Calculation of encoded and encrypted values

Abstract

Some embodiments are directed to a cryptographic method that performs encrypted computations on one or more sets of encoded and encrypted values. The values are encoded and encrypted as the encryption of a plurality of respective sub - values. The sub - values have a corresponding message modulus and a carry message modulus that is larger than the message modulus. The values are encoded and encrypted without carry by a carry - free sub - value that is smaller than the corresponding message modulus. The values are encoded and encrypted with carry by at least one carry - with sub - value that is greater than or equal to the corresponding message modulus. An encrypted operation is applied to at least the input value encoded and encrypted with carry to obtain an output value encoded and encrypted with carry. Encrypted carry reduction is applied to the output value encoded and encrypted with carry to obtain further encoding and encryption of the output value, where at least one carry - with sub - value is reduced to a carry - free sub - value.

Description

[Technical Field]

[0001] The subject matter disclosed in this invention relates to cryptographic methods for performing encrypted computations, corresponding devices, compiler methods and devices for encrypted computations, and computer-readable media. [Background technology]

[0002] Homomorphic encryption makes it possible to perform encrypted computations; that is, to perform computations on encrypted data, such as circuit evaluation, on data that cannot be decrypted by the participants. For example, input data and computation results may be received and returned in encrypted form. Intermediate data of a computation, such as internal states, may also be in encrypted form.

[0003] Although the results of the calculation are returned in encrypted form, when decrypted, the output is expected to be the same as, or very close to, what would occur if the calculation were performed on unencrypted data. Homomorphic encryption can be used for outsourced storage and computation while preserving privacy. This allows data to be encrypted and outsourced to a cloud environment for processing and / or storage, all while remaining encrypted.

[0004] For example, homomorphic encryption may be applicable to fields such as healthcare, where privacy regulations may make sharing plain data difficult, but computation on encrypted medical data may be permitted. For instance, a medical model developed to classify medical data may be configured to receive the data in encrypted form from a third party, such as a hospital. The medical model may classify the medical data, for example, as normal or abnormal, or as having a specific medical symptom, disease, or other disorder. Using homomorphic encryption, the medical model can be applied to the medical data received in encrypted form. This means that the party providing the medical model cannot access the plain medical data corresponding to the encrypted medical data. Users of the service can decrypt the results of the medical model application.

[0005] In particular, there are homomorphic cryptography techniques that can be used, at least in principle, to compute any function relating to encrypted data. Such techniques are called "fully homomorphic" (FHE) techniques.

[0006] Known implementations of FHE use noisy ciphertext for security reasons. For example, encrypting a data item may involve mapping the data item to a point in a key-dependent grid, where noise is added to that point. In particular, many known implementations of FHE use LWE-type ciphertext, whose security depends on the cryptographic hardness of the cipher in the Learning With Errors problem. Such LWE-type ciphertext may consist of one or more mask values ​​(e.g., values ​​modulo a particular modulus q, or torus elements) and a noisy body value derived from the mask values ​​and from the plaintext using the encryption key. A generalization of this is GLWE-type ciphertext, which encrypts and uses polynomials instead of scalar values. RLWE-type ciphertext is another type of GLWE ciphertext. Other known implementations of FHE use NTRU-type ciphertext, to which the same considerations largely apply.

[0007] When a data item is first encrypted, there is little noise, and the encryption is fresh. For example, if the amount of noise is very small, it may be removed at some point in the decryption process, for example, by rounding, when the data item is decrypted. On the other hand, the noise must be high enough to make it sufficiently difficult to attack the system. For example, assuming no noise exists, many homomorphic encryption schemes can be attacked using linear algebra or other efficient algorithms, such as lattice reduction algorithms. When a data item is encrypted, noise is added that is chosen to make the attack difficult, but homomorphic operations can still be performed and decryption is still possible.

[0008] Most homomorphic operations increase the noise inherent in homomorphically encrypted data items. When many such operations are performed, the noise can reach a level where unique decryption is no longer possible. Generally, a technique called bootstrapping is known to be used to reduce the noise in homomorphically encrypted values. Bootstrapping may use a public key called a bootstrapping key. By reducing the noise using bootstrapping when necessary, it is theoretically possible to compute any desired number of homomorphic operations.

[0009] A particular class of fully homomorphic encryption schemes is the TFHE-like homomorphic encryption scheme. Such schemes are described (incorporated herein by reference) in I. Chillotti et al., "Programmable bootstrapping enables efficient homomorphic inference of deep neural networks," Cyber ​​Security Cryptography and Machine Learning (CSCML 2021), vol. 12716 of Lecture Notes in Computer Science, pp. 1-19, Springer, 2021. TFHE-like schemes are differentiated from other FHE schemes by supporting relatively highly efficient bootstrapping techniques; furthermore, they simultaneously allow the evaluation of functions during the bootstrap operation, which is called programmable bootstrapping. Ordinary bootstrapping corresponds to programmable bootstrapping using an identity function.

[0010] Other known implementations of TFHE-like schemes use NTRU-type ciphertexts, to which the same considerations largely apply. In particular, NTRU may be used in combination with the techniques provided by using a blind rotation that yields an NTRU-encrypted polynomial product of the test polynomial and the bootstrapping monomial, and / or by applying a blind rotation to the NTRU ciphertext as input. Examples of proper NTRU encryption are defined in C. Bonte et al., "FINAL: Faster FHE instantiated with NTRU and LWE", Cryptology ePrint Archive, Paper 2022 / 07; and K. Kluczniak, "NTRU-ν-um: Secure Fully Homomorphic Encryption from NTRU with Small Modulus", Cryptology ePrint Archive, Paper 2022 / 089.

[0011] Interestingly, the output of programmable bootstrapping has a noise level independent of the noise in the input ciphertext. Therefore, by performing programmable bootstrapping, the noise in the input ciphertext can be reduced to a fixed level, and in some cases, a function can be applied to the input ciphertext simultaneously. By performing programmable bootstrapping at the appropriate time, it is possible to perform encrypted computations of unlimited multiplicative complexity.

[0012] Despite the power of PBS operations, efficiently performing arithmetic operations (e.g., multiplication) on relatively large values, such as values ​​defined modulo greater than 256 or 1024, remains challenging even today. One reason for this is that PBS scales less linearly than linearly with respect to the input size.

[0013] In the paper "Putting up the Swiss army knife of homomorphic calculations by means of TFHE functional bootstrapping" by P. Clet et al., Cryptology ePrint Archive, Report 2022 / 149, a technique is proposed for performing multiplication and addition on ciphertexts based on a digit decomposition approach. This means that a value is encoded and encrypted by encrypting the elements of the radix decomposition of the value modulo base β. In this article, the authors propose addition using two or more programmable bootstrappings for each ciphertext in which the elements of the decomposition are encrypted. Addition is performed sequentially. Multiplication is performed based on a textbook multiplication approach. Despite these developments, further improvements to cryptographic calculations for large encrypted values ​​are still needed. [Prior art documents] [Non-patent literature]

[0014] [Non-Patent Document 1] I. Chilotti et al., “Programmable bootstrapping enables homomorphic inference of deep neural networks,” Cyber ​​Security Cryptography and Machine Learning (CSCML 2021), vol.12716 of Lecture Notes in efficient Computer Science, pp.1-19, Springer, 2021 [Non-Patent Document 2] C. Bonte et al., “FINAL:Faster FHE instantiated with NTRU and LWE”, Cryptology ePrint Archive, Paper 2022 / 07 [Non-Patent Document 3] K. Kluczniak, “NTRU-ν-um:Secure Fully Homomorphic Encryption from NTRU with Small Modulus”, Cryptology ePrint Archive, Paper 2022 / 089 [Non-Patent Document 4] Paper by P. Clet et al., "Putting up the Swiss army knife of homomorphic calculations by means of TFHE functional bootstrapping," Cryptology ePrint Archive, Report 2022 / 149. [Non-Patent Document 5] R. Rothblum, "Homomorphic encryption: From private-key to public-key", Theory of Cryptography (TCC 2011), vol. 6597 of Lecture Notes in Computer Science, pp. 219-234, Springer, 2011 [Non-Patent Document 6] L. Ducas et al., “FHEW: bootstrapping homomorphic encryption in less than a second”, proceedings EUROCRYPT 2015 [Non-Patent Document 7] I. Chillotti et al., “Faster fully homomorphic encryption:Bootstrapping in less than 0.1 seconds”, proceedings ASIACRYPT 2016 [Non-Patent Document 8] I. Chillotti et al., “Faster packed homomorphic operations and efficient circuit bootstrapping for TFHE”, proceedings ASIACRYPT 2017 [Non-Patent Document 9] C. Bonte et al., “FINAL:Faster FHE instantiated with NTRU and LWE”, Cryptology ePrint Archive, Paper 2022 / 07 [Non-Patent Document 10] C. Boura et al., “CHIMERA:Combining Ring-LWE-based Fully Homomorphic Encryption Schemes”, J.Math.Cryptol.,14(1):316-338,2020 [Non-Patent Document 11] M. Albrecht et al., “On the concrete hardness of Learning with Errors”, Journal of Mathematical Cryptology, 9(3):169-203, 2015 [Non-Patent Document 12] I. Chillotti et al., “Improved programmable bootstrapping with larger precision and efficient arithmetic circuits for TFHE”, proceedings ASIACRYPT 2021 [Non-Patent Document 13] A. Guimaraes et al., “Revisiting the functional bootstrap in TFHE”, IACR Trans.Cryptogr.Hardw.Embed.Syst., 2021(2):229-253,2021 [Non-Patent Document 14] H. Chen et al., “Onion ring ORAM: efficient constant bandwidth oblivious RAM from(leveled) TFHE”, proceedings CCS 2019 [Overview of the project] [Problems that the invention aims to solve]

[0015] The inventors noticed several shortcomings in existing approaches.

[0016] Some existing approaches have low precision with respect to integer plaintext using TFHE; that is, when encrypting an integer using a single ciphertext, performing arithmetic operations such as multiplication on a ciphertext containing plaintext exceeding 7 bits is not currently practically feasible.

[0017] Furthermore, existing approaches lack efficiency. Approaches based on converting computations into Boolean circuits and then evaluating the circuits by gate bootstrapping are actually significantly slower if the plaintext is not a Boolean value. Also, existing approaches that rely on encoding values ​​using small integers (e.g., 1 or 2 bits) are slow and costly because the operations on these small integers are typically built using PBS, or are followed by PBS.

[0018] Another drawback of existing approaches is the inability to parallelize. For example, when integers are encoded by radix decomposition, addition or multiplication may involve carry propagation along the MSB of homomorphic integers, which is a sequential process. This suggests that when parallelization is possible, speed will decrease during homomorphic circuit evaluation.

[0019] A further drawback is the lack of flexibility. Existing implementations of arithmetic operations involving carry propagation, such as addition or multiplication, are not flexible enough to adapt how the arithmetic operations are performed depending on the size of the input, and therefore cannot optimize performance to suit the current use case.

[0020] The objective of this invention is to address at least some of these problems. [Means for solving the problem]

[0021] According to one aspect of the present invention, a cryptographic computation method is provided for performing encrypted computation as defined in the claims. According to a further aspect, a device corresponding to a computer-implemented method as defined in the claims is provided. According to another aspect, a computer-readable medium as defined in the claims is provided.

[0022] Various aspects relate to performing encrypted calculations on a set of one or more encoded and encrypted values. The values ​​may be numerical, for example, values ​​defined modulo a particular overall modulus q. Such values ​​modulo q may be interpreted, for example, as unsigned integers (e.g., from the range [0, q)); as signed integers (e.g., [-q / 2, q / 2)); as fixed-point numbers, etc.

[0023] Such encoded and encrypted values ​​may be encoded and encrypted as an encryption of multiple subvalues, each of which is also referred to herein as a “block.” For example, the value and subvalues ​​may relate to each other according to a radix decomposition according to a fixed base β. Several other ways of relating the value and subvalues ​​are also possible, as discussed in more detail elsewhere.

[0024] In one embodiment, partial value encryption is LWE encryption. In another embodiment, partial value encryption is NTRU encryption.

[0025] Encrypted calculations may involve applying one or more encrypted operations to a set of encoded and encrypted values, such as arithmetic operations like addition and / or multiplication; functional applications like the application of ReLU, sign, exponential, or other single-variable functions; and / or other numerical operations. Such encrypted operations may generally take one or more encoded and encrypted input values ​​(and optionally additional inputs, such as further encrypted or unencrypted values) as input and may result in one or more encoded and encrypted output values. Interestingly, the operations are performed in an encrypted form in the sense that they do not leak information about the input and / or output values, and in particular, the input values ​​are not decrypted in order to perform the operations.

[0026] Interestingly, the inventors have considered using the encoding of an encoded and encrypted value to an encrypted subvalue that is capable of preserving a carry. The subvalue may have an associated message modulus, but may also have a carry message modulus that is greater than the message modulus. For example, a subvalue may be defined according to a radix decomposition, and therefore also having a message modulus of 8, but may be encrypted as a value modulo 64. Thus, a value may be encoded and encrypted without a carry, meaning that the subvalue is a carry-free subvalue less than the corresponding message modulus; however, a value may also be encoded and encrypted with a carry, meaning that at least one subvalue is a carry-included subvalue greater than or equal to the corresponding message modulus.

[0027] A value encoded and encrypted with a carry is processed according to the relationship between that value and the part value without the carry, and according to the corresponding carry-reduction operation, for example, according to radix decomposition using a message modulo β, and the part value m is carried down to m mod β, and the carry is reduced

number

[0028] The inventors have realized that a carry-encoded partial value can be used not only within an encrypted operation, but also as an input or output of an encrypted operation. An encrypted operation (e.g., addition, multiplication, another arithmetic operation, or evaluation of a single-variable function) may be applied to at least one input value encoded and encrypted with a carry, and may result in at least one output value encoded and encrypted with a carry.

[0029] In some cases, encrypted carry reduction may be applied to the output value, reducing at least one carry-bearing subvalue to a carry-free subvalue. However, in other cases, the output value may not undergo carry reduction and may be input along with the carry to further encrypted operations (e.g., further addition, multiplication, or other arithmetic operations). In either case, if necessary, encrypted carry reduction may be applied during the encrypted operation, for example, to intermediate subvalues. In general, encrypted carry reduction may be applied to ensure that subsequent encrypted operations do not result in subvalues ​​exceeding the carry message modulus.

[0030] By enabling encoded and encrypted values ​​with carries as inputs and / or outputs to encrypted operations, and optionally by performing carry reduction that does not reduce all carry-carried subvalues ​​of the encoded-encrypted value, the efficiency of encrypted computations can be significantly improved for several reasons detailed below. In general, the techniques provided enable the evaluation of, for example, arithmetic circuits that efficiently perform encrypted computations on values ​​encoded and encrypted into multiple subvalues. A configurable cryptographic computation technique is provided that enables optimization of execution from a computational standpoint, either before execution or in the fly, by selectively performing encrypted carry reduction on selected subvalues.

[0031] In particular, using multiple subvalues ​​improves upon the lack of precision in some existing approaches. This makes it possible to perform encrypted computations on values ​​defined modulo a relatively large modulus, an example of which will be given later.

[0032] Selective carry reduction can significantly reduce the number of carry reduction operations required; for example, compared to existing approaches, encrypted computations can be performed with far fewer programmable bootstrapping applications, thereby greatly improving efficiency. For instance, multiple additions, other linear operations, or even multiplications of encrypted values ​​can be performed without carrying reduction in between. Various parameters, including the message modulus, the carry message modulus, and encoding to partial values ​​of the plaintext during encryption, can be modified. This offers the possibility of optimizing the homomorphic evaluation of a given encrypted computation, improving flexibility and performance.

