ca is 0, cb is 1 / 4, cc is 0 (ca+cb+cc is the binary symbol 0+1+0=1) ⇒0+1 / 4+0-1 / 8=1 / 8 ca is 0, cb is 1 / 4, cc is 1 / 4 (ca+cb+cc is the binary symbol, 0+1+1=2) ⇒0+1 / 4+1 / 4-1 / 8=3 / 8 ca is 1 / 4, cb is 0, cc is 0 (ca+cb+cc is the binary symbol 1+0+0=1) ⇒1 / 4+0+0-1 / 8=1 / 8 ca is 1 / 4, cb is 0, cc is 1 / 4 (ca+cb+cc is the binary symbol 1+0+1=2) ⇒1 / 4+0+1 / 4-1 / 8=3 / 8 ca is 1 / 4, cb is 1 / 4, cc is 0 (ca+cb+cc is the binary symbol 1+1+0=2) ⇒1 / 4+1 / 4+0-1 / 8=3 / 8 ca is 1 / 4, cb is 1 / 4, cc is 1 / 4 (ca+cb+cc is the binary symbol 1+1+1=3) ⇒1 / 4+1 / 4+1 / 4-1 / 8=5 / 8

[0057] The TLWE ciphertext ct has one of the four plaintexts, 1 / 8, 3 / 8, 5 / 8, or 7 / 8, and the error added to the plaintext is within the range of ±1 / 8. This is because the errors of the TLWE ciphertexts ca, cb, and cc are multiplied by three, ±1 / 24.

[0058] Next, the cryptographic processing device 1 performs Gate Bootstrapping on the TLWE ciphertext ct in accordance with the above-mentioned paper. As a result, a TLWE ciphertext cy is obtained in which the plaintext is 0 when ca+cb+cc is the binary symbol 0 or 1, and the plaintext is 1 / 4 when ca+cb+cc is the binary symbol 2 or 3. In the TLWE ciphertext cy, the error added to the plaintext is within the range of ±1 / 24. This is called the most significant bit (carry output) of the sum of the full adder.

[0059] Next, the cryptographic processing device 1 performs homomorphic addition on the ciphertexts ct. The cryptographic processing device 1 performs the calculation ct+ct+(0,1 / 4) and performs gate bootstrapping as described in the above paper. The calculation result of ct+ct takes 0 or 1 / 2 as plaintext, and is a ciphertext cz with an error added to the plaintext within the range of ±1 / 4. The calculation results are as follows: ca is 0, cb is 0, cc is 0 ⇒-1 / 8+(-1 / 8)+1 / 4=0 ca is 0, cb is 0, cc is 1 / 4 ⇒1 / 8+1 / 8+1 / 4=4 / 8=1 / 2 ca is 0, cb is 1 / 4, cc is 0 ⇒1 / 8+1 / 8+1 / 4=4 / 8=1 / 2 ca is 0, cb is 1 / 4, cc is 1 / 4 ⇒3 / 8+3 / 8+1 / 4=8 / 8=1(0) ca is 1 / 4, cb is 0, cc is 0 ⇒1 / 8+1 / 8+1 / 4=4 / 8=1 / 2 ca is 1 / 4, cb is 0, cc is 1 / 4 ⇒3 / 8+3 / 8+1 / 4=8 / 8=1(0) ca is 1 / 4, cb is 1 / 4, cc is 0 ⇒3 / 8+3 / 8+1 / 4=8 / 8=1(0) ca is 1 / 4, cb is 1 / 4, cc is 1 / 4 ⇒5 / 8+5 / 8+1 / 4=12 / 8=3 / 2(1 / 2)

[0060] The result of gate bootstrapping is a TLWE ciphertext cz, where the plaintext is 0 when ca+cb+cc is a binary symbol of 0 or 2, and 1 / 2 when ca+cb+cc is a binary symbol of 1 or 3. The error added to the plaintext in ciphertext cz is within the range of ±1 / 24. This is the lower bit of the sum in the full adder. With this configuration, the cryptographic processing device 1 can reduce the number of gate bootstraps, which consume almost all of the calculation time in the calculations of the logic elements, to 2. As a result of an experiment, the calculation time was 22.4 ms. It was confirmed that the calculation time was reduced by 60% compared to 55.5 ms when Gate Bootstrapping was performed five times. In addition, there is no dependency between the two Gate Bootstrapping processes. Therefore, by parallelizing it using a method such as multithreading, it is possible to perform two Gate Bootstrapping processes in the processing time of one stage.

[0061] [Example 2] This is similar to the above in that it performs a three-input binary logic operation (operation is performed using three binary-valued ciphertexts as plaintexts as inputs) by reducing the error range added to the plaintext. In the above example (Example 1), the entire circle group {T} (0 to 1) was used to calculate the lower bits, so the test vector was as described in the above paper. In [Example 2], only the lower half (0 to 0.5) of the circle group {T} is used to calculate the lower bits, making the test vector special. The reason why only the lower half (0 to 0.5) of the circular group {T} is used is that there are no inverted positive and negative values ​​in the test vectors corresponding to the circular group {T}. The advantage is that the 0th to nth orders of the test vectors correspond one-to-one to the ciphertext. In addition, when only the lower half (0 to 0.5) of the circular group {T} is used, it is necessary to reduce the variance range of the plaintext error (±1 / 48) as shown below in order to prevent the errors from overlapping. However, as will be described later, this is not the case when the problems caused by the overlapping errors are tolerable, and the variance range of the errors may be ±1 / 24 as in the embodiment or ±1 / 16 as in the above paper.

[0062] Suppose there are TLWE ciphertexts ca, cb, and cc corresponding to the inputs A, B, and C of the full adder, respectively. These ciphertexts are TLWE ciphertexts based on specially set system parameters, and are either generated by Gate Bootstrapping or newly encrypted. The TLWE ciphertexts ca, cb, and cc each have 0 or 1 / 8 as plaintext, and the error added to the plaintext is within the range of ±1 / 48. In the TLWE ciphertexts ca, cb, and cc, 0 corresponds to the binary symbol 0, and 1 / 8 corresponds to the binary symbol 1. The cryptographic processing device 1 calculates ca+cb+cc+(0,1 / 16) and obtains a TLWE ciphertext ct as the calculation result. (0,1 / 16) is a trivial ciphertext whose plaintext is 1 / 16.

[0063] Note that ca+cb+cc is expressed in binary symbols as follows: ca is 0, cb is 0, cc is 0 ⇒ 0+0+0 = 0 ca is 0, cb is 0, cc is 1 / 8 ⇒ 0+0+1=1 ca is 0, cb is 1 / 8, cc is 0 ⇒ 0 + 1 + 0 = 1 ca is 0, cb is 1 / 8, cc is 1 / 8 ⇒ 0+1+1 = 2 ca is 1 / 8, cb is 0, cc is 0 ⇒ 1+0+0=1 ca is 1 / 8, cb is 0, cc is 1 / 8 ⇒ 1 + 0 + 1 = 2 ca is 1 / 8, cb is 1 / 8, cc is 0 ⇒ 1+1+0=2 ca is 1 / 8, cb is 1 / 8, cc is 1 / 8 ⇒ 1+1+1=3 This also applies to the following explanation.

[0064] The calculation result of ca+cb+cc+(0,1 / 16) is as follows. ca is 0, cb is 0, cc is 0 ⇒0+0+0+1 / 16=1 / 16 ca is 0, cb is 0, cc is 1 / 8 ⇒0+0+1 / 8+1 / 16=3 / 16 ca is 0, cb is 1 / 8, cc is 0 ⇒0+1 / 8+0+1 / 16=3 / 16 ca is 0, cb is 1 / 8, cc is 1 / 8 ⇒0+1 / 8+1 / 8+1 / 16=5 / 16 ca is 1 / 8, cb is 0, cc is 0 ⇒1 / 8+0+0+1 / 16=3 / 16 ca is 1 / 8, cb is 0, cc is 1 / 8 ⇒1 / 8+0+1 / 8+1 / 16=5 / 16 ca is 1 / 8, cb is 1 / 8, cc is 0 ⇒1 / 8+0+1 / 8+1 / 16=5 / 16 ca is 1 / 8, cb is 1 / 8, cc is 1 / 8 ⇒1 / 8+1 / 8+1 / 8+1 / 16=7 / 16 The TLWE ciphertext ct has one of the four plaintexts, 1 / 16, 3 / 16, 5 / 16, or 7 / 16, and the error added to the plaintext is within the range of ±1 / 16. This is because the TLWE ciphertexts ca, cb, and cc have three errors of ±1 / 48 added to them.

[0065] Next, the cryptographic processing device 1 performs Gate Bootstrapping on the TLWE ciphertext ct in accordance with the above-mentioned paper, except that while the coefficient of the test vector used in BlindRotate in the above-mentioned paper is μ=1 / 8, this time it is μ=1 / 16. As a result, a TLWE ciphertext cy is obtained in which the plaintext is 0 when ca+cb+cc is symbol 0 or 1, and the plaintext is 1 / 8 when ca+cb+cc is symbol 2 or 3. The error added to the plaintext is within the range of ±1 / 48. This is the carry output of the full adder.

[0066] Next, the cryptographic processing device 1 performs gate bootstrap on the TLWE ciphertext ct. In the above paper, the test vectors for BlindRotate are TIFF0007597400000031.tif752 where μ=1 / 8 X n / 2 The value multiplied by is used. Instead, the cryptographic processing device 1 uses the following as a test vector: TIFF0007597400000032.tif8160 where μ1=μ3=1 / 16, μ2=μ4=-1 / 16 is used.

[0067] Immediately after SampleExtract, a TLWE ciphertext is obtained, which can take two plaintexts: -1 / 16 and 1 / 16. From this point on, by adding (0, 1 / 16) and performing key switching as in the above paper, a TLWE ciphertext cz is obtained in which the plaintext is 0 when ca+cb+cc is symbol 0 or 2, and 1 / 8 is the plaintext when ca+cb+cc is symbol 1 or 3. The error added to the plaintext is within the range of ±1 / 48. This is the lower-order bit output of the sum. With this configuration, the cryptographic processing device 1 can reduce the number of gate bootstraps, which consume almost all of the calculation time in the calculations of the logic elements, to 2. As a result of an experiment, the calculation time was 22.4 ms. It was confirmed that the calculation time was reduced by 60% compared to 55.5 ms when Gate Bootstrapping was performed five times. In addition, there is no dependency between the two Gate Bootstrapping processes. Therefore, by parallelizing them using a method such as multithreading, it is possible to perform two Gate Bootstrapping processes in the processing time of one stage.

