Approximate gadget decomposition useful for fully homomorphic encrypted computation

Abstract

Some embodiments are directed to a cryptographic method (500) for an approximate gadget decomposition of an integer, a cryptographic method (510) for computing a gadget vector for use with an approximate gadget decomposition of an integer and / or a cryptographic method (520) for reconstructing an approximation of an integer from an approximate gadget decomposition of the integer.

Description

[0001] APPROXIMATE GADGET DECOMPOSITION USEFUL FOR FULLY HOMOMORPHIC ENCRYPTED COMPUTATION TECHNICAL FIELD The presently disclosed subject matter relates to a method for an approximate gadget decomposition of an integer, a method for computing a gadget vector, a method for reconstructing an approximation of an integer from an approximate gadget decomposition of the integer, a method for a fully homomorphic encrypted computation, a system, and a computer storage medium. BACKGROUND CRT gadget decomposition refers to the process of breaking down a number into a set of smaller integers based on the Chinese Remainder Theorem (CRT), where each integer corresponds to the remainder of the original number modulo different, pairwise coprime bases. This technique enables the efficient representation and manipulation of large numbers by transforming them into parallelizable, modular arithmetic operations across these bases. It is particularly useful in cryptographic applications, such as homomorphic encryption, where operations on encrypted data can be optimized through operations on these decomposed, modular components. Homomorphic cryptography allows one to execute computer programs, e.g., circuit evaluations, function evaluations, etc., over encrypted data by a party without that party being able to decrypt. For example, input data and computation results may be received and returned in encrypted form. Intermediate data, e.g., an internal state of the computation, may also be in encrypted form. Even though the output of the computer program is returned in an encrypted form, when decrypted the output is expected to be the same, or very close to, as if the operations had been performed on the unencrypted data. Homomorphic encryption can be used for privacy-preserving outsourced storage and computation. This allows for example data to be encrypted and outsourced to a cloud environment for processing and / or storage, all while encrypted. In particular, homomorphic cryptography techniques exist that can be used, at least in principle, to compute any function on encrypted data. Such techniques are referred to as "fully homomorphic encryption" (FHE) techniques. The execution environment is provided by various homomorphic encryption techniques. One such homomorphic encryption system is described in I. Chillotti et al., TFHE: Fast fully homomorphic encryption over the torus. Journal of Cryptology,33(1):34–91, 2020 (incorporated herein by reference). Generally, TFHE-likehomomorphic encryption schemes can be based on lattice encryption, e.g., LWE, LWR or NTRU encryption, and their variants. Gadget decomposition enhances the efficiency of Fully HomomorphicEncryption (FHE) schemes by splitting elements as vectors of smaller chunks whose innerproducts with the corresponding gadget vector rebuilds (an approximation of) the originalelements. This decomposition reduces the computational complexity and memoryrequirements of operations on encrypted data, making FHE more practical for real-world applications. Moreover, it improves the overall performance of FHE systems, enabling them to support more complex computations and larger datasets within reasonable time frames and computational resources. For example, radix-based decomposition involves representing a number in a base (or radix), e.g., a power of 2 or 10, breaking down a large number into a series of digits in that base. For example, Chinese Remainder Theorem (CRT)-based decomposition, on the other hand, represents a number as a set of residues modulo a sequence of pairwise coprime integers. The Chinese Remainder Theorem allows computation of a gadget vector and to recompute the original integer from the gadget representation. Like radix-based gadget representation it breaks operations on large numbers into smaller,independent modular operations that may even be performed in parallel. CRT decomposition is advantageous as it allows more operations to be performed component wise than radix-based representation. For example, to multiply two numbers in CRTgadget decomposition one can simply multiply the representations component wise. Thisdoes not work for radix-based representation. On the other hand, radix-based decomposition easily allows an approximategadget representation by discarding the least significant digits. Likewise, thecorresponding gadget vector can be truncated to work with the truncated gadgetrepresentation. Thus, the amount of space allocated to an integer, and correspondingly,the amount of time spent on computing with the number can easily be scaled back for integers in radix-based representation. This does not work for CRT based representation, discarding even one integer from an integer in a CRT gadget decomposition would completely change the resulting number after reconstruction. There is a need for obtaining CRT-based gadget decompositions in the approximate setting. At present CRT-based gadget decompositions are only known for the exact setting. This finds applications in fully homomorphic encryption; in particular, it enables supporting arithmetic on operands larger than the machine word. SUMMARY It would be advantageous to have an improved approximate gadget decomposition. Preferable, an approximate gadget decomposition that allows approximate representation, but also component wise computations. In an embodiment, a method for approximate gadget decomposition of aninteger is provided. The method may comprise:- obtaining an input integer modulo a modulus. For example, the input integer maybe a parameter in a computation, e.g., a weight in a neural network, etc.- obtaining a first modulus and a second modulus , wherein the modulus is a productof the first modulus and the second modulus , the first and second moduli being relatively prime and larger than 1. Either one or both of the moduli may be obtained in the form of a first or second sequence of integers, the product of which equals the modulus.- obtaining a second sequence of integers for the second modulus, wherein thesecond sequence has at least two integers, the product of the integers of the secondsequence equals the second modulus , the integers of the second sequence being pairwise co-prime, and the integers are larger than 1.- computing the approximate gadget decomposition by computing a representativefor a difference modulo each of the integers in the second sequence corresponding to the second modulus , wherein the difference is between the input integer and an integercongruent to the input integer modulo the first modulus. The difference may first becomputed in the integers or in a larger modulus, alternatively, the difference may be compute modulo the integers in the second sequence directly. For example, the computed approximate gadget decomposition may be usedin an FHE computation, e.g., a fully homomorphic encrypted computation. For example,an approximate gadget decomposition may be used in an FHE multiplication between anunencrypted first integer (^) and an FHE encrypted second integer (^), wherein the first integer is represented in the approximate gadget decomposition. In an embodiment, a cryptographic method for computing a gadget vector is provided. The method may comprise- obtaining a first modulus and a second modulus, wherein the modulus is a productof the first modulus and the second modulus, the first and second moduli being relatively prime and larger than 1,- obtaining a second sequence of integers for the second modulus, wherein thesecond sequence has at least two integers, the product of the second sequence equals the second modulus, the second sequence of integers are pairwise co-prime, and the integers are larger than 1,- computing the sequence, by multiplying for each integer in the second sequence:- the second modulus divided by the integer,- the first modulus.Note that the last computation may include additional factors. This is not necessary, and in fact, one can take only the factors listed above. Optionally the additional factor may comprise an inverse modulo the integer of one of:- the first modulus times the second modulus divided by the integer,- the second modulus divided by the integer,- the first modulus.Depending on the option chosen appropriate changes may be made to computing the gadget decomposition. In an embodiment, a method for reconstructing an approximation of an integerfrom an approximate gadget decomposition of the integer is provided. The method maycomprise,- obtaining an approximate gadget decomposition of the integer,- obtaining a corresponding gadget vector- computing the dot product of the obtained approximate gadget decomposition andthe corresponding gadget vector. The dot product is sometimes referred to as the inner product. Each of the methods may be implemented on an electronic device, in particular on a computer. A computer may comprise one or more of a processor, an FPGA, and an ASIC. The methods described herein may be applied in a wide range of practicalapplications. Such practical applications include FHE cryptography.An embodiment of the method may be implemented on a computer as a computer implemented method, or in dedicated hardware, or in a combination of both. Executable code for an embodiment of the method may be stored on a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Preferably, the computer program product comprises non-transitory program code stored on a computer readable medium for performing an embodiment of the method when said program product is executed on a computer. In an embodiment, the computer program comprises computer program code adapted to perform all or part of the steps of an embodiment of the method when the computer program is run on a computer. Preferably, the computer program is embodied on a computer readable medium. Another aspect of the presently disclosed subject matter is a method of making the computer program available for downloading. This aspect is used when the computerprogram is uploaded into a server, and when the computer program is available fordownloading from such a server.BRIEF DESCRIPTION OF DRAWINGS Further details, aspects, and embodiments will be described, by way of example only, with reference to the drawings. Elements in the figures are illustrated for simplicity and clarity and have not necessarily been drawn to scale. In the figures, elements which correspond to elements already described may have the same reference numerals. In the drawings, Figure 1a schematically shows an example of an embodiment of a computation system, Figure 1b schematically shows an example of an embodiment of a computation system, Figure 2 schematically shows an example of an embodiment of a device for an approximate gadget decomposition of an integer, Figure 3 schematically shows an example of an embodiment of a device for an approximate gadget decomposition of an integer, Figure 4a schematically shows an example of an embodiment of a device for computing a gadget vector, Figure 4b schematically shows an example of an embodiment of a device for computing a gadget vector, Figure 5 schematically shows an example of an embodiment of a method foran approximate gadget decomposition of an integer, a method for computing a gadgetvector, a method for reconstructing an approximation of an integer from an approximate gadget decomposition of the integer, Figure 6a schematically shows a computer readable medium having a writable part comprising a computer program according to an embodiment, Figure 6b schematically shows a representation of a processor system according to an embodiment. Reference signs list The following list of references and abbreviations corresponds to the figures, and is provided for facilitating the interpretation of the drawings and shall not be construed as limiting the claims.100, 102 a computing system110 a device for an approximate gadget decomposition of an integer120 a device for computing a gadget vector130 a device for a fully homomorphic encrypted computation140 a device for reconstructing an approximation of an integer from anapproximate gadget decomposition of the integer111, 121, 131, 141 a processor system112, 122, 132, 142 storage113, 123, 133, 143 communication interface172 computer network200 a device for approximate gadget decomposition210 an input integer211 a modulus (^)220 a first modulus (^^)230 a second modulus (^^)231, 232 integer in a second sequence of integers250 an approximate gadget decomposition251, 252 approximate gadget decomposition element240 an integer modulo the first modulus241 a difference300 a device for approximate gadget decomposition310 an input integer311 a modulus (^)320 a first modulus (^^)321, 322 integer in a second sequence of integers330 a second modulus (^^)331, 332 integer in a second sequence of integers350 an approximate gadget decomposition351, 352 approximate gadget decomposition element360 an integer modulo an integer in sequence 331-332371 a product400, 401 a device for computing a gadget vector411 a modulus (^)420 a first modulus (^^)430 a second modulus (^^)431, 432 integer in a second sequence of integers470 a CRT gadget vector471, 472 a CRT gadget vector element421 an integer for multiplication480 a gadget vector481, 482 a gadget vector element461 the second modulus (^^) divided by the integer (^^)451 the first modulus times integer 461452 the inverse of integer 451500 a cryptographic method for an approximate gadget decomposition of aninteger510 a cryptographic method for computing a gadget vector520 a cryptographic method for reconstructing an approximation of an integerfrom an approximate gadget decomposition of the integer,1000, 1001 a computer readable medium1010 a writable part1020 a computer program1110 integrated circuit(s)1120 a processing unit1122 a memory1124 a dedicated integrated circuit1126 a communication element1130 an interconnect1140 a processor systemDESCRIPTION OF EMBODIMENTS While the presently disclosed subject matter is susceptible of embodiment in many different forms, there are shown in the drawings and will herein be described in detail one or more specific embodiments, with the understanding that the present disclosure is to be considered as exemplary of the principles of the presently disclosed subject matter and not intended to limit it to the specific embodiments shown and described. In the following, for the sake of understanding, elements of embodiments are described in operation. However, it will be apparent that the respective elements are arranged to perform the functions being described as performed by them. Further, the subject matter that is presently disclosed is not limited to the embodiments only, but also includes every other combination of features described herein or recited in mutually different dependent claims. Figure 1a schematically shows an example of an embodiment of a device foran approximate gadget decomposition 110, an embodiment of a device for computing a gadget vector 120, an embodiment of a device for FHE computation 130, and an embodiment of device for reconstructing an approximation of an integer 140. A device for an approximate gadget decomposition 110, device for computing a gadget vector 120, device for FHE computation 130, and device for reconstructing anapproximation of an integer 140 may be part of a computing system 100.Device for an approximate gadget decomposition 110 is configured tocompute an approximate gadget decomposition of an integer. An approximate gadget decomposition decomposes an integer into a vector of bounded integers whose innerproduct with a corresponding gadget vector approximates the original integer.Device 110 may obtain an input integer, e.g., receive it, and compute for it theapproximate gadget decomposition with respect to a series of integers. Device forcomputing a gadget vector 120 is configured to compute a gadget vector for use with anapproximate gadget decomposition of an integer. Having one or more integers in approximate gadget decomposition allows efficient computation with those integers. For example, an approximate gadget decomposition needs fewer integers in its representation than an exact gadget decomposition would. For example, integers in approximate gadget decomposition can be added, subtracted, multiplied, etc., by performing these operations elementwise. To make the transition back to a regular representation, e.g., as an integer modulo some modulus, the inner product with a so-called gadget vector can be computed. For integersin approximate gadget representation, a special gadget vector may be used, to bestapproximate the integer after conversion back from gadget representation to regular representation. One particular advantageous application of approximate gadget approximation is in fully homomorphic encrypted (FHE) computation. Fully Homomorphic Encryption (FHE) is a cryptographic system that allows for arbitrary computations to be performed on encrypted data without needing to decrypt it first, thereby preserving the confidentiality of the data. This means that a third party can compute functions on the encrypted data, producing encrypted results that, once decrypted, would match the outcome of the same operations if they were performed on the plaintext. Device for FHE computation 130 is configured to perform for a fullyhomomorphic encrypted computation comprising in which at least some of the integers are represented in an approximate gadget representation. Note