[0033] Furthermore, the techniques provided offer improved parallelism. Since the output of an operation may have a carry, carry reduction between steps can be avoided, and thus one or a series of encrypted operations can be performed in parallel for each subvalue. For example, when using radix-based encoding, addition can be performed individually for each subvalue. When using remainder-based encoding, multiplication and carry reduction can also be parallelized. This improves performance, especially in multithreaded and multicore systems.

[0034] Specifically, the aforementioned paper, "Putting up the Swiss army knife of homomorphic calculations by means of TFHE functional bootstrapping," proposes sequential addition, encrypting the elements of decomposition using at least two PBSs per ciphertext. In comparison, the technique provided allows for the implementation of addition only when carry reduction of that ciphertext is required, using only one PBS per ciphertext; and when carry reduction is not required, the addition can be fully parallelized. Furthermore, compared to their proposed multiplication, the technique provided is more efficient and can be parallelized more effectively.

[0035] Generally, encrypted computations may be performed in a TFHE setting. This means that the ciphertext used to encrypt the subvalues ​​enables programmable bootstrapping operations. In particular, the ciphertext may be LWE (Learning With Errors) encryption, i.e., encryption based on the cryptographic assumption that the Learning With Errors problem is difficult. As is known in itself, programmable bootstrapping can evaluate LWE decryption on the exponent of a GLWE-encrypted monomial, implemented, for example, as a so-called blind rotation. In particular, programmable bootstrapping may involve computing the encrypted polynomial product of a bootstrapping monomial that expresses the plaintext values ​​as exponents and a test polynomial. The test polynomial may represent a function applied to the input by the programmable bootstrapping. Programmable bootstrapping may use a bootstrapping key that enables programmable bootstrapping but does not enable the decryption of the ciphertext. Encrypted carry reduction, and / or one or more encrypted operations of encrypted computations, may be implemented using programmable bootstrapping operations.

[0036] Instead of using LWE / GLWE type ciphertexts, various lattice encryption methods can also be used. For example, a ciphertext to which blind rotation is applied, and / or the encrypted polynomial product obtained therefrom, can be an NTRU ciphertext. For example, NTRU encryption of a message μ may be defined by adding the quotient of a noise polynomial g and a private key polynomial f to the message, for example,

number

number

[0037] In one embodiment, the ciphertext to which the blind rotation is applied may be an LWE type ciphertext. For example, the blind rotation may be part of an encrypted computation performed on an LWE type ciphertext (e.g., without including an NTRU type ciphertext). Alternatively, an LWE type ciphertext may be obtained by a transformation from an NTRU type ciphertext, for example, as part of an encrypted computation performed on an NTRU type ciphertext. It is also possible to apply the blind rotation directly to an NTRU type ciphertext without converting it to LWE. More generally, the ciphertext may be a lattice-type ciphertext whose security is determined by the strength of the cipher in the lattice problem, with LWE and NTRU being two examples.

[0038] In one embodiment, the output value may be calculated by performing a series of encrypted operations on a set of encoded and encrypted values, the encrypted operations being performed without any encrypted carry reduction between or during the encrypted operations. For example, the encrypted operations may include a series of additions and / or multiplications. For example, performing an encrypted calculation may include evaluating an arithmetic circuit that includes encrypted operations. The arithmetic circuit may have, for example, a multiplication depth of at least 2 (meaning that the output of one multiplication is used directly or indirectly as the input to another multiplication) or at least 3. By enabling carry, such calculations may, in some cases, be performed without carry reduction between them, or with less carry reduction in any case, thereby providing a significant performance improvement.

[0039] In one embodiment, encrypted operations may be performed by individually applying a sub-operation to the encryption of each sub-value of the input value. In particular, performing encrypted operations may consist solely of performing these sub-operations. This may be the case, for example, in the case of linear operations or multiplication when using a remainder representation. In one embodiment, the individually applied encrypted operations may be performed at least partially in parallel, which is advantageous in terms of performance, especially in the case of multithreaded and multicore systems.

[0040] In one embodiment, encoding a value as a partial value without carry is based on the radix decomposition of the value. In other words, a value encoded by a set of partial values ​​with and without carry may be computable by reducing the carry of the partial values ​​with carry and reconstructing the value from the radix decomposition. The radix decomposition may be about the base of each base element, with each message modulus corresponding to each base element. Encoding using radix decomposition allows for relatively efficient performance of various parts of the encrypted computation, particularly arithmetic operations such as addition and / or multiplication and / or division; comparison operations, such as determining which of two values ​​is greater; and also carry reduction.

[0041] A base element can define an overall modulus corresponding to the product of its respective base elements. Therefore, a radix decomposition with a given base can be used to encode a value modulo its overall modulus. Furthermore, as described elsewhere in this specification, it is also possible to use bases in combination with modulus smaller than the product of their base elements.

[0042] The base elements may all be the same; for example, they may all be equal to 2 for a base 2 radix decomposition, or they may all be equal to 5 for a base 5 radix decomposition. Interestingly, however, this is not required. In some embodiments, the base elements of the radix decomposition are not all the same. This provides much greater flexibility in selecting the base elements according to the size requirements of the current application, thereby reducing the overhead of using a modulus larger than necessary. In particular, the base elements do not all have to be the same power of 2, nor do they all have to be powers of 2. The inventors have found that the encrypted computation technique, particularly in TFHE settings, can also be applied to such more general settings.

[0043] In one embodiment, encrypted carry reduction may be performed in a radix decomposition setting, where the carry-bearing partial value of the output value is decomposed into the encrypted parts of each partial value, and the encrypted parts of each partial value are added to the encrypted part of the output value. In this way, the carry-bearing partial value can be reduced to a value lower than the message modulus. By repeating this process for each carry-bearing partial value, the encoding and encryption of the carry-free value can be obtained.

[0044] In one embodiment, encrypted multiplication of the encoded and encrypted values ​​by an unencrypted scalar may be performed. This encrypted multiplication can be implemented, for example, by using programmable bootstrapping to compute each encrypted subvalue of the scalar multiplication of the subvalues ​​of the encoded and encrypted values. When radix decomposition coding is used, the results of the encrypted multiplications may be combined to obtain the whole result. In this way, multiplication of relatively large scalars can be performed. For example, for smaller scalars, it is also possible to obtain each encrypted output subvalue by directly multiplying each encrypted subvalue by the scalar itself. When remainder coding is used, each product of each subvalue may form the whole result.

[0045] In one embodiment, the encrypted multiplication of the first encoded and encrypted value and the second encoded and encrypted value may be performed by performing an encrypted multiplication of the encryption of the partial values ​​of the first and second encoded and encrypted values. In a radix decomposition setting, the encrypted multiplication of the encryption of the partial values ​​may result in the encoded and encrypted values. These encoded and encrypted values ​​may be summed up to obtain the overall result. During the multiplication, carry reduction may be performed as needed, as indicated by the degree of fullness calculated, for example, as described herein. Interestingly, this method enables particularly effective multiplication of large encrypted values.

[0046] In one embodiment, a value encoded and encrypted using radix decomposition coding is defined modulo a modulus smaller than the maximum value representable by radix decomposition, e.g., the product of the base elements. Thus, the number of situations in which radix decomposition coding can be used is greatly improved. In terms of efficiency, radix decomposition coding preferably uses small base elements, in which case the maximum representable value is the product of such small base elements. Interestingly, the inventors have found that radix decomposition coding can still be used even when calculations modulo a modulus other than the product of small base elements are desired. Various encrypted operations can be performed in the same way as when acting modulo the product of the base elements, except that the encrypted carry reduction of the top-level submessage can be adapted by modifying the carry reduction according to the desired modulus. For example, the modification may be performed by multiplying the top-level partial value by a scalar and subtracting the result from the value from which the top-level partial value has been removed.

[0047] In one embodiment, the encoding of a value as a carry-free partial value may be based on a remainder-based representation of the value. Such a representation is also known as the CRT (Chinese Remainder Theorem) representation. This representation may be based on a set of disjoint base elements. For example, each partial value of the encoded and encrypted value may have a message modulus corresponding to the base elements.

[0048] In particular, the values ​​encoded and encrypted with the carry are the respective message modulus β. i According to the CRT decomposition using the respective partial values ​​m i m i mod β i It can correspond to a partial value by following the modulo reduction (carry reduction).

[0049] Similar to radix representation, linear arithmetic operations can be efficiently implemented using CRT representation. Interestingly, CRT representation can also enable particularly efficient multiplication and carry reduction, both of which can be performed individually on each subvalue and therefore parallelizable. Furthermore, various other types of operations, such as the application of single-variable functions, can also be performed using CRT representation.

[0050] In one embodiment, the encoding of a value as a carry-less partial value may be based on a remainder system representation, and further on the cardinal decomposition of the elements of the remainder system representation. This approach is referred to herein as the “hybrid” approach. For example, one, more, or all elements of the remainder system may be cardinal decomposed according to their respective (different or equal) bases. Using the hybrid approach, it is possible to efficiently use the CRT approach with relatively large CRT base elements.

[0051] In one embodiment, when encoding an element of a remainder representation using radix decomposition, the modulus (i.e., the corresponding base element of the CRT base) that defines this element may be smaller than the maximum value that can be represented by radix decomposition. Furthermore, as generally described with respect to radix decomposition, radix decomposition can still be used in such cases and is applicable to a wider range of cases. This combination is particularly beneficial because it allows for a better combination of the essential requirement (desiderata) of having disjoint base elements of the CRT and the essential requirement of having a radix decomposition that uses small base elements.

[0052] Several advantages of using CRT representations, particularly efficient and parallelizable encrypted linear and multiplicative operations, also apply when no carry is used with respect to the inputs and outputs of encrypted operations, for example, when encrypted carry reduction is used only within the encrypted operation; when encrypted carry reduction is used immediately after each encrypted operation, resulting in a carry-free output; or when the encrypted operation does not involve any carry at all, for example, when implemented using programmable bootstrapping without carry. It is also conceivable to have cryptographic computation methods that use CRT but do not involve encrypted operations applied to values ​​encrypted and encoded without carry.

[0053] In particular, a cryptographic computation method can be conceivable that includes accessing one or more encoded and encrypted values, wherein the encoding of the value as a carry-free partial value is based on a remainder-based representation of the value; and applying an encrypted operation to at least an encoded and encrypted input value to obtain an encoded and encrypted output value. Cryptographic devices corresponding to this method can also be conceivable.

[0054] In one embodiment, performing encrypted computation with carry may involve tracking the filliness of the subvalues ​​of the encoded and encrypted value. Filliness may represent, for example, the limit of the subvalues, expressed as the maximum value that the subvalue is known to have, or the ratio of the maximum value to the carry message modulus. For example, for an encoded and encrypted value without carry, filliness may indicate that its subvalue is less than the corresponding message modulus. For an encoded and encrypted value with carry, filliness may indicate that at least one of its subvalues ​​may be greater than or equal to the corresponding message modulus, in other words, it is not guaranteed that it will be less than the message modulus.

[0055] Filling may be used to determine whether to perform encrypted carry reduction on encrypted subvalues ​​during and / or between encrypted operations. In particular, filling may be determined with respect to a carry subvalue that should be calculated in an encrypted operation from one or more input encrypted subvalues. If the limit indicated by filling exceeds the corresponding carry message modulus, encrypted carry reduction may be applied to one or more input encrypted subvalues ​​before calculating the carry subvalue, so that the limit of the carry subvalue no longer exceeds the carry message modulus. Thus, subvalue overflow can be avoided.

[0056] Interestingly, tracking the degree of filling during encrypted computation provides a flexible way to perform encrypted computation, allowing for adaptive decisions on whether or not to perform encrypted carry reduction. The decision may therefore depend on the current input, such as the public scalar used in the computation, the limits of the encrypted input provided by the inputter, or the degree of filling in a particular iteration of an iterative algorithm. This generally leads to more efficient execution of encrypted computation. Furthermore, identifying encrypted computation becomes easier, as there is no need for explicit specification of when to perform carry reduction. This makes the techniques offered particularly well-suited to those outside the expertise of encrypted computation.

[0057] For example, an encrypted computation may be performed such that, in the first execution, encrypted carry reduction is performed on certain encrypted subvalues, while in the second execution, this encrypted carry reduction is avoided. Furthermore, multiple encrypted computations may or may not include encrypted carry reduction, depending on the degree of filling of their inputs. For instance, an encrypted multiplication or other encrypted operation may include encrypted carry reduction on encrypted subvalues ​​computed during the operation in the first execution of a multiplication, but not in the second execution.

[0058] A further aspect of the present invention provides a compiler method and device as defined by the claims. As the inventors have noticed, tracking the degree of filling during encrypted computation is not required. Many of the advantages of using the degree of filling can also be achieved when the degree of filling is calculated as part of a compiler method that compiles the computation into a homomorphic executable file. That is, this homomorphic executable file may enable the efficient execution of encrypted computation by performing encrypted carry reduction operations only when necessary. The homomorphic executable file may be executable by a cryptographic computation engine that causes the cryptographic computation engine to perform encrypted computations on one or more sets of encoded and encrypted values, as described herein. The homomorphic executable file may include, for example, one or more instructions for performing encrypted carry reduction operations, as described herein, as part of or between the execution of encrypted computations. The compiler method may include determining a degree of fill that indicates a limit on the carry portion value to be computed; and, if the limit exceeds the corresponding carry message modulus, generating an instruction to cause the cryptographic computation engine to apply encrypted carry reduction before computed the carry portion value. The compiler method may also include optimizing one or more parameters of the encrypted computation, such as numbers and values ​​relating to the message and carry message modulus, for the encrypted computation to be compiled into an executable file.

[0059] In one embodiment, one or each message modulus is not a power of 2. Existing techniques for encrypted computations, particularly in TFHE settings, generally use powers of 2 with respect to their modulos, but the inventors have found that this is not necessary and the provided techniques can be used even when one or more message modulos are not powers of 2. Alternatively, or in addition, in one embodiment, one or more of the carry message modulos are not powers of 2. This allows for better tailoring of the computation to the current situation, for example, computations on the current input values ​​and computations on values ​​defined modulo a modulus that matches the range.

[0060] In one embodiment, the message modulus is at least 3, and / or at least 5, and / or at least 10. Using a larger value for the message modulus has the advantage of having higher precision for a single ciphertext and requiring less ciphertext to represent the value. It can also lead to more efficient computation, particularly computation without carry reduction.

[0061] In one embodiment, the carry message modulus may be at least 4 times, at least 8 times, or at least 32 times larger than the corresponding message modulus. Thus, in bitwise representation, this may substantially provide at least 2, at least 3, or at least 5 carry bits. By using a carry message modulus that is significantly larger than the message modulus, the number of operations that can be performed before carry reduction is required, or the number of substeps of operations, is increased, thereby increasing efficiency.

[0062] In one embodiment, one or each carry message modulus is at most 128, at most 256, or at most 512. The efficiency of operations such as carry reduction using programmable bootstrapping typically scales less linearly than linearly with respect to the size of the carry message modulus. By keeping the carry message modulus limited, the computational cost of such operations remains limited.

[0063] In one embodiment, the modulus defining the encrypted value is at least 1024, at least 4096, or at least 16384. Interestingly, despite the use of such large modulos, the technique provided still allows for relatively efficient computation for those values.

[0064] In one embodiment, function evaluation may be applied to one or more encoded and encrypted values ​​by extracting one or more bits from one or more subvalues ​​of the encoded and encrypted values; converting the extracted bits into a GGSW ciphertext; and applying a lookup table to the GGSW ciphertext. As described in more detail elsewhere, this is a particularly efficient way to implement the function, especially for relatively large values, such as values ​​with a relatively large number of message and / or carry message modulos and / or subvalues.