[0068] [Example 3] FIG. 4 is a diagram for explaining in detail the arithmetic process of the full adder based on the functional configuration of FIG. 2 in relation to [Example 3]. [Example 3] is based on the binary 3-input homomorphic operations explained in Examples 1 and 2, and further reduces the number of Gate Bootstrapping operations to one. As shown in Figure 4, the cryptographic processing device 1 of [Example 3] inputs the input ciphertexts ca, cb, and cc to the third calculation unit 12, performs homomorphic calculation, and inputs the calculation result (ciphertext ct = ciphertext ca + cb + cc) to the third Bootstrapping unit 17 which performs binary gate bootstrapping. The output of the third bootstrapping unit 17 is a carry output C that can take one of two values ​​(0, μ) as a plaintext. O The ciphertext of output S is cy, and the ciphertext of output S is cz. The time required for the homomorphic calculation by the third calculation unit 14 is negligible. Gate Bootstrapping consumes almost all of the processing time when processing a full adder using homomorphic arithmetic.

[0069] In the cryptographic processing device 1 of [Example 3], as in [Example 1] and [Example 2], three binary ciphertexts are input to the third calculation unit 12, and the total number of homomorphic calculation processes is reduced to one by improving Gate Bootstrapping. As a result, in the cryptographic processing device 1, the number of gate bootstraps, which account for almost all of the homomorphic arithmetic processing, can be reduced to once in total. Since gate bootstrapping takes up almost the entire operation time of the full adder in fully homomorphic encryption, the encryption processing device 1 can significantly speed up the operation of the full adder by reducing the number of times gate bootstrapping is performed.

[0070] By improving the system parameters of the above paper, the cryptographic processing device 1 reduces the error variance range from ±1 / 16 to ±1 / 36 or ±1 / 48. By setting the upper coefficient of the BlindRotate test vector to 0 and multiplying the result of the homomorphic operation by two types of polynomials, it is possible to create a logic element that obtains the lower bit and the upper bit (carry) of the sum for one BlindRotate result. This makes it possible to reduce the number of times of Gate Bootstrapping, which accounts for almost the entire operation time of a full adder, and BlindRotate, which accounts for the majority of that, from five to one.

[0071] The construction method differs depending on how the binary plaintext is arranged on the circular group {T}. In this specification, the method using 0 and 1 / 6 on the circular group {T} is referred to as the [6-partition version], and the method using 0 and 1 / 8 is referred to as the [8-partition version]. The "6-division version" corresponds to the above-mentioned "Example 1," and the system parameters are set so that the error added to the plaintext is within the range of ±1 / 36. The "8-division version" corresponds to the above-mentioned "Example 2," and the system parameters are set so that the error added to the plaintext is within the range of ±1 / 48. The [6-division version] uses the range of the cycle group {T} from 0 to 1, specifically the range from 0 to 0.5 + 1 / 6, while the [8-division version] uses the right half of the cycle group {T} (0 to 0.5).

[0072] Suppose that there are TLWE ciphertexts ca, cb, and cc corresponding to the inputs A, B, and C of the full adder, respectively. In the following, we set p=1 / 6 for the [6-way version] and p=1 / 8 for the [8-way version]. The TLWE ciphertexts ca, cb, and cc all have 0 or p as the plaintext, and the error added to the plaintext in the [6-part version] is within the range of ±1 / 36, and in the [8-part version] it is within the range of ±1 / 48.

[0073] First, the cryptographic processing device 1 (the third arithmetic unit 12) calculates ca+cb+cc+(0,p / 2), which is a trivial TLWE ciphertext whose plaintext is p / 2. The calculation result of ca+cb+cc+(0,p / 2) is as follows. ca is 0, cb is 0, cc is 0 ⇒0+0+0+p / 2=p / 2 ca is 0, cb is 0, cc is p ⇒0+0+p+p / 2=3p / 2 ca is 0, cb is p, cc is 0 ⇒0+p+0+p / 2=3p / 2 ca is 0, cb is p, cc is p ⇒0+p+p+p / 2=5p / 2 ca is p, cb is 0, cc is 0 ⇒p+0+0+p / 2=3p / 2 ca is p, cb is 0, cc is p ⇒p+0+p+p / 2=5p / 2 ca is p, cb is p, cc is 0 ⇒p+p+0+p / 2=5p / 2 ca is p, cb is p, cc is p ⇒p+p+p+p / 2=7p / 2 The plaintext has any one of the four values ​​p / 2, 3p / 2, 5p / 2, and 7p / 2, and a TLWE ciphertext ct is obtained in which the error added to the plaintext is within the range of ±1 / 12 or ±1 / 16.

[0074] The cryptographic processing device 1 (third bootstrap unit 17) performs a gate bootstrap process on the TLWE ciphertext ct in accordance with the above paper. In Gate Bootstrapping, the cryptographic processing device 1 performs BlindRotate using the following polynomial as a test vector. TIFF0007597400000033.tif660 where μ=p / 2 This test vector is a polynomial whose values ​​are limited to one interval that divides the circle group {T}. As a result of the BlindRotate, the cryptographic processing device 1 (the third Bootstrapping unit 17) obtains a TRLWE ciphertext cr=(a(X), b(X)). Next, the cryptographic processing device 1 multiplies the TRLWE ciphertext cr by polynomials fc(X) and fs(X), which do not exist in the above paper. fc(X) and fx(X) are [6-part version] TIFF0007597400000034.tif1147, [8 division version] Let's say TIFF0007597400000035.tif1258.

[0075] The cryptographic processing device 1 multiplies the TRLWE ciphertext cr by the polynomials fc(X) and fs(X), respectively, to obtain the TRLWE ciphertext cco and the TRLWE ciphertext cs. The TRLWE ciphertext cco is the TRLWE ciphertext corresponding to the carry of the full adder, and the TRLWE ciphertext cs is the TRLWE ciphertext corresponding to the sum output of the full adder. The cco and cs obtained by multiplying the TRLWE ciphertext cr = (a(X), b(X)) by the polynomials fc(X) and fs(X), respectively, are cco = (a(X) · fc(X), b(X) · fc(X)) cs = (a(X) fs(X), b(X) fs(X)) It is calculated as:

[0076] The plaintext polynomial obtained by decrypting the TRLWE ciphertext cr is The file is TIFF0007597400000036.tif856. Therefore, when the TRLWE ciphertext cco is decrypted, The result is TIFF0007597400000037.tif9116, and the plaintext polynomial obtained by decrypting the TRLWE ciphertext cr is multiplied by the polynomial fc(X). The same is true for the TRLWE ciphertext cs corresponding to the sum output, which when decrypted gives The result is TIFF0007597400000038.tif8113, and the plaintext polynomial obtained by decrypting the TRLWE ciphertext cr is multiplied by the polynomial fs(X).

[0077] Then, BlindRotate applies the 2n×ct TLWE ciphertext plaintext pt=φ to the test vector polynomial T(X). s Without calculating (2n×ct), T(X)·X -pt This was an operation to obtain the TRLWE ciphertext with the plaintext polynomial. Therefore, the plaintext polynomial obtained by decrypting the TRLWE ciphertext cco is TIFF0007597400000039.tif860, which is the same as the test vector polynomial T(X) fc(X). Similarly, the plaintext polynomial obtained by decrypting cs is TIFF0007597400000040.tif1059, which is the same as the test vector polynomial T(X) fs(X). The polynomials fc(X) and fs(X) in the [6-partition version] can be multiplied by a test vector to obtain a test vector polynomial that uses the range of 0 to 0.5 + 1 / 6 of the circle group {T}. The polynomials fc(X) and fs(X) in the [8-part version] can be multiplied by a test vector to obtain a test vector polynomial for using the right half (0 to 0.5) of the circular group {T}.

[0078] The cryptographic processing device 1 factorizes a test vector polynomial (T(X)·fc(X)) for obtaining a carry output and a test vector polynomial (T(X)·fs(X)) for obtaining a sum, and performs BlindRotate on the resulting common polynomial T(X). Then, the cryptographic processing device 1 multiplies the results of BlindRotate by the remaining parts of both test vector polynomials, fc(X) and fs(X). This makes it possible to obtain both calculation results at once without performing BlindRotate on the test vector polynomial for obtaining the carry output and the test vector polynomial for obtaining the sum output separately. A single BlindRotate will produce the results of BlindRotate for two types of polynomials. Since most of the processing time for Gate Bootstrapping is taken up by BlindRotate, this is essentially equivalent to performing two Gate Bootstrappings in the same time.

[0079] Next, the cryptographic processing device 1 performs SampleExtract and key switching on cco and cs, respectively, in the same way as Gate Bootstrapping in the above paper. These processes consume only a small amount of the Gate Bootstrapping processing time, so the impact on the calculation time is negligible. With the above configuration, the number of BlindRotate operations, which consume almost all of the calculation time in the operation of the logic elements, can be reduced from five to one. Experiments have shown that the calculation time for the configuration of [Example 3] is 11.4 ms, which is about five times faster than the 55.5 ms required when Gate Bootstrapping is executed five times.

[0080] [Example 4] As a modification of the third embodiment, the process of performing BlindRotate only once in the Gate Bootstrapping process for the TLWE ciphertext ct may be performed as follows. The cryptographic processing device 1 assigns different coefficients to even and odd degrees in the test vector polynomial and aligns the coefficients of the TLWE ciphertext to even numbers. As a result, the cryptographic processing device 1 refers to multiple lookup tables by one BlindRotate, as described below. As a result, the cryptographic processing device 1 can obtain multiple types of operation results by the subsequent SampleExtract to obtain ciphertext cz having the sum (output S) of the full adder as plaintext and ciphertext cy having the carry output Co of the full adder as plaintext. The cryptographic processing device 1 performs calculations in which the elements (multiple values) constituting the TLWE ciphertext resulting from the homomorphic calculation are integers. These integers all have the same remainder when divided by 2 (mod 2 value), and the test vector polynomial has the same coefficient for every two numbers (for every even number, for every odd number), making it possible to obtain multiple types of calculation results.

[0081] Suppose there are TLWE ciphertexts ca, cb, and cc corresponding to the inputs A, B, and C of the full adder, respectively. As in [Example 3], the TLWE ciphertexts ca, cb, and cc all have 0 or p as plaintext, with p=1 / 6 in the [6-partition version] and p=1 / 8 in the [8-partition version]. The error added to the plaintext is within the range of ±1 / 36 in the [6-partition version] and ±1 / 48 in the [8-partition version]. The method using 0 and 1 / 6 on the circle group {T} as binary plaintexts is the [6-way partition version], and the method using 0 and 1 / 8 is the [8-way partition version].

[0082] The process is the same as in [Example 3] until the cryptographic processing device 1 (third calculation unit 12) calculates ca+cb+cc+(0,p / 2) to obtain a TLWE ciphertext ct having one of the four plaintexts, p / 2, 3p / 2, 5p / 2, or 7p / 2, and an error added to the plaintext falling within the range of ±1 / 12 or ±1 / 16. As a first step of [Example 4], the cryptographic processing device 1 (third arithmetic unit 12) multiplies the TLWE ciphertext ct by n, rounds it off, and then doubles the result to calculate the LWE ciphertext ct1. In the above paper, the TLWE ciphertext is multiplied by 2n before being rounded off, but this is where the present embodiment differs. All coefficients of the doubled LWE ciphertext ct1 are even, and the corresponding plaintext p'=φ s It is guaranteed that (ct1)=[s]·[a]-b(b-[s]·[a]) is even. As explained in the above paper, the plaintext p'=φ s Since (ct1) is the number of times that X is multiplied by the test vector polynomial T(X), the number of rotations in BlindRotate (the number of times that X is multiplied) is an even number.