that an approximate gadget representation can be applied to FHE encrypted data as well. This allows the same type of operations, e.g., operations on one or more component wise FHE encrypted integers in approximate gadget representation. In this case the operations are performed using FHE operations on the encrypted components. Operations may also be between unencrypted and encrypted integers. This can be advantageous since such operations typically require fewer resources. Device for reconstructing an approximation of an integer 140 is configured toreconstruct an approximation of an integer from an approximate gadget decomposition ofthe integer. For example, an integer in gadget representation may be obtained as a resultof an FHE computation. If the secret key is available, e.g., by a client of the system, theencrypted elements may be decrypted and the reconstruction may be performed. Interestingly, the conversion from approximated gadget representation can be performed while in FHE encryption as well. This would take as input an integer in approximated gadget representation and produce a regular integer, e.g., modulo a modulus, but still in FHE encryption. Device for an approximate gadget decomposition 110 may comprise aprocessor system 111, a storage 112, and a communication interface 113. Device forcomputing a gadget vector 120 may comprise a processor system 121, a storage 122, anda communication interface 123. Device for FHE computation 130 may comprise aprocessor system 131, a storage 132, and a communication interface 133. Device forreconstructing an approximation of an integer 140 may comprise a processor system 141,a storage 142, and a communication interface 143. Devices 110, 120, 130 and 140 are represented here as devices, though eachone of them could just as well be implemented as systems, e.g., a geographically distributed system, e.g., a cloud computing system, e.g., a system comprising multiplecomputers. Devices 110, 120, 130 and 140 are represented here are separate device,though in practice many of their functions will be integrated in a single device or system.For example, in an embodiment, a device may be configured for an approximate gadgetdecomposition of an integer, as well as for reconstructing an approximation of an integerfrom an approximate gadget decomposition of the integer. The device could receive agadget vector, though it could compute the gadget vector instead. For example, a device could be configured for an approximate gadget decomposition of an integer, for reconstructing an approximation of an integer from an approximate gadget decompositionof the integer, for computing a gadget vector, and for a fully homomorphic encryptedcomputation. Other combinations are possible. In the various embodiments of communication interfaces 113, 123, 133, and / or 143, the communication interfaces may be selected from various alternatives. For example, the interface may be a network interface to a local or wide area network, e.g., the Internet, a storage interface to an internal or external data storage, an application interface (API), etc. Storage 112, 122, 132, and 142 may be, e.g., electronic storage, magnetic storage, etc. The storage may comprise local storage, e.g., a local hard drive or electronic memory. Storage 112, 122, 132, and 142 may comprise non-local storage, e.g., cloud storage. In the latter case, storage 112, 122, 132, and 142 may comprise a storage interface to the non-local storage. Storage may comprise multiple discrete sub-storages together making up storage 112, 122, 132, and 142. Storage 112, 122, 132, and 142 may be non-transitory storage. For example, storage 112, 122, 132, and 142 may store data in the presence of power such as a volatile memory device, e.g., a Random Access Memory (RAM). For example, storage 112, 122, 132, and 142 may store data in the presence of power as well as outside the presence of power such as a non-volatile memory device, e.g., Flash memory. Storage may comprisea volatile writable part, say a RAM, a non-volatile writable part, e.g., Flash, Storage maycomprise a non-volatile non-writable part, e.g., ROM. The devices 110, 120, 130, and 140 may communicate internally, with each other, with other devices, external storage, input devices, output devices, and / or one or more sensors over a computer network. The computer network may be an internet, anintranet, a LAN, a WLAN, a WAN, etc. The computer network may be the Internet. Thedevices 110, 120, 130, and 140 may comprise a connection interface which is arranged to communicate within system 100 or outside of system 100 as needed. For example, the connection interface may comprise a connector, e.g., a wired connector, e.g., an Ethernet connector, an optical connector, etc., or a wireless connector, e.g., an antenna, e.g., a Wi- Fi, 4G or 5G antenna. The communication interface 113 may be used to send or receive digital data, e.g., receive in input integer, send an approximate gadget decomposition of an integer.The communication interface 123 may be used to send or receive digital data, e.g., toreceive moduli, a sequence of integers, and to send a gadget vector. The communication interface 133 may be used to send or receive digital data, e.g., receive FHE encrypted input data, send receive FHE encrypted output data. The communication interface 133 may be used to receive unencrypted integers, possibly in approximated gadget format, for use in the computation. The communication interface 143 may be used to send or receive digital data, e.g., to communicate with other server devices, e.g., to receive an integer in approximated gadget format, to send a reconstructed integer. The execution of devices 110, 120, 130, and 140 may be implemented in a processor system. The devices 110, 120, 130, and 140 may comprise functional units to implement aspects of embodiments. The functional units may be part of the processor system. For example, functional units shown herein may be wholly or partially implemented in computer instructions that are stored in a storage of the device and executable by the processor system. The processor system may comprise one or more processor circuits, e.g.,microprocessors, CPUs, GPUs, etc. Devices 110, 120, 130, and 140 may comprisemultiple processors. A processor circuit may be implemented in a distributed fashion, e.g., as multiple sub-processor circuits. For example, devices 110, 120, 130, and 140 may use cloud computing. Typically, the device for an approximate gadget decomposition 110, device for computing a gadget vector 120, device for FHE computation 130, and device for reconstructing an approximation of an integer 140, each comprise one or more microprocessors which executes appropriate software stored at the device; for example, that software may have been downloaded and / or stored in a corresponding memory, e.g., a volatile memory such as RAM or a non-volatile memory such as Flash. Instead of using software to implement a function, the devices 110, 120, 130, and / or 140 may, in whole or in part, be implemented in programmable logic, e.g., as field- programmable gate array (FPGA). The devices may be implemented, in whole or in part, as a so-called application-specific integrated circuit (ASIC), e.g., an integrated circuit (IC)customized for their particular use. For example, any one of processor systems 111, 121,131, 141 may comprise an FPGA and / or ASIC configured for a method according to anembodiment or for part thereof. For example, the circuits may be implemented in CMOS, e.g., using a hardware description language such as Verilog, VHDL, etc. In particular, devices 110,120, 130, and 140 may comprise circuits, e.g., for cryptographic processing, and / orarithmetic processing. In hybrid embodiments, functional units are implemented partially in hardware, e.g., as coprocessors, e.g., cryptographic coprocessors, and partially in software stored and executed on the device. Figure 1b schematically shows an example of an embodiment of a computingsystem 102. System 102 may comprise multiple devices of the types 110, 120, 130 and / or 140. The devices are connected through a computer network 172, e.g., the Internet.Below is a list of examples for using an FHE computation device. Homomorphiccomputation may be used, e.g., in one of the following scenarios: Outsource computational tasks: An FHE computation device may beconfigured to perform various homomorphic operations on encrypted plain texts. The encrypted plaintexts may be directly obtained from a data-provider device, or they may be the result of previous homomorphic operations, e.g., the encrypted plaintexts may be intermediate results. In an embodiment, homomorphic encryption is used by a data-provider device to securely offload or outsource computational tasks to a server, e.g., an FHE computation device, without compromising the privacy of the underlying data. For example, a data- provider device encrypts one or more input data and transfers the resulting ciphertext, e.g., the encrypted plaintexts, to the server. The FHE computation device then performs computations on the encrypted data, producing encrypted results that the data-provider device can decrypt locally. This setup eliminates the need for high-performance computing hardware on the client side, as the computation can be executed on a more capable server. Furthermore, homomorphic encryption allows multiple data-provider devices to securely pool encrypted data for joint computation tasks, such as training machine learning models. For example, this approach is useful for collaborative learning, where different entities wish to jointly train a neural network model without sharing sensitive data in plaintext. Healthcare applications: Patient data may be encrypted by a client device. Aclient device may encrypt data before sending it to an FHE computation device, e.g.,device for FHE computation 130. Homomorphic calculation can be used to perform medical research on the encrypted data without compromising patient privacy. This could include analyzing genomic data or conducting clinical trials. For example, a homomorphic calculation may be performed on medical data, e.g., medical sensor data, e.g., a medical image. The medical data may comprise genomic data. The medical data is smaller during transport from the client device to the server device due to the stream-cipher type encryption. Cloud computing: The encryption may be used to securely outsource computation to untrusted cloud providers. Computations may be performed on encrypted data stored in the cloud, without ever having to decrypt the data. For example, a client device may stream-cipher encrypt data and store it in the cloud. A server device may access the data and transcipher it to FHE encrypted data. Machine learning: The encryption may be used to perform machine learning computations on encrypted data. This could include training models on encrypted data or making predictions on encrypted data without ever decrypting it. For example, a neural network may be trained and / or evaluated on encrypted data. For example, a client device may stream-cipher encrypt training data and send it to a server device. The server device may access the data and transcipher it to FHE encrypted data. The FHE computation device can homomorphically evaluate a machine learning model, such as a neural network, on encrypted data provided by one or more data-provider devices. This setup allows data-provider devices to benefit from advanced AI models without exposing their raw data to the server. For instance, in medical data analysis, data-provider devices can send encrypted data to the server, which then applies a machine learning model to this data in its encrypted form. The result, still encrypted, is returned to the data-provider device for decryption, enabling insights without privacy compromise. For example, the FHE computation device may receive encrypted data, e.g., encrypted plaintexts, homomorphically evaluate a neural network on the received encrypted data, and obtain encrypted results. The encrypted results may then be sent to the data-provider device. Blockchains: The encryption may be used to hide data appearing on a public blockchain. This could include private data like a user’s account balance. Using encryption would enable wiring money by checking on encrypted data that the user’s balance is sufficient for the transfer. Doing so would hide the exact balance of the user. For example, a client device may stream-cipher encrypt data and place it on the blockchain. A server device can access the blockchain to receive the encrypted data and transcipher it to FHE encrypted data for further processing. An embodiment comprises performing computations using fully homomorphic encryption (FHE) for distributed ledgers, e.g., a blockchain. For example, values on which a homomorphic computation is to be performed may be stored on a distributed ledger. The homomorphic computation may be encoded in a smart contract. The smart contract is typically also stored on the distributed ledger, e.g., in whole or in part. Typical examples of distributed ledgers include Ethereum, Solana, and the like, e.g., other distributed ledgers supporting the storing of encrypted values and of smart contracts, or storing smart contracts at least in part. For example, one or more homomorphically encrypted values may be obtained, and a smart contract may be homomorphically evaluated. This evaluation includes a homomorphic computation applied at least to the one or more homomorphically encrypted value(s) that were obtained. The obtained homomorphically encrypted values may be retrieved from the distributed ledger, but other possibilities exist. For example, instead of actually storing a homomorphically encrypted value on the distributed ledger, the ledger may instead store an identifier that identifies the homomorphically encrypted values. The homomorphically encrypted value may then, e.g., be retrieved from an external storage, e.g., external to the distributed ledger, that associates identifiers with homomorphically encrypted values. These encrypted values may be encrypted using an encryption key specific to the particular user. For example, after obtaining the one or more homomorphically encrypted values, the encrypted data may undergo a series of homomorphic operations to implement a computation specified in the smart contract. This produces a homomorphically encrypted result value. Throughout this process, the data remains encrypted, ensuring that its confidentiality is preserved. After the homomorphic computation is complete, the resulting homomorphically encrypted result value may be stored on the distributed ledger. The latter is not necessary, and instead, the homomorphically encrypted result value may be returned to a user. Yet another possibility is to store the homomorphically encrypted result value in the external storage. In any case, an owner of the encryption key may decrypt the resulting homomorphically encrypted result value. The owner may be a user but may also be a computation service, e.g., an oracle or the like. This application uses FHE computation as a motivating example. Indeed,approximate CRT gadget decompositions are very useful in FHE computation. Althoughmost of this document will assume application in this field, this is exemplary, and otherapplications are possible. For example, CRT decompositions are used, e.g., in DigitalSignal Processing (DSP). In DSP, especially in the context of fast Fourier transforms(FFTs) and convolution, CRT can be used to decompose computations into smaller, more manageable problems. By applying CRT, a problem can be divided into subproblems modulo different bases, solved in parallel, and then recombined. This approach can lead to more efficient implementations of FFTs and convolution, which are fundamental operations in signal processing, affecting applications in audio processing, imagecompression, and telecommunications. A consequence of using CRT is that computationsare necessarily exact, as the CRT representation cannot conventionally be truncated. In an embodiment, the above DSP may use an embodiment of the approximated CRT gadget decomposition. Notation Elements in ℤ / ^ℤ, the ring of integers modulo ^, are typically viewed asintegers in the integer range [−⌊^ / 2⌋, ⌊^ / 2⌋], where ⌊⋅⌋ denotes the flooring function. Forexample, for ^ = 5, ⌊5 / 2⌋ = 2 and elements of ℤ / 5ℤ are represented by the set{−2, −1,0,1,2}. When integers modulo ^ are seen as integers, or more precisely by theirinteger representatives, this is indicated by the lifting function; for an integer ^ ∈ ℤ / ^ℤ,it is denoted by (^ mod ^)ℤ or sometimes, more simply, as (^)ℤ. The lift function is afunction that maps elements from ℤ / ^ℤ the ring of integers modulo ^ to a specific set ofinteger representatives. The preferred set of representatives is always centered around zero, as smallerrepresentatives lead to smaller error. For example, representatives sets for (a mod q) maybe a signed integer in [ − ⌊^ / 2⌋, ⌊(^ − 1) / 2⌋], [ − ⌊(^ − 1) / 2⌋, ⌊^ / 2⌋], or [ −⌊^ / 2⌋, ⌊^ / 2⌋]. In the latter case, this representation is not unique if 2 divides q. Anotheruseful set of representatives, that avoids negative numbers is [0, ^ − 1]. Vectors are given in row representation and denoted by bold letters ^. Polynomials, as well as algebraic integers, are denoted by cursive letters ^. It is not necessary for the elements in ℤ / ^ℤ, to use, e.g., the integer range [− ⌊^ / 2⌋, ⌊^ / 2⌋] . Instead, say, the range [0, ^ − 1] may be used, or even other ranges.However, in general, computation is faster, and representations are more accurate if the former interval is used. Fully Homomorphic Encryption One of the issues to deal with for fully homomorphic encryption is the noise growth. This can be controlled to some extent thanks to a so-called gadget decomposition

