Computation on encoded and encrypted values

Abstract

Some embodiments relate to an encryption method for performing cryptographic computing on a set of one or more encoded and encrypted values. A value is encoded and encrypted as encryptions of a plurality of individual sub-values. The sub-values ​​have a corresponding message modulus and a carry message modulus greater than the message modulus. A value is encoded and encrypted without a carry by non-carry sub-values ​​smaller than the corresponding message modulus. A value is encoded and encrypted with a carry by at least one carry-containing sub-value greater than or equal to the corresponding message modulus. An encrypted operation is applied to at least the input value encoded and encrypted with a carry to obtain an output value encoded and encrypted with a carry. An encrypted carry reduction is applied to the output value encoded and encrypted with a carry to obtain an additional encoding and encryption of the output value in which at least one carry-containing sub-value is reduced to a non-carry sub-value.

Description

Technology Field

[0001] The subject matter of the claims disclosed herein relates to a cryptographic method for performing cryptographic computing, a corresponding device, a compiler method and device for cryptographic computing, and a computer-readable medium. Background Technology

[0002] Homomorphic encryption enables the performance of encrypted computing: that is, it allows the company to perform computing on undecryptable encrypted data, such as circuit evaluations. For example, input data and computing results can be received and returned in an encrypted form. Intermediate data, such as the internal state of the computing, can also be in an encrypted form.

[0003] Even if the result of computing is returned in an encrypted form, the output upon decryption is expected to be identical or very close, as if the operations had been performed on unencrypted data. Homomorphic encryption can be used for privacy-preserving outsourced storage and computing. This enables data to be outsourced to a cloud environment for processing and / or storage while remaining fully encrypted.

[0004] For example, homomorphic encryption can be applied in fields such as healthcare, where privacy regulations may make it difficult to share general data but computing on encrypted medical data may be permissible. For instance, a medical model developed to classify medical data can be configured to receive medical data in an encrypted form from a third party, such as a hospital. The medical model may classify medical data, for instance, as normal or abnormal, or as having a specific medical syndrome, disease, or other disorder. Using homomorphic encryption, the medical model can be applied to the medical data received in an encrypted form. This means that the party providing the medical model cannot access the general medical data corresponding to the encrypted medical data. Users of the service can decrypt the results of the medical model application.

[0005] In particular, there exist homomorphic encryption techniques that can be used to compute arbitrary functions on encrypted data, at least in principle. These techniques are referred to as "fully homomorphic encryption" (FHE) techniques.

[0006] Known implementations of FHE use noisy ciphertexts for security reasons. For example, the encryption of a data item may involve mapping the data item to a point in a key-dependent grid to which noise is added. In particular, many known implementations of FHE use LWE-type ciphertexts, the security of which relies on the cryptographic hardness of the Learning With Errors problem. These LWE-type ciphertexts use one or more mask values ​​(e.g., torus elements or a specific modulus) qIt may include not only values ​​obtained by modulo operation with ) but also body values ​​derived from the plaintext and mask values ​​using an encryption key, which include noise. A generalization of this is the GLWE type ciphertext, which uses polynomials instead of scalar values ​​for encryption. The RLWE type ciphertext is another type of GLWE ciphertext. Other known implementations of FHE use NTRU type ciphertexts, and generally the same considerations apply to them.

[0007] When a data item is just encrypted, the noise is low—the cipher is up-to-date. For example, if the amount of noise is so small that the data item is decrypted, the noise can be removed at some point during the decryption process, for instance, by rounding. On the other hand, the noise must be high enough to make attacks on the system sufficiently difficult. For example, hypothetically, in the absence of noise, many homomorphic encryption methods could be attacked by linear algebra or other efficient algorithms, such as grid reduction algorithms. When a data item is encrypted, noise is added that is chosen to make attacks difficult while allowing homomorphic operations to still be performed and decryption still possible.

[0008] Most homomorphic operations increase the noise inherent in homomorphically encrypted data items. When many of these operations are performed, the noise can reach a level where unique decryption is no longer possible. Generally, it is known to use a technique called bootstrapping to reduce the noise of homomorphically encrypted values. Bootstrapping can utilize a public key called a bootstrapping key. By using bootstrapping to reduce noise when necessary, it is possible in principle to compute any desired number of homomorphic operations.

[0009] A specific class of fully homomorphic encryption schemes is TFHE-type homomorphic encryption schemes. These schemes are based on I. Chillotti (incorporated herein by reference). 등 "Programmable bootstrapping enables efficient homomorphic inference of deep neural networks" ( Cyber Security Cryptography and Machine Learning (CSCML 2021) This is described in , vol. 12716 of Lecture Notes in Computer Science, pp. 1-19, Springer, 2021. TFHE-type methods differentiate themselves from other FHE methods by supporting a relatively very efficient technique for bootstrapping; additionally, TFHE-type methods simultaneously enable the evaluation of a function during the bootstrap operation referred to as programmable bootstrapping. Regular bootstrapping corresponds to programmable bootstrapping using an identity function.

[0010] Other known implementations of TFHE-type schemes use NTRU-type ciphertexts, and generally the same considerations apply to them. In particular, NTRU can be used in combination with the provided techniques by using a blind rotation that generates the NTRU-encrypted polynomial product of the test polynomial and the bootstrapping monomial, and / or by applying a blind rotation to the NTRU ciphertext as input. Examples of suitable NTRU ciphers are C. Bonte et al.'s "FINAL: Faster FHE instantiated with NTRU and LWE" (Cryptology ePrint Archive, Paper 2022 / 07); and K. Kluczniak's "NTRU- ν -um: Secure Fully Homomorphic Encryption from NTRU with Small Modulus" (Cryptology ePrint Archive, Paper 2022 / 089).

[0011] Interestingly, the output of programmable bootstrapping has an amount of noise independent of the noise within the input ciphertext. Therefore, by performing programmable bootstrapping, the noise within the input ciphertext can be reduced to a fixed amount, while potentially allowing a function to be applied to the input ciphertext. By performing programmable bootstrapping at appropriate times, it is possible to perform cryptographic computing of unlimited multiplicative complexity.

[0012] Despite the capabilities of PBS operations, efficiently performing arithmetic operations (e.g., multiplication) on relatively large values—e.g., values ​​greater than 256 or greater than 1024, defined by modulo operation with respect to the modulus—remains a difficult challenge today. One reason for this is that PBS scales worse than linearly with respect to the size of the inputs.

[0013] P. Clet 등 In the literature "Putting up the Swiss army knife of homomorphic calculations by means of TFHE functional bootstrapping" (Cryptology ePrint Archive, Report 2022 / 149), techniques are proposed for performing multiplications and additions on ciphertexts constructed using a digit-decomposition approach. This is based on Base βThis means that a value is encoded and encrypted by encrypting the elements of the radix decomposition of a value computed by r modulo operation. In this paper, the authors propose an addition operation using two or more programmable bootstrappings for each ciphertext that encrypts the decomposition elements. The addition is performed sequentially. Multiplication is performed based on the textbook multiplication approach. Despite these developments, further improvements are still needed in cryptographic computing for large encrypted values.

[0014] The inventors noted several disadvantages in existing approaches.

[0015] Some existing approaches have low precision for integer plaintexts with TFHE: when using a single ciphertext to encrypt an integer, it is not actually feasible today to perform arithmetic operations such as multiplication on ciphertexts with plaintexts exceeding 7 bits.

[0016] Existing approaches also lack efficiency. Approaches based on converting computing into Boolean circuits and then evaluating the circuits through gate bootstrapping actually suffer from significant slowdowns when the plaintexts are not Boolean. Additionally, existing approaches that rely on encoding values ​​using small integers (e.g., 1 or 2 bits) are slow because operations on these small integers are typically constructed using PBS, which are followed by 1s and therefore require many expensive PBSs.

[0017] Another disadvantage of existing approaches is their lack of parallelization capability. For example, when integers are encoded by radix decomposition, performing addition or multiplication can involve carry propagation based on the MSB of the isomorphic integers, which is a sequential process. This implies deceleration during parallelizable isomorphic circuit evaluation.

[0018] An additional disadvantage is the lack of flexibility. Existing implementations of arithmetic operations, such as addition or multiplication using carry propagation, do not allow for the flexible adaptation of how arithmetic operations occur based on the size of the inputs, thereby making it possible to optimize performance for the use case at hand.

[0019] The goal of the present invention is to solve at least some of these problems.

[0020] According to one aspect of the present invention, a cryptographic computing method for performing cryptographic computing as defined by the claims is provided. According to a further aspect, a device corresponding to a computer implementation method as defined by the claims is provided. According to another aspect, a computer-readable medium as defined by the claims is provided.

[0021] Various aspects relate to performing cryptographic computing on a set of one or more encoded and encrypted values. The values ​​are numeric values, for example, a specific whole modulus ( q They can be values ​​defined by performing a modulo operation with ). Modulus( q These values ​​obtained by modulo operation with ) are, for example, (e.g., domain [0, q As unsigned integers (from ); signed integers (e.g., [- q / 2, q It can be interpreted as / 2)) as fixed-point numbers, etc.

[0022] These encoded and encrypted values ​​may be encoded and encrypted as encryptions of a plurality of individual sub-values, also referred to as "blocks" in this specification. For example, the values ​​and sub-values ​​are based on a fixed basis ( β They can be related to each other according to the radix decomposition based on ). As discussed in more detail elsewhere, there are also several other ways in which values ​​and sub-values ​​can be related.

[0023] In the embodiment, the encryption of the sub-values ​​is LWE encryption. In the embodiment, the encryption of the sub-values ​​is NTRU encryption.

[0024] Cryptographic computing may include applying one or more cryptographic operations, such as arithmetic operations like addition and / or multiplication, to a set of encoded and encrypted values; applying functions such as ReLU, sign, exponent, or other univariate functions; and / or other numerical operations. These cryptographic operations may generally take one or more encoded and encrypted input values ​​(and optionally, additional inputs, such as additional encrypted or unencrypted values) as inputs and may result in one or more encoded and encrypted output values. Interestingly, the operations are performed in an encrypted manner, in particular, in that the input values ​​are not decrypted to perform the operations, so that the operations do not leak information regarding the input and / or output values.

[0025] Interestingly, the inventors considered using encoding and encoding of encrypted subvalues ​​that are allowed to retain the carry. The subvalues ​​may have an associated message modulus as well as a carry message modulus greater than the message modulus. For example, the subvalues ​​may be defined according to a radix decomposition with a radix of 8, and accordingly, also according to the message modulus, but may be encrypted as values ​​moduloed with a carry message modulus of 64. Accordingly, the values ​​may be encoded and encrypted without a carry, which means that the subvalues ​​are non-carry subvalues ​​smaller than the corresponding message modulus; however, the values ​​may also be encoded and encrypted with a carry, which means that at least one subvalue is a carry-containing subvalue greater than or equal to the corresponding message modulus.

[0026] Values ​​encoded and encrypted with a carry, depending on the relationship between the value and non-carry sub-values ​​and the corresponding carry reduction operation, for example β According to the radix decomposition using the message modulo-operated and the lower value( m )second m mod β Reduce carry and carry [ m / β It can correspond to the lower values ​​of that value according to the carry reduction that propagates ] to the next highest value.

[0027] The inventors have recognized that carry-containing sub-values ​​can be used not only within an encrypted operation but also as inputs or outputs of an encrypted operation. An encrypted operation (e.g., addition, multiplication, other arithmetic operations, or univariate function evaluation) can be applied to at least one input value encoded and encrypted with a carry and can result in at least one output value encoded and encrypted with a carry.

[0028] In some cases, encrypted carry reduction may be applied to the output value, and at least one carry-containing sub-value in the output value may be reduced to a non-carry sub-value. However, in other cases, the output value may not be carried reduced and may be input to additional encrypted operations (e.g., additional addition, multiplication, or other arithmetic operations) along with the carry. In either case, if necessary, encrypted carry reduction may be applied during the encrypted operation, for example, to intermediate sub-values. Generally, encrypted carry reduction may be applied to ensure that subsequent encrypted operations do not result in sub-values ​​exceeding the carry message modulus.

[0029] The efficiency of cryptographic computing can be significantly improved for a number of reasons described in detail below by allowing values ​​encoded and encrypted with a carry as inputs and / or outputs of encrypted operations, and in some cases, by selectively performing carry reductions on all carry-inclusive sub-values ​​of the encoded-encrypted value without reducing the carry. In general, the provided techniques enable the efficient execution of cryptographic computing, for example, to evaluate arithmetic circuits for values ​​encoded and encrypted with multiple sub-values. Configurable cryptographic computing techniques are provided that enable the optimization of execution in terms of computing, either before or immediately, by selectively performing encrypted carry reductions on selected sub-values.

[0030] In particular, the lack of precision in some existing approaches is resolved by using multiple sub-values. This enables cryptographic computing to be performed on values ​​defined by modulo operations with relatively large moduli, examples of which are given later.

[0031] By selective carry reduction, the number of required carry reduction operations can be significantly reduced; for example, compared to existing approaches, cryptographic computing can be performed with a much smaller number of programmable bootstrapping applications, thereby greatly improving efficiency. For example, multiple additions or other linear operations, or even multiplications of encrypted values, can be performed without intermediate carry reduction. Various parameters, including message moduli, carry message moduli, and encoding into sub-values ​​of the plaintext during encryption, can vary. This provides the possibility to optimize isomorphic evaluation for a given cryptographic computing, thereby improving flexibility and performance.

[0032] Furthermore, the provided techniques offer improved parallelization potential. Since the outputs of operations can carry, carry reduction between steps can be avoided, thereby making it possible to perform one or a series of encrypted operations simultaneously on individual sub-values. For example, when using an encoding based on radix decomposition, addition can be performed individually on each sub-value. When using an encoding based on the remainder number system, multiplication and carry reduction can also be parallelized. This improves performance, particularly on multi-threaded and multi-core systems.

[0033] Specifically, the paper cited above, "Putting up the Swiss army knife of homomorphic calculations by means of TFHE functional bootstrapping," proposes a sequential addition method using at least two PBSs per ciphertext that encrypts the elements of the decomposition. In comparison, the provided methods allow for the implementation of addition using only one PBS per ciphertext and only when carry reduction is required for that ciphertext; if carry reduction is not required, the addition can be fully parallelized. Furthermore, compared to their proposed multiplication method, the provided methods are more efficient and can be parallelized more effectively.

[0034] Generally, cryptographic computing can be performed in a TFHE configuration. This means that the ciphertexts used to encrypt the sub-values ​​allow for programmable bootstrapping operations. In particular, the ciphertexts may be LWE (Learning With Errors) ciphers, that is, ciphers based on the cryptographic assumption that the learning problem through errors is difficult. As is known by itself, programmable bootstrapping can evaluate LWE decryption on the exponent of a GLWE encrypted monomial implemented, for example, as a so-called blind rotation. Specifically, programmable bootstrapping may involve computing the encrypted polynomial product of a bootstrapping monomial representing the plaintext value as the exponent and a test polynomial. The test polynomial may represent a function applied to the input by programmable bootstrapping. Programmable bootstrapping may use a bootstrapping key that enables the performance of programmable bootstrapping rather than the decryption of the ciphertexts. One or more encrypted operations of encrypted carry reduction and / or cryptographic computing can be implemented using programmable bootstrapping operations.

[0035] Instead of using LWE / GLWE type ciphertexts, it is also possible to use different grid ciphers. For example, a ciphertext to which a blind rotation is applied and / or the encrypted polynomial product resulting therefrom can be NTRU ciphertexts. For example, the message μ The NTRU encryption is a noise polynomial g and private key polynomial f It can be defined by adding the share of to the message, for example can be an invertible polynomial (typically having small coefficients); and the NTRU cipher is It can be given as, g = e 1+ f · e If denoted as 2, c = e 1 / f + μ + e It can be given as 2. In particular, NTRU ciphertexts can contain only a single polynomial. The security of such ciphertexts can be based on the NTRU assumption.

[0036] In the embodiments, the ciphertext to which the blind rotation is applied may be an LWE type ciphertext. For example, the blind rotation may be part of cryptographic computing performed on LWE type ciphertexts (e.g., without involving any NTRU type ciphertexts). Alternatively, the LWE type ciphertext may be obtained by transformation from an NTRU type ciphertext, for example, as part of cryptographic computing performed on NTRU type ciphertexts. It is also possible to apply the blind rotation directly to an NTRU type ciphertext without transformation to LWE. More generally, the ciphertext may be a grid type ciphertext in which security depends on the cryptographic hardness of the grid problem, and there are two examples: LWE and NTRU.

[0037] In an embodiment, the output value may be computed by performing a number of encrypted operations on a set of encoded and encrypted values, wherein the encrypted operations are performed without performing any encrypted carry reduction between or during the encrypted operations. For example, the encrypted operations may include a number of additions and / or a number of multiplications. For example, performing the encrypted computing may include evaluating an arithmetic circuit that includes the encrypted operations. The arithmetic circuit may have, for example, at least 2 (meaning the output of one multiplication is used directly or indirectly as an input to another multiplication) or at least 3 multiplication depths. By allowing a carry, in some cases, these computings may provide a significant performance improvement by being performed without intermediate carry reduction or using fewer carry reductions in either case.

[0038] In the embodiments, the encrypted operation may be applied by individually applying individual sub-operations to the individual ciphers of the sub-values ​​of the input value. In particular, performing the encrypted operation may consist solely of performing these sub-operations. This may be, for example, in the case of linear operations, or in the case of multiplications when using remainder number system representations. In the embodiments, the individually applied encrypted operations may be performed at least partially simultaneously, which is particularly advantageous for performance on multi-threaded and multi-core systems.