[0083] Next, the cryptographic processing device 1 (the third bootstrap unit 17) calculates the following polynomial ft(X)=μX 2np-2 +μX 2np-4 +…+μX 2 +μ where μ=p / 2 We construct a test vector using the above and perform gate bootstrap processing on the LWE ciphertext ct1 according to the above paper. The method for constructing the test vector is described below. Since 0 to 1 of the plaintext circle group {T} corresponds to the 0th to 2nth degree terms of the test vector, the constant term of the plaintext polynomial of the TRLWE ciphertext with the test vector ft(X) as BlindRotate is p / 2 only when the TLWE ciphertext ct is in the range of 0 to p, and is 0 otherwise. In addition, the plaintext polynomial of the TRLWE ciphertext with the test vector ft(X) as BlindRotate only has even degrees. In [Example 4], the test vector ft(X) is [6-part version] TIFF0007597400000041.tif1147 [8 division version] Let ft(X){fc(X)X+fs(X)} using the polynomial in TIFF0007597400000042.tif1258 be the test vector polynomial T(X) for BlindRotate. As explained in [Example 3], the polynomials fc(X) and fs(X) of the [6-division version] are expressions that can obtain a test vector polynomial that uses the range of 0 to 0.5 + 1 / 6 of the circular group {T} by multiplying the test vector ft(X). The polynomials fc(X) and fs(X) of the [8-division version] are expressions that can obtain a test vector polynomial that uses the right half (0 to 0.5) of the circular group {T} by multiplying the test vector ft(X).

[0084] For example, in the case of [6 division version], fc(X)X+fs(X) =(X 4np -X 2np -1)X+(-X 4np +X 2np -1) =(X 4np+1 -X 2np+1 -X)+(-X 4np +X 2np -1) =X 4np+1 -X 4np -X 2np+1 +X 2np -X-1 It is. The test vector polynomial T(X) is T(X)=ft(X){fc(X)X+fs(X)} =(μX 2np-2 +μX 2np-4 +…+μX 2 +μ)×(X 4np+1 -X 4np -X 2np+1 +X 2np -X-1) =μX 6np-1 -μX 6np-2 -μX 4np-1 +μX 4np-2 -μX 2np-1 -μX 2np-2 +μX 6np-3 -μX 6np-4 -μX 4np-3 +μX 4np-4 -μX 2np-3 -μX 2np-4 …+μX 4np+3 -μX 4np+2 -μX 2np+3 +μX 2np+2 -μX 3 -μX 2 +μX 4np+1 -μX 4np -μX 2np+1 +μX 2np -μX-μ =μX 6np-1 -μX 6np-2 +μX 6np-3 -μX 6np-4 …+μX 4np+3 -μX 4np+2 +μX 4np+1 -μX 4np -μX 4np-1 +μX 4np-2 -μX 4np-3 +μX 4np-4 -μX 2np+3 +μX 2np+2 -μX 2np+1 +μX 2np -μX 2np-1 -μX 2np-2 -μX 2np-3 -μX 2np-4 -μX 3 -μX 2 -μX-μ

[0085] The cryptographic processing device 1 performs SampleExtract with degrees 0 and 1 on the result of BlindRotate using such a test vector polynomial T(X). As a result of the above process making the coefficients of the TLWE ciphertext ct even, the number of times that it is rotated by BlindRotate (multiplying the test vector polynomial by X) is an even number. Therefore, the relationship between the coefficients and the even / odd degree in the test vector polynomial T(X) is preserved before and after BlindRotate. The coefficients of the terms with even degrees in the test vector polynomial T(X) before BlindRotate appear in degree 0 after BlindRotate, and the coefficients of the terms with odd degrees in the test vector polynomial T(X) before BlindRotate appear in degree 1 after BlindRotate. At this time, the signs of the coefficients are inverted. In the test vector polynomial T(X) after BlindRotate, the ciphertext cz obtained as a result of performing SampleExtract with degree 0 has the sum (output S) of the full adder as plaintext, and the ciphertext cy obtained as a result of performing SampleExtract with degree 1 has the carry output Co of the full adder as plaintext.

[0086] Note that the coefficients of the degree 4np (even) and degree 4np-1 (odd) of the above test vector polynomial T(X) are both negative, but the largest degree of the test vector polynomial T(X) is odd, and when rotated an even number of times with BlindRotate, the same coefficients of the even degree terms and odd degree terms do not appear in degree 0 and degree 1. In other words, as a result of BlindRotate, both degree 0 and degree 1 do not become positive values ​​with their signs inverted. According to the above process, it is not necessary to perform BlindRotate on the test vector polynomial that obtains the carry output Co and the test vector polynomial that obtains the test vector that becomes the sum output S. By performing SampleExtract twice with degrees 0 and 1 for the result of one BlindRotate on one test vector polynomial, it is possible to obtain encrypted text corresponding to the two values ​​of the full adder. Since most of the processing time for Gate Bootstrapping is taken up by BlindRotate, this is essentially equivalent to performing two Gate Bootstrappings in the same time.

[0087] Next, the cryptographic processing device 1 performs key switching in the same manner as Gate Bootstrapping in the above paper. These processes consume only a small amount of the processing time of Gate Bootstrapping, so the impact on the calculation time is negligible. With the above configuration, the number of BlindRotate operations, which consume almost all of the calculation time in the operation of the logic elements, can be reduced from five to one.

[0088] FIG. 7 is a flowchart (part 1) illustrating the flow of arithmetic processing by the full adder executed by the cryptographic processing device. As described above, when gate bootstrapping a binary ciphertext as described in the paper, plaintext in the intervals of 0 to 1 / 4 and 3 / 4 to 1 in the circular group {T} is converted to a TLWE ciphertext of 0. Furthermore, plaintext in the interval of 1 / 4 to 3 / 4 in the circular group {T} is converted to a TLWE ciphertext of 1 / 4. In the first and second embodiments, the error added to the plaintext during this conversion is a value within the range of ±1 / 24 or ±1 / 48 in this embodiment. The range of the circle group {T} mentioned above is associated with symbols such as 0 and 1 used in (multiple-valued) logical operations.

[0089] The ranges (including the error) on the circle group {T} correspond to the plaintext symbols in the ciphertext. The ciphertext is a vector of the form ([a], b), whose elements are points on the circular group. The plaintext is also a point on the circular group {T}. The symbols used in logical operations correspond to a range on the circular group {T}, and the plaintext for a given ciphertext points to one of the points within that range. It is difficult to determine which point within the range the plaintext points to without the private key. This ensures the strength of TLWE ciphertexts. If the range is set to 0 and points on the circular group and symbols are associated, it is possible to derive the plaintext by collecting multiple ciphertexts as a simultaneous equation, and the TLWE ciphertext will no longer function as an encryption.

[0090] Corresponding to the first and second embodiments, the cryptographic processing device 1 (acceptor 11) determines in step S101 whether or not a ciphertext to be subjected to computation has been input. When it is determined that the ciphertext has been input (Yes in step S101), the cryptographic processing device 1 (acceptor 11) accepts the ciphertext and stores it in the storage unit 20 in step S102. Next, in step S103, the cryptographic processing device 1 (the first arithmetic unit 12) performs a homomorphic operation using the ciphertext, and stores the operation result in the storage unit 20. In step S104, the cryptographic processing device 1 (first calculation unit 15) performs gate bootstrap on the calculation result, calculates the ciphertext of the carry output of the full adder having two values ​​as plaintext, and stores it in the storage unit 20. In the processing by the first calculation unit 12 and the first calculation unit 15, the following calculations are performed. This operation accepts three binary ciphertexts ca, cb, and cc as plaintext inputs, calculates the TLWE ciphertext ct from ca+cb+cc-1 / 8, and gate bootstraps this to obtain the ciphertext cy with the carry output Co.

[0091] For example, when the three input ciphertexts are binary symbols 0 or 1, that is, in the intervals 0±1 / 24 or 1 / 4±1 / 24, and the first calculation unit 12 performs the calculation in step S103, the ciphertext ct is obtained by the following calculation. ca is 0, cb is 0, cc is 0 ⇒0±1 / 24+0±1 / 24+0±1 / 24-1 / 8=-1 / 8±1 / 8 ca is 0, cb is 0, cc is 1 ⇒0±1 / 24+0±1 / 24+1 / 4±1 / 24-1 / 8=1 / 8±1 / 8 ca is 0, cb is 1, cc is 0 ⇒0±1 / 24+1 / 4±1 / 24+0±1 / 24-1 / 8=1 / 8±1 / 8 ca is 0, cb is 1, cc is 1 / 4 ⇒0±1 / 24+1 / 4±1 / 24+1 / 4±1 / 24-1 / 8=3 / 8±1 / 8 ca is 1, cb is 0, cc is 0 ⇒1 / 4±1 / 24+0±1 / 24+0±1 / 24-1 / 8=1 / 8±1 / 8 ca is 1 / 4, cb is 0, cc is 1 ⇒1 / 4±1 / 24+0±1 / 24+1 / 4±1 / 24-1 / 8=3 / 8±1 / 8 ca is 1, cb is 1, cc is 0 ⇒1 / 4±1 / 24+0±1 / 24+1 / 4±1 / 24-1 / 8=3 / 8±1 / 8 ca is 1, cb is 1, cc is 1 ⇒1 / 4±1 / 24+1 / 4±1 / 24+1 / 4±1 / 24-1 / 8=5 / 8±1 / 8 The obtained ciphertext ct has one of the four plaintexts, 1 / 8, 3 / 8, 5 / 8, or 7 / 8, and the error added to the plaintext is within the range of ±1 / 8. When the first calculation unit 15 performs gate bootstrap on the TLWE ciphertext ct in step S104, an output of ciphertext cy is obtained, which has 0 or 1 / 4 as plaintext and has an error added to the plaintext within the range of ±1 / 24. This is set as the upper bit (carry output Co) of the sum of the full adder.