[0013] . A gadget decomposition splits elements as vectors of smaller chunks whose inner products with the corresponding gadget vector rebuilds (an approximation of) the original elements. In particular, gadget decompositions are used in this context to perform, e.g.,the multiplication of a ciphertext by a scalar. Multiplying a noisy ciphertext by a scalar may result in a ciphertext whose noise error exceeds tolerated bounds. One way to control noise growth is to decompose the scalar with respect to a small radix [4, 6]. This techniquehas been applied in a number of fully homomorphic encryption schemes — at the heartof the encryption process or as an auxiliary tool for accompanying gadgets or procedures;see e.g., [5, 13, 4, 11, 1, 10, 7, 8, 3].Definitions Formally, we give a generic definition inspired from [8], on a general ^- module for some algebraic ring ^. Examples of interest include (but are not limited to)^ = ℤ, ^ = ℤ / ^ℤ, ^ = ℤ[^], ^ = ℤ[^] / ^^(^)^ for some irreducible monic polynomial^, and ^ = (ℤ / ^ℤ)[^] / ^^(^)^; respectively, the ring of integers, the ring of integersmodulo ^, the ring of polynomials modulo ^ with integer coefficients, and the ring ofpolynomials modulo ^ with coefficients in ℤ / ^ℤ. The definition naturally extends to e.g.,matrices defined over these structures. A gadget decomposition is characterized by three parameters: level ℓ, quality ^, and precision ^. [Gadget Decomposition] Let ℳ be a ^-module for some ring ^. A gadgetdecomposition on ℳ of level ℓ, quality ^ and precision ^ is given by:1. a gadget vector 2. an efficient algorithm ∇: = ∇^,^ℓ^ : ℳ → ^ s.t. for any ^ ∈ ℳ:‖∇^‖^ ≤ ^ and ‖^ − ^∇^, ^^‖^ ≤ ^ .where the infinity norms are taken coefficient-wise. A natural method for handling large integers using small arithmetic units is torely on the Chinese Remainder Theorem (CRT)

[0015] . Though gadget decompositionswere first based on binary or radix-^ representation of integers

[0013] , which is sometimescalled “Canonical Gadget Decomposition” as in [8], alternative decompositions havebeen introduced based on the mixed-radix representation

