Cryptographic processing device, cryptographic processing method, and cryptographic processing program

Abstract

To perform comparison operation on ciphertexts with a small amount of calculation.SOLUTION: A cryptographic processing device calculates a second ciphertext r1 having a polynomial as a plaintext using a first polynomial F1(X) for a first ciphertext ca; performs a homomorphic operation on the ciphertext having the first polynomial F1(X) as a plaintext for the second ciphertext r1, to calculate a third ciphertext r1' having a polynomial as a plaintext; and calculates a fifth ciphertext c3 having a polynomial as a plaintext, using the third ciphertext r1' for a ciphertext cc calculated by performing a homomorphic operation on the first ciphertext ca and the second ciphertext cb.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to a cryptographic processing device, a cryptographic processing method, and a cryptographic processing program. [Background technology]

[0002] Homomorphic encryption is an encryption method that allows data processing to be performed on encrypted data without decrypting the data. Additive homomorphic encryption is an encryption in which there is an operation between ciphertexts that corresponds to the addition between plaintexts, and multiplicative homomorphic encryption is an encryption in which there is an operation between ciphertexts that corresponds to the multiplication between plaintexts. Additive homomorphic encryption, which treats finite cyclic groups as integers and performs only additive operations (addition and subtraction), and multiplicative homomorphic encryption, which performs only multiplicative operations (multiplication), have long been known. Finite cyclic groups allow integer multiplication by repeated addition, so integer multiplication of plaintext is possible, and exponentiation of plaintext is also possible by repeated multiplication. There is also ring homomorphic encryption, which processes both additive and multiplicative operations while keeping the data encrypted, and fully homomorphic encryption (FHE), which allows all operations including additive and multiplicative operations. One type of fully homomorphic encryption is based on the Learning with Errors (LWE) problem, which involves adding small errors to plaintext during encryption that do not affect decryption.

[0003] In fully homomorphic encryption based on the LWE problem, errors accumulate as calculations are performed, so bootstrapping is performed to reduce the error components while still encrypting the data before the errors become too large to make decryption possible. The computation time of bootstrapping accounts for most of the computation time required for fully homomorphic encryption. In addition, because bootstrapping handles a huge amount of data, the amount of computation required is enormous. Therefore, in fully homomorphic encryption, it has been difficult to obtain the computation results within a practical time frame. A technique that dramatically improves this problem is TFHE (Fast Fully Homomorphic Encryption over the Torus), which is shown in Non-Patent Document 1 (referred to as the above paper in the following description). There are two types of homomorphic encryption: bit-wise homomorphic encryption, which has two values ​​as plaintext and is based on logical operations, and integer-wise homomorphic encryption, which uses an entire integer as plaintext as a single ciphertext. The TFHE described in Non-Patent Document 1 is a bit-wise type. Note that the plaintext of TFHE is a real number between 0 and 1 that is associated with a circular group. Therefore, by sequentially associating integers with intervals that divide the range of the circular group from 0 to 1, TFHE can be extended and applied as an integer-wise homomorphic encryption method that has integers as plaintexts (see Non-Patent Document 2). When TFHE is used as an integer-wise type, a single ciphertext can contain several bits of information, allowing more complex calculations to be performed in a single homomorphic calculation, significantly reducing the number of calculations required for the entire system. It is known that any one-variable function can be evaluated by substituting a function value into the bootstrap test vector polynomial and using it as an LUT (Non-Patent Document 3). [Prior art documents] [Patent documents]

[0004] [Non-Patent Document 1] TFHE:Fast Fully Homomorphic Encryption over the Torus. Journal of Cryptology, 33:34-91, 2020, I. Chillotti, N. Gama, M. Georgieva, and M. Izabachene [Non-Patent Document 2] Integerwise Functional Bootstrapping on TFHE, 2020, Hiroki Okada, Shinsaku Kiyomoto, and Carlos Cid [Non-Patent Document 3] Bootstrapping in FHEW-like Cryptosystems, 2020, Daniele Micciancio and Yuriy Polyakov Summary of the Invention [Problem to be solved by the invention]

[0005] Furthermore, there is a demand for ciphertext comparison operations using integer-wise TFHE, because comparison between TLWE ciphertexts has a wide range of applications, such as homomorphic multiple-precision arithmetic on multiple-precision integers with one TLWE ciphertext as a division unit. Among multiple-precision arithmetic, multiple-precision subtraction involves repeating subtraction and carry operations one division unit at a time, starting from the lowest division unit, in the same way that humans perform subtraction by addition. This carry operation requires a homomorphic comparison operation. In addition, multiple-precision addition involves a carry operation, which is the opposite of multiple-precision subtraction. This carry operation also requires a homomorphic comparison operation. Not only in multiple-precision arithmetic, but also in the case of ciphertexts representing a single integer value, comparison operations are necessary in addition and subtraction to determine the magnitude relationship between ciphertexts and plaintexts. An object of one aspect of the present invention is to perform, with a small amount of calculation, comparison operations of ciphertexts required for processing carry and borrow that occur during addition and subtraction. [Means for solving the problem]

[0006] According to one embodiment, the present invention provides a cryptographic processing device for processing a ciphertext, the ciphertext being a fully homomorphic ciphertext having a plaintext in which a value obtained by adding an error having a predetermined variance to a predetermined value is associated with an integer, and in which a predetermined operation between integers can be performed without decryption, Depending on , the first polynomial By cycling through the coefficients, calculating a second ciphertext having the polynomial as a plaintext, and performing a homomorphic operation on the second ciphertext having the second polynomial as a plaintext to calculate a third ciphertext having the polynomial as a plaintext; before Using the third ciphertext as a polynomial, the fourth ciphertext is In response to the above, the coefficients of the third ciphertext are rotated to extract a predetermined term. The cryptographic processing device calculates a fifth ciphertext by Effect of the Invention

[0007] According to one aspect of the present invention, comparison operations of ciphertexts can be performed with a small amount of calculation. [Brief description of the drawings]

[0008] [Figure 1] FIG. 2 is a diagram illustrating a functional configuration of the cryptographic processing device according to the present embodiment. [Diagram 2] 2 is a diagram for explaining in detail a calculation process based on the functional configuration of FIG. 1. [Diagram 3] 2 is a diagram for explaining in detail a calculation process based on the functional configuration of FIG. 1. [Figure 4] FIG. 1 is an image diagram for explaining a circular group that the TLWE cipher has as plaintext. [Diagram 5] This is an image diagram of binary gate bootstrapping operation. [Figure 6] FIG. 1 is a diagram for explaining TFHE applied to an integer-wise type. [Figure 7] FIG. 2 is a diagram illustrating an integer-wise TFHE in this embodiment. [Figure 8]FIG. 13 is a diagram illustrating a ciphertext that represents an addition result of ciphertexts. [Figure 9] FIG. 13 is a diagram illustrating a ciphertext that represents an addition result of ciphertexts. [Figure 10] FIG. 1 is a diagram showing a circular group corresponding to a ciphertext obtained by inverting a plaintext. [Figure 11] FIG. 13 is a diagram illustrating a ciphertext that represents an addition result of ciphertexts. [Figure 12] FIG. 13 is a diagram illustrating a ciphertext that represents an addition result of ciphertexts. [Figure 13] FIG. 13 is a diagram showing possible values ​​of ciphertext depending on the result of subtraction of the ciphertext. [Figure 14] 4 is a flowchart illustrating a process according to the first embodiment. [Figure 15] 13 is a flowchart illustrating a process according to a second embodiment. [Figure 16] 10 is a diagram showing ciphertexts input and output to Gate Bootstrapping of the present embodiment. FIG. [Figure 17] FIG. 1 is a block diagram illustrating an embodiment of a computing device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. In the following description, alphanumeric characters enclosed in [] indicate that it is a vector, and alphanumeric characters enclosed in {} indicate that it is a set. In addition, in this specification, the term "logical operation" refers to a binary or multi-valued operation.

[0010] FIG. 1 is a diagram illustrating the functional configuration of the cryptographic processing device of this embodiment. The cryptographic processing device 1 includes a control unit 10, a storage unit 20, a communication unit 25, and an input unit . The control unit 10 includes a receiving unit 11, a first calculation unit 12, a second calculation unit 13, a third calculation unit 14, a fourth calculation unit 15, a fifth calculation unit 16, and a sixth calculation unit 17. The control unit 10 also includes a first bootstrap unit (calculation unit) 41, a second bootstrap unit (calculation unit) 42, a third bootstrap unit (calculation unit) 43, a fourth bootstrap unit (calculation unit) 44, and an output unit 35.

[0011] The reception unit 11 receives an input of a ciphertext to be subjected to an operation via the communication unit 25 or the input unit 26. Alternatively, the reception unit 11 receives an input of a ciphertext from another process executed by the cryptographic processing device 1. The first calculation unit 12 performs a first homomorphic calculation on the input ciphertext accepted by the acceptance unit 11 . The second arithmetic unit 13 performs a second homomorphic operation on the ciphertext output during the processing by the first bootstrap unit 41. The third arithmetic unit 14 performs a third homomorphic operation on the two input ciphertexts to be compared. The fourth arithmetic unit 15 performs a fourth homomorphic operation on the ciphertext output from the first bootstrap unit 41 and the ciphertext output from the second bootstrap unit . The fifth arithmetic unit 16 performs a fifth homomorphic operation on the ciphertext output from the third bootstrap unit 43 . The sixth arithmetic unit 17 performs a sixth homomorphic operation on the ciphertexts output from the fifth arithmetic unit 16 .

[0012] The first bootstrap unit 41 performs first gate bootstrap on the ciphertext output from the first arithmetic unit 12 . The second bootstrap unit 42 performs second gate bootstrap on the ciphertext output from the third arithmetic unit 14 . The third bootstrap unit 43 performs third gate bootstrap on the ciphertext output from the fourth arithmetic unit 15 . The fourth bootstrap unit 44 performs fourth gate bootstrap on the ciphertext output from the second bootstrap unit 42 .

[0013] The first calculation unit 12, the second calculation unit 13, the third calculation unit 14, the fourth calculation unit 15, the fifth calculation unit 16, and the sixth calculation unit 17 are calculation processing units that realize the homomorphic calculation described below by software. The first bootstrap unit 41, the second bootstrap unit 42, and the third bootstrap unit 43 are arithmetic processing units that realize the gate bootstrapping process described below by software. At least one of the first calculation unit 12, the second calculation unit 13, the third calculation unit 14, the fourth calculation unit 15, the fifth calculation unit 16, the sixth calculation unit 17, the first bootstrap unit 41, the second bootstrap unit 42, the third bootstrap unit 43, the fourth bootstrap unit 44, and the output unit 35 may be realized in hardware.

[0014] The output unit 35 outputs the final calculation result to the outside of the cryptographic processing device 1 or to another processing process executed by the cryptographic processing device 1. The storage unit 20 can store input ciphertext, temporary files and temporary data used in operations on the ciphertext, and output ciphertext. Furthermore, the storage unit 20 can store an encrypted database 60 . The communication unit 25 connects the cryptographic processing device 1 to a network, enabling communication with external devices. By storing the encrypted database 60 in the storage unit 20 and providing the communication unit 25, the cryptographic processing device 1 can function as a database server. In this case, the cryptographic processing device 1 can accept an encrypted query from a terminal device as an external device, perform a search on the encrypted encrypted database 60, and respond with encrypted search results to the terminal device. The input unit 26 inputs, to the cryptographic processing device 1, ciphertext to be processed and a query for the encrypted database 60.

[0015] FIG. 2 is a diagram for explaining in detail the calculation process according to the first embodiment based on the functional configuration of FIG. The configuration shown in Figure 2 uses the Gate Bootstrapping proposed in the above paper. The Gate Bootstrapping of TFHE proposed in the above paper is described in detail below. The cryptographic processing device 1 compares integer-wise TLWE ciphertexts, where TLWE ciphertext ca is a ciphertext of a plaintext integer a, and TLWE ciphertext cb is a ciphertext of a plaintext integer b.

[0016] 2, the cryptographic processing device 1 inputs a TLWE ciphertext ca to a first arithmetic unit 12 and performs a first homomorphic operation to obtain a TLWE ciphertext ca'. The cryptographic processing device 1 inputs the TLWE ciphertext ca' to a first bootstrap unit 41 and performs BlindRotate on the TLWE ciphertext ca' using polynomial F1(X) as a test vector polynomial to calculate a TRLWE ciphertext r1. The cryptographic processing device 1 inputs the TRLWE ciphertext r1 to the second arithmetic unit 13 and performs a second homomorphic operation to obtain a TRLWE ciphertext r1'. The cryptographic processing device 1 inputs the TLWE ciphertext ca and TLWE ciphertext cb to the third arithmetic unit 14 and performs a third homomorphic operation to obtain a TLWE ciphertext cc. The cryptographic processing device 1 inputs the TLWE ciphertext cc to the second Bootstrapping unit 42 and performs BlindRotate on the TLWE ciphertext cc using the TRLWE ciphertext r1', which is the operation result of the second homomorphic operation, as a test vector polynomial to calculate a TRLWE ciphertext r2. The cryptographic processing device 1 performs SampleExtract on the TRLWE ciphertext r2 using the second Bootstrapping unit 42 to obtain a TLWE ciphertext c3. The cryptographic processing device 1 performs SampleExtract on the TRLWE ciphertext r1 using the first Bootstrapping unit 41 to obtain a new ciphertext c2. The cryptographic processing device 1 inputs the TLWE ciphertext c2 and the TLWE ciphertext c3 to the fourth arithmetic unit 15 and performs a fourth homomorphic arithmetic operation to obtain a TLWE ciphertext c4. The cryptographic processing device 1 inputs the TLWE ciphertext c4 to the third bootstrap unit 43, and performs BlindRotate on the TLWE ciphertext c4 using the polynomial F1'(X) as a test vector polynomial to calculate a TRLWE ciphertext r3. The cryptographic processing device 1 performs SampleExtract twice on different parts of the TRLWE ciphertext r3, and performs a sixth homomorphic operation on each output result by the fifth operation unit 16 to obtain TLWE ciphertexts c5 and c6.

[0017] FIG. 3 is a diagram for explaining in detail the calculation process according to the second embodiment based on the functional configuration of FIG. 3, the cryptographic processing device 1 inputs a TLWE ciphertext ca to a first arithmetic unit 12 and performs a first homomorphic operation to obtain a TLWE ciphertext ca'. The cryptographic processing device 1 inputs a new ciphertext ca' to a first bootstrap unit 41 and performs BlindRotate on the TLWE ciphertext ca' using polynomial F2(X) as a test vector polynomial to calculate a TRLWE ciphertext r11'. The cryptographic processing device 1 inputs the TRLWE ciphertext r11 to the second arithmetic unit 13 and performs a second homomorphic operation to obtain a TRLWE ciphertext r11'. The cryptographic processing device 1 inputs the TLWE ciphertext ca and the TLWE ciphertext cb to the third arithmetic unit 14 and performs a third homomorphic operation to obtain a TLWE ciphertext cc'. The cryptographic processing device 1 inputs the TLWE ciphertext cc' to the second bootstrap unit 42, and performs BlindRotate on the TLWE ciphertext cc' using the operation result r11' of the second homomorphic operation as a test vector polynomial to calculate a TRLWE ciphertext r2'.

[0018] The cryptographic processing device 1 performs SampleExtract on the TRLWE ciphertext r2' using the second Bootstrapping unit 42 to obtain a TLWE ciphertext c3'. The cryptographic processing device 1 performs SampleExtract on the TRLWE ciphertext r11 by the first Bootstrapping unit 41 to obtain a new ciphertext c2'. The cryptographic processing device 1 inputs the TLWE ciphertext c2' and the TLWE ciphertext c3' to the fourth arithmetic unit 15 and performs a fourth homomorphic arithmetic operation to obtain a TLWE ciphertext c4'. The cryptographic processing device 1 inputs the TLWE ciphertext c4' to the third bootstrap unit 43, and performs BlindRotate on the TLWE ciphertext c4' using the polynomial F2'(X) as a test vector polynomial to calculate a TRLWE ciphertext r3. The cryptographic processing device 1 performs SampleExtract three times at different points on the TRLWE ciphertext r3, inputs each output result to a fifth arithmetic unit 16, and performs a fifth homomorphic operation to obtain TLWE ciphertexts c5, c6, and c7. The cryptographic processing device 1 inputs the TLWE ciphertexts c5, c6, and c7 to the sixth arithmetic unit 17 to perform a sixth homomorphic operation, and obtains a TLWE ciphertext c8 corresponding to the comparison result.

