Method for homomorphic encryption with low noise growth

Abstract

The present invention relates to a method for homomorphically encrypting general plaintext spaces with controlled noise growth, comprising: a general plaintext space by selecting a polynomial of degree greater than 1, and defining the plaintext space as formula (I), where f(x) and t(x) are polynomials; applying an encoding method on a message and producing a corresponding element in the plaintext space Rt; applying a homomorphic encryption method that takes the encoded message as input and returns a ciphertext that encrypts the message; providing a decryption method that takes the ciphertext as input and returns the decoded plaintext; applying a method to homomorphically process encrypted messages by evaluating an arithmetic circuit representing the function to be evaluated, wherein the noise growth during homomorphic operations is determined by the size of; and applying a method to refresh ciphertexts via bootstrapping, which consists of homomorphically processing the decryption circuit.

Description

Method for Homomorphic Encryption with Low Noise Growth Field of the invention

[0001] The present invention is generally related to the field of cryptography, specifically to fully homomorphic encryption (FHE) schemes that support high-precision arithmetic and SIMD (Single Instruction, Multiple Data) capabilities. Background of the invention

[0002] Homomorphic encryption (HE) schemes allow computations to be performed directly on encrypted data, ensuring data privacy by avoiding the need for decryption during processing. This capability is critical for secure cloud computing, privacy-preserving machine learning, and other data- sensitive applications.

[0003] Homomorphic encryption schemes are commonly divided into two categories. On the one hand, there exist schemes that can evaluate “single instruction, multiple data” operations on a batch encryption of multiple elements, also known as Single Instruction Multiple Data (SIMD) schemes or operations. Examples of this first category are as Brakerski-Gentry-Vaikuntanathan (BGV), Brakerski-Fan-Vercauteren (BFV), and Cheon-Kim-Kim-Song (CKKS). On the other hand, some schemes do not have the SIMD option, but have faster execution times, an easier programming model and smaller parameters. This second category includes FHEW and TFHE.

[0004] All previously mentioned homomorphic encryption schemes are noise-based. Encryption adds a small “noise” or “error” to the ciphertext, and this noise is removed during decryption. This approach is necessary for security, but it also comes with a major limitation: homomorphic evaluation of a circuit causes the noise to grow. As such, the noise must stay below a given threshold for the ciphertext to remain decryptable.

[0005] For current SIMD schemes, the noise-based methodology imposes one more restriction: let p be the “precision” of the encoding (i.e. the plaintext modulus in BGV / BFV), then the noise growth of multiplication roughly obeys nout= c(p) · (n1+ n2), where n1and n2are upper bounds on the input noise, noutis an upper bound on the output noise, and c(p) is a function that depends linearly on p. This linear relation results in more noise for larger p and is hence an unfavorable property. As such, current SIMD schemes are rather impractical for high-precision arithmetic, which is required in many useful HE applications.

[0006] A less well-studied scheme, which does not belong to either of the categories discussed above, is the CLPX scheme presented by to Chen et al. 2018. The idea is to define the plaintext ring modulo a linear polynomial t(x) = x − b, instead of an integer p in BGV and BFV. As suchit can encode a single integer defined modulo Φm(b) (which typically supports thousands of bits), but has relatively slow execution time and large parameters. Unfortunately, this scheme is still rather impractical as it supports only one number per ciphertext and is only a leveled scheme since it cannot be bootstrapped. On the positive side, the noise growth under multiplication is only sublinear in the desired precision. Whereas BGV and BFV are very limited in multiplicative capacity, the CLPX scheme creates a true "gap" between precision and noise growth. Consequently, the CLPX scheme is currently the best choice for implementing extremely high precision exact arithmetic in homomorphic encryption.Summary of the invention

[0007] According to a first aspect of the present invention, there is provided a method for homomorphically encrypting general plaintext spaces with controlled noise growth, comprising: defining a general plaintext space by selecting a polynomial t(x) of degree greater than 1, and defining the plaintext space as where f(x) and t(x) are polynomials;applying an encoding method on a message m and producing a corresponding element in the plaintext space Rt; applying a homomorphic encryption method that takes the encoded message as input and returns a ciphertext that encrypts the message; providing a decryption method that takes the ciphertext as input and returns the decoded plaintext; applying a method to homomorphically process encrypted messages by evaluating an arithmetic circuit representing the function to be evaluated, wherein the noise growth during homomorphic operations is determined by the size of t(x); and applying a method to refresh ciphertexts via bootstrapping, which consists of homomorphically processing the decryption circuit.

[0008] In a preferred embodiment the polynomials f(x) and t(x) are chosen such that the plaintext space Rtdecomposes into a direct product of k smaller plaintext spaces R^ for i = 1 to k, allowing for encryption of a vector of elements, where the i-th element of the vector is an element of

[0009] In some embodiments a sequence of compatible plaintext spaces Rtfor i = 1 to k is used, connected by ring embeddings , and the method further comprises a method totake a ciphertext encrypting a plaintext Rt. and deriving a valid ciphertext encrypting a portion of the original plaintext, interpreted as an element of Rtk, wherein k < j.

[0010] Advantageously some of the plaintext spaces R^ are identical, and the method further comprises a method to permute elements residing at indices i where the plaintext spaces are identical, by exploiting automorphisms σ of the ring such that tR is invariant under □.

[0011] In an embodiment f(x) and t(x) are chosen such that the plaintext space Rtis equivalent tofor some integer n and polynomial t'(x), where t'(x) is the greatest common divisor of / (x) and t(x) module n.

[0012] For purposes of summarizing the invention and the advantages achieved over the prior art, certain objects and advantages of the invention have been described herein above. Of course, it is to be understood that not necessarily all such objects or advantages may be achieved in accordance with any particular embodiment of the invention. Thus, for example, those skilled in the art will recognize that the invention may be embodied or carried out in a manner that achieves or optimizes one advantage or group of advantages as taught herein without necessarily achieving other objects or advantages as may be taught or suggested herein.

[0013] The above and other aspects of the invention will be apparent from and elucidated with reference to the embodiment(s) described hereinafter.Detailed description of illustrative embodiments

[0014] The present invention will be described with respect to particular embodiments and with reference to certain drawings but the invention is not limited thereto but only by the claims.

[0015] Furthermore, the terms first, second and the like in the description and in the claims, are used for distinguishing between similar elements and not necessarily for describing a sequence, either temporally, spatially, in ranking or in any other manner. It is to be understood that the terms so used are interchangeable under appropriate circumstances and that the embodiments of the invention described herein are capable of operation in other sequences than described or illustrated herein.

[0016] It is to be noticed that the term "comprising", used in the claims, should not be interpreted as being restricted to the means listed thereafter; it does not exclude other elements or steps. It is thus to be interpreted as specifying the presence of the stated features, integers, steps or components as referred to, but does not preclude the presence or addition of one or more other features, integers, steps or components, or groups thereof. Thus, the scope of the expression "a device comprising means A and B" should not be limited to devices consisting only of components A and B. It means that with respect to the present invention, the only relevant components of the device are A and B.