[0039] In the embodiment, the encoding of the value as non-carry sub-values ​​is based on the radix decomposition of the value. That is, a value encoded by a set of carry-containing and non-carry sub-values ​​can be computed by carry-reducing the carry-containing sub-values ​​and reconstructing the value from the radix decomposition. The radix decomposition may be for the base of individual basis elements, and individual message moduli correspond to individual basis elements. Encoding using radix decomposition enables various parts of cryptographic computing, particularly arithmetic operations such as addition and / or multiplication and / or division; comparison operations such as determining which of two values ​​is larger; and also allows carry reduction to be performed relatively efficiently.

[0040] Basis elements can define a total modulus corresponding to the product of the individual basis elements. Accordingly, a radix decomposition having a given basis can be used to encode a value moduloed by that total modulus. As also described elsewhere in this specification, it is also possible to use a basis in combination with a modulus smaller than the product of the basis elements.

[0041] The base elements can all be identical; for example, in the case of a base-2 radix decomposition, they can all be equal to 2, or in the case of a base-5 radix decomposition, they can all be equal to 5. However, interestingly, this is not necessary. In some embodiments, the base elements of the radix decomposition are not all identical. This reduces the overhead of using modulus larger than necessary by providing much greater flexibility when selecting base elements according to the size requirements of the application at hand. In particular, the base elements do not need to all be the same power of 2, or they do not need to all be powers of 2 at all. The inventors recognized that cryptographic computing techniques, particularly in TFHE settings, can also be applied to such more general settings.

[0042] In an embodiment, the encrypted carry reduction in the radix decomposition setting can be performed by decomposing the carry-containing sub-values ​​of the output value into the ciphers of the individual sub-values ​​of the sub-values, and adding the ciphers of the sub-values ​​of the sub-values ​​to the ciphers of the corresponding sub-values ​​of the output value. In this way, the carry-containing sub-values ​​can be reduced to a value less than the message modulus. By repeating this process for individual carry-containing sub-values, the encoding and encryption of a carry-free value can be obtained.

[0043] In the embodiment, encrypted multiplication of an encrypted value and an unencrypted scalar can be performed. This encrypted multiplication can be implemented, for example, by using programmable bootstrapping, by computing the individual encrypted subvalues ​​of the multiplication of the encoded and encrypted values ​​and the scalar. If a radix encoding is used, the results of the encrypted multiplications can be combined to obtain the overall result. In this way, multiplication with relatively large scalars can be performed. For example, for smaller scalars, it is also possible to obtain individual encrypted output subvalues ​​by directly multiplying the individual encrypted subvalues ​​by the scalar itself. If a remainder number system encoding is used, individual products of the individual subvalues ​​can form the overall result.

[0044] In an embodiment, the encrypted multiplication of the first encoded and encrypted value and the second encoded and encrypted value may be performed by performing encrypted multiplications of the ciphers of the sub-values ​​of the first encoded and encrypted value and the second encoded and encrypted value. In a radix decomposition setting, the encrypted multiplication of the ciphers of the sub-values ​​may result in an encoded and encrypted value. These encoded and encrypted values ​​may be summed together to obtain the total result. During the multiplication, carry reductions may be performed as necessary, for example, as indicated by the computed fullness as described herein. Interestingly, particularly efficient multiplication of large encrypted values ​​is achieved in this way.

[0045] In the embodiments, the value encoded and encrypted using radix encoding is defined by performing a modulo operation with a modulus smaller than the maximum value expressible by radixing, e.g., the product of basis elements. In this way, the number of situations in which radix encoding can be used is greatly improved. For efficiency, radix encoding preferably uses small basis elements, in which case the expressible maximum value is the product of such small basis elements. Interestingly, the inventors recognized that radix encoding can still be used in cases where computing by performing a modulo operation with a modulus other than the product of small basis elements is required. Various encrypted operations can be performed as if they were operating by performing a modulo operation with the product of basis elements, except that the encrypted carry reduction of the top-most sub-message can be adapted by correcting the carry reduction according to the desired modulus. For example, the correction can be performed by multiplying the top-most sub-value by a scalar and subtracting the result from the value from which the top-most sub-value has been removed.

[0046] In the embodiment, the encoding of the value as non-carry sub-values ​​is based on the remainder number system representation of the value. This representation is also known as the Chines Remainder Theorem (CRT) representation. The representation may be based on a set of mutually coprime basis elements. For example, individual sub-values ​​of the encoded and encrypted value may have message moduli corresponding to the basis elements.

[0047] In particular, the values ​​encoded and encrypted with the carry are individual message modulus( β i Depending on the CRT decomposition using ) and individual sub-values( m i )second m i mod β i It can correspond to the lower values ​​according to the carry reduction that reduces the modulus.

[0048] Similar to radix representation, linear arithmetic operations can be efficiently implemented using CRT representation. Interestingly, CRT representation can also enable particularly efficient multiplication and carry reduction, both of which can be performed separately on individual sub-values ​​and are therefore parallelizable. Furthermore, various other types of operations, such as applying univariate functions, are possible using CRT representation.

[0049] In the embodiments, the encoding of values ​​as non-carry sub-values ​​may be based on a remainder number system representation and may additionally be based on the radix decomposition of the elements of the remainder number system representation. This approach is referred to herein as a "hybrid" approach. For example, one, many, or all elements of the remainder number system may be radix decomposed according to individual (different or identical) bases. Using the hybrid approach, it is possible to efficiently use the CRT approach for relatively large CRT base elements.

[0050] In the examples, when using a radix decomposition to encode elements of a remainder number system representation, the modulus on which these elements are defined (i.e., the corresponding basis element of the CRT basis) may be smaller than the maximum value expressible by the radix decomposition. As generally also described regarding radix decomposition, the radix decomposition can still be used in such cases, thereby enabling the radix decomposition to be used in a wider range of cases. This combination is particularly advantageous because it allows for a better combination of the need to have mutually disjoint basis elements of the CRT and the need to have a radix decomposition using small basis elements.

[0051] If carries are not used in the inputs and outputs of encrypted operations, for example, if encrypted carry reduction is used only within the encrypted operations; if encrypted carry reduction is used immediately after each encrypted operation to produce carry-free outputs; or if the encrypted operations do not involve any carries at all, for example, if the encrypted operations are implemented using programmable bootstrappings without the use of carries, then the various advantages of using CRT representations, particularly efficient and parallelizable encrypted linear and multiplicative operations, also apply. Additionally, a cryptographic computing method is considered that uses CRT but does not involve encrypted operations being applied to encrypted and encoded values ​​without carries.

[0052] In particular, a cryptographic computing method is considered, which comprises: a step of accessing one or more encoded and encrypted values—wherein the encoding of the value as non-carry sub-values ​​is based on the remainder number system representation of the value—; and a step of applying an encrypted operation to at least the encoded and encrypted input value to obtain an encoded and encrypted output value. A cryptographic device corresponding to this method is also considered.

[0053] In an embodiment, performing cryptographic computing with a carry may involve continuously tracking the fullness of the sub-values ​​of the encoded and encrypted values. Fullness may indicate, for example, a limit for a sub-value expressed as a maximum value known to have a sub-value, or a ratio of the maximum value to the carry message modulus. For example, for a value encoded and encrypted without a carry, fullness may indicate that the sub-values ​​of that value are smaller than the corresponding message modulus. For a value encoded and encrypted with a carry, fullness may indicate that at least one of the sub-values ​​of that value may be greater than or equal to the corresponding message modulus, i.e., that it is not guaranteed to be smaller than the message modulus.

[0054] During and / or between encrypted operations, fullness can be used to determine whether to perform encrypted carry reduction on an encrypted subvalue. Specifically, fullness can be determined from one or more input encrypted subvalues ​​for a carry-containing subvalue to be computed in an encrypted operation. If the limit indicated by the fullness exceeds the corresponding carry message modulus, encrypted carry reduction may be applied to one or more of the input encrypted subvalues ​​before computing the carry-containing subvalue, so that the limit for the carry-containing subvalue no longer exceeds the carry message modulus. Accordingly, overflow of the subvalue can be prevented.

[0055] Interestingly, by continuously tracking fullness during cryptographic computing, a flexible method of performing cryptographic computing can be obtained in which the decision to perform encrypted carry reduction can be adaptively determined. Accordingly, the decision may depend on the inputs at hand, such as the public scalar used for computing, the limit(s) on the encrypted inputs provided by the input device, and the fullness at specific iterations of the iterative algorithm. This generally leads to more efficient execution of cryptographic computing. It also makes cryptographic computing easier to specify because there is no need for explicit specification of when to perform carry reduction. This makes the provided techniques particularly suitable for non-experts in cryptographic computing.

[0056] For example, cryptographic computing may be executed in such a way that in the first execution, cryptographic carry reduction of a specific cryptographic subvalue occurs, whereas in the second execution, such cryptographic carry reduction is prevented. Additionally, cryptographic computing operations performed multiple times may or may not include cryptographic carry reductions depending on the fullness of their inputs. For example, cryptographic multiplication or other cryptographic operations may include cryptographic carry reduction for a cryptographic subvalue that is computed during the operation in the first execution of the multiplication but not in the second execution.

[0057] According to further aspects of the present invention, a compiler method and device as defined by the claims are provided. As recognized by the inventors, it is not necessary to continuously track fullness during cryptographic computing. If fullness is computed as part of a compiler method that compiles computing into a homomorphic executable, many advantages of using fullness can also be achieved. That is, such a homomorphic executable can enable efficient cryptographic computing by performing encrypted carry reduction operations, particularly only when necessary. The homomorphic executable may be executable by a cryptographic computing engine, which causes the cryptographic computing engine to perform cryptographic computing on one or more sets of encoded and encrypted values ​​as described herein. The homomorphic executable may include one or more instructions for performing encrypted carry reduction operations as described herein, for example, as part of an encrypted operation or between the execution of encrypted operations. The compiler method comprises the step of determining, for a carry-containing sub-value to be computed, a fullness that indicates a limit for the carry-containing sub-value; If the limit exceeds the corresponding carry message modulus, the method may include a step of generating an instruction that causes the cryptographic computing engine to apply an encrypted carry reduction before computing the carry-inclusive lower value. The compiler method may also include a step of optimizing one or more parameters of the cryptographic computing, such as numbers and values ​​for the message and carry message modulus, so that the cryptographic computing is compiled into an executable file.

[0058] In the embodiments, the message modulus or each message modulus is not a power of 2. In particular, in TFHE configurations, existing techniques for cryptographic computing generally use powers of 2 for their modulus, but the inventors recognized that this is not necessary and that the provided techniques are also used when one or more of the message modulus is not a power of 2. Instead, or additionally, in the embodiments, one or more of the carry message modulus is not a power of 2. This makes it possible to better coordinate operations for the situation at hand, for example, to perform computing on values ​​defined by modulo operations with modulus matching the computing and ranges for the input values ​​at hand.

[0059] In the embodiments, the message modulus is at least 3 and / or at least 5 and / or at least 10. Using larger values ​​for the message modulus has the advantage of having higher precision for a single ciphertext, requiring fewer ciphertexts to represent the value. Additionally, computings, particularly those that do not involve carry reduction, may be more efficient.

[0060] In an embodiment, the carry message modulus may be at least 4 times, at least 8 times, or at least 32 times larger than the corresponding message modulus. Accordingly, effectively represented in bits, at least 2, at least 3, or at least 5 carry bits may be provided. By using a carry message modulus that is significantly larger than the message modulus, the number of operations or sub-steps of operations that can be performed before carry reduction is required is increased, thereby improving efficiency.

[0061] In the embodiments, the carry message modulus or each carry message modulus is at most 128, at most 256, or at most 512. For example, the efficiency of operations such as carry reduction using programmable bootstrapping is typically scaled smaller than linearly by the size of the carry message modulus. By keeping the carry message modulus limited, the computing costs of such operations are kept limited.

[0062] In the embodiments, the modulus in which the encrypted values ​​are defined is at least 1024, at least 4096, or at least 16384. Interestingly, even with the use of such large modulus, the provided techniques still enable relatively efficient computing for them.

[0063] In an embodiment, one or more bits are extracted from one or more sub-values ​​of the encoded and encrypted value(s); the extracted bits are converted into GGSW ciphertexts; and a lookup table is applied to the GGSW ciphertexts, thereby allowing a function evaluation to be applied to one or more encoded and encrypted values. As described in more detail elsewhere, this is a particularly efficient way to implement a function for relatively large values, such as message and / or carry message modulus and / or values ​​where the number of sub-values ​​is relatively large.

[0064] In an embodiment, cryptographic computing may, at some point, include the evaluation of a multivariate function (e.g., a bivariate function) on a plurality of encrypted input values, e.g., sub-values. An important example of a multivariate function is, for example, the encrypted multiplication of first and second sub-values ​​of the same encoding and encryption values ​​or different encoding and encryption values. For example, such an encrypted multiplication may occur as part of an encrypted multiplication of encoding and encryption values ​​or as part of an encrypted operation of a different type. In any case, the evaluation of the multivariate function may be performed by determining a combined cipher representing the individual encrypted input values; and by applying a univariate function to the combined cipher corresponding to applying the multivariate function to the individual input values, for example, by applying programmable bootstrapping to the combined cipher.

[0065] This is a particularly efficient method for performing multivariate function evaluations that combine well with determining fullness and using carries. In particular, when input values ​​are encrypted with carries, there may actually be enough space in the plaintext space to store the combined cipher; here, if necessary, the encrypted carry reduction can be performed to ensure that the combined cipher does not overflow the carry message modulus.

[0066] The techniques provided for enhanced computing of encrypted data can be applied to a wide range of practical applications. Such practical applications include the encrypted evaluation of software programs without accessing general data. For example, medical diagnostic software on medical data can be evaluated without actual access to the medical data. The medical data may include medical images. The medical images may include multidimensional image data, such as 2D (two-dimensional), 3D (three-dimensional), or 4D (four-dimensional) images, captured by various capture modes such as (but not limited to) standard X-ray imaging, CT (Computed Tomography), MRI (Magnetic Resonance Imaging), US (Ultrasound), PET (Positron Emission Tomography), SPECT (Single Photon Emission Computed Tomography), and NM (Nuclear Medicine).

[0067] In the embodiments, the provided techniques may be used to evaluate a neural network on encrypted inputs. Persons evaluating the neural network may or may not have plaintext access to the trained parameters of the neural network, such as weights and biases. Generally, the techniques provided herein, such as improved polynomial multiplication, programmable bootstrapping, and the cross product, improve the efficiency of evaluating the neural network and / or reduce storage and transmission requirements for the ciphertexts or key materials used.

[0068] An embodiment of the method may be implemented as a computer-implemented method on a computer, on dedicated hardware, or in a combination of both. Executable code for an embodiment of the method may be stored on a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Preferably, the computer program product includes non-transient program code stored on a computer-readable medium to perform an embodiment of the method when said program product is executed on a computer.

[0069] In an embodiment, the computer program includes computer program code adapted to perform all or part of the steps of an embodiment of the method when the computer program is executed on a computer. Preferably, the computer program is implemented on a computer-readable medium. Brief explanation of the drawing

[0070] Additional details, aspects, and embodiments will be described merely by way of example with reference to the drawings. The elements of the drawings are illustrated for simplicity and clarity and are not necessarily drawn to actual scale. In the drawings, elements corresponding to elements already described may have the same reference numbers. In the drawings, FIG. 1a schematically illustrates an example of an embodiment of an encryption device. FIG. 1b schematically illustrates an example of an embodiment of a compiler device. FIG. 1c schematically illustrates an example of an embodiment of a cryptographic computing system. FIGS. 2a and 2b schematically illustrate examples of lookup tables for programmable bootstrapping. Figure 3a schematically illustrates an example of a carry-in sub-value. Figure 3b schematically illustrates an example of the addition of lower values ​​including the carry. Figure 3c schematically illustrates an example of scalar multiplication of lower values ​​including the carry. FIG. 3d schematically illustrates an example of an encrypted multiplication operation of the passwords of the first sub-value and the second sub-value. Figure 4 schematically illustrates examples of encoded and encrypted values ​​based on radix decomposition. Figure 5 schematically illustrates an example of encoded and encrypted values ​​based on the remainder number system representation. Figure 6 schematically illustrates an example of encoded and encrypted values ​​based on radix decomposition and using a modulus smaller than the maximum value expressible by radix decomposition. Figure 7 schematically illustrates examples of encoded and encrypted values ​​based on the remainder number system representation and additionally based on the radix decomposition of the elements of the remainder number system representation. FIG. 8 schematically illustrates an example of an embodiment of a cryptographic method that performs cryptographic computing. FIG. 9 schematically illustrates an example of an embodiment of a compiler method. FIG. 10 schematically illustrates a computer-readable medium having a recordable portion according to an embodiment. FIG. 11 schematically illustrates a representation of a processor system according to an embodiment. Specific details for implementing the invention

[0071] Although the subject matter of the claims disclosed herein is susceptible to many different forms of embodiments, and as understood that the present disclosure is to be an example of the principles of the subject matter of the claims disclosed herein and is not intended to be limited to the specific embodiments illustrated and described herein, one or more specific embodiments will be illustrated in the drawings and described in detail herein.

[0072] In the following, for the sake of understanding, the elements of the embodiments are described in terms of operation. However, it will be apparent that the individual elements are arranged to perform the functions described as performed by them.

[0073] Additionally, the subject matter of the claims disclosed herein is not limited merely to embodiments, but includes all different combinations of features described herein or mentioned in mutually distinct dependent claims.