[0065] In one embodiment, an encrypted computation may, at some point, involve the evaluation of a multivariable function (e.g., a two-variable function) on multiple encrypted input values, such as subvalues. An important example of a multivariable function is the encrypted multiplication of the encryptions of first and second subvalues, for example, the same encoded and encrypted values ​​or different encoded and encrypted values. For example, such an encrypted multiplication may occur as part of an encrypted multiplication of encoded and encrypted values, or as part of a different type of encrypted operation. In either case, the evaluation of the multivariable function may be done by determining a combined encryption that represents each encrypted input value; and by applying a one-variable function to the combined encryption (which corresponds to applying a multivariable function to each input value), for example, by applying programmable bootstrapping to the combined encryption.

[0066] This is a particularly efficient method for performing multivariable function evaluation and combines well with determining the degree of packing and using carries. In particular, when input values ​​are encrypted with carries, there can indeed be enough room in the plaintext space to store the combined encryption. Encrypted carry reduction may be performed if necessary to ensure that the combined encryption does not overflow the carry message modulus.

[0067] The techniques provided for improved computation on encrypted data can be applied to a wide range of practical applications. Such practical applications include performing encrypted evaluations of software programs in a state where plain data is inaccessible. For example, medical diagnostic software can be evaluated with respect to medical data in a state where medical data is not actually accessible. Medical data may include medical images. Medical images may include, for example, multidimensional image data, such as 2D, 3D, or 4D images, acquired by various acquisition modalities such as standard X-ray imaging, computed tomography (CT), magnetic resonance imaging (MRI), ultrasound (US), positron emission tomography (PET), single-photon emission computed tomography (SPECT), and nuclear medicine (NM), but are not limited to these.

[0068] In one embodiment, the techniques provided may be used to evaluate a neural network on encrypted input. Those evaluating the neural network may or may not have access to the neural network's trained parameters, such as weights and biases, in plaintext. Generally, the techniques provided herein, such as improved polynomial multiplication, programmable bootstrapping, and external product, improve the efficiency of evaluating neural networks and / or reduce the memory and transmission requirements for the ciphertext or key material used.

[0069] Embodiments of the method may be implemented on a computer as a computer implementation method, in dedicated hardware, or a combination of both. Executable code relating to embodiments of the method may be stored in a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, and online software. Preferably, the computer program product includes non-temporary program code stored on a computer-readable medium to perform embodiments of the method when the program product is executed on a computer.

[0070] In one embodiment, the computer program includes computer program code configured to perform all or part of the steps of the embodiment of the method when the computer program is executed on a computer. Preferably, the computer program is embodied on a computer-readable medium.

[0071] Further details, aspects, and embodiments are described only as examples with reference to the drawings. Elements in the drawings are illustrated for brevity and clarity and are not necessarily drawn to a uniform scale. Elements in the drawings that correspond to elements already described may have the same reference numeral. [Brief explanation of the drawing]

[0072] [Figure 1a] This is a schematic diagram showing an example of an embodiment of an encryption device. [Figure 1b] This is a schematic diagram of an example of one embodiment of a compiler device. [Figure 1c] This is a schematic diagram showing an example of an embodiment of an encryption computing system. [Figure 2a] This is a schematic diagram illustrating an example of a lookup table for programmable bootstrapping. [Figure 2b] This is a schematic diagram illustrating an example of a lookup table for programmable bootstrapping. [Figure 3a] This is a schematic diagram showing an example of a partial value with a carry. [Figure 3b] This is a schematic diagram illustrating an example of adding partial values ​​with carry. [Figure 3c] This is a schematic diagram illustrating an example of scalar multiplication of partial values ​​with carry. [Figure 3d] This diagram schematically illustrates an example of an encrypted multiplication operation embodiment for the encryption of first and second partial values. [Figure 4] This is a schematic diagram showing an example of a value encoded and encrypted based on radix decomposition. [Figure 5]This is a schematic diagram showing an example of a value encoded and encrypted based on a remainder representation. [Figure 6] This is a schematic diagram illustrating an example of a value encoded and encrypted using a modulus smaller than the maximum value representable by radix decomposition, based on radix decomposition. [Figure 7] This is a schematic diagram showing an example of values ​​encoded and encrypted based on a residue-based representation, and further based on the radix decomposition of the elements of the residue-based representation. [Figure 8] This is a schematic diagram of an example of an embodiment of an encryption method that performs encrypted calculations. [Figure 9] This is a schematic diagram showing an example of one embodiment of a compiler method. [Figure 10] This is a schematic diagram showing a computer-readable medium having a writable portion according to one embodiment. [Figure 11] This is a schematic diagram showing a representation of a processor system according to one embodiment. [Modes for carrying out the invention]

[0073] While the subject matter disclosed herein can be implemented in many different forms, one or more specific embodiments are shown in the drawings and described in detail herein. It should be understood that this disclosure is intended to be illustrative of the principles of the subject matter disclosed herein and is not intended to limit itself to the specific embodiments shown and described herein.

[0074] In the following, for the sake of clarity, the elements of the embodiment will be described in terms of their operation. However, it will be clear that each element is configured to perform the function described as being performed by them.

[0075] Furthermore, the subject matter disclosed herein is not limited to embodiments, but also includes any other combination of features described herein or described in any other dependent claims.

[0076] First, some general information and notation applicable to several embodiments are presented. Throughout this specification, the parameter q represents the modulus of the encoded and encrypted value, for example, a positive integer.

number

number

number

number

number

number

number

[0077] The Chinese Remainder Theorem (CRT) states the following: Let R be a ring, and some

number

Number

[0078] In this specification, CRT represents a morphism from \(R\) to \(R / I_0\times R / I_1\times\cdots\times R / I_n\). The inverse CRT, denoted as iCRT, maps \(R / I_0\times R / I_1\times\cdots\times R / I_n\) to \(R\). n In this specification, CRT represents a morphism from \(R\) to \(R / I_0\times R / I_1\times\cdots\times R / I_n\). The inverse CRT, denoted as iCRT, maps \(R / I_0\times R / I_1\times\cdots\times R / I_n\) to \(R\). n to \(R\).

[0079] Various embodiments use LWE (Learning With Errors) encryption. Generally, an LWE type ciphertext may include one or more mask values and a body value derived from the mask value and the plaintext value. The values are typically integers modulo a given modulus \(q\). Various embodiments also use GLWE (Generalized Learning With Error) type ciphertexts. A GLWE type ciphertext may include one or more mask polynomials and a body polynomial derived from the mask polynomial and the plaintext polynomial. A GLWE type ciphertext may be defined modulo \(q\) and a quotient polynomial \(p(X)\). An LWE ciphertext can be regarded as a particular type of GLWE ciphertext where the quotient polynomial has degree 1. Another particular type of ciphertext is the RLWE (Ring Learning With Errors) ciphertext where the number of mask polynomials is 1.

[0080] Specifically, the GLWE ciphertext of the message

Number

Number

Number

number

number

number

number

number

number

[0081] Throughout this specification, an integer q is used to represent the ciphertext modulus, but it should be noted that multiple ciphertext modulos may be used in encrypted multiplication. For example, modulus switching may be used to align ciphertexts under the same q, as needed.

[0082] The above example illustrates a GLWE private key, a symmetric variant. The techniques provided herein also apply to variants of public keys known in themselves. In the latter case, for example, the above private key may be used as a private key, and the public key may contain one or more zeros. See, for example, R. Rothblum, "Homomorphic encryption: From private-key to public-key," Theory of Cryptography (TCC 2011), vol. 6597 of Lecture Notes in Computer Science, pp. 219-234, Springer, 2011 (incorporated herein by reference).

[0083] Various embodiments operate in a TFHE setting, which means that ciphertexts supporting programmable bootstrapping (PBS) are used. Programmable bootstrapping can take a ciphertext as input and output a ciphertext of the same message, including noise independent of the input, or a function of that message. PBS may involve evaluating homomorphic decryption of the input ciphertext in polynomial exponents. In general, TFHE-like schemes allow for the selection of a secure set of cryptographic parameters to minimize computational cost while fitting the required precision. Interestingly, such parameters can be selected independently of the amount of homomorphic operation and the depth of the circuit being evaluated. Examples of cryptographic schemes in a TFHE setting that can be combined with the techniques provided herein are listed in the following references: - [DM15] L. Ducas et al., "FHEW: bootstrapping homomorphic encryption in less than a second", proceedings EUROCRYPT 2015; - [CGGI16] I. Chillotti et al., “Faster fully homomorphic encryption:Bootstrapping in less than 0.1 seconds”, proceedings ASIACRYPT 2016; - [CGGI17] I. Chilotti et al., “Faster packed homomorphic operations and efficient circuit bootstrapping for TFHE”, proceedings ASIACRYPT 2017; - [BIPPS22] C. Bonte et al., "FINAL: Faster FHE instantiated with NTRU and LWE", Cryptology ePrint Archive, Paper 2022 / 07.

[0084] Various embodiments deal with performing encrypted computations on encrypted values ​​as partial-value encryption. In this specification, these values ​​are typically represented, for illustrative purposes, as integers modulo a particular modulus. Such values ​​modulo integers can be considered equivalent to elements of a discretized torus, as done in some of the references listed above. In particular, various references deal with the real-number torus

number

number

number

number

number

[0085] The programmable bootstrapping operation in TFHE-like schemes makes them an attractive choice for a wide range of applications. Bootstrapping is relatively efficient compared to many other FHE schemes, making it far more feasible to perform relatively complex calculations with multiplication depths of, for example, at least 10, at least 50, or at least 100. In particular, the cryptographic parameters of TFHE-like schemes can be selected based on the desired precision and the resulting computational cost, regardless of the amount of homomorphism and their circuit depth. In contrast, with other FHE schemes, bootstrapping is highly inefficient; in fact, these schemes are typically applied in a leveled manner, meaning their parameters are selected according to the given calculation so that it can be performed without the need for bootstrapping. However, such a leveled approach is not feasible for more complex calculations, and therefore, in such cases, TFHE-like schemes are particularly beneficial.

[0086] In general, the security of GLWE-based ciphertexts is based on the distribution of the secret key and the following three main parameters: n = kN, where N is the degree of the quotient polynomial, k is the number of random mask polynomials in the ciphertext, and n is the length of the secret key; q is the modulus; and σ is a statistical parameter of noise, e.g., its standard deviation. Given these parameters, methods for estimating the degree of security provided are known in themselves. For example, see M. Albrecht et al., "On the concrete hardness of Learning with Errors," Journal of Mathematical Cryptology, 9(3):169-203, 2015 (incorporated herein by reference).

[0087] In the embodiments herein, the parameters of the TFHE-like LWE-based and GLWE-based ciphertexts used can be selected based on a desired security level and the desired precision of operations such as linear combination and / or application of programmable bootstrapping of LWE ciphertexts, in other words, the noise level resulting from the application of these operations. Interestingly, in TFHE settings, security parameters can be selected independently of computational complexity, for example, independently of the multiplication depth of the computation. This differs from non-TFHE-like schemes, where security parameters are typically chosen to restrict or eliminate bootstrapping.

[0088] In particular, the LWE-based ciphertexts and / or GLWE-based ciphertexts used in the TFHE configurations herein may use relatively small modulos, for example, up to 32 bits, up to 64 bits, or up to 128 bits. This modulus is typically selected independently of the computation to be performed, for example, according to the desired precision and / or efficiency. The parameters N, k, and / or σ can also typically be selected, again independently of the computation to be performed, to achieve the desired level of security. For example, N may be set to at least 512 and / or up to 2048 or 4096, e.g., 1024. For example, in one embodiment, RLWE is used with N at least 512 and / or up to 2048 or 4096, e.g., 1024, and k=1. Such values ​​for N are typically not used in non-TFHE-like cryptographic schemes, where such values ​​would severely limit the computations that can be performed; instead, in non-TFHE-like schemes, both q and N are typically selected based on the desired level of security, and therefore q may be much larger.

[0089] Figure 1a schematically shows an example of an embodiment of the encryption computing device 110. The device 110 may be used to perform encrypted calculations on one or more sets of encoded and encrypted values.

[0090] Encoded and encrypted values ​​may be encoded and encrypted as multiple partial values, each having a corresponding message modulus and a carry message modulus greater than the message modulus. One or more of the encoded and encrypted values ​​may be encoded and encrypted without a carry. In this case, the partial values ​​without a carry may be less than the corresponding message modulus. One or more of the encoded and encrypted values ​​may be encoded and encrypted with a carry. In this case, at least one partial value with a carry may be greater than or equal to the corresponding message modulus. The remaining zero or more partial values ​​may be partial values ​​without a carry.

[0091] Device 110 may comprise a processor system 130, storage 140, and a communication interface 150. Storage 140 may comprise local storage, such as a local hard drive or electronic memory. Storage 140 may also comprise non-local storage, such as cloud storage. In the latter case, storage 140 may comprise a storage interface to the non-local storage. For example, storage 140 may be for storing one or more computed encoded and encrypted values. Storage 140 may also include additional data for use in blind rotation, such as a bootstrapping key, as discussed elsewhere.

[0092] Device 110 can communicate internally with other devices, external storage, input devices, output devices, and / or one or more sensors over a computer network. The computer network may be the Internet, an intranet, a LAN, a WLAN, etc. The computer network may be the Internet. The device may optionally have a connection interface 150 configured to communicate with other devices when necessary. For example, the connection interface may include a connector, such as a wired connector, such as an Ethernet connector or an optical connector, or a wireless connector, such as an antenna, such as a Wi-Fi, 4G, or 5G antenna. Communication, such as internal communication, may use other communication protocols or media, such as an internal data bus.

[0093] In device 110, the communication interface 150 may be used to transmit or receive digital data. For example, device 110 may be configured to receive or transmit data representing one or more encoded and encrypted values ​​and / or LWE encryption, for example, representing the input and / or output of an encrypted computation. In another example, the communication interface 150 may be used to receive data representing a bootstrapping key.

[0094] The operation of device 110 may be carried out by a processor system 130, for example, one or more processor circuits, such as a microprocessor, examples of which are shown herein. Device 110 may have multiple processors, and the processors may be distributed in different locations. For example, device 110 may use cloud computing.

[0095] The processor subsystem 130 may be configured to apply encrypted operations to an input value encoded and encrypted with at least one carry to obtain an output value encoded and encrypted with one carry. The processor subsystem 130 may be further configured to apply encrypted carry reduction to the output value encoded and encrypted with one carry to obtain further encoding and encryption of the output value in which at least one carry-carried subvalue has been reduced to a carry-free subvalue.

[0096] The processor subsystem 130 may be configured to obtain one or more inputs to an encrypted computation, the inputs including, for example, one or more encoded and encrypted values ​​and / or one or more encrypted but unencoded values, which the processor subsystem 130 can optionally convert to encoded and encrypted values ​​as described herein. The encoded and encrypted values ​​provided as inputs are typically encoded and encrypted without carry, although it is also possible in principle to obtain inputs with carry. Along with the inputs, the processor subsystem 130 may obtain limits on the encrypted values, for example, the degree of filling.

[0097] The processor subsystem 130 may be configured to output one or more outputs of an encrypted computation, the outputs including, for example, one or more encoded and encrypted values ​​and / or one or more encrypted but unencoded values, which are determined, for example, by the processor subsystem 130 converting the encoded and encrypted values ​​to encrypted values ​​as described herein. When outputting encoded and encrypted values, the processor subsystem 130 may be configured to apply an encrypted carry reduction operation to output encrypted and encoded values ​​without carry.

[0098] For example, the processor subsystem 130 can obtain inputs to and from the storage 130, and / or outputs to and from other stakeholders, via the communication interface 150.

[0099] Some of the figures show functional units that may constitute functional units of a processor system. For example, the figures can be used as a blueprint for the organization of possible functions of a processor system. In most figures, the processor circuitry is not shown separately from the units. For example, the functional unit shown in Figure 2-6 (see below) may be implemented entirely or partially in a device such as device 110, for example, with computer instructions that are stored in the electronic memory of device 110 and can be executed by the microprocessor of device 110. In a hybrid embodiment, the functional unit is partially implemented in hardware, for example, as a coprocessor, for example, an arithmetic and / or cryptographic coprocessor, and partially implemented in software that is stored and executed in device 110.