[0012] or the CRT representation [2]. However, the CRT-based gadget decomposition is extremely sensitive to errors, as these are getting spread by the inverse CRT isomorphism. In turn, this implies that the gadget decomposition is required to be exact, which has unfortunate consequences both in terms of computational costs and key sizes, that outweigh the benefits of using the CRT-based decomposition in the first place. In embodiments, an approximate (e.g., non-exact) CRT-based gadgetdecomposition is used. It combines the advantages of a non-exact decomposition withthose of a CRT-based decomposition. This leads for example to more efficient implementations in various use-cases, e.g., as detailed herein. In an embodiment, a modulus ^ is decomposed into a high part and a low part,which serve as a first basis for decomposition. Given two co-prime moduli ^^^^^ and^^^^, letting Q = ^^^^ ^^^^^, any value ^ modulo Q can be recovered from ^^^^: =^ mod ^^^^ and ^^^^^: = ^ mod ^^^^^ as^ = ^ + ^^^^ ⋅ ( ^^^^^ Q^^^ (^^^^^ − ^^^^) mod ^^^^^).We will also refer to ^^^^^ as ^^ or the second modulus; we will also refer to^^^^as ^^or the first modulus. Interestingly, we observe that ^(^ − ^^^^) / ^^^^^^^ℤ≡ Q^^^^^^^^^−^ ^ modul ∏ℓ ^^^ o ^^^^^. When ^^^^^ = ^^^^^is a product of pairwise co-prime integers,the exact CRT ga decomposition modulo of ^^^^ (^^^^^ − ^^^^) mod ^^^^yields (^ − ^^^^) / ^^^^. The exact CRT gadget decomposition of an integer ^ for asequence of ^^, … , ^ℓ are the remainders of ^ modulo each of the integers in the sequence.The remainders are chosen in a set of representatives; preferably, this is a set centered around 0. In turn, incorporating the multiplicative factor ^^^^into the gadget vectoryields, after reconstruction, (^ − ^^^^), which can be seen as an approximation of ^. Onecan for example define the gadget vector ^ as the one-dimensional vector of value^^^^^^(Q^^^ mod ^^^^^), and define the decomposition ∇^^ as the one-dimensional vectorof value ^^^^^ − (^ mod ^^^^)ℤ mod ^^^^^).Then, it can be checked that, modulo ^,^∇ ^^^^, ^^ = ^^^^(^^^^ mod mod ^^^^)ℤ mod ^^^^^)= ^^^^ ⋅ (^ ^^^^^ (^^^^^ − ^^^^) mod ^^^^^)= ^ − ^^^^ ≈ ^.The above description assumes that ^ = ℤ and ℳ = ℤ / ^ℤ. It howeverreadily adapts to more general ^-modules. For example, the example can be extended to polynomials, by applying it to the coefficients. Note that both parts, modulo ^^^^and modulo ^^^^^, can be further decomposed in a CRT fashion. This is useful for example is ^^^^^and / or ^^^^are large and / or the underlying architecture only supports working on smaller operands. Hence, the total size of the low part controls the precision of thedecomposition, whilst the size of the CRT moduli controls its quality, e.g., in turn, thenoise growth. Figure 2 schematically shows an example of an embodiment of a device 200for an approximate gadget decomposition of an integer. Shown in figure 2 is an input integer ^, 210. The input integer is modulo amodulus ^, 211. By choosing the modulus ^ sufficiently large, non-modulo computationcan be performed as well. For example, if two integers ^ and ^ are smaller than the squareroot of ^, their product may be computed modulo ^ while still giving the result of themultiplication; or an approximation thereof in case an approximate gadget decompositionaccording to an embodiment is use. It is not necessary to have the modulus Q explicitly.To reduce integer 210, modulus ^ is split into two smaller moduli: a firstmodulus ^^, 220 and a second modulus ^^, 230. The modulus ^, 211 is a product of thefirst modulus ^^ and the second modulus ^^. The first and second moduli are relativelyprime and larger than 1. It is not necessary to have the second modulus explicitly. At least for the second modulus ^^, a second sequence of integers is obtained.Two integers of the second sequence are indicated with reference numbers 231, and 232.There may be more than two integers in the second sequence, e.g., at least 3, at least 4, etc. The product of the integers of the second sequence equals the second modulus ^^. The integers of the second sequence are pairwise co-prime, and the integers are larger than 1. These integers could be taken as prime numbers, but it is important to note thatthere is no necessity to do so; in fact, often most or even all are composite. An advantageof using composite numbers is that integers can be chosen that are closer to a bound, e.g., imposed by the underlying machine, e.g., a word size. The approximate gadget decomposition 250 may be computed by computing a representative difference modulo each of the integers in the second sequencecorresponding to the second modulus ^^. The difference (^ − ^^), 241 is between theinput integer ^ and an integer 240 congruent to the input integer (^) modulo the firstmodulus (^^), (^^ ≡ ^ mod ^^).For example, one way to implement this is to first compute the difference(^ − ^^), say in the integers, or modulo ^, e.g., in the form of a representative modulo Q,and then compute the exact CRT gadget decomposition for the differences. Figure 2shows the elements of the approximate gadget decomposition at 250, of which elements251, and 252 are shown. For example, element 251 corresponds to modulus 231 and elements 252 to modulus 232. For example, the following may be used. Given input integer a, compute ^^=^ mod ^^, wherein the modulo operation selects a representative from a suitable. This setis preferably centered around zero; it could also be the integers from 0 upto ^^. Any otherset of representatives would also work, though the approximation may be worse. Nextcompute ^ − ^^ . This computation could be in the integers of mod ^. Finaly, exact CRTgadget decomposition may be used. That is, compute a representative for the differencefor each modulus in the sequence for ^^.Various variants may be used. For example, one may compute ^^=^ ^^^ ^^, and compute the CRT decomposition over the difference ^^ − ^^, this willgive the same result as ^ ≡ ^^ for each integer in the sequence for ^^, but it will allowthe difference to be smaller, which is beneficial in each of the following reductions in the CRT decomposition. It is noted that alternative embodiments can be obtained by multiplying the difference with a fixed number which is relatively prime to ^^^^^. The multiplication can be compensated for in the gadget vector. A particular choice for such a multiplication is to take ^^^^for this, as it would remove a multiplication from the gadget definition. Yet another alternative is to compute an exact CRT decomposition for ^ or^^, an exact CRT decomposition for ^^, and subtract the two vectors. This approach has the advantage of working only with small moduli. An embodiment may be applied to any object, e.g., mathematical object, datastructure, etc., in which integers need computation. In particular, polynomials and lists ofpolynomials may advantageously be converted to approximate CRT decomposition by applying an embodiment to each of their coefficients. For example, a convertedpolynomial may be stored internally as a list of lists, in which the former list representsthe coefficients and the latter the approximate CRT coefficients. Approximate CRT representation may be used with various coefficients, e.g., as in the examples below. In an embodiment, an exponent ^ is defined such that the first modulus ^^ andthe second modulus ^^are both smaller than two to the power of the exponent 2^, and both larger than two to the power of the exponent minus one 2^^^. This has the effect of keeping the two moduli close together in value. Furthermore, if t represents a bound within which integers can be efficiently represented, this is also more efficient while usinga large part of the available storage space. For example, the exponent may be at least 8,at least 16. For example, the exponent may be 17, 32, or 64.It may be preferred to have the first and second modulus close together, for example, a quotient of the larger of the first and second modulus by the smaller of the first and second modulus is between 1 and 2, e.g., between 1 and 1.1. It should be noted however that this is not necessary. The size of the first modulus may be used to control the accuracy of the approximation. A smaller firstmodulus and thus larger second modulus is more accurate, albeit at a large space andcompute cost. In an embodiment, the first and second modulus are both smaller than a machine word size, but the modulus ^) is larger than the machine word size. In an embodiment, the numbers in the second sequence are each smaller than a machine word size. In an embodiment, the numbers in the first and second sequence are each smaller than a machine word size. For example, in an embodiment, ^^is less than ^^, e.g., at most half ^^. The word size is the number of different values that can be stored in onemachine word. If the machine has machine word bit size t, we can store ^-bit values. Thesemay be values from 0 to 2^ − 1 or, what is typically done for signed integers between−2^^^ and 2^^^ − 1. In particular, for 8-bit primes, the largest prime we can support is251, either by considering that the bits represent values from 0 to 250, or between -125 and 125. We detail here the approximate CRT-Based gadget decomposition in the caseof algebraic integers ^ ∈ ℛ^, typically viewed as polynomials with integer coefficientsmodulo ^. Nevertheless, all the definitions and properties are also valid for integers ^ ∈ℤ / ^ℤ, or more generally for any ℤ / ^ℤ-module, as e.g., ℛ^-modules of rank ^ viewed asvectors of polynomials In a preferred embodiment, let ^ = ^^^^^ ⋅ ^^^^ with gcd(^^^^^, ^^^^) = 1,where the high part (resp. the low part) ^^^^^ = ∏ℓ ^^^ ^^ (resp. ^^^^ = ∏^ ^^^^′^) is aproduct of ℓ (resp. ^) pairwise co-prime integers ^ (resp. ^′^, … , ^′^)The definition of the gadget vector for approximate CRT decomposition maybe defined in terms of the gadget vector for exact CRT reconstruction, but omitting thecoefficients corresponding to divisors of ^^^^, e.g., where ^= ^^^^^^ ⋅ ^(^^^^^^^) mod ^^^ and The approximate CRT-based gadget decomposition of a polynomial ^ =tuple where, for 1 ≤ ^ ≤ ℓ, ^^ = ∑^^^^^^^^^^^for ^^^ ∈ ℤ / ^^ℤ defined by thecongruence mod ^ . (2) ^ Recall that the ^^^’s are typically represented as integers in [−⌊^^⌋, ⌊^^^⌋], andtheir computation indeed happens modulo ^^. Any other representation is also possible,in that case the bounds given below for quality ^ and precision ^ might be slightly worse.The above inner sum, indexed by ^ in equation (2), has no dependency in ^.Hence, for all divisors ^′^of ^^^^, the part modulo ^′^of each term can be computed beforehand by units working modulo ^′^. Then, these are disclosed at once to the units working modulo the ^^’s, where their inner product with the precomputed twisting ^^^ vectors (^^^^^ , … , ^^^^^^ ) mod ^^ is done directly modulo ^^.The gadget vector ^ and associated decomposition algorithm ∇^, asdescribed above, define a level-ℓ gadget decomposition on ℛ^ of quality ^ and precision^ given by the following bounds, for all ^ ∈ ℛ^: where the infinity norms are understood coefficient-wise. Below an example is given. Suppose ^ = 256 and modulus ^ is a 32-bitinteger, which is divided in ^′^ = 233, ^′^ = 239 for the low part (^^^^ = 55687) and^^ = 241, ^^ = 251 for the high part (^^^^^ = 60491); hence ^ = 3368562317 andℓ = 2. The corresponding gadget vector is^ = (1663315003,952860257) ∈ ℛ^^. ^ In equation (2), we have that ^(^^^^^^ ) mod is 39 for ^ = 1 (resp. −40 for ^ = 2). If the input polynomial ^ is^ = 1618033988 ^^ + 749894848 ^^ − 1322693974 ^+656381177 ,then (^ m ( )=od 241) +2 ⋅ 39^ mod 233 ℤ+8 ⋅ (−40^ mod 239)ℤ mod 241= 7 ^^ + 2 ^^ + 9 ^ − 111 ,(^ mod 251 ( )=) +12 ⋅ 39^ mod 233 ℤ+18 ⋅ (−40^ mod 239)ℤ mod 251= 92 ^^ + 68 ^^ + 43 ^ + 99. The corresponding approximate polynomial ^^: = ^∇^^, ^^ is equal to ^^ =1618041472 ^^ + 749881142 ^^ − 1322733311 ^ + 656382669, whose distancefrom ^ in infinity-norm (coefficients-wise) is^^ − ^^^^= ‖−7484 ^^ + 13706 ^^ + 39337 ^ − 1492‖^= 39337 55686.In a preferred embodiment, we have ^ = 1 (then ^^^^ = ^′^). This is ofparticular interest, since then equation (2) writes as simply as^^^ ≡ ^^ − (^^ mod ^^^^)ℤ mod ^^. (3) This yields a gadget decomposition of the same quality achieving precision^ =Note that in this particular case, no additional operation is needed by thearithmetic unit working modulo ^^ apart from receiving (^^ mod ^^^^).Suppose ^ = 32 and ℓ = 3. Select for example ^^ = 23, ^^ = 29, ^^ = 31,and ^^^^ = 2^^ + 1 (and thus ^ = 1355108549). The corresponding gadget vector is^ = (−471342104, −186911524,480844969) ∈ ℛ^^. If input polynomial ^ is^ = 314159265 ^^ + 358979323 ^^ − 508844211 ^ + 327950288 ,then The corresponding approximate polynomial = ^∇^^, ^^ is equal to ^^ =314184378 ^^ + 359011686 ^^ − 508829268 ^ + 327947148, whose distance from^ is^^ − ^^^^= ‖−25113 ^^ − 32363 ^^ − 14943 ^ + 3140‖^= 32363 ≤ 32768.Figure 3 schematically shows an example of an embodiment of a device 300for an approximate gadget decomposition of an integer. A device according to Figure 3 is similar to figure 2, e.g., as both can use similar means to obtain an input integer, transmit or otherwise use output numbers, e.g., decompositions, etc. Furthermore, both compute a representative for the difference modulo each of the integers in the secondsequence. However, the way in which the representatives are computed differs. Whereasin figure 2 some form of the difference is first computed, and then further computed upon to obtain the approximate CRT decomposition, in figure 3 this does not happen. As aresult, most or all of the computation can be done over small moduli which increasesparallelization, speed, and hardware requirements. Note however, that the error in the approximation can be slightly higher in embodiments according to figure 3 than those in which the difference is computed first. As in figure 2, device 300 obtains an input integer 310, ^. Furthermore, amodulus ^, 311, a first modulus 320, ^^ and a second modulus 330, ^^ are defined. Foreach of the two moduli a sequence of integers is provided. It is not necessary to have anyof the modulus ^, 311, a first modulus 320, ^^ and a second modulus 330, ^^ availableexplicitly. For the second modulus we have a sequence with integers 331-332, similar asin figure 2. The second sequence of integers for the second modulus ^^, wherein thesecond sequence has at least two integers, the product of the integers of the secondsequence equals the second modulus ^^, the integers of the second sequence being pairwise co-prime, and the integers are larger than 1. For the first modulus we have a sequence with integers 321-322, similar to the second sequence. The first sequence of integers for the first modulus ^^, wherein the firstsequence has at least one integer, the product of the integers of the first sequence equalsthe first modulus ^^, the first sequence of integers are pairwise co-prime, and the integersare larger than 1. The second sequence may have more than 2 integers, e.g., at least 3, etc.Note that we allow the first sequence to have only one integer. In this case, the product of the sequence is understood to be the one integer. In this case, the sequenceof integers equals the first modulus ^^ . This special case can be advantageous, as pointedout herein. The first sequence may have more than one integer, e.g., at least 2, at least 3,etc. Computing the approximate gadget decomposition may use equation (2)mentioned above. For each of the integers in the second sequence, e.g., integers 331, 332, aninteger is computed equal to the input integer 310, ^ modulo the integer. For example, arepresentative from a set of representatives may be selected. Accordingly, the inputinteger is reduced modulo each number in the second series. Only one integer 360 is shown in figure 3, but one will be computed for each integer in sequence 330. From the reduced input integer 360 an integer is subtracted that is congruent an integer (240) congruent to the input integer (^) modulo the first modulus (^^), (^^≡^ mod ^^). This computation is done modulo the same integer of the second sequence asfor which integer 360 was computed. The integer ^^ is from integer 360 in parts, one part for each integer in thefirst sequence. For each first specific integer in the first sequence the product 371 iscomputed modulo the second specific integer of -the first modulus (^^) divided by the first specific integer - the input integer (^) multiplied with the inverse of the first modulus(^^) divided by the first specific integer modulo the first specific integer ((^^ / ^′^^^)mod ^′^).The result of the subtractions is integer 341 which is then included in the decomposition 350. Shown are integers 351 and 352 corresponding to moduli 331 and 332. The product may be computed modulo the same integer in the second sequence that was also used to compute integer 360. Note only one integer 371 is shown, a sequence will be computed for each integer in the first sequence 321-322. One such sequence will be computed for each integer in the second series. The result is the subtraction is an element of the approximate gadget decomposition element for the particular integer in the second series. In an embodiment, this algorithm is implemented using a synchronizedparallel framework for operations, where the synchronization steps comprise exchangingvalues across the parallel arithmetic units. The approximate CRT-based gadgetdecomposition allows avoiding performing large operands arithmetic, which results in asimplified workflow, smaller circuit design and improved performances, with no impacton the keys size compared to the approximate radix-^ gadget decomposition introducedin [8]. The following pseudocode may be used to compute the approximate gadget decomposition. Input: integersLow, integersHigh, aQLow := product of integersLowdecomposition :=[]for qH in integersHigh: s:= a mod qHfor qL in integersLow: Qprime := QLow / / qL #can be precomputed Qprimei := Qprime^-1 mod qL #can be precomputed#Qprime = Qprime mod qH #can be precomputed (optional)t := (Qprimei*a) mod qL # can be precomputeds := (s - (Qprime * t)) mod qHdecomposition.append(s) return decomposition Note that, as indicated in the pseudocode some of the operations can be precomputed. Note also that some optional modulo reductions can be inserted to help keeping numbers small. They are fully optional. Figure 4a schematically shows an example of an embodiment of a device 400for computing a gadget vector. The construction of figure 4a reuses the exact gadgetvector for the exact CRT gadget decomposition. Figure 4b below details an alternative way to compute the gadget vector which is better, because it results in smaller integers. The gadget vector can be used to reconstruct the integer corresponding to an approximate gadget decomposition. After decomposing an integer and reconstructing using the gadget vector, an approximation of the original integer is still obtained. Note, this is not true for a conventional CRT gadget decomposition. If any of the coefficients in a conventional CRT gadget decomposition is lost, the reconstructed integer may be completely different from the original integer. A gadget vector computed using an embodiment according to figure 4a, may, e.g., be used with a decomposition according to figure 2 or figure 3. As with the decomposition, such as for example in figures 2 and 3, a modulus^, 411, a first modulus ^^ , 420, and a second modulus ^^, 430 are defined. It may beconvenient to have modulus ^ explicitly in a device, such as a device according to figure4a, but it is not necessary. For second modulus ^^, 430, a second sequence of integers431-432 is obtained. Since a sequence is available for the second modulus ^^ is notnecessary to have second modulus ^^, 430 itself explicitly available. The second sequence has at least two integers. The product of the second sequence equals the second modulus ^^, the second sequence of integers are pairwise co- prime, and the integers are larger than 1. To compute a gadget vector for approximate gadget decompositions relativeto the second sequence and the first modulus. First the CRT gadget vector 470 may becomputed, as it would be for an exact CRT decomposition relative only to the secondsequence. Two integers of gadget vector 470 are labelled 471 and 472 corresponding tomoduli 431, and 432, respectively. Formulas therefor are contained herein, and are alsogiven in the pseudo code below. Agadget vector 480 for the approximate gadget decomposition is obtained bymultiplying each of its elements with an integer 421. Two integers of gadget vector 480are labelled 481 and 482 corresponding to moduli 431, and 432, respectively. The integer 421 may be computed as the product of the first modulus ^^and a modular inverse of the first modulus modulo the second modulus ^^^^ mod ^^.Figure 4b schematically shows an example of an embodiment of a device 401for computing a gadget vector. Shown in figure 4b is the modulus ^, 411, a first modulus ^^, 420, and a second modulus ^^, 430. For the second modulus a second sequence of integers is available. Shown are integers 431 and 432 in the second sequence. For each value ^^in the second sequence a corresponding value in the gadget vector is computed. To compute the gadget vector element corresponding to element ^^, the following numbers are computed An integer 461 which is the second modulus ^^divided by the integer ^^, denoted by ^^^= ^^. This integer could also be computed by multiplying all integers in the second sequence except for integer ^^. Integer 461, ^^^is multiplied with first modulus ^^, 420 to obtain integer 451. The inverse of integer 451 modulo the integer ^^is shown at 452. Finally, the product of integers 451 and 452 is recorded as the element of thegadget vector 480. That is the element ^^ of the gadget vector is computed as: ^^ = In a preferred embodiment, these preferred embodiments are subject to variants. One possible alternative is to include the multiplicative factor modulo ^^(resp. ^^ ^^^ , (^^^^^^^)^^) directly in the definition of ^^^and to adapt the definition of ^^accordingly. More precisely, for example the gadget vector could be defined as ^′ =(^′^, … , ^′ℓ) wheremod ^^^ℤ, where, for 1 ≤ ^ ≤ ℓ, ^′^ = ∑^^^ ^^^^′^^^^whose coefficients ^′^^viewed as small integers satisfy the congruence ^′ ^^^ ≡ ^ ^^^^ ⋅ ^^^ mod ^^,where ^^^is defined in equation (2). Element 452 is optional and may be omitted. Element 452 may be replaced with other values. For example, the gadget vector may be computed by any of the formulas below mod ^^^ℤmod ^^^ℤmod ^^^ℤ^^ = ^^^^^A corresponding factor may be added to the decomposition computation. For example, these algorithms may be used as follows. One or more integers may be transformed into their approximate gadget decomposition, e.g., using an embodiment such as those of figures 2 or 3. Operations may be performed component wise on the decomposed numbers, e.g., they may be added, multiplied, etc. An operation result may be transformed back to the integers, e.g., the integers module ^, by computer the dot product of the gadget representation and the gadget vector. The approximate gadget decomposition is not exact. After decomposing and reconstructing there may be an error. The size of the error depends on the size of the first modulus—a smaller first modulus allows smaller errors—and on the exact choices made in implementing the algorithms. For example, implementing the modulo operations sothat they map to a set of representatives centered around zero leads to smaller errors. Analgorithm according to figure 3 may lead to larger errors, though with the advantage that computations can be performed modulo smaller moduli. For example, in an embodiment, using centered representatives and an embodiment according to figure 2 an error between the reconstructed approximation and the original integer is at most half the first modulus (^^). Using non-negative representatives smaller than the modulus doubles the possible error. Using an implementation according to figure 3 may multiply the error by a factor equal to the number of integers in the first sequence, though in practice this error is typically smaller. In an embodiment, the approximate gadget decomposition is used in fullyhomomorphic encrypted multiplication. In an embodiment, the FHE scheme is latticebased, as many FHE schemes are, e.g., basing their security on the learning with errors problem or variants thereof. In the FHE scheme ciphertexts are noisy. The problem is that the noise present in the ciphertexts tends to grow when noisy ciphertexts are homomorphically processed. If the noise grows above a certain threshold, ciphertexts can no longer be decrypted. There are basically two ways to address this problem: (i)bootstrapping ciphertexts and (ii) controlling the noise growth in ciphertexts. Theapproach of bootstrapping was introduced in Gentry’s seminal work in 2009. It compriseshomomorphically evaluating the decryption circuit on input an encryption of a ciphertext and of the decryption key, yielding another ciphertext that encrypts the same plaintext—this is also known as recryption. Since the decryption removes noise, the noise in abootstrapped ciphertext is reset to a nominal level; the output ciphertext only contains the noise resulting from the bootstrapping process. A complementary approach for dealing with the noise is to ensure that the noise does not grow too quickly so that a larger number of homomorphic operations can be performed before the need of bootstrapping. One approach to do so, is to use a gadget decomposition. For example, let Enc denote a homomorphic encryption scheme. Suppose weneed to evaluate ^ ← ^ ⋅ Enc(^) for some scalar ^ and ciphertext Enc(^). Instead ofcomputing ^ ← ^ ⋅ Enc(^) directly, which would affect the noise by a factor proportionalto ^, let (^^, … , ^^) by the approximate gadget decomposition of the k according to anembodiment with respect to a second sequence of integers (^^, … , ^^) for a secondmodulus (^^). Let the corresponding gadget vector be (^^, … , ^^). Obtain ciphertextsEnc(^^^) for all 1 ≤ ^ ≤ ^, that represent integer ^ in encrypted approximated gadgetformat. We can represent ciphertext ^, that is the encryption of ^^ as a sequence of values^^Enc(^^^) = Enc(^). Observe that∑^^^^ ^^ ⋅ Enc(^^ ^) = Enc(^).This second approach is more advantageous regarding noise propagation asthe noise in ciphertexts is now multiplied by smaller values—observe that |^^| ≪ |^|.Oneway to obtain the initial ciphertexts Enc(^^^), is to receive them from the client. Forexample, a client having input data x, may encrypt the input data to obtain Enc(^^^) forall it, and send all these values the computation server. At the computation server the FHEcomputations are performed, say, a neural network is evaluated on input ^, a neuralnetwork is trained for training data ^, etc. Note that if needed, an integer represented as asequence Enc(^^^), can be converted to Enc(^) homomorphically if needed.Once a gadget decomposition ∇: = ∇^,^ ^ has been fixed for a certain gadgetvector ^ = (ℊ^, … , ∈ ℛℓ^ , it induces an associated leveled encryption of a message^ ∈ ℛ, as^^^^ ^ ^ and its GGSW expansion ^^^^ (^) = (^^^^^(−^^ ^ ^^ ^ ⋅ ^), … , ^^^^^(−^^ ⋅ ^), ^^^^^(^)). This allows defining certain homomorphic operations. These operations do not depend, formula-wise, on the particular gadget decomposition. Only their noise analysismay differ, depending on ℓ, ^, ^ and on the distribution of ∇(⋅).Scalar product. The gadget decomposition gives rise to the definition of a scalarproduct: In particular, if the polynomial vector ^ is the gadget vector, we have ^ ⊙ ^ ≈ ^.Typically, this is extended to compute the product of a known element ^ ∈ ℛ^ with anencryption of a message ^ to get an encryption of ^ ⋅ ^. Letting ∇^= (^^, … , ^ℓ), it canbe seen that^ ⊙ ^^^^^ ^ ^ ^^^^^(^)^ =^^^^^(^ ⋅ ^).In this way one gets ^^^^ ^ ^(^ ⋅ ^) as an output by evaluating ((^ ⋅ ℊ^) ⊙^^^^ ^ ^(^))^^^^ℓ. External product The external product allows computing the GLWE encryption of the product of two encrypted messages, as ^^^^^(^^). The result is a GLWE encryption of ^^ ⋅ ^^ if message ^^ is small sothat ‖ℯ ⋅ ^^‖^ ≈ ‖ℯ‖^. The external product is asymmetric in the sense that one of itsoperand is a GLWE ciphertext whereas the other is a GGSW ciphertext with (^ + 1)ℓcomponents. Embodiments as set out herein are useful in a variety of ways. As an example, some are discussed below. For example, we consider use-cases where a machine word is too small for accommodating the arithmetic on large operands. For instance, this mayarise in the following two cases:1. in the software case, when ciphertexts are given modulo an integer ^ that is largerthan the machine word size, e.g., 64 or 32 bits;2. in the hardware case, wherein multipliers have a restricted size, e.g., 17 bits; seee.g.,