[0017] Reference throughout this specification to "one embodiment" or "an embodiment" means that a particular feature, structure or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Thus, appearances ofthe phrases “in one embodiment” or “in an embodiment” in various places throughout this specification are not necessarily all referring to the same embodiment, but may. Furthermore, the particular features, structures or characteristics may be combined in any suitable manner, as would be apparent to one of ordinary skill in the art from this disclosure, in one or more embodiments.

[0018] Similarly it should be appreciated that in the description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together in a single embodiment, figure, or description thereof for the purpose of streamlining the disclosure and aiding in the understanding of one or more of the various inventive aspects. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of this invention.

[0019] Furthermore, while some embodiments described herein include some but not other features included in other embodiments, combinations of features of different embodiments are meant to be within the scope of the invention, and form different embodiments, as would be understood by those in the art. For example, in the following claims, any of the claimed embodiments can be used in any combination.

[0020] It should be noted that the use of particular terminology when describing certain features or aspects of the invention should not be taken to imply that the terminology is being re- defined herein to be restricted to include any specific characteristics of the features or aspects of the invention with which that terminology is associated.

[0021] In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In other instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description.

[0022] It is an open problem to design HE schemes that natively support both high precision arithmetic and SIMD capabilities. In this invention, such a scheme is proposed by significantly generalizing and simplifying BFV and CLPX to arbitrary cyclotomic polynomials Φm(x) and arbitrary plaintext polynomials t(x). A detailed noise analysis is given of the different operations such as addition, key switching, automorphism and multiplication.

[0023] Then the scheme is instantiated by a clever choice of m and t(x) allowing us to natively compute with vectors of elements in finite fields defined by a cyclotomic prime, i.e. a primeobtained as the evaluation of a cyclotomic polynomial in an integer. The present invention also shows how to natively deal with extensions of such finite fields. Several parameter families are given including the Fermat prime Φ2(216) = 216+1 and the Goldilocks prime Φ6(232) = 264− 232+ 1.

[0024] The present invention can be seen as a trade-off between standard BFV and CLPX: similar to BFV, the scheme offers packing capabilities; and similar to CLPX, the scheme encrypts large (but not huge) integers with reduced noise growth. The new scheme is called Generalized BFV (GBFV). Finally, it is shown for the first time how an encryption scheme with polynomial plaintext modulus can be bootstrapped for appropriately chosen parameters. This bootstrapping is based on a new GBFV-to-BFV conversion and packing algorithms, which may be of independent interest. The bootstrapping is implemented on top of Microsoft SEAL and extensively compared to regular BFV bootstrapping.

[0025] Various FHE applications require high-precision plaintext spaces. For example, state- of-the-art private set intersection protocols work with a plaintext modulus of 16 up to 26 bits, which is already significant in terms of noise growth for standard BFV. Privacy preserving machine learning uses even larger plaintext moduli of up to 80 bits. Other applications of high-precision FHE include rational number encoding and p-adic encoding.

[0026] Outside the FHE domain, many zero-knowledge proof systems also use large values of p. For example, the FRI-based systems known as Plonky2, Miden-VM, Era-Boojum and Risc Zero use the popular Goldilocks prime p = 264− 232+ 1. Note that the name “Goldilocks prime” is a slight abuse of terminology here, because the original prime was of the shape φ2− φ − 1 rather than φ2− φ + 1. GBFV instantiated with the Goldilocks prime can be used to securely and efficiently delegating proof generation of a zkSNARK to an untrusted server.

[0027] Another reason to use large values of p is packing density. It is well known that the BFV packing density (i.e. the number of slots divided by the ring dimension) is equal to 1 / d, where d is the multiplicative order of p modulo the cyclotomic index m. As such, one needs p > m if one wants to achieve full packing. In the specific case of power-of-two cyclotomics, the number of slots is upper bounded by (p + 1) / 2. This is one of the motivations to use the popular prime p = 216+ 1, which achieves full packing density up to index m = 216. The large-p restriction becomes even more apparent during bootstrapping, where p2is used as an intermediate modulus. This results in a precision of 32 bits for the previously mentioned prime.

[0028] The idea behind the CLPX scheme originates from the NTRU scheme. Hoffstein and Silvermann (Optimizations for ntru. In: Proc. the Conf. on Public Key Cryptography and Computational Number Theory, 2000, Warsaw. pp. 77–88) noticed that the integer modulus in NTRU encoding can be replaced with a small polynomial modulus. The CLPX scheme uses this trick in combination withthe BFV scheme to construct leveled homomorphic encryption for large integers. Later research has shown how the same trick can be used to encode complex numbers more efficiently. To some extent, these works on complex number encoding already offer a limited form of plaintext packing by using a modulus of the shape xk−b. However, this is still not general enough for the present use case (where non-power-of-two cyclotomics and arbitrary plaintext moduli are needed). Moreover, these prior works are tailored to complex numbers, do not have a mechanism to permute the encoded plaintext slots, and are not known to be bootstrappable. Another research direction has found an alternative way to reduce the modulus consumption in complex number encoding by making the individual FHE operations more expensive. However, this strategy seems not applicable to exact schemes.

[0029] The R-LWE problem will be used, so definitions and properties of cyclotomic polynomials are first introduced. For an integer m ^ 1, one takes a primitive m-th root of unity ωm∈ C. This means that ωmk= 1 if and only if m divides k. The expression is called the m-th cyclotomicgroup of integers modulo m. The degree of the above polynomial is n = φ(m), where φ(·) is Euler’s totient function. A standard result states that all cyclotomic polynomials are monic, irreducible over Q and have integer coefficients. For the R-LWE problem, one defines the m-th cyclotomic number field K = Q(ωm) = Q[x] / (Φm(x)) and its ring of integers R = ℤ[ωm] = ℤ[x] / (Φm(x)). The Galois group of K / Q is written as Gal(K / Q). It consists of the automorphisms σj : x → xjfor j ∈ ℤ×m. As such, it is a trivial result that this Galois group is isomorphic to ℤ×m. The multiplicative subgroup generated by is denoted by ^g1,...,gs^. An ideal in a ring is written with round parentheses, that is (r1, ..., rs).

[0030] Referring to embeddings and norms, for the purpose of noise analysis, one needs to embed the cyclotomic number field into a real or complex vector space. Two common methods are the coefficient embedding and the canonical embedding. In the definition here, the coefficient embedding uses the powerful basis of K.

[0031] Definition 1. Let m = m1 · ... · ms be the prime-power factorization of m. Let where xj = xm / mjanj) − 1. Then the coefficient embedding is defined by the mapc

[0032] Definition 2. The canonical embedding is defined by the mapThis map is well-defined because ωmJis a root of CDm(x) for ea ch. h5

[0033] The coefficient embedding preserves addition, and is therefore an additive group embedding. The canonical embeddings preserves addition and multiplication, and is therefore a ring embedding. Note that multiplication is defined component wise in the embedding space (Cn. To analyze the noise in a ciphertext, its norm is studied through the coefficient or canonical embedding.The notationsdenote the on the coefficient embedding and the canonical embedding respectively. Since noise estimates are simpler for the canonical embedding, but decryption is done on the coefficient embedding, it can be useful to upper bound the coefficient norm in terms of the canonical norm.Fortunately, this is possible because any two norms on a finite-dimensional vector space are known to15 be equivalent. HElib is referred to for more information on how this can be done. The norms satisfy the following lemma.