[0100] For example, device 110 may be a device for performing encrypted calculations. Encrypted calculations may use homomorphic encryption. For example, device 110 may be used to perform encrypted calculations, even if the data is received in encrypted form, for example, from a data provider, and even if device 110 cannot decrypt the data. The calculations may include encrypted operations and / or carry reduction as described herein.

[0101] For example, storage 140 may store encrypted data items received from, for example, one or more data providers, or generated as intermediate or final results of a computation, such as output. Typically, almost all or all data items on which device 110 performs calculations are encrypted using a key unknown to device 110. That is, device 110 may not be configured to obtain plain data items corresponding to encrypted data items, such as those stored in storage 140. The encryption / decryption key may be available in encrypted form, but the decryption key in plain form is secret to device 110.

[0102] For example, a processor system may be configured to perform a sequence of homomorphic cryptographic operations. Encrypted operations may include linear operations such as addition, subtraction, and / or scalar multiplication; multiplication; single-variable function evaluation; etc. Interestingly, using the provided technique, multiple encrypted arithmetic operations, such as arithmetic circuits with multiplication depths of at least 2, at least 3, or at least 5, can be performed on a set of encoded and encrypted values, and such operations do not involve encrypted carry reduction.

[0103] Figure 1b schematically shows an example of an embodiment of compiler device 119 for compiling a computation into a homomorphic executable file. The homomorphic executable file may be executable by a cryptographic computation engine, which causes the cryptographic computation engine to perform an encrypted computation on one or more sets of encoded and encrypted values, for example, as described herein by device 110 in Figure 1a. The homomorphic executable file may contain one or more instructions for performing an encrypted carry reduction computation, as described herein, for example, as part of or between the execution of an encrypted computation. Device 119 can perform the encrypted computation itself, and for example, device 110 in Figure 1a may be combined with device 119 in Figure 1b.

[0104] Device 110 may include a processor system 139, storage 149, and a communication interface 159. The processor system 139, storage 149, and communication interface 159 may be implemented as discussed for each component in Figure 1a. Storage 149 may be for storing descriptions of homomorphic computations to be compiled into a homomorphic executable file, stored, for example, as program code or instruction graphs. Communication interface 159 may be used to receive computations to be compiled. Communication interface 159 may be used to send homomorphic executable files.

[0105] The processor subsystem 139 may be configured to generate a homomorphic executable file by translating operations into homomorphic computation instructions, as is known by itself in the Art. Interestingly, the processor subsystem 139 may be configured to track the degree of filling of the encoded and encrypted partial values ​​used in the encrypted computation. In this way, encrypted carry reduction operations may be included in the homomorphic executable file, where necessary. In particular, the processor system 139 may be configured to determine a degree of filling that indicates a limit on the carry partial value to be computed. If the limit exceeds the corresponding carry message modulus, the processor subsystem 139 may generate an instruction that causes the cryptographic computation engine to apply an encrypted carry reduction before computed the carry partial value. The processor subsystem 139 may be configured to optimize one or more parameters of the encrypted computation, such as numbers and values ​​relating to the message and carry message modulus, with respect to the encrypted computation compiled into an executable file.

[0106] Figure 1c schematically shows an example of an embodiment of the cryptographic computation system 100. The system 100 is configured to perform encrypted computations using homomorphic encryption, such as fully homomorphic encryption.

[0107] In this example, system 100 comprises a compiler device 111, a data provider device 113, and an encryption computing device 112. The compiler device 111 may be combined with the encryption computing device 112 or the data provider device 113 into a single device. Device 112 may be configured to receive encrypted data items from the data provider 113. At least one or more data items may be received in encrypted form. One or more additional data items may be received in plain form. Device 112 may be configured to receive a homomorphic executable file from the compiler device 111 for performing encrypted computations.

[0108] Device 112 can perform the calculations described herein on received data items, and possibly on stored data items. Interestingly, the calculations can be performed by the device on encrypted data without decrypting the data, for example, without converting encrypted data items into plain format data.

[0109] In this example, device 112 may be based on device 110 in Figure 1a, and may comprise, for example, the processor system 130, storage 140, and / or communication interface 150 of Figure 1a. Devices 111, 112, and 113 may each be based on device 119 in Figure 1b, and may each comprise, for example, the processor system 139, storage 149, and / or communication interface 159 of Figure 1b.

[0110] Optionally, the compiler device 111 or the data provider device 113 may be further configured to generate key material for the cryptographic computing device 112 to perform encrypted computations, including a bootstrapping key for performing programmable bootstrapping, such as as discussed herein. The key material generating device can provide the bootstrapping key 151 to device 112, for example, by transmitting it over the computer network 150 or uploading it to shared storage. The key material may be generated by a separate key generation device (not shown in this figure).

[0111] Although not shown in this figure, the cryptographic computing system 100 may comprise multiple, for example, two, three, or four or more cryptographic computing devices. Encrypted computations may be distributed among multiple cryptographic computing devices. Cryptographic computing devices may typically exchange encrypted intermediate computation results with each other, for example, as encoded and encrypted values ​​containing multiple encrypted subvalues. Each cryptographic multiplication device may be implemented similarly to cryptographic computing device 112 and may perform encrypted operations and / or encrypted carry reduction operations as described herein.

[0112] Homomorphic encryption schemes can be applied in many settings. For example, an encrypted computing device 112 may be operated by a cloud provider. The cloud provider may provide computing and storage services to its clients. By employing homomorphic encryption, a data provider device 113, for example, a client of the cloud provider, can send data in an encrypted format. The cloud provider can still perform the required computing and / or storage, but does not know what corresponds to the plain data. For example, the data provider device 113 may use an encryption key of a type corresponding to a particular homomorphic encryption system used to encrypt data items. When the computing results are received by the data provider 113 from the encrypted computing device 112, the corresponding decryption key may be used to decrypt the encrypted data items. The encryption key and the decryption key may be the same, and are typically the same.

[0113] For example, the cryptographic computing system 100 may be configured to train machine learning models, such as image classifiers or medical models, while the cryptographic computing device does not have access to plain data items. For example, linear regression may be performed on the input data, sometimes even without bootstrapping. For example, backpropagation may be performed on the input data, sometimes with bootstrapping. The resulting model parameters may be returned to the entity that owns the decryption key. This allows multiple providers of medical data to pool their data by sending their own data to a cloud provider. The cloud provider then returns the model parameters, while not having access to the plain data. The cryptographic key may be equal to the decryption key.

[0114] After the model is trained, the cryptographic computing system 100 can be used to provide a model for use, for example, with medical data. This may be done using plain model parameters or encrypted model parameters, in either case using encrypted data, such as encrypted input data, intermediate data, and output data. Typically, the use of plain model parameters is far more efficient. In either case, the effect of the system is that the computation, such as image classification, such as medical image classification, is performed without the computer knowing the plain data items. For example, a mammogram may be evaluated for cancer, but in the cryptographic computing device 112, the image is never plain, and no cryptographic computing device 112 or a coalition of such devices knows the result of the cancer evaluation. From a privacy perspective, it may be acceptable to compute a plain model on encrypted privacy-sensitive data, but it may not be acceptable to compute on plain privacy-sensitive data.

[0115] Other uses include database services, such as retrieving encrypted data in an encrypted database; for example, a calculation might involve comparing an input item with a database item. For example, multiple calculations might be combined to create a database index that matches an index. For example, the database could be a genome database and the input could be a gene sequence. For example, system 100 might be used for the protected control of a device. For example, a device, or even a large device such as a power plant, might send sensor values ​​to an encrypted computing device 112 and receive encrypted control signals in return. The control signals are calculated from the sensor signals. An attacker of the system might be able to determine the content of data to and from one or more encrypted computing devices 112, or even access intermediate data from these devices, but this would not help the attacker because the data is encrypted. Even if all encrypted computing devices 112 of system 100 are completely destroyed, the data will not be exposed because the decryption keys are not known to these devices. The calculation of control signals may involve mathematical operations such as linear algebra, averaging, matrix multiplication, and polynomial evaluation, all of which can be performed using homomorphic cryptographic operations. In any case, such applications involve calculations that involve arithmetic operations on relatively large values, which can be efficiently implemented as described herein.

[0116] For example, a pool of encrypted data items may be maintained within the cryptographic computing system; a subset of these may be received, and another subset may be the result of an encrypted computation, for example, an intermediate result. For example, the cryptographic computing device 112 may be configured to apply homomorphic cryptographic operations to one, two, or three or more encrypted data items in the pool, for example, a collection of input values ​​and / or intermediate values ​​and / or output values. The result may be a new encrypted data item that can be stored in the pool. For example, one or more values ​​may be encoded and encrypted, while zero or more other values ​​may be encrypted directly without encoding. The pool may be stored in the storage of the cryptographic computing system. This may be local storage or distributed storage. In the latter case, one or more encrypted data items may be displayed multiple times in the pool. Encrypted, in particular encoded and encrypted, data items may be sent from one computing device to another, for example, when their values ​​are needed elsewhere. The pool may be implemented in various forms, for example, as a register file, an array, various data structures, etc.

[0117] Encrypted data items can represent all types of data. For example, an encrypted data item might represent a number that needs to be averaged, or a number used in linear regression. For example, an encrypted data item might represent an image. For example, each pixel in an image may correspond to one or more encrypted data items. For example, a grayscale pixel may be represented by gray levels, and a gray level may be represented by a single encrypted data item. For example, 256 gray levels may be encoded within a single encrypted data item. For example, a color pixel may be represented as multiple color levels, such as RGB levels, and a color level may be represented by a tuple of encrypted data items. For example, three 256-level colors may be encoded as their respective encoded values, or as encoded and encrypted values.

[0118] A set of homomorphic cryptographic operations may be defined for computation. For example, from homomorphic cryptographic operations, a network or circuit of operations that implement the computation together may be constructed by a compiler device, such as described with respect to Figure 1b, or by the computation device itself. For example, the operations may include Boolean operations. The way in which the homomorphic cryptographic operations are combined, for example, which operations are applied to which operands in the pool, determines the computation to be performed. For example, the computation may be represented as a list of homomorphic cryptographic operations to be performed, along with an indication of which encrypted data items they are performed on. The network or circuit may indicate to the cryptographic computation device 112 when to perform encrypted carry reduction, and / or the cryptographic computation device 112 may decide whether to perform encrypted carry reduction operations based on tracking the degree of filling of the computed partial values.

[0119] Figures 2a and 2b schematically show an example of a lookup table for programmable bootstrapping.

[0120] In various embodiments, the encrypted computation is an encrypted computation in a TFHE setting. In this setting, the encryption scheme used, for example, LWE encryption, may support programmable bootstrapping operations. As is known, such programmable bootstrapping may evaluate LWE decryption in the exponent of a GLWE encrypted monomial. As is known, by using the respective test polynomial in the programmable bootstrapping operation, programmable bootstrapping may be used to evaluate various functions relating to the LWE encryption to which it is applied. As described elsewhere, programmable bootstrapping may be used to perform encrypted carry reduction, but it may also be used for various other operations, such as the evaluation of a single-variable function.

[0121] Here, an example of a programmable bootstrapping operation is discussed. Bootstrapping can evaluate a single-variable function while simultaneously reducing noise in the input ciphertext. Throughout this specification, the notation PBS is used to represent programmable bootstrapping. The function evaluated for the input may be represented as a lookup table (LUT). The lookup table may correspond to a test polynomial that may be multiplied by a GLWE-encrypted monomial. By computing the GLWE-encrypted monomial and multiplying it by the test polynomial, the lookup table may be effectively rotated to output the correct elements in the table.

[0122] A visual representation of the polynomials that store the LUT is shown in Figure 2a. In this example, an array is shown, and each element of the array, 201-204, is a polynomial.

number

[0123] In various cases, redundant lookup tables may be used. In particular, an r-redundant LUT may be used, where the coefficient is repeated r times consecutively for a given value r. This is shown in Figure 2b. In this example, the LUT for function f is represented as an array containing blocks 210, 211, and 212, each containing 16 iterations of each output value. A redundant PBS may be used to reduce noise in the input ciphertext.

[0124] PBS may use bootstrapping keys. Bootstrapping keys may involve GGSW encryption of each element of the secret key used to encrypt the input LWE ciphertext of PBS. Bootstrapping may involve modulus switching operations.

number

number

[0125] Throughout this specification, the following notation may be used to indicate that a programmable bootstrapping operation is being performed:

number

number

[0126] For example, using techniques known from "Programmable bootstrapping enables efficient homomorphic inference of deep neural networks," PBS can be performed at the following computational complexity levels:

number

number

[0127] Various existing implementations of programmable bootstrapping operations, such as the implementation in "Programmable bootstrapping enables efficient homomorphic inference of deep neural networks," can perform operations on input ciphertexts where the most significant bit is zero.

[0128] As an example, it is possible to use NTRU-type encryption on the input ciphertext and / or the encrypted polynomial product. More generally, the techniques provided are X N This can be applied to any bind rotation that yields an encrypted polynomial product of the test polynomial and the bootstrapping polynomial modulo a quotient polynomial different from +1, such as any accumulator-based blind rotation.

[0129] In particular, regarding the use of NTRU for encrypted polynomial products, it should be noted that the "blind rotation" algorithm discussed itself uses the abstract accumulator ACC. As discussed, this accumulator can be implemented based on GLWE, but this is not mandatory. Other types of accumulators based on NTRU are also possible, for example. Based on NTRU ciphertexts, gadget encryption similar to GGSW encryption can be defined, and the outer product can be defined using it. A detailed example can be seen in C. Bonte et al., "FINAL: Faster FHE instantiated with NTRU and LWE", https: / / ia.cr / 2022 / 074. Therefore, the accumulator may be implemented based on NTRU, and its value is, for example,

number

[0130] As an example, applying a blind rotation to an LWE ciphertext c that encrypts μ using this type of NTRU-based accumulator results in a specific scaled plaintext - m'·Δ in Bootstrapping monomials related to

number

number

number

number

[0131] Instead of, or in addition to, the encrypted polynomial, the input ciphertext does not need to be of the LWE type. In particular, as discussed in the "FINAL" references, blind rotation can be applied to NTRU type ciphertexts. As discussed in the "FINAL" references, it is also possible to obtain the input LWE ciphertext by transforming from an NTRU ciphertext.

[0132] Even in such cases, the test polynomial P is designed so that the encrypted polynomial product contains the desired output value at fixed coefficients. f It is desirable to define this.

[0133] Interestingly, the techniques provided herein can also be used in combination with unpadding programmable bootstrapping, meaning that the programmable bootstrapping can operate on input ciphertexts having any most significant bit. Such programmable bootstrapping is provided, for example, in I. Chillotti et al., "Improved programmable bootstrapping with larger precision and efficient arithmetic circuits for TFHE," proceedings ASIACRYPT 2021. In such cases, when using the Encode described elsewhere in this document,

number

number

[0134] Another method of performing programmable bootstrapping involves extracting each bit of the ciphertext and converting them into GGSW ciphertexts using, for example, the self-known circuit bootstrapping; and then applying a lookup table to each GGSW ciphertext. As is self-known, the latter can be performed particularly efficiently using mixed packing, such as horizontal and / or vertical packing. Furthermore, in this technique for performing programmable bootstrapping, padding bits may not be required, and for example, the most significant bit can hold any value. This technique will be discussed in more detail with respect to Figure 4.

[0135] Generally, programmable bootstrapping may involve key-switching operations performed such that the output ciphertext is encrypted under the same key as the input ciphertext. Throughout this specification, the notation PBS-KS may be used to represent such programmable bootstrapping that involves key switching. In this case, the key material PUB used for programmable bootstrapping may include the key-switching key for performing this key-switching. Generally, performing key-switching is optional. The complexity of PBS-KS is:

number

number

[0136] Figure 3a schematically shows an example of a partial value with a carry.