[0019] The cryptographic processing device 1 performs SampleExtract on the TRLWE ciphertext r2' using the second Bootstrapping unit 42 to obtain the TLWE ciphertext cg. The cryptographic processing device 1 inputs the TLWE ciphertext cg to the fourth bootstrap unit 44 and calculates a polynomial F id Gate bootstrap is performed using (X) as a test vector polynomial, and the TLWE ciphertext c9 corresponding to the calculation result of ca-cb is obtained.

[0020] This section provides details on Gate Bootstrapping as explained in TFHE. Gate Bootstrapping is a technique for making fully homomorphic encryption practical, which was previously considered impractical due to the huge amount of data and computation time required. The TFHE in the above paper uses a cryptosystem called TLWE cryptosystem, which is an LWE (Learning with Errors) cryptosystem constructed on a circular group, to realize various homomorphic logical operations (and ultimately any operation such as addition and multiplication) between TLWE ciphertexts at high speed and with small data size while reducing errors during calculation.

[0021] The input for Gate Bootstrapping in TFHE is a TLWE ciphertext encrypted with a private key. In TFHE, fully homomorphic encryption (FHE) is realized based on TLWE ciphertext. TLWE cryptography is a special case of LWE cryptography, which is a type of lattice cryptography (LWE cryptography defined on a circular group). It is known that TLWE encryption is additively homomorphic, and additive operations between TLWE-encrypted plaintexts can be performed without decrypting the ciphertext.

[0022] FIG. 4 is an image diagram for explaining a circular group that the TLWE cipher has as a plaintext. The TLWE cipher advances from 0 with real number precision and returns to 0 when it reaches 1. Any point on the circle group {T} shown in Figure 4 is used as the plaintext, and the vicinity of 0 (including error) and the vicinity of μ (including error) are used as plaintext. Points on the circle group {T} are also referred to herein as "elements." A cryptographic processing device that handles TFHE performs common homomorphic operations such as additive operations between such TLWE ciphertexts, and by using Gate Bootstrapping to keep the error in the operation results within an appropriate range, it realizes fully homomorphic encryption (FHE) that allows logical operations to be performed again (at a later stage).

[0023] [TLWE cipher] Explain the TLWE cipher. As an element on the circle group {T}, prepare a vector [a] consisting of N uniformly distributed random numbers. Also prepare a secret key vector [s] consisting of N random numbers chosen from the binary values ​​0 and 1. If the mean is the plaintext μ and e is a random number with a Gaussian (normal) distribution and a predetermined variance α, then the set ([a],[s]·[a]+e) is an example of a TLWE ciphertext. The average value of e when an infinite number of TLWE ciphertexts are generated for the same plaintext μ is the plaintext μ, where μ is a plaintext without errors and e is a plaintext with errors. Note that "·" represents the inner product of vectors. The same applies hereafter. If we define the above [s]·[a]+e as b, the TLWE ciphertext can be expressed as ([a], b). φ s (([a],b))=b-[s]·[a]=e is the function that decrypts TLWE ciphertext. Since TLWE ciphertext encrypts plaintext by adding the inner product of the secret key vector and random number vector and an error, it is possible to decrypt the TLWE ciphertext with an error by calculating the inner product of the secret key vector and random number vector. At this time, if the secret key vector is unknown, the components that make up the inner product cannot be calculated, and therefore decryption is not possible.

[0024] This TLWE encryption is additively homomorphic, meaning that addition operations between TLWE ciphertexts can be performed without decrypting the ciphertexts. Add the two TLWE ciphertexts ([a],b) and ([a'],b') as is to obtain ([a]+[a'],b+b'), and then use the above decryption function φ s If you enter φ s (([a]+[a'],b+b'))=(b+b')-[s]·([a]+[a'])=(b-[s]·[a])+(b'-[s]·[a'])=φ s ([a],b)+φ s ([a'],b') This gives us the sum of the two plaintexts. This proves that the TLWE ciphertext is an "additively homomorphic encryption". In the TFHE described in the above paper, various calculations are achieved by repeatedly performing additive operations on the TLWE ciphertext with errors added to the plaintext, and reducing the errors by gate bootstrapping.

[0025] In what follows, a "trivial ciphertext" such as ([0],μ) is a TLWE ciphertext that can be decrypted with any private key, i.e., a ciphertext that can be decrypted with any private key to decrypt the same plaintext. In ([0],μ), [0] represents the zero vector. "Trivial ciphertext" can be treated as TLWE ciphertext, but it essentially contains the plaintext as is. The TLWE ciphertext ([0],μ) is decrypted by the decryption function φ s When multiplied by φ s Since (([0],μ))=μ-[s]·0=μ, and the secret key [s] is multiplied by the zero vector [0] and disappears, the plaintext μ can be easily obtained. Such a ciphertext is nothing but a trivial ciphertext for the plaintext μ.

[0026] We explain the finite cyclic groups used in Gate Bootstrapping of TFHE. Gate Bootstrapping utilizes the properties of the quotient ring of a polynomial ring as a finite cyclic group. Explain that there are finite cyclic groups in the quotient ring of a polynomial ring. A polynomial of degree n is generally n x n +a n-1 x n-1 It is expressed as +...+a0. All these sets form a commutative group for the sum of polynomials f(x) + g(x). Also, the product of polynomials, f(x)g(x), has properties similar to a commutative group, except that an inverse does not necessarily exist. Such a group is called a monoid. The distributive law holds for sums and products of polynomials as follows: f(x){g(x)+g'(x)}=f(x)g(x)+f(x)g'(x) Therefore, if we define the sum and product of polynomials as elements, they form a "ring", which is called a polynomial ring.

[0027] In TFHE, we use a polynomial ring whose coefficients are the circle group {T}, and denote such a polynomial ring as T[X]. Let T(X) be a polynomial ring, and let T[X](X n If we decompose it into the form X+T[X], and then take out and collect only the second term (the remainder), this also has the properties of a "ring," so we obtain the remainder ring of the polynomial ring. In TFHE, the quotient ring of a polynomial ring is defined as T[X] / (X n +1).

[0028] The polynomial ring T[X] / (X n +1), using any coefficient μ(μ∈T), Polynomial F(X)=μX n-1 +μX n-2 +···+μX+μ Take out. When we multiply an element F(X) in the quotient ring of a polynomial ring by X, we get μX n-1 +μX n-2 +···+μX-μ, and the coefficient of the top term changes from positive to negative and appears as a constant term. This is because the terms with degrees n-2 or less remain constant even after multiplying by X. n +1 cannot be divided, but the highest degree term is μX n =μ(X n +1)-μ. n Since we are considering the remainder when dividing by +1, only the remainder -μ on the right-hand side remains. Multiplying it by X again gives us μX n-1 +μX n-2 +···+μX 2 The same thing happens again: -μX-μ (the coefficient of the top term flips from positive to negative and appears as a constant term). Repeat this a total of n times, -μX n-1 -μX n-2 ...-μX-μ and the coefficients of all terms are negative.

[0029] If we continue multiplying by X, -μX n-1 -μX n-2 -μX+μ -μX n-1 -μX n-2 +μX+μ The coefficient of the top term flips from negative to positive and appears as a constant term. If you repeat this 2n times, you get the element F(X)=μX n-1 +μX n-2 Returning to +···+μX+μ, in this way, the top-order coefficient (μ) appears in the bottom-order constant term with its sign inverted (-μ), resulting in an overall shift of one term. That is, polynomial F(X)=μX n-1 +μX n-2 +···+μX+μ is the quotient ring T[X] / (X n +1), it is a finite cyclic group of order 2n. In TFHE, the cryptographic processing device realizes fully homomorphic encryption by utilizing the properties of a polynomial F(X) based on a remainder ring of such a polynomial ring. Regardless of whether the exponent of X is positive or negative, multiplying an element F(X) of the quotient ring of a polynomial ring n times by X reverses the signs of all the terms, and multiplying it 2n times restores the signs of all the terms. Also, X -1 Since multiplying by is the inverse operation of multiplying X, -1 If you continue to multiply it, the opposite change will occur compared to multiplying it by X, -1 Multiplying it n times inverts all the terms, and multiplying it 2n times returns it to its original state. From the above, we can see that the element F(X) of the quotient ring of the polynomial ring has the same structure as X or X -1 Multiplying it n times will invert the signs of all the terms, and multiplying it 2n times will restore the signs of all the terms. In this cyclic group, because it can be rotated in either direction, it is sometimes convenient to use the expressions "multiplying -n times" or "multiplying -2n times". This is merely a convenient expression for explaining the theory, and when implementing the present invention, for example, X a When multiplying by -b times, X -a Even if you apply it b times, X 2n-a It is also possible to apply the above formula b times, and if the same result can be achieved, other transformations can also be performed.

[0030] [TRLWE cipher] In addition to the TLWE cipher, Gate Bootstrapping uses a cipher called the TRLWE cipher. This section explains the TRLWE encryption. The R in TRLWE stands for ring, and TRLWE is an LWE encryption scheme built on rings. Like TLWE, TRLWE is also an additively homomorphic encryption scheme. The ring in TRLWE cryptography is the remainder ring T[X] / (X n +1). To obtain the TRLWE encryption, we use the polynomial ring T[X] / (X n +1) at random. In practice, the n coefficients of the n-1 degree polynomial are selected from the circle group {T} as uniformly distributed random numbers. If the degree of the polynomial is n-1, then X n Let polynomial a(X) be a polynomial of degree n-1, since it cannot be divided by +1 and there is no need to consider the remainder.

[0031] Randomly select n values ​​from the two values ​​0 and 1 and construct the polynomial s(X) that will be the secret key below. s(X)=s n-1 X n-1 +s n-2 X n-2 +···s1X+s0 n random numbers e i The average value is the plaintext μ i Let the random numbers be Gaussian (normal) distributed with variance α, and then construct the following polynomial e(X) from these. e(X)=e n-1 X n-1 +e n-2 X n-2 +···e1X+e0 s(X) a(X) + e(X) is expressed as f(X)(X n +1)+b(X) to obtain b(X). As a result, the TRLWE ciphertext obtained is (a(X), b(X)). Like the TLWE encryption, the TRLWE encryption uses random numbers for encryption, so an infinite number of ciphertexts can be generated for the same secret key and plaintext. In addition, the TRLWE encryption code has the same structure as the TLWE encryption code. s ((a(X),b(X))=b(X)-s(X)·a(X)+g(X)(X n +1), φ s T[X] / (X nThe decryption function is defined as g(X) being the element of b(X) + 1. In other words, (b(X)-s(X) a(X))mod(X n +1) serves as the decoding function. mod means the remainder of the division.

[0032] [Gadget Decomposition] Explain Gadget Decomposition. The coefficients of the polynomial used in the TRLWE ciphertext are real numbers between 0 and 1, which are elements of the circle group {T} in FIG. 4, and have only a decimal part. The operation of decomposing this into several bits in binary notation is defined as Gadget Decomposition (Dec) in TFHE of the above paper. For example, if the degree n of the polynomial F(X) of the TRLWE ciphertext is n=2, then one unit of division is Bg=2. 2 Then, decompose it into l=3 elements, where each element is between -Bg / 2 and Bg / 2. The TRLWE ciphertext is a combination of two polynomials, such as (a(X), b(X)) above. Therefore, the TRLWE ciphertext d can be regarded as a two-dimensional vector whose elements are polynomials that are the elements of the remainder ring of the polynomial ring. For example, d=[0.75X 2 +0.125X+0.5,0.25X 2 +0.5X+0.375] Therefore, in the following, each element is written as Bg -1 =Decompose into the form of a sum of powers of 0.25.

[0033] On the circle group {T}, 0.75=-0.25, so d=[0.75X 2 +0.125X+0.5,0.25X 2 +0.5X+0.375] =[-0.25X 2 +0.125X+0.5,0.25X 2 +0.5X+0.25+0.125] = [0.25 × (-X 2+2)+0.25 2 ×2X+0.25 3 ×0,0.25×(X 2 +2X+1)+0.25 2 ×2+0.25 3 ×0] It can be broken down as follows. Therefore, when Gadget Decomposition is performed, Dec(d) = [-X 2 +2,2X,0,X 2 +2X+1,2,0] This becomes the vector.

[0034] We also define an operator H that converts a vector back to a ciphertext. Based on the above example, The matrix TIFF0007649558000001.tif3034 is the inverse transform operator H. The TRLWE ciphertext d is obtained by calculating Dec(d) H. The lower bits are rounded off.

[0035] For a TRLWE ciphertext d, the operation of obtaining [v] such that ||d-[v]·H|| is the minimum value can also be said to be a gadget decomposition, where || is the norm (length) of the vector. All coefficients of e(X) are calculated using a polynomial generated from random numbers with a mean of 0 and a variance of α, to generate 2l TRLWE ciphertexts Zi=(a(X),b(X)). Then, the plaintext μ is encrypted as follows to obtain the following ciphertext k. TIFF0007649558000002.tif2643The ciphertext that can be expressed as this ciphertext k will be called the TRGSW ciphertext. The TRGSW ciphertext constitutes the Bootstrapping Key used below.

[0036] Explain Bootstrapping Key. The Bootstrapping Key is used as a method to encrypt a private key for use in Gate Bootstrapping. In addition to the secret key [s] (Nth degree) used for the TLWE ciphertext, each element of the secret key [s'] for encrypting the secret key [s] for use in Gate Bootstrapping is selected as a binary value of 0 or 1. The degree of the private key [s'] must be the same as the degree n of the polynomial used in the TRLWE encryption. Create a TRGSW ciphertext for each element of the private key [s]. When decrypted with the private key [s'], φ s’ Create 2l (el) TRLWE ciphertexts Zj such that (Zj)=0. And, according to the structure of the TRGSW ciphertext above, Let's say TIFF0007649558000003.tif2539. The set of TRGSW ciphertexts constructed using different Zj for each element of the secret key [s] is called the Bootstrapping Key (BK). In other words, BK is a set of N TRGSW ciphertexts.

[0037] The cross product of the TRGSW ciphertext BKi and the TRLWE ciphertext d is BKi×d=Dec(d)·BKi It is defined as: Gadget Decomposition is an operation to obtain [v] such that ||d-[v]·H|| is the minimum value for the TRLWE ciphertext d. Therefore, [v] = Dec(d) and the error (ε a (X),ε b Using (X), [v] H=d+(ε a (X),ε b (X)). As a result, BKi×d=Dec(d)·BKi The result is TIFF0007649558000004.tif2243. The left half calculates the dot product, and the right half calculates [v] H=d+(ε a (X),ε bSubstituting (X), we get The result is TIFF0007649558000005.tif1490, which is the same as calculating the sum of the three ciphertexts c1, c2, and c3 below. TIFF0007649558000006.tif1945TRLWE encryption is an additively homomorphic encryption method, so adding two ciphertexts together is the same as adding two plaintexts together. C1 is Z j Since it is the sum of several times, the plain text φ s’ The expected values ​​of each coefficient in (c1) are all zero. Also, the decoded φ s’ In (c3), since the magnitude of the absolute value of each coefficient of the plaintext can be adjusted by the system parameters, the magnitude is set to be sufficiently small, including the subsequent calculations.

[0038] Then, φ s’ (BKi×d)=φ s’ (s i × d), but s i Whether s is 0 or 1, the calculation result is the sum of the three ciphertexts c1, c2, and c3. In other words, a simple comparison of s i It is not possible to determine whether it is 0 or 1. Assuming that there are TRLWE ciphertexts d0 and d1 corresponding to two plaintext polynomials μ0 and μ1, and substituting d = d1 - d0 and finally adding d0, the CMux function shown below is completed. CMux(BK i ,d0,d1)=BKi×(d1-d0)+d0=Dec(d1-d0)·BK i +d0 The CMux function is i If is 0, the plaintext polynomial μ0 outputs the TRLWE ciphertext without decryption, and s i If is 1, the TRLWE ciphertext with plaintext polynomial μ1 is output without decryption. The CMux function can compute the TRLWE ciphertext for which the plaintext polynomial is either μ0 or μ1, but the choice cannot be known from the result without decrypting it.

[0039] TFHE's binary gate bootstraping is performed using the various pieces of information described above. Binary Gate Bootstrapping consists of three steps: (1) BlindRotate, (2) SampleExtract, and (3) Public Key Switching, as described below.