[0034] Lemma 1. Let a,b £ K, thenThe first property is the triangle inequality. The second and third property are given for example by20 Gentry et al., Better bootstrapping in fully homomorphic encryption. In: Public Key Cryptography.Lecture Notes in Computer Science, 2012, vol. 7293, pp. 1-16. Springer.

[0035] Throughout this disclosure, t = t(x) is considered, which is either a polynomial in Z[x] or a non-zero element of R, depending on the context. The quotient ring of R modulo t is written as Rt= R / tR. All ring and field elements (except for the modulus t) are shown in bold lower-case letters or25 explicitly as polynomials. For a £ K (which can have non-integral coefficients) and a positive integer N, the coefficient-wise centered reduction of a modulo N is denoted by [a] / N. In other words, this gives the element in NR + a which has coefficients in [-N / 2,N / 2). The standard notations [a], [a] and [a] are employed for coefficient-wise flooring, ceiling and rounding to the nearest integer, respectively. The result of rounding goes upwards if the input coefficient is in Z + 1 / 2.30

[0036] Vectors and matrices over R are regularly used. Row vectors are written ascolumn vectors as and matrices as For the inner product between vectors of thesame type, ^·,·^ is used. Finally, it is to be noted that the above notations for modular reduction, flooring, ceiling and rounding carry over component-wise to vectors and matrices.

[0037] To count the number of elements in a quotient ring, the ideal norm can be used. Definition 3. Let I be an ideal in R, then the absolute norm of I is N(I) = [R : I]. Lemma 2. Let t ∈ R be non-zero, then N(tR) = |NK / Q(t)| where NK / Q(·) is the standard field norm. This lemma shows that the absolute norm and the field norm are compatible for principal ideals. For the proof, Marcus et al., Number fields, 1977, vol. 1995, Springer, is referred to. A direct corollary is that the ring Rtis finite for non-zero t. Definition 4. Let .k ⊆ ℤ[x] be the set of polynomials of degree at most k. Consider f(x),g(x) ∈ ℤ[x] of degree i and j respectively. The Sylvester map of f(x) and g(x) is the linear transformation Pj−1⊕ Pi−1→ Pi+j−1: (r(x),s(x)) → r(x) · f(x) + s(x) · g(x). If the power basis of x is used to express the Sylvester map as a matrix, then the determinant of this matrix is called the resultant Res(f(x),g(x)). Observe that the image of the Sylvester map is a subset of the ideal (f(x),g(x)) in ℤ[x]. The next lemma gives an alternative way to count the number of elements in the ring Rt based on the relation between norms and resultants. Lemma 3. Let t(x) ∈ ℤ[x], then NK / Q(t(x)) = Res(Φm(x),t(x)). The following lemma is a standard result: Lemma 4. For f(x),g(x) ∈ ℤ[x], it holds that – Res(f(x),g(x)) is in the image of the Sylvester map. – Res(f(x),g(x)) = 0 if and only if f(x) and g(x) have a common factor of degree at least one. The former statement generalizes Bézout’s identity. Although the resultant is in the image of the Sylvester map, it is not necessarily the smallest positive integer with this property. Therefore, a definition is used of i Ventosa and Wiese, 2009, Computing congruences of modular forms and galois representations modulo prime powers. Arithmetic, geometry, cryptography and coding theory 2009 521, 145–166. Definition 5. Let f(x),g(x) ∈ ℤ[x] have non-zero resultant. Then the reduced resultant or congruence number Con(f(x),g(x)) is the smallest positive integer in the image of the Sylvester map of f(x) and g(x).

[0038] The ring learning with errors problem is an algebraic variant of the learning with errors problem. Both are commonly used to construct homomorphic encryption schemes, but only the variant over rings is needed. The R-LWE problem is based on the R-LWE distribution for an integer q ≥ 2 and a secret s sampled from χkey.Definition 6. Fix a secret s € Rp. The R-LWE distribution is defined by first samplingand then returningDefinition 7. Given access to polynomially many samples from the decision R-LWE problem is todistinguish between the distributions5 Definition 8. Given access to polynomially many samples from Aqs, the search R-LWE problem is to find the underlying s.Both variants of the R-LWE problem are conjectured to be hard for appropriately chosen parameters.

[0039] Now the secret key variants of BFV and CLPX are introduced. In fact, the improved version of BFV encryption is described where ring rounding is applied after multiplication by A. Details10 of the BGV scheme are omitted for conciseness, and because it is roughly equivalent to BFV.

[0040] BFV encryption. One fixes a plaintext modulus t = p, a ciphertext modulus q and a scaling factor Zl = q / t. Encryption of m E Rtis done via R-LWE:Decryption requires a ciphertext15One can homomorphically compute three types of operations over the plaintext space Rt: addition, multiplication and automorphism. The scheme can be made fully homomorphic by bootstrapping.

[0041] CLPX encryption: a plaintext modulus t = t(x) = x - b, a ciphertext modulus q and a scaling factorare fixed. The plaintext space corresponds to20where Encryption of a single element is done via R-LWE as follows. First, onecomputes a "hat encoding" m" = p (mod tR) such that m" has small coefficients. Then the ciphertext is computed as25 Decryption requires a ciphertextq and the secret keyFinally, the original message is retrieved via m = m(x) and p = m(fa). One can homomorphically compute two types of operations over the plaintext space addition and multiplication. Since only a single element is encrypted, no SIMD operations are possible, and since the size of p is exponential in30 m, it is not known how to bootstrap for cryptographically secure parameters.

[0042] Remark that the hat encoder is redundant if one applies ring rounding after multiplication of A and m instead of before. This is done in the definition of the Generalized BFV scheme outlined hereinafter, similarly to the implementation of the BFV scheme due to Kim et al.,Revisiting homomorphic encryption schem f f nite fields. In: ASIACRYPT (3). Lecture Notes in Computer Science, 2021, vol. 13092, pp. 608–639, Springer. However, the hat encoder (generalized and renamed to Flatten) is still required for plaintext-ciphertext multiplication.

[0043] SIMD operations. It was shown by Smart, Vercauteren, F., Fully homomorphic SIMD operations. Des. Codes Cryptogr., 2014, that one FHE plaintext can encode several independent numbers. Their idea is based on the Chinese remainder theorem (CRT). Specifically, let t = p be a prime that does not divide m. Then it is a well-known fact that the m-th cyclotomic polynomial factorsmodulo p into ℓ = n / d distinct irreducible factors of degree d, where d is the order of. In otherwords, one has the CRT isomorphism Rp= ℤ[x] / (Φm(x),p) → ℤ[x] / (F1(x),p) × ... × ℤ[x] / (Fℓ(x),p) (1) µ(x) → (µ(x) mod F1(x),...,µ(x) mod Fℓ(x)), where Fi(x) are the factors of Φm(x) modulo p. Consequently, the plaintext space is isomorphic to a direct product of ℓ copies of the finite field Fpd. In the case where t = peis a prime power, one can apply Hensel lifting so that the plaintext space is given by ℓ copies of a Galois ring of characteristic pe.