[0016] . In both cases, the above-mentioned operations involve multiplications of elements that comprise multiple machine words. This results additional computational cost, as well as an increased circuit size. Using an embodiment these costs can be reduced. The approximate CRT-based gadget decomposition may be used to computethe homomorphic scalar product between a scalar and a ciphertext. For example, theciphertext may be leveled associated to the gadget vector definition. Leveled encryptionrefers to an encryption where the input being encrypted is multiplied by the componentsof the gadget vector; see. e.g., Section 2 in

[0014] for the case of ring LWE encryption. Theapproximate gadget decomposition according to an embodiment may be used as the gadget decomposition building block for homomorphic operations and routines in FHEschemes, see, e.g., [5, 13, 4, 11, 1, 10, 7, 8, 3]. For instance, it allows defining an externalproduct, as in [8, 12], between an encrypted value and a leveled ciphertext, which is a critical operation repeated many times during bootstrapping in certain FHE schemes, like e.g., TFHE, FINAL or FHEW. As an example, we detail the modus operandi for the Blind Rotation which is at the heart of the programmable bootstrapping; the same techniques apply readily for e.g., the Key Switch . We also present two concrete applications: for machine learning on encrypted data and in the context of blockchain applications for homomorphic threshold decryption. Blind rotation. The gadget decomposition is a central operation used FHEschemes, e.g., in TFHE and the likes, e.g., for blind rotation. As such, the proposed methods apply to the blind rotation using the advantageous approximate decomposition. Homomorphic Machine Learning. A critical operation for machine learningon encrypted data consists in computing homomorphically weighted sums of the form ∑^^^^ ^^ ⋅ ^^. Each term of this sum involves a scalar product between a weight ^^and a ciphertext ^^, involving as many gadget decompositions. Those operations are to beaccelerated on dedicated, massively parallel, hardware such as GPUs, FPGAs, or ASICs.These architectures might have quite small arithmetic units. For example, FPGAs typically contain multipliers ranging from 17 bits to 23 bits, depending on themodel. On the other hand, GPUs may take advantage of performing vectorized operationson several 16 bits or 32 bits operands on parallel threads, e.g., as many as for a 2000 ormore. An approximate CRT-based gadget decomposition allows taking full advantage ofthe computational characteristics of these hardwares. Moreover, using the approximateCRT-based gadget decomposition these multiplications and other operations areparallelizable. Threshold decryption for TFHE. In the context of threshold decryption for FHE, and in particular for blockchain applications, one way to avoid leaking the shared secret key through the noise to the parties is to inject some additional noise into the secretshares, a technique which is called noise flooding. For TFHE, where the ciphertextmodulus is usually relatively small (say, 64 bits or less) to enhance performance, this technique is not directly applicable as the noise gap is too small to preserve the message from being destroyed during the noise flooding operation. Therefore, a technique called Switch-n-Squash was proposed in [9], that embeds ciphertexts into larger parameters during a bootstrapping operation; thereafter the regular noise flooding operation can be safely applied. As a consequence, costly bootstrapping operations, involving the NumberTheoretic Transforms, or more generally polynomial multiplications, have to be computed on larger integers, e.g., 128 bits, as suggested in [9]. In practice, optimized code for these sizes is not readily available off the shelf and moving beyond the frontier of asingle machine word incurs a noticeable computational overhead. Using the approximateCRT-based gadget decomposition makes it possible to reuse code that is optimized for64-bit words for the extended ciphertext moduli featured in [9]. This can be done inparallel, with no additional overhead apart from the synchronization step computing the gadget decomposition. References [1] Jacob Alperin-Sheriff and Chris Peikert. Faster bootstrapping withpolynomial error. In J. A. Garay and R. Gennaro, editors, Advances in Cryptology –CRYPTO 2014, Part I, volume 8616 of Lecture Notes in Computer Science, pages 297–314. Springer, 2014. [2] Guillaume Bonnoron, Léo Ducas, and Max Fillinger. Large FHE gatesfrom tensored homomorphic accumulator. In Progress in Cryptology — AFRICACRYPT2018, volume 10831 of Lecture Notes in Computer Science, pages 217–251. Springer, Cham, 2018. [3] Charlotte Bonte, Ilia Iliashenko, Jeongeun Park, Hilder V. L. Pereira, and Nigel P. Smart. FINAL: Faster FHE instantiated with NTRU and LWE. In Advances inCryptology — ASIACRYPT 2021, volume 13792 of Lecture Notes in Computer Science,pages 188–215. Springer, 2021. [4] Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan. (Leveled) fully homomorphic encryption without bootstrapping. ACM Transactions on Computation Theory, 6(3):13:1–13:36, 2014. Earlier version in ITCS 2012. [5] Zvika Brakerski and Vinod Vaikuntanathan. Efficient fully homomorphic encryption from (standard) LWE. SIAM Journal on Computing, 43(2):831–871, 2014. [6] Zvika Brakerski. Fully homomorphic encryption without modulusswitching from classical GapSVP. In R. Safavi-Naini and R. Canetti, editors, Advancesin Cryptology – CRYPTO 2012, volume 7417 of Lecture Notes in Computer Science,pages 868–886. Springer, 2012. [7] Jung Hee Cheon, Andrey Kim, Miran Kim, and Yongsoo Song. Homomorphic encryption for arithmetic of approximate numbers. In T. Takagi and T.Peyrin, editors, Advances in Cryptology – ASIACRYPT 2017, volume 10624 of LectureNotes in Computer Science, pages 409–437. Springer, 2017. [8] Ilaria Chilotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachène. TFHE: Fast fully homomorphic encryption over the torus. Journal of Cryptology, 33:34– 91, 2020. [9] Morten Dahl, Daniel Demmler, Sarah El Kazdady, Arthur Meyre, Jean- Baptiste Orfila, Dragor Rotaru, Nigel P. Smart, Samuel Tap, and Michael Walter. Noah’sArk: Efficient Threshold-FHE using noise flooding. In WAHC’23: Proceedings of the11th Workshop on Encrypted Computing & Applized Homomorphic Cryptography, pages 35–46. ACM, New York, 2023.