[0040] FIG. 5 is a conceptual diagram of the operation of binary gate bootstrapping. Binary Gate Bootstrapping reduces the error of the homomorphic operation result between TLWE ciphertexts with respect to the plaintext through the three steps described below. In the following explanation, unless otherwise specified, the plaintext refers to the result of an operation between plaintexts that is the result of an operation between TLWE ciphertexts. In the circle group {T} in Figure 4, plaintexts in the ranges 0 to 0.25(1 / 4) and 0.75(3 / 4) to 1 are converted into a TLWE ciphertext of 0, and plaintexts in the range 0.25(1 / 4) to 0.75(3 / 4) are converted into a ciphertext of 0.25(1 / 4). During this conversion, the error added to the plaintext is within the range of ±1 / 16.

[0041] (1) BlindRotate BlindRotate is performed as the first step in Gate Bootstrapping. BlindRotate is the process that creates the TRLWE ciphertext. In BlindRotate, we convert the trivial TRLWE ciphertext (0,T(X)) with polynomial T(X) as plaintext into X -φs(c’) The TRLWE ciphertext multiplied by is obtained without decryption. 0 indicates the 0th degree polynomial 0. Here, φs(c') is the plaintext obtained by applying the LWE ciphertext c' below to the decryption function. In BlindRotate, the following polynomial F(X) is used as a test vector, which is a finite cyclic group as described above. F(X)=μX n-1+μX n-2 +…μX+μ where μ=1 / 8 X n / 2 The following polynomial T(X) obtained by multiplying T(X)=F(X) X n / 2 Prepare the following.

[0042] Suppose there is a TLWE ciphertext c obtained by encrypting plaintext μ1 with a secret key [s]. Each element of this TLWE ciphertext c = ([a], b) is multiplied by 2n and rounded off to obtain the LWE ciphertext c' = ([a'], b'). When the LWE ciphertext c'=([a'],b') is decrypted, μ1'=φ s (c') ≒ 2n × φ s (c) = 2nμ1. Because of rounding errors, the numbers may not match perfectly, but the larger n is, the smaller the error becomes. Prepare a trivial TRLWE ciphertext (0,T(X)) with polynomial T(X) as plaintext, A0=X -b’ ×(0,T(X))=(0,X -b’ ×T(X)). 0 indicates the 0th degree polynomial 0. In this case, since b' is an integer, the power can be naturally defined. In practice, it is sufficient to rotate the coefficients of each term of the polynomial of the TRLWE ciphertext a predetermined number of times. Hereafter, the above-mentioned Bootstrapping Key, BK i Using, in order, A i =CMux(BK i ,A i-1 ,X a’i A i-1 Here too, since a'i is an integer, the power of X can be naturally defined. Similarly, instead of calculating the power of X, we calculate the TRLWE ciphertext A i-1 It is sufficient to rotate the coefficients of each term of the polynomial, which is an element of the polynomial, a predetermined number of times.

[0043] Then, s i When is 0, the plaintext remains unchanged, and s i When is 1, X a’iare multiplied in order. Therefore, If you repeat this with TIFF0007649558000007.tif2849, The result is TIFF0007649558000008.tif749. Where: Since TIFF0007649558000009.tif629 is equal to the decoded function φs(c') with its sign inverted, The result is TIFF0007649558000010.tif741. Here, φ s’ (A n ) is the polynomial T(X) plus X -1 is the ciphertext of a polynomial obtained by multiplying A by μ1' times. n is the ciphertext. At this point, we should clarify that the error component of the error-added plaintext e of the initially set TLWE ciphertext c is expressed as the amount of rotation of the polynomial T(X), and is not expressed as the magnitude of the coefficient values ​​of each term. TFHE essentially reduces the error by this mechanism. In addition, for the plaintext μ1 of the TLWE ciphertext c related to BlindRotate, a unique value (n coefficients and up to 2n coefficients with their signs inverted) according to the number of times μ1' (=2nμ1) by which the polynomial T(X) is multiplied by X is obtained as the coefficient of the constant term of the plaintext polynomial, which can be regarded as a kind of look-up table.

[0044] (2)SampleExtract TRLWE ciphertext A obtained by BlindRotate in (1) n The plaintext polynomial φ obtained by decrypting s’ (A n ), counting from the lower terms, we get n / 2-φ s The coefficient of the (c')th term is -μ, and if it becomes negative, the coefficient of the term from the top down will be -μ. TRLWE Ciphertext A n The plaintext polynomial φ obtained by decrypting s’ (A n ), if we look only at the constant term of φ s(c') is greater than or equal to n / 2 and less than 3n / 2, i.e., φ s If (c) is 1 / 2±1 / 4, the constant term is μ. Otherwise, if φs(c) is ±1 / 4, the constant term is -μ. SampleExtract is the TRLWE ciphertext A obtained by BlindRotate in (1). n From this, we can obtain the plaintext polynomial φ without decrypting it. s’ (A n ) to obtain the TLWE ciphertext cs. As mentioned above, the error added to the initial input TLWE ciphertext c and the error added by rounding only affect the position of the boundary where the plaintext μ and -μ of the constant term switch, and the effect on the magnitude of the coefficient of the constant term is negligibly small. In other words, it can be interpreted as eliminating input errors. Also, the range within which the boundary where the plaintext value of the constant term changes can be moved without any problems is the error limit for which bootstrap processing can be performed correctly, and this is the mechanism that creates the trade-off described below.

[0045] The process for obtaining the TLWE ciphertext cs will now be described. All TRLWE ciphertexts have degree n, Taking TIFF0007649558000011.tif1134 and a polynomial, it can be expressed as (A(X),B(X)). When this is decrypted with the private key [s'], the polynomial of the private key is Put it as TIFF0007649558000012.tif636, It can be expanded as TIFF0007649558000013.tif7116.

[0046] For this, the following calculation is carried out: I get TIFF0007649558000014.tif82136. Since it is a "modulus ring of a polynomial ring", (X n +1), we get the remainder The result is TIFF0007649558000015.tif18156.

[0047] moreover, If you put TIFF0007649558000016.tif1046, The file becomes TIFF0007649558000017.tif38143. The coefficients of each term of the plaintext polynomial can be found from TIFF0007649558000018.tif776. Of these, what we need is the coefficient of the constant term, so if we extract the coefficient for j=0, we get The result is TIFF0007649558000019.tif638. If you put TIFF0007649558000020.tif620, It can be transformed into a TLWE cipher decryption function, such as TIFF0007649558000021.tif8114.

[0048] In other words, the TRLWE ciphertext A obtained by BlindRotate in (1) n =(A(X),B(X)), the coefficients are When extracted as TIFF0007649558000022.tif1055, the original TRLWE ciphertext A n A new TLWE ciphertext ([a”], b1) is obtained, whose plaintext is the same as the constant term of the plaintext polynomial corresponding to a. This new TLWE ciphertext is the output of SampleExtract, and has two plaintexts: -μ or μ. The obtained TLWE ciphertext is added to the trivial ciphertext ([0],μ) whose plaintext is μ to obtain the TLWE ciphertext cs=([a”],b1)+([0],μ). Specifically, since μ=1 / 8 in the polynomial F(X) serving as the test vector, ciphertexts of −1 / 8 and 1 / 8 are obtained at this stage. Adding to this the trivial TLWE ciphertext ([0],1 / 8) with plaintext μ=1 / 8 gives us -1 / 8+1 / 8=0 1 / 8+1 / 8=1 / 4 From this, a new TLWE ciphertext cs is obtained, which has one of the two plaintext values ​​0 or 1 / 4.

[0049] (3) Public Key Switching The TLWE ciphertext cs obtained by SampleExtract in (2) is encrypted with the private key [s'], not the private key [s]. Therefore, it is necessary to replace the key of the TLWE ciphertext cs with the secret key [s] without decrypting the TLWE ciphertext cs, and return it to a state encrypted with the secret key [s]. Therefore, we will explain the Public Key Switching technique. The secret key [s] of the TLWE ciphertext used in TFHE is an N-dimensional vector. This is used to encrypt the secret key [s'] of the n-th vector used when creating the Bootstrapping Key. That is, TIFF0007649558000023.tif746 and the elements of the circle group {T}, real numbers between 0 and 1, are encrypted as shifted values ​​for each digit when expressed in binary. The private key is [s]. The "number of digits" t is a system parameter. When decrypted with the private key [s], The result is TIFF0007649558000024.tif737. This is the "key switching key". As mentioned above, the TLWE ciphertext cs = ([a], b) obtained in (2) is a value of 0 or 1 / 4 encrypted with the private key [s']. The number of elements of [a] is n, the same as the private key [s']. If we convert each of these into a t-bit fixed-point number, we get It can be written in the format TIFF0007649558000025.tif735. At this stage the error increases, but the maximum absolute value can be constrained by system parameters. As part of the Public Key Switching process, the following TLWE ciphertext cx is calculated. The term TIFF0007649558000026.tif862([0],b) is a trivial ciphertext, so when decrypted it becomes b. When the result of decrypting the TLWE ciphertext cx is calculated, The file is TIFF0007649558000027.tif8118. s' i Since is a constant for j, we can factor it out as Enter TIFF0007649558000028.tif749 and substitute the formula that was decomposed into fixed decimal points above. TIFF0007649558000029.tif977As a result, The file will be TIFF0007649558000030.tif530, which means the key change was successful.

[0050] The TLWE ciphertext cx obtained here is encrypted with the same secret key [s] as the TLWE ciphertext c that was input to Gate Bootstrapping. By performing the public key switching process, the TLWE ciphertext is restored to the TLWE ciphertext encrypted with the private key [s], and s If (c) is within ±1 / 4, then the plain text φ s (cx) is 0, φ s If (c) is in the range of 1 / 2±1 / 4, then the plaintext φ s (cx) is now 1 / 4. Through the above process, the result of Gate Bootstrapping was a TLWE ciphertext that was one of two values, 0 or 1 / 4, with an error within ±1 / 16. The maximum error does not depend on the input TLWE ciphertext c, but is fixed by the system parameters. Therefore, the system parameters are set so that the maximum error value is within ±1 / 16 of the input TLWE ciphertext. This makes it possible to perform the NAND operation any number of times. The NAND operation is a complete operation in the field of logical operations. In other words, if the NAND operation can be realized, all logical operations are possible by combining it. Therefore, by expressing any numerical value in binary, all operations including addition and multiplication become possible.

[0051] The errors in the "plaintext" of the TLWE ciphertext output from Gate Bootstrapping are the error added by rounding off the TLWE ciphertext, the error added by CMux, the error when it is converted to fixed decimal by Public Key Switching, etc. All of these errors can be constrained by system parameters, and the system parameters can be adjusted so that the error taking all of these into consideration is ±1 / 16. This completes the TFHE Gate Bootstrapping process.

[0052] As described above, TFHE is a bit-wise homomorphic encryption method that has 0 or non-0 as plaintext and performs logical operations. However, as explained in Figure 4, the plaintext is a real number between 0 and 1 that is associated with the circular group {T}. Therefore, by associating integers with the intervals that divide the circular group {T} in order, it can be used as an integer-wise homomorphic encryption method that has integers as plaintext.

[0053] FIG. 6 is a diagram illustrating the TFHE applied to an integer-wise type. As shown in Figure 6, the range of values ​​from 0 to 1 associated with the circular group {T} is divided into t parts. In a TLWE ciphertext, the possible values ​​of the plaintext are the t values ​​obtained by dividing the range of values ​​0 to 1, from -(t / 2) to (t / 2)-1, and (t / 2)-1 is the maximum integer value that can be recorded in one TLWE ciphertext. As shown in FIG. 6, when t=10 and the range of 0 to 1 is divided into 10 parts, the ciphertext can express integers of -5, -4, -3, -2, -1, 0, 1, 2, 3, and 4. These integer values ​​are assigned to intervals centered on -5 / t, -4 / t, -3 / t, -2 / t, -1 / t, 0 / t, 1 / t, 2 / t, 3 / t, and 4 / t, which are obtained by dividing the range of 0 to 1 of the circular group {T} into t=10 parts. In this way, as shown in FIG. 6, it is possible to assign consecutive integers counterclockwise from the area centered on 1 / 2, which is the minimum value when expressed as an integer.

[0054] As shown in Figure 6, 0 (1) on the circular group {T} is within the range of -1 / (2t) to 1 / (2t). The position of the plaintext of the ciphertext on the circular group {T} within the range (position on the circular group {T}) can be adjusted as necessary by adding or subtracting an offset based on, for example, 1 / (2t) to the state in Figure 6. Although there is no essential difference, in the embodiment described below, the meaning of the division number t of the circle group is different from that described in FIG.

[0055] FIG. 7 is a diagram illustrating the integer-wise TFHE in this embodiment. As shown in FIG. 7, in the ciphertext of this embodiment, the entire range (0 to 1) of the circular group {T} is divided into 2t parts. Increasing the value of t and dividing the circle group {T} into smaller parts makes it possible to increase the range of integer values ​​that can be recorded in the TLWE ciphertext, but dividing it too finely results in a problem in that the error range added to the plaintext becomes too small, reducing the strength of the ciphertext. This point will be explained later. An integer value is assigned to each 1 / (2t) interval into which the circular group {T} is divided, and the possible plaintext integer values ​​of a TLWE ciphertext range from -t to t-1. t-1 is the maximum integer value that can be recorded in a single TLWE ciphertext, and -t is the minimum integer value that can be recorded in a single TLWE ciphertext. As in the case of Figure 6, Figure 7(b) shows the state where no offset is added to the plaintext (the offset to the plaintext is 0). Figure 7(a) shows the state where an offset of, for example, +1 / (4t) is added to the plaintext of the ciphertext shown in Figure 7(b). By adding an offset, it is possible to change the slicing of the circle group {T}. In the following description, the right and left halves of the circle group are assumed to conform to the state shown in FIG. 7(a) to which an offset of 1 / (4t) has been applied. For example, if the circular group is expressed as 0 to 1, then 0 to 0.5 is the right half plane, and 0.5 to 1 is the left half plane. Similarly, if the circular group is expressed as -0.5 to 0.5, then -0.5 to 0 is the left half plane, and 0 to 0.5 is the right half plane. These expressions are just differences in how the coordinates on the circular group are expressed, and there is no essential difference. In addition, since addition and subtraction on a circular group have directions, in this embodiment, the counterclockwise direction is assumed to be the positive (plus) direction, and the clockwise direction is assumed to be the negative (minus) direction. In other words, the result of adding 0.25 to an element on a circular group indicates the element at a point moved 1 / 4 of a circle counterclockwise from the original element. The same is true for subtraction. This convention is used for illustrating the above-mentioned concepts of left and right half faces, and the exact same discussion applies regardless of which direction is actually the positive direction.

[0056] In the state where no offset is added, as shown in FIG. 7(b), 0(1) on the circle group {T} is within a slice of -1 / (4t) to 1 / (4t) (the noise added to the plaintext before and after the 0 is one slice). By adding an offset, as shown in Figure 7(a), the integer 0 can be associated with the slice (0 / (2t)) on the circular group {T} that starts with 0. The other slices start with X / (2t) (X is a plaintext integer). Since 0 on the circular group {T} corresponds to refer to the degree 0 term of the test vector polynomial used when processing using bootstrapping, adding an offset in this way has the advantage of making the order of the coefficients more natural and easier to read. In Fig. 7(a), the plaintext with the offset is located in the center of each slice (e.g., the slice starting from 3 / (2t)) within the error range of ±1 / (4t). In this case, the mean of the normal distribution is, for example, 3 / (2t)+1 / (4t), and in most cases it is distributed within the error range of ±1 / (4t), so that the plaintext is distributed in the center of the slice starting from 3 / (2t). In Fig. 7(a), the plaintext with an offset is shown only for the slice 3 / (2t), but this is merely an example, and all slices have plaintext with an offset added to the starting value. The same is true for Fig. 8.

[0057] The ciphertext in Figure 7(a) is obtained by dividing the right half of the circular group {T} into t pieces and the left half into t pieces. The right half of the circular group {T} corresponds to 0 and positive plaintext integers (0 to t-1), and the left half corresponds to negative plaintext integers (-1 to -t). The width of one block (slice) is 1 / (2t). Integer values ​​are assigned to 2t slices of the range 0 to 1 (-1 / 2 to 1 / 2) of the circle group {T}, starting from -t / (2t) to (t-1) / (2t). Non-negative integers are assigned to slices starting at 0 / (2t), 1 / (2t), …, (t-3) / (2t), (t-2) / (2t), (t-1) / (2t) in the right-plane, while negative integers are assigned to slices starting at -t / (2t), -(t-1) / (2t), -(t-2) / (2t) …, -1 / (2t) in the left-plane. These slices are centered on the starting value with an offset of +1 / (4t). The 1 / (4t) offset is equivalent to half the slice width of 1 / (2t). If the 1 / (4t) offset is expressed as an integer, it can be conveniently expressed as an offset of +0.5.