[0074] First, some general information and notations applicable to various embodiments are provided. Throughout this specification, parameters q represents the modulus for encoded and encrypted values, e.g., a positive integer. is a ring Represents. Parameter N represents the magnitude of various polynomials used, and is typically a power of 2. Eun Hwan Represents, ne hwan It represents. χ σ is the average set to 0 and σ Represents a Gaussian distribution with a standard deviation set to . The symbol || represents a chain. The most significant (or least significant) bit of an integer is referred to as the MSB (or LSB). Lookup tables are abbreviated as LUTs. are some parameters ( p 1, … , p n Represents the (computation) complexity of an algorithm (Alg) that potentially depends on ).

[0075] The CRT (Chinese Remainder Theorem) describes the following. R It is called Eul Hwan, and I 0, I 1, … , I n part of About RThese are called mutually disjoint ideals. Subsequently, the following ring isomorphism exists:

[0076]

[0077] In this specification, CRT Is R at R / I 0× R / I 1× … × R / I n It represents the idea of... iCRT The inverse CRT labeled as is R / I 0× R / I 1× … × R / I n second R Maps to.

[0078] Various embodiments use LWE (Learning With Errors) ciphers. Generally, an LWE type ciphertext may include one or more mask values ​​and a body value derived from the mask values ​​and the plaintext value. These values ​​are typically, given a modulus ( q These are integers obtained by modulo operation with ). Various embodiments also use GLWE (Generalized Learning With Error) type ciphertexts. A GLWE type ciphertext may include one or more mask polynomials and a body polynomial derived from the mask polynomials and the plaintext polynomial. A GLWE type ciphertext is a quotient polynomial p ( X ) and modulus( q It can be defined by performing a modulo operation with ). An LWE ciphertext can be considered as a specific type of GLWE ciphertext in which the quotient polynomial has a degree of 1. Another specific type of ciphertext is an RLWE (Ring Learning With Errors) ciphertext in which the number of mask polynomials is 1.

[0079] In particular, secret key Lower message The GLWE ciphertext of can be defined as follows:

[0080]

[0081] Here, is a secret key having coefficients sampled from, for example, a uniform ternary, a uniform ternary, or a Gaussian distribution. is the appropriate scaling of the input message. For example, having coefficients sampled from a uniform distribution in They are polynomials of, and E The coefficients are, for example, Gaussian distribution ( χ σ Sampled from ) It is the noise (error) polynomial of. Parameter k is a positive integer and represents the number of polynomials in the GLWE secret key. To simplify the notations, S k +1 can be defined as -1. In this example, the LWE ciphertext is N It is a GLWE ciphertext where = 1. In this case, the parameter regarding the size of the LWE secret key n = k ...can be considered, and both the ciphertext and the secret key are each lowercase, for example ct q and s It can be represented as. In this example, the RLWE ciphertext is k = 1 and N > 1, for example, a GLWE ciphertext raised to a power of 2.

[0082] An integer throughout this specification to represent the ciphertext modulus ( q ) is used, but multiple ciphertext modulus can be used within encrypted multiplication, for example, the same when necessary qIt is noted that modulus switching is used to align ciphertexts under.

[0083] The above examples describe the secret key symmetric variant of GLWE. The techniques provided herein apply equally to public key variants as are known by themselves. In the latter case, for example, the above secret key may be used as a private key, and the public key may include one or more ciphers of zeros, for example, see R. Rothblum’s “Homomorphic encryption: From private-key to public-key” (Theory of Cryptography (TCC 2011), vol. 6597 of Lecture Notes in Computer Science, pp. 219-234, Springer, 2011) (incorporated herein by reference).

[0084] Various embodiments operate in a TFHE configuration, which means that ciphertexts supporting programmable bootstrapping (PBS) are used. Programmable bootstrapping takes a ciphertext as input and can output a ciphertext of the same message or a function of that message having input-independent noise. PBS may include evaluating the homomorphic decryption of the input ciphertext at the exponent of a polynomial. Generally, in TFHE-type schemes, it is possible to select a set of secure cryptographic parameters to minimize computing costs while meeting the required precision. Interestingly, these parameters can be selected independently of the quantity of homomorphic operations and the depth of the circuit evaluated. Examples of cryptographic schemes in a TFHE configuration that can be combined with the techniques provided herein are provided in the following references:

[0085] - [DM15] L. Ducas 등 , “FHEW: bootstrapping homomorphic encryption in less than a second” (proceedings EUROCRYPT 2015);

[0086] - [CGGI16] I. Chillotti 등 , “Faster fully homomorphic encryption: Bootstrapping in less than 0.1 seconds” (proceedings ASIACRYPT 2016);

[0087] - [CGGI17] I. Chillotti 등 , “Faster packed homomorphic operations and efficient circuit bootstrapping for TFHE” (proceedings ASIACRYPT 2017).

[0088] - [BIPPS22] C. Bonte 등, “FINAL: Faster FHE instantiated with NTRU and LWE”, Cryptology ePrint Archive, Paper 2022 / 07

[0089] Various embodiments deal with performing cryptographic computing on values ​​encrypted as ciphers of sub-values. In this specification, these values ​​are presented, by example, as integers modulo-modulo by a specific modulus. These integer modulo-modulo values ​​can be regarded as equivalent to elements of a discretized torus, as made in some of the references mentioned above. In particular, various references use a real torus to represent message and ciphertext spaces. Use , and arithmetic modulo 2 32 or 2 64 By using It implements the discretization of. This is ( q = 2 32 or q= 2 64 person) It can be identified as equivalent to computing using integers. Accordingly, integers modulo-operated with a given modulus and discretized torus elements can be used interchangeably, particularly as also mentioned in the literature, and Isomorphisms exist between them, for example, see C. Boura et al. “CHIMERA: Combining Ring-LWE-based Fully Homomorphic Encryption Schemes” (J. Math. Cryptol., 14(1):316-338, 2020).

[0090] Programmable bootstrapping operations in TFHE-type methods make them an attractive choice for a wide range of applications. Because bootstrapping is relatively efficient compared to many other FHE methods, it is much more feasible to perform relatively complex computations, for example, using multiplication depths of at least 10, at least 50, or at least 100. In particular, cryptographic parameters in TFHE-type methods can be selected based on the desired precision and resulting computational cost, independently of the number of homomorphic operations and their circuit depth. In contrast, in other FHE methods, bootstrapping can be too inefficient, so these methods are typically applied in a leveled manner; this means that their parameters are selected according to the given computation so that they can be performed without the need for bootstrapping. However, since this leveled approach is not feasible for more complex computations, TFHE-type methods are particularly advantageous in such cases.

[0091] Generally, the security of GLWE-based ciphertexts consists of the distribution of the secret key and three main parameters: n = kN Based on, hereN is the degree of the quotient polynomial, and k is the number of random mask polynomials of the ciphertext, and n is the length of the secret key; q is the modulus; σ is a statistical parameter of the noise, e.g., the standard deviation of the noise. Given these parameters, the method itself for estimating the degree of security provided is known, for example, refer to "On the concrete hardness of Learning with Errors" (Journal of Mathematical Cryptology, 9(3):169-203, 2015) by M. Albrecht et al. (incorporated herein by reference).

[0092] In the embodiments of this specification, the parameters of the TFHE-type LWE and GLWE-based ciphertexts used may be selected based on the desired security level and the desired accuracy of operations, such as the linear combination of LWE ciphertexts and / or the application of programmable bootstrapping, i.e., the noise level arising from the application of such operations. Interestingly, in the TFHE configuration, security parameters may be selected independently of computational complexity, for example, independently of the multiplication depth of the computation. This differs from non-TFHE-type methods in which security parameters are typically selected to limit or eliminate bootstrapping.

[0093] In particular, LWE-based ciphertexts and / or GLWE-based ciphertexts used in the TFHE settings of this specification may use a relatively small modulus, for example, up to 32 bits, up to 64 bits, or up to 128 bits. This modulus is typically selected independently of the computing to be performed, for example, according to the desired precision and / or efficiency. Parameters ( N , k and / or σ ) can also typically be selected to achieve a desired security level independently of the computing to be performed. For example, N can be set to at least 512 and / or up to 2048 or 4096, e.g., 1024. For example, in the embodiment, RLWE is at least 512 and / or up to 2048 or 4096, e.g., 1024. N It is used as, k = 1. N These values ​​for are typically not used in non-TFHE encryption schemes, as they would severely limit the computations that can be performed; instead, in non-TFHE schemes, q and N Typically, both are selected based on the desired security level, so q It can be much larger.

[0094] FIG. 1a schematically illustrates an example of an embodiment of a cryptographic computing device (110). The device (110) may be for performing an encrypted computation on one or more sets of encoded and encrypted values.

[0095] Encoded and encrypted values ​​may be encoded and encrypted as encryptions of multiple individual sub-values. Here, the sub-values ​​may have a corresponding message modulus and a carry message modulus greater than the message modulus. Among the encoded and encrypted values, one or more values ​​may be encoded and encrypted without a carry. In this case, the non-carry sub-values ​​may be smaller than the corresponding message modulus. One or more values ​​among the encoded and encrypted values ​​may be encoded and encrypted with a carry. In this case, at least one carry-containing sub-value may be greater than or equal to the corresponding message modulus. The remaining zero or greater sub-values ​​may be non-carry sub-values.

[0096] The device (110) may include a processor system (130), a storage (140), and a communication interface (150). The storage (140) may include local storage, such as a local hard drive or electronic memory. The storage (140) may include non-local storage, such as cloud storage. In the latter case, the storage (140) may include a storage interface to the non-local storage. For example, the storage (140) may be for storing one or more encoded and encrypted values ​​being computed. The storage (140) may include additional data, such as bootstrapping keys for use in blind rotation, as also discussed elsewhere.

[0097] The device (110) can communicate internally with other devices, external storage, input devices, output devices, and / or one or more sensors via a computer network. The computer network may be the Internet, an intranet, a LAN, a WLAN, etc. The computer network may be the Internet. The device may optionally include a connection interface (150) arranged to communicate with other devices as needed. For example, the connection interface may include a connector, such as a wired connector, such as an Ethernet connector, an optical connector, etc., or a wireless connector, such as an antenna, such as a Wi-Fi, 4G, or 5G antenna. Communication, such as internal communication, may use other communication protocols or media, such as an internal data bus.

[0098] In the device (110), the communication interface (150) may be used to transmit or receive digital data. For example, the device (110) may be configured to receive or transmit data representing one or more encoded and encrypted values ​​and / or LWE ciphers representing inputs and / or outputs of cryptographic computing, for example. As another example, the communication interface (150) may be used to receive data representing a bootstrapping key.

[0099] The execution of the device (110) may be implemented in a processor system (130), for example, one or more processor circuits, for example, microprocessors, and examples thereof are illustrated in this specification. The device (110) may include a plurality of processors that can be distributed across different locations. For example, the device (110) may use cloud computing.

[0100] The processor subsystem (130) may be configured to apply an encrypted operation to at least an input value encoded and encrypted with a carry in order to obtain an output value encoded and encrypted with a carry. The processor subsystem (130) may be further configured to apply an encrypted carry reduction to the output value encoded and encrypted with a carry in order to obtain additional encoding and encryption of an output value in which at least one carry-containing sub-value is reduced to a non-carry sub-value.

[0101] The processor subsystem (130) may be configured to receive one or more inputs for cryptographic computing, for example, including one or more encoded and encrypted values, and / or, as described herein, one or more encrypted but unencoded values ​​that the processor subsystem (130) can optionally convert into encoded and encrypted values. In principle, it is also possible to receive an input having a carry, but the encoded and encrypted value provided as an input is typically encoded and encrypted without a carry. Along with the input, the processor subsystem (130) may receive a limit for the encrypted value, for example, as fullness or something similar.

[0102] The processor subsystem (130) may be configured to output one or more outputs of cryptographic computing, for example, including one or more encoded and encrypted values, and / or, as described herein, one or more encrypted but unencoded values ​​determined by the processor subsystem (130), for example, by converting the encoded and encrypted values ​​into encrypted values. When outputting the encoded and encrypted values, the processor subsystem (130) may be configured to apply an encrypted carry reduction operation to output the encrypted and encrypted values ​​without carry.

[0103] For example, the processor subsystem (130) can acquire inputs through the communication interface (150) and / or output outputs from / to the storage (130) and / or from / to other stakeholders.

[0104] Some of the drawings illustrate functional units that may be functional units of a processor system. For example, the drawings may be used as blueprints of possible functional organization of a processor system. Processor circuit(s) are not drawn separately from the units in most of the drawings. For example, the functional units illustrated in FIGS. 2–6 (see below) may be implemented wholly or partially as computer instructions that are stored in the electronic memory of a device such as device (110) and executable by the microprocessor of device (110). In hybrid embodiments, the functional units are implemented partly in hardware, for example, as coprocessors, such as arithmetic and / or cryptography coprocessors, and partly in software that is stored and executed on device (110).

[0105] For example, the device (110) may be a device for performing cryptographic computing. The cryptographic computing may use homomorphic encryption. For example, the device (110) may be used to perform cryptographic computing, for example, even if the data is received in an encrypted form from a data provider, for example, and even if the device (110) cannot decrypt the data, the device may perform the computing. The computing may involve encrypted operations and / or carry reduction as described herein.

[0106] For example, the storage (140) may store encrypted data items received from, for example, one or more data providers or generated as intermediate or final results of computing, for example, outputs. Typically, most or all data items for which computing is performed on the device (110) are encrypted with a key (or keys) unknown to the device (110), that is, the device (110) may not be configured to obtain general data items corresponding to encrypted data items, such as those stored in the storage (140), for example. The decryption key in its general form is secret to the device (110), but the encryption / decryption key may be available in an encrypted form.

[0107] For example, a processor system may be configured to perform a series of homomorphic cryptographic operations. The encrypted operations include linear operations, e.g., addition, subtraction and / or scalar multiplication; multiplications; univariate function evaluations; etc. Interestingly, using the provided techniques, a number of encrypted arithmetic operations, e.g., arithmetic circuits having a multiplication depth of at least 2, at least 3, or at least 5, may be performed on a set of encoded and encrypted values, wherein the performance does not include encrypted carry reduction.

[0108] FIG. 1b schematically illustrates an example of an embodiment of a compiler device (119) for compiling computing into a homomorphic executable file. The homomorphic executable file may be executable by a cryptographic computing engine, which causes the cryptographic computing engine to perform cryptographic computing on one or more sets of encoded and encrypted values, for example, as described herein by the device (110) of FIG. 1a. The homomorphic executable file may include one or more instructions for performing an encrypted carry reduction operation, for example, as part of an encrypted operation or between the execution of encrypted operations, as described herein. The device (119) may perform cryptographic computing itself, for example, the device (110) of FIG. 1a may be combined with the device (119) of FIG. 1b.

[0109] The device (110) may include a processor system (139), a storage (149), and a communication interface (159). The processor system (139), the storage (149), and the communication interface (159) may be implemented as described for the individual components of FIG. 1A. The storage (149) may be for storing a description of a homomorphic computing to be compiled into a homomorphic executable file, for example, as program code, an instruction graph, etc. The communication interface (159) may be used to receive the computing to be compiled. The communication interface (159) may be used to transmit the homomorphic executable file.

[0110] The processor subsystem (139) may be configured to generate a homomorphic executable file by converting operations into homomorphic computing instructions, as is known in the art itself. Interestingly, the processor subsystem (139) may be configured to continuously track the fullness of the sub-values ​​of the encoded and encrypted values ​​used in cryptographic computing. In this way, if necessary, encrypted carry reduction operations may be included in the homomorphic executable file. In particular, the processor system (139) may be configured to determine a fullness that indicates a limit for the carry-containing sub-value to be computed. If the limit exceeds the corresponding carry message modulus, the processor subsystem (139) may generate an instruction that causes the cryptographic computing engine to apply encrypted carry reduction before computing the carry-containing sub-value. The processor subsystem (139) may be configured to optimize one or more parameters of the cryptographic computing, such as the number and value for the message and carry message modulus, so that the cryptographic computing is compiled into an executable file.

[0111] FIG. 1c schematically illustrates an example of an embodiment of a cryptographic computing system (100). The system (100) is configured to perform cryptographic computing using a homomorphic cipher, such as a fully homomorphic cipher.

[0112] In this example, the system (100) includes a compiler device (111), a data provider device (113), and an encryption computing device (112). The compiler device (111) may be combined with the encryption computing device (112) or the data provider device (113) in a single device. The device (112) may be configured to receive encrypted data items from the data provider (113). At least one data item may be received in an encrypted form. One or more additional data items may be received in a normal format. The device (112) may be configured to receive a homomorphic executable file for performing encryption computing from the compiler device (111).

[0113] The device (112) can perform computing as described herein on received data items and possibly on stored data items as well. Interestingly, computing can be performed by the device on encrypted data without decrypting the data, for example, without converting encrypted data items into data in a normal format.

[0114] In this example, the device (112) may be based on the device (110) of FIG. 1a, for example, may include the processor system (130), storage (140), and / or communication interface (150) of FIG. 1a. Each of the devices (111, 112, 113) may be based on the device (119) of FIG. 1b, for example, may include the processor system (139), storage (149), and / or communication interface (159) of FIG. 1b.

[0115] Optionally, the compiler device (111) or the data provider device (113) may be further configured to generate key material for the cryptographic computing device (112) to perform cryptographic computing, for example, by including a bootstrapping key for performing programmable bootstrapping as discussed herein. The device generating the key material provides the bootstrapping key (151) to the device (112), for example, by transmitting the bootstrapping key (151) over a computer network (150) and uploading it to a shared storage. The key material may also be generated by an individual key generating device (not shown in this drawing).