[0092] In step S105, the cryptographic processing device 1 (the second arithmetic unit 13) performs a homomorphic operation on the temporary ciphertexts ct obtained in step S103, and stores the operation result in the storage unit 20. In step S106, the cryptographic processing device 1 (the second calculation unit 16) performs binary gate bootstrapping on the calculation result in step S105 to calculate an output ciphertext cz, and stores the output ciphertext cz in the storage unit 20. As a result of the processing by the second calculation unit 13 and the second calculation unit 16, the following calculations are performed. This operation accepts an input of ciphertext ct having a binary value as plaintext, and adds the ciphertext ct together to obtain an output ciphertext cz having a binary value as plaintext. When the second calculation unit 13 performs the calculation in step S105, the following calculation is performed. ca is 0, cb is 0, cc is 0 ⇒-1 / 8±1 / 8+(-1 / 8±1 / 8)+1 / 4=0±1 / 4 ca is 0, cb is 0, cc is 1 / 4 ⇒1 / 8±1 / 8+1 / 8±1 / 8+1 / 4=4 / 8=1 / 2±1 / 4 ca is 0, cb is 1 / 4, cc is 0 ⇒1 / 8±1 / 8+1 / 8±1 / 8+1 / 4=4 / 8=1 / 2±1 / 4 ca is 0, cb is 1 / 4, cc is 1 / 4 ⇒3 / 8±1 / 8+3 / 8±1 / 8+1 / 4=8 / 8=1(0)±1 / 4 ca is 1 / 4, cb is 0, cc is 0 ⇒1 / 8±1 / 8+1 / 8±1 / 8+1 / 4=4 / 8=1 / 2±1 / 4 ca is 1 / 4, cb is 0, cc is 1 / 4 ⇒3 / 8±1 / 8+3 / 8±1 / 8+1 / 4=8 / 8=1(0)±1 / 4 ca is 1 / 4, cb is 1 / 4, cc is 0 ⇒3 / 8±1 / 8+3 / 8±1 / 8+1 / 4==8 / 8=1(0)±1 / 4 ca is 1 / 4, cb is 1 / 4, cc is 1 / 4 ⇒5 / 8±1 / 8+5 / 8±1 / 8+1 / 4=12 / 8=3 / 2(1 / 2)±1 / 4 When the second calculation unit 16 performs Gate Bootstrapping as the process of step S106, a ciphertext cz having 0 or 1 / 4 as a plaintext and an error added to the plaintext falling within the range of ±1 / 24 is obtained. This is set as the lower bits (output S) of the sum of the full adder. The binary gate bootstrapping in step S104 and the binary gate bootstrapping in step S106 can be executed in parallel by multi-thread processing.

[0093] FIG. 8 is a flowchart (part 2) illustrating the flow of the arithmetic processing of the full adder executed by the cryptographic processing device. The following explanation corresponds to [Example 3] and [Example 4] of the [8-division version]. In step S101, the cryptographic processing device 1 (acceptor unit 11) determines whether or not a ciphertext to be subjected to computation has been input. When it is determined that the ciphertext has been input (Yes in step S201), the cryptographic processing device 1 (acceptor 11) accepts the ciphertext and stores it in the storage unit 20 in step S202. Next, in step S203, the cryptographic processing device 1 (the third arithmetic unit 14) performs a homomorphic operation using the ciphertext, and stores the operation result in the storage unit 20. In step S204, the cryptographic processing device 1 (the third calculation unit 17) performs gate bootstrap on the calculation result, calculates the ciphertext of the carry output Co of the full adder having two values ​​as plaintext, and stores it in the storage unit 20. In the processing by the third calculation unit 14 and the third calculation unit 17, the following calculations are performed. This operation accepts three binary ciphertexts ca, cb, and cc as inputs as plaintexts, calculates the TLWE ciphertext ct from ca+cb+cc+1 / 16, and then gate bootstraps this to obtain the ciphertext (high-order bits) cy of the carry output Co of the full adder and the ciphertext cz of the output S of the full adder.

[0094] For example, when the three input ciphertexts are binary symbols 0 or 1, that is, in the intervals 0±1 / 48 or 1 / 8±1 / 48, the third calculation unit 14 performs the calculation in step S103 as follows. ca is 0, cb is 0, cc is 0 ⇒0±1 / 48+0±1 / 48+0±1 / 48+1 / 16=1 / 16±1 / 16 ca is 0, cb is 0, cc is 1 ⇒0±1 / 48+0±1 / 48+1 / 8±1 / 48+1 / 16=3 / 16±1 / 16 ca is 0, cb is 1, cc is 0 ⇒0±1 / 48+1 / 8±1 / 48+0±1 / 48+1 / 16=3 / 16±1 / 16 ca is 0, cb is 1, cc is 1 / 4 ⇒0±1 / 48+1 / 8±1 / 48+1 / 8±1 / 48+1 / 16=3 / 16±1 / 16 ca is 1, cb is 0, cc is 0 ⇒1 / 8±1 / 48+0±1 / 48+0±1 / 48+1 / 16=3 / 16±1 / 16 ca is 1 / 4, cb is 0, cc is 1 ⇒1 / 8±1 / 48+0±1 / 48+1 / 8±1 / 48+1 / 16=5 / 16±1 / 16 ca is 1, cb is 1, cc is 0 ⇒1 / 8±1 / 48+0±1 / 48+1 / 8±1 / 48+1 / 16=5 / 16±1 / 16 ca is 1, cb is 1, cc is 1 ⇒1 / 8±1 / 48+1 / 8±1 / 48+1 / 8±1 / 48+1 / 16=7 / 16±1 / 16 The obtained ciphertext ct has one of the four plaintexts: 1 / 16, 3 / 16, 5 / 16, or 7 / 16, and the error added to the plaintext is within the range of ±1 / 16. When the third calculation unit 17 performs Gate Bootstrapping as the process of step S204, the output of ciphertexts cy and cz having 0 or 1 / 8 as plaintext and an error added to the plaintext within the range of ±1 / 48 is obtained. These are set as the lower bits (output S) and the upper bits (carry output Co) of the sum of the full adder, respectively.

[0095] [Variations] In the [6-partition version] of the above [Example 3], corresponding to [Example 1], the plaintext values ​​are set to 0 and 1 / 6, and the parameters are changed so that the error added to the plaintext is within the range of ±1 / 36, thereby further reducing the number of Gate Bootstrappings to one. By using the same parameters as the [6-part version] in [Example 3], setting the error added to the plaintext within the range of ±1 / 36, having two plaintext values ​​of 0 or 1 / 6, and performing gate bootstrap twice with two different test vector polynomials, it is possible to obtain the ciphertext cz of the sum of the full adders and the ciphertext cy of the carry output. In this [Modification], the cryptographic processing device 1 calculates ca+cb+cc+1 / 12, and obtains a TLWE ciphertext ct' as the calculation result. As described above, in [Example 1], gate bootstraping was performed on the TLWE ciphertext ct as described in the above paper to calculate the ciphertext cy of the carry output Co, and gate bootstrapping was performed on the homomorphic operation (ct+ct) between the TLWE ciphertexts ct as described in the above paper to calculate the ciphertext cz of the output S.

[0096] In contrast, in the [Modification], gate bootstrap is performed on the TLWE ciphertext ct' using two different test vector polynomials TA and TB to obtain the ciphertext cy and the ciphertext cz. The test vector polynomial TA to obtain the ciphertext cy of the carry output Co is μ1X n-1 +…+μ1X 2n / 3 +μ2X 2n / 3-1 +…+μ2X 0 where μ1=1 / 12, μ2=-1 / 12 Let us assume that. The test vector polynomial TB for obtaining the ciphertext cz of the output S is μ1X n-1 +…+μ1X 2n / 3 +μ2X 2n / 3-1 +…+μ2X n / 3 +μ1X n / 3-1 +…+μ1X 0 where μ1=-1 / 12, μ2=1 / 12 Let us assume that. Note that the ciphertext cz can be obtained by performing gate bootstraping using the test vector polynomial TB on the TLWE ciphertext ct' without performing a homomorphic operation (ct'+ct') between TLWE ciphertexts ct'.

[0097] When the three input ciphertexts are binary symbols 0 or 1, that is, in the range 0±1 / 36 or 1 / 6±1 / 36, the calculation result of ca+cb+cc+1 / 12 by the first calculation unit 12 is as follows. ca is 0, cb is 0, cc is 0 (ca+cb+cc is the binary symbol 0+0+0=0) ⇒0+0+0+1 / 12=1 / 12 ca is 0, cb is 0, cc is 1 / 6 (ca+cb+cc is the binary symbol, 0+0+1=1) ⇒0+0+1 / 6+1 / 12=1 / 4(3 / 12) ca is 0, cb is 1 / 6, cc is 0 (ca+cb+cc is the binary symbol, 0+1+0=1) ⇒0+1 / 6+0+1 / 12=1 / 4(3 / 12) ca is 0, cb is 1 / 6, cc is 1 / 6 (ca+cb+cc is the binary symbol, 0+1+1=2) ⇒0+1 / 6+1 / 6+1 / 12=5 / 12 ca is 1 / 6, cb is 0, cc is 0 (ca+cb+cc is the binary symbol 1+0+0=1) ⇒1 / 6+0+0+1 / 12=1 / 4(3 / 12) ca is 1 / 6, cb is 0, cc is 1 / 6 (ca+cb+cc is the binary symbol 1+0+1=2) ⇒1 / 6+0+1 / 6+1 / 12=5 / 12 ca is 1 / 6, cb is 1 / 6, cc is 0 (ca+cb+cc is the binary symbol 1+1+0=2) ⇒1 / 6+1 / 6+0+1 / 12=5 / 12 ca is 1 / 6, cb is 1 / 6, cc is 1 / 6 (ca+cb+cc is the binary symbol 1+1+1=3) ⇒1 / 6+1 / 6+1 / 6+1 / 12=7 / 12 The resulting ciphertext has 1 / 12, 1 / 4, 5 / 12, and 7 / 12 as plaintext.

[0098] In Gate Bootstrapping by the first Bootstrapping unit 15, only when ca, cb, and cc are all binary symbols of 1, does ca+cb+cc=3 result in a binary symbol of 3, and in this case the calculation result of ca+cb+cc corresponds to the left half-plane (the upper half of the circular group {T}). In the upper half of the circle group {T} (0.5 to 1), the lower term X in the test vector polynomial n / 3-1 ~…X 0 The coefficient sign turns negative. Therefore, μ2X of the test vector polynomial TA 2n / 3-1 ~μ2X 0 The lower μ2X n / 3-1 ~μ2X 0 is 1 / 12, which is μ2=-1 / 12 multiplied by -1. Add (0,1 / 12) to the coefficient value at this point to get 1 / 6 as the plaintext of the ciphertext cy of the carry output Co. (0,1 / 12) is a trivial ciphertext whose plaintext is 1 / 12. Also, the lower term μ1X in the test vector polynomial TB n / 3-1 ~μ1X 0 The coefficient in is μ1=-1 / 12 multiplied by -1, which is 1 / 12. Add (0, 1 / 12) to the coefficient value at this point to get 1 / 6 as the plaintext of the ciphertext cz of the sum (output S) of the full adder. The obtained ciphertext cy and ciphertext cz both have 0 or 1 / 6 as plaintext, and it is clear that the carry output Co and the sum of the full adder (output S) have been calculated correctly.

[0099] [Application to AOI21 and OAI21 gates] A technique similar to the above-described [Modification] regarding the full adder can be applied to the AOI21 gate and the OAI21 to increase the speed. The AOI21 gate is an abbreviation for AND-OR-INVERT2-1 gate, and outputs D1=NOT(OR(A,AND(B,C))) for inputs A, B, and C. In the following explanation, the AOI21 gate will be simply referred to as the AOI gate.