[0058] As shown in Figure 7(a), when the range of the circular group is divided into 8 parts with 2t=8 (t=4), the right half of the circular group {T} can represent integers from 0 to 3 (=t-1), and the left half can represent integers from -4 (=-t) to -1. In other words, the entire ciphertext can represent integers -4, -3, -2, -1, 0, 1, 2, and 3. These integer values ​​are assigned to the intervals that divide the range of the circle group {T} into 2t = 8 intervals, starting with -4 / (2t), -3 / (2t), -2 / (2t), -1 / (2t), 0 / (2t), 1 / (2t), 2 / (2t), and 3 / (2t). Integers are assigned counterclockwise from the range starting with 1 / 2. Note that, taking the above offset of 0.5 into account, a slice on the right side starting at, say, 1 / (2t) is a slice centered at 1.5 / (2t), and a slice on the left side starting at, say, -4 / (2t) is a slice centered at -3.5 / (2t). The integers expressed with the offset included are, counterclockwise from the top, -3.5, -2.5, -1.5, -0.5, 0.5, 1.5, 2.5, and 3.5.

[0059] The cryptographic processing device 1 sets system parameters for TFHE so that the error range added to the plaintext in the ciphertext obtained after Gate Bootstrapping is less than ±1 / (4t). Suppose there are TLWE ciphertexts ca and cb that perform addition. The TLWE ciphertexts ca and cb are TLWE ciphertexts having the structure shown in FIG. 7(a), in which the right half plane is divided into t pieces and the entire circle group {T} is divided into 2t pieces. In this embodiment, in each of the TLWE ciphertext ca and the TLWE ciphertext cb, the right half plane of the circle group {T} corresponds to plaintexts that are non-negative integers, and the left half plane corresponds to plaintexts that are negative integers. The TLWE ciphertext ca has as plaintext the real number a / (2t)+1 / (4t) corresponding to the integer a, which cannot be known without the private key. The TLWE ciphertext cb has as plaintext the real number b / (2t)+1 / (4t) corresponding to the integer b, which cannot be known without the secret key. These are plaintexts without any errors, and in reality, values ​​with errors within the above range are stored as plaintexts. The plaintexts of the TLWE ciphertexts ca and cb are a / (2t) and b / (2t) because the entire circular group is divided into 2t parts. As explained above, the +1 / (4t) offset added to the plaintext aligns the slice of the circular group starting from 0 with the integer 0, and positions the plaintext in the center of the slice.

[0060] As explained with reference to FIG. 7(a), in the TLWE ciphertext ca and the TLWE ciphertext cb, offsets a / (2t)+1 / (4t) and b / (2t)+1 / (4t) are added to the plaintext. The offset value 1 / (4t) is an example and is not limited to this, but the polynomial and parameters must be adjusted depending on the offset value.

[0061] In FIG. 7(a), on the left half of the circle group {T}, which handles negative integers, the integers -t to -1 are expressed counterclockwise from the top using slices starting from -t / (2t) to -1 / (2t). On the right half of the circle group {T}, which deals with 0 and positive integers (non-negative integers), the integers 0 to t-1 are represented counterclockwise from the bottom using slices starting from 0 / (2t) to t-1 / (2t).

[0062] This embodiment relates to a comparison operation of ciphertexts using integer-wise TFHE. When implementing unencrypted integer comparisons on a CPU, the actual comparison instruction is often a subtraction that discards the result. This is because executing a subtraction instruction changes the flags register according to the result. If the subtraction result flag indicates that the result is 0, then the previous subtraction showed that the two values ​​were equal. By looking at flags such as overflow and carry, it is possible to determine which value was greater in the comparison. To do the same thing with integer-wise TFHE, one possible method would be to perform homomorphic subtraction on two TLWE ciphertexts and determine where the resulting TLWE ciphertext plaintext is located on the circle group {T}. By using an appropriate LUT after homomorphic subtraction, it is possible to obtain a value equivalent to the flag register.

[0063] If only the right half plane of the circular group {T} (for example, 0 to 0.5) is used, that is, if only non-negative integers are handled, then if the plaintext ca-cb, the result of homomorphic subtraction between ciphertexts, is in the interval of the right half plane of the circular group {T}, then no carry-over occurs and φ(ca) ≧ φ(cb). Conversely, if the plaintext of the homomorphic subtraction result ca-cb is in the left half-plane of the circle group {T} (for example, 0.5 to 1.0), then the subtraction result is negative, and φ(ca)<φ(cb). Similarly, in the case of comparison operations used for carry, if homomorphic addition is performed on TLWE ciphertexts that constitute one division unit of a multiple-precision integer, and the plaintext of the homomorphic addition result ca+cb is in the interval of the right half plane of the circle group {T}, then no carry has occurred. Conversely, if the plaintext of the homomorphic addition result ca+cb is in the interval of the left half-plane of the circle group, a carry has occurred.

[0064] However, if the entire circle group (for example, 0 to 1.0) is used in order to make the most of the circle group, the following problems arise. If the entire circle group is divided into 2t slices and associated with integers from 0 to 2t-1, suppose the plaintext of homomorphic addition of ciphertexts ca+cb is an integer representation of 3. From this result alone, it is not possible to determine whether the result became 3 without a carry because 0+3 was calculated in the homomorphic addition of ciphertexts, or whether a carry occurred and the result became 3 as a result of adding t+1 and t+2 to get 2t+3.

[0065] If we map the entire circle group {T} (for example, 0 to 1.0) to integers from -t to t-1, it becomes even more complicated because it includes negative numbers. Suppose the plaintext of the homomorphic addition of ciphertexts ca+cb is -2 in integer representation. From this result alone, it is not possible to determine whether the result was -2 without a carry because 0+(-2) was calculated in the homomorphic addition of ciphertexts, or whether the result was -2 because a carry occurred as a result of calculating (t-1)+(t-1), which resulted in 2t-2. Also, (-t)+(-t) gives -2t, and even though it is an addition, a carry can occur. Therefore, when the entire circle group {T} is associated with integers, there are three possibilities: a carry has occurred, a carry has occurred, or neither a carry has occurred. Therefore, when performing addition and subtraction in multiple precision, appropriate processing must be performed for all patterns.

[0066] Below, a comparison operation of ciphertexts using integer-wise TFHE will be described. In the following explanation, we will explain the case of performing homomorphic addition ca+cb corresponding to plaintext a+b. However, by inverting the value (sign) of plaintext b in TLWE ciphertext cb in advance, homomorphic subtraction corresponding to plaintext ab can also be performed in the same way. The carry and borrow information in the homomorphic addition ca+cb corresponding to the plaintext a+b can be used as the result of a comparison operation between the plaintext a and the plaintext b, i.e., the ciphertext ca and the ciphertext cb. The cryptographic processing device 1 of this embodiment adds the trivial ciphertext of the plaintext polynomial to the TRLWE ciphertext, which is the output of BlindRotate, and then performs BlindRotate again to calculate, as a result of the comparison operation, ciphertexts corresponding to the presence or absence of a carry and the presence or absence of a carry-over.

[0067] The following [First Example] and [Second Example] explain a comparison between TLWE ciphertexts that constitute one division unit of multiple-precision arithmetic. [First Example] The following description will be given with reference to FIG. First, the cryptographic processing device 1 inputs the TLWE ciphertext ca that has been accepted as input to the first calculation unit 12, and performs a homomorphic operation to homomorphically add a trivial ciphertext (0, 1 / (4t)) having 1 / (4t) as plaintext to the TLWE ciphertext -ca, which is the sign-inverted version of the TLWE ciphertext ca, to obtain a new ciphertext ca' corresponding to -ca+(0, 1 / (4t)). The cryptographic processing device 1 inputs the TLWE ciphertext ca' to the first bootstrap unit 41, and derives a polynomial F1(X) with all coefficients of 1 / 16 for the ciphertext ca'. Perform BlindRotate using TIFF0007649558000031.tif833 as the test vector polynomial to obtain the TRLWE ciphertext r1.

[0068] Next, the cryptographic processing device 1 inputs the TRLWE ciphertext r1 to the second calculation unit 13, and performs homomorphic subtraction of a trivial ciphertext (0, F1(X)) with the polynomial F1(X) as plaintext from the TRLWE ciphertext r1 to obtain a new TRLWE ciphertext r1' corresponding to r1-(0, F1(X)). The cryptographic processing device 1 inputs the TLWE ciphertext ca and TLWE ciphertext cb to the third arithmetic unit 14, performs homomorphic addition on the TLWE ciphertext ca and TLWE ciphertext cb, and further performs homomorphic subtraction on the trivial ciphertext (0,1 / (4t)) to obtain a new TLWE ciphertext cc corresponding to ca+cb-(0,1 / (4t)). The reason for subtracting the trivial ciphertext (0,1 / (4t)) here is that the TLWE ciphertext ca and TLWE ciphertext cb each have an offset equivalent to 0.5 in integer precision (1 / (4t) on the circle group {T}), and a constant term is needed to eliminate this. The cryptographic processing device 1 inputs the TLWE ciphertext cc to the second Bootstrapping unit 42, and performs BlindRotate on the TLWE ciphertext cc using the TRLWE ciphertext r1' as a test vector polynomial to obtain a TRLWE ciphertext r2. Furthermore, the cryptographic processing device 1 performs SampleExtract on the TRLWE ciphertext r2 at position 0 to extract the coefficient of the 0th order term (constant term) to obtain a ciphertext c3. In some cases, it is not necessary to perform homomorphic computation between the TLWE ciphertext ca and the TLWE ciphertext cb by the third computation unit 14, and it is sufficient to use a TLWE ciphertext cc having the same plaintext as the TLWE ciphertext ca. In this case, the BlindRotate performed by the second Bootstrapping unit 42 on the TLWE ciphertext cc can be regarded as the BlindRotate performed on the TLWE ciphertext ca.

[0069] 8 to 12 are diagrams for explaining ciphertexts representing the results of addition of ciphertexts. In this embodiment, the range of the circle group {T} is 0 to 1, and non-negative integers are assigned to the right half plane with a boundary of 0.5 (1 / 2), and negative integers are assigned to the left half plane. In the following explanation, the interval of the right half plane of the circle group {T} is in the range of 0 to 0.5, and the interval of the left half plane is in the range of 0.5 to 1. The range of the circle group {T} need not be 0 to 1, but may be -0.25 to 0.75 or -0.5 to 0.5, for example.

[0070] FIG. 8 shows what plaintext is obtained as the above TLWE ciphertext c3 for what value of plaintext a+b when plaintext a of TLWE ciphertext ca is a non-negative integer (a≧0). If the plaintext a of the TLWE ciphertext ca (whose value in the circular group {T} is a / (2t)) is a non-negative integer, then the plaintext a lies in the interval of the right half-plane of the circular group {T}, as shown in Figure 8. A carry occurs when the plaintext a+b of the ciphertext ca+cb obtained by homomorphically adding the ciphertext cb to such a TLWE ciphertext ca on the cycle group {T} becomes a large value that exceeds 0.5 on the cycle group {T} in a counterclockwise direction and reaches the left half plane, causing a carry. In that case, as shown in Figure 8, the plaintext φ(c3) of the TLWE ciphertext c3 becomes 1 / 8. If the plaintext a is on the right half-plane of the circle group {T}, then φ(ca+cb), i.e., the plaintext a+b, will never exceed the boundary of 0.5+a / (2t) in either the clockwise or counterclockwise direction. This is because the plaintext a+b will always be within the range of ±0.5 when a / (2t) is taken as the base. Therefore, even if there is a carryover, no matter how large the value of the plaintext b is, the plaintext φ(c3) of the TLWE ciphertext c3 will never become 0.

[0071] FIG. 9 is a diagram showing what plaintext is obtained as the above TLWE ciphertext c3 when the plaintext a of the TLWE ciphertext ca is a negative integer (a<0) and what value of plaintext a+b is given. If the plaintext a of the TLWE ciphertext ca (whose value in the circular group {T} is a / (2t)) is a negative integer, then the plaintext a lies in the interval on the left half plane of the circular group {T}, as shown in Figure 9. A carry-down occurs when the plaintext a+b of the ciphertext ca+cb obtained by homomorphically adding the TLWE ciphertext cb to such a TLWE ciphertext ca on the cycle group {T} becomes a small value clockwise that exceeds 0.5 on the cycle group {T} and reaches the right half plane. In that case, as shown in Figure 9, the plaintext φ(c3) of the TLWE ciphertext c3 becomes -1 / 8. If the plaintext a is in the interval of the left half plane of the circle group {T}, then φ(ca+cb), i.e., the plaintext a+b, will not exceed the boundary of 0.5+a / (2t) in either the clockwise or counterclockwise direction. This is because the plaintext a+b will always be within the range of ±0.5 when a / (2t) is used as the base. Therefore, no matter how small the value of the plaintext b is when there is a carryover, the plaintext φ(c3) of the TLWE ciphertext c3 will never become 0.

[0072] Combining FIG. 8 and FIG. 9, the plaintext φ(c3) of the TLWE ciphertext c3 has a value of either 0 or ±1 / 8. If the plaintext a is in the interval of the right half plane of the circle group {T} and a+b is carried over, the plaintext φ(c3) of the TLWE ciphertext c3 is 1 / 8, and if it is not carried over, the plaintext φ(c3) of the TLWE ciphertext c3 is 0 or -1 / 8. On the other hand, if the plaintext a is in the interval on the left half plane of the circle group {T} and a+b is carried down, the plaintext φ(c3) of the TLWE ciphertext c3 will be -1 / 8, and if there is no carry down, the plaintext φ(c3) of the TLWE ciphertext c3 will be 0 or 1 / 8. In other words, when the plaintext φ(c3) of the TLWE ciphertext c3 is 0, a carry-up occurs to a+b, and no carry-down occurs. However, when it is -1 / 8 or 1 / 8, the presence or absence of a carry-up or carry-down depends on whether the plaintext a is negative or not. However, the value of the plaintext a cannot be known unless the TLWE ciphertext ca is decrypted. Therefore, with only the TLWE ciphertext c3, it is not possible to determine whether the plaintext a is in the interval on the right half plane of the circular group {T} or in the interval on the left half plane of the circular group {T}, that is, whether a+b is carried up or down. Therefore, a ciphertext is required that indicates whether the plaintext a is in the interval of the right half-plane of the circular group {T} or in the interval of the left half-plane of the circular group {T}.

[0073] Referring again to Figure 2, the cryptographic processing device 1 inputs the TRLWE ciphertext r1 to the first Bootstrapping unit 41, and performs SampleExtract on the TRLWE ciphertext r1 at position n-1 (the n-1th term, i.e., the highest term) on the circular group {T} to obtain a TLWE ciphertext c2. The TLWE ciphertext c2 is a ciphertext extracted from the TRLWE ciphertext r1 obtained by BlindRotating the above F1(X), all of whose coefficients are 1 / 16, using -ca, and is therefore a ciphertext obtained by rotating the above polynomial F1(X) by -a in the direction of a lower degree. In other words, the TLWE ciphertext c2 is obtained by rotating the above polynomial F1(X) by a in the direction of a higher degree. When plaintext integer a ≧ 0, that is, when the plaintext φ(ca) of the TLWE ciphertext ca is located in the interval of the right half plane of the circular group, the TLWE ciphertext c2 is the plaintext, which is 1 / 16, the coefficient of F1(X). If the plaintext integer a<0, that is, φ(ca) is located in the interval of the left half plane of the circular group, the TLWE ciphertext c2 is -1 / 16, which is the inverted sign of the coefficient 1 / 16 of F1(X). Such a TLWE ciphertext c2 is a ciphertext that contains as plaintext information whether the plaintext a of the TLWE ciphertext ca is in the interval of the right half-plane of the circular group {T} or in the interval of the left half-plane of the circular group {T}.