[0116] Although not illustrated in this drawing, the cryptographic computing system (100) may include a plurality of cryptographic computing devices, e.g., two, three, or more than three. Cryptographic computing may be distributed among the plurality of cryptographic computing devices. The cryptographic computing devices may exchange with one another typically encrypted intermediate computing results, such as encoded and encrypted values ​​including a plurality of encrypted sub-values. Each encrypted multiplying device may be implemented as a cryptographic computing device (112) and may perform encrypted operations and / or encrypted carry reduction operations as described herein.

[0117] Homomorphic encryption methods can be applied in many settings. For example, an encrypted computing device (112) may be operated by a cloud provider. The cloud provider may provide computing and storage services to its clients. By using homomorphic encryption, a data provider device (113), such as a client of the cloud provider, can transmit its data in an encrypted form. The cloud provider can still perform the required computing and / or required storage, but cannot know the corresponding general data. For example, the data provider device (113) may use an encryption key of a type corresponding to a specific homomorphic encryption system used to encrypt data items. When computing results are received by the data provider (113) from the encrypted computing device (112), a corresponding decryption key may be used to decrypt the encrypted data items. The encryption key and the decryption key may be the same, and typically they are.

[0118] For example, the cryptographic computing system (100) can be configured so that cryptographic computing devices train machine learning models, such as image classifiers, such as medical models, without accessing general data items. For example, linear regression can be performed on input data, possibly without bootstrapping. For example, backpropagation can be performed on input data using bootstrapping. The resulting model parameters can be returned to an entity that possesses the decryption key. This enables multiple providers of medical data to pool their data by transmitting data to a cloud provider. Then, the cloud provider returns the model parameters without accessing general data. The cryptographic keys can be identical to the decryption keys.

[0119] After the model is trained, the cryptographic computing system (100) can be used, so to speak, to provide a model for use with medical data. This can be done using general model parameters or encrypted model parameters—in both cases, using encrypted data, e.g., encrypted input, intermediate, and output data. Using general model parameters is generally much more efficient. In both cases, the effect of the system is that computing, so to speak, image classification, e.g., medical image classification, is performed without the computer knowing the general data items. For example, mammography can be evaluated for cancer without the image ever existing in plane on the cryptographic computing device (112) and without any cryptographic computing device (112) or any association of such devices knowing what the result of the cancer evaluation is. From a privacy perspective, running a general model on encrypted privacy-sensitive data may be acceptable, but running it on general privacy-sensitive data may not be acceptable.

[0120] Other applications involve database services that, for example, retrieve encrypted data from an encrypted database; for example, computing may be a comparison between an input item and a database item. For example, multiple computing operations may be combined to generate a database index that matches an index. For example, the database may be a genomic database, and the input may be a gene sequence. For example, the system (100) may be used for the protection and control of a device. For example, a device, or even a large device such as a power plant, may transmit sensor values ​​to an encrypted computing device (112) and receive encrypted control signals in return. The control signals are computed from the sensor signals. An attacker of the system may be able to determine the content of the data exchanged with one or more encrypted computing devices (112), or even gain access to the intermediate data of these devices, but the attacker will not be aided because the data is encrypted. Even if all encrypted computing devices (112) of the system (100) are completely compromised, the data is not exposed because the decryption key is not known to these devices. Computing control signals may involve mathematical operations such as linear algebra, means, matrix multiplication, and polynomial evaluation, all of which can be executed as homomorphic cryptographic operations. In any case, these applications involve computing that includes arithmetic operations on relatively large values, which can be efficiently implemented as described herein.

[0121] For example, a pool of encrypted data items may be maintained in an encrypted computing system; a subset of these may be received, and another subset may be the result of the encrypted computing, e.g., intermediate results. For example, an encrypted computing device (112) may be configured to apply homomorphic encryption operations to one, two, or more encrypted data items in the pool, e.g., a set of input and / or intermediate and / or output values. The result may be a new encrypted data item that can be stored in the pool. For example, one or more of the values ​​may be encoded and encrypted, while zero or more other values ​​may be unencoded and directly encrypted. The pool may be stored in a storage of the encrypted computing system. This may be a local storage or a distributed storage. In the case of a distributed storage, one or more encrypted data items may be represented multiple times in the pool. Encrypted, particularly encoded and encrypted data items, may be transferred from one computing device to another computing device, for example, if their values ​​are needed elsewhere. Pools can be implemented in various ways, such as register files, arrays, and various data structures.

[0122] Encrypted data items can represent all kinds of data. For example, encrypted data items can represent numbers that need to be averaged or used for linear regression, etc. For example, encrypted data items can represent images. For example, each pixel of an image can correspond to one or more encrypted data items. For example, a grayscale pixel can be represented as gray levels, which can ultimately be represented as a single encrypted data item. For example, 256 gray levels can be encoded as a single encrypted data item. For example, a color pixel can be represented as multiple color levels, such as RGB levels, which can ultimately be represented as a tuple of encrypted data items. For example, three 256-level colors can be encoded as individual encoded, or encoded and encrypted, values.

[0123] A set of homomorphic cryptographic operations may be defined for computing. For example, a network or circuit of operations that implement computing together from homomorphic cryptographic operations may be constructed, for example, by a compiler device as described in FIG. 1b, or by the computing device itself. For example, the operations may include Boolean operations. The way homomorphic cryptographic operations are combined, for example, which operation is applied to which operand of a pool, determines the computing being performed. For example, computing may be represented as a list of homomorphic cryptographic operations to be performed, along with an indication of the encrypted data item on which the homomorphic cryptographic operations will be performed. The network or circuit may indicate to the cryptographic computing device (112) when to perform encrypted carry reduction, and / or the cryptographic computing device (112) may determine whether to perform the encrypted carry reduction operation based on tracking the fullness of the sub-values ​​being computed.

[0124] FIGS. 2a and 2b schematically illustrate examples of lookup tables for programmable bootstrapping.

[0125] In various embodiments, cryptographic computing is cryptographic computing in a TFHE configuration. In such a configuration, the cryptographic schemes used, such as LWE ciphers, may support programmable bootstrapping operations. As is known by itself, such programmable bootstrapping can evaluate LWE decryption on the exponent of a GLWE encrypted monomial. As is known by itself, by using individual test polynomials in the programmable bootstrapping operation, programmable bootstrapping can be used to evaluate various functions for the LWE cipher to which it applies. As also described elsewhere, programmable bootstrapping can be used to perform various other operations, such as univariate function evaluation as well as encrypted carry reduction.

[0126] Now, examples of programmable bootstrapping operations are discussed. Bootstrapping can evaluate univariate functions and simultaneously reduce noise in the input ciphertext. Throughout this specification, to represent programmable bootstrapping PBS Notation is used. A function evaluated for an input can be represented as a look-up table (LUT). A look-up table can correspond to a test polynomial to which a GLWE encrypted monomial can be multiplied. By computing a GLWE encrypted monomial and multiplying it by a test polynomial, the look-up table can be effectively rotated to output the correct element within the table.

[0127] A visual representation of a polynomial storing an LUT is shown in FIG. 2a. In this example, the individual elements (201-204) are polynomials An array representing the individual coefficients of is shown. The function may be an identity function, in which case programmable bootstrapping can implement regular bootstrapping.

[0128] In various cases, redundant lookup tables can be used. In particular, given a value ( r For ), the coefficients are continuous r Repeated r - A redundant LUT can be used. This is exemplified in Fig. 2b. In this example, the function ( f The LUT for ) is represented as an array containing individual blocks (210, 211, 212) of 16 iterations of each output value. A redundant PBS may be used to reduce noise in the input ciphertext.

[0129] PBS can use a bootstrapping key. The bootstrapping key may include the GGSW ciphers of the individual elements of the secret key used to encrypt the input LWE ciphertext of the PBS. Bootstrapping is The scaled ciphertext of the input LWE ciphertext, e.g., It may include a modulus switching operation that transforms into an element from. Blind rotation may be applied to effectively rotate the GLWE encryption of the redundant LUT according to the LWE ciphertext generated by modulus switching using a public bootstrapping key. A sampling operation may be applied to extract fixed coefficients of the GLWE encryption, such as constant coefficients, as the LWE ciphertext.

[0130] Throughout this specification, the following notations may be used to indicate the execution of programmable bootstrapping operations:

[0131] ct out ← PBS (ct in , BSK, P f ),

[0132] Here

[0133] For example, using techniques known by itself from "Programmable bootstrapping enables efficient isomorphic inference of deep neural networks," PBS It can be performed with the following computational complexity:

[0134]

[0135] Here

[0136]

[0137] Various existing implementations of programmable bootstrapping operations, for example, the implementation of “programmable bootstrapping enables efficient isomorphic inference of deep neural networks,” can be performed on input ciphertexts in which the most significant bit is 0.

[0138] For example, it is possible to use NTRU type ciphers for the input ciphertext and / or the encrypted polynomial product. More generally, the provided techniques are X N The encrypted polynomial product of a test polynomial and a bootstrapping polynomial, moduloed with a quotient polynomial different from +1, can be applied to any blind rotation that causes any accumulator-based blind rotation.

[0139] In particular, regarding the use of NTRU for encrypted polynomial products, it is noted that the "blind rotation" algorithm discussed itself uses an abstract accumulator (ACC). As discussed, this accumulator can be implemented based on GLWE, but this is not mandatory. For example, other types of accumulators based on NTRU are possible. Based on NTRU ciphertexts, a gadget cipher similar to the GGSW cipher can be defined, and the cross product can be defined using this. Detailed examples can be found in C. Bonte et al.'s "FINAL: Faster FHE instantiated with NTRU and LWE" (https: / / ia.cr / 2022 / 074). Accordingly, the accumulator can be implemented based on NTRU, where the value of the accumulator is, for example, It can include elements of and CMux can be defined.

[0140] For example, using this type of NTRU-based accumulator μ LWE ciphertext that encrypts ( c Applying blind rotation to ) is a specific scaled plaintext - m’ ·Δ in bootstrapping monomial for X - m' ·Δin and test polynomial P f The encrypted polynomial product of X - m' ·Δin · P f It can cause. In this case, the encrypted polynomial is c' = g / f + X - m' ·Δin · P f It can be an NTRU ciphertext of the form. Using an appropriate key switching key, X - m' ·Δin · P f An LWE ciphertext that encrypts the constant term of can be optionally extracted from this encrypted polynomial, as discussed in the "FINAL" reference.

[0141] Instead of or in addition to the encrypted polynomial, the input ciphertext does not need to be an LWE type ciphertext. In particular, as discussed in the "FINAL" reference, blind rotation can be applied to NTRU type ciphertexts. As discussed in the "FINAL" reference, it is also possible to obtain an input LWE ciphertext by transforming from an NTRU ciphertext.

[0142] In these cases as well, a test polynomial such that the encrypted polynomial product includes the desired output value of the fixed coefficients P f It is desirable to define .

[0143] Interestingly, it is also possible to use the techniques provided herein in combination with programmable bootstrapping without padding, which means that programmable bootstrapping can be operated on input ciphertexts having any most significant bit. Such programmable bootstrapping is, for example, I. Chillotti 등 It is provided in "Improved programmable bootstrapping with larger precision and efficient arithmetic circuits for TFHE" (proceedings ASIACRYPT 2021). In these cases, as described elsewhere in this document, Encode When using, go It can be used instead.

[0144] Another method of performing programmable bootstrapping is, for example, by using circuit bootstrapping, known in itself, to extract individual bits of the ciphertext and convert them into GGSW ciphertexts; and by applying a lookup table to the individual GGSW ciphertexts. As known in itself, the latter can be performed particularly efficiently using mixed packing, such as horizontal and / or vertical packing. Furthermore, for this technique to perform programmable bootstrapping, padding bits may not be required, for example, the most significant bit may retain an arbitrary value. This technique is discussed in more detail in relation to FIG. 4.

[0145] Generally, programmable bootstrapping may include a key switching operation performed such that the output ciphertext becomes a cipher under the same key as the input ciphertext. Throughout this specification, to represent such programmable bootstrapping including key switching PBS―KS Notation may be used. In this case, the key material PUB used for programmable bootstrapping may include a key switching key for performing such key switching. Generally, performing key switching is optional. PBS―KS The complexity is as follows:

[0146] ,

[0147] Here It indicates the complexity of the key switch.

[0148] Figure 3a schematically illustrates an example of a carry-in sub-value.

[0149] In various embodiments, the value may be encoded and encrypted, for example, as encryptions of a plurality of individual sub-values ​​corresponding to individual digits of the radix decompositions of the value. According to this correspondence, the individual sub-values ​​may be associated with a specific modulus referred to as the message modulus. For example, base- β When using radix decomposition, the message modulus is β It can be set to. Accordingly, the value can be encoded and encrypted by encoding the value as sub-values ​​obtained by modulo operation with the message modulus and encrypting these sub-values.

[0150] However, interestingly, in the various embodiments described herein, sub-values ​​may be stored with a carry. This is because the carry message modulus (where the sub-value is greater than the message modulus) p This means that it is defined by modulo operation. Accordingly, the lower value can be larger than the message modulus.

[0151] Individual sub-values ​​may each be encrypted according to the same encryption key, but this is not mandatory. In the latter case, various operations on the encoded and encrypted values, such as carry propagation as described herein, may use, for example, key switching from the encryption key of one sub-value to the encryption key of other sub-values ​​as needed.

[0152] For example, as exemplified in FIG. 3a, the ciphertext can encrypt a value characterized by the following:

[0153] - An optional bit of padding (301) set to 0 as the most significant bit;

[0154] - β ≤ p In carry message modulus ( p )(302) and message modulus( β )(303), for example, base decomposition ( p andβ Note that it does not need to be powers of 2);

[0155] - Value( x ), for example β Smaller non-carry value or β Greater than or equal to p Smaller carry included value.

[0156] For example, carry message modulus ( p ) is the message modulus( β It may be at least 4 times the message modulus; at least 8 times the message modulus, or at least 32 times the message modulus. For example, the carry message modulus may be up to 128, up to 256, or up to 512. Given a message of a specific size (e.g., up to 8 or up to 16 bits), the remaining space of the carry message modulus may be used for the carry.

[0157] For example, the drawing is the message modulus ( β = 4 = 2 2 ) and carry message modulus( p = 16 = 2 2+2 Examples of values ​​having ) are provided. A cipher using such a message modulus and a carry message modulus may have a 2-bit carry that is set to 0 for non-carry values ​​and can be used advantageously for encrypted operations.

[0158] For example, non-carry value ( m ) scales the value according to the following algorithm, and then, the scaled version( ) as a password, for example It can be LWE encrypted by using it. This exemplary algorithm is 0 and p It takes an integer between them and provides more space to compute 1-bit padding and leveling operations.

[0159]

[0160] Encrypted operations can increase the encrypted value, particularly making it larger than the message modulus. In particular, the most significant part of the encrypted value corresponding to dividing the encrypted value by the message modulus (e.g., the most significant bits) can represent a carry and may be referred to herein as a "carry buffer".

[0161] Two examples of this are illustrated in relation to FIGS. 3b and FIG. 3c. FIG. 3b illustrates computing the encrypted addition of two values ​​(311, 312) encrypted without a carry (e.g., having a carry buffer and padding bits set to 0). As illustrated in the figure, the value encrypted by the resulting ciphertext (313) may exceed the message modulus, that is, the value may be a lower value including the carry. In this particular case, as illustrated, one carry bit (314) may be consumed by the addition.

[0162] An additional example is illustrated in FIG. 3c. This figure illustrates the encryption of a non-carry value (321) and a scalar (i.e., an unencrypted value) ( μ < β An example of scalar multiplication of ) is given, which results in an encrypted value (322). In this case, the number of carry bits (323) that may be affected is proportional to the size of the constant.

[0163] Returning to FIG. 3a. As illustrated in FIG. 3b and FIG. 3c, various encrypted operations may result in values ​​encoded and encrypted with a carry; that is, values ​​having a carry-containing sub-value greater than or equal to the corresponding message modulus. Or, at least, for some sub-values, it may not be guaranteed that the sub-values ​​do not contain a carry. While it is possible to directly perform an encrypted carry reduction operation on such carry-containing values ​​to reduce the value to less than the message modulus, the inventors have recognized that this is not always necessary. In some cases, it is possible to retain the sub-values ​​encrypted with a carry and use the values ​​encoded and encrypted with such a carry as input for other encrypted operations.

[0164] However, in some respects, for example, if the applied encrypted operation or sub-operation could potentially lead to a value exceeding the corresponding carry message modulus, encrypted carry reduction may be necessary. Accordingly, it may be determined at some point during cryptographic computing whether to perform encrypted carry reduction on the carry-inclusive value.

[0165] Interestingly, to determine whether to perform encrypted carry reduction, the inventors considered continuously tracking the fullness of carry-containing subvalues ​​computed as part of the encrypted operation. Fullness can indicate a limit for the carry-containing subvalues. Fullness can be regarded as metadata associated with the ciphertext. Fullness can indicate whether it is possible to apply an encrypted, e.g., leveling isomorphic operation to the ciphertext, or whether the carry needs to be emptied first. When it is still possible to compute leveling operations, fullness can quantify the amount of leveling operations that can still be performed.

[0166] Fullness is typically computed dynamically during cryptographic computing, but as discussed elsewhere, it can also be computed by a compiler device. Tracking fullness during computing can be referred to here as a "smart" variant that performs cryptographic computing using encrypted carry reduction. Smart cryptographic computing can verify specific conditions to automatically determine whether the carry buffer should be emptied or if other leveling operations can still be performed. In this sense, smart cryptographic computing can be regarded as an improvement on gated bootstrapping for a setup where lower values ​​do not need to be binary and carries can be preserved between cryptographic operations to perform more leveling operations between bootstrappings. Interestingly, because smart cryptographic computing can automatically determine whether to perform encrypted carry reduction, deciding when to perform encrypted carry reduction may not be necessary during the design time of cryptographic computing.