[0137] In various embodiments, a value may be encoded and encrypted as an encryption of a plurality of respective partial values, for example corresponding to each digit of a radix decomposition of the value. According to this correspondence, each partial value may be associated with a particular modulus called a message modulus. For example, when using a radix decomposition with base β, the message modulus may be set to β. Thus, a value may be encoded and encrypted by encoding it as partial values modulo a message modulus and encrypting these partial values.

[0138] However, interestingly, in various embodiments described herein, a partial value may be stored with a carry. This means that the partial value is defined modulo a carry message modulus p that is larger than the message modulus. Thus, a partial value may be larger than the message modulus.

[0139] Each partial value may be encrypted according to the same encryption key, but this is not necessary. In the latter case, various operations on the encoded and encrypted values, such as carry propagation described herein, may use key switching, for example, from the encryption key of one partial value to the encryption key of another partial value, as needed.

[0140] For example, as shown in FIG. 3a, a ciphertext may encrypt a value characterized by: - An optional padding bit 301 set to zero as the most significant bit; - A carry message modulus p, 302 and a message modulus β, 303 such that β ≤ p, for example a radix base (note that p and β need not be powers of two); - A value x, for example a value x without a carry smaller than β, or a value x with a carry that is β or greater and smaller than p.

[0141] For example, the carry message modulus p may be at least 4 times the message modulus β, at least 8 times the message modulus, or at least 32 times the message modulus. For example, the carry message modulus may be at most 128, at most 256, or at most 512. Given a message of a particular size (e.g., at most 8 bits or at most 16 bits), the remaining accommodation of the carry message modulus may be used for the carry.

[0142] For example, the figure shows a message modulus β = 4 = 2 2 and a carry message modulo p = 16 = 2 2+2 having values. Encryption using this message modulus and carry message modulus may have a 2-bit carry, which are set to 0 in the case of a carry-free value and can be advantageously used in encrypted operations.

[0143] For example, a carry-free value m scales the value according to the following algorithm and then the scaled version [Number] is encrypted, for example [Number] and by using it in [ ], it can be encrypted with LWE. This exemplary algorithm takes an integer between 0 and p and provides 1-bit padding and more accommodation for calculating leveled operations.

[0144] [Table 1]

[0145] Encrypted operations can increase the encrypted value, particularly making it greater than the message modulus. Specifically, the most significant part of the encrypted value (e.g., the most significant bit) corresponding to the value obtained by dividing the encrypted value by the message modulus may represent the carry, and is sometimes referred to herein as the “carry buffer.”

[0146] Two examples of this are shown with respect to Figures 3b and 3c. Figure 3b shows the calculation of an encrypted addition of two values ​​311, 312 encrypted without carry (for example, with carry buffer and padding bits set to zero). As shown in this figure, the value encrypted by the resulting ciphertext 313 may exceed the message modulus, i.e., its value may be a carry-included subvalue. In this particular case, as illustrated, the addition may consume one carry bit 314.

[0147] A further example is shown in Figure 3c. This figure illustrates scalar multiplication of an encrypted value 321 with no carry bits and a scalar (i.e., an unencrypted value) μ < β, resulting in an encrypted value 322. In this case, the number of carry bits 323 that may be affected is proportional to the size of the constant.

[0148] Returning to Figure 3a, as shown with respect to Figures 3b and 3c, various encrypted operations may result in values ​​encoded and encrypted with a carry; that is, values ​​having a carry-carry subvalue greater than or equal to the corresponding message modulus. Or at least, with respect to some subvalues, it may not be guaranteed that they do not contain a carry. While it is possible to directly perform an encrypted carry reduction operation on such carry-carry values ​​to reduce them to less than the message modulus, the inventors have found that this is not always necessary. In some cases, it is possible to leave the subvalues ​​encrypted with a carry and use such values ​​encoded and encrypted with a carry as input to another encrypted operation.

[0149] However, at some point, encrypted carry reduction may be necessary, for example, if the encrypted operation or sub-operation to be applied may result in a value exceeding the corresponding carry message modulus. Therefore, at some point during an encrypted computation, a decision may be made as to whether or not to perform encrypted carry reduction on the carry value.

[0150] Interestingly, to determine whether to perform encrypted carry reduction, the inventors considered tracking the degree of packing of the carry-bearing partial values ​​computed as part of the encrypted operation. The packing degree may indicate the limit of the carry-bearing partial values. The packing degree can be considered metadata associated with the ciphertext. The packing degree may indicate whether it is possible to apply an encrypted, e.g., leveled homomorphic operation to the ciphertext, or whether its carry needs to be emptied first. If it is still possible to compute the leveled operation, the packing degree can quantify the amount of leveled operation that can still be performed.

[0151] The degree of packing is typically calculated dynamically while performing encrypted computations, but may also be calculated by the compiler device, as discussed elsewhere. Tracking the degree of packing during computation is sometimes referred to herein as a “smart” variant of performing encrypted computations with encrypted carry reduction. Smart encrypted computations may automatically determine, by verifying certain conditions, whether the carry buffer must be emptied or whether another leveled operation can still be performed. In this sense, smart encrypted computations can be seen as an improvement over gated bootstrapping to a setting where partial values ​​do not need to be binary and carries can be preserved between encrypted operations, allowing for more leveled operations between bootstrappings. Interestingly, because smart encrypted computations can automatically determine whether to perform encrypted carry reduction, it may not be necessary to decide when to perform encrypted carry reduction during the design time of the encrypted computation.

[0152] In particular, ciphertext can be used to encrypt subvalues ​​at specific intervals defined by the packing density. The encrypted subvalues ​​may be used as input for leveled homomorphic operations, resulting in different, typically larger intervals. Specifically, the top-level portion of a subvalue may be padded with a carry. This portion of the encrypted subvalue is sometimes called a carry buffer.

[0153] In particular, the encrypted value m (e.g., a partial value of the encoded and encrypted value) encrypted under the secret key s is the so-called Arith ciphertext C, defined as follows: ari It can be expressed as such, along with the associated degree of filling:

number

number

[0154] In particular, the filling degree can be defined as follows. [Number] is used as the carry message modulus, [Number] is used as the message modulus (which may or may not be a power of 2), for example, as a radix decomposition base such that β ≤ p. Let ct be the ciphertext encrypting the value m < p. Let μ be the known worst-case for m, for example, the largest integer that m can take, and 0 ≤ m ≤ μ. [Number] at [Number] the filling degree of can be defined as the following value: [Number]

[0155] Using this definition, when the degree of the ciphertext ct reaches 1, this means that this ciphertext may be encrypting the value p - 1, and this value is the largest integer that such a ciphertext can store without consuming (or without duplicating if no padding bits are used) the padding bits. Therefore, when deg ≈ 1, carry reduction can be performed. In other words, for the carry-containing partial value to be calculated, the resulting filling degree for it can be determined, and if it is greater than 1, carry reduction encrypted before calculating the carry-containing partial value can be performed.

[0156] The above is used throughout this specification as an exemplary definition of fillness, but other definitions are also possible. For example, fillness may be defined by the integral size of the interval between the values ​​it can take, or by the encrypted minimum and maximum values ​​it can take. In either case, fillness may indicate a limit on the carry portion value, and if it is determined that this limit exceeds the corresponding carry message modulus for the carry portion value to be calculated, an encrypted carry reduction may be applied before the carry portion value is calculated.

[0157] In particular, the packing density of encrypted values ​​can be higher granularity than indicating whether a value contains a carry or not, and also higher granularity than counting the integer number of carry bits a value possesses. This allows for a more rigorous worst-case estimate of the level of carry bit consumption, enabling an increase in the number of leveled arithmetic operations before carry extraction occurs.

[0158] Here, examples are given of how the degree of packing can be calculated for various homomorphic arithmetic operations on encrypted values, particularly addition, subtraction, and scalar multiplication. In general, the degree of packing can be determined by determining the limits of the output of the operation based on the limits of the respective inputs. Such limits generally depend on how the operation is implemented and can often be derived from the implementation.

[0159] Furthermore, permission checks are defined for homomorphic operations, and a method is shown for determining whether an operation can be performed without exceeding the carry message modulus. As discussed elsewhere in this specification, operations on encoded and encrypted values ​​can be implemented with respect to such operations on encrypted values.

[0160] The following discussion will examine two Arith ciphertexts.

number

number

number

[0161] In particular, the degree of filling is sometimes calculated for encrypted addition. Below, this is done with two ciphertexts having filling degrees deg1 and deg2, respectively.

number

number

number

[0162] [Table 2]

[0163] This algorithm assumes that the inputs are compatible.

number

number

number

[0164] As another example, the degree of packing may be determined for encrypted negations. In particular, this applies to ciphertext C that encrypts message m. ari The homomorphic modular negation of is illustrated below. The output is the updated packing degree (deg). out A new cipher that encrypts the negation of the original message

number

number

[0165] This value is useful for the Neg algorithm. By the definition of degree,

number

number

[0166] Therefore, z can represent the smallest multiple of β such that μ ≤ z. This value can represent the worst-case scenario with respect to negation.

[0167] [Table 3]

[0168] This algorithm is

number

number

number

[0169] Another example is the calculation of the degree of filling for encrypted subtraction. Below are two LWE ciphertexts.

number

number

number

[0170] [Table 4]

[0171] The input is compatible,

number

number

number

[0172] Another example is encrypted scalar multiplication, in other words, multiplication of values ​​known to the parties performing the encrypted multiplication. Below, we have ciphertext C ari A homomorphic scalar multiplication between a known integer μ and μ is illustrated. The output is a new ciphertext that encrypts the product of the original message and μ.

number

[0173] [Table 5]

[0174] This algorithm is μ·(C ari This can be applied when (::deg) ≤ 1. Computational complexity of scalar multiplication algorithms.

number

number

[0175] An alternative method for performing multiplication is to use programmable bootstrapping. Programmable bootstrapping typically resets the fill level to a fill level that does not hold the carry.

[0176] Figure 3d schematically illustrates an example of an encrypted multiplication operation for the encryption of first and second encrypted values. For example, the values ​​may be partial values ​​of the respective encrypted and encoded values ​​for which the product is calculated. A method for calculating the degree of filling is also illustrated.

[0177] This technique for computing the encrypted multiplication of two ciphertexts can be a separate concern and can be used, for example, for encrypted computations that do not involve encoded and encrypted values ​​with a carry, or even for encrypted computations that do not involve encoded and encrypted values ​​at all. Such encrypted computations, therefore, may involve accessing a set of encrypted values, performing encrypted computations, and computing one or more encrypted multiplications, as discussed in relation to this figure.

[0178] Encrypted multiplication is the product of two encrypted values ​​331 and 332, specifically the product of the top part of the product of two values ​​defined modulo β.

number

[0179] Encrypted multiplication can be performed by first determining a combined ciphertext 333 that includes both the first and second partial values; and then applying programmable bootstrapping 334 to the combined ciphertext 333 to obtain the result 335. In particular, to obtain the combined ciphertext 333, the first encrypted value 331 may be scaled, or in other words, shifted; and the shifted ciphertext 336 may be added to the unscaled second encrypted value 332.

[0180] In particular, the least significant part of the product can be calculated as follows:

[0181] [Table 6]

[0182] This technique is

number

number

number

[0183] Instead of the LSB, a similar algorithm may be used to calculate the MSB. For the final programmable bootstrapping, a different lookup table is used:

[0184] [Table 7]

[0185] As mentioned above, the computational complexity of this algorithm is:

number

[0186] More generally, a multivariable function evaluation can be performed on one or more input ciphertexts, e.g., encrypted subvalues, by determining a combined encryption that represents each encrypted input value; and applying a single-variable function to the combined encryption, e.g., by programmable bootstrapping. MulLSB is an example of this, but this technique also works for other multivariable (e.g., two-variable) functions. Interestingly, in this way, a multivariable function can be efficiently evaluated using a single programmable bootstrap.

[0187] In particular, consider a two-variable function, for example, a lookup table l(m1,m2). In this case, two messages m1 and m2 may be combined, for example, by shifting one of two ciphertexts. This can effectively move the messages higher within the MSB. The shifted ciphertext may be added to the other ciphertext. For example, ciphertext ct2 may be multiplied by (μ1+1) and added to ct1. In this way, even in the worst-case scenario, the information cannot be mixed. This can be possible if both the ciphertexts and the result of the combination (e.g., multiplication with a constant, and addition) comply with conditions regarding degree and noise. When two messages are combined into a single ciphertext, the two-variable function l can be evaluated as a one-variable LUT l' in concatenation.

[0188] The same technique can be applied to multivariable functions with three or more inputs if the degree of the ciphertexts included in the calculation, as well as their error amounts, allow for the steps leading to concatenation. Just as the output degree can be calculated for a single-variable function, the output degree can also be calculated when the function is multivariable.

[0189] Return to Figure 3a.

[0190] Here, an alternative to the encrypted multiplication in Figure 3d is discussed. This alternative is less efficient but may be preferred in some situations because it requires lower precision. The method for determining the packing density for this alternative is also shown.

[0191] In this example, two ciphertexts

number

number

number

number

number

[0192] [Table 8]

[0193] The above procedure assumes that the parameters of Arith::Sub are appropriate for that algorithm.

number

number

number

[0194] Another example of an operation in which the packing density can be determined is the extraction of the carry from a ciphertext. This operation is sometimes used to implement encrypted carry reduction, as discussed elsewhere. In particular, the following algorithm takes an Arith ciphertext with a specific packing density as input and performs PBS to extract the portion of the message that overflows base β to form another Arith ciphertext.

[0195] [Table 9]

[0196] This procedure is C ari This can be applied when ::deg≦1. The computational complexity is,

number

[0197] Another operation that can determine the packing density is message extraction modulo the message modulus. In particular, the following algorithm takes an Arith ciphertext with a specific packing density as input, performs PBS, and extracts the portion of the message that does not overflow β to form a new Arith ciphertext.

[0198] [Table 10]

[0199] The above procedure is C ari This can be applied when ::deg≦1. The computational complexity is,

number

[0200] Furthermore, base change operations may also be defined. In some cases, for example, to guarantee compatibility between ciphertexts, C may be used during encrypted computation. ari ∈Arith s (m) It may be necessary to change the base of the ciphertext. For this purpose, C ari and base (p out ,β out The ciphertext takes ) as input and encrypts m with a new base.

number

number

[0201] This algorithm is C ari ::deg·(C ari ::p-1) <p out It may be used in cases of computational complexity.

number

[0202] Further calculations may involve multiplying the encrypted value by a scalar (i.e., a value known to those performing the encrypted calculation), while simultaneously changing the base (β,p) of the ciphertext. This calculation can be implemented as follows:

[0203] [Table 11]

[0204] This algorithm is C ari It may be used when ::deg≦1, and the computational complexity

number

[0205] In general, with respect to carry values ​​computed during encrypted computations, such as carry-carry partial values ​​of encoded and encrypted values, a degree of packing may be determined, and if so indicated by the degree of packing, encrypted carry reduction may be applied to the inputs used to compute the carry-carry values.

[0206] For this purpose, when calculating a value with a carry, it may be checked whether the carry buffer could overflow, and if so, the carry may be reduced as appropriate by clearing it (e.g., in CRT representation) or propagating it (e.g., in radix representation). With respect to the encoded and encrypted values ​​being calculated, it may be that none of the subvalues ​​are carried, or that one or more or all of the subvalues ​​are carried, as appropriate. In the case of operations with multiple input values ​​(e.g., addition), carry reduction may generally apply to none of the input values, to one or more input values, or to all input values. Encrypted operations that correspond to the original operation but check whether the carry buffer could overflow for each suboperation and perform carry reduction if so are sometimes called "smart versions" of the encrypted operations.