[0010] Léo Ducas and Daniele Micciancio. FHEW: Bootstrapping homomorphic encryption in less than a second. In E. Oswald and M. Fischlin, editors,Advances in Cryptology – EUROCRYPT 2015, Part I, volume 9056 of Lecture Notes inComputer Science, pages 617–640. Springer, 2015.

[0011] Craig Gentry, Amit Sahai, and Brent Waters. Homomorphic encryption from learning with errors: Conceptually-simpler, asymptotically-faster, attribute-based.In R. Canetti and J. A. Garay, editors, Advances in Cryptology – CRYPTO 2013, Part I,volume 8042 of Lecture Notes in Computer Science, pages 75–92. Springer, 2013.

[0012] Shai Halevi, Tzipora Halevi, Victor Shoup, and Noah Stephens-Davidowitz. Implementing BP-obfuscation using graph-induced encoding. In CCS ’17:Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pages 783–798. ACM, 2017.

[0013] Daniele Micciancio and Chris Peikert. Trapdoors for lattices: Simpler,tighter, faster, smaller. In Advances in Cryptology — EUROCRYPT 2012, volume 7237of Lecture Notes in Computer Science, pages 700–718. Springer, Berlin, Heidelberg,2012.

[0014] Daniele Micciancio and Yuriy Polyakov. Bootstrapping in FHEW-likecryptosys- tems. In 9th Workshop on Encrypted Computing & Applied HomomorphicCryptography (WAHC 2021), pages 17–28. ACM Press, 2021.

[15] Dingyi Pei, Arto Salomaa, and Cunsheng Ding. Chinese RemainderTheorem: Applications in Computing, Coding, Cryptography. World ScientificPublishing Company, 1996.