[0167] In particular, the ciphertext can be used to encrypt subvalues ​​at specific intervals defined by fullness. The encrypted subvalues ​​can be used as inputs for leveling isomorphic operations, which can result in different, typically larger, intervals. Specifically, the top part of the subvalue can be filled with carries. This part of the encrypted subvalue can be referred to as the carry buffer.

[0168] In particular, secret key ( s Encrypted under ) encrypted, encrypted value( m )(e.g., sub-values ​​of encoded and encrypted values) is the so-called defined as follows Arith cryptogram( It can be expressed as ) along with its associated fullness, and:

[0169]

[0170] Here am.

[0171] In particular, fullness can be defined as follows. is called the carry message modulus, and Using a message modulus (which may or may not be a power of 2), e.g., a radix decomposition base, β ≤ p It becomes. ct value( m < p It is used as a ciphertext to encrypt ) μ cast m The known worst-case scenario for, for example m Since this is considered the largest possible integer, 0 ≤ m ≤ μ am. person The fullness of can be defined as the following value:

[0172]

[0173] Using this definition, ciphertext( ct If the degree of ) reaches 1, this is the largest integer value that these ciphertexts can store without consuming padding bits (or without nesting if padding bits are not used). p - 1) implies that it is potentially encrypting. Therefore, deg When it is 1, carry reduction can be performed. That is, for a carry-containing sub-value to be computed, its resulting fullness can be determined, and if the fullness is greater than 1, encrypted carry reduction can be performed before computing the carry-containing sub-value.

[0174] Although the above is used throughout this specification as an exemplary definition of fullness, other definitions are also possible. For example, fullness may be defined by the integral magnitude of the interval of possible values ​​of a value, or fullness may be defined by the minimum and maximum possible values ​​being encrypted. In either case, fullness may indicate a limit for a carry-inclusive sub-value, and if it is determined that the limit exceeds the corresponding carry message modulus for the carry-inclusive sub-value to be computed, an encrypted carry reduction may be applied before computing said carry-inclusive sub-value.

[0175] In particular, the fullness of the encrypted value can be more granular than indicating whether the value contains a carry, and also more granular than counting the integer number of carry bits the value possesses. This allows for obtaining an estimate of the carry bit consumption level in a stricter case, thereby enabling an increase in the number of leveled arithmetic operations before carry extraction is performed.

[0176] Now, examples are given of how fullness can be computed for various homomorphic arithmetic operations on encrypted values, particularly for addition, subtraction, and scalar multiplication. In general, fullness can be determined by determining the limits of the output of an operation based on the limits of the individual inputs. These limits generally depend on how the operation is implemented and, in many cases, can be derived from the implementation.

[0177] How permission checks can be defined for isomorphic operations to determine whether an operation can be performed without exceeding the carry message modulus is further illustrated. As discussed elsewhere in this specification, operations on encoded and encrypted values ​​can be implemented in terms of these operations on encrypted values.

[0178] In the discussion below, 2 Arith Ciphertexts , ) is referred to as "compatible" in the following cases:

[0179]

[0180] In particular, the fullness of an encrypted addition can be computed. Below, this involves the fullness (deg1, deg2) and two ciphertexts, respectively ( , This is exemplified for the homomorphic addition of ). The output is a new ciphertext that encrypts the addition of two original messages with updated fullness ( )am.

[0181]

[0182]

[0183] This algorithm allows for compatible inputs If it is 1, it can be applied. Computational complexity of the addition algorithm Is ( n + 1) = O ( n It can be.

[0184] As another example, the fullness of the encrypted negation can be determined. In particular, this is the message ( m Ciphertext that encrypts ) The isomorphic modular negation of ) is exemplified below. The output is the updated fullness (deg out A new ciphertext that encrypts the negation of the original message with ) ) is. ζ is defined as follows:

[0185]

[0186] This value Neg It is useful for algorithms. By the definition of degree, 0 ≤ m ≤ μ So that it becomes It is. Next, " ::" without notation:

[0187]

[0188] Accordingly, z Is μ ≤ z So that it becomes β It can represent the minimum multiple of. This value can represent the worst case for negation.

[0189]

[0190] In this case, this algorithm can be applied. Computational complexity ( )Is It could be.

[0191] Another example is the computing of fullness for encrypted subtraction. Below, two LWE ciphertexts ( , Isomorphic modular subtraction of ) is exemplified. The output is a new ciphertext that encrypts the subtraction of two original messages with updated fullness ( )am.

[0192]

[0193] The inputs are compatible and In this case, an algorithm can be applied. The computational complexity of subtraction ( )Is: It could be.

[0194] Another example is encrypted scalar multiplication, that is, multiplication by a value known to the person performing the encrypted multiplication. Below, the ciphertext ( ) and known integers( μ Isomorphic scalar multiplication between ) is exemplified. The output is μ A new ciphertext that encrypts the product of the original message ( )am.

[0195]

[0196]

[0197] In this case, this algorithm can be applied. Computational complexity of the scalar multiplication algorithm Is It could be.

[0198] An alternative method for performing multiplication is to use programmable bootstrapping. Programmable bootstrapping typically resets the fullness to the fullness of a value that does not retain a carry.

[0199] FIG. 3d schematically illustrates an example of an encrypted multiplication operation of the ciphers of a first encrypted value and a second encrypted value. For example, the values ​​may be sub-values ​​of the individual encrypted and encoded values ​​being computed. How fullness is computed is also exemplified.

[0200] This technique of computing the encrypted multiplication of two ciphertexts may be of independent interest and may also be used in cryptographic computing that does not involve, for example, encoded and encrypted values ​​with a carry, or even in cryptographic computing that does not involve encoded and encrypted values ​​at all. Accordingly, such cryptographic computing may include accessing a set of encrypted values ​​and performing cryptographic computing, the cryptographic computing of which includes computing one or more encrypted multiplications as discussed in this figure.

[0201] The encrypted multiplication operation is the product of two encrypted values ​​(331, 332), for example β The product of two defined values ​​calculated modulo The highest part of; or the lowest part, for example β The product of two defined values ​​calculated modulo x · y mod βIt can be used to compute.

[0202] The encrypted multiplication operation can be performed by first determining a combined cipher (333) that includes both a first sub-value and a second sub-value; and then applying programmable bootstrapping (334) to the combined cipher (333) to obtain a result (335). In particular, to obtain the combined cipher (333), the first encrypted value (331) can be scaled, that is, shifted; and the shifted ciphertext (336) can be added to the second encrypted value (332) that is not scaled.

[0203] In particular, the lowest part of the product can be computed:

[0204]

[0205]

[0206] This technique can be applied to compatible ciphertexts, where is. The computational complexity of the LSB multiplication algorithm silver It could be.

[0207] A similar algorithm can be used to compute the MSB instead of the LSB. Different lookup tables are used for final programmable bootstrapping:

[0208]

[0209]

[0210] As shown above, the computational complexity of this algorithm is: It could be.

[0211] More generally, a combined cipher representing individual encrypted input values ​​is determined; and, for example, by programmable bootstrapping, by applying a univariate function to the combined cipher, a multivariate function evaluation can be performed on one or more input ciphertexts, e.g., encrypted sub-values. MulLSB and MulLSB These are examples of this, but this technique also works for other multivariate (e.g., bivariate) functions. Interestingly, in this way, multivariate functions can be efficiently evaluated using a single programmable bootstrap.

[0212] In particular, bivariate functions, e.g., lookup tables l ( m 1, m Consider 2). In this case, the two messages ( m 1, m 2) can be combined, for example, by shifting one of the two ciphertexts. In this way, the message can be effectively moved higher from the MSB. The shifted ciphertext can be added to the other ciphertext. For example, ciphertext (ct2) is ( μ It can be multiplied by 1+1) and added to ct1. In this way, even in the worst-case scenario, no information can be mixed in. This is possible if both the ciphertexts and the results of the combination (e.g., multiplication × constant and addition) respect conditions regarding degrees and noise. Once the two messages are combined into a single ciphertext, the bivariate function ( l ) is a univariate LUT for the chain( l It can be evaluated as ').

[0213] If the degree of the ciphertexts involved in computing, as well as their error amounts, can be chained to perform steps, the same technique can be applied to multivariate functions with more than two inputs. In the same way that the degree of output for a univariate function is computed, the degree of output when the function is multivariate can also be computed.

[0214] Return to Fig. 3a.

[0215] An alternative to the encrypted multiplication of Fig. 3d is now discussed, which is less efficient but may be desirable in some situations because it requires less precision. Additionally, for this alternative, how fullness can be determined is exemplified.

[0216] In this example, 2 ciphertexts ( , The LSB result of the homomorphic multiplication of ) is determined. The output is a new ciphertext that encrypts the LSB portion of the product of the two original messages with the updated fullness ( ) is. Interestingly, the two input messages only need to contain enough space to compute LWE addition / subtraction. This implementation relies on the following relationship:

[0217]

[0218] Accordingly, LWE addition; LWE subtraction; an appropriate univariate function using programmable bootstrapping, in this case, a function Evaluations of; additional LWE subtraction; and multiplication can be performed with optional programmable bootstrapping that reduces the carry on the result:

[0219]

[0220] The above procedure is Arith::Sub The parameters of can be applied to compatible inputs suitable for that algorithm, and is. The computational complexity of this version of the LSB multiplication algorithm silver: It could be.

[0221] Another example of an operation where fullness can be determined is the extraction of the ciphertext's carry. This operation can be used to implement encrypted carry reduction, as discussed elsewhere. In particular, the following algorithm has a specific fullness. Arith Takes the ciphertext as input, and base β Part of the message overflowing is another Arith Perform PBS to extract the ciphertext.

[0222]

[0223] This procedure is In this case, it can be applied. Computational complexity is It could be.

[0224] Another operation in which fullness can be determined is the extraction of messages modulo-messenger operations. Specifically, the following algorithm has a specific fullness Arith Taking a ciphertext as input, and β A part of a message that does not overflow another Arith Perform PBS to extract the ciphertext.

[0225]

[0226]

[0227] The above procedure is In this case, it can be applied. Computational complexity is It could be.

[0228] Additionally, a basis change operation may be defined. In some cases, for example, during cryptographic computing to ensure compatibility between ciphertexts. ∈ Arith S ( m It may be necessary to change the basis of the ciphertext. For this purpose, as an input and base ( p out , β out Taking ), and at a new basis m ciphertext that encrypts ∈ Arith S ( m An algorithm that returns ) can be defined. This algorithm can be implemented by programmable bootstrapping and can be denoted as follows:

[0229] .

[0230] This algorithm is If so, it can be used and computing complexity Can have.

[0231] In the additional operation, the encrypted value is multiplied by a scalar (i.e., a value known to the parties performing cryptographic computing) while simultaneously the basis of the ciphertext ( β , p ) can be changed. This operation can be implemented as follows:

[0232]

[0234] This algorithm is If so, it can be used and computing complexity Can have.

[0235] Generally, for a carry-inclusive value to be computed during cryptographic computing, such as a carry-inclusive sub-value of an encoded and encrypted value, a fullness can be determined, and if so represented by a fullness, an encrypted carry reduction can be applied to the input used to compute the carry-inclusive value.

[0236] To this end, it can be verified whether the carry buffer may overflow when computing a carry-containing value, and if it may overflow, the carry may be reduced by appropriately clearing (e.g., for CRT representation) or propagating (e.g., for radix representation). For the encoded and encrypted values ​​to be computed, appropriately none of the sub-values ​​may be carried reduced, or one or more of the carry values ​​may be carried reduced. In the case of operations with multiple input values ​​(e.g., addition), carry reductions may generally not be applied to any of the input values, or may be applied to one or more of the input values. An encrypted operation obtained in this way, corresponding to the original operation but verifying for each sub-operation whether the carry buffer may overflow and performing carry reduction in such cases, may be referred to as a "smart version" of the encrypted operation.

[0237] Fig. 4 is RadModInt Examples of encoded and encrypted values ​​based on radix decomposition, also referred to as expressions, are schematically illustrated.

[0238] In particular, the value is a relationship A set of multiple individual sub-values ​​according to ( m i It can be encoded as ). Here, the vector is referred to as the basis of radix decomposition. As in conventional radix decomposition, the basis elements are all the same value ( b It can be identical to ), where the radix decomposition is also base- b It can be referred to as a radix decomposition. However, it is possible for not all basis elements to be identical. This is also referred to as a mixed-radix representation. This increases flexibility in terms of the moduli that can be expressed. In either case, the encoded value is the total modulus of the radix decomposition. It can be defined as a value obtained by modulo operation with a smaller modulus (or as discussed in Fig. 6).

[0239] In particular, 0 ≤ m < M The value can be encoded and encrypted by encoding the value according to the following procedure and then encrypting the resulting encoded sub-values:

[0240]

[0241] It is noted that this encoding can be combined with programmable bootstrapping using padding bits as desired or with unpadded PBS.

[0242] By using radix decomposition, the total modulus ( M Cryptographic computing can be performed on values ​​defined by modulo operation with ), where M is the product of the basis elements. The basis elements can be, for example, up to 32, up to 64, or up to 128. The basis elements do not have to be powers of 2. One, the excess, or all of the basis elements can be at least 3, at least 5, or at least 10. For example, at least 2, at least 4, or at least 8 ( κ A basis of ) can be used. Using these basis elements allows computing on lower values ​​to be implemented relatively efficiently. The total modulus can be, for example, at least 256, at least 512, or at least 1024. Thus, computing on values ​​that cannot be efficiently implemented without decomposition into lower values ​​can be made possible.

[0243] Using radix decomposition, modular integers β i calculated modulo κ It can be implemented as a chain of encrypted blocks, and 0 ≤ i < κ is. For a block, a pair including the message modulus and the carry message modulus. This can be defined. Pair can be referred to as a basis associated with modular integers. In this way, Computations on integers obtained by modulo operation can be implemented.

[0244] This is illustrated as an example in FIG. 4. In this example, three individual blocks (401-403) are used, namely κ = 3. All 0 ≤ i < κ Regarding, β i = 4 and p i = 16 and; M = 4 3 is. In this drawing, fresh having lower values ​​that do not retain the carry RadModInt ...is shown. In particular, the plaintext of block (401) can be identified as including padding bits (404); a carry message modulus (405); and a message modulus (406).

[0245] Interestingly, when using radix decomposition, modulo M and base Various parameters of cryptographic computing, including (but not limited to) [the above], may be changed. Accordingly, the total computing cost may be reduced for specific use cases by automatically optimizing these parameters, for example, by a compiler device.

[0246] Several examples of cryptographic operations that can be performed on encoded and encrypted values ​​using radix decomposition are now discussed in detail. First, a certain notation is introduced. Secret key ( s Under ) basis Integer decomposed according to ( ), for example m = m 0+ (Here Encoding and encrypted ciphertext that encrypt ) ) can be written as follows:

[0247]

[0248] Below, Encoded and encrypted ciphertext i The first The encrypted sub-value It can be denoted as, and base elements ( The same applies to ). (Here i ≤ j )Is = It is an abbreviation for, The same applies to . The size of It is written as .

[0249] As also mentioned elsewhere, individual encrypted sub-values ​​( ) can be encrypted according to different cryptographic keys, and key switching is used to convert between cryptographic keys as needed.

[0250] Additionally, The compatibility of ciphertexts can be defined as follows. , 2 of RadModInt They are called ciphertexts. Two RadModInt Ciphertexts , ) is, | | = | | = κ And if it is as follows, it can be defined as compatible:

[0251]

[0252] Based on, and then and ...does so. The following functions are used in the following examples. Function Is It is recursively defined as follows for:

[0253]

[0254] is as follows:

[0255]

[0256] and is defined as follows:

[0257]

[0258] The following is the ciphertext ∈ Arith base Using ∈ RadModInt This exemplifies an operation in which the encoding and encryption of a value that is decomposed into, that is, using radix decomposition, are determined from the cipher of that value. Determining the encoding and encryption is based on the basis ( To sequentially compute Euclidean divisions of the input ciphertext by individual members of ) PBS It may include using, and the rest are Arith It is stored as encrypted non-carry subvalues ​​as ciphertexts. The remainders are a set of carry message modulus( The carry message modulus corresponding to match ) p i It can be shifted depending on ).

[0259]

[0260] This algorithm is μ ≤ p - If it is 1, it can be used, and It can have a computing complexity of .

[0261] The following exemplifies an operation to increase the number of sub-values ​​used to encode and encrypt values ​​using radix decomposition. To this end, encoding and encryption can be extended to ciphers of zeros. Interestingly, this operation is highly efficient for radix-based encodings. This operation RadModIntCT::Padding It can be written as, ∈ RadModInt The size of | | = κ at It can be changed to. To do so, the ciphertext is ∈ Arith 0 (0), for example, can be completed with trivial ciphers of 0. This is, for example, Decompose It is useful in combination with algorithms, which is its output ciphertext ( )this κ This is because it may not be a length. This operation can be expressed as follows:

[0262]

[0263] This operation is, The underlying elements of the index α from It can be used in the same case as the elements of, and therefore κ out ≥ κ + α is. Officially, Lo and ...does it. Next, [ α ∈ 0, κ out - κ In the case of ], all i ∈ [0, κ - About 1] β i = β out,α+i and p i = p out,α+i am.

[0264] The following is a radix decomposition ∈ RadModInt S ( m 1) and ∈ RadModInt S ( m An example of an addition operation between two encoded and encrypted values ​​using 2) is provided. The addition can be performed by adding the individual corresponding sub-values. Therefore, interestingly, this operation can be parallelized. Specifically, each i Regarding each [ i ]and [ i ] between Arith::Add can be called.