[0207] Figure 4 schematically shows an example of a value encoded and encrypted based on radix decomposition, also known as the RadModInt representation.

[0208] In particular, the value is related

number

number

number

[0209] In particular, the value 0 ≦ m < M can be encoded and encrypted by encoding the value according to the following procedure and then encrypting the resulting encoded partial value:

[0210]

Table 12

[0211] Note that this encoding can be combined, as desired, with programmable bootstrapping using padding bits or PBS without padding.

[0212] By using radix decomposition, encrypted calculations can be performed on values defined modulo the overall modulus M, where M is the product of base elements. The base elements can be, for example, at most 32, at most 64, or at most 128. The base elements need not be powers of two. One, several, or all of the base elements can be at least 3, at least 5, or at least 10. For example, a base of size κ of at least 2, at least 4, or at least 8 may be used. The use of such base elements allows calculations on partial values to be implemented relatively efficiently. The overall modulus can be, for example, at least 256, at least 512, or at least 1024. Thus, calculations can be made possible even for values that cannot be implemented efficiently without decomposition into partial values.

[0213] Using radix decomposition, modular integers can be implemented as a chain of κ encrypted blocks modulo β i (0 ≦ i < κ). For the blocks, a pair including a message modulus and a carry message modulus

Number

number

number

[0214] This is illustrated in Figure 4 as an example. In this example, each of the three blocks 401-403 is used, i.e., κ=3. For all 0≦i<κ, β i =4 and p i =16; and M=4 3 This figure shows a fresh RadModInt with a partial value that does not retain the carry. In particular, we can see that the plaintext of block 401 includes the padding bit 404, the carry message modulus 405, and the message modulus 406.

[0215] Interestingly, when using radix decomposition, modulo M and base

number

[0216] Here, we will discuss in detail some examples of encrypted operations that can be performed on values ​​encoded and encrypted using radix decomposition. First, we will introduce some notations. Under the secret key s, base

number

number

number

number

number

[0217] Below, C rad The ith of the encoded and encrypted ciphertext

number

number

number

number

number

[0218] As explained elsewhere, each encrypted partial value

number

[0219] Furthermore, C rad The compatibility of ciphertexts can be defined as follows:

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

[0220] The following is ciphertext C ari ∈Arith is the base

number

number

number

[0221] [Table 13]

[0222] This algorithm can be used when μ ≤ p-1, and the computational complexity is

number

[0223] The following describes an operation for increasing the number of subvalues ​​used to encode and encrypt values ​​using radix decomposition. For this purpose, encoding and encryption may be extended with zero encryption. Interestingly, this operation is very efficient for radix decomposition-based encoding. This operation is sometimes denoted as RadModIntCT::Padding.

number

number

number

number

number

number

number

number

number

[0224] Below are two values ​​encrypted using radix decomposition:

number

number

number

number

[0225] [Table 14]

[0226] This operation assumes that the inputs are compatible.

number

number

[0227] Below are two values ​​encoded and encrypted using radix decomposition.

number

number

number

number

[0228] [Table 15]

[0229] This operation can be used on inputs that are compatible with each other.

number

number

[0230] The following describes an encrypted carry reduction operation that can be used to reduce the carry-carryed subvalues ​​of an encoded and encrypted value to carry-free subvalues. For this purpose, the carry-carryed subvalue can be decomposed into the encryption of each subvalue. The resulting encryption can then be added to the encryption of the corresponding subvalue of the output value. In this way, the carry of the subvalue can be propagated to the subvalue at a higher index. In particular, C rad ∈RadModInt s Let (m) be the ciphertext. For example, carry reduction is performed on the encrypted partial value C at index α ∈ [0, κ-1]. rad [α] may be applied to this.

[0231] [Table 16]

[0232] This operation is,

number

number

number

number

[0233] The following illustrates an encrypted carry reduction operation in which values ​​encoded and encrypted with carry can be converted back to encoded and encrypted without carry. For this purpose, the encrypted carry reduction can be applied to each partial value, starting with the least significant partial value. In this way, each carry can be propagated. If a partial value does not retain a carry even after the previous carry reduction, that carry reduction can be skipped. In particular, C rad ∈RadModInt s Let (m) be the ciphertext. The following algorithms can be used:

[0234] [Table 17]

[0235] This operation is performed for all i ∈ [0, κ-1], parameter

number

number

[0236] The following illustrates an encrypted operation in which values ​​encoded and encrypted using radix decomposition are multiplied by a scalar, for example, a known integer λ. In this example, the multiplication by each subvalue is performed, possibly in parallel. This algorithm is suitable for relatively small λ values.

[0237] [Table 18]

[0238] This operation is,

number

number

[0239] The following illustrates an encrypted operation in which an encrypted but unencoded value, for example, a subvalue of an encoded and encrypted value, is multiplied by a scalar λ. Interestingly, this operation can also be used with relatively large scalars. This operation can result in the encoding and encryption of the product. Each subvalue of the encoded and encrypted product can be computed by the respective programmable bootstrapping operations corresponding to each subvalue of the scalar. In particular, the integer λ and C are clear. ari Ciphertext C ari ∈Arith s Scalar multiplication with (m) is performed using the base

number

[0240] [Table 19]

[0241] This operation can be used when μ ≤ p-1. The computational complexity is:

number

[0242] The following illustrates an encrypted operation in which values ​​encoded and encrypted using radix decomposition are multiplied by a scalar λ. This operation can be implemented by performing scalar multiplication of each partial value with the scalar λ, yielding their respective encoded and encrypted products, and then combining the resulting encoded and encrypted products. Interestingly, this operation can also be used for relatively large scalars. In particular,

number

[0243] [Table 20]

[0244] This operation can be used when the subroutines RadModIntCT::ScalarMulDecomp and RadModIntCT::Add may be applied to their respective inputs. The computational complexity is:

number

[0245] The following illustrates encrypted multiplication between encrypted but unencoded values, e.g., subvalues ​​of one or two different encoded and encrypted values. Encrypted multiplication can result in encoded and encrypted values. The input values ​​are combined into a single encrypted value by scaling and addition, and the respective subvalues ​​of the encoded and encrypted values ​​can be determined by applying their respective programmable bootstrappings. In particular, two compatible C ari ciphertext

number

number

number

number

[0246] [Table 21]

[0247] This operation is performed by Arith::ScalarMul

number

number

[0248] The following illustrates encrypted multiplication of an encrypted but unencoded value with an encoded and encrypted value. This operation can be implemented by multiplying each of the encoded and encrypted values ​​by the encrypted but unencoded value to obtain their respective encoded and encrypted products; and by combining the encoded and encrypted products. In particular, C ari ∈Arith s (m1) and C rad ∈RadModInt s If we let (m2), then the homomorphism multiplication of m1 and m2 can be implemented as follows:

[0249] [Table 22]

[0250] This operation can be used when RadModIntCT::MulDecomp and RadModIntCT::Add can be applied to their respective arguments for all i∈0,κ-1. The computational complexity is:

number

[0251] The following illustrates encrypted multiplication of first and second encoded and encrypted values. This multiplication can be implemented by multiplying the respective subvalues ​​of the first and second encoded and encrypted values, with these multiplications yielding encoded and encrypted results; and by combining the encoded and encrypted results, for example, by addition. In particular, with respect to the OneBlockMul operation discussed above, for example, encrypted multiplication can be implemented by multiplying the respective subvalues ​​of the first encoded and encrypted value by the second encrypted value. In particular, two ciphertexts

number

number

number

number

number

number

number

[0252] [Table 23]

[0253] This operation can be used when RadModIntCT::OneBlockMul and RadModIntCT::Add can be applied to their respective parameters for all i∈[0,κ1-1]. The computational complexity is:

number

[0254] It is also possible to perform encrypted evaluation of a single-variable function on values ​​encoded and encrypted using radix decomposition. For example, the single-variable function being evaluated could be an inverse function or division. This operation can be implemented in various ways.

[0255] One method for evaluating a single-variable function is by applying tree-programmable bootstrapping. Using tree-programmable bootstrapping to evaluate a large lookup table for multiple ciphertexts encoding one input to the lookup table is known by itself from A. Guimaraes et al., "Revisiting the functional bootstrap in TFHE," IACR Trans.Cryptogr.Hardw.Embed.Syst., 2021(2):229-253, 2021 (incorporated herein by reference). This reference uses plaintext integers encrypted with the same base β. Interestingly, the inventors have found that these techniques are also applicable to the settings of the present invention, particularly when the base elements of the radix decomposition are not all the same. Thus, multi-radix tree-programmable bootstrapping can be obtained.

[0256] in particular,

number

number

number

number

[0257] Multi-radix tree programmable bootstrapping can be implemented iteratively by selecting the largest remaining base element, dividing the remaining lookup table according to the largest remaining base element, applying programmable bootstrapping to each lookup table component using the subvalue corresponding to the largest remaining base element as a selector, and combining the results into an updated lookup table.

[0258] In particular, B={β i Let |i∈0,κ-1},

number

number

number

[0259] Regarding computational complexity, in the worst case, β for all i∈[0,κ-1] i =β max Therefore, the complexity of the worst-case scenario from the perspective of PBS is:

number

[0260] Here, we discuss a particularly efficient technique for performing function evaluation on encoded and encrypted values. This technique works by extracting the bits required to evaluate the function from each encrypted subvalue; converting the extracted bits into a GGSW ciphertext; and applying a lookup table to each GGSW ciphertext. This technique is illustrated with a single-variable function evaluation, but it also applies to multi-variable function evaluations.

[0261] The inventors have found that, in the setting of the present invention, this approach has several advantages over the use of programmable bootstrapping directly based on blind rotation (however, it should be understood that this approach may indirectly use programmable bootstrapping based on blind rotation, for example, for conversion to GGSW).

[0262] By performing bitwise operations at the level of individual subvalues, the use of blind rotations with polynomials that exponentially scale the size of the message modulus and / or carry message modulus is avoided. As a result, the proposed single-variable function evaluation can work for subvalues ​​with larger message modulus and / or carry message modulus, for example, the size of the message modulus and / or carry message modulus of a subvalue may be at least 10 bits, at least 13 bits, at least 15 bits, or at least 16 bits. By using a larger modulus with respect to the subvalue, the efficiency of computing the encoded and encrypted values ​​can be greatly improved. In particular, since encrypted subvalues ​​may have more accommodating parts for the carry and / or fewer subvalues ​​may be needed to represent a given value, less carry reduction may be required.

[0263] Furthermore, at the overall level of encoded and encrypted values, the proposed single-variable function evaluation also provides a significantly improved scaling of the size of the encrypted values. This is because the lookup table can be applied to each GGSW ciphertext much more efficiently than using Tree-PBS, for example, by using mixed packing. In particular, while Tree-PBS can scale exponentially with respect to the number of subvalues, applying a lookup table to a bitwise GGSW ciphertext can be done much more efficiently with respect to the number of subvalues, and may even be linear.

[0264] Another advantage of the proposed single-variable function evaluation is that the most significant bit of the encrypted value does not require a padding bit, and there is no need to guarantee that the most significant bit remains zero, as is the case with some existing implementations of programmable bootstrapping. This means that higher precision can be obtained for a given ciphertext modulus q.

[0265] The improved single-variable function evaluation allows for rounding each encrypted subvalue to the desired precision before applying the LUT, thus providing further efficiency improvements. Furthermore, multiple single-variable function evaluations can be performed on the same input using the same GGSW-encrypted bits, making the application of multiple functions particularly efficient.

[0266] The proposed WoP-PBS can take a bootstrapping key and a LUT L, which may or may not be encrypted, as input. WoP-PBS can output a homomorphic evaluation of the LUT for the input message, e.g., LWE or GLWE encryption of L[m].

[0267] In particular, bits can be extracted from an encrypted partial value by extracting each least significant bit using programmable bootstrapping scaled to perform operations on each bit as the least significant bit. This operation can be performed efficiently using generalized programmable bootstrapping, such as that proposed in I. Chillotti et al., "Improved programmable bootstrapping with larger precision and efficient arithmetic circuits for TFHE" (incorporated herein by reference). In particular, generalized programmable bootstrapping may involve modulus switching that reads the bit immediately adjacent to the bit to be extracted and may be used to evaluate a sign function rescaled to the jth bit.

[0268] In many cases, all bits of the input value can be extracted, but if the function does not depend on one or more bits (for example, if the function uses only some of the least significant bits), extracting these bits may be avoided, further improving efficiency.

[0269] When using the generalized programmable bootstrapping described above, as stated in "Improved programmable bootstrapping with larger precision and efficient arithmetic circuits for TFHE",

number

[0270] To convert bits into GGSW ciphertext, circuit bootstrapping can be used, for example. See, for example, I. Chillotti et al., "Faster packed homomorphic operations and efficient circuit bootstrapping for TFHE," proceedings of ASIACRYPT 2017 (incorporated herein by reference). Note that the second step of circuit bootstrapping can be improved, as described in H. Chen et al., "Onion ring ORAM: efficient constant bandwidth oblivious RAM from (leveled) TFHE," proceedings CCS 2019 (incorporated herein by reference). That is, the initial non-functional LWE-to-GLWE KS may be applied to the output of programmable bootstrapping, and the external product may be multiplied with the GGSW encryption of the GLWE private key. This may reduce the size of the public evaluation key, and efficiency may be improved by using the FFT.

[0271] By using packing lookup table evaluation, lookup tables can be efficiently applied to GGSW ciphertexts. For example, see I. Chillotti et al., "Faster packed homomorphic operations and efficient circuit bootstrapping for TFHE," proceedings of ASIACRYPT 2017 (incorporated herein by reference). In general, such packing LUT evaluation may use mixed packing, with horizontal and vertical packing being two specific examples.

[0272] Interestingly, the above approach works for encoded and encrypted values ​​regardless of whether a carry is used; it also works for values ​​that are encrypted as their respective subvalues ​​but not encoded. In the latter case as well, many of the advantages discussed apply. Thus, methods and devices for performing encrypted computations can be conceivable that use the described single-variable function evaluation without necessarily using a carry or encoded and encrypted values. Generally, improved single-variable function evaluation typically uses programmable bootstrapping based on blind rotations internally (e.g., circuit bootstrapping may involve a certain number of programmable bootstraps), but it should be noted that at higher levels, especially when applied with large message moduli, improved single-variable function evaluation can be used to replace programmable bootstrapping performed in encrypted computations.

[0273] In particular, single-variable function evaluation based on conversion to bits can be implemented as follows:

[0274] [Table 24]

[0275] The example above demonstrates vertical packing, but horizontal or mixed packing can also be used. Furthermore, as shown above, it is possible to output a GLWE ciphertext instead of an LWE ciphertext. Moreover, the example above can be generalized to multivariable function evaluation with multiple (e.g., at least two or at least three) encoded and encrypted inputs by extracting the desired bits from each input and applying a lookup table to the bits from each input.

[0276] As discussed elsewhere, performing encrypted calculations may involve tracking the degree of fill of each carry-bearing partial value. If the degree of fill indicates that the carry-bearing partial value to be calculated may exceed the corresponding carry message modulus, encrypted carry reduction may be applied before calculating the carry-bearing partial value. In particular, encrypted carry reduction operations may be performed before or during encrypted operations, as needed. Operations configured to automatically perform carry reduction if necessary to ensure that the carry buffer does not overflow are called "smart" operations.

[0277] Figure 5 schematically shows an example of a value encoded and encrypted based on a remainder representation. It illustrates how various encrypted operations can be applied to the encoded and encrypted value in encrypted computations.

[0278] Such encrypted calculations may involve the use of carries on the encoded and encrypted values, but this is not required. For example, carry reduction may be applied immediately after each operation or sub-operation described herein, so that the encrypted operation applies only to the encoded and encrypted values ​​without any carries.