[0044] It can be shown that the plaintext slots can be arbitrarily permuted based on the group action of Gal(K / Q). This automorphism group contains the subgroup ^σp^ generated by the Frobenius automorphism σp. The Frobenius automorphism itself acts on each slot independently as an automorphism on the underlying Galois ring. However, it becomes more interesting when considering automorphisms outside of ^σp^. These automorphisms can be shown to induce inter-slot permutations of the plaintext data.

[0045] Now a generalization of BGV / BFV and CLPX to arbitrary cyclotomic rings and non- linear polynomial plaintext moduli is described. Although the secret key variant of the scheme is described, it can easily be turned into a public key encryption scheme using standard techniques.

[0046] The generalization captures plaintext spaces modulo arbitrary non-zero principal ideals generated by t = t(x). In some procedures, one requires a representative with small coefficients in R from an element in Rt. To achieve this, the function is defined Flatten:. Note that Flatten generalizes both the hat encoder from Chen et al., High-precision arithmetic in homomorphic encryption. In: CT-RSA. Lecture Notes in Computer Science, 2018, vol. 10808, pp. 116– 136. Springer, and the notation [·]N (since Flatten(m) = [m]t for an integer t). Moreover, it filters out a unique canonical representative in R: it satisfies Flatten(m) = m (mod tR), and the output does not depend on the input representative. Also note the similarity to Babai rounding for approximating theclosest vector problem, as presented in Babai, On Lovasz' lattice reduction and the nearest lattice point problem. Comb. 6(1), 1986, 1-13.

[0047] Two additional functions are required for decomposition and recombination of ring elements. These functions are defined with respect to integersand they will be used to control the noise growth during key switching (see later). Let thenone defines andThe following essential lemma is proven by Brakerski et al. (leveled) fully homomorphic encryption without bootstrapping. ACM Trans. Comput. Theory 6(3), 2014, 13:1-13:36.Lemma 5. For all a,b £ R, it holds thatAlternative methods have been proposed to define D and P, which are more convenient for the actual implementation of HE schemes.

[0048] The FHE scheme has plaintext space Rtand ciphertext space for an integer q. Forcorrectness, it is required that (similarly to BGV and BFV, where one assumes that t« q). The "scaling factor" is defined as The scaling factor is not rounded to R, whichresults in a conceptually simpler scheme definition than the original BFV and CLPX. The scheme then consists of the following algorithms for key generation, encryption and decryption:SecretKeyGen: sample and return s.EvalKeyGen(s,s): given secret keys sample and and computeReturn evk.Encrypt(m,s): given message and secret key sample andcomputeReturn ct. Observe that the computed ciphertext is independent of the chosen plaintext representative m due to the scaling by Δ.Decrypt(ct,s): given ciphertext and secret key s ∈ R, computeReturn m.

[0049] In a similar way as BFV, the IND-CPA security of the GBFV homomorphic encryption scheme (without any evaluation keys) can be reduced to the hardness of the decision R-LWE problem5 using a simple indistinguishability argument. The procedure EvalKeyGen, where s' depends on s, requires a circular security assumption on top of R-LWE.

[0050] The following algorithms are necessary to compute homomorphic operations on ciphertexts of the GBFV scheme:Add(ct,ct ): given ciphertexts10 Now computeand return ctadd-- Add(ct,m): given ciphertext ct € R^ and message m € Rt, compute15 and return Add(ct,ct ). given partial ciphertext and evaluation keycompute20 Return ctswitch.p y ( ) : given ciphertexts and evaluation keyforNow computeand return Add(ct ",ct" ).25 - Multiply (ct,m): given ciphertext ct = (co,ci) € R2^ and message m € Rt, let m" = Flatten(m). Now computeand return ctmuit-- Automorphism given ciphertext automorphism,σ ∈ G where G = {σ ∈ Gal(K / Q) | σ(t) ∈ tR} and evaluation keyfor s′= σ(s), compute ct .Compute ct′′ = KeySwitch(c′1 ,7e77v777k⃗ ) and return Add(ct’,ct’’). Multiplication by σ(t) / t is not required inthe regular BFV scheme because it is equal to 1.

[0051] In the BGV and BFV schemes, all automorphisms of Gal(K / Q) induce valid automorphisms on Rt. This is different in the generalized scheme: for correctness, it is imposed that σ(t) ∈ tR (which is equivalent to σ(tR) = tR) such that σ is well-defined over Rt.

[0052] Remark 1. Observe that the groups Gal(K / Q(t)) ⊆ G ⊆ Gal(K / Q) are not equal in general. For example, let m = 8 and t(x) = x2+ 3x + 1, then - Gal(K / Q(t)) contains only x → x. - G contains x→ xifor i = 1,7. Note that σ7(t) = −x2t over R which shows that indeed σ7∈ G. - Gal(K / Q) contains x → xifor i = 1,3,5,7.

[0053] Remark 2. Note that the scheme described is totally general, i.e. it will work for any plaintext modulus polynomial t, and one has not imposed any restriction except that ||t||can∞ ≪ q. The above example already illustrates that a “compatible” choice of Φm and t results in a non-trivial set of valid automorphisms. Similarly, such choice is also required to achieve non-trivial SIMD capabilities of the scheme.