[0265]

[0266] The inputs are compatible and ∀ i ∈ 0, κ - 1, [ i ]::deg + [ i If ]::deg ≤ 1, this operation can be used. The computational complexity is It could be.

[0267] The following is a radix decomposition ∈ RadModInt S ( m 1) and ∈ RadModInt S ( m Using 2), the subtraction of two encoded and encrypted values ​​is exemplified. Similar to addition, this operation can be implemented as subtractions of individual sub-values ​​and thus can be parallelized. In particular, this operation is each i Regarding each [ i ]and [ i ] between Arith::Sub It can be implemented by computing.

[0268]

[0269]

[0270] Such operations on mutually compatible inputs are possible and are as follows:

[0271]

[0272] Computational complexity is It could be.

[0273] The following exemplifies an encrypted carry reduction operation that can be used to reduce a carry-containing subvalue of an encoded and encrypted value to a non-carry subvalue. To this end, the carry-containing subvalue can be decomposed into the ciphers of its individual subvalues. Subsequently, the resulting ciphers can be added to the ciphers of the corresponding subvalues ​​of the output value. In this way, the carry of that subvalue can be propagated to subvalues ​​of higher indices. In particular, It is called ciphertext. For example, index α ∈ [0, κ - Encrypted sub-value in 1] [ α Carry reduction can be applied to ].

[0274]

[0275]

[0276] This operation is ∀ i ∈ 0, κ - 1, In the case of, or algorithm In terms of the internal state of, ∀ i ∈ 0, κ - 1, [ i ]::deg ≤ 1 - [ i It can be applied in the case of ]::deg. Computational complexity is It could be.

[0277] The following exemplifies an encrypted carry reduction operation that allows values ​​encoded and encrypted with a carry to be converted into carry-free encoding and encryption. To this end, encrypted carry reductions can be applied to individual child values, starting from the lowest child value. In this way, individual carries can be propagated. If a child value does not retain a carry after previous carry reductions, its carry reduction can be skipped. In particular, It is called a ciphertext. The following algorithms can be used:

[0278]

[0279] ∀ i ∈ [0, κ - In 1], parameters ( , i )go ClearCarry If it is made possible to use, this operation can be used. The computational complexity is It could be.

[0280] The following is a value encoded and encrypted using radix decomposition that is a scalar, e.g., a known integer ( λ This exemplifies an encrypted operation that is multiplied by ). In this example, this is performed by multiplying the individual sub-values ​​by a scalar, if possible, in parallel. This algorithm is relatively small λ Suitable for.

[0281]

[0282] ∀ i ∈ 0, κ - 1, [ i ]::deg· λ If ≤ 1, this operation can be applied. The computational complexity is It could be.

[0283] The following is a scalar ( on an encrypted but unencoded value, e.g., a sub-value of an encoded and encrypted value λ This exemplifies an encrypted operation in which ) is multiplied. Interestingly, this operation can be used for relatively large scalars. This operation can result in the encoding and encryption of the product. The individual sub-values ​​of the encoded and encrypted product can be computed by individual programmable bootstrapping operations corresponding to the individual sub-values ​​of the scalar. In particular, clear λ The integer and cryptogram ∈ Arith S ( m Scalar multiplication between ) is a basis having It can result in a ciphertext. This can be implemented as follows.

[0284]

[0285]

[0286] μ ≤ p If it is 1, this operation can be used. The computational complexity is It could be.

[0287] The following are values ​​encoded and encrypted using radix decomposition that are scalar ( λ It exemplifies an encrypted operation that is multiplied by ). This operation involves individual sub-values ​​and a scalar ( λ It can be implemented by performing scalar multiplications of ) to yield individual encoded and encrypted products, and by combining the resulting encoded and encrypted products. Interestingly, this operation can also be used for relatively large scalars. In particular, and ...is done. This operation can be implemented as follows:

[0288]

[0289] Subroutines RadModIntCT::ScalarMulDecomp and RadModIntCT::Add If can be applied to these individual inputs, this operation can be used. The computational complexity can be as follows:

[0290] .

[0291] The following exemplifies encrypted multiplication between individual encrypted but unencoded values, for example, between sub-values ​​of one or two different encoded and encrypted values. Encrypted multiplication can result in encoded and encrypted values. Input values ​​can be combined into a single encrypted value by scaling and addition, and individual sub-values ​​of the encoded and encrypted values ​​can be determined by applying individual programmable bootstrappings. In particular, two compatible ciphertexts ∈ Arith S ( m 1) and ∈ Arith S ( m 2) can be multiplied. The result is base so that it becomes Using It can be broken down into ciphertext.

[0292]

[0293] Arith::ScalarMul this ( , μ If it can be applied to 1), this operation can be used. The computational complexity can be as follows:

[0294]

[0295] The following exemplifies encrypted multiplication between an encrypted but unencoded value and an encoded and encrypted value. This operation can be implemented by multiplying individual sub-values ​​of the encoded and encrypted values ​​by the encrypted but unencoded value to yield individual encoded and encrypted products; and by combining the encoded and encrypted products. In particular, ∈ Arith S ( m 1) And ∈ RadModInt S ( m After doing 2), m Lesson 1 m Isomorphic multiplication of 2 can be implemented as follows:

[0296]

[0297] ∀ i ∈ 0, κ - 1, RadModIntCT::MulDecomp and RadModIntCT::Add If can be applied to these individual arguments, this operation can be used. The computational complexity is It could be.

[0298] The following exemplifies the encrypted multiplication of the first and second encoded and encrypted values. This multiplication can be implemented by multiplying the individual sub-values ​​of the first and second encoded and encrypted values—these multiplications yield encoded and encrypted results—and by combining, for example, adding the encoded and encrypted results. In particular, for example, the one discussed above OneBlockMul Regarding the operation, encrypted multiplication can be implemented by multiplying the individual sub-values ​​of the first encoded and encrypted value by the second encrypted value. In particular, two ciphertexts ∈ RadModInt S ( m 1) and ∈ RadModInt S ( m 2) Given, pairs of blocks ( [ i ], [ j Multiplication-decompositions can be computed between ]) and, i ∈ [0, | | - 1], j ∈ [0, | | - 1] is. Encoded and encrypted inputs( , It is noted that ) does not need to be compatible. In this example, the result of the multiplication is It is expressed as the base of.

[0299]

[0300] ∀ i ∈ [0, κ In the case of 1-1], the parameters RadModIntCT::OneBlockMul and RadModIntCT::Add If can be applied to these individual parameters, this operation can be used. The computational complexity is It could be.

[0301] It is also possible to perform the cryptographic evaluation of a univariate function on encoded and encrypted values ​​using radix decomposition. For example, the univariate function being evaluated can be an inverse or division. These operations can be implemented in various ways.

[0302] One method for evaluating a univariate function is to apply tree programmable bootstrapping. The use of tree programmable bootstrapping to evaluate a large lookup table for multiple ciphertexts encoding a single input of the lookup table is described by A. Guimar (incorporated herein by reference). It is known in itself from es et al.'s "Revisiting the functional bootstrap in TFHE" (IACR Trans. Cryptogr. Hardw. Embed. Syst., 2021(2):229-253, 2021). This reference is based on the same basis ( β Plaintext integers that are all encrypted under ) are used. Interestingly, the inventors recognized that these techniques are also applicable to the present setup, particularly even when not all basis elements of the radix decomposition are identical. In this way, multi-radix tree programmable bootstrapping can be obtained.

[0303] Specifically, cast It is a lookup table having elements. This lookup table is x Multi-radix representation: Encoding and encrypted value that encrypts as ( It can be applied to ). Univariate function evaluation using multiradix tree PBS as input Ciphertext and large lookup table( P Taking ) It can return a ciphertext and can be represented as follows:

[0304]

[0305] Multi-radix tree programmable bootstrapping can be iteratively implemented by, in an iteration, selecting the largest remainder basis element, splitting the remainder lookup table according to the largest remainder basis element, applying programmable bootstrappings to individual lookup table components using the child value corresponding to the largest remainder basis element as a selector, and combining the results into an updated lookup table.

[0306] especially, B = { β i | i ∈ 0, κ Set to -1} θ ( β )cast β related to x It is made into a component of. In the loop, β max = max( β ∈ B Defines ). P of β max Each containing different elements With several smaller lookup tables P Splits. θ ( β maxUsing the ciphertext that encrypts ) as a selector ν Compute the PBS for each of the lookup tables. The new large lookup table ( P ) is PBS's ν It consists of the results of repeated iterations. B : B = B - β max from β max Removes. This iterative process is B It can be repeated until it is empty. In the first iteration, the plaintext lookup table ( P Separation can be performed for ); and in the following iterations, separation can be performed using key switching.

[0307] Regarding computational complexity, in the worst case, all i ∈ [0, κ - Regarding 1] β i = β max is. Therefore, the worst-case complexity for PBS is It could be.

[0308] A particularly efficient technique for performing function evaluation on encoded and encrypted values ​​is now discussed. This technique extracts the bits necessary to evaluate a function from individual encrypted sub-values; converts the extracted bits into GGSW ciphertexts; and performs operations by applying a lookup table to the individual GGSW ciphertexts. This technique is exemplified for univariate function evaluation, but it applies likewise to multivariate function evaluation.

[0309] The inventors recognized that, in this setting, this approach has several advantages over using programmable bootstrapping based directly on blind rotation (however, it will be understood that this approach can also indirectly use programmable bootstrapping based on blind rotation for, for example, a transformation to GGSW).

[0310] By performing bitwise operations at the level of individual sub-values, the use of blind rotation using polynomials in which the size of the message modulus and / or carry message modulus scales exponentially is avoided. Consequently, the proposed univariate function evaluation can be performed on sub-values ​​having larger message modulus and / or carry message modulus, for example, the size of the message modulus and / or carry message modulus of the sub-values ​​can be at least 10, at least 13, at least 15, or at least 16 bits. By using larger modulus for the sub-values, computational efficiency for encoded and encrypted values ​​can be significantly improved. In particular, fewer carry reductions may be required because the encrypted sub-values ​​may have more space for the carry and / or fewer encrypted sub-values ​​may be needed to represent a given value.

[0311] Furthermore, at the level of the entire encoded and encrypted values, the proposed univariate function evaluation also provides significantly improved scaling in terms of the size of the encrypted values, because the lookup table can be applied much more efficiently to individual GGSW ciphertexts using mixed packing than, for example, using tree PBS. In particular, while the number of sub-values ​​in tree PBS can scale exponentially, the application of the lookup table to the bits of GGSW ciphertexts can be performed much more efficiently, for example, even linearly, in terms of the number of sub-values.

[0312] Another advantage of the proposed univariate function evaluation is that there is no need for padding bits in the most significant bit of the encrypted value; for instance, as in some existing implementations of programmable bootstrapping, there is no need to guarantee that the most significant bit remains 0. This applies to a given ciphertext modulus ( q This means that higher precision can be achieved.

[0313] Additional efficiency improvements are provided by improved univariate function evaluation, as it is possible to round individual encrypted subvalues ​​to the desired precision before applying the LUT. Furthermore, multiple univariate function evaluations can be performed on the same input(s) using the same GGSW encrypted bits, making the application of multiple functions particularly efficient.

[0314] The proposed WoP-PBS includes a bootstrapping key and a LUT that can be encrypted or not encrypted ( L It can take ) as input. WOP-PBS performs isomorphism evaluation of the LUT for the input message, for example L [ m Can output the LWE or GLWE password of ].

[0315] In particular, bits can be extracted from encrypted lower values ​​by extracting individual least significant bits using programmable bootstrapping that scales to perform operations on individual bits as least significant bits. This operation is based on I. Chillotti (incorporated herein by reference). 등 This can be performed efficiently using generalized programmable bootstrapping as proposed in "Improved programmable bootstrapping with larger precision and efficient arithmetic circuits for TFHE". In particular, generalized programmable bootstrapping may include modulus switching that reads right next to the bit to be extracted, which It can be used to evaluate a sign function rescaled to the i-th bit.

[0316] In many cases, all bits of the input value can be extracted, but if the function does not depend on one or more bits (e.g., if the function uses only multiple least significant bits), extracting these bits is prevented, which can further improve efficiency.

[0317] When using the generalized programmable bootstrapping described, θ Further improvements are possible by selecting a value of 0 and using PBSmanyLUT as described in "Improved programmable bootstrapping with larger precision and efficient arithmetic circuits for TFHE". For example, if the bit extracted at the moment of extraction of information from the inputs is already in the correct rescaling (or close to it), programmable bootstrapping does not need to be applied to each bit either.

[0318] To convert bits into GGSW ciphertexts, it is possible to use, for example, circuit bootstrapping, refer, for example, to I. Chillotti et al. “Faster packed homomorphic operations and efficient circuit bootstrapping for TFHE” (proceedings of ASIACRYPT 2017) (incorporated herein by reference). In the case of circuit bootstrapping, it is noted that the second step can be improved similarly to H. Chen et al. “Onion ring ORAM: efficient constant bandwidth oblivious RAM from (leveled) TFHE” (proceedings CCS 2019) (incorporated herein by reference). That is, an initial non-functional LWE-to-GLWE KS can be applied to the outputs of programmable bootstrappings, and the cross product of the GLWE secret key with the GGSW cipher can be performed. By doing so, the size of public evaluation keys can be reduced, and efficiency can be improved by using FFT.

[0319] Lookup tables can be efficiently applied to GGSW ciphertexts by using packing lookup table evaluation, for example, refer to I. Chillotti et al. “Faster packed homomorphic operations and efficient circuit bootstrapping for TFHE (proceedings of ASIACRYPT 2017) (incorporated herein by reference).” In general, such packing LUT evaluation may use mixed packing, and horizontal and vertical packing of the mixed packing are two specific examples.

[0320] Interestingly, the above approach operates on encoded and encrypted values ​​regardless of whether a carry is used; it also operates as individual sub-values ​​for encrypted but unencoded values. Furthermore, in the latter case, many of the advantages discussed apply. Accordingly, a method for performing cryptographic computing and a cryptographic computing device are considered that use the described univariate function evaluation without necessarily using a carry or encoded and encrypted values. In general, enhanced univariate function evaluation typically uses programmable bootstrapping internally based on blind rotation (e.g., circuit bootstrapping may involve a certain number of programmable bootstrappings), but it is noted that enhanced univariate function evaluation at a higher level can be used to replace programmable bootstrappings performed in cryptographic computing, particularly when a large message modulus is applied.

[0321] In particular, univariate function evaluation based on conversion to bits can be implemented as follows:

[0322]

[0323]

[0324] Although the above example illustrates vertical packing, it is also possible to use horizontal or mixed packing. Furthermore, it is also possible to output a GLWE ciphertext instead of an LWE ciphertext as exemplified above. Moreover, the above example is generalized to a multivariate function evaluation using multiple encoded and encrypted inputs (e.g., at least two or at least three) by extracting desired bits from individual inputs and applying a lookup table to the bits from the individual inputs.

[0325] As discussed elsewhere, performing cryptographic computing may involve continuously tracking the fullness of individual carry-in subvalues. If a carry-in subvalue to be computed has a fullness indicating that the corresponding carry message modulus may be exceeded, encrypted carry reduction may be applied before computing the carry-in subvalue. In particular, the encrypted carry reduction operation may be performed before or during the encrypted operation as needed. An operation configured to automatically perform carry reduction when necessary to ensure that the carry buffer does not overflow is referred to as a "smart" operation.

[0326] Figure 5 schematically illustrates an example of encoded and encrypted values ​​based on a remainder number system representation. In cryptographic computing, it is demonstrated how various encrypted operations can be applied to these encoded and encrypted values.

[0327] Such cryptographic computing may involve the use of carries in the encoded and encrypted values, but is not necessary, for example, carry reduction may be applied immediately after each operation or sub-operation described herein so that the encrypted operations are applied only to the values ​​being encoded and encrypted without carries.

[0328] In particular, the mapping between a value and its sub-values ​​can follow a remainder number system representation, specifically based on the Chinese Remainder Theorem (CRT). Encoded and encrypted values ​​are individual message moduli ( β i )(0 ≤ i < κ - having 1) κ It can be encrypted as ciphers of the sub-values. Typically, modulus ( β i , β j , i ≠ j) are pairwise disjoint, which enables the use of a CRT to reconstruct a value from its sub-values. Generally, any modulus can be used as the carry message modulus; for example, the sub-values ​​can use a common carry message modulus. To encode a value into an encoded and encrypted value, the CRT representation of the value can be computed, and individual elements of the representation can be encrypted. Similarly, an inverse CRT can be used to decode the encoded and encrypted value.

[0329] Interestingly, the use of remainder number system encoding can provide particularly efficient encrypted carry reduction. Specifically, carry reduction can be performed by performing individual modulo reductions on individual sub-values, for example, so that no carries are forwarded from one sub-value to the next. This makes carry reduction fast and multithread-friendly. For example, one, its excess, or all of the message moduli can be at least 2 and / or at most 32. For example, one, its excess, or all of the message moduli can be at least 3, at least 5, or at least 10. Specifically, the figure exemplifies values ​​encoded and encrypted as ciphers of three individual sub-values ​​(501, 502, 503) defined by modulo operations with individual message moduli (504, 505, 506), such as 25, 29, and 32, respectively. Accordingly, the encoded and encrypted value M = can be defined by modulo operation as 32×29×25, and κ = 3. A common carry message modulus (507) such as 64 is used in this example.

[0330] In particular, the encoding of the value into lower values ​​can be determined as follows:

[0331]

[0332]

[0333] Now, a notation regarding encodings based on the remainder number system is introduced. All 0 ≤ i , j < κ About , i ≠ j Pairs of integers when ( β i , β j So that ) become coprime It is based on a CRT. The associated total CRT modulus ( τ )Is It can be defined as.