[0100] FIG. 9 is a diagram illustrating the configuration of an AOI gate. FIG. 9 explains the AOI gate as a hardware circuit using logical operation elements, but the AOI gate may be considered as an AOI gate program executed by a CPU that implements the AOI gate in software. When implementing bit-wise homomorphic encryption processing in software, calculations are performed with the idea of ​​designing a logic circuit (logic gate) for the ciphertext. The AOI gate 60 includes one AND circuit section (arithmetic processing section for obtaining AND) 61 and one OR circuit section (arithmetic processing section for obtaining OR) 62. The AND circuit unit 61 and the OR circuit unit 62 each include an arithmetic unit that performs homomorphic operations between ciphertexts, and a calculation unit that performs Gate Bootstrapping to reduce errors in the results of the operations. The inputs B and C are input to the AND circuit section 61, and the output of the AND circuit section 61 and the input A are input to the subsequent OR circuit section 62, which outputs the AOI output D1. The AOI gate has the following boolean values: TIFF0007597400000043.tif52143

[0101] On the other hand, the OAI21 gate is an abbreviation for OR-AND-INVERT2-1 gate, and outputs D2=NOT(OR(A,AND(B,C))) for inputs A, B, and C. In the following explanation, the OAI21 gate will be simply referred to as the OAI gate. FIG. 10 is a diagram illustrating the configuration of an OAI gate. Although FIG. 10 explains the OAI gate as a hardware circuit using logical operation elements, it may be considered that the OAI gate is an OAI gate program executed by a CPU that implements the OAI gate in software. When implementing bit-wise homomorphic encryption processing in software, calculations are performed with the idea of ​​designing a logic circuit (logic gate) for the ciphertext. The OAI gate 70 includes one OR circuit section (arithmetic processing section for obtaining OR) 71 and one AND circuit section (arithmetic processing section for obtaining AND) 72. The OR circuit unit 71 and the AND circuit unit 72 each include an arithmetic unit that performs homomorphic operations between ciphertexts, and a calculation unit that performs Gate Bootstrapping to reduce errors in the results of the operations. Inputs B and C are input to an OR circuit section 71, and the output of the OR circuit section 71 and input A are input to an AND circuit section 72 in the subsequent stage, from which an OAI output D2 is output. The OAI gate has the following truth values: TIFF0007597400000044.tif47129

[0102] FIG. 11 is a diagram for explaining the functional configuration of a cryptographic processing device that realizes an AOI gate and an OAI gate. The cryptographic processing device 1 includes a control unit 10, a storage unit 20, a communication unit 25, and an input unit . The control unit 10 includes a receiving unit 11, a fourth calculation unit 31, a fourth bootstrap unit (fourth calculation unit) 32, and an output unit 18. The configuration other than the fourth calculation unit 31 and the fourth bootstrap unit (fourth calculation unit) 32 is the same as that in FIG. 2, and therefore description thereof will be omitted. The fourth arithmetic unit 31 performs a fourth homomorphic operation on the binary three-input ciphertext accepted by the acceptance unit 11. The fourth calculation unit 31 is a calculation processing unit that realizes, by software, the calculations (homomorphic calculations) of the AOI gate and the OAI gate using the logic gates (AND circuit unit, XOR circuit unit, and NOT circuit unit) described in Figures 9 and 10. The fourth calculation unit 31 may be realized by hardware.

[0103] The fourth Bootstrapping unit 32 performs a binary Gate Bootstrapping process, which will be described below, on the operation result of the fourth arithmetic unit 31, and outputs a new ciphertext that can take binary values as the outputs D1 and D2 of the AOI gate and the OAI gate.

[0104] FIG. 12 is a diagram for explaining in detail the operation processes of the AOI gate and the OAI gate based on the functional configuration of FIG. 11. In the description of FIG. 12, the ciphertexts ca, cb, and cc input to the cryptographic processing device 1 are all TLWE ciphertexts shown in the above paper. As will be described in detail below, the TLWE cipher is a Bit-wise type fully homomorphic cipher having a value of 0 or μ (non-zero) as the plaintext. Various operations can be performed by logical operations using logical gates. Also, as will be described later, the TLWE ciphertext has two values with an error having a predetermined dispersion added to a predetermined value corresponding to the binary symbol 0 or 1 as the plaintext, and logical operations can be performed without decryption.

[0105] In the configuration shown in FIG. 12, (binary) Gate Bootstrapping presented in the paper of Non-Patent Document 1 (the above paper) is used. The TFHE's Gate Bootstrapping presented in the above paper will be described in detail below. The input ciphertexts ca, cb, and cc are input to the fourth arithmetic unit 31 to perform a homomorphic operation, and the operation result (ciphertext ct = ciphertext ca × 2 + cb + cc) is input to the first Bootstrapping unit 15 that performs binary Gate Bootstrapping. The output of the first Bootstrapping unit 15 can take either of the two values (0, μ) as the plaintext, which is the ciphertext dc1 of the output D1 of the AOI gate or the ciphertext dc2 of the output D2 of the OAI gate.

[0106] <Operation process of AOI21 gate> Suppose there are TLWE ciphertexts ca, cb, and cc corresponding to inputs A, B, and C of the AOI21 gate, respectively. These ciphertexts are TLWE ciphertexts based on specially set system parameters, and are either generated by Gate Bootstrapping or newly encrypted. The TLWE ciphertexts ca, cb, and cc all have 0 or 1 / 6 as plaintext, and the error added to the plaintext is within the range of ±1 / 48. In the TLWE ciphertexts ca, cb, and cc, 0 corresponds to the binary symbol 0 and 1 / 6 corresponds to the binary symbol 1.

[0107] First, the cryptographic processing device 1 (fourth calculation unit 31) calculates 2×ca+cb+cc+(0,1 / 12). (0,1 / 12) is a trivial TLWE ciphertext whose plaintext is 1 / 12. The calculation result of 2×ca+cb+cc+(0,1 / 12) is as follows. ca is 0, cb is 0, cc is 0 (2×ca+cb+cc is the binary symbol, 0+0+0=0) ⇒2×0+0+0+1 / 12=1 / 12 ca is 0, cb is 0, cc is 1 / 6 (2×ca+cb+cc is the binary symbol, 0+0+1=1) ⇒2×0+0+1 / 6+1 / 12=3 / 12 ca is 0, cb is 1 / 6, cc is 0 (2×ca+cb+cc is the binary symbol, 0+1+0=1) ⇒2×0+1 / 6+0+1 / 12=3 / 12 ca is 0, cb is 1 / 6, cc is 1 / 6 (2×ca+cb+cc is the binary symbol, 0+1+1=2) ⇒2×0+1 / 6+1 / 6+1 / 12=5 / 12 ca is 1 / 6, cb is 0, cc is 0 (2×ca+cb+cc is the binary symbol, 2+0+0=2) ⇒2×1 / 6+0+0+1 / 12=5 / 12 ca is 1 / 6, cb is 0, cc is 1 / 6 (2×ca+cb+cc is the binary symbol, 2+0+1=3) ⇒2×1 / 6+0+1 / 6+1 / 12=7 / 12 ca is 1 / 6, cb is 1 / 6, cc is 0 (2×ca+cb+cc is the binary symbol, 2+1+0=3) ⇒2×1 / 6+1 / 6+0+1 / 12=7 / 12 ca is 1 / 6, cb is 1 / 6, cc is 1 / 6 (2×ca+cb+cc is the binary symbol, 2+1+1=4) ⇒2×1 / 6+1 / 6+1 / 6+1 / 12=9 / 12 The plaintext has one of the five values ​​1 / 12, 3 / 12, 5 / 12, 7 / 12, and 9 / 12, and a TLWE ciphertext ct is obtained in which the error added to the plaintext is within the range of ±1 / 16.

[0108] The cryptographic processing device 1 (third bootstrap unit 17) performs a gate bootstrap process on the TLWE ciphertext ct in accordance with the above paper. However, in Gate Bootstrapping, the cryptographic processing device 1 performs BlindRotate using the following polynomial as a test vector. Tx=μ1X (n-1) +μ1X (n-2) +…+μ1X (2 / 3n) +μ2X (2 / 3n-1) +…μ2 where μ1=-1 / 12, μ2=1 / 12 The TLWE ciphertext obtained immediately after SampleExtract is ca is 0, cb is 0, cc is 0 ⇒ 1 / 12 ca is 0, cb is 0, cc is 1 / 6⇒1 / 12 ca is 0, cb is 1 / 6, cc is 0 ⇒ 1 / 12 ca is 0, cb is 1 / 6, cc is 1 / 6 ⇒ -1 / 12 ca is 1 / 6, cb is 0, cc is 0 ⇒ -1 / 12 ca is 1 / 6, cb is 0, cc is 1 / 6⇒-1 / 12 ca is 1 / 6, cb is 1 / 6, cc is 0⇒-1 / 12 ca is 1 / 6, cb is 1 / 6, cc is 1 / 6 ⇒ -1 / 12 , we have 1 / 12 or -1 / 12 as plaintext. When adding (0, 1 / 12) to this and performing key switching, a TLWE ciphertext cy having 0 or 1 / 6 as the plaintext is obtained. Here, 0 corresponds to the binary symbol 0, and 1 / 6 corresponds to the symbol 1 respectively. The following is a truth table showing the symbols that the TLWE ciphertext cy can take according to the input ciphertext. TIFF0007597400000045.tif52143 The above has the same operation result as the AOI21 gate described above, indicating that the operation of the AOI21 gate was correctly performed.

[0109] <OAI21 Gate Operation Processing> Assume that there are TLWE ciphertexts ca, cb, and cc corresponding to the inputs A, B, and C of the OAI21 gate respectively. These ciphertexts are TLWE ciphertexts based on specially set system parameters, and are generated by Gate Bootstrapping or newly encrypted. All of the TLWE ciphertexts ca, cb, and cc have 0 or 1 / 6 as the plaintext, and the error added to the plaintext is within the range of ±1 / 48. For the TLWE ciphertexts ca, cb, and cc, 0 corresponds to the binary symbol 0, and 1 / 6 corresponds to the symbol 1 respectively.