[16] Xilinx. UltraScale architecture DSP slice. User Guide, v1.11, August2021. Below several further optional refinements, details, and embodiments are illustrated. Using the conventional CRT gadget decomposition, any ^ ∈ ℛ^ may beexpressed exactly = ^∇^^, ^^ mod ^. However, some applications only require anapproximate expression ^^ for ^, provided that ^^ satisfies ^^ − ^^^^≤ ^ for some givenbound ^. A typical example is when a ciphertext is gadget-decomposed. The lower part contains noise; a full gadget decomposition boils down at some point to uselesslydecompose noise. We illustrate this in the case of LWE ciphertexts for simplicity but thesame carries over e.g., RLWE ciphertexts or other types of ciphertexts. Consider an LWE-type ciphertext ⌊^ / ^⌉^ encodes message ^ ∈ ℤ / ^ℤ, ^ ∈ {0,1}^ is the secret key, and noise ^ ∈ ℤ issampled according to normal distribution ^(0, ^^). The phase and error functions of ^are respectively defined by ^^(^) = ^ − ^^, ^^ mod ^ and Err(^) = (^^(^) − ^)ℤ.Let mod ^ = (^, ^^). Noting that^^(^^) ≡ ^^(^^ − ^) + ^^(^) ≡ ^^ − ^ − ^^ − ^, ^^ + ^^(^)≡ ^ − ^^, ^^ + ^^(^) (mod ^)for some variables ^ ∈ ([−^, ^])^ and ^ ∈ ([−^, ^] and assuming that ^ and^ are uniformly distributed, the variance of the noise error in the recomposed ciphertext^^ verifies As a result, if the bound ^ on the approximation error ^^^ − ^^^ is forexample set such that ^ ≤ ^^3 / (^ + 2) then Var(Err(^^)) ≤ 2^^; i.e., the impact on thenoise error is very low. Regarding the performance, however, the impact can besubstantially positive. Application to the Blind Rotation. The blind rotation is the costliest part of the (programmable) bootstrapping phase of TFHE-like schemes. Starting from a noisyLWE ciphertext, it consists in essence in applying iteratively an encrypted CMuxoperation on an accumulator with the help of so-called bootstrapping keys, that areconcretely extended encryptions of the components of the initial LWE key.Below, for illustration purposes, we specialize to the case where LWE keysare binary and to 2^-th cyclotomic rings of the form ℛ ≅ ℤ[^] / ^^^ + 1^. As the gadgetdecomposition is a low-level primitive, our new approximate CRT-based gadgetdecomposition also applies to broader settings, as other key distributions, e.g., ternary,other rings ℛ, e.g., ^-th cyclotomic rings where ^ is a prime or is of the form 2^ ⋅ 3^, orℛ-modules of rank greater than 1. GINX Blind Rotation. Let ^ be the ciphertext modulus, let ℛ^ = ℛ / ^ℛ ≅(ℤ / ^ℤ)[^] / ^^^ + 1^ be the 2^-th cyclotomic ring modulo ^ and let ^ be the plaintextmodulus. The Blind Rotation starts from an LWE encryption of dimension ^ of anencoding of ^ ∈ ℤ / ^ℤ, will do a uniformization later i.e., from where the noise ^ follows a sufficiently large Gaussian distribution and thekey ^ is supposed to be binary, i.e., ^ = (^^, … , ^^) ∈ {0,1}^. In particular, we considerthat the Modulus Switching from ^ to 2^ has previously been done.Bootstrapping keys. Suppose a gadget decomposition ∇:^∇^ of level ^ hasbeen fixed relatively to a gadget vector ^ = (ℊ ^^, … , ∈ ℛ^ . The encrypted CMuxoperations are enabled by RGSW encryptions associated to ^ of the bits of ^ under a key^ ∈ ℛ^. More precisely, the bootstrapping keys associated to ^ are hence defined, for ^ ∈[1, ^], bybsk[^] = ^^^^^(^^) = [{^^^^^(ℊ^ ⋅ ^^)}^∈[^,^], {^^^^^(ℊ^^ ⋅^^)}^∈[^,^]]. We will refer with bsk[^]^ (resp. bsk[^]^) to the leveled encryption of ^^ (resp.^^^), i.e., to the first (resp. second) part of bsk[^]. Further, each leveled part is also indexedby ^, so that e.g., bsk[^] refers Test polynomial. The programmability of GINX bootstrapping comes fromthe so-called test polynomial. Suppose for simplicity that ^ is even. For any ^: = ℤ / ^ℤ → the test polynomial can be defined as It is known that solutions exist to adapt the method when function ^ does notsatisfy above negacyclicity property.For our purpose, it is sufficient to know that a suitable ^ ∈ ℛ^ encoding ^ isgiven and that the Blind Rotation eventually computes an RLWE encryption of ^ ⋅^^⌊^^ / ^⌉^^^, with nominal noise, from the LWE encryption of ^. In particular, if ^ is nottoo large, the constant coefficient of the output contains an encryption of ^(^). Encrypted CMuxes. The core operation in the loop of the Blind Rotation isthe encrypted CMux gate, which starts from a RLWE encryption ^ of some andoutputs a RLWE encryption ^′ of ^^^^^ ⋅ ^. Concretely, this is achieved by computing^′ ← ^ + ((^^^ − 1) ⋅ ^) ⊛ ^^^^^(^^),noting that ^^^^^ ⋅ ^ is equal to ^ if ^ ^^ = 0, and to ^ ^ ⋅ ^ if ^^ = 1.This works in particular because the multiplication of ^ by ^^^ is actually anegacyclic permutation of the coefficients of ^ that does not induce any noise growth. Computing the Blind Rotation loop At very high level, the Blind Rotation starts from a trivial noiseless RLWEencryption ^^^ = (0, ^ ⋅ ^^^) ∈ ℛ^^ , and then sequentially applies ^ times the above-defined CMux gateFunction GINX Blind Rotation with binary keys (high level)^^ Require: ^^^^(⌊ ^⌉^) = (^, ^ = ^^, ^^ + ⌊^^ ^⌉^ + ^), bootstrapping keys bsk[1 … ^].Ensure: A ciphertext in ^^^^^(^ ⋅ ^^⌊^^ / ^⌉^^^) For 1 ≤ ^ ≤ ^^^^ ← ^^^ + ((^^^ − 1) ⋅ ^^^) ⊛ bsk[^]End For Return ^^^ The external product ⊛ can be decomposed in two parts:1. a gadget decomposition ∇^, applied to both mask and body of Acc , andcorresponding to the given bootstrapping keys, returning a vector of ^ degree-^ (small)polynomials; 2. for each of the two resulting vectors of polynomials, an inner product with the body and mask of the appropriate leveled component of the bootstrapping key. For all currently known gadget decompositions, the former must beperformed in the coefficient domain, whereas the multiplication of degree-^ polynomials,where ^ is relatively big, requires working in the Fourier or NTT domain. Hence, the vastmajority of the computational cost of the Blind Rotation is actually devoted to performseveral forward and backward NTTs modulo the ciphertext modulus ^, at each loop iteration. Figure 5 schematically shows an example of an embodiment of a method 500for an approximate gadget decomposition of an integer, a method 510 for computing agadget vector, a method 520 for reconstructing an approximation of an integer from an approximate gadget decomposition of the integer. Method 500 may be computer-implemented, including microprocessor, ASIC or FPGA implemented. Method 510 may be computer-implemented, including microprocessor, ASIC or FPGA implemented. Method 520 may be computer-implemented, including microprocessor, ASIC or FPGA implemented. Method 500 comprises -obtaining (501) an input integer (^, 210) modulo a modulus (^, 211),- obtaining (502) a first modulus (^^ , 220) and a second modulus (^^, 230),wherein the modulus (^) is a product of the first modulus (^^) and the second modulus (^^), the first and second moduli being relatively prime and larger than 1, -obtaining (503) a second sequence of integers (231, 232) for the secondmodulus (^^), wherein the second sequence has at least two integers, the product of theintegers of the second sequence equals the second modulus (^^), the integers of the second sequence being pairwise co-prime, and the integers are larger than 1, -computing (504) the approximate gadget decomposition by computing arepresentative for a difference modulo each of the integers in the second sequencecorresponding to the second modulus (^^), wherein the difference (^ − ^^ , 241) isbetween the input integer (^) and an integer (240) congruent to the input integer (^)modulo the first modulus (^^), (^^ ≡ ^ mod ^^). Instead of ^ − ^^, a multiple thereofmay be used, e.g., ^(^ − ^^), for some ^ ≠ 0. Typically ^^ is represented in a canonicalset of representatives, e.g., centered around zero, non-negative, etc. Method 510 comprises- obtaining (511) a first modulus (^^ , 420) and a second modulus (^^, 430),wherein the modulus (^) is a product of the first modulus (^^) and the second modulus (^^), the first and second moduli being relatively prime and larger than 1,- obtaining (512) a second sequence of integers for the second modulus (^^,431, 432), wherein the second sequence has at least two integers, the product of the second sequence equals the second modulus (^^), the second sequence of integers are pairwise co-prime, and the integers are larger than 1,- computing (513) the sequence (^^ = ^^^^^ ⋅^^ ^^^= ^^ ^ ^^ ^^ )( ^′^ = ^^^^ ⋅ ^ ^^ mod ^^^ℤ ) (^^ = ^^^^), bymultiplying for each integer (^^) in the second sequence: -the second modulus (^^) divided by the integer (^^) (^^^^^ =^^), -the first modulus (^^). Method 520 comprises -obtaining (521) an approximate gadget decomposition of the integercomputed according to an embodiment, -obtaining (522) a corresponding gadget vector computed according to anembodiment, -computing (523) the dot product of the obtained approximate gadgetdecomposition and the corresponding gadget vector. Many different ways of executing the method are possible, as will be apparent to a person skilled in the art. For example, the order of the steps can be performed in theshown order, but the order of the steps can be varied, or some steps may be executed inparallel. Moreover, in between steps other method steps may be inserted. The inserted steps may represent refinements of the method such as described herein or may beunrelated to the method. For example, some steps may be executed, at least partially, inparallel. Moreover, a given step may not have finished completely before a next step is started. Embodiments of the method may be executed using software, which comprises instructions for causing a processor system to perform an embodiment of method 500, 510, and / or 520. Software may only include those steps taken by a particular sub-entity of the system. The software may be stored in a suitable storage medium, such as a hard disk, a floppy, a memory, an optical disc, etc. The software may be sent as a signal along a wire, or wireless, or using a data network, e.g., the Internet. The software may be made available for download and / or for remote usage on a server. Embodiments of the method may be executed using a bitstream arranged to configure programmable logic, e.g., a field-programmable gate array (FPGA), to perform an embodiment of the method. The following clauses represent contemplated embodiments.Clause 1. A cryptographic method (500) for an approximate gadget decomposition of aninteger, comprising- obtaining (501) an input integer (^, 210) modulo a modulus (^, 211),- obtaining (502) a first modulus (^^ , 220) and a second modulus (^^, 230),wherein the modulus (^) is a product of the first modulus (^^) and the second modulus (^^), the first and second moduli being relatively prime and larger than 1,- obtaining (503) a second sequence of integers (231, 232) for the secondmodulus (^^), wherein the second sequence has at least two integers, the product of theintegers of the second sequence equals the second modulus (^^), the integers of the second sequence being pairwise co-prime, and the integers are larger than 1,- computing (504) the approximate gadget decomposition by computing arepresentative for a difference modulo each of the integers in the second sequencecorresponding to the second modulus (^^), wherein the difference (^ − ^^ , 241) isbetween the input integer (^) and an integer (240) congruent to the input integer (^)modulo the first modulus (^^), (^^ ≡ ^ mod ^^), or a multiple thereof.Clause 2. A method for an approximate gadget decomposition of an integer as in Clause1, comprising reducing the input integer (^) modulo the first modulus (^^) to obtain the integer congruent to the input integer (^) modulo the first modulus (^^).Clause 3. A method for an approximate gadget decomposition (350) of an integer (310)as in Clause 1,- obtaining a first sequence of integers (321, 322) for the first modulus (^^ ,320), wherein the sequence has at least one integer, the product of the integers of the first sequence equals the first modulus (^^), the integers of the first sequence are pairwise co-prime, and the integers are larger than 1, wherein computing the difference modulo eachof the integers in the second sequence comprises for a second specific integer in thesecond sequence (^ − ∑^^^^^^^^^ ⋅ ^(^^^^^)^^ ⋅ ^ mod ^′^^ mod ^^)ℤ- computing an integer (^ mod ^^, 360) equal to the input integer (^)modulo the second specific integer - subtracting therefrom for each first specific integer in the firstsequence the product (371) modulo the second specific integer of -the first modulus (^^) divided by the first specific integer -the input integer (^) multiplied with the inverse of the first modulus(^^) divided by the first specific integer modulo the first specific integer ((^^^^ / ^′^)mod ^′^). Clause 4. A method as in Clause 3, wherein- an exponent (^) is defined such that the integers in the second sequenceand the first sequence are all larger than two to the power of the exponent (2^), wherein the exponent is 4, 8, 16, 17, or 32, and / or- an exponent (^) is defined such that the integers in the second sequenceand the first sequence are all smaller than two to the power of the exponent (2^), wherein the exponent is 8, 16, 17, 23, 32, or 64, and / or- the integers in the second sequence and the first sequence are smaller thana machine word size, and / or- the second sequence of integers comprises at least three integers, e.g., atleast 4 integers.Clause 5. A method as in any one of the preceding clauses, wherein computing (504) the approximate gadget decomposition by computing a representative for a difference modulo each of the integers in the second sequence corresponding to the second modulus(^^^), wherein the difference (^ − ^^ , 241) is between the input integer (^) and aninteger (240) congruent to the input integer (^) modulo the first modulus (^^), (^^≡^ mod ^^).Clause 6. A method as in any one of the preceding clauses, comprising- obtaining an input polynomial having integer coefficients modulo themodulus (^), wherein the coefficients of the input polynomial are represented in the approximate gadget decomposition according to any one of the preceding clauses.Clause 7. A cryptographic method (510) for computing a gadget vector for use with anapproximate gadget decomposition of an integer according to any one of Clauses 1-6,- obtaining (511) a first modulus (^^ , 420) and a second modulus (^^, 430),wherein the modulus (^) is a product of the first modulus (^^) and the second modulus (^^), the first and second moduli being relatively prime and larger than 1,- obtaining (512) a second sequence of integers for the second modulus (^^,431, 432), wherein the second sequence has at least two integers, the product of the second sequence equals the second modulus (^^), the second sequence of integers are pairwise co-prime, and the integers are larger than 1,- computing (513) the sequence (^^ = ^^^^^ ⋅ mod ^^^^^ℤ ; ^^^= ^^ )( ^′^ = ^^^^^ ⋅ ^ ^^ ^^^ mod ^^^ℤ ) (^^ = ^^^^^), bymultiplying for each integer (^^) in the second sequence: -the second modulus (^^) divided by the integer (^^) (^^^ = -the first modulus (^^).Clause 8. A method as in Clause 7, wherein each element in the CRT gadget vector isfurther multiplied with the inverse modulo the integer (^^) of one of:- the first modulus ^^ times the second modulus (^^) divided by the integer - the second modulus (^^) divided by the integer (^^) (^^^ = - the first modulus ^^ ((^^)^^).Clause 9. A cryptographic method (520) for reconstructing an approximation of an integerfrom an approximate gadget decomposition of the integer,- obtaining (521) an approximate gadget decomposition of the integercomputed according to any one of Clauses 1-6,- obtaining (522) a corresponding gadget vector computed according toClause 7 or 8,- computing (523) the dot product of the obtained approximate gadgetdecomposition and the corresponding gadget vector.Clause 10. A method as in Clause 9, wherein- integers in the approximate gadget decomposition of an integer are, up totheir signs, at most half a corresponding integer in the second sequence of integers, andwherein an error between the reconstructed approximation and the integer is at most half the first modulus (^^), or- integers in the approximate gadget decomposition of an integer smallerthan a corresponding integer in the second sequence of integers, and wherein an error between the reconstructed approximation and the integer is smaller than the first modulus (^^), or- integers in the approximate gadget decomposition of an integer are, up totheir signs, at most half a corresponding integer in the second sequence of integers, and wherein an error between the reconstructed approximation and the integer is at most half the first modulus (^^) times the number of integers in a first sequence of integers for the first modulus (^^), or- integers in the approximate gadget decomposition of an integer smallerthan a corresponding integer in the second sequence of integers, and wherein an error between the reconstructed approximation and the integer is smaller than the first modulus times the number of integers in a first sequence of integers for the first modulus (^^).Clause 11. A cryptographic method for a fully homomorphic encrypted computationcomprising- a multiplication between an unencrypted first integer (^) and an FHEencrypted second integer (^), wherein the first integer is represented in the approximate gadget decomposition according to any one of Clauses 1-6, and the second integer encrypted according to the FHE.Clause 12. A method as in any one of the preceding clauses, comprising- obtaining an approximate gadget decomposition of a first integer(^^, … , according to any one of Clauses 1-6 with respect to the second sequence ofintegers (^^, … , ^^) for the second modulus (^^),- obtaining an FHE encrypted second integer (^), wherein the FHEencrypted second integer is obtained from- component wise FHE encryption of a component wisemultiplication between the second integer (^) and a gadget vector (^^, ^^, ...) for thesecond sequence of integers (Enc(^^^)),- for each of the values in the approximate gadget decomposition of the firstinteger, multiply the value with the corresponding encryption of the value for the secondinteger (^^ ⋅ Enc(^^^)), obtaining the result as an FHE encrypted integer, thus obtaininga multiplication result as an encrypted approximate gadget decomposition. Clause 13. A method as in any one of the preceding clauses, comprising computing an FHE encrypted blind rotation using integers represented according to the approximate gadget representation of any one of Clauses 1-6.Clause 14. A system comprising: one or more processors; and one or more storage devicesstoring instructions that, when executed by the one or more processors, cause the one or more processors to perform operations for- A method for an approximate gadget decomposition of an integeraccording to any one of Clauses 1-6, and / or- A method for computing a gadget vector for use with an approximategadget decomposition of an integer according to Clause 7 or 8, and / or- A method for reconstructing an approximation of an integer from anapproximate gadget decomposition of the integer according to Clause 9, and / or- A fully homomorphic encrypted computation according to any one ofClauses 11-13.Clause 15. A system as in Clause 14,- wherein one or more of the processors are an Application-SpecificIntegrated Circuit (ASIC), and / or- wherein one or more of the processors are a Field-Programmable GateArray (FPGA).Clause 16. An ASIC and / or FPGA configured to execute the method according to anyone of Clauses 1-13.Clause 17. A transitory or non-transitory computer storage medium encoded withinstructions that, when executed by one or more computers, cause the one or more computers to perform- A method for computing a gadget vector for use with an approximategadget decomposition of an integer according to any one of Clauses 1-6, and / or- A method for an approximate gadget decomposition of an integeraccording to Clause 7 or 8, and / or- A method for reconstructing an approximation of an integer from anapproximate gadget decomposition of the integer according to Clause 9, and / or- A fully homomorphic encrypted computation according to any one ofClauses 11-13. It will be appreciated that the presently disclosed subject matter also extends to computer programs, particularly computer programs on or in a carrier, adapted for putting the presently disclosed subject matter into practice. The program may be in the form of source code, object code, a code intermediate source, and object code such as partially compiled form, or in any other form suitable for use in the implementation of an embodiment of the method. An embodiment relating to a computer program product comprises computer executable instructions corresponding to each of the processing steps of at least one of the methods set forth. These instructions may be subdivided into subroutines and / or be stored in one or more files that may be linked statically or dynamically. Another embodiment relating to a computer program product comprisescomputer executable instructions corresponding to each of the devices, units and / or partsof at least one of the systems and / or products set forth. Figure 6a shows a computer readable medium 1000 having a writable part1010, and a computer readable medium 1001 also having a writable part. Computer readable medium 1000 is shown in the form of an optically readable medium. Computer readable medium 1001 is shown in the form of an electronic memory, in this case a memory card. Computer readable medium 1000 and 1001 may store data 1020 wherein the data may indicate instructions, which when executed by a processor system, cause a processor system to perform an embodiment of a method for an approximate gadget decomposition of an integer, a method for computing a gadget vector, and / or a method for reconstructing an approximation of an integer from an approximate gadget decomposition of the integer, according to an embodiment. The computer program 1020 may be embodied on the computer readable medium 1000 as physical marks or by magnetization of the computer readable medium 1000. However, any other suitable embodiment is conceivable as well. Furthermore, it will be appreciated that, although the computer readable medium 1000 is shown here as an optical disc, the computer readable medium 1000 may be any suitable computer readable medium, such as a hard disk, solid state memory, flash memory, etc., and may be non-recordable or recordable. The computer program 1020 comprises instructions forcausing a processor system to perform an embodiment of said method for an approximategadget decomposition of an integer, method for computing a gadget vector, and / or methodfor reconstructing an approximation of an integer from an approximate gadget decomposition of the integer, according to an embodiment. Figure 6b shows in a schematic representation of a processor system 1140according to an embodiment of a device for an approximate gadget decomposition of aninteger, a device for computing a gadget vector, and / or a device for reconstructing an approximation of an integer from an approximate gadget decomposition of the integer, according to an embodiment. The processor system comprises one or more integrated circuits 1110. The architecture of the one or more integrated circuits 1110 is schematically shown in Figure 6b. Circuit 1110 comprises a processing unit 1120, e.g., a CPU, for running computer program components to execute a method according to an embodiment and / or implement its modules or units. Circuit 1110 comprises a memory 1122 for storing programming code, data, etc. Part of memory 1122 may be read-only. Circuit 1110 may comprise acommunication element 1126, e.g., an antenna, connectors, or both, and the like. Circuit1110 may comprise a dedicated integrated circuit 1124 for performing part or all of the processing defined in the method. Processor 1120, memory 1122, dedicated IC 1124 and communication element 1126 may be connected to each other via an interconnect 1130,say a bus. The processor system 1140 may be arranged for contact and / or contact-lesscommunication, using an antenna and / or connectors, respectively. For example, in an embodiment, processor system 1140, e.g., the device foran approximate gadget decomposition of an integer, the device for computing a gadgetvector, and / or the device for reconstructing an approximation of an integer from anapproximate gadget decomposition of the integer, according to an embodiment, may comprise a processor circuit and a memory circuit, the processor being arranged to execute software stored in the memory circuit. For example, the processor circuit may be an Intel Core i7 processor, ARM Cortex-R8, etc. In an embodiment, the processor circuit may be ARM Cortex M0. The memory circuit may be an ROM circuit, or a non-volatile memory, e.g., a flash memory. The memory circuit may be a volatile memory, e.g., anSRAM memory. In the latter case, the device may comprise a non-volatile softwareinterface, e.g., a hard drive, a network interface, etc., arranged for providing the software. While system 1140 is shown as including one of each described component,the various components may be duplicated in various embodiments. For example, theprocessing unit 1120 may include multiple microprocessors that are configured toindependently execute the methods described herein or are configured to perform elements or subroutines of the methods described herein such that the multiple processors cooperate to achieve the functionality described herein. Further, where the system 1140 is implemented in a cloud computing system, the various hardware components may belong to separate physical systems. For example, the processor 1120 may include a first processor in a first server and a second processor in a second server. It should be noted that the above-mentioned embodiments illustrate rather than limit the presently disclosed subject matter, and that those skilled in the art will be able to design many alternative embodiments. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. Use of the verb ‘comprise’ and its conjugations does not exclude the presence of elements or steps other than those stated in a claim. The article ‘a’ or ‘an’ preceding an element does not exclude the presence of a plurality of such elements. Expressions such as “at least one of” when preceding a list of elements represent a selection of all or of any subset of elements from the list. For example, the expression, “at least one of A, B, and C” should be understood as including only A, only B, only C, both A and B, both A and C, both B and C, or all of A, B, and C. The presently disclosed subject matter may be implemented by hardware comprising several distinct elements, and by a suitably programmed computer. In the device claim enumerating several parts, several of these parts may be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage. In the claims references in parentheses refer to reference signs in drawings of exemplifying embodiments or to formulas of embodiments, thus increasing the intelligibility of the claim. These references shall not be construed as limiting the claim.