[0334] m mod τ To encode and encrypt the value, the individual remainders of this value obtained by modulo operation with individual bases ( m i = m mod β i )silver κ Dogs different Arith It can be encrypted as ciphertexts.

[0335] A number of Arith Encoded and encrypted values ​​using these CRT representations across ciphertexts ( m To decrypt ), first, encrypt the sub-values Arith The ciphertexts can be decrypted. Then, the encrypted integer, as is known in itself, τ It can be decoded by performing a modulo operation.

[0336] Accordingly, CRT base Under integers ( Encrypting ) CrtModInt cryptogram( )this: = It can be defined as, where all 0 ≤ i < κ Regarding, , and and m ≡ m i mod β i am. i The first Arith The ciphertext is [ i It can be denoted as ]. As discussed elsewhere, ciphertexts ( Each can follow a common encryption key, but this is not strictly necessary.

[0337] 2 CrtModInt Ciphertexts , ) is | |=| If it is ramen and is as follows, it can be referred to as compatible:

[0338]

[0339] Now, various operations on encoded and encrypted values ​​using CRT are discussed. Interestingly, when using CRT representations, in many cases, encrypted operations can be applied by individually applying sub-operations to the individual ciphers of the sub-values ​​of the input values. This makes the operations efficient to implement and enables parallelization. This is particularly true for addition, subtraction, and multiplication.

[0340] In particular, homomorphic addition can be implemented by adding blocks of the same index together, for example:

[0341]

[0342] The inputs are compatible and ∀0 ≤ i < κ, Arith::Add If can be applied, this operation can be applied. The computational complexity is It could be.

[0343] In addition, isomorphic subtraction can be implemented by subtracting blocks of the same index, for example:

[0344]

[0345] The inputs are compatible and 0 ≤ i < κ , Arith::Sud If can be applied, this operation can be applied. The computational complexity is It could be.

[0346] Multiplication by a scalar known to the official performing the encrypted multiplication is the individual message modulus ( β i scalar modulo operation with ) u This can be performed by multiplying ) and individual blocks, for example:

[0347]

[0348]

[0349] 0 ≤ i < κ , Arith::ScalarMul If this can be applied, this operation can be applied. The computational complexity is It could be.

[0350] An alternative way to implement scalar multiplication is to apply, for example, programmable bootstrapping.

[0351] Interestingly, when using CRT representations, encrypted carry reduction can be applied to carry-containing subvalues ​​by reducing the carry-containing subvalue moduloed by the corresponding message modulus, for example using programmable bootstrapping. This may not affect other subvalues, and accordingly, carry reductions for multiple or all subvalues ​​of the encoded and encrypted values ​​can be performed individually and possibly simultaneously. Propagation may not be necessary. For example, a single carry-containing subvalue can be carry reduced as follows:

[0352]

[0353] This operation is [ i It can be applied when ]::deg ≤ 1, and the computational complexity has

[0354] Many sub-values ​​are CrtModInt Each of the constituent Regarding ciphertext β i Carry reduction can be achieved by extracting messages operated on the r modulo, for example:

[0355]

[0356]

[0357] ∀0 ≤ i < κ, [ i If ]::deg ≤ 1, this operation can be applied. The computational complexity is It could be.

[0358] β i Individual corresponding sub-values ​​obtained by modulo operation x mod β i , y mod β i ( i ∈ [0, κ Isomorphic multiplication can be implemented by multiplying - 1]) together, for example:

[0359]

[0360] ∀ i ∈ [0, κ - 1], Arith::MulLSB If can be applied, this operation can be applied. The computational complexity is It is possible. Other techniques for the multiplication of sub-values, for example Arith::MulLSB 3PBS It is also possible to use .

[0361] Values ​​encoded and encrypted using CRT ( Various techniques can be used to apply univariate functions to ). In particular, as further discussed in relation to FIG. 4, it is possible to use tree-programmable bootstrapping or to apply lookup tables to GGSW-encrypted extracted bits. Depending on the function, it may also be possible to evaluate the univariate function by applying it individually to each sub-value. This is, for example, This may be the case for functions that can be expressed in terms of sums and products of, for example, arithmetic functions. In such cases, univariate functions can be applied, for example, as follows:

[0362]

[0363]

[0364] 0 ≤ i < κ All that become i Regarding, CrtModInt [ i ]::deg < 1 and function If is partitioned across the elements of the CRT representation, this operation can be applied. The computational complexity is It could be.

[0365] Figure 6 schematically illustrates an example of encoded and encrypted values ​​based on radix decomposition. In this case, interestingly, the value has a modulus smaller than the maximum value expressible by radix decomposition ( M It is defined using ). This is the modulus ( M ) has the advantage that it does not need to be equal to the product of the basis elements.

[0366] especially, M To encode and encrypt the value obtained by modulo operation, the modulus ( M The maximum value that can be expressed by radix decomposition ( Base to be smaller than ) A base may be selected. The base may be as discussed in relation to Fig. 4.

[0367] For example, the drawing has a modulus (601). M The case where = 1433 is given as an example. It is noted that since 1433 is a prime number, the radix or CRT representation cannot be directly used for decomposition for this modulus. The figure shows the common basis element β = 2 5 A basis having (602) as an example, κ = 3 and, p = 2 7 common carry message modulus It has. Therefore, in this case, the values ​​can be encoded and encrypted as three encrypted sub-values ​​(606-608).

[0368] Encrypted operations, carry reduction M Except that it may involve applying corrections resulting from modular reduction performed modulo-computation, it can be performed as discussed in relation to FIG. 4. The latter can be performed by performing an encrypted modulo reduction of the cipher of the highest lower value of the output value. In particular, as also discussed elsewhere, the carry and message can be extracted from the highest block, and the modulo can be computed isomorphically by redistribution to the remaining blocks. To this end, several approaches are possible, as discussed in more detail elsewhere.

[0369] More specifically, secret key ( s Under ) basis Integer decomposed according to ( ), for example (Here Encoding and encrypted ciphertext that encrypt ) ) can be written as follows:

[0370]

[0371] Here am. composing i The first Arith The ciphertext is It can be defined as.

[0372] In the definition above, the modulus ( Q ) is the top-level block( κ - It is set to be in 1). RadModInt + One or more MSBs of the structure Arith It is noted that it is possible to add ciphertext blocks. The algorithms described herein for performing isomorphic modulus reduction are additional Arith having ciphertext blocks RadModInt + It can be adapted to perform modular reduction on the ciphertext.

[0373] In the following cases, 2 RadModInt + Ciphertexts , ) can be defined as compatible and :

[0374]

[0375] Here , and:

[0376]

[0377] For example, ciphertexts ( , ) may be compatible.

[0378] As discussed in relation to Fig. 4, various operations can be performed. Now, several examples of this are discussed.

[0379] In particular, modular addition is RadModInt It can be computed as with ciphertexts. To this end, RadModInt + The ciphertexts RadModInt It can be seen as ciphertexts. This operation is It can be written as.

[0380] also, RadModInt Modular subtraction is performed as with ciphertexts, RadModInt + ciphertexts RadModInt It can be viewed as ciphertexts. This operation is It can be written as.

[0381] RadModInt As with ciphertexts, modular padding is also performed, so that the output's RadModInt + ciphertexts RadModInt It can be viewed as ciphertext. Generally, the input resulting from decomposition is RadModInt It can be. This operation is It can be written as.

[0382] Applying encrypted carry reduction to lower values ​​containing the carry also, RadModInt Performed as with ciphertexts, RadModInt + ciphertexts RadModInt + It can be viewed as ciphertexts. This operation is It can be written as.

[0383] Modular reduction can be performed when reducing the carry of the highest and lowest values. Now, two possible methods for performing modular reduction are discussed. Their relative efficiencies are modulus ( M ) and limitations( M max It can depend on the distance between ).

[0384] A first method for performing modulo reduction is to apply programmable bootstrappings to the top-level encrypted sub-value and propagate the sub-value to the individual encrypted sub-values, Q It is to obtain the reduced value calculated by modulo.

[0385] In particular, carry reduction may involve emptying and propagating the carries for the lower values ​​of the encoded and encrypted values, excluding the highest lower values. This allows all carries within the highest block, except for one, to be emptied. This can be done if the carry of the highest block does not exceed the capacity to support such carry propagation. In the highest block, both the carry and the message can be extracted and transformed using programmable bootstrappings. The extracted carry and message being transformed can be redistributed to individual blocks.

[0386] Now, the parameters exemplified in Fig. 6, i.e. Q = 1433, κ = 3, β = 2 5 person and p = 2 7 person A detailed example of is given. The top-level block is the quantity ( β 2 Message rescaled to ) m < 2 p It can encrypt ). Modulo reduction uses individual PBSs, Q Quantity calculated modulo ( mβ 2 It is possible to reduce ) and simultaneously decompose it into base powers and redistribute them to individual blocks. That is to say, m' = mβ 2 mod Q It is. Next, m' can be decomposed as follows:

[0387]

[0388] m Taking the password as input and these decomposition values ​​( m' 2, m' 1, m'PBS LUTs can be constructed to output the cipher of 0). Then, the reduced ciphertext can be obtained as follows:

[0389] - In Block 0: Previous Block 0 and m' By addition between 0s;

[0390] - In Block 1: Previous Block 1 and m' By addition between ciphers of 1;

[0391] - In Block 2: having a smaller degree than the original m' By the password of 2.

[0392] As a detailed example, modular reduction can be implemented as follows:

[0393]

[0394]

[0395] this Satisfying and all Ciphertexts regarding ( ct j , )to Arith::Add If can be applied, this operation can be applied. The computational complexity is It could be.

[0396] It is noted that it is possible to evaluate individual programmable bootstrappings as a single programmable bootstrapping using the “PBS many LUT” technique disclosed in “Improved programmable bootstrapping with larger precision and efficient arithmetic circuits for TFHE”.

[0397] An alternative technique for performing modulo reduction is the smaller modulo between the child value corresponding to the top-level basis element and a set of child values ​​corresponding to the remaining basis elements. QIt is based on a linear relationship calculated modulo. Based on this relationship, the encoded and encrypted values ​​can be reduced modulo to encoded and encrypted values ​​where the highest and lowest values ​​are 0. In particular, to obtain a linear relationship, Q calculated modulo β κ -1 The product of basis elements excluding ( ) is the base It can be decomposed into:

[0398]

[0399] In decomposition If so, this method can be used. In this case, the constant ( v j The top-level block multiplied by ) It can be added to the nth block, and then, the new top block can be set to 0. This technique uses the elements of decomposition ( It is particularly efficient when ) is small or even zero, and for some applications, a suitable modulus ( Q By selecting ), it may be possible to obtain particularly efficient cryptographic computing.

[0400] For example, the parameters exemplified in Fig. 6: a smaller modulus ( Q = 1433), number of lower values( κ = 3), β = 2 5 The basis of message moduluses and p = 2 7 Carry message modulus Refer to . In this example, (2 5 ) 2 mod 1433 = -409 = -12 2 5-25 can be observed, so that in the lowest block (608), the previous lowest block (608) and the previous highest block (606) are multiplied by -25 and added together; in the middle block (607), the previous middle block (607) and the previous highest block (606) are multiplied by -12 and added together; and by setting the highest block (606) to 0, modulo reduction can be performed.

[0401] Another example where this modulus reduction is particularly efficient is as before. Q = 1087, κ = 3, β = 2 5 person and p = 2 7 person This is the case. In this case, so that modulus reduction can be implemented by scalar multiplication with small scalars (2 5 ) 2 mod 1087 = -63 = -2 2 5 + 1 can be observed.

[0402] It is noted that this technique can be efficiently implemented without programmable bootstrapping. Subsequently, carry propagation via bootstrapping can be performed optionally. For example, this technique can be implemented as follows:

[0403]

[0404]

[0405] decomposition( ν In ), coefficient ν κ -1 = 0 and all Regarding, Arith::ScalarMul This ciphertext and scalar It can be applied to; the decomposition does not overflow the decomposition base; and RadModInt + ::Padding , RadModInt + ::Sub , and RadModInt + ::Add If can be applied to these individual inputs, this procedure can be applied. κ + < κ Let be the number of positive elements in the decomposition, and κ - < κ is defined as the number of negative elements in the decomposition. Subsequently, the computational complexity of the technique is: It could be. ν j If a coefficient is equal to 0, the loop for that coefficient can be skipped, one or more coefficients ( ν j It may be noted that this technique is particularly efficient when parameters are selected such that ) becomes 0.

[0406] RadModInt + Performing an encrypted carry reduction operation on all child values ​​of a value being encoded and encrypted using can be accomplished by applying the encrypted carry reduction to individual child values ​​excluding the most significant child value, and applying the encrypted modulo to the most significant child value. In particular, this operation can be implemented as follows:

[0407]

[0408] RadModInt + ::ClearCarry Although it can reduce carry-in sub-values ​​to non-carry sub-values, RadModInt + ::ClearAllCarries It is noted that the overall result may have carry-inclusive sub-values ​​due to the additions performed in the modular reduction. Optionally, if desired, for example, if this enables the performance of one or more subsequent operations, to reduce these carry-inclusive sub-values ​​to non-carry sub-values, for example, RadModInt + ::ClearCarry Additional encrypted carry reductions using can be applied.

[0409] every Regarding, RadModInt + ::ClearCarry If it can be applied, and RadModInt + ::ModularReduction 1,2 If it can be applied to the result, the above procedure can be applied. Depending on which modular reduction is used, the computational complexity is or It could be.

[0410] SmallScarlarMul using operations RadModInt As discussed regarding ciphertexts, scalar multiplication can be performed. This may be particularly suitable for relatively small scalars. To this end, RadModInt + The ciphertexts RadModInt It can be seen as ciphertexts. This operation is It can be written as.

[0411] Scalar multiplication is also, ScarlarMulDecomp using operations RadModInt As discussed regarding ciphertexts, carried out, RadModInt + ciphertexts RadModInt They can be viewed as ciphertexts. In particular, individual sub-values ​​of the encoded and encrypted values ​​can be multiplied, and the resulting encodings and encryptions can be combined. Scalar multiplication may further involve performing modular reduction. The entire scalar multiplication operation is It can be written as.

[0412] In this case, one way to implement modular reduction is to include one or more additional sub-values ​​in the encoded and encrypted product so that exact multiplication is supported—that is, so that the encoded and encrypted product can be computed without modular reduction (the number of sub-values ​​to be added is appropriately selected for the scalar to be multiplied); to perform exact multiplication; and, for example, proceeding from the highest to the lowest, apply individual modular reductions to the individual added sub-values ​​and the original highest sub-value.

[0413] An alternative is to iteratively perform individual modular reductions on the individual resulting encodings and encryptions before combining them. In this case, adding additional sub-values ​​can be prevented.

[0414] The multiplication of encoded and encrypted values ​​is RadModInt As discussed regarding ciphertexts, carried out, RadModInt + ciphertexts RadModInt They can be viewed as ciphertexts. In particular, the first encoded and encrypted value can be multiplied by the individual sub-values ​​of the second encoded and encrypted value, and the results can be combined. The multiplication may involve modular reduction. The total multiplication is It can be written as.

[0415] To perform modular reduction, one or more sub-values ​​may be included in the encoded and encrypted product so that exact multiplication of the encoded and encrypted values ​​can be performed (the number of sub-values ​​is appropriately selected for the values ​​to be multiplied); exact multiplication can be performed; for example, individual modular reductions can be applied to the added blocks and the original top sub-values, proceeding from top to bottom.

[0416] Another way to perform modular reduction is to iteratively perform the reduction during computing, for example, before nesting the result into the top block. In this way, there may be no need to add any extra sub-values.

[0417] FIG. 7 schematically illustrates an example of encoded and encrypted values ​​based on a remainder number system representation and additionally based on the radix decomposition of the elements of the remainder number system representation. Such representation is referred to herein as "hybrid" encoding and encryption. In particular, the encoded and encrypted values ​​may include one or more individual encodings and encryptions according to the remainder number system representation of individual sub-values ​​defined according to the remainder number system representation.

[0418] Interestingly, in this way, it is possible to combine the advantages of a remainder number system representation, where much carry propagation can be prevented, without the problem of requiring many small coprimes. In particular, by using a hybrid approach, it is possible to perform cryptographic computing relatively efficiently, especially using large moduli, for example, a modulus of at least 2 10 , at least 2 20 or at least 2 30 It can be. For example, the number of remainders in the remainder number system representation can be at most or at least 3, at most or at least 6, or at most or at least 10.

[0419] The drawing is a modulus (4 5 )×1433×17×(3 4 This exemplifies hybrid encoding and encryption using ). This modulus is 4, which are the 4 remainders according to the remainder number system. 5 (710); 1433(720); 17(730); and 3 4It can be decomposed into (740). For each remainder of the remainder number system decomposition, the encoding and encryption of a given value may include one or more sets of encrypted values ​​representing the individual elements of the remainder number system decomposition of the value.

[0420] In particular, for 0, 1, or more remainders of the remainder number system, the corresponding element can be encrypted as an unencoded value that is encrypted with the same message modulus as the remainder, as discussed in relation to FIG. 5. This is the case for remainder 17 (730) in the figure, which can be encrypted as a cipher (740) that is modulo calculated on the remainder itself.

[0421] For 0, 1, or more additional remainders, the corresponding element may be encoded as an encoded and encrypted value according to the radix decomposition of the element. Here, the remainder may be equal to the maximum value that can be represented by the radix decomposition using, for example, the encoding and encryption of FIG. 4; and / or the remainder may be smaller than the maximum value that can be represented by the radix decomposition using, for example, the encoding and encryption of FIG. 6.