[0110] First, the encryption processing device 1 (the fourth operation unit 31) calculates 2×ca + cb + cc+(0, 1 / 12). Here, (0, 1 / 12) is a trivial TLWE ciphertext with the plaintext being 1 / 12. The operation result of 2×ca + cb + cc+(0, 1 / 12) is as follows. When ca is 0, cb is 0, and cc is 0 (2×ca + cb + cc is 0 + 0 + 0 = 0 in binary symbols) ⇒2×0 + 0 + 0 + 1 / 12 = 1 / 12 When ca is 0, cb is 0, and cc is 1 / 6 (2×ca + cb + cc is 0 + 0 + 1 = 1 in binary symbols) ⇒2×0 + 0 + 1 / 6 + 1 / 12 = 3 / 12 ca is 0, cb is 1 / 6, cc is 0 (2×ca+cb+cc is the binary symbol, 0+1+0=1) ⇒2×0+1 / 6+0+1 / 12=3 / 12 ca is 0, cb is 1 / 6, cc is 1 / 6 (2×ca+cb+cc is the binary symbol, 0+1+1=2) ⇒2×0+1 / 6+1 / 6+1 / 12=5 / 12 ca is 1 / 6, cb is 0, cc is 0 (2×ca+cb+cc is the binary symbol, 2+0+0=2) ⇒2×1 / 6+0+0+1 / 12=5 / 12 ca is 1 / 6, cb is 0, cc is 1 / 6 (2×ca+cb+cc is the binary symbol, 2+0+1=3) ⇒2×1 / 6+0+1 / 6+1 / 12=7 / 12 ca is 1 / 6, cb is 1 / 6, cc is 0 (2×ca+cb+cc is the binary symbol, 2+1+0=3) ⇒2×1 / 6+1 / 6+0+1 / 12=7 / 12 ca is 1 / 6, cb is 1 / 6, cc is 1 / 6 (2×ca+cb+cc is the binary symbol, 2+1+1=4) ⇒2×1 / 6+1 / 6+1 / 6+1 / 12=9 / 12 The plaintext has one of the five values ​​1 / 12, 3 / 12, 5 / 12, 7 / 12, and 9 / 12, and a TLWE ciphertext ct is obtained in which the error added to the plaintext is within the range of ±1 / 16.

[0111] The cryptographic processing device 1 (third bootstrap unit 17) performs a gate bootstrap process on the TLWE ciphertext ct in accordance with the above paper. However, in Gate Bootstrapping, the cryptographic processing device 1 performs BlindRotate using the following polynomial as a test vector. Tx=μX (n-1) +…+μ where μ=1 / 12 The TLWE ciphertext obtained immediately after SampleExtract is ca is 0, cb is 0, cc is 0 ⇒ 1 / 12 ca is 0, cb is 0, cc is 1 / 6⇒1 / 12 ca is 0, cb is 1 / 6, cc is 0 ⇒ 1 / 12 ca is 0, cb is 1 / 6, cc is 1 / 6 ⇒ 1 / 12 ca is 1 / 6, cb is 0, cc is 0 ⇒ 1 / 12 ca is 1 / 6, cb is 0, cc is 1 / 6⇒-1 / 12 ca is 1 / 6, cb is 1 / 6, cc is 0⇒-1 / 12 ca is 1 / 6, cb is 1 / 6, cc is 1 / 6 ⇒ -1 / 12 , we have 1 / 12 or -1 / 12 as plaintext. Adding (0,1 / 12) to this and key switching results in the TLWE ciphertext cy with either 0 or 1 / 6 as plaintext, where 0 corresponds to the binary symbol 0 and 1 / 6 corresponds to the binary symbol 1, respectively. Below is a truth table showing the possible symbols of the TLWE ciphertext cy depending on the input ciphertext. TIFF0007597400000046.tif47129 The calculation result is the same as that of the OAI21 gate described above, and it can be seen that the OAI21 gate calculation was performed correctly.

[0112] When performing AOI gate calculations using binary Gate Bootstrapping, such as the AOI gate shown in FIG. 9, Gate Bootstrapping must be executed once each at the rear stages of the AND circuit section 61 and the OR circuit section 62, that is, twice in total. When performing an OAI gate operation using binary Gate Bootstrapping, such as the OAI gate shown in FIG. 10, Gate Bootstrapping must be executed once each at the downstream of the AND circuit section 71 and the OR circuit section 72, for a total of two times. In contrast, in the cryptographic processing device 1 of this embodiment, in the calculations of the AOI gate and OAI gate, three binary ciphertexts are input to the fourth calculation unit 31, and the number of homomorphic calculation processes is reduced to one in total by improving the gate bootstrapping. As a result, in the cryptographic processing device 1, the number of gate bootstraps, which account for almost all of the homomorphic arithmetic processing, can be reduced to once in total. Therefore, compared with the AOI gate and OAI gate shown in Fig. 9 and Fig. 10, the cryptographic processing device 1 can reduce the calculation processing time by approximately 50%. As described above, since Gate Bootstrapping accounts for almost all of the computation time of the AOI gates and OAI gates related to fully homomorphic encryption, the cryptographic processing device 1 can significantly speed up the computation of the AOI gates and OAI gates by reducing the number of times Gate Bootstrapping is performed.

[0113] FIG. 13 is a flowchart illustrating the flow of computational processing of the AOI gate and the OAI gate executed by the cryptographic processing device. In step S301, the cryptographic processing device 1 (acceptor unit 11) determines whether or not a ciphertext to be subjected to computation has been input. When it is determined that the ciphertext has been input (Yes in step S301), the cryptographic processing device 1 (acceptor 11) accepts the ciphertext and stores it in the storage unit 20 in step S302. Next, in step S303, the cryptographic processing device 1 (fourth arithmetic unit 31) performs a homomorphic operation using the ciphertext, and stores the operation result in the storage unit 20. In step S304, the cryptographic processing device 1 (fourth calculation unit 32) performs gate bootstrap on the calculation result, calculates ciphertexts dc1 and dc2 of the outputs D1 and D2 of the AOI gate and OAI gate having two values ​​as plaintexts, and stores them in the memory unit 20. In the processing by the fourth calculation unit 31 and the fourth calculation unit 32, the following calculations are performed. This operation accepts three binary ciphertexts ca, cb, and cc as plaintext inputs, calculates the TLWE ciphertext ct from 2×ca+cb+cc+1 / 16, and performs gate bootstrap on this to obtain the ciphertexts dc1 and dc2 of the outputs D1 and D2 of the AOI and OAI gates.

[0114] For example, when the three input ciphertexts are binary symbols 0 or 1, that is, in the intervals 0±1 / 48 or 1 / 6±1 / 48, the fourth calculation unit 31 performs the calculation in step S103 as follows. ca is 0, cb is 0, cc is 0 ⇒2×0±1 / 48+0±1 / 48+0±1 / 48+1 / 16=1 / 16±1 / 16 ca is 0, cb is 0, cc is 1 ⇒2×0±1 / 48+0±1 / 48+1 / 8±1 / 48+1 / 16=3 / 16±1 / 16 ca is 0, cb is 1, cc is 0 ⇒2×0±1 / 48+1 / 8±1 / 48+0±1 / 48+1 / 16=3 / 16±1 / 16 ca is 0, cb is 1, cc is 1 / 4 ⇒2×0±1 / 48+1 / 8±1 / 48+1 / 8±1 / 48+1 / 16=5 / 16±1 / 16 ca is 1, cb is 0, cc is 0 ⇒2×1 / 8±1 / 48+0±1 / 48+0±1 / 48+1 / 16=5 / 16±1 / 16 ca is 1 / 4, cb is 0, cc is 1 ⇒2×1 / 8±1 / 48+0±1 / 48+1 / 8±1 / 48+1 / 16=7 / 16±1 / 16 ca is 1, cb is 1, cc is 0 ⇒2×1 / 8±1 / 48+0±1 / 48+1 / 8±1 / 48+1 / 16=7 / 16±1 / 16 ca is 1, cb is 1, cc is 1 ⇒2×1 / 8±1 / 48+1 / 8±1 / 48+1 / 8±1 / 48+1 / 16=9 / 16±1 / 16 The obtained ciphertext ct has one of the five plaintexts: 1 / 16, 3 / 16, 5 / 16, 7 / 16, or 9 / 16, and the error added to the plaintext is within the range of ±1 / 16. When the fourth calculation unit 32 performs Gate Bootstrapping as the process of step S204, an output of ciphertext dc1 or dc2 having 0 or 1 / 8 as plaintext and an error added to the plaintext within the range of ±1 / 48 is obtained. These are set as the output D1 of the AOI gate and the output D2 of the OAI gate, respectively.

[0115] As explained above, by reducing the error range added to the plaintext of the TLWE ciphertext, the number of homomorphic operations can be reduced, and the number of gate bootstraps after the homomorphic operations can also be reduced to just one. In addition to speeding up the full adder, which is the main focus of this specification, by reducing the error range added to the plaintext, the calculations of the AOI gate and OAI gate described above can also be significantly sped up, and the simulation of CMOS circuits using these gates can also be sped up.

[0116] FIG. 14 is a diagram showing ciphertexts input and output to and from Gate Bootstrapping of this embodiment. In the above description, as shown in FIG. 19(a), Gate Bootstrapping is performed in the order of BlindRotate, SampleExtract, and key switching. Alternatively, as shown in FIG. 14(b), key switching can be performed first in Gate Bootstrapping, and then BlindRotate and SampleExtract can be performed. TLWE ciphertext has a concept of levels according to security strength. In Gate Bootstrapping in Fig. 14(a), the input and output TLWE ciphertexts are LEVEL 0. When BlindRotate is performed on the LEVEL 0 TLWE ciphertext and SampleExtract is performed on the output TRLWE ciphertext, the TLWE ciphertext obtained is LEVEL 1, but as a result of key switching, the LEVEL 0 TLWE ciphertext is output. In contrast, in the method shown in Figure 14(b), the TLWE ciphertext that is the input and output of Gate Bootstrapping is set to LEVEL 1, and first key switching is performed to lower it to LEVEL 0, and then BlindRotate is performed. When SampleExtract is performed on the output TRLWE ciphertext, a TLWE ciphertext of LEVEL 1 is output.

[0117] The ciphertext of LEVEL0 consists of an N-order vector [a] of elements on the circular group {T} encrypted with an N-order secret key [s]. On the other hand, the ciphertext of LEVEL1 obtained as a result of SampleExtract consists of an n-order vector [a'] of elements on the circular group {T} encrypted with an n-order secret key [s']. The LEVEL0 ciphertext has a smaller number of coefficients (the degree of the vector), which is the difficulty of the LWE problem, than the LEVEL1 ciphertext, so the amount of computation required for homomorphic addition is smaller than that of LEVEL1. On the other hand, the LEVEL0 ciphertext has a problem that security strength is likely to decrease if the allowable error added to the plaintext is reduced to enable homomorphic operations with two values ​​and three inputs as in the above example. This is because the security of LWE-based ciphers is guaranteed by the error added to the plaintext. The larger the error added to the plaintext and the greater the number of coefficients (the degree of the vector), the more difficult it becomes to calculate (decrypt) the TLWE cipher. On the other hand, the smaller the error added to the plaintext and the fewer the number of coefficients (the degree of the vector), the easier it is to calculate (decrypt) the TLWE cipher. To reduce the error, it is necessary to increase the number of coefficients in the ciphertext (the degree of the vector) to ensure security.