[0074] The cryptographic processing device 1 inputs the TLWE ciphertexts c2 and c3 to the fourth calculation unit 15, and calculates c3+2×c2 to obtain the TLWE ciphertext c4. This can be performed by normal homomorphic scalar multiplication and homomorphic addition. When the plaintext a of the TLWE ciphertext ca is in the interval of the left half plane of the cycle group {T}, the plaintext of the TLWE ciphertext c2 is -1 / 16, and the plaintext of the TLWE ciphertext c3 is -1 / 8, 0, or 1 / 8, so the plaintext of the TLWE ciphertext c4 is either 0, -1 / 8, or -1 / 4, which is obtained by adding (-1 / 16) x 2 = -1 / 8 to the plaintext of c3. In the TLWE ciphertext c4, the value of the plaintext of the TLWE ciphertext c3 is shifted by 1 / 8 in the negative direction of the cycle group {T}. Therefore, the plaintext φ(c4) of the TLWE ciphertext c4 is -1 / 4 only when the plaintext a is in the interval of the left half plane of the cycle group {T} and there is a carry. When plaintext a is in the interval of the right half plane of the cycle group {T}, the plaintext of TLWE ciphertext c2 is 1 / 16, and the plaintext of TLWE ciphertext c3 is either -1 / 8, 0, or 1 / 8, so the plaintext of TLWE ciphertext c4 is either 0, 1 / 8, or 1 / 4, which is obtained by adding (1 / 16) x 2 = 1 / 8 to the plaintext of c3. In TLWE ciphertext c4, the value of the plaintext of TLWE ciphertext c3 is shifted by 1 / 8 in the positive direction of the cycle group {T}. Therefore, φ(c4) is 1 / 4 only when plaintext a is in the interval of the right half plane of the cycle group {T} and there is a carry. If plaintext a is in the interval of the right half plane of the circle group {T} and is an integer 0, then no carry-over or carry-down occurs; conversely, if plaintext a is in the interval of the left half plane of the circle group {T}, then no carry-over occurs; and if plaintext a is in the interval of the right half plane of the circle group {T}, then no carry-down occurs.

[0075] Therefore, when the plaintext φ(c4) of the TLWE ciphertext c4 is 1 / 4, a carry occurs, and when the plaintext φ(c4) of the TLWE ciphertext c4 is -1 / 4, a carry occurs. The TLWE ciphertext c4 is a ciphertext in which the presence or absence of a carry-over or the presence or absence of a carry-down can be determined based on the value of the plaintext φ(c4). In other words, it can be said that it is possible to determine, based on only the TLWE ciphertext c4, whether a carry has occurred, a carry has occurred, or neither has occurred as a result of the homomorphic addition ca+cb.

[0076] The cryptographic processing device 1 inputs the TLWE ciphertext c4 to the third bootstrap unit 43, and calculates the following polynomial F1'(X) for the TLWE ciphertext c4. Perform BlindRotate using TIFF0007649558000032.tif939 as the test vector polynomial to obtain the TRLWE ciphertext r3. The cryptographic processing device 1 performs SampleExtract on the TRLWE ciphertext r3 at multiple points (two points, 2n×5 / 16 and 2n×3 / 16) on the circle group {T} to extract the TLWE ciphertexts cd and ce. The cryptographic processing device 1 then performs homomorphic addition of a trivial ciphertext (0,1 / (2t)) with 1 / (2t) as plaintext to the ciphertexts cd and ce. The TLWE ciphertext c5 is obtained by adding (0,1 / (2t)) to the TLWE ciphertext cd extracted by SampleExtract with 2n×5 / 16. The TLWE ciphertext c6 is obtained by adding (0,1 / (2t)) to the TLWE ciphertext ce extracted by SampleExtract at 2n×3 / 16.

[0077] The cryptographic processing device 1 simultaneously performs a comparison with 1 / 4 (whether or not there is a carry-over) and a comparison with -1 / 4 (whether or not there is a carry-down) to calculate a TLWE ciphertext c5 and a TLWE ciphertext c6. The TLWE ciphertext c5 is a ciphertext whose plaintext φ(c5) is 1 / (4t) (0 as an integer) if there is a carry (the plaintext of the TLWE ciphertext c4 is 1 / 4), and is 1 / (2t)+1 / (4t) (1 as an integer) if the plaintext of the TLWE ciphertext c4 without a carry is -1 / 4. The TLWE ciphertext c6 is a ciphertext in which the plaintext φ(c6) becomes 1 / (4t) (the integer 0) when there is a carry, and becomes 1 / (2t)+1 / (4t) (the integer 1) when there is no carry. Through the above process, a TLWE ciphertext c5 that represents the presence or absence of a carry-over in binary form, and a TLWE ciphertext c6 that represents the presence or absence of a carry-down in binary form are obtained.

[0078] By changing the coefficients of the polynomial F1'(X) used in BlindRotate, adjusting the trivial plaintext as an offset to the ciphertext after SampleExtract, or performing additional operations on the TLWE ciphertext c5 and the TLWE ciphertext c6, it is possible to convert the ciphertext into any binary ciphertext suitable for the application. When simply comparing two ciphertexts, TLWE ciphertext ca and TLWE ciphertext cb, it is possible to determine which of the TLWE ciphertext ca and the TLWE ciphertext cb is larger by performing the above calculation on the TLWE ciphertext ca and the TLWE ciphertext cb, which is the plaintext b with the sign inverted to make it -b.

[0079] [Example 2] Next, referring to Fig. 3, we consider a case where a ciphertext (result of addition and subtraction) corresponding to the plaintext a+b itself is obtained at the same time as a ciphertext having information as a carry-up and carry-down flag as [Example 2]. This is particularly applicable to multiple-precision arithmetic. [Example 2] differs from [Example 1] only in the constants used. In [Example 1], homomorphic addition of ca+cb is performed, and this can be used as is. However, in order to perform multiple operations, it is necessary to reduce errors along the way, for example by bootstrapping using a step polynomial. However, when using the entire circle group, simply bootstrapping with a step polynomial does not return the original value in the case of negative values. Therefore, the polynomial F id This requires bootstrapping to be performed twice. The two bootstraps are the first bootstrap to flip the values ​​of the left half-face of the circle group {T}, which handles negative numbers, described below, upside down, and the second bootstrap to return the flipped left half-face to its original state.

[0080] polynomial F id This article explains Bootstrapping using . The cryptographic processing device 1 is a one-variable polynomial function (one-variable function) Fid (X) Using TIFF0007649558000033.tif1163, we perform bootstrap (first time) on the TLWE ciphertext ca to calculate the TLWE ciphertext ca1 shown in Figure 10, in which the values ​​(corresponding integer values) on the left half-plane of the circular group {T}, which handles negative numbers, are flipped upside down. Gate Bootstrapping includes BlindRotate, SampleExtract, and Public Key Switching. To calculate a one-variable function on an encrypted integer value, a method that extends the Gate Bootstrapping method described in the above paper (Non-Patent Document 1) can be used. This method is described in the paper "Bootstrapping in FHEW-like Cryptosystems, Daniele Micciancio and Yuriy Polyakov Duality Technologies February 23, 2020." In the disclosed method, the coefficient of the test vector is not set to a constant μ, but rather the result of the function is set to obtain a different result depending on the value of the TLWE ciphertext.

[0081] Figure 10 shows which integer value in the circle group {T} corresponds to the plaintext of the TLWE ciphertext ca1 in the original TLWE ciphertext ca, or which integer value corresponds to which plaintext of the TLWE ciphertext ca in the circle group {T} in the TLWE ciphertext ca1. As shown in Figure 10, the polynomial F id As a result of bootstrapping using TLWE, the order of the left half of the ciphertext ca1, which is the area used for negative numbers, is reversed upside down from that of the TLWE ciphertext ca. polynomial F id For an input of a ciphertext of a non-negative integer 0 to t-1, the polynomial F outputs a ciphertext of the same non-negative integer 0 to t-1, and adds an offset of 0.5 to the plaintext. id For input of a ciphertext of a negative integer -t to -1, it outputs a ciphertext of integers -1 to -t, and adds an offset of 0.5 to the plaintext integer. As shown in Figure 7, the width of the slice that one integer in the TLWE ciphertext ca corresponds to is 1 / (2t), and adding an offset of 0.5 to the plaintext integer a in the TLWE ciphertext ca1 is equivalent to adding an offset of 1 / (4t) to the plaintext real number a / (2t), etc. The offset part of +1 / (4t) for the plaintext is included in the integer representation and expressed as +0.5.

[0082] In Figure 7(a), if the plaintext is in the interval of the right half plane of the circle group {T} (if the plaintext is a non-negative number), then the polynomial F id As a result of the above process using the above, the plaintext integer of the TLWE ciphertext ca1 remains within the same slice (area) of the circular group {T} as shown in Fig. 10. On the other hand, if the plaintext is a negative number -t to -1 and is in the interval on the left half plane of the circular group {T}, the plaintext integer of the TLWE ciphertext ca1 will be upside down in the circular group {T} as shown in Fig. 10 as a result of the above process. For example, as shown in FIG. 7, when the plaintext integer a in the TLWE ciphertext ca is -1, its value on the circle group {T} is in the range of -1 / (2t) to 0. Therefore, the polynomial F id The most significant block of the term is inverted and appears at the lowest position. Therefore, the plaintext of the TLWE ciphertext ca1 after the first bootstrap is -1 / 2+1 / (4t) as a value on the circle group {T}, and -t as an integer.

[0083] If the plaintext integer a in the TLWE ciphertext ca1 is -t, then its value on the circle group {T} is -t / (2t)+1 / (4t)=-1 / 2+1 / (4t), which is in the block closest to -1 / 2. id Since the sign-negated term of the lowest block of is obtained as the TLWE ciphertext ca1 after bootstrapping (first time), the plaintext of the TLWE ciphertext ca1 is -1 / (4t) as a value on the circle group {T}, or -1 as an integer.

[0084] In the right half of Figure 7, integers from 0 to t-1 are assigned to slices from 0 / (2t) to 4 / (2t) counterclockwise from the bottom, and the order of plaintext integers is the same as in Figure 7(a). On the other hand, on the left half, integers from -1 to -t are assigned to slices from -t / (2t) to -1 / (2t) in a counterclockwise direction from the top, reversing the order from that in FIG. 7(a). 10, the integers, from the top of the circular group {T}, are -1, -2, -3, -4, 0, 1, 2, and 3. Positive and negative values ​​are lined up consecutively in the circular group {T}.

[0085] In FIG. 7(a), for example, if the TLWE ciphertext ca is a ciphertext of -1, the plaintext is in the interval -1 / (2t)~0 on the circle group {T}. As a result of the above process, in the TLWE ciphertext ca1, the polynomial F id The most significant block of the term appears at the lowest position with its sign inverted. Therefore, in Fig. 7, the plaintext of the TLWE ciphertext ca is -1 / 2+1 / (4t) as a value on the circle group {T}. In Fig. 7(a), this plaintext corresponds to the integer -t (=-4), but in the ciphertext ca1 shown in Fig. 10, the original -1 is assigned as the plaintext integer. In Figure 7(a), for example, if the TLWE ciphertext ca is a ciphertext of -t, the plaintext is distributed around -t / (2t)+1 / (4t) on the circular group {T} (a value slightly larger than -1 / 2), so the plaintext is in the section on the circular group {T} closest to -1 / 2. As a result of the above process, in the TLWE ciphertext ca1, the polynomial F id The term in the lowest block of appears with its sign inverted. Therefore, in Fig. 10, the plaintext of the TLWE ciphertext ca is -1 / (2t)+1 / (4t) as a value on the circle group {T}. This plaintext corresponds to the integer -1 in Fig. 7(a), but in the ciphertext ca1 shown in Fig. 10, -t (=-4) is assigned as the plaintext integer of the original ciphertext ca. In this way, the test vector polynomial F id If the integer values ​​assigned before and after bootstrapping by (X) are the same, it can be interpreted that the order of the integer values ​​on the left half of the TLWE ciphertext ca1 is reversed.

[0086] In general, the plaintext of TLWE ciphertext ca, whose plaintext is a non-negative number, becomes a / (2t)+1 / (4t) in TLWE ciphertext ca1, and the plaintext integer remains a. In contrast, the plaintext of the TLWE ciphertext ca, whose plaintext is a negative number, is -(t+1+a) / (2t)+1 / (4t) in the TLWE ciphertext ca1. If we look at only the numerator of the plaintext, if the plaintext integer a is -1, then -(t+1+a)=-{t+1+(-1)}=-t, and if the plaintext integer a is -t, then -(t+1+a)=-{t+1+(-t)}=-1. We can confirm that this matches when the plaintext of the TLWE ciphertext cb is considered as an integer.

[0087] As a result of this process, an offset is added to the plaintext by the 1 / (4t) term added to the polynomial term, so that the slice boundaries in the TLWE ciphertext ca1 in Figure 10 are the positions of 0 in the circle group, just like in the TLWE ciphertext ca in Figure 7. In this way, when the plaintext is a negative number, the plaintext to which integers are assigned changes. In other words, if the plaintext of TLWE ciphertext ca1 is viewed as an integer symbol with the same value as the integer of ciphertext ca, the correspondence between the plaintext slices and integers of TLWE ciphertext ca1 is different from that of TLWE ciphertext ca. When looking at this correspondence, the order of the plaintext itself in the circle group does not change between TLWE ciphertext ca and TLWE ciphertext ca1, but in the left half where negative numbers are assigned, the order of the plaintext integers assigned to the plaintext is reversed. Since the order is simply reversed, the test vector polynomial F id By performing bootstrapping twice with (X), the representation returns to the original order. In other words, when the plaintext is viewed as a value on the circle group {T}, it returns to the same slice. However, since the error added to the plaintext is sufficiently reduced by the nature of bootstrapping, this process can be used as bootstrapping when using the entire circle group.

[0088] In Figure 10, where t = 4 (2t = 8), the above-mentioned offset of 0.5 is added to the plaintext of the ciphertext, so the plaintexts located in the center of the slice are, going left (counterclockwise) from the top (1 / 2) of the circle group {T}, -3.5 / (2t), -2.5 / (2t), -1.5 / (2t), -0.5 / (2t), 0.5 / (2t), 1.5 / (2t), 2.5 / (2t), and 3.5 / (2t). These slices are assigned the plaintext integers -1, -2, -3, -4, 0, 1, 2, and 3 in counterclockwise order as the plaintext integers of the ciphertext ca that was used to generate the TLWE ciphertext ca1. The integers represented with an offset of 0.5 are -0.5, -1.5, -2.5, -3.5, 0.5, 1.5, 2.5, and 3.5, starting from the top of the circle group {T}.

[0089] In [Example 2], a method called manyLUT is introduced to id The first Bootstrapping by is incorporated into the comparison operation to reduce the number of BlindRotate operations. "manyLUT" is a process that uses a common TLWE ciphertext to perform BlindRotate (referencing different lookup tables) for different test vector polynomials. As in [Example 1], the cryptographic processing device 1 inputs a TLWE ciphertext ca to the first calculation unit 12, and performs homomorphic addition of a trivial ciphertext having 1 / (4t) as plaintext to the inverted TLWE ciphertext ca, resulting in a TLWE ciphertext ca' corresponding to -ca+(0,1 / (4t)). The cryptographic processing device 1 inputs the TLWE ciphertext ca' to the first bootstrap 41, and calculates the following polynomial F2(X) for the ciphertext ca'. Perform BlindRotate using TIFF0007649558000034.tif1039 as the test vector polynomial to obtain the TRLWE ciphertext r11. However, while normally each element of the TLWE ciphertext ca' is multiplied by 2n and rounded off, this is done by multiplying it by 2n and then rounding off the bit above it so that the least significant bit becomes 0. This is the normal process performed by manyLUT, and is a process that ensures that at least the even / odd degree does not change when each term of the plaintext polynomial rotates before and after BlindRotate. Unlike the polynomial F1(X) in [Example 1], the coefficients of odd degrees in the polynomial F2(X) are 0, and the polynomial has no odd-degree terms. This is because the value of the exponent part is changed depending on whether it is even or odd in order to perform manyLUT.