[0422] This is, for example, as discussed in relation to Fig. 4, the remaining 4 5 The element modulo (710) can be encoded and encrypted as five lower values ​​(711-715) modulo 4; and the remaining 3 4 An example is shown in the drawing where an element modulo-operated by (740) can be encoded and encrypted as four sub-values ​​(741-743) modulo-operated by 3. The remaining element modulo-operated by 1433 (720) is, in this example, 2 as discussed, for instance, in relation to FIG. 6. 5 It can be encoded and encrypted as three sub-values ​​(721-723) obtained by modulo operation.

[0423] In particular, multiple integers that are coprime to each other Given a list, m mod τ values( A hybrid approach can be used to encode and encrypt ). The value By determining individual elements of the CRT representation of a value, it can be encoded and encrypted, where the individual values ​​are encrypted, and RadModInt Encoded-encrypted as, and / or RadModInt + It can be encoded and encrypted as encrypted.

[0424] Now, regarding all the rest RadModInt + Detailed examples of its use are provided. These examples apply to one, in excess of, or all of the remainders, RadModInt Alternatively, it can be adapted when a single encryption is used. In this example, CRT base Under integers ( Encrypting ) ModInt cryptogram( ) can be defined as follows:

[0425]

[0426] Here, 0 ≤ i ≤ κ - Regarding 1, since, is. In this example, composing i The first RadModInt + ciphertext It is denoted as . Then, and am.

[0427] ModInt Ciphertexts , ) can be defined as compatible in the following cases and:

[0428]

[0429] Here and, ciphertexts( , If ) is compatible, am.

[0430] In general, various computations including encrypted operations and encrypted carry reductions can be performed as discussed for the encoding and encryption based on the normal remainder number system of FIG. 5. For example, encrypted addition, subtraction, scalar multiplication, carry reduction, clearing of all carries, multiplication and / or univariate function evaluation may be applied.

[0431] If performing such computing involves performing subcomputation on one or more elements of a CRT representation, the subcomputation may be applied to individual encoded and encrypted elements using the techniques discussed for FIG. 4 or FIG. 6. For example, ModInt The operation on is individual components It can be computed separately for, where Arith Instead of using the base algorithms described in this specification RadModInt + The underlying algorithms ModInt of It can be used to compute on.

[0432] FIG. 8 schematically illustrates an example of an embodiment of an encryption method (800) that performs cryptographic computing on one or more sets of encoded and encrypted values. The method (800) may be computer-implemented. A value may be encoded and encrypted as encryptions of a plurality of individual sub-values. A sub-value may have a corresponding message modulus and a carry message modulus greater than the message modulus. A value may be encoded and encrypted without a carry by non-carry sub-values ​​smaller than the corresponding message modulus. A value may be encoded and encrypted with a carry by at least one carry-containing sub-value greater than or equal to the corresponding message modulus.

[0433] This method (800) may include a step (810) of accessing one or more encoded and encrypted values. This method (800) may include a step (820) of applying an encrypted operation to at least one input value encoded and encrypted with a carry to obtain an output value encoded and encrypted with a carry. This method (800) may include a step (830) of applying an encrypted carry reduction to an output value encoded and encrypted with a carry to obtain an additional encoding and encryption of an output value in which at least one carry-containing sub-value is reduced to a non-carry sub-value.

[0434] FIG. 9 schematically illustrates an example of an embodiment of a compiler method (900) for compiling computing into a homomorphic executable file. The homomorphic executable file may be executable by a cryptographic computing engine and may cause the cryptographic computing engine to perform cryptographic computing on one or more sets of encoded and encrypted values, for example, according to the method (800) of FIG. 8, as described herein. The homomorphic executable file may include one or more instructions for performing an encrypted carry reduction operation, for example, as part of an encrypted operation or between the execution of encrypted operations, as described herein. The compiler method (900) may be computer-implemented.

[0435] The compiler method (900) may include a step (910) of determining a fullness that indicates a limit for a carry-inclusive sub-value to be computed; and (920) a step (930) of generating an instruction that causes a cryptographic computing engine to apply an encrypted carry reduction before computing the carry-inclusive sub-value if the limit exceeds a corresponding carry message modulus.

[0436] As will be apparent to those skilled in the art, many different ways of executing the method(s) (800, 900) are possible. For example, the order of the steps may be performed in the order shown, but the order of the steps may be changed or some steps may be executed simultaneously. Furthermore, other method steps may be inserted between the steps. The inserted steps may represent improvements to the method such as those described herein, or they may not be related to the method. For example, some steps may be executed at least partially simultaneously. Furthermore, a given step may not be fully completed before the next step begins. It is also possible to combine the methods (800, 900), for example, the method (800) for performing cryptographic computing may be executed according to a previously compiled homomorphic executable file according to the method (900).

[0437] Embodiments of the methods may be executed using software that includes instructions for a processor system to perform the method (800 or 900). The software may include only such steps taken by a specific subentity of the system. The software may be stored on a suitable storage medium such as a hard disk, floppy disk, memory, optical disk, etc. The software may be transmitted as a signal over a wired or wireless connection or using a data network, such as the Internet. The software may be made available for remote use on a server and / or for download. Embodiments of the method may be executed using a bitstream arranged to form programmable logic, such as a field-programmable gate array (FPGA), to perform the method.

[0438] It will be recognized that the subject of the claim disclosed at present also extends to computer programs adapted to practice the subject of the claim disclosed at present, in particular to computer programs on or within a carrier. A program may be in the form of source code, object code, intermediate source code and object code, such as a partially compiled form, or any other form suitable for use in the implementation of an embodiment of the method. An embodiment related to a computer program product includes computer-executable instructions corresponding to each of the processing steps of at least one of the presented methods. These instructions may be subdivided into subroutines and / or stored in one or more files that may be linked statically or dynamically. Another embodiment related to a computer program product includes computer-executable instructions corresponding to each of at least one of the devices, units, and / or parts of the presented systems and / or products.

[0439] Typically, the devices described herein, for example, in FIGS. 1a–1c, comprise one or more microprocessors that execute appropriate software stored in the system; for example, the software may be downloaded and / or stored in corresponding memory, such as volatile memory like RAM or non-volatile memory like flash. Alternatively, the systems may be implemented wholly or partially as programmable logic, for example, as a field-programmable gate array (FPGA). The systems may be implemented wholly or partially as an application-specific integrated circuit (ASIC), for example, as an integrated circuit customized for a specific application. For example, the circuits may be implemented in CMOS using a hardware description language such as Verilog, VHDL, etc. In particular, the systems may include circuits for evaluating cryptographic primitives.

[0440] Processor circuits can be implemented in a distributed manner, for example, as multiple subprocessor circuits. Storage can be distributed across multiple distributed sub-stores. Part or all of the memory can be electronic memory, magnetic memory, etc. For example, storage can have volatile and non-volatile parts. Part of the storage can be read-only.

[0441] FIG. 10 illustrates a computer-readable medium (1000) having a writable portion (1010). The computer-readable medium (1000) is illustrated in the form of an optical-readable medium. The computer-readable medium (1000) may store data (1020), and the data may indicate instructions that, when executed by a processor system, cause the processor system to perform an embodiment of a method for performing cryptographic computing and / or a compiler method, according to an embodiment.

[0442] Instead or additionally, data (1020) may represent a homomorphic executable file compiled according to the compiler method described in this specification.

[0443] Data (1020) may represent a set of one or more encoded and encrypted values, including zero or more values ​​encoded and encrypted without a carry and one or more values ​​encoded and encrypted with a carry, as described in the specification.

[0444] Data (1020) may be realized as physical marks on the computer-readable medium (1000) or by magnetization of the computer-readable medium (1000). However, any other suitable embodiment may also be considered. Furthermore, although the computer-readable medium (1000) is illustrated herein as an optical disc, the computer-readable medium (1000) may be any suitable computer-readable medium such as a hard disk, solid-state memory, flash memory, etc., and may be non-writable or writable.

[0445] FIG. 11 illustrates a schematic representation of a processor system (1140) according to an embodiment of a device for performing cryptographic computing or determining a test polynomial. The processor system includes one or more integrated circuits (1110). The architecture of one or more integrated circuits (1110) is schematically illustrated in the drawing. The circuit (1110) includes a processing unit (1120), such as a CPU, for executing computer program components to execute a method according to an embodiment and / or to implement the modules or units thereof. The circuit (1110) includes a memory (1122) for storing programming code, data, etc. Part of the memory (1122) may be read-only. The circuit (1110) may include a communication element (1126), such as an antenna, connectors, or both. The circuit (1110) may include a dedicated integrated circuit (1124) for performing some or all of the processing defined in the method. The processor (1120), memory (1122), dedicated IC (1124), and communication element (1126) can be interconnected via an interconnection (1130), that is, a bus. The processor system (1110) can each be arranged for contact and / or non-contact communication using antennas and / or connectors.

[0446] For example, in an embodiment, a processor system (1140), such as a device for performing cryptographic computing or compilation, may include a processor circuit and a memory circuit, and the processor is arranged to execute software stored in the memory circuit. For example, the processor circuit may be an Intel Core i7 processor, an ARM Cortex-R8, etc. In an embodiment, the processor circuit may be an ARM Cortex M0. The memory circuit may be a ROM circuit or a non-volatile memory, such as flash memory. The memory circuit may be a volatile memory, such as SRAM memory. In the case of volatile memory, the device may include a non-volatile software interface, such as a hard drive, a network interface, etc., arranged to provide software.

[0447] Although the device (1110) is illustrated as comprising one of each of the described components, various components may be replicated in various embodiments. For example, the processor (1120) may include a plurality of microprocessors configured to execute the methods described herein independently, or configured to perform steps or subroutines of the methods described herein so that a plurality of processors cooperate to achieve the function described herein. Additionally, if the device (1110) is implemented as a cloud computing system, various hardware components may belong to separate physical systems. For example, the processor (1120) may include a first processor on a first server and a second processor on a second server.

[0448] It should be noted that the embodiments mentioned above are illustrative rather than limiting of the subject matter of the claims disclosed in this specification, and that those skilled in the art may design many alternative embodiments.

[0449] In the claims, any reference numerals placed between parentheses shall not be interpreted as limiting the claims. The use of the verb 'to include' and its conjugations does not exclude the existence of elements or steps other than those described in the claims. A singular expression preceding an element does not exclude the existence of a plurality of such elements. Expressions such as "at least one of" preceding a list of elements indicate a selection of any subset or all of the elements from the list. For example, the expression "at least one of A, B, and C" should be understood to include only A, only B, only C, both A and B, both A and C, both B and C, or all of A, B, and C. The subject matter of the claims disclosed herein may be implemented by hardware comprising several individual elements and by a suitably programmed computer. In device claims enumerating several parts, some of these parts may be implemented by a single and identical hardware item. The mere fact that specific measures are referred to in mutually different dependent claims does not indicate that a combination of these measures cannot be used advantageously.

[0450] In the claims, references within parentheses represent reference numerals or formulas of the exemplary embodiments within the drawings, thereby enhancing the clarity of the claims. These references shall not be interpreted as limiting the claims.

Claims

Claim 1 An encryption method (800) for performing encryption computing on one or more sets of encoded and encrypted values, wherein - a value is encoded and encrypted as encryptions of a plurality of individual sub-values, and the sub-values ​​have a corresponding message modulus and a carry message modulus greater than said message modulus; - a value is encoded and encrypted without carry into non-carry sub-values ​​smaller than the corresponding message modulus; And—a value is encoded and encrypted with a carry when at least one carry-with-carry sub-value is greater than or equal to the corresponding message modulus, and the method comprises:— a step of accessing the one or more encoded and encrypted values ​​(810);— a step of applying an encrypted operation to the input value encoded and encrypted with at least one carry to obtain an output value encoded and encrypted with a carry (820); and— a step of applying an encrypted carry-reduction to the output value encoded and encrypted with a carry to obtain an additional encoding and encryption of the output value in which at least one carry-with-carry sub-value is reduced to a non-carry sub-value (830). Claim 2 In claim 1, the encryption of the lower values ​​is LWE encryption, the LWE encryption supports a programmable bootstrapping operation, the programmable bootstrapping evaluates LWE decryption at the exponent of a GLWE encrypted monomial, and the encrypted carry reduction uses the programmable bootstrapping operation, encryption method (800). Claim 3 An encryption method (800) according to claim 1, comprising the step of computing the output value by performing a plurality of encrypted arithmetic operations on a set of encoded and encrypted values, wherein the operation does not include encrypted carry reduction. Claim 4 In claim 1, the encrypted operation is performed by individually applying individual sub-operations to individual encryptions of the sub-values ​​of the input value, and the individually applied encrypted operations are performed at least partially in parallel, encryption method (800). Claim 5 In claim 1, the encoding of the value as non-carry sub-values ​​is based on the remainder number system representation of the value, encryption method (800). Claim 6 In claim 5, the encryption method (800) is further based on the radix decomposition of the elements of the remainder number system representation. Claim 7 In claim 1, the encoding of the value as non-carry sub-values ​​is based on the radix decomposition of the value, encryption method (800). Claim 8 An encryption method (800) according to claim 6 or 7, wherein applying the encrypted carry reduction comprises decomposing the carry-inclusive sub-value of the output value into the encryptions of the individual sub-values ​​of the sub-value, and adding the encryptions of the sub-values ​​of the sub-value to the encryptions of the corresponding sub-values ​​of the output value. Claim 9 An encryption method (800) comprising the step of performing an encrypted multiplication of an encoded and encrypted value and a scalar by computing individual encrypted sub-values ​​for the multiplication of an encoded and encrypted value and a scalar in accordance with claim 6 or 7. Claim 10 An encryption method (800) according to claim 6 or 7, comprising the step of performing an encrypted multiplication of the first encoded and encrypted value and the second encoded and encrypted value by performing an encrypted multiplication of the encryptions of the sub-values ​​of the first encoded and encrypted value and the second encoded and encrypted value, wherein the encrypted multiplication of the encryptions of the sub-values ​​results in the encoded and encrypted value. Claim 11 In claim 6, the element of the remainder number system representation is defined as a modulo for a modulus smaller than the maximum value expressible by the radix decomposition, in an encryption method (800). Claim 12 In claim 7, the encryption method (800) wherein the value encoded and encrypted without the carry is defined as a modulo for a modulus smaller than the maximum value expressible by the radix decomposition. Claim 13 In claim 1, the encryption method (800) comprises applying the encrypted operation, determining a degree of fullness that indicates a bound for the carry-inclusive sub-value to be computed, and, if the bound exceeds a corresponding carry message modulus, applying the encrypted carry reduction before computing the carry-inclusive sub-value. Claim 14 In claim 1, the message modulus is not a power of 2, encryption method (800). Claim 15 In claim 1, the encryption method (800) has a carry message modulus of at least 4 and at most 512. Claim 16 An encryption method (800) according to claim 1, comprising the step of performing at least one of one or more encrypted linear operations, one or more encrypted multiplications, and one or more univariate function evaluations. Claim 17 An encryption method (800) according to claim 1, comprising the steps of: extracting one or more bits from one or more sub-values ​​of the encoded and encrypted values; converting the extracted bits into GGSW ciphertexts; and applying a function evaluation to the one or more encoded and encrypted values ​​by applying a lookup table to the GGSW ciphertexts. Claim 18 A computer implementation compiler method (900) for compiling computing into a homomorphic executable, wherein the homomorphic executable is executable by a cryptographic computing engine and the cryptographic computing engine performs cryptographic computing according to claim 1, the method comprising: - a step (910) of determining a fullness that indicates a limit for a carry-containing sub-value to be computed; and - a step (930) of generating an instruction that, when the limit exceeds a carry message modulus of the carry-containing sub-value (920), the cryptographic computing engine applies an encrypted carry reduction before computing the carry-containing sub-value. Claim 19 An encryption device (110, 112) for performing an encrypted calculation on one or more sets of encoded and encrypted values, wherein - a value is encoded and encrypted with encryptions of a plurality of individual sub-values, and the sub-values ​​have a corresponding message modulus and a carry message modulus greater than the message modulus; - a value is encoded and encrypted without carry with non-carry sub-values ​​smaller than the corresponding message modulus; And—a value is encoded and encrypted including a carry when at least one carry-containing sub-value is greater than or equal to the corresponding message modulus, and the device (110, 112) comprises:—a storage (140) for storing the one or more encoded and encrypted values; and—a processor subsystem (130) configured to obtain an output value encoded and encrypted including a carry by applying an encrypted operation to an input value encoded and encrypted including a carry, and to obtain additional encoding and encryption of the output value in which at least one carry-containing sub-value is reduced to a non-carry sub-value by applying an encrypted carry reduction to the output value encoded and encrypted including a carry. Claim 20 A compiler device (119) for compiling computing into a homomorphic executable file, wherein the homomorphic executable file is executable by an cryptographic computing engine and the cryptographic computing engine performs cryptographic computing according to claim 1, and the device comprises: - a storage (149) for storing data representing the computing to be compiled into the homomorphic executable file; and - a processor subsystem (139) configured to determine a fullness indicating a limit for a carry-inclusive subvalue to be computed, and, if the limit exceeds the carry message modulus of the carry-inclusive subvalue, to generate an instruction to the cryptographic computing engine to apply an encrypted carry reduction before computing the carry-inclusive subvalue. Claim 21 A non-transient computer-readable storage medium (1000) on which a program is recorded, wherein the program comprises: - instructions that, when executed by a processor system, cause the processor system to perform the method according to claim 1; or - at least one of instructions that, when executed by a processor system, cause the processor system to perform the method according to claim 18.

Images