[0054] Hereinafter a worst-case conservative noise analysis on the canonical embedding is described. As such, it will demonstrate that the multiplication noise growth (which is linear in the norm of t) is decoupled from the precision (which can be superlinear in the norm of t). The invariant noise of a ciphertext is defined in the same way as CLPX. Definition 9: Let ct = (c0,c1) be a ciphertext that encrypts m ∈ Rt. Its invariant noise is the field element v ∈ K with smallest infinity norm on the coefficient embedding such that (c0+ c1· s) / ∆ = m + v (mod tR). (2) Observe the above definition can be rewritten as c0+ c1· s = ∆ · (m + v) (mod qR). (3) The following lemma gives a condition on the invariant noise for correctness of decryption, again similar to CLPX. Lemma 6. A ciphertext ct = (c0,c1) that encrypts m ∈ Rtdecrypts correctly if the invariant noise v satisfies ||v||∞ < 1 / 2.Proof. Let (c0 + c1 · s) / ∆ = m + v + t · a for a ∈ R. Decryption computes⌊(c0 + c1 · s) / ∆⌉ = ⌊m + v + t · a⌉ = m + t · a = m (mod tR), where the middle equ lit h ld if || || 1 / 2Additional symbols. The ciphertext noise after encryption and all homomorphic operations must bebounded. For this purpose, the key and error distributions, which were used earlier, are assumed to be upper bounded. More specifically, three extra symbols are defined: -Bkey is an upper bound on for s ← χkey.- Berris an upper bound o χerr. – Btis defined as ||t(x)||can∞.The next lemma bounds the “ring rounding” error that occurs when ro di l ment from K to R.Lemma 7. Let a ∈ K and b = ⌊a⌉ ∈ R, then ||b − a||can∞≤ n / 2. Proof. Let ^ = b − a. Ac di t th thi d t f L ma 1, one hasThe second inequality is obtained by s of ^ by 1 / 2.Initial noise. Let ct = (c0,c1) be a freshly encrypted ciphertext. It satisfies c0+ c1· s = ⌊∆ · m⌉ + e = ∆ · m + ^ + e (mod qR), where e is sampled from χ and ^ is the ring rounding error The invariant noise is given by v = (^ +e) / ∆. It can be bounded as Ciphertext-ciphertext addition. Th∆ ( + ) ( d R) where madd = m + m′a se respectively. The noise can be bounded asPlaintext-ciphertext addition. Th ing rounding error. Then the formula changes to ||vadd||can∞ ≤ ||v||can∞ + (n / 2) · Bt / q. Key switching. Suppose that one has c·s′= ∆·(m+v) (mod qR). The key switched ciphertext satisfies= ∆ (m+ vswitch) (mod qR), where the third equality fvswitch Recall that ^⃗ is sampled from. T||vswitch||can∞ ≤ ||v||can∞ + Bswitch, where Bswitch= ℓω,q·(ω ·n / 2)·Berr· / h f / 2 decomposition of c in base ω, whichuses a similar observation as in Lemma 7.Ciphertext-ciphertext multiplication. Before key switching, the multiplied ciphertext satisfies :than m,m′∈ Rt. This is so that the decryption formula can be defined from Equation (2) without reduction modulo tR. The elements ^iare again ring rounding errors. Clearly, the intermediate noise is given by ′ ′ ′ int = · + · + · +0+1 ·+2∆||vint||can∞≤ (n / 2) · (Bkey+ 1) · Bt· (||v||can∞+ ||v′||can∞) + The final n||vmult||can∞ ≤ ||vint||can∞ + Bswitch.

[0057] Plaintext-ciphertext multiplication. Different from addition, the equations for plaintext-ciphertext multiplication deviate much from ciphertext-ciphertext multiplication. That is, the multiplied ciphertext satisfies [^4 · c0]q + [^4 · c1]q · s = ^4 · (c0 + c1 · s)= ∆ · (mmult+ vmult) (mod qR),where mmult = m · m′ and vmult = ^4 · v. Note that m′ indicates the plaintext encrypted by the ciphertext(c0,c1). Here the important property is used that Flatten(m) = m (mod tR). The invariant noise can then be bounded as ||vmult .

[0058] Automorphism. Before key switching, the computed ciphertext satisfies [(σ(t) / t) · σ(c0)]q + [(σ(t) / t) · σ(c1)]q · σ(s) = (σ(t) / t) · σ(c0 + c1 · s) = ∆ · (σ(m) + σ(v)) (mod qR), where the fact is used that (σ(t) / t)·σ(∆) = ∆. Clearly, the intermediate noise is given by vint= σ(v), so . The final noise (after key switching) can be bounded as ||vauto switch.

[0059] In what follows the algebraic structure of the plaintext space is studied. One starts with the special case of binomial moduli (plus some additional assumptions on the exact shape of the binomial) and then more general moduli are treated

[0060] The following standard property of cyclotomic polynomials will be used. Reference may be made to Al-Kateeb, A.Q.M. et al., 2016, Structures and properties of cyclotomic polynomials, for a proof of the lemma and for a more detailed discussion about the properties of cyclotomics.

[0061] Lemma 8. Let r = rad(m) denote the radical of a positive integer m, i.e. the product of its distinct prime factors. Then the following relation holds: Φm(x) = Φr(xm / r). Now properties of the plaintext space are derived when the modulus is of the special shape t(x) = xk− b, where both k and b are integers. It is assumed that 0 < k < n = φ(m) and k | (m / r), where r = rad(m) is the radical of m. The plaintext ring is Rt= ℤ[x] / I, using the ideal I = (Φm(x),t(x)) ⊆ ℤ[x]. In this special case, this can be simplified with Lemma 8 and Euclidean division (i.e. by substituting Φm(x) with its reduction modulo t(x) = xk− b) toI = (Φr(xm / r),xk− b) = (t(x),p), where p = Φr(bm / (rk)). The next l h th t f binations, the splitting behaviour oft(x) modulo p is extremely nice.

[0062] Lemma 9. Let m ≥ 3 be an integer and let r = rad(m) be its radical. Consider 0 < k < n = φ(m) such that k | (m / r). For an integer b, define t(x) = xk−b and p = Φr(bm / (rk)). If p is a prime number and does not divide m, then t(x) splits over Fpinto ℓ′= k / d distinct irreducible factors of identical degree d, where d is the multiplicative order of p modulo m. The subgroup G of valid automorphisms equals G = Gal(K / Q(t)) and consists of the maps x 7→ xifor i = 1 (mod m / k).

[0063] Proof. Observe that Φm(x) ∈ (t(x),p), and thus t(x) divides Φm(x) over Fp[x]. As such, the splitting behaviour of t(x) over Fp follows directly from the splitting behaviour of Φm(x) over Fp, which is well known to split into φ(m) / d distinct irreducible factors of degree d, with d the multiplicative order of p modulo m. Since Φm(x) splits completely over Fpd, the same holds for t(x). Moreover, its roots are primitive m-th roots of unity, so the order of b is exactly m / k.

[0064] Now the subgroup of valid automorphisms is analyzed. Recall that σi: x → xiis valid if and only if σi(t) = xk·i− b ∈ tR ⇐⇒ bi− b ∈ tR. This equivalence holds because xk·i= bi(mod tR). As such, one needs p | bi− b, or even p | bi−1−1 since p and b are coprime by definition. This is true if i−1 is divisible by the order of b modulo p, which was established to be m / k. Moreover, all these valid automorphisms satisfy σi(t) = t.

[0065] SIMD operations. Similarly to BFV, multiple elements can be packed in one plaintext based on the splitting behaviour of t(x) modulo p. One can also compute arbitrary permutations of the plaintext slots in a similar way as Halevi et al., Design and implementation of HElib: a homomorphic encryption library, Cryptology ePrint Archive, 2020, Paper 2020 / 148, or HElib. That is, Equation (1) is first replaced by the isomorphism Rt= ℤ[x] / (t(x),p) → ℤ[x] / (T1(x),p) × ... × ℤ[x] / (Tℓ′(x),p) (4) Define the slot alg en ζ is also a root ofΦm(x), so it is a primitive m-th root of unity. The roots of t(x) over Fpdare simply obtained by twisting ζ with the k-th roots of unity. Therefore, they are obtained asIn particular, the roots of T1(x) are the p-th power maps of ζ. Let S ⊆ ℤ be a full system of representatives for H / ^p^, where H∼= G is the subgroup of whose elements are congruent to 1 modulo m / k. Equation (4) is updated to This is possible because all ζhare roots of t(x) belonging to different Ti(x). The hypercube representatives are constructed aswhere the number of slots is and s is the number of dimensions. As such, one canassociate each slot with a tuple (e1,...,es) or with .