[0090] The cryptographic processing device 1 inputs the TRLWE ciphertext r11 to the second calculation unit 13, doubles the TRLWE ciphertext r11, and further multiplies it by the following polynomial F3(X): By performing homomorphic addition on the trivial ciphertext (0, F3(X)) with TIFF0007649558000035.tif1174 as the plaintext, we obtain the TRLWE ciphertext r11' corresponding to r11 × 2 + (0, F3(X)). The cryptographic processing device 1 inputs the TLWE ciphertext ca and TLWE ciphertext cb to the third arithmetic unit 14, homomorphically adds the TLWE ciphertext cb to the TLWE ciphertext ca, and homomorphically subtracts the trivial ciphertext (0,1 / (4t)) to obtain the TLWE ciphertext cc'. The cryptographic processing device 1 inputs the ciphertext cc' to the second bootstrap unit 42, and performs BlindRotate on the ciphertext cc' using the TRLWE ciphertext r11' as the test vector polynomial to obtain the TRLWE ciphertext r2'. Here, while each coefficient is normally multiplied by 2n and rounded off, an adjustment is further made so that the least significant bit becomes 0. In other words, in summary, rounding is performed at the position where the least significant bit is obtained after multiplying by 2n. For example, after multiplying by n and rounding off, an additional multiplication by 2 may be performed. This is the normal processing performed with manyLUT. Then, the cryptographic processing device 1 performs SampleExtract on the TRLWE ciphertext r2' at position 0 to extract the coefficient of the 0th-order term (constant term) of the TRLWE ciphertext r2', thereby obtaining a TLWE ciphertext c3'. In addition, there is a case where a TLWE ciphertext cc' having the same plaintext as the TLWE ciphertext ca is used without the need for the homomorphic operation of the third operation unit 14 between the TLWE ciphertext ca and the TLWE ciphertext cb. In this case, the BlindRotate performed by the second Bootstrapping unit 42 on the TLWE ciphertext cc' can be regarded as the BlindRotate on the TLWE ciphertext ca.

[0091] As in [Example 1], the cryptographic processing device 1 adds a constant polynomial F3(X) to a TRLWE ciphertext r11, which is an output of BlindRotate by the first Bootstrapping unit 41, and then performs BlindRotate again by the second Bootstrapping unit 42. The TRLWE ciphertext r11' to which the constant polynomial F3(X) has been added has different properties for even orders and odd orders due to the many LUT being performed. In polynomial F2(X), all odd-degree coefficients are 0, so no matter how many times the coefficients are rotated by BlindRotate performed by first Bootstrapping unit 41, at the stage of TRLWE ciphertext r11, all odd-degree coefficients are 0. When constant polynomial F3(X) is added to TRLWE ciphertext r11 in TRLWE ciphertext r11', the coefficient value of the odd-degree term of polynomial F3(X) is added to the coefficient value of the odd-degree term of TRLWE ciphertext r11. The odd-order term of the TRLWE ciphertext r11' is set to the value of the odd-order coefficient of the polynomial F3(X). The coefficient added to this odd-order is the coefficient of the polynomial F id That is, the coefficients of the odd-order terms of the TRLWE ciphertext r11' are the same as the polynomial F id are the coefficients of odd-order terms of

[0092] The cryptographic processing device 1 performs BlindRotate on the odd degree of the TRLWE ciphertext r11' and BlindRotate on the even degree of the TRLWE ciphertext r11' simultaneously on the common TLWE ciphertext cc' based on ca+cb by the second Bootstrapping unit 42. id On the even degree side, the processing is performed using the even degree of the polynomial F2(X). In the polynomial F2(X), the coefficients that are set to 0 may be even-order coefficients. In that case, unlike the above, F id The polynomial F3(X) is constructed so that the coefficient of F2(X) is added to the even-order side of F2(X). In this embodiment, by setting the coefficient of either the even degree or odd degree of the test vector polynomial for performing manyLUT to 0, it is possible to ignore the influence of the first half of the BlindRotate (BlindRotate by the first Bootstrapping 41) for the degree of the one with the coefficient set to 0. This is because no matter how many times the column of 0s is rotated, there is no change. Then, by adding a test vector polynomial with a characteristic such as a stepped shape later, it is possible to obtain a result that is only influenced by the BlindRotate by ca+cb by the second half of the BlindRotate (BlindRotate by the second Bootstrapping 42). This is because in manyLUT, different calculations can be performed simultaneously using the even degree and odd degree terms.

[0093] FIG. 11 shows how the plaintext of the TLWE ciphertext c3' obtained by ca+cb is selected when the plaintext a of the TLWE ciphertext ca is a non-negative integer (a≧0) for even orders. If the plaintext a of the TLWE ciphertext ca (whose value in the circular group {T} is a / (2t)) is a non-negative integer, then the plaintext a lies in the interval of the right half-plane of the circular group {T}, as shown in Figure 11. If the plaintext a+b of the ciphertext ca+cb obtained by homomorphically adding the TLWE ciphertext cb to such a TLWE ciphertext ca on the cycle group {T} goes counterclockwise beyond 0.5 on the cycle group {T} and reaches the left half plane, a carry occurs. In that case, as shown in Figure 11, the plaintext φ(c3') of the TLWE ciphertext c3' becomes -1 / 32-1 / 8. If the plaintext a is on the right half-plane of the circle group {T}, then φ(ca+cb), i.e., the plaintext a+b, will never go beyond the boundary of 0.5+a / (2t) either clockwise or counterclockwise, so the amount of carryover will be too large and the plaintext φ(c3') of the TLWE ciphertext c3' will never become 0. This is because the plaintext a+b will always be within the range of ±0.5 when a / (2t) is taken as the base.

[0094] FIG. 12 shows how the plaintext of the TLWE ciphertext c3' obtained by ca+cb is selected when the plaintext a of the TLWE ciphertext ca is a negative integer (a<0) for even orders. If the plaintext a of the TLWE ciphertext ca (whose value in the circular group {T} is a / (2t)) is a negative integer, the plaintext a lies in the interval of the left half plane of the circular group {T}, as shown in Figure 12. When the plaintext a+b of the ciphertext ca+cb obtained by homomorphically adding the TLWE ciphertext cb to such a TLWE ciphertext ca on the cycle group {T} goes clockwise beyond 0.5 on the cycle group {T} and reaches the right half plane, a carry occurs. In that case, as shown in Figure 12, the plaintext φ(c3') of the ciphertext c3' becomes 1 / 32+1 / 8. If the plaintext a is in the interval of the left half plane of the circle group {T}, φ(ca+cb), i.e., the plaintext a+b, will not exceed 0.5+a / (2t) either clockwise or counterclockwise, so the amount of carry-down will be too large and the plaintext φ(c3') of the TLWE ciphertext c3' will not become 0. This is because the plaintext a+b will always be within the range of ±0.5 when a / (2t) is used as the base.

[0095] The possible values ​​that can be obtained as the plaintext φ(c3') of the TLWE ciphertext c3' are all combinations (four combinations, when each is positive or negative) that can be obtained by adding and subtracting 1 / 32 and 1 / 8 used in polynomials F1(X) and F3(X). The plaintext φ(c3') of the TLWE ciphertext c3' is selected from all combinations obtained by the sum of ±1 / 8 and ±1 / 32. The large number of possible values ​​means that a lot of information can be obtained from the TLWE ciphertext c3', which is important for efficient calculation.

[0096] In [Example 2], the polynomial F3 is homomorphically added (r11×2+(0,F3(X)) to the TRLWE ciphertext r11 obtained in the first BlindRotate by the first Bootstrapping unit 41 using the polynomial F2(X) as a test vector, and this is used as a substitute (the rotated side) for the trivial ciphertext consisting of the test vector polynomial in the second BlindRotate by the second Bootstrapping unit 42. If there is no homomorphic addition and subtraction by the second arithmetic unit 13, the same result can be obtained and the processing speed is faster by simply adding and subtracting the TLWE ciphertext as the amount of rotation of BlindRotate. However, in that case, if the polynomial F2(X) is a "flat polynomial" with the same values ​​for all coefficients, only two types of values ​​can be obtained. In contrast, in this embodiment, by adding polynomial F3(X) along the way, even if polynomials F2(X) and F3(X) as test vectors are both flat polynomials, four types of plaintexts can be obtained as shown in FIG. 11 and FIG. 12, respectively. In other words, when the process is BlindRotate → homomorphic addition / subtraction → BlindRotate, the result is 2 2 = 4 types of plaintext can be obtained. Furthermore, when the process is BlindRotate → homomorphic addition / subtraction → BlindRotate → homomorphic addition / subtraction → BlindRotate, even if the polynomial is flat, 2 3 =8 types, etc., of plaintext can be obtained. By repeating BlindRotate via homomorphic addition and subtraction, such as BlindRotate → homomorphic addition and subtraction → BlindRotate → homomorphic addition and subtraction → BlindRotate → homomorphic addition and subtraction → BlindRotate, it is possible to calculate a ciphertext from which more plaintext can be obtained.

[0097] The TLWE ciphertext c3' has plaintext depending on whether or not there is a carry-over or a carry-down, and is a ciphertext that can be a carry-over or a carry-down flag. However, since the value of plaintext a cannot be known unless the TLWE ciphertext ca is decrypted, it is not possible to determine from the TLWE ciphertext c3' so far whether plaintext a is in the interval of the right half plane of the circular group {T} or the interval of the left half plane of the circular group {T}. A ciphertext is needed that indicates whether plaintext a is in the interval of the right half plane of the circular group {T} or the interval of the left half plane of the circular group {T}. Returning to FIG. 3, the cryptographic processing device 1 performs SampleExtract on the TRLWE ciphertext r11 at the n-2 position by the first Bootstrapping 41, extracts the coefficient of the n-2 order term that is the most significant term among the even orders, and obtains a TLWE ciphertext c2'. The TLWE ciphertext c2' is a ciphertext extracted from the TRLWE ciphertext r11 obtained by BlindRotating the above F2(X), all of whose coefficients are -1 / 32, using -ca, and is therefore a ciphertext obtained by rotating the above polynomial F2(X) by -a in the direction of a lower degree. In other words, the TLWE ciphertext c2' is obtained by rotating the above polynomial F2(X) by a in the direction of a higher degree. When plaintext integer a ≧ 0, that is, when the plaintext φ(ca) of the TLWE ciphertext ca is located in the interval of the right half plane of the circular group, the TLWE ciphertext c2' is -1 / 32, which is the coefficient of F2(X), as it is. If the plaintext integer a<0, that is, φ(ca) is located in the interval of the left half plane of the circular group, the TLWE ciphertext c2' is 1 / 32, which is the coefficient of F2(X) with the sign inverted. Such a TLWE ciphertext c2' is a ciphertext that contains as plaintext information whether the plaintext a of the TLWE ciphertext ca is in the interval of the right half-plane of the circular group {T} or in the interval of the left half-plane of the circular group {T}.

[0098] The cryptographic processing device 1 inputs the TLWE ciphertext c2' and the TLWE ciphertext c3' to the third calculation unit 15, calculates c3'+2×c2', and obtains the TLWE ciphertext c4'. This can be achieved by normal homomorphic scalar multiplication and homomorphic addition. If the plaintext a of the TLWE ciphertext ca is in the interval of the left half plane of the cycle group {T}, the plaintext of the TLWE ciphertext c2' is 1 / 32, and if there is a carry-over at a+b, the plaintext of the TLWE ciphertext c3' is 1 / 32+1 / 8, so the plaintext of the TLWE ciphertext c4' is (1 / 32+1 / 8)+(1 / 32)×2, which is 7 / 32. In the TLWE ciphertext c4', the value of the plaintext of the TLWE ciphertext c3' is shifted by 1 / 16 in the positive direction of the cycle group {T}. Therefore, the plaintext φ(c4') of the TLWE ciphertext c4' is 7 / 32 only if the plaintext a is in the interval of the left half plane of the cycle group {T} and there is a carry-over. If the plaintext a of the TLWE ciphertext ca is in the interval of the right half plane of the cycle group {T}, the plaintext of the TLWE ciphertext c2' is -1 / 32, and if there is a carry at a+b, the plaintext of the TLWE ciphertext c3' is -1 / 32-1 / 8, so the plaintext of the TLWE ciphertext c4' is (-1 / 32-1 / 8)+(1 / 32)×2, or -7 / 32. In the TLWE ciphertext c4', the value of the plaintext of the ciphertext c3' is shifted by 1 / 16 in the negative direction of the cycle group {T}. Therefore, the plaintext φ(c4') of the TLWE ciphertext c4' is -7 / 32 only if the plaintext a is in the interval of the right half plane of the cycle group {T} and there is a carry. If plaintext a is in the interval of the right half plane of the circle group {T} and is an integer 0, then no carry-over or carry-down occurs; conversely, if plaintext a is in the interval of the left half plane of the circle group {T}, then no carry-over occurs; and if plaintext a is in the interval of the right half plane of the circle group {T}, then no carry-down occurs. Also, as described above, depending on whether the plaintext a of the TLWE ciphertext ca is in the left half-plane interval or the right half-plane interval of the circular group, the plaintext value of the ciphertext c3' shifts by 1 / 16 in the opposite direction. From the above, if there is a carry-down in the plaintext a+b, for example, the plaintext φ(c4') of the TLWE ciphertext c4' will be 7 / 32, and if there is a carry-up, the plaintext φ(c4') of the TLWE ciphertext c4' will be -7 / 32. Otherwise, it will be -5 / 32, -3 / 32, -1 / 32, 1 / 32, 3 / 32, or 5 / 32, but will never be -7 / 32 or 7 / 32. That is, the TLWE ciphertext c4' is a ciphertext in which the presence or absence of a carry-over or a carry-down due to ca+cb can be determined based on the value of the plaintext φ(c4').

[0099] Furthermore, combining Figures 11 and 12, whether the plaintext a of the TLWE ciphertext ca is in the left half-plane section of the cycle group {T} or the plaintext a is in the right half-plane section, the plaintext of the TLWE ciphertext c3' will have one of the two values ​​±1 / 32+1 / 8 if the result of a+b is in the right half-plane of the cycle group {T}, and will have one of the two values ​​±1 / 32-1 / 8 if it is in the left half-plane. Furthermore, since ±1 / 16 is added depending on the value of the plaintext a, the plaintext φ(c4') of the TLWE ciphertext c4' has a value of ±1 / 32±1 / 16+1 / 8 if a+b is in the interval of the right half-plane of the circular group {T}, and has a value of ±1 / 32±1 / 16-1 / 8 if a+b is in the interval of the left half-plane of the circular group {T}. Here, ±1 / 32±1 / 16+1 / 8 are all greater than 0, and ±1 / 32±1 / 16-1 / 8 are all less than 0. From the above, if φ(c4')>0, then a+b is in the interval of the right half-plane of the circle group {T}. Conversely, if φ(c4')<0, then a+b is in the interval of the left half-plane of the circle group {T}. In other words, the TLWE ciphertext c4' is also a ciphertext that makes it possible to determine, based on the value of the plaintext φ(c4'), whether the result of a+b exists in the interval on the right half of the circle group {T} or on the left half of the circle group {T}.

[0100] The cryptographic processing device 1 inputs the TLWE ciphertext c4' to the third bootstrapping 43, and calculates the following polynomial F2'(X) for the TLWE ciphertext c4'. Perform BlindRotate using TIFF0007649558000036.tif833 as the test vector polynomial to calculate the TRLWE ciphertext r3'.

[0101] Next, the cryptographic processing device 1 performs SampleExtract on the TRLWE ciphertext r3' at multiple points (2n×3 / 16, 2n×13 / 16, 0) of the circular group {T}, and extracts ciphertexts cd', ce', and cf. Then, the cryptographic processing device 1 inputs the ciphertexts cd', ce', and cf to the fifth arithmetic unit 16 and performs homomorphic addition of the trivial ciphertext (0,1 / (2t)) to cd', ce', and cf to calculate TLWE ciphertext c5, TLWE ciphertext c6, and TLWE ciphertext c7, respectively. The TLWE ciphertext c5 is the ciphertext obtained by adding (0,1 / (2t)) to the TLWE ciphertext cd' extracted by SampleExtract at the 2n×3 / 16 position. The TLWE ciphertext c6 is the ciphertext obtained by adding (0, 1 / (2t)) to the TLWE ciphertext ce' extracted by SampleExtract at the 2n×13 / 16 position. The TLWE ciphertext c7 is obtained by adding (0,1 / (2t)) to the TLWE ciphertext cf extracted by SampleExtract at position 0.

[0102] The ciphertext c5 is a ciphertext such that φ(c5) is 1 / (4t) (an integer 0) if there is a carry, and 1 / (2t)+1 / (4t) (an integer 1) if there is no carry. The ciphertext c6 is a ciphertext such that φ(c6) is 1 / (4t) (0 as an integer) if there is a carryover, and 1 / (2t)+1 / (4t) (1 as an integer) if there is no carryover. The ciphertext c7 is a ciphertext such that φ(c7) is 1 / (4t) (0 as an integer) if a+b is in the interval of the left half-plane of the circular group {T}, and is 1 / (2t)+1 / (4t) (1 as an integer) if a+b is in the interval of the right half-plane of the circular group {T}. By calculating the ciphertext c5, the ciphertext c6, and the ciphertext c7, the cryptographic processing device 1 simultaneously performs, in one BlindRotate, a comparison with -7 / 32 (whether there is a carry-over), a comparison with 7 / 32 (whether there is a carry-down), and a determination of whether a+b is in the right or left half of the circular group {T}.