[0279] In particular, the mapping between a value and its subvalues ​​may follow a remainder-based representation, especially one based on the Chinese Remainder Theorem (CRT). The encoded and encrypted values ​​are based on the respective message modulus β.i can be encrypted as the encryption of κ partial values using 0 ≦ i ≦ κ - 1. Typically, the modulus β i , β j , where i ≠ j are pairwise relatively prime and using the CRT enables the reconstruction of the value from the partial values. In general, any modulus can be used as the carry message modulus, for example, the partial values can use a common carry message modulus. To encrypt a value into an encrypted value, the CRT representation of the value may be calculated and each element of the representation may be encrypted. Similarly, the inverse CRT may be used to decrypt the encrypted value.

[0280] Interestingly, the use of residue number system encoding can provide particularly efficient encrypted carry reduction. In particular, carry reduction may be performed by performing a respective modulo reduction for each partial value, for example, a carry may not be transferred from one partial value to the next. This makes carry reduction fast and multi-threaded. For example, one, multiple, or all of the message moduli can be at least 2 and / or at most 32. For example, one, multiple, or all of the message modules can be at least 3, at least 5, or at least 10. In particular, the figure shows an encrypted value encoded and encrypted as the encryption of three respective partial values 501, 502, 503 defined modulo respective message moduli 504, 505, 506 each equal to 25, 29, and 32. Thus, the encrypted value can be defined modulo κ = 3 and M = 32 × 29 × 25. In this example, a common carry message modulus 507 equal to 64 is used.

[0281] In particular, encoding a value into partial values can be determined as follows:

[0282]

Table 25

[0283] Here, we introduce several notations for coding based on the remainder system.

number

number

[0284] To encode and encrypt the value m mod τ, use the respective remainder m modulo the respective base. i =m mod β i However, it can be encrypted as κ different Arith ciphertexts.

[0285] To decrypt a value m encoded and encrypted using this CRT representation across multiple Arith ciphertexts, first the Arith ciphertext encrypting the partial value can be decrypted. Then, the encrypted integer can be decrypted modulo τ, as is known in itself.

[0286] therefore,

number

number

number

number

Number

Number

Number

[0287] Two CrtModInt ciphertexts

Number

Number

Number

Number

[0288] Here, various operations on values encoded and encrypted using the CRT are discussed. Interestingly, when using the CRT representation, in many cases, the encrypted operations can be applied by individually applying each sub-operation to the encryption of each partial value of the input value. This makes the operations more efficient to implement and parallelizable. This is especially true for addition, subtraction, and multiplication.

[0289] In particular, homomorphic addition can be implemented by adding blocks of the same index, for example, as follows:

[0290] [Table 26]

[0291] If the inputs are compatible, this operation can be applied, and Arith::Add can be applied for all 0≦i<κ. The computational complexity is,

number

[0292] Furthermore, homomorphic subtraction can be implemented by subtracting blocks of the same index, for example as follows:

[0293] [Table 27]

[0294] If the inputs are compatible, this operation can be applied, and Arith::Sub can be applied for all 0≦i<κ. The computational complexity is,

number

[0295] Multiplication by a scalar known to those involved in performing encrypted multiplication is applied to each block, with the respective message modulus β. i This can be done by multiplying by a scalar u modulo , for example:

[0296] [Table 28]

[0297] This operation can be applied if Arith::ScalarMul can be applied to all 0≦i<κ. The computational complexity is:

number

[0298] An alternative way to implement scalar multiplication is, for example, by applying programmable bootstrapping.

[0299] Interestingly, when using CRT representations, encrypted carry reduction can be applied to the carry-carry portion by reducing it modulo the corresponding message modulus, for example, using programmable bootstrapping. This may not affect other portions, and therefore, carry reduction of multiple or all portions of an encoded and encrypted value can be performed individually, and possibly in parallel. Propagation may not be necessary. For example, a single carry-carry portion can be carried as follows:

[0300] [Table 29]

[0301] This operation is C crt [i]: Applicable when deg ≤ 1, computational complexity

number

[0302] Each C that makes up CrtModInt ari Beta regarding ciphertext i By extracting messages modulo , multiple partial values ​​can be reduced by carry, for example, as follows:

[0303] [Table 30]

[0304] This operation is C for all 0≦i<κ crt [i]:: may apply when deg ≤ 1. The computational complexity is,

number

[0305] Homomorphism multiplication is performed on i∈[0,κ-1] β i The corresponding partial values ​​x modulo β i , y mod β i This can be implemented by multiplying them together, for example:

[0306] [Table 31]

[0307] This operation can be applied when Arith::MulLSB can be applied to all i∈[0,κ-1]. The computational complexity is:

number

[0308] Value C encoded and encrypted using CRT crt Various techniques can be used to apply a single-variable function to it. In particular, it is possible to use tree-programmable bootstrapping or to apply a lookup table to GGSW-encrypted extracted bits, both of which will be discussed further with respect to Figure 4. Depending on the function, it may also be possible to evaluate the single-variable function by applying it to each subvalue individually. This is, for example,

number

[0309] [Table 32]

[0310] This operation is such that for all i such that 0≦i<κ, CrtModInt[i]::deg<1, and the function

number

number

[0311] Figure 6 schematically shows an example of a value encoded and encrypted based on radix decomposition. Interestingly, in this case, the value is defined using a modulus M that is smaller than the maximum value representable by radix decomposition. This has the advantage that the modulus M does not need to be equal to the product of the base elements.

[0312] In particular, to encode and encrypt values ​​modulo M,

number

number

[0313] For example, this figure shows the case where the modulus 601 is M=1433. Note that 1433 is a prime number, and therefore, the cardinal or CRT representation cannot be directly used for the decomposition with respect to this modulus. This figure shows the common base element β=2 5 , 602, κ=3, and common carry message modulus

number

number

[0314] Encrypted operations can be performed in the same manner as discussed with respect to Figure 4, except that carry reduction may involve applying a correction resulting from modular reduction modulo M. The latter can be done by performing encrypted modulo reduction of the top-most partial value of the output. In particular, as discussed elsewhere, the carry and message can be extracted from the top-most block, and the modulo can be computed homomorphically by redistributing it across the remaining blocks. Several approaches are possible in this regard, as discussed in more detail elsewhere.

[0315] More specifically, under private keys, base

number

number

number

number

number

number

number

number

number

[0316] In the above definition, the modulus Q is set to be in the top-level block κ-1. RadModInt + Note that it is possible to add one or more Arith ciphertext blocks to the MSB of the structure. The algorithm described herein for homomorphic modulus reduction uses the additional Arith ciphertext blocks to perform RadModInt + It can be configured to perform modular reduction of the ciphertext.

[0317] Two RadModInt + ciphertext

number

number

number

number

number

number

number

[0318] As discussed with respect to Figure 4, various operations can be performed. Here, we will discuss some examples.

[0319] In particular, modular addition can be calculated in the same way as with RadModInt ciphertexts. For this reason, RadModInt + The ciphertext may be seen as a RadModInt ciphertext. This operation is,

number

[0320] Furthermore, modular subtraction is performed using RadModInt + The ciphertext can be treated as a RadModInt ciphertext and processed in the same way as a RadModInt ciphertext. This operation is performed as follows:

number

[0321] Modular padding is also available at the output via RadModInt + The ciphertext can be treated as a RadModInt ciphertext and the process can be carried out in the same way as with other RadModInt ciphertexts. Generally, the input resulting from the decomposition can be a RadModInt. This operation is performed as follows:

number

[0322] Applying encrypted carry reduction to partial values ​​with carry is also possible with RadModInt + The ciphertext can be treated as a RadModInt ciphertext and the operation can be performed in the same way as with RadModInt ciphertexts. This operation is performed as follows:

number

[0323] Modular reduction can occur when the top-level partial value is reduced by carry. Here, we discuss two possible methods for performing modulo reduction. Their relative efficiency is given by the modulus M and the limit M. max It may depend on the distance between them.

[0324] The first method of modulo reduction involves applying programmable bootstrapping to the top-level encrypted subvalue to propagate the subvalue to each encrypted subvalue, thereby obtaining a reduced value modulo Q.

[0325] In particular, carry reduction may involve propagating empty carries with respect to the parts of the encoded and encrypted values, except for the most significant part. This can result in all carries except the carry within the top-level block being empty. This may be done if the carry in the top-level block is capable of supporting this carry propagation without being exceeded. In the top-level block, both the carry and the message may be extracted and transformed using programmable bootstrapping. The transformed and extracted carries and messages may then be redistributed to their respective blocks.

[0326] Here, the parameters shown in Figure 6, namely Q=1433, κ=3,

number

number

number

[0327] As a detailed example, modular reduction can be implemented as follows:

[0328] [Table 33]

[0329] This operation is,

number

number

number

number

[0330] It should be noted that each programmable bootstrapping can be evaluated as a single programmable bootstrapping using the "PBS many LUT" technique disclosed in "Improved programmable bootstrapping with larger precision and efficient arithmetic circuits for TFHE".

[0331] An alternative technique for modulo reduction is based on a linear relationship modulo Q between the subvalues ​​corresponding to the topmost base elements and the set of subvalues ​​corresponding to the remaining base elements. Based on such a relationship, the encoded and encrypted values ​​can be modulo reduced to the encoded and encrypted values ​​whose topmost subvalues ​​are zero. In particular, to obtain a linear relationship, modulo Q is β κ-1 Product of base elements excluding

number

number

[0332] This method involves ν κ-1 It can be used when = 0. In this case, the constant ν jThe top-level block multiplied by can be added to the j-th block, and then the new top-level block can be set to zero. This technique applies to the decomposition elements ν0, ν1, ..., ν κ-2 This is particularly efficient when Q is small, or even zero, and for some applications, it may be possible to select an appropriate modulus Q so that this modulo reduction is efficient, thereby obtaining particularly efficient encrypted computations.

[0333] For example, refer to the parameters shown in Figure 6: smaller modulus Q = 1433, number of subvalues ​​κ = 3, base of message modulus

number

number

[0334] Another example where this modulus reduction is particularly efficient is, as mentioned above, Q=1087, κ=3,

number

number

[0335] It should be noted that this technique can be efficiently implemented without programmable bootstrapping. Carry propagation via bootstrapping can be performed later as an option. For example, this technique can be implemented as follows:

[0336] [Table 34]

[0337] This procedure involves the coefficient ν in the decomposition ν κ-1 = 0, and for all j ∈ [0; κ-2] Arith::ScalarMul is the ciphertext.

number

number

[0338] RadModInt + Performing an encrypted carry reduction operation on all subvalues ​​of a value encoded and encrypted using can be done by applying the encrypted carry reduction to each subvalue except the most significant subvalue, and then applying the encrypted modulo to the most significant subvalue. In particular, this operation can be implemented as follows:

[0339] [Table 35]

[0340] RadModInt + ::ClearCarry can reduce a partial value with a carry to a partial value without a carry, but the addition performed by modular reduction results in RadModInt + Note that the overall result of ::ClearAllCarries may have partial values ​​with carries. Optionally, for example, RadModInt + Further encrypted carry reduction using ::ClearCarry can be applied, if desired, to reduce such carry-bearing subvalues ​​to carry-free subvalues, for example, if it allows for one or more subsequent operations.

[0341] The above procedure performs RadModInt for all i∈[0,κ-2] + ::ClearCarry may be applied, and RadModInt may be applied to the result + ::ModularReduction 1,2 It can be applied when applicable. Depending on which modular reduction is used, the computational complexity is

number

number

[0342] Scalar multiplication can be performed as discussed for RadModInt ciphertexts using the SmallScalarMul operation. This is particularly suitable for relatively small scalars. For this purpose, RadModInt + The ciphertext may be viewed as a RadModInt ciphertext. This operation is,

number

[0343] Scalar multiplication is performed using RadModInt + Viewing the ciphertext as a RadModInt ciphertext, the process can be carried out as discussed for RadModInt ciphertexts using the ScalarMulDecomp operation. In particular, the respective subvalues ​​of the encoded and encrypted values ​​may be multiplied, and the resulting encoded and encrypted values ​​may be combined. Scalar multiplication may further involve performing modular subtraction. The overall scalar multiplication operation is:

number

[0344] One way to implement modular reduction in this case is to include one or more additional subvalues ​​in the encoded and encrypted product (the number of subvalues ​​to be added is appropriately chosen for the scalars to be multiplied) so that exact multiplication is supported, in other words, so that the encoded and encrypted product can be computed without modular reduction; perform exact multiplication; and apply the respective modular reductions to each added subvalue and the original top-order subvalue, for example, from top-order to bottom-order.

[0345] An alternative approach is to iteratively perform the modular reduction on each resulting encoding and encryption before combining them. In this case, the addition of further subvalues ​​can be avoided.

[0346] Multiplication of encoded and encrypted values ​​is performed using RadModInt + The ciphertext may be viewed as a RadModInt ciphertext and processed as discussed for RadModInt ciphertexts. In particular, the first encoded and encrypted value may be multiplied by the respective subvalues ​​of the second encoded and encrypted value, and the results may be combined. Multiplication may include modular subtraction. The overall multiplication is,

number

[0347] To perform modular reduction, the encoded and encrypted product may include one or more subvalues ​​(the number of subvalues ​​is appropriately chosen for the values ​​to be multiplied) so that the exact multiplication of the encoded and encrypted values ​​can be performed; the exact multiplication can be performed; and each modular reduction may be applied to the added blocks and the original top-level subvalues, for example, from top-level to bottom-level.

[0348] Another way to perform modular reduction is to iteratively perform it during computation, for example, before superimposing the results in the top-level block. This may eliminate the need to add further subvalues.

[0349] Figure 7 schematically shows an example of a value encoded and encrypted based on a remainder representation, and further based on the radix decomposition of the elements of the remainder representation. Such representations are referred to herein as “hybrid” encoding and encryption. In particular, the encoded and encrypted value may include one or more respective encodings and encryptions according to the remainder representations of each subvalue defined according to the remainder representation.

[0350] Interestingly, this approach combines the advantages of residue-based representations, which can avoid many carry propagations without the problem of requiring many small, disproportionate numbers. In particular, by using a hybrid approach, it is possible to perform encrypted computations that use particularly large modulos relatively efficiently, for example, when the modulus is at least 2 10 , at least 2 20 , or at least 2 30 That's fine. For example, the remainder in a remainder representation can be at most 3, at most 6, or at most 10.

[0351] For example, this diagram shows the modulus (4 5 )×1433×17×(3 4 This demonstrates hybrid coding and encryption using ). This modulus is four remainders according to the remainder system. 5 , 710;1433, 720;17, 730; and 3 4 It can be decomposed into 740. For each remainder of the residue factorization, the encoding and encryption of a given value may include each set of one or more encrypted values ​​that represent each element of the residue factorization of the value.

[0352] In particular, for remainders of 0, 1, or 2 or greater in the remainder system, as discussed with respect to Figure 5, the corresponding element can be encrypted as an encrypted but unencoded value whose message modulus is equal to the remainder. This is the case for remainders 17,730 in the figure, and can be encrypted as an encrypted value modulo the remainder itself, 740.

[0353] With respect to further remainders of 0, 1, or 2 or more, the corresponding element can be encoded as a value encoded and encrypted according to the radix decomposition of the element. Here, the remainder may be equal to the maximum value that can be represented by radix decomposition using the encoding and encryption in Figure 4, for example; and / or the remainder may be less than the maximum value that can be represented by radix decomposition using the encoding and encryption in Figure 6, for example.

[0354] This is shown in the diagram, with a remainder of 4. 5 The elements modulo 710 can be encoded and encrypted as five subvalues ​​modulo 4, 711-715, as discussed with respect to Figure 4, for example; remainder 3 4 The element modulo 740 can be encoded and encrypted as four subvalues ​​modulo 3, 741-743. In this example, the element modulo 720, with a remainder of 1433, is 2, as discussed with respect to Figure 6, for example. 5 It can be encoded and encrypted as three partial values ​​721-723 modulo .