[0066] Rotations can be implemented by means of the automorphism group G, in a similar way as for BFV. Let α be the mask obtained by embedding 0 in the plaintext slots with indices (e1,...,ei,...,et) where ei < v, and embedding 1 in the other slots. Then the rotation with 0 positions in dimension i for a plaintext m can be computed as m → α · σj(m) + (1 − α) · σk(m),where ). If the order of gi in H is ℓ′ i, the equation collapses to m → σj(m) and only one automorphism is needed. Finally, observe that the Frobenius automorphism σpacts on each slot separately as the p-th power map.

[0067] Some applications (bootstrapping in particular) require a plaintext space defined modulo a prime power perather than a prime p. The following analysis shows that this can be achieved by changing the plaintext modulus from t to te. Again, it is assumed that p = Con(Φm(x),t(x)) is prime and does not divide m.

[0068] Starting point is the observation that Φm(x) is in the ideal (t′(x),p). It follows immediately that Φm(x) = β′(x) · t′(x) (mod p). for some β′(x) ∈ ℤ[x]. Through the process of Hensel lifting, this equation may also be defined modulo pe, so one can write Φm(x) = β′(x) · t′(x) (mod pe). (7)

[0069] Now it is proven that (Φm(x),te(x)) = (t′(x),pe) as ideals in ℤ[x]. First, observe that Φm(x) ∈ (t′(x),pe) due to Equation (7). It is also known that t(x) ∈ (t′(x),p) because t′(x) divides t(x) over Fpby construction. A simple binomial expansion of t(x) = γ(x) · t′(x) + δ(x) · p shows that te(x) ∈ (t′(x),pe), so it follows that (Φm(x),te(x)) ⊆ (t′(x),pe).

[0070] In the opposite direction, note that both ideals have an index equal to (N(tR))ewhen seen as additive subgroups of ℤ[x], so they must be identical. Moreover, the interpretation as a subspace of BFV with plaintext modulus pestill holds.

[0071] Now families of parameter sets are proposed for 16-bit, 32-bit and 64-bit cyclotomic prime moduli. These parameter families accommodate a range of security levels, mainly determined by the degree of Φm(x) and allow for a flexible trade-off between noise growth and number of slots. 1.p = Φ2(216) = 216+ 1: let m = 2jand t(x) = xk− b, with k = 2i+j−5and b = 22ifor some integers 0 ≤ i ≤ 3 and 5 ≤ j ≤ 16. 2. p = Φ10(28) = 232−224+216−28+1: let m = 5·2jand t(x) = xk−b, with k = 2i+j−4and b = 22ifor some integers 0 ≤ i ≤ 3 and 4 ≤ j ≤ 16. 3. and t(x) = xk−b, with k = 2i+j−6and b = 22for some integers 0 ≤ i ≤ 5 and 6 ≤ j ≤ 16.

[0072] For the first and third parameter family, the polynomial t(x) splits completely modulop = 1 (mod m) and the plaintext space is thus isomorphic to . Note that the method is fullyparameterizable and has a trade-off between number of slots and noise growth: a larger value of i results in larger k and b. This gives more slots but also more noise growth during multiplication, because Btincreases with b. In the extreme case where b = 2, the multiplication noise is completely dominated by the contribution inherent to the cyclotomic ring and (the Hamming weight of) the secret key distribution.

[0073] Remark 4. In zero-knowledge applications, one typically works in a quadratic or cubic field extension for the Goldilocks prime (i.e. the third parameter family) to achieve sufficient soundness. It is of course possible to mimic computations in such extension fields via Fp-arithmetic, but it is shown that with a small tweak, it is also possible to support these extension fields natively. To achieve this, one needs to look for roots of unity that live in Fpdbut not in a strict subfield. That is, one looks for small factors of pd−1 (which are not already factors of pd′−1 for some d′| d and d′< d); in particular, it suffices to consider small prime factors of Φd(p). The following augmented parameter sets are proposed. 1. To obtain a quadratic extension, one can adjoin a primitive 7-th root of unity to the cyclotomic ring (which is contained in Fp2 \ Fp). As such, the parameters are updated to m = 7·3·2jand k = 7·2i+j−6. This augmented parameter set does not satisfy the restrictions introduced above because k ∤ (m / r). The number of slots over Fp2is therefore not k / 2, but 3 · 2i+j−6.2. To obtain a cubic extension, one can adjoin a primitive 9-th root of unity to the cyclotomic ring (which is contained in Fp3\Fp). As such, the parameters are updated to m = 9·2jand k = 3·2i+j−6. The number of slots over Fp3is given by 2i+j−6.

[0074] Remark 5. In some applications, one wants to minimize the size of the ciphertext which is the result of a computation. To this end, a modulus switch can be done to the smallest ciphertext modulus q′which still allows for correct decryption. However, in the SIMD setting where a ciphertext encrypts a vector of plaintext values, it can happen that one is only interested in obtaining a ciphertext that encrypts a subset of this vector. This occurs for instance in delegating proof generation of a zkSNARK to an untrusted server. Note that the above families define a tower of cyclotomic fields indexed by the parameter j, where mj= 2 · mj−1, and that one has the natural embedding. ι : Rm→ R2m: x → x2whenever 2 | m, since Φ2m(x) = Φm(x2). Furthermore, note that this embedding also respects the definition of t(x) for a fixed i when j is replaced by j + 1. In particular, the families define compatible cyclotomic rings, but also compatible plaintext spaces. As such one can apply ring switching which allows transforming a ciphertext defined over Rm to a corresponding ciphertext over Rm / 2a(as long as m / 2a= 0 mod 2) encrypting a fraction of 1 / 2aof the original plaintext. It suffices to perform a key switch to a secret key that lives in ιa(Rm / 2a) ⊂ Rm, select the slots one is interested in using a linear transformation and finally, map to the ring Rm / 2ausing the trace function.

[0075] The following proposes a novel GBFV bootstrapping method inspired by existing bootstrapping algorithms for regular BFV. Therefore, BFV bootstrapping is first reviewed. Then novel methods are described to bootstrap single GBFV ciphertexts and batches of GBFV ciphertext, which are non-trivial adaptations of BFV bootstrapping. Historically, the “native” BGV / BFV bootstrapping approach was first studied theoretically and then implemented in HElib. Later research has shown how it can be improved by optimizing the involved polynomials and linear transformations. Below the “thin” bootstrapping workflow due to Chen and Han is described, because it will be used further in the present disclosure: 1. Evaluate a homomorphic linear transformation to map the slots of the input ciphertext to the coefficients of a different ciphertext. 2. Evaluate a homomorphic inner product to convert a noisy encryption of m to a low-noise encryption of p · m + e. 3. Evaluate a homomorphic linear transformation to map the coefficients of the ciphertext to the slots of a different ciphertext. 4. Evaluate a homomorphic digit removal polynomial to cancel the terms ei.These four steps are summarized in the flow chart below, where Encp(m) denotes an encryption of m under plaintext modulus p. For simplicity, it is assumed that the used plaintext moduli are a prime p and its square. This is sufficient for the large-p use case, but it could also be generalized to higher powers of p.