[0103] Through the above processing, we obtain TLWE ciphertext c5, which indicates in binary form whether a carry has been carried over, TLWE ciphertext c6, which indicates in binary form whether a carry has been borrowed, and ciphertext c7, which indicates in binary form whether a+b is in the right or left half of the circular group {T}. By changing the coefficient of F2'(X) used in BlindRotate, adjusting the trivial plaintext as an offset to the ciphertext after SampleExtract, or performing additional operations on the TLWE ciphertext c5, TLWE ciphertext c6, and TLWE ciphertext c7, it is possible to convert them into any binary ciphertext suitable for the application. Furthermore, the cryptographic processing device 1 performs SampleExtract on the TRLWE ciphertext r2′ to extract the coefficients of the first-order terms, inputs the TRLWE ciphertext to the fourth bootstrap unit 42, and extracts the coefficients of the first-order terms of the polynomial F id By bootstrapping (second blind rotation) with (X) as the test vector polynomial, the TLWE ciphertext c9 is obtained. This allows us to obtain the TLWE ciphertext c9 that correctly corresponds to the plaintext φ(c9) = a + b for negative numbers without increasing the amount of additional calculations.

[0104] [Example 3] In [Example 1] and [Example 2], it has been assumed that a+b is applied to the addition of multiple-precision integers. In [Example 3], which is a modification of [Example 1], a case is considered in which the present invention is applied to subtraction in units of divided elements, which is necessary for subtraction of multiple-precision integers. Since it is possible to invert the sign of the plaintext of the TLWE ciphertext cb as a homomorphic operation, the ciphertext cb is set to the ciphertext -cb with the inverted sign. In this embodiment, an offset of 0.5 is added for the convenience of associating each slice obtained by dividing the circular group with an integer. Therefore, adjustment is required to perform homomorphic operation on the trivial ciphertext (0, 1 / (4t)) corresponding to the offset of 0.5.

[0105] The cryptographic processing device 1 performs homomorphic subtraction of the trivial ciphertext (0, 1 / (4t)) on the ciphertext -ca obtained by inverting the ciphertext ca to obtain the ciphertext ca' corresponding to -ca-(0, 1 / (4t)). Then, the cryptographic processing device 1 performs BlindRotate on the ciphertext ca' using the same polynomial F1(X) as in [Example 1] as a test vector polynomial, to obtain a TRLWE ciphertext r1.

[0106] Next, the cryptographic processing device 1 performs homomorphic subtraction of a trivial ciphertext (0,F1(X)) with the polynomial F1(X) as plaintext from the TRLWE ciphertext r1 to obtain a new TRLWE ciphertext r1' corresponding to (r1-(0,F1(X)). The cryptographic processing device 1 homomorphically subtracts the ciphertext cb from the ciphertext ca, and homomorphically adds the trivial ciphertext (0,1 / (4t)) to obtain the ciphertext cc corresponding to ca-cb+(0,1 / (4t)). The cryptographic processing device 1 performs BlindRotate using the ciphertext corresponding to ca-cb+(0,1 / (4t)) with the TRLWE ciphertext r1' as the test vector polynomial, thereby obtaining a TRLWE ciphertext r2. The cryptographic processing device 1 performs SampleExtract at the position of 0, extracts the coefficient of the 0th order term (constant term) of the TRLWE ciphertext r2, and obtains the TLWE ciphertext c3. The subsequent steps are the same as those in the above [Example 1]. According to [Example 3], in a comparison of one ciphertext between a and b, the presence or absence of a carry-over or carry-down due to ab can be determined from the TLWE ciphertexts c5 and c6. Therefore, it is possible to detect the case where a - b overflows (for example, (t - 1)-(-t)=2t - 1) and the case where it underflows (for example, (-t)-(t - 1)=-2t + 1).

[0107] [Example 4] In [Example 4] as a modification of [Example 2], the plaintext integers a and b are compared between the ciphertexts representing integers in one ciphertext. In this case, if a - b is negative, then a < b, and if it is non - negative, then a ≥ b. By looking at the sign of ca - cb, the comparison result can be known, but here also, overflow and underflow have an impact. In [Example 4], the encryption processing device 1 subtracts the trivial ciphertext (0,1 / (4t)) from -ca obtained by inverting the ciphertext ca, and obtains a ciphertext ca’ corresponding to -ca-(0,1 / (4t)). The encryption processing device 1 performs BlindRotate with the polynomial F2(X) as the test vector polynomial on the ciphertext ca’, and obtains the TRLWE ciphertext r11. At this time, similar to the case of [Example 2], a process of multiplying each element of the ciphertext ca’ by 2n and then rounding to make the least significant bit 0 is performed.

[0108] The encryption processing device 1 multiplies the TRLWE ciphertext r11 by 2, and further adds the trivial ciphertext (0,F3(X)) having the polynomial F3(X) as the plaintext, and obtains a TRLWE ciphertext corresponding to r11×2+(0,F3(X)). The encryption processing device 1 subtracts the ciphertext cb from the ciphertext ca, and adds the trivial ciphertext (0,1 / (4t)) to calculate a ciphertext corresponding to ca - cb+(0,1 / (4t)).

[0109] The encryption processing device 1 performs BlindRotate on the TRLWE ciphertext r11’ based on the result of multiplying each coefficient of the ciphertext ca - cb+(0,1 / (4t)) by 2n and rounding at the least significant bit, and obtains the TRLWE ciphertext r2’. Then, SampleExtract is performed on the TRLWE ciphertext r2' at the position of 0 to extract the coefficient of the 0th order term (constant term) of the TRLWE ciphertext r2', and the TLWE ciphertext c3' is obtained. The subsequent steps are the same as those in [Example 2] above. As a result, when comparing a and b with one ciphertext, the TLWE ciphertexts c5 and c6 can tell whether ab has carried over or down. Therefore, it is possible to detect whether ab has carried over (for example, (t-1)-(-t)=2t-1) or carried down (for example, (-t)-(t-1)=-2t+1). Furthermore, according to [Example 4], it is possible to know whether ab is in the interval of the right half plane or the left half plane of the circular group {T} by the TLWE ciphertext c7.

[0110] 13 is a diagram showing possible values ​​of ciphertexts depending on the result of subtraction of the ciphertexts, and particularly shows possible patterns of TLWE ciphertexts c5 to c8 according to the ca-cb relationship for [Example 2]. c8 is calculated by homomorphic addition and subtraction of c8=c7+c6-c5. As a result of the premise, -t≦a, b≦t-1, so -2t+1≦ab≦2t-1 is always true. Therefore, ab fits into one of the four patterns shown in Figure 13: ab>t-1, t-1≧ab≧0, 0>ab≧-t, -t>ab.

[0111] As shown in FIG. 13, when ab>t-1, a carry occurs, and the plaintext φ(c5) of the TLWE ciphertext c5 corresponding to the presence or absence of a carry is 0 as an integer. A carry-over does not occur at the same time as a carry-over, and the TLWE ciphertext c6 corresponding to the presence or absence of a carry-over is an integer 1. ab is in the interval of the left half-plane of the circular group {T}, and the plaintext φ(c7) of the TLWE ciphertext c7 corresponding to that information is an integer 0. The plaintext φ(c8) of the TLWE ciphertext c8 is an integer equal to 1.

[0112] If t-1 ≧ ab ≧ 0, no carry occurs, and the plaintext φ(c5) of the TLWE ciphertext c5 is 1 as an integer. No carry occurs, and the plaintext φ(c6) of the TLWE ciphertext c6 is an integer 1. ab is in the interval of the right half-plane of the circle group {T}, and the plaintext φ(c7) of the TLWE ciphertext c7 is an integer 1. The plaintext φ(c8) of the TLWE ciphertext c8 is an integer equal to 1.

[0113] If 0>ab≧-t, no carry occurs, and the plaintext φ(c5) of the TLWE ciphertext c5 is an integer 1. No carry occurs, and the plaintext φ(c6) of the TLWE ciphertext c6 is an integer 1. ab is in the interval of the left half-plane of the circle group {T}, and the plaintext φ(c7) of the TLWE ciphertext c7 is an integer 0. The plaintext φ(c8) of the TLWE ciphertext c8 is an integer 0.

[0114] If -t ≧ ab, no carry occurs, and the plaintext φ(c5) of the TLWE ciphertext c5 is an integer 1. A carry occurs, and the plaintext φ(c6) of the TLWE ciphertext c6 is 0 as an integer. ab is in the interval of the right half-plane of the circle group {T}, and the plaintext φ(c7) of the TLWE ciphertext c7 is an integer 1. The plaintext φ(c8) of the TLWE ciphertext c8 is an integer 0.

[0115] As can be seen from Figure 13, if a carry occurs as a result of ca-cb, a carry-down will never occur, and the plaintext resulting from the calculation of ca-cb will always be located in the interval of the left half-plane of the circle group {T}. If a carry-down occurs as a result of ca-cb, a carry-up will never occur, and the plaintext resulting from the ca-cb calculation will always be located in the interval between the right half-plane (0 and 0.5) of the circle group {T}. In order to determine the magnitude relationship between a and b, it is necessary to check whether the result, including carry and borrow, is negative or non - negative. Therefore, the occurrence of carry and borrow takes precedence over whether a - b is in the right - hand interval or the left - hand interval of the circular group {T}. When there is no carry or borrow in the result of ca - cb and the plaintext of the calculation result of ca - cb is non - negative, the plaintext is located in the right - hand interval of the circular group {T}. When there is no carry or borrow in the result of ca - cb and the plaintext of the calculation result of ca - cb is negative, the plaintext is located in the left - hand interval of the circular group {T}. From the above, for the plaintext of c8, when a - b ≥ 0, φ(c8)=1 as an integer. When a - b < 0, φ(c8)=0. Rearranging the formula, φ(c8)=1 when a ≥ b and φ(c8)=0 when a < b. The cryptographic processing device 1 can obtain a TLWE ciphertext c8 representing a comparison result from the TLWE ciphertexts c5, c6, and c7 without performing complex and computationally intensive calculation processes such as Bootstrapping. Even starting from the initial ciphertexts ca and cb, BlindRotate is only used twice.

[0116] Figure 14 is a flowchart for explaining the processing of the first embodiment. In step S101, the cryptographic processing device 1 (the first arithmetic unit 12) performs a homomorphic operation of - ca+(0,1 / (4t)) on the input TLWE ciphertext ca. In step S102, the cryptographic processing device 1 (the first Bootstrapping unit 41) performs BlindRotate with the polynomial F1(X) as a test - vector polynomial on the TLWE ciphertext ca’, and calculates the TRLWE ciphertext r1. In step S103, the cryptographic processing device 1 (the second arithmetic unit 13) performs a homomorphic operation of r1×2-(0,F1(X)) on the TRLWE ciphertext r1, and calculates the TRLWE ciphertext r1’. In step S104, the cryptographic processing device 1 (third arithmetic unit 14) performs a homomorphic operation of ca+cb-(0,1 / (4t)) on the TLWE ciphertext ca and the TLWE ciphertext ca to obtain a TLWE ciphertext cc. In step S105, the cryptographic processing device 1 (the second bootstrap unit 42) performs BlindRotate on the TLWE ciphertext cc using the TRLWE ciphertext r1' as a test vector polynomial to calculate a TRLWE ciphertext r2.

[0117] In step S106, the cryptographic processing device 1 (the second bootstrap unit 42) performs SampleExtract on the TRLWE ciphertext r2 to obtain a TLWE ciphertext c3. In step S107, the cryptographic processing device 1 (the first bootstrap unit 41) performs SampleExtract on the TRLWE ciphertext r1 to obtain a TLWE ciphertext c2. In step S108, the cryptographic processing device 1 (fourth arithmetic unit 15) performs a homomorphic operation of c3+2×2c on the TLWE ciphertext c3 and the TLWE ciphertext c2 to obtain a TLWE ciphertext c4.

[0118] In step S109, the cryptographic processing device 1 (the third bootstrap unit 43) performs BlindRotate on the TLWE ciphertext c4 using the polynomial F1'(X) as a test vector polynomial, to calculate a TRLWE ciphertext r3. In steps S110 and S111, the cryptographic processing device 1 (the third Bootstrapping unit 43) performs SampleExtract twice on different parts of the TRLWE ciphertext r3 to obtain TLWE ciphertexts cd and ce. In steps S112 and S113, the cryptographic processing device 1 (fifth arithmetic unit 16) performs homomorphic addition on the TLWE ciphertexts cd and ce by adding (0, 1 / (2t)), respectively, to obtain TLWE ciphertexts c5 and c6. The homomorphic addition may be performed every time SampleExtract is executed. The homomorphic addition in step S104 may be performed before or during the processes of steps S101 to S103.

[0119] FIG. 15 is a flowchart illustrating the process of the second embodiment. In step S201, the cryptographic processing device 1 (first arithmetic unit 12) performs a homomorphic operation of −ca+(0, 1 / (4t)) on a TLWE ciphertext ca to obtain a TLWE ciphertext ca′. In step S202, the cryptographic processing device 1 (the first bootstrap unit 41) performs BlindRotate on the TLWE ciphertext ca' calculated in step S201 using the polynomial F2(X) as a test vector polynomial, to calculate a TRLWE ciphertext r11. In step S203, the cryptographic processing device 1 (second arithmetic unit 13) performs a homomorphic operation of r11×2−(0, F3(X)) on the TRLWE ciphertext r11 to calculate a TRLWE ciphertext r11′.

[0120] In step S204, the cryptographic processing device 1 (third arithmetic unit 14) performs a homomorphic operation of 2n×(ca+cb−(0,1 / (4t))) on the TLWE ciphertext ca and the TLWE ciphertext cb, and obtains a TLWE ciphertext cc′ by rounding off. In step S205, the cryptographic processing device 1 (the second bootstrap unit 42) performs BlindRotate on the TLWE ciphertext cc' using the TRLWE ciphertext r11' as a test vector polynomial to calculate a TRLWE ciphertext r2'. In step S206, the cryptographic processing device 1 (the second bootstrap unit 42) performs SampleExtract on the TRLWE ciphertext r2' to obtain a TLWE ciphertext c3'. In step S207, the cryptographic processing device 1 (the first bootstrap unit 41) performs SampleExtract on the TRLWE ciphertext r11 to obtain a TLWE ciphertext c2'. In step S208, the cryptographic processing device 1 (fourth arithmetic unit 15) performs a homomorphic operation of c3'+2×c2' on the TLWE ciphertext c3' and the TLWE ciphertext c2' to obtain a TLWE ciphertext c4'.

[0121] In step S209, the cryptographic processing device 1 (the third bootstrap unit 43) performs BlindRotate on the TLWE ciphertext c4' using the polynomial F2'(X) as a test vector polynomial to calculate a TRLWE ciphertext r3. In steps S210, S211, and S212, the cryptographic processing device 1 (the third Bootstrapping unit 43) performs SampleExtract three times on different parts of the TRLWE ciphertext r3 to obtain TLWE ciphertexts cd' and ce'cf. In steps S213, S214, and S215, the cryptographic processing device 1 (fifth arithmetic unit 16) performs homomorphic addition on the TLWE ciphertexts cd', ce'cf by adding the trivial ciphertext (0, 1 / (2t)), respectively, to obtain TLWE ciphertexts c5, c6, and c7. The homomorphic addition may be performed every time SampleExtract is executed. The homomorphic addition in step S204 may be performed before or during the processes of steps S201 to S203. In step S216, the cryptographic processing device 1 (sixth arithmetic unit 17) performs a homomorphic operation on the TLWE ciphertext c7+c6-c5 to obtain a TLWE ciphertext c8 corresponding to the comparison result.

[0122] FIG. 16 is a diagram showing ciphertexts input and output to and from Gate Bootstrapping of this embodiment. In the above description, as shown in FIG. 16(a), a case has been described in which Gate Bootstrapping is performed in the order of BlindRotate, SampleExtract, and Public Key Switching in the case of the fourth calculation unit 41, for example. Alternatively, as shown in FIG. 16(b), Public Key Switching can be executed first in Gate Bootstrapping, and then BlindRotate and SampleExtract can be executed. TLWE ciphertext has a concept of levels according to security strength.