[0355] In particular, multiple relatively prime integers (Q0, ..., Q) κ-1 Given the list of ), the hybrid approach is:

number

[0356] Here, RadModInt + This provides a detailed example of how it is used for all remainders. This example can be applied when RadModInt or a single encryption is used for one, multiple, or all remainders. In this example,

number

number

number

number

number

[0357] ModInt cipher

number

number

number

number

number

number

[0358] In general, various computations, including encrypted operations and encrypted carry reduction, can be performed as discussed for ordinary remainder-based encoding and encryption in Figure 5. For example, encrypted addition, subtraction, scalar multiplication, carry reduction, clearing of all carries, multiplication, and / or single-variable function evaluation can be applied.

[0359] If performing such calculations involves performing subcomputations on one or more elements of the CRT representation, the subcomputations may be applied to each encoded and encrypted element using the techniques discussed with respect to Figure 4 or Figure 6. For example, an operation on ModInt may be applied to each component RadModInt + (m mod Q i ), which can be computed individually for i∈[0,κ-1], where instead of using the Arith-based algorithm, the RadModInt described herein can be used. + The base algorithm is ModInt

number

[0360] Figure 8 schematically illustrates an example of an embodiment of cryptographic method 800 that performs encrypted computation on one or more sets of encoded and encrypted values. Method 800 can be computed-implemented. A value can be encoded and encrypted as an encryption of a plurality of individual subvalues. A subvalue may have a corresponding message modulus and a carry message modulus greater than the message modulus. A value can be encoded and encrypted without carry by a non-carry subvalue less than the corresponding message modulus. A value can be encoded and encrypted with carry by at least one carry subvalue greater than or equal to the corresponding message modulus.

[0361] Method 800 may include accessing one or more encoded and encrypted values ​​(810). Method 800 may include applying an encrypted operation to an input value encoded and encrypted with at least a carry to obtain an output value encoded and encrypted with a carry (820). Method 800 may include applying an encrypted carry reduction to an output value encoded and encrypted with a carry to obtain further encoding and encryption of an output value in which at least one carry-carried subvalue has been reduced to a carry-free subvalue (830).

[0362] Figure 9 schematically shows an example of an embodiment of the compiler method 900 for compiling a computation into a homomorphic executable file. The homomorphic executable file is executable by a cryptographic computation engine, which can perform encrypted computations on one or more sets of encoded and encrypted values, for example, as described herein according to method 800 in Figure 8. The homomorphic executable file may contain one or more instructions for performing encrypted carry reduction operations, as described herein, for example, as part of or between performing encrypted operations. The compiler method 900 can be implemented on a computer.

[0363] Compiler method 900 may include: determining a degree of fill that indicates a limit on the carry portion to be computed (910); and, if the limit exceeds the corresponding carry message modulus (920), generating an instruction for the cryptographic computation engine to apply encrypted carry reduction before computed the carry portion (930).

[0364] As will be apparent to those skilled in the art, many different ways of performing methods 800, 900 are possible. For example, the order of the steps may be as shown, but the order of the steps may be changed, or some steps may be performed in parallel. Furthermore, other method steps may be inserted between steps. The inserted steps may represent improvements to the method as described herein, or they may be unrelated to the method. For example, some steps may be performed in parallel, at least partially. Furthermore, a given step may not be completely finished before the next step begins. Methods 800, 900 can also be combined; for example, method 800, which performs encrypted computation, may be performed according to a homomorphic executable previously compiled according to method 900.

[0365] Some embodiments of the method may be performed using software that includes instructions for a processor system to perform method 800 or 900. The software may include only steps performed by specific sub-entities of the system. The software may be stored on a suitable storage medium such as a hard disk, floppy disk, memory, or optical disk. The software may be transmitted as a signal along a wire, wirelessly, or using a data network, such as the Internet. The software may be made available for download and / or for remote use on a server. Embodiments of the method may be performed using programmable logic, such as a bitstream arranged to constitute a field-programmable gate array (FPGA), in order to perform this method.

[0366] It should be understood that the subject matter disclosed herein also extends to computer programs configured to practice the subject matter disclosed herein, in particular computer programs on or within a carrier. The programs may be in the form of source code, object code, code intermediate source, and partially compiled forms, or any other form suitable for use in implementing embodiments of the method. Embodiments relating to a computer program product include computer executable instructions corresponding to each of the processing steps of at least one method described. These instructions may be divided into subroutines and / or stored in one or more files that may be statically or dynamically linked. Another embodiment relating to a computer program product includes computer executable instructions corresponding to each of at least one device, unit, and / or component of the system and / or product described.

[0367] Typically, the devices described herein, for example in Figure 1a-1c, comprise one or more microprocessors that perform appropriate software stored in the system; for example, the software may be downloaded and / or stored in corresponding memory, such as volatile memory like RAM or non-volatile memory like flash. Alternatively, the system may be implemented entirely or partially with programmable logic, for example as a field-programmable gate array (FPGA). The system may be implemented entirely or partially as a so-called application-specific integrated circuit (ASIC), for example, an integrated circuit (IC) customized for those specific applications. For example, the circuit may be implemented in CMOS using a hardware description language such as Verilog or VHDL. In particular, the system may include circuitry for evaluating cryptographic primitives.

[0368] Processor circuits may be implemented in a distributed manner, for example, as multiple subprocessor circuits. Storage may be distributed across multiple distributed substorages. Some or all of the memory may be electronic memory or magnetic memory. For example, storage may have volatile and non-volatile parts. Part of the storage may be read-only.

[0369] Figure 10 shows a computer-readable medium 1000 having a writable portion 1010. The computer-readable medium 1000 is shown in the form of an optically readable medium. The computer-readable medium 1000 can store data 1020, which may, when executed by a processor system, represent instructions that cause the processor system to perform one embodiment of a method for performing encrypted calculations and / or a compiler method according to one embodiment.

[0370] Alternatively, or in addition, data 1020 may represent a homomorphic executable compiled according to the compiler methods described herein.

[0371] Alternatively, or in addition, data 1020 may represent a set of one or more encoded and encrypted values, including zero or more encoded and encrypted values ​​without carry and one or more encoded and encrypted values ​​with carry, as described herein.

[0372] The data 1020 may be embodied as a physical mark on the computer-readable medium 1000 or by magnetization of the computer-readable medium 1000. However, any other suitable embodiment can be considered. Furthermore, although the computer-readable medium 1000 is shown here as an optical disc, it should be understood that the computer-readable medium 1000 may be any suitable computer-readable medium such as a hard disk, solid-state memory, or flash memory, and may be non-recordable or recordable.

[0373] Figure 11 shows a schematic diagram of a processor system 1140 according to an embodiment of a device for performing encrypted calculations or determining a test polynomial. The processor system comprises one or more integrated circuits 1110. The architecture of one or more integrated circuits 1110 is schematically shown in this figure. Circuit 1110 includes a processing unit 1120, e.g., a CPU, for executing a method according to one embodiment and / or for executing computer program components to implement the module or unit thereof. Circuit 1110 includes a memory 1122 for storing programming code, data, etc. Part of the memory 1122 may be read-only. Circuit 1110 may include communication elements 1126, e.g., an antenna, a connector, or both. Circuit 1110 may include a dedicated integrated circuit 1124 for performing some or all of the processing defined by the method. The processor 1120, memory 1122, dedicated IC 1124, and communication elements 1126 can be interconnected via an interconnect 1130, e.g., a bus. The processor system 1110 can be configured for contact and / or contactless communications, respectively, using antennas and / or connectors.

[0374] For example, in one embodiment, a processor system 1140, for example, a device for performing encrypted calculations or compilation, may include a processor circuit and a memory circuit, the processor being configured to execute software stored in the memory circuit. For example, the processor circuit may be an Intel Core i7 processor or an ARM Cortex-R8. In one embodiment, the processor circuit may be an ARM Cortex-M0. The memory circuit may be a ROM circuit or non-volatile memory, such as flash memory. The memory circuit may also be volatile memory, such as SRAM memory. In the latter case, the device may also include a non-volatile software interface configured to provide software, such as a hard drive or a network interface.

[0375] Although device 1110 is shown to include one of the components described above, various components may be replicated in various embodiments. For example, processor 1120 may include multiple microprocessors configured to independently perform the methods described herein, or multiple microprocessors configured to cooperate to perform steps or subroutines of the methods described herein to realize the functions described herein. Furthermore, if device 1110 is implemented in a cloud computing system, various hardware components may belong to separate physical systems. For example, processor 1120 may include a first processor in a first server and a second processor in a second server.

[0376] It should be noted that the embodiments described above are illustrative and not limiting to the subject matter disclosed herein, and that those skilled in the art can design many alternative embodiments.

[0377] In the claims, any reference numerals enclosed in parentheses shall not be construed as limiting the claims. The use of the verb “equipped with” and its conjugations shall not preclude the existence of elements or steps other than those described in the claims. The articles “a” or “an” preceding an element shall not preclude the possibility that there may be multiple such elements. Expressions such as “at least one of” following a list of elements represent a selection of all elements or any subset of elements from the list. For example, the expression “at least one of A, B, and C” should be understood to include A only, B only, C only, both A and B, both A and C, both B and C, or all of A, B, and C. The subject matter disclosed herein may be implemented by hardware comprising several different elements and by a appropriately programmed computer. In an apparatus claim listing multiple parts, some of these parts may be embodied by one identical item of hardware. The mere fact that certain means are described in different dependent claims does not indicate that combinations of these means cannot be used advantageously.

[0378] In the claims, references in parentheses represent illustrative reference numerals or formulas of embodiments in the drawings, thereby facilitating the understanding of the claims. These reference numerals shall not be construed as limiting the claims.

Claims

1. A computer-based cryptographic method (800) that performs encrypted calculations on one or more sets of encoded and encrypted values, The value is encoded and encrypted as multiple separate subvalues, each subvalue having a corresponding message modulus and a carry message modulus that is greater than the message modulus. The value is encoded and encrypted without carry by a carry-free subvalue that is smaller than the corresponding message modulus. The value is encoded and encrypted with a carry by at least one carry-carried subvalue greater than or equal to the corresponding message modulus. The method is performed by a processor system, Accessing one or more encoded and encrypted values ​​from storage (810), (820) A method of obtaining an output value that is encoded and encrypted with carry by applying an encrypted operation to an input value that is encoded and encrypted with carry, wherein one or more encoded and encrypted values ​​include the input value. (830) Applying encrypted carry reduction to the output value encoded and encrypted with carry to obtain further encoding and encryption of the output value in which at least one carry-included subvalue has been reduced to a carry-free subvalue. Cryptographic methods (800), including those mentioned above.

2. The method of claim 1 (800), wherein the partial value encryption is LWE encryption, the LWE encryption supports a programmable bootstrapping operation, the programmable bootstrapping evaluates LWE decryption on the exponent of the GLWE-encrypted monomial, and the encrypted carry reduction uses a programmable bootstrapping operation.

3. The method according to claim 1 (800), comprising calculating an output value by performing a set of encrypted and encrypted values, wherein the calculation does not include encrypted carry reduction.

4. The method according to claim 1 (800), wherein the encrypted operations are applied by individually applying each sub-operation to the encryption of each sub-value of the input value, and the individually applied encrypted operations are performed at least partially in parallel.

5. The method according to claim 1 (800), wherein the encoding of the value as a partial value without carry is based on a remainder-based representation of the value.

6. The method according to claim 5 (800), wherein the encoding is further based on the cardinal decomposition of elements of the residue system representation.

7. The method according to claim 1 (800), wherein the encoding of the value as a partial value without carry is based on the cardinal decomposition of the value.

8. The method according to claim 6 (800), wherein applying encrypted carry reduction includes decomposing the carry-carry portion of the output value into encrypted portions of each portion of the portion, and adding the encrypted portions of the portion of the portion to the encrypted portion of the corresponding portion of the output value.

9. The method according to claim 6 (800), comprising performing an encrypted scalar multiplication of encoded and encrypted values ​​by calculating each encrypted subvalue of a scalar multiplication of subvalues ​​of encoded and encrypted values.

10. The method according to claim 6 (800), comprising performing an encrypted multiplication of a first encoded and encrypted value and a second encoded and encrypted value by performing an encrypted multiplication of the partial values ​​of the first and second encoded and encrypted values, wherein the encrypted multiplication of the partial values ​​results in an encoded and encrypted value.

11. The method according to claim 6 (800), wherein the elements of the residue system, or values ​​encoded and encrypted without carry, are defined modulo a modulus smaller than the maximum value that can be represented by radix decomposition.

12. The method according to claim 1 (800), wherein the application of an encrypted operation includes determining a degree of filling that indicates a limit on the carry portion value to be calculated, and, if the limit exceeds the corresponding carry message modulus, applying an encrypted carry reduction before calculating the carry portion value.

13. The method according to claim 1 (800), wherein the message modulus is not a power of 2 and / or at least 3 and / or at least 5 and / or at least 10.

14. The method according to claim 1 (800), wherein the carry message modulus is at least 4 times, at least 8 times, or at least 32 times the corresponding message modulus.

15. The method according to claim 1 (800), comprising performing one or more encrypted linear operations and / or one or more encrypted multiplications and / or one or more single-variable function evaluations.

16. The method according to claim 1 (800), comprising extracting one or more bits from one or more subvalues ​​of an encoded and encrypted value, converting the extracted bits into a GGSW ciphertext, and applying a lookup table to the GGSW ciphertext to apply a function evaluation to one or more encoded and encrypted values.

17. A computer-implemented compiler method (900) performed by a computer for compiling a computation into a homomorphic executable file, wherein the homomorphic executable file is executable by an encryption computation engine, the encryption computation engine is made to perform an encrypted computation according to any one of claims 1 to 16, and the method is executed by a processor system. Regarding the carry portion value to be calculated, determine the degree of filling that indicates the limit of the carry portion value (910), If the limit exceeds the carry message modulus of the carry-carry partial value (920), generate an instruction to the cryptographic calculation engine to apply encrypted carry reduction before calculating the carry-carry partial value (930) A computer-implemented compiler method (900), including a compiler method (900).

18. Cryptographic devices (110, 112) for performing encrypted computations on one or more sets of encoded and encrypted values, The value is encoded and encrypted as multiple separate subvalues, each subvalue having a corresponding message modulus and a carry message modulus that is greater than the message modulus. The value is encoded and encrypted without carry by a carry-free subvalue that is smaller than the corresponding message modulus. The value is encoded and encrypted with a carry by at least one carry-carried subvalue greater than or equal to the corresponding message modulus. Devices (110, 112) Storage (140) for storing one or more encoded and encrypted values, A processor subsystem (130) configured to apply encrypted operations to an input value encoded and encrypted with at least one carry to obtain an output value encoded and encrypted with one carry, and to apply encrypted carry reduction to the output value encoded and encrypted with one carry to obtain further encoding and encryption of the output value in which at least one carry-containing subvalue is reduced to a carry-free subvalue. An encryption device (110, 112) is provided.

19. A compiler device (119) for compiling a computation into a homomorphic executable file, wherein the homomorphic executable file is executable by an encryption computation engine, and the encryption computation engine is made to perform the encrypted computation according to any one of claims 1 to 16, and the device Storage (149) for storing data representing computations to be compiled into a homomorphic executable file, A processor subsystem (139) is configured to determine a fill degree indicating a limit on the carry portion value to be calculated, and if the limit exceeds the carry message modulus of the carry portion value, to generate an instruction for the cryptographic calculation engine to apply encrypted carry reduction before calculating the carry portion value. A compiler device (119) equipped with the following:

20. A computer program (1000), An instruction, when executed by a processor system, that causes the processor system to perform the method described in any one of claims 1 to 16, An instruction, when executed by a processor system, that causes the processor system to perform the method described in claim 17, A computer program that includes at least one of the following.

Images