[0118] In the embodiment, the number of BlindRotate operations is reduced by reducing the error added to the plaintext to, for example, ±1 / 24, and the MUX operation is accelerated by using homomorphic operations with two values ​​and three inputs. In order to ensure the security of the ciphertext, which has become easier to calculate (decrypt) by reducing the error added to the plaintext, it is desirable to move the key switching to the beginning of Gate Bootstrapping and use LEVEL1 ciphertext, which has a large number of coefficients (vector order) and is easy to reduce the error range, as the input and output of Gate Bootstrapping. Then, after converting to LEVEL0 at the beginning of Gate Bootstrapping, the ciphertext is not converted back to LEVEL0 at the end. The time required for BlindRotate is proportional to the number of coefficients (vector degree) of the input TLWE ciphertext. Therefore, when the input is a LEVEL1 ciphertext, the time required for BlindRotate is longer in proportion to the number of coefficients (vector degree) than when the input is a LEVEL0 ciphertext. Even if the LEVEL1 ciphertext is used as the input for Gate Bootstrapping to ensure the security of the ciphertext, the increase in the required time can be avoided by performing BlindRotate using the LEVEL0 TLWE ciphertext converted by key switching as the input. The method of making the input and output of Gate Bootstrapping TLWE ciphertext of LEVEL1 is applicable not only to the case of performing homomorphic operations of two-value and two-input binary operations as in the embodiment, but also to the case of homomorphic operations of two-value and two-input binary operations. By not returning to LEVEL0, it is possible to perform high-speed processing by safely performing multi-value input in the calculation of the TLWE ciphertext in the next stage as well.

[0119] In addition, adding an error of ±1 / 24 to the plaintext raises the problem of errors during decryption in addition to the security issues mentioned above. In the configuration of this embodiment, BlindRotate, which takes up most of the processing time of Gate Bootstrapping, can be performed only once. However, since the error range needs to be made smaller, there are problems such as a decrease in security strength and an increase in the decryption error rate. In homomorphic encryption of the LWE system, including TFHE, the errors added to the plaintext are normally distributed, and it is not possible to strictly set the "error range." Although the error still tends to be concentrated near 0, in principle, this simply makes it possible to concentrate the error more in the specified range. For example, even if the error to be added to the plaintext is set to within ±1 / 24, there is a few percent chance that an error outside that range will be added. If the error falls outside the set range, the plaintext will be interpreted as a different plaintext, which may result in unexpected calculation results. The calculation itself does not become impossible, but rather a different result is obtained. How much of a probability of obtaining a different calculation result can be tolerated is up to the application to which homomorphic encryption is applied.

[0120] In this embodiment, by changing the system parameters so that the error added to the plaintext is set to ±1 / 24, it is possible to achieve three goals in a well-balanced manner: reducing the probability of an error occurring in the calculation, speeding up the calculation by reducing the number of BlindRotates, and maintaining high security. In order to obtain the best balance between these, it is necessary to set the system parameters so that the error range overlap falls within a certain value.

[0121] The error may be set so as to satisfy conditions that are of particular importance depending on the system or device to which this embodiment is applied. When speeding up calculations is important, homomorphic calculations such as binary four-input calculations can be made possible by setting the error added to the plaintext within the range of ±1 / 32. For applications that can tolerate the possibility of different calculation results to a certain extent, it is possible to maintain security by keeping the error within ±1 / 16 while speeding up calculations by using two-value, three-input calculations and allowing a certain degree of overlap in the error ranges. For example, even if the parameters of the above paper, which set the error added to the plaintext to within ±1 / 16, are used, the configuration of this embodiment, which speeds up the full adder with homomorphic operations for two-value and three-input, is possible in principle. The only thing that will happen is that the error will go outside the set range, increasing the probability of obtaining a different calculation result.

[0122] [Application example] The speed-up of the full adder performed by the cryptographic processing device 1 can be applied as follows. For example, consider a case where you want to aggregate data for a specific field within a certain range from a database where the fields and records are encrypted with TLWE encryption (for example, you want to find the average annual income of people aged 30 to 39). In this case, the cryptographic processing device 1 is a database server that manages an encrypted database, accepts queries encrypted with TLWE encryption from a terminal device connected via a network, etc., and returns a response to the query to the terminal device in a state encrypted with TLWE encryption. Indexes cannot be created on encrypted databases, so comparisons and aggregations across the entire database are required.

[0123] The cryptographic processing device 10 performs a comparison operation to compare all records in the encrypted database with the query using the functions of the first arithmetic unit 12, the second arithmetic unit 13, the third arithmetic unit 14, the first bootstrap unit 15, the second bootstrap unit 16, and the third bootstrap unit 17, which realize a full adder. The comparison operation is a subtraction between the ciphertexts of the record and the query, and the positive or negative result of the subtraction indicates the equivalence of the comparison operation. The cryptographic processing device 1 can further perform an aggregation operation on records that match the query in the comparison operation. In the aggregation operation, the cryptographic processing device 1 calculates a sum by adding up the records that match the query in the comparison operation, and further calculates an average value using division. In this way, processing queries against an encrypted database requires the four basic arithmetic operations, such as addition, subtraction, multiplication, and division, between the integers that make up the ciphertext, as well as comparisons (comparisons are equivalent to the positive and negative results of subtraction). It is expected that full adder operations will be used extensively in the processing. The number of full adders required increases as the bit length of the integers being handled increases. By speeding up the operations of the full adder by reducing the number of logical operations described above and thus the number of gate bootstraps, it is possible to significantly reduce the execution time of a query. The four arithmetic operations are homomorphic arithmetic operations performed on encrypted numerical values ​​that are regarded as the ciphertext of each bit when a permutation using the input ciphertext is expressed in binary.

[0124] Not only in database aggregation, but also in various data processing applications using ciphertext, arithmetic operations and comparisons between integers are frequently used. Other examples include fuzzy authentication and fuzzy search. Fuzzy authentication is, for example, biometric authentication using biometric data, and it is an absolute requirement that the biometric data, which remains unchanged throughout a person's life, be encrypted and kept secret. Fuzzy authentication performs authentication based on the correspondence between the biometric authentication data presented as an authentication request and the biometric authentication data registered in a database, but it does not check for a perfect match between the two, but rather judges whether they match based on a threshold value. Fuzzy search is a vague search method that presents data close to the query from a database as a search result even if the query and the record do not match exactly. In fuzzy authentication and fuzzy search, a comparison is made between the encrypted database and the query, similar to the comparison and aggregation operations in the encrypted database described above, and in this case, the comparison operation must be performed using data encrypted by homomorphic encryption. In particular, in fuzzy authentication and fuzzy searches, addition, subtraction, multiplication, division, and comparison of integers take up the majority of the processing time, so speeding up the operations of the full adders used in these operations can have a significant effect on shortening processing time.

[0125] In addition, Euclidean distance is often used for comparison in fuzzy authentication and fuzzy search. Calculating Euclidean distance requires square operations. Therefore, in bit-wise homomorphic encryption, multiplication takes time of O(N 2 ) full adder operations. Even a simple comparison operation using subtraction requires O(N) full adder operations. Therefore, by speeding up the calculation of the full adder, the processing time required for fuzzy authentication and fuzzy search can be significantly reduced.

[0126] FIG. 15 is a block diagram illustrating an embodiment of a computer device. The configuration of the computer device 100 will be described with reference to FIG. The computer device 100 is, for example, a cryptographic processing device that processes various types of information. The computer device 100 includes a control circuit 101, a storage device 102, a reading / writing device 103, a recording medium 104, a communication interface 105, an input / output interface 106, an input device 107, and a display device 108. The communication interface 105 is connected to a network 200. The components are connected to each other via a bus 110. The cryptographic processing device 1 can be configured by appropriately selecting some or all of the components described in the computer device 100.

[0127] The control circuit 101 controls the entire computer device 100. The control circuit 101 is, for example, a processor such as a Central Processing Unit (CPU), a Field Programmable Gate Array (FPGA), an Application Specific Integrated Circuit (ASIC), or a Programmable Logic Device (PLD). The control circuit 101 functions as, for example, the control unit 10 in FIG. 2 and FIG. 11.

[0128] The storage device 102 stores various data. The storage device 102 is, for example, a memory such as a Read Only Memory (ROM) and a Random Access Memory (RAM), a Hard Disk (HDD), or a Solid State Drive (SSD). The storage device 102 may store an information processing program that causes the control circuit 101 to function as the control unit 10 in Fig. 2. The storage device 102 functions as, for example, the storage unit 20 in Figs. 2 and 11.

[0129] When performing information processing, the cryptographic processing device 1 reads out a program stored in the storage device 102 into the RAM. The cryptographic processing device 1 executes a program read into the RAM in the control circuit 101, thereby executing processing including one or more of a reception processing, a first calculation processing, a second calculation processing, a third calculation processing, a fourth calculation processing, a first bootstrap processing, a second bootstrap processing, a third bootstrap processing, a fourth bootstrap processing, and an output processing. The program may be stored in a storage device of a server on the network 200 as long as the control circuit 101 can access the program via the communication interface 105 .

[0130] The reading / writing device 103 is controlled by the control circuit 101 and reads / writes data from / to a removable recording medium 104 . The recording medium 104 stores various data. For example, the recording medium 104 stores an information processing program. For example, the recording medium 104 is a non-volatile memory (non-transient recording medium) such as a Secure Digital (SD) memory card, a Floppy Disk (FD), a Compact Disc (CD), a Digital Versatile Disk (DVD), a Blu-ray (registered trademark) Disk (BD), or a flash memory.

[0131] The communication interface 105 communicably connects the computer device 100 to other devices via the network 200. The communication interface 105 functions as, for example, the communication unit 25 in FIG. The input / output interface 106 is, for example, an interface that is detachably connected to various input devices. The input devices 107 connected to the input / output interface 106 include, for example, a keyboard and a mouse. The input / output interface 106 communicably connects the various input devices connected to the computer device 100. The input / output interface 106 outputs signals input from the various input devices connected to the control circuit 101 via the bus 110. The input / output interface 106 also outputs signals output from the control circuit 101 to the input / output device via the bus 110. The input / output interface 106 functions as, for example, the input unit 26 in FIG. 2.