Claims

CLAIMS Claim 1. A cryptographic method (500) for an approximate gadget decomposition of aninteger for use in an FHE computation, comprising- obtaining (501) an input integer (^, 210) modulo a modulus (^, 211),- obtaining (502) a first modulus (^^ , 220) and a second modulus (^^, 230),wherein the modulus (^) is a product of the first modulus (^^) and the second modulus (^^), the first and second moduli being relatively prime and larger than 1,- obtaining (503) a second sequence of integers (231, 232) for the secondmodulus (^^), wherein the second sequence has at least two integers, the product of theintegers of the second sequence equals the second modulus (^^), the integers of the second sequence being pairwise co-prime, and the integers are larger than 1,- computing (504) the approximate gadget decomposition by computing arepresentative for a difference modulo each of the integers in the second sequencecorresponding to the second modulus (^^), wherein the difference (^ − ^^ , 241) isbetween the input integer (^) and an integer (240) congruent to the input integer (^)modulo the first modulus (^^), (^^ ≡ ^ mod ^^), or a multiple thereof.Claim 2. A method for an approximate gadget decomposition of an integer as in Claim 1, comprising reducing the input integer (^) modulo the first modulus (^^) to obtain the integer congruent to the input integer (^) modulo the first modulus (^^). Claim 3. A method for an approximate gadget decomposition (350) of an integer (310) as in Claim 1,- obtaining a first sequence of integers (321, 322) for the first modulus (^^ ,320), wherein the sequence has at least one integer, the product of the integers of the first sequence equals the first modulus (^^), the integers of the first sequence are pairwise co-prime, and the integers are larger than 1, wherein computing the difference modulo eachof the integers in the second sequence comprises for a second specific integerin thesecond sequence (^ − ∑^^^^^ ^^^^^^^^ ⋅ ^(^^^) ⋅ ^ mod ^′^^ mod ^^)ℤ- computing an integer (^ mod ^^, 360) equal to the input integer (^)modulo the second specific integer- subtracting therefrom for each first specific integer in the firstsequence the product (371) modulo the second specific integer of- the first modulus (^^) divided by the first specific integer- the input integer (^) multiplied with the inverse of the first modulus(^^) divided by the first specific integer modulo the first specific integer((^^^^ / ^′^)mod ^′^).Claim 4. A method as in Claim 3, wherein- an exponent (^) is defined such that the integers in the second sequenceand the first sequence are all larger than two to the power of the exponent (2^), wherein the exponent is 4, 8, 16, 17, or 32, and / or- an exponent (^) is defined such that the integers in the second sequenceand the first sequence are all smaller than two to the power of the exponent (2^), whereinthe exponent is 8, 16, 17, 23, 32, or 64, and / or- the integers in the second sequence and the first sequence are smaller thana machine word size, and / or- the second sequence of integers comprises at least three integers, e.g., atleast 4 integers.Claim 5. A method as in any one of the preceding claims, wherein computing (504) the approximate gadget decomposition by computing a representative for a difference modulo each of the integers in the second sequence corresponding to the second modulus(^^^), wherein the difference (^ − ^^ , 241) is between the input integer (^) and aninteger (240) congruent to the input integer (^) modulo the first modulus (^^), (^^≡^ mod ^^).Claim 6. A method as in any one of the preceding claims, comprising- obtaining an input polynomial having integer coefficients modulo themodulus (^), wherein the coefficients of the input polynomial are represented in the approximate gadget decomposition according to any one of the preceding claims.Claim 7. A cryptographic method (510) for computing a gadget vector for use with anapproximate gadget decomposition of an integer according to any one of Claims 1-6 inan FHE computation,- obtaining (511) a first modulus (^^ , 420) and a second modulus (^^, 430),wherein the modulus (^) is a product of the first modulus (^^) and the second modulus (^^), the first and second moduli being relatively prime and larger than 1,- obtaining (512) a second sequence of integers for the second modulus (^^,431, 432), wherein the second sequence has at least two integers, the product of the second sequence equals the second modulus (^^), the second sequence of integers are pairwise co-prime, and the integers are larger than 1,- computing (513) the sequence (^^ = ^^^^^ ⋅^^ ^^^= ^^ )( ^′^ = ^^^^^ ⋅ ^ ^^ ^^^ mod ^^^ℤ ) (^^ = ^^^^^), bymultiplying for each integer (^^) in the second sequence: -the second modulus (^^) divided by the integer (^^) (^^^ =<img src='' class="img-anchor img-center" img-id="IMGF000051_0002" / >-the first modulus (^^).Claim 8. A method as in Claim 7, wherein each element in the CRT gadget vector isfurther multiplied with the inverse modulo the integer (^^) of one of:- the first modulus ^^ times the second modulus (^^) divided by the integer<img src='' class="img-anchor img-center" img-id="IMGF000051_0003" / >- the second modulus (^^) divided by the integer (^^) (^^^ =<img src='' class="img-anchor img-center" img-id="IMGF000051_0004" / >- the first modulus ^^ ((^^)^^< / sup>). Claim 9. A cryptographic method (520) for use in an FHE computation for reconstructing an approximation of an integer from an approximate gadget decomposition of the integer,- obtaining (521) an approximate gadget decomposition of the integercomputed according to any one of Claims 1-6,- obtaining (522) a corresponding gadget vector computed according toClaim 7 or 8,- computing (523) the dot product of the obtained approximate gadgetdecomposition and the corresponding gadget vector. Claim 10. A method as in Claim 9, wherein- integers in the approximate gadget decomposition of an integer are, up totheir signs, at most half a corresponding integer in the second sequence of integers, andwherein an error between the reconstructed approximation and the integer is at most half the first modulus (^^< / sub>), or- integers in the approximate gadget decomposition of an integer are smallerthan a corresponding integer in the second sequence of integers, and wherein an error between the reconstructed approximation and the integer is smaller than the first modulus (^^< / sub>), or- integers in the approximate gadget decomposition of an integer are, up totheir signs, at most half a corresponding integer in the second sequence of integers, andwherein an error between the reconstructed approximation and the integer is at most half the first modulus (^^) times the number of integers in a first sequence of integers for the first modulus (^^< / sub>), or- integers in the approximate gadget decomposition of an integer are smallerthan a corresponding integer in the second sequence of integers, and wherein an error between the reconstructed approximation and the integer is smaller than the first modulus times the number of integers in a first sequence of integers for the first modulus (^^< / sub>). Claim 11. A cryptographic method for use in an FHE computation for a fully homomorphic encrypted computation comprising- a multiplication between an unencrypted first integer (^) and an FHEencrypted second integer (^), wherein the first integer is represented in the approximate gadget decomposition according to any one of Claims 1-6, and the second integer is encrypted according to the FHE. Claim 12. A method as in any one of the preceding claims, comprising- obtaining an approximate gadget decomposition of a first integer(^^, … , according to any one of Claims 1-6 with respect to the second sequence ofintegers (^^, … , ^^) for the second modulus (^^),- obtaining an FHE encrypted second integer (^), wherein the FHEencrypted second integer is obtained from- component wise FHE encryption of a component wisemultiplication between the second integer (^) and a gadget vector (^^, ^^, ...) for thesecond sequence of integers (Enc(^^< / sub>^)),- for each of the values in the approximate gadget decomposition of the firstinteger, multiply the value with the corresponding encryption of the value for the secondinteger (^^ ⋅ Enc(^^^)), obtaining the result as an FHE encrypted integer, thus obtaininga multiplication result as an encrypted approximate gadget decomposition. Claim 13. A method as in any one of the preceding claims, comprising computing an FHE encrypted blind rotation using integers represented according to the approximate gadget representation of any one of Claims 1-6.Claim 14. A system comprising: one or more processors; and one or more storage devicesstoring instructions that, when executed by the one or more processors, cause the one or more processors to perform operations for- A method for an approximate gadget decomposition of an integeraccording to any one of Claims 1-6, and / or- A method for computing a gadget vector for use with an approximategadget decomposition of an integer according to Claim 7 or 8, and / or- A method for reconstructing an approximation of an integer from anapproximate gadget decomposition of the integer according to Claim 9, and / or- A fully homomorphic encrypted computation according to any one ofClaims 11-13. Claim 15. A system as in Claim 14,- wherein one or more of the processors are an Application-SpecificIntegrated Circuit (ASIC), and / or- wherein one or more of the processors are a Field-Programmable GateArray (FPGA). Claim 16. An ASIC and / or FPGA configured to execute the method according to any one of Claims 1-13. Claim 17. A transitory or non-transitory computer storage medium encoded with instructions that, when executed by one or more computers, cause the one or more computers to perform- A method for computing a gadget vector for use with an approximategadget decomposition of an integer according to any one of Claims 1-6, and / or- A method for an approximate gadget decomposition of an integeraccording to Claim 7 or 8, and / or- A method for reconstructing an approximation of an integer from anapproximate gadget decomposition of the integer according to Claim 9, and / or- A fully homomorphic encrypted computation according to any one ofClaims 11-13.

Images