[0123] In Gate Bootstrapping in Fig. 16(a), the input and output TLWE ciphertexts are LEVEL 0. When BlindRotate is performed on the LEVEL 0 TLWE ciphertext and SampleExtract is performed on the output TRLWE ciphertext, the TLWE ciphertext obtained is LEVEL 1, but as a result of Public Key Switching, a LEVEL 0 TLWE ciphertext is output. In contrast, in the method shown in Figure 16(b), the TLWE ciphertext that is the input and output of Gate Bootstrapping is set to LEVEL 1, and first Public Key Switching is performed to lower it to LEVEL 0, and then BlindRotate is performed. When SampleExtract is performed on the output TRLWE ciphertext, a TLWE ciphertext of LEVEL 1 is output.

[0124] The ciphertext of LEVEL0 consists of an N-order vector [a] of elements on the circular group {T} encrypted with an N-order secret key [s]. On the other hand, the ciphertext of LEVEL1 obtained as a result of SampleExtract consists of an n-order vector [a'] of elements on the circular group {T} encrypted with an n-order secret key [s']. The LEVEL0 ciphertext has a smaller number of coefficients (the degree of the vector), which is the difficulty of the LWE problem, than the LEVEL1 ciphertext, so the amount of computation required for homomorphic addition is smaller than that of LEVEL1. On the other hand, the problem with LEVEL0 ciphertext is that the security strength is likely to decrease if the allowable error added to the plaintext is reduced, because the security of LWE-based ciphers is guaranteed by the error added to the plaintext.

[0125] The larger the error added to the plaintext and the greater the number of coefficients (the degree of the vector), the more difficult it becomes to calculate (decrypt) the TLWE cipher. On the other hand, the smaller the error added to the plaintext and the fewer the number of coefficients (the degree of the vector), the easier it is to calculate (decrypt) the TLWE cipher. In particular, in the case of TFHE applied to the integer-wise type, the larger the plaintext (integer) value stored in the TLWE ciphertext becomes, the more finely it is necessary to divide the range of values ​​from 0 to 1 in the circular group {T}, and there is also the problem of errors during decryption, which will be described later, so the error needs to be reduced. In that case, as mentioned above, the security strength is likely to decrease, so in order to reduce the error, it is necessary to ensure security by increasing the number of coefficients in the ciphertext (the degree of the vector).

[0126] In order to ensure the security of ciphertexts that are easier to calculate (decrypt) by reducing the error added to the plaintext, it is desirable to move Public Key Switching to the beginning of Gate Bootstrapping and use LEVEL1 ciphertexts, which have a large number of coefficients (vector order) and are therefore easier to reduce the error range, as the input and output of Gate Bootstrapping. Then, after converting to LEVEL0 at the beginning of Gate Bootstrapping, the ciphertext is not returned to LEVEL0 at the end. By not returning to LEVEL0, the calculation of the TLWE ciphertext can be performed safely in the next stage as well. The time required for BlindRotate is proportional to the number of coefficients (vector degree) of the input TLWE ciphertext, because the number of CMux is the same as the degree. Therefore, when the ciphertext of LEVEL1 is input, the time required for BlindRotate is longer in proportion to the number of coefficients (vector degree) than when the ciphertext of LEVEL0 is input. Even if the LEVEL1 ciphertext is used as the input for Gate Bootstrapping to ensure the security of the ciphertext, the increase in the required time can be avoided by performing BlindRotate using the LEVEL0 TLWE ciphertext converted by Public Key Switching as the input.

[0127] Furthermore, reducing the error added to the plaintext poses the problem of errors during decryption in addition to the security strength mentioned above. As described above, in TFHE applied to the integer-wise type, the range of values ​​from 0 to 1 corresponding to the circular group {T} is divided into 2t parts. By increasing the value of t and dividing the circular group into smaller parts, the integer values ​​that can be recorded in the TLWE ciphertext can be made larger. The maximum value that can be stored is determined by the number of parts t into which the circular group is divided, but when trying to store a large value, the error range must be made smaller, which can lead to problems such as a decrease in security strength and an increase in the decryption error rate. In homomorphic encryption of the LWE system, including TFHE, the errors added to the plaintext are normally distributed, and it is not possible to strictly set the "error range." Although the error still tends to be concentrated near 0, in principle, this simply makes it possible to concentrate the error more in the specified range. If the error falls outside the set range, the plaintext will be interpreted as a different plaintext, which may result in unexpected calculation results. The calculation itself does not become impossible, but rather a different result is obtained. How much of a probability of obtaining a different calculation result can be tolerated is up to the application to which homomorphic encryption is applied.

[0128] In order to best balance the three goals of reducing the probability of errors occurring in calculations, reducing the number of BlindRotates to speed up calculations, and maintaining high security, it is necessary to set the system parameters so that the overlap of the error ranges falls within a certain value. The error may be set so as to satisfy conditions that are of particular importance depending on the system or device to which this embodiment is applied.

[0129] [Application example] The cryptographic processing device 10 performs comparison operations on ciphertexts using the functions of the first calculation unit 12, the second calculation unit 13, the third calculation unit 14, the fourth calculation unit 15, the fifth calculation unit 16, the sixth calculation unit 17, the first bootstrap unit 41, the second bootstrap unit 42, the third bootstrap unit 43, and the fourth bootstrap unit 44. By performing a comparison operation, it is possible to calculate whether or not there is a carry-over or carry-down required for multiple-precision integer operations. The process performed by the cryptographic processing device 1 using multiple-precision integers can be applied as follows. Specific applications include fuzzy authentication such as biometric authentication (as the data remains unchanged throughout one's lifetime, it must be kept secret; a threshold is set to determine whether or not there is a match), fuzzy search that searches a database for ambiguous, similar data, and query aggregation from an encrypted database. Fuzzy authentication is, for example, biometric authentication using biometric data, and it is an absolute requirement that the biometric data, which remains unchanged throughout a person's life, be encrypted and kept secret. Fuzzy authentication performs authentication based on the correspondence between the biometric data presented in the authentication request and the biometric data registered in a database. However, since it is not possible to obtain exactly the same value even when biometric information is measured accurately, it does not check for a perfect match between the two, but rather checks for a match based on a threshold value. Fuzzy search is a vague search method that presents data close to the query from a database as a search result even if the query and the record do not match exactly. In fuzzy authentication and fuzzy search, various operations are required on data encrypted by homomorphic encryption when querying an encrypted database. For example, when using Euclidean distance to calculate the degree of match with a registered fingerprint in fuzzy authentication, x 2In addition, when converting the scale by vector normalization, it is necessary to multiply the scale, that is, to calculate a first-order polynomial. To evaluate the similarity of texts, it is necessary to calculate the cosine similarity by dividing the inner product of two vectors by their respective norms. After expressing the index of how close the ciphertext is to the target by these calculations as a value, a comparison calculation is required to determine whether or not to accept the result or to authenticate it. This can be performed using the comparison calculation performed by the cryptographic processing device 1 of this embodiment and multiple-precision integer calculations that apply the comparison calculation.

[0130] FIG. 17 is a block diagram illustrating an embodiment of a computer system. The configuration of the computer device 100 will be described with reference to FIG. The computer device 100 is, for example, a cryptographic processing device that processes various types of information. The computer device 100 includes a control circuit 101, a storage device 102, a reading / writing device 103, a recording medium 104, a communication interface 105, an input / output interface 106, an input device 107, and a display device 108. The communication interface 105 is connected to a network 200. The components are connected to each other via a bus 110. The cryptographic processing device 1 can be configured by appropriately selecting some or all of the components described in the computer device 100.

[0131] The control circuit 101 controls the entire computer device 100. The control circuit 101 is, for example, a processor such as a Central Processing Unit (CPU), a Field Programmable Gate Array (FPGA), an Application Specific Integrated Circuit (ASIC), or a Programmable Logic Device (PLD). The control circuit 101 functions as, for example, the control unit 10 in FIG.

[0132] The storage device 102 stores various data. The storage device 102 is, for example, a memory such as a Read Only Memory (ROM) and a Random Access Memory (RAM), a Hard Disk (HD), or a Solid State Drive (SSD). The storage device 102 may store an information processing program that causes the control circuit 101 to function as the control unit 10 in Fig. 1. The storage device 102 functions as, for example, the storage unit 20 in Fig. 1.

[0133] When performing information processing, the cryptographic processing device 1 reads out a program stored in the storage device 102 into the RAM. The cryptographic processing device 1 executes a program read into the RAM in the control circuit 101, thereby executing processing including one or more of the first calculation processing, the second calculation processing, the third calculation processing, the fourth calculation processing, the fifth calculation processing, the sixth calculation processing, the first bootstrap processing, the second bootstrap processing, the third bootstrap processing, the fourth bootstrap processing, and an output processing. The program may be stored in a storage device of a server on the network 200 as long as the control circuit 101 can access the program via the communication interface 105 .

[0134] The reading / writing device 103 is controlled by the control circuit 101 and reads / writes data from / to a removable recording medium 104 . The recording medium 104 stores various data. For example, the recording medium 104 stores an information processing program. For example, the recording medium 104 is a non-volatile memory (non-transient recording medium) such as a Secure Digital (SD) memory card, a Floppy Disk (FD), a Compact Disc (CD), a Digital Versatile Disk (DVD), a Blu-ray (registered trademark) Disk (BD), or a flash memory.

[0135] The communication interface 105 communicably connects the computer device 100 to other devices via the network 200. The communication interface 105 functions as, for example, the communication unit 25 in FIG. The input / output interface 106 is, for example, an interface that is detachably connected to various input devices. The input devices 107 connected to the input / output interface 106 include, for example, a keyboard and a mouse. The input / output interface 106 communicably connects the various input devices connected to the computer device 100. The input / output interface 106 outputs signals input from the various input devices connected to the control circuit 101 via the bus 110. The input / output interface 106 also outputs signals output from the control circuit 101 to the input / output devices via the bus 110. The input / output interface 106 functions as, for example, the input unit 26 in FIG. 1.

[0136] The display device 108 displays various information. The display device 108 is, for example, a cathode ray tube (CRT), a liquid crystal display (LCD), a plasma display panel (PDP), an organic electroluminescence display (OLED), etc. The network 200 is, for example, a LAN, wireless communication, a P2P network, or the Internet, and communicatively connects the computer device 100 to other devices. It should be noted that the present embodiment is not limited to the embodiment described above, and various configurations or embodiments can be adopted without departing from the spirit of the present embodiment. [Explanation of symbols]

[0137] 1 encryption processing device, 10 control unit, 20 memory unit, 25 communication unit, 26 input unit, 100 computer device, 101 control circuit, 102 storage device, 103 reading / writing device, 104 recording medium, 105 communication interface, 106 input / output interface, 107 input device, 108 display device, 110 bus, 200 network

Claims

1. A cryptographic processing device for processing a ciphertext, comprising: the ciphertext is a fully homomorphic ciphertext that has a value obtained by adding an error having a predetermined variance to a predetermined value as a plaintext associated with an integer and that enables a predetermined operation between integers without decryption, calculating a second ciphertext having the polynomial as a plaintext by rotating coefficients of the first polynomial in response to the first ciphertext; calculating a third ciphertext having the polynomial as a plaintext by performing a homomorphic operation on the second ciphertext having the second polynomial as a plaintext; calculating a fifth ciphertext by using the third ciphertext as a polynomial and extracting a predetermined term by cyclically rotating coefficients of the third ciphertext in accordance with a fourth ciphertext; 4. A cryptographic processing device comprising:

2. 2. The cryptographic processing device according to claim 1, a coefficient of one of an even-order term and an odd-order term in the first polynomial is set to 0, and the coefficient of the first polynomial is rotated in response to the first ciphertext, thereby leaving the coefficient of the one of the terms unchanged; a coefficient of each of the even-numbered and odd-numbered terms of the first polynomial, which is included in the third ciphertext, and a coefficient of each of the second polynomials, which corresponds to the coefficient of the first polynomial, are used to simultaneously execute different operations using the fourth ciphertext; 4. A cryptographic processing device comprising:

3. 2. The cryptographic processing device according to claim 1, 4. The cryptographic processing device according to claim 1, wherein the predetermined calculation is a multiple-precision integer calculation.

4. In the cryptographic processing device according to claim 1, the fourth ciphertext is a ciphertext corresponding to a result of a homomorphic operation between the first ciphertext and another ciphertext, calculating a sixth ciphertext indicating the presence or absence of a carry-over in the fourth ciphertext and a seventh ciphertext indicating the presence or absence of a carry-down in the fourth ciphertext by cyclically rotating the coefficients of a third polynomial according to a ciphertext obtained by performing a homomorphic operation on the ciphertext extracted from the second ciphertext and the fifth ciphertext, and 4. A cryptographic processing device comprising:

5. In the cryptographic processing device according to claim 1, the fourth ciphertext is a ciphertext corresponding to a result of a homomorphic operation between the first ciphertext and another ciphertext, calculating at least one of a sixth ciphertext indicating whether or not a carry-over occurs in the fourth ciphertext, a seventh ciphertext indicating whether or not a carry-down occurs in the fourth ciphertext, and an eighth ciphertext indicating whether or not a result of the homomorphic operation is positive or negative by circulating coefficients of a third polynomial according to a ciphertext obtained by performing a homomorphic operation on the ciphertext extracted from the second ciphertext and the fifth ciphertext, 4. A cryptographic processing device comprising:

6. In the cryptographic processing device according to claim 5, calculating a ciphertext corresponding to a comparison result between the first ciphertext and other ciphertexts, based on the sixth ciphertext, the seventh ciphertext, and the eighth ciphertext; 4. A cryptographic processing device comprising:

7. In the cryptographic processing device according to claim 5, the fourth ciphertext is a ciphertext corresponding to a result of homomorphic addition / subtraction between the first ciphertext and another ciphertext, using the third ciphertext as a polynomial, calculating a ninth ciphertext by circulating coefficients of the third ciphertext in accordance with the fourth ciphertext, and calculating a tenth ciphertext corresponding to a result of homomorphic addition / subtraction between the first ciphertext and the other ciphertext by circulating coefficients of a fourth polynomial in accordance with the ninth ciphertext and extracting a predetermined term; 4. A cryptographic processing device comprising:

8. In the cryptographic processing device according to claim 1, The ciphertext having the second polynomial as a plaintext is a trivial ciphertext that can be decrypted with any private key.

4. A cryptographic processing device comprising:

9. In the cryptographic processing device according to claim 1, By performing the predetermined calculation, a process related to fuzzy authentication or fuzzy search is performed using the input ciphertext.

4. A cryptographic processing device comprising:

10. In the cryptographic processing device according to claim 1, performing the predetermined operation to process a query to an encrypted database based on the input ciphertext; 4. A cryptographic processing device comprising:

11. In the cryptographic processing device according to claim 1, The homomorphic operation is homomorphic addition or homomorphic subtraction.

4. A cryptographic processing device comprising:

12. A processor-implemented cryptographic processing method for processing ciphertext, comprising: the ciphertext is a fully homomorphic ciphertext that has a value obtained by adding an error having a predetermined variance to a predetermined value as a plaintext associated with an integer and that enables a predetermined operation between integers without decryption, The processor, calculating a second ciphertext having the polynomial as a plaintext by rotating coefficients of the first polynomial in response to the first ciphertext; calculating a third ciphertext having the polynomial as a plaintext by performing a homomorphic operation on the second ciphertext having the second polynomial as a plaintext; calculating a fifth ciphertext by using the third ciphertext as a polynomial and extracting a predetermined term by rotating coefficients of the third ciphertext in accordance with a fourth ciphertext; 13. A cryptographic processing method comprising:

13. A cryptographic processing program for causing a processor to execute a cryptographic processing method for processing a ciphertext, comprising: the ciphertext is a fully homomorphic ciphertext that has a value obtained by adding an error having a predetermined variance to a predetermined value as a plaintext associated with an integer and that enables a predetermined operation between integers without decryption, The processor, calculating a second ciphertext having the polynomial as a plaintext by rotating coefficients of the first polynomial in response to the first ciphertext; calculating a third ciphertext having the polynomial as a plaintext by performing a homomorphic operation on the second ciphertext having the second polynomial as a plaintext; calculating a fifth ciphertext by using the third ciphertext as a polynomial and extracting a predetermined term by rotating coefficients of the third ciphertext in accordance with a fourth ciphertext; 4. A cryptographic processing program comprising:

Images