[0132] Various types of information are displayed on the display device 108. The network 200 is, for example, a LAN, wireless communication, a P2P network, or the Internet, and communicatively connects the computer device 100 to other devices. It should be noted that the present embodiment is not limited to the embodiment described above, and various configurations or embodiments can be adopted without departing from the spirit of the present embodiment. [Explanation of symbols]

[0133] 1 encryption processing device, 10 control unit, 11 reception unit, 12 first calculation unit, 13 second calculation unit, 14 third calculation unit, 15 first bootstrap unit (calculation unit), 16 second bootstrap unit (calculation unit), 17 third bootstrap unit (calculation unit), 18 output unit, 20 memory unit, 25 communication unit, 26 input unit, 100 computer device, 101 control circuit, 102 storage device, 103 reading / writing device, 104 recording medium, 105 communication interface, 106 input / output interface, 107 input device, 108 display device, 110 bus, 200 network

Claims

1. A cryptographic processing device for processing a ciphertext, comprising: The cryptographic processing device is a cryptographic processing device that performs a fully homomorphic encryption operation that processes values ​​on a cyclic group that cyclically cycles between 0 and a predetermined value while keeping them encrypted, and includes a calculation unit that performs a homomorphic operation related to a predetermined operation on three or more ciphertexts, and a calculation unit that calculates a new ciphertext by applying a first polynomial to the ciphertext resulting from the homomorphic operation, the three or more ciphertexts are a first ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 4 of the predetermined value, a second ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 4 of the predetermined value, and a third ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 4 of the predetermined value, the calculation unit adds the first cipher text, the second cipher text, and the third cipher text while keeping them encrypted, and obtains a fifth cipher text by subtracting a fourth cipher text that is ⅛ of the predetermined value while keeping it encrypted; the calculation unit obtains a sixth ciphertext of a second polynomial obtained by rotating a coefficient of the first polynomial in accordance with the fifth ciphertext, and extracts a seventh ciphertext of a coefficient of the second polynomial from the sixth ciphertext, from which a plaintext corresponding to the fifth ciphertext is obtained; the calculation unit obtains a ninth ciphertext by adding the fifth ciphertext, the fifth ciphertext, and an eighth ciphertext that is ¼ of the predetermined value while still being encrypted; the calculation unit obtains a tenth ciphertext of a third polynomial obtained by rotating a coefficient of the first polynomial in accordance with the ninth ciphertext, and extracts an eleventh ciphertext of a coefficient of the third polynomial from which a plaintext corresponding to the ninth ciphertext is obtained from the tenth ciphertext.

4. A cryptographic processing device comprising:

2. The seventh ciphertext is a ciphertext corresponding to a carry output, the eleventh ciphertext is a ciphertext corresponding to an output of the sum, The calculation unit is extracting the seventh ciphertext corresponding to a plaintext obtained by adding an error to 0 when the plaintext of the fifth ciphertext is between 0 and ¼ of the predetermined value and between ¾ of the predetermined value and the predetermined value, and extracting the seventh ciphertext corresponding to a plaintext obtained by adding an error to ¼ of the predetermined value when the plaintext of the fifth ciphertext is between ¼ of the predetermined value and ¾ of the predetermined value; When the plaintext of the ninth ciphertext is between 0 and ¼ of the predetermined value and between ¾ of the predetermined value and the predetermined value, the eleventh ciphertext corresponding to a plaintext obtained by adding an error to 0 is extracted, and when the plaintext of the ninth ciphertext is between ¼ of the predetermined value and ¾ of the predetermined value, the eleventh ciphertext corresponding to a plaintext obtained by adding an error to ½ of the predetermined value is extracted.

2. The cryptographic processing device according to claim 1.

3. The error is A value less than 1 / 24 of the predetermined value 3. The cryptographic processing device according to claim 1, wherein the first and second inputs are connected to the first and second inputs.

4. The error is A value equal to or greater than 1 / 24 of the predetermined value according to the probability of obtaining a different calculation result that is permitted in an application to which the cryptographic processing device is applied.

3. The cryptographic processing device according to claim 1, wherein the first and second inputs are connected to the first and second inputs.

5. A cryptographic processing device for processing a ciphertext, comprising: The cryptographic processing device is a cryptographic processing device that performs a fully homomorphic encryption operation that processes values ​​on a cyclic group that cyclically cycles between 0 and a predetermined value while keeping them encrypted, and includes a calculation unit that performs a homomorphic operation related to a predetermined operation on three or more ciphertexts, and a calculation unit that calculates a new ciphertext by applying a first polynomial to the ciphertext resulting from the homomorphic operation, the three or more ciphertexts are a first ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 8 of the predetermined value, a second ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 8 of the predetermined value, and a third ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 8 of the predetermined value, the calculation unit adds the first ciphertext, the second ciphertext, and the third ciphertext while keeping them encrypted, and obtains a fifth ciphertext by adding a fourth ciphertext that is 1 / 16 of the predetermined value while keeping it encrypted; the calculation unit obtains a sixth ciphertext of a second polynomial obtained by rotating a coefficient of the first polynomial in accordance with the fifth ciphertext, and extracts, from the sixth ciphertext, a seventh ciphertext of a coefficient of the second polynomial from which a plaintext of a carry output corresponding to the fifth ciphertext is obtained; the calculation unit obtains an eighth ciphertext of a fourth polynomial obtained by rotating a coefficient of a third polynomial in accordance with the fifth ciphertext, and extracts a ninth ciphertext of a coefficient of the fourth polynomial from which a plaintext of a sum output corresponding to the fifth ciphertext is obtained from the eighth ciphertext.

2. The cryptographic processing device according to claim 1.

6. The error is A value less than 1 / 48 of the predetermined value 6. The cryptographic processing device according to claim 5.

7. The error is A value equal to or greater than 1 / 48 of the predetermined value according to the probability of obtaining a different calculation result that is permitted in an application to which the cryptographic processing device is applied.

6. The cryptographic processing device according to claim 5.

8. A cryptographic processing method for processing a ciphertext, the method being executed by a processor, comprising: the ciphertext is a fully homomorphic ciphertext on which a value in a cyclic group that cyclically ranges from 0 to a predetermined value can be operated while being encrypted, The processor, performing homomorphic operations relating to a predetermined operation on three or more ciphertexts, and calculating new ciphertexts by applying a first polynomial to the ciphertexts resulting from the homomorphic operations; the three or more ciphertexts are a first ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 4 of the predetermined value, a second ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 4 of the predetermined value, and a third ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 4 of the predetermined value, The processor, obtaining a fifth cipher text by adding the first cipher text, the second cipher text, and the third cipher text while keeping them encrypted, and subtracting a fourth cipher text that is 1 / 8 of the predetermined value while keeping it encrypted; obtaining a sixth ciphertext of a second polynomial obtained by rotating a coefficient of the first polynomial in accordance with the fifth ciphertext, and extracting a seventh ciphertext of the coefficient of the second polynomial from the sixth ciphertext, from which a plaintext corresponding to the fifth ciphertext is obtained; obtaining a ninth cipher text by adding the fifth cipher text, the fifth cipher text, and an eighth cipher text that is ¼ of the predetermined value while still being encrypted; obtaining a tenth ciphertext of a third polynomial obtained by rotating the coefficients of the first polynomial in accordance with the ninth ciphertext, and obtaining a plaintext corresponding to the ninth ciphertext from the tenth ciphertext; and extracting an eleventh ciphertext of the coefficients of the third polynomial.

13. A cryptographic processing method comprising:

9. A cryptographic processing method for processing a ciphertext, the method being executed by a processor, comprising: the ciphertext is a fully homomorphic ciphertext on which a value in a cyclic group that cyclically ranges from 0 to a predetermined value can be operated while being encrypted, The processor, performing homomorphic operations relating to a predetermined operation on three or more ciphertexts, and calculating new ciphertexts by applying a first polynomial to the ciphertexts resulting from the homomorphic operations; the three or more ciphertexts are a first ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 8 of the predetermined value, a second ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 8 of the predetermined value, and a third ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 8 of the predetermined value, The processor, adding the first cipher text, the second cipher text, and the third cipher text while keeping them encrypted, to obtain a fifth cipher text by adding a fourth cipher text that is 1 / 16 of the predetermined value while keeping it encrypted; obtaining a sixth ciphertext of a second polynomial obtained by rotating a coefficient of the first polynomial in accordance with the fifth ciphertext, and extracting a seventh ciphertext of a coefficient of the second polynomial from the sixth ciphertext, from which a plaintext of a carry output corresponding to the fifth ciphertext is obtained; obtaining an eighth ciphertext of a fourth polynomial obtained by rotating a coefficient of a third polynomial according to the fifth ciphertext, and obtaining a plaintext of a sum output corresponding to the fifth ciphertext from the eighth ciphertext; and extracting a ninth ciphertext of the coefficient of the fourth polynomial.

13. A cryptographic processing method comprising:

10. A cryptographic processing program for causing a processor to execute a cryptographic processing method for processing a ciphertext, comprising: the ciphertext is a fully homomorphic ciphertext on which a value in a cyclic group that cyclically ranges from 0 to a predetermined value can be operated while being encrypted, The processor, performing homomorphic operations relating to a predetermined operation on three or more ciphertexts, and calculating new ciphertexts by applying a first polynomial to the ciphertexts resulting from the homomorphic operations; the three or more ciphertexts are a first ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 4 of the predetermined value, a second ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 4 of the predetermined value, and a third ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 4 of the predetermined value, The processor, obtaining a fifth cipher text by adding the first cipher text, the second cipher text, and the third cipher text while keeping them encrypted, and subtracting a fourth cipher text that is 1 / 8 of the predetermined value while keeping it encrypted; obtaining a sixth ciphertext of a second polynomial obtained by rotating a coefficient of the first polynomial in accordance with the fifth ciphertext, and extracting a seventh ciphertext of the coefficient of the second polynomial from the sixth ciphertext, from which a plaintext corresponding to the fifth ciphertext is obtained; obtaining a ninth cipher text by adding the fifth cipher text, the fifth cipher text, and an eighth cipher text that is ¼ of the predetermined value while still being encrypted; obtaining a tenth ciphertext of a third polynomial obtained by rotating the coefficients of the first polynomial in accordance with the ninth ciphertext, and obtaining a plaintext corresponding to the ninth ciphertext from the tenth ciphertext; and extracting an eleventh ciphertext of the coefficients of the third polynomial.

4. A cryptographic processing program comprising:

11. A cryptographic processing program for causing a processor to execute a cryptographic processing method for processing a ciphertext, comprising: the ciphertext is a fully homomorphic ciphertext on which a value in a cyclic group that cyclically ranges from 0 to a predetermined value can be operated while being encrypted, The processor, performing homomorphic operations relating to a predetermined operation on three or more ciphertexts, and calculating new ciphertexts by applying a first polynomial to the ciphertexts resulting from the homomorphic operations; the three or more ciphertexts are a first ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 8 of the predetermined value, a second ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 8 of the predetermined value, and a third ciphertext corresponding to a plaintext obtained by adding an error to 0 or 1 / 8 of the predetermined value, The processor, adding the first cipher text, the second cipher text, and the third cipher text while keeping them encrypted, to obtain a fifth cipher text by adding a fourth cipher text that is 1 / 16 of the predetermined value while keeping it encrypted; obtaining a sixth ciphertext of a second polynomial obtained by rotating a coefficient of the first polynomial in accordance with the fifth ciphertext, and extracting a seventh ciphertext of a coefficient of the second polynomial from the sixth ciphertext, from which a plaintext of a carry output corresponding to the fifth ciphertext is obtained; obtaining an eighth ciphertext of a fourth polynomial obtained by rotating a coefficient of a third polynomial according to the fifth ciphertext, and obtaining a plaintext of a sum output corresponding to the fifth ciphertext from the eighth ciphertext; and extracting a ninth ciphertext of the coefficient of the fourth polynomial.

4. A cryptographic processing program comprising:

Images