[0076] Alternatives of the native approach. Recently, there were many alternative BFV bootstrapping proposals. This includes a method to use the slots more efficiently, functional bootstrapping, and even an algorithm that uses CKKS bootstrapping as a subroutine. While finding the optimal method is an interesting research question, this invention does not intend to answer it. Instead, the native approach is used due to the improvements applied in the following.

[0077] A first (p rk with a temporary plaintext modulus of t2 (instead of p2 in the above flow chart). This approach required switching the ciphertext modulus from q to t2 right before the inner product step. This is technically possible if a ring rounding error is introduced 8 To f ten must beimplemented as an arithmetic circuit. Note that this works correctly if the norm of 1 / t is small enough (and otherwise, one can switch to ahigher power of t). Let the newly obtained ciphertext from Equation (8) be denoted by ( ). Itsregular (i.e. noninvariant) noise e = t · v + ^0+ ^1· s can be extracted asTo finish the bootstrapping, the noise needs to be extracted homomorphically, so Flatten must be implemented as an arithmetic circuit. It is noted that Flatten has a period of t, and when translated to the isomorphic space modulo p2, this period becomes p. As a result, there exists a polynomial representation of the required functionality if p is prime. However, since the interpolation space is Zp2for a possibly very large number p, the polynomial may have a huge degree of up to 2p − 1. Moreover, the large-p bootstrapping trick from Ma et al. Accelerating BGV bootstrapping for large p using null polynomials over Zpe. In: EUROCRYPT (2). Lecture Notes in Computer Science, 2024, vol.14652, pp.403–432. Springer does not seem to help here, because multiple small error coefficients are “spread” over one element of ℤp2.

[0078] To overcome the previous obstacle, a bootstrapping algorithm is proposed that uses BFV bootstrapping as a subroutine. The idea is very simple: first one converts the GBFV ciphertext to BFV, via a new method that is almost noise-free (it only adds a small ring rounding error). Then the regular BFV bootstrapping is run. Finally, the refreshed ciphertext is converted back to GBFV without additional noise. So, the remaining question is how to convert GBFV to BFV and vice versa.

[0079] Suppose one has a GBFV ciphertext as in Equation (2) and Equation (3). The reduction modulo t is made explicit by introducing an extra term: c0 + c1 · s = ∆ · (m + t · a + v). If both sides are multiplied by t / p and round one getsThis is a BFV e dom but irrelevantring element. In the other direction, suppose that one starts from a BFV ciphertext Then one simply mutp es by p / t to obta This works correctly bec

[0080] Furtherimprovements can be obtained by opening the black box from the previous section. In particular, BFV bootstrapping with a large value of p is somehow wasteful, because the available message space is not fully used. Assume from now on that p is prime and congruent to 1 modulo m, so that d = 1. An improved bootstrapping is proposed as follows: a. One starts with an encryption Enct(m1,...,mℓ′), where ℓ′denotes the number of GBFV slots (to avoid confusion, a different symbol ℓ > ℓ′is used to denote the number of BFV slots).As above, this notation means a slot-encoded encryption of m, under plaintext modulus t.In the first step, this ciphertext is converted to BFV to getb. Evaluate the first three steps from thin bootstrapping as described above. c. Convert the obtained ciphertext from BFV modulus p2to GBFV modulus t2. This step is a multiplication by (p / t)2and can be folded in the inverse linear transformation from the previous step, which saves a multiplicative level. d. Evaluate an adapted digit removal polynomial. This consists of the normal digit removal polynomial, followed by multiplication with (p / t)1(mod t), which is simply included in the same polynomial.E

[0081] These four steps are illustrated in the flowchart above. They only cover the full splitting case, which suffices for many parameter sets. For d > 1, one needs to include extra unpacking and repacking operations before and after digit removal.

[0082] Improvements over the black-box approach in terms of noise growth during digit extraction (which is typically the most depth-consuming step of bootstrapping) are presented.Remark that one now works with plaintext modulus t2, which has much smaller norm than p2for typical parameter sets. Consequently, one gets the beneficial multiplication noise growth as described before. This crucial improvement allows for the use of a smaller ring dimension of n = 214than prior work.

[0083] The following proposes one more method to exploit the unused part of the message space. When multiple GBFV ciphertexts are bootstrapped simultaneously, they can be packed together during the linear transformations. It is assumed once more that p is prime and that it does not divide m. To facilitate the packing step, additionally a plaintext space with binomial modulus isassumed as treated before. A maximum of n / k GBFV ciphertexts can be packed in one BFV ciphertext, where n is the ring dimension and k is the degree of t(x).

[0084] To ease the notation, let us write 6 = p / t £ R as before. We are given a set of encryptions Enct(m,j for 1 ≤ z ≤ n / k. These ciphertexts are equal toThis identity can be seen by expanding the ciphertexts using Equation (2) and multiplying by 6. Consider the subset of the automorphismswhich forms a system of representatives for the quotient group Gal(K / Q) / G. Packing homomorphically computeswhere the inverse of 6 is defined modulo t. To unpack the / -th message, one simply applies the inverse of and uses the BFV-to-GBFV conversion routine. Packing costs one multiplicative BFV level and n / k automorphisms, whereas unpacking only requires the same number of automorphisms.

[0085] The correctness of the above procedure can be shown as follows. First of all, the inverse of o(i) is written as o(-i). Then we need to show thatIf / = j, both automorphisms cancel and the remaining term is 6"16-mv, which is congruent to mvmodulo t. All other terms will disappear completely modulo t, because owand ayiare in different cosets of Gal(K / Q) / G. More specifically, it can be seen by the following lemma that CT^tc / '^d)) is divisible by t.

[0086] Lemma 10. Let o / G G be an automorphism of the cyclotomic number field K, then o(P) is divisible by t in R under the conditions stated above.Proof. The congruence number p is divisible by t and o(t) (because the division results are 6 and o(6) respectively). So, if it can be shown that the greatest common divisor of t and o(t) is 1, then o(6) = p / o(t) is divisible by t and we are done.Consider o; x -> x', then Lemma 9 implies that(mod m / k). Define the idealand let t(x) = x* - b. Clearly p G I and also b' - b is in I because it is the reduction of o(t) modulo t. It was proven earlier that the multiplicative order of b modulo p is equal to m / k. In combination with the fact that i / = 1 (mod m / k), one finds that b'-b is not divisible by p. But as p is prime, it must be coprime to b'- b in TL, so 1 G I by Bezout's identity.The steps for batch bootstrapping are described below. The workflow is very similar to the steps illustrated before, except that the conversion steps are replaced by packing and unpacking. Note that the packing multiplication by β−1can be folded in the digit removal polynomial. The choice of doing unpacking before digit extraction, and not after digit extraction, is a design decision that reduces the noise growth. The GBFV scheme is implemented on top of the Microsoft SEAL library. Unfortunately, SEAL is restricted to power-of-two cyclotomic rings, which makes it impossible to implement the second recommended parameter set. However, there are two good reasons why to opt for SEAL: first, it supports the BFV scheme, which uses a GBFV-compatible “most significant bit” encoding. As a result, the implementation can be conveniently generalized to GBFV. Moreover, the choice for SEAL allows extending the BFV bootstrapping implementation from GEELEN, Revisiting the slot-to-coefficient transformation for BGV and BFV. Cryptology ePrint Archive, 2024, Paper 2024 / 153, to GBFV. Note that other work also implements bootstrapping, but in HElib and only for the BGV scheme.

[0087] In contrast to prior works about BGV / BFV, we are able to use a small ring dimension of n = 214at 128-bit security, while still being able to pack a relatively large number of at least 1024 slots. This small ring dimension is enabled by the reduced multiplication noise of digit removal: since there is less noise growth, one can work with smaller q and n at constant security level. To the best of our knowledge, the only other method that can use ring dimension n = 214(apart from the FHEW / TFHE branch) is BLEACH. However, this scheme can only pack bits (whereas 16-bit numbers are packed), has a more expensive addition (i.e. XOR gate) and its bootstrapping has few remaining multiplicative levels.

[0088] The BFV bootstrapping implementation from Geelen, Revisiting the slot-to-coefficient transformation for BGV and BFV. Cryptology ePrint Archive, 2024, Paper 2024 / 153 was augmented with sparse secret encapsulation. The benchmarks in this section use similar parameters as BLEACH bootstrapping: one takes n = 214, a modulus q ≈ 2420and a ternary secret key distribution withHamming weight h = 256. The sparse key has Hamming weight h˜ = 32 and the noise cut-off parameter is set to B = 15 for negligible failure probability. the prime p = 216+ 1 from the first recommended parameter family is used. Similarly to BFV bootstrapping, 15 bits were subtracted from the initial and remaining noise budget to enable subdomain interpolation of the noise over [−B,B] ∩ ℤ. The paragraphs below show experiments for single and batch bootstrapping operations. All experiments were conducted with single-threaded Microsoft SEAL version 4.1 on an Intel®Xeon®Gold 6248R CPU with 500 GB memory and Ubuntu 22.04.3 LTS. The shown noise budget is the one reported by Microsoft SEAL and is always normalized to p. It does not necessarily correspond to the invariant noise.

[0089] Experiments for single bootstrapping: Bootstrapping results for individual ciphertexts are given in Table 1. A 2-stage decomposition of the linear transformations in partial thin bootstrapping was applied. The first recommended parameter family was used, which has ℓ′= k GBFV slots. The trade-off between number of slots and noise growth is clear from the table: the number of slots increases gradually from left to right column, while the remaining noise budget decreases.

[0090] Increasing the number of slots to 16384 (which would coincide with regular BFV) is not possible for this parameter set because the remaining noise budget would be negative. The total bootstrapping execution time is the lowest number ever demonstrated for BFV-like schemes. In particular, the recent work from Ma et al. Accelerating BGV bootstrapping for large p using null polynomials over Zpe. In: EUROCRYPT (2). Lecture Notes in Computer Science, 2024, vol. 14652, pp. 403–432. Springer obtained bootstrapping in 20 seconds, which is 4 times slower.

[0091] Experiments for batch bootstrapping. Similarly, also results for batch bootstrapping were generated in Table 2. The displayed number of slots reflects an individual ciphertext (the number of slots for a full batch is always 16384). The latency of single bootstrapping is lower than in a batch bootstrapping. This is because multiple digit removal polynomials need to be evaluated. However, the throughput (number of bootstrapped slots times remaining capacity divided by total execution time) of Table 2 is generally much higher than the corresponding column in Table 1 since partial thin bootstrapping is only evaluated once for the entire batch. The notable exception to this is the rightmost column, where the remaining noise budget of batch bootstrapping is less than a multiplicative level.

[0092] or the 64- bit Goldilocks prime, which leads to even more noise reduction than the 16-bit Fermat prime. Table 3 shows the estimated noise growth for m = 3 · 216(which corresponds to ring dimension n = 216) and q ≈ 21680. The results were estimated, because SEAL only supports power-of-two cyclotomics. A 3-stage decomposition of the linear transformations was applied for all columns. The table indicates that BFV bootstrapping has very little remaining noise budget (less than a multiplicative level, so it is technically not bootstrappable for the chosen ring dimension). Contrarily, GBFV has plenty of remaining capacity for further homomorphic operations.

[0093] We believe that the smaller ring dimension of GBFV bootstrapping will also facilitate implementations. For example, one can use substantially smaller keys and work with smaller batches of encrypted numbers. This speeds up applications where few plaintext slots are required.

[0094] While the invention has been illustrated and described in detail in the drawings and foregoing description, such illustration and description are to be considered illustrative or exemplary and not restrictive. The foregoing description details certain embodiments of the invention. It will be appreciated, however, that no matter how detailed the foregoing appears in text, the invention may be practiced in many ways. The invention is not limited to the disclosed embodiments.

[0095] Other variations to the disclosed embodiments can be understood and effected by those skilled in the art in practicing the claimed invention, from a study of the drawings, the disclosure and the appended claims. In the claims, the word “comprising” does not exclude other elements or steps, and the indefinite article “a” or “an” does not exclude a plurality. A single processor or other unit may fulfil the functions of several items recited in the claims. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage. A computer program may be stored / distributed on a suitable medium, such as an optical storage medium or a solid-state medium supplied together with or as part of other hardware, but may also be distributed in other forms, such as via the Internet or other wired or wireless telecommunication systems. Any reference signs in the claims should not be construed as limiting the scope.

Claims

Claims1. A computer-implemented method for homomorphically encrypting general plaintext spaces with controlled noise growth, comprising:- defining a general plaintext space by selecting a polynomial t(x) of degree greater than 1, and defining the plaintext space as , where f(x) and t(x) are polynomials;- applying an encoding method on a message m and producing a corresponding element in the plaintext space Rt;- applying a homomorphic encryption method that takes the encoded message as input and returns a ciphertext that encrypts the message;- providing a decryption method that takes the ciphertext as input and returns the decoded plaintext;- applying a method to homomorphically process encrypted messages by evaluating an arithmetic circuit representing the function to be evaluated, wherein the noise growth during homomorphic operations is determined by the size of t(x); and applying a method to refresh ciphertexts via bootstrapping, which consists of homomorphically processing the decryption circuit.

2. The method according to Claim 1, wherein the polynomials f(x) and t(x) are chosen such that the plaintext space Rtdecomposes into a direct product of k smaller plaintext spacesallowing for encryption of a vector of elements, where the i-th element of the vector is an element of3. The method according to the previous Claim, wherein some of the plaintext spaces areidentical, further comprising a method to permute elements residing at indices i where the plaintext spaces are identical, by exploiting automorphisms <r of the ring such that tR is invariantunder σ.

4. The method according to Claim 2, wherein a sequence of compatible plaintext spaces Rtfor i = 1 to k is used, connected by ring embeddings , further comprising a method to take aciphertext encrypting a plaintext Rt. and deriving a valid ciphertext encrypting a portion of the original plaintext, interpreted as an element of5. The method according to Claim 1, wherein f(x) and t(x) are chosen such that the plaintext spaceRtis equivalent tofor some integer n and polynomial t'(x), where t'(x) is the greatest common divisor of f(x) and t(x) module n.

Images