Homomorphic computation on ciphertexts encrypting multiple messages

Abstract

Some embodiments are directed to a cryptographic method for homomorphic computation The method works on multiple messages encrypted in a single packed GLWE or GLWR ciphertext. The packed GLWE or GLWR ciphertext comprises a mask and a body. Each value in the body is associated with a different secret key and corresponds to a message in the multiple messages. Various homomorphic operation can be performed on the packed GLWE or GLWR ciphertext.

Description

[0001] HOMOMORPHIC COMPUTATION ON CIPHERTEXTS ENCRYPTING MULTIPLE MESSAGES TECHNICAL FIELD The presently disclosed subject matter relates to cryptographic, computer- implemented method for homomorphic computation, a system for homomorphic computation, and computer-readable media. BACKGROUND The encryption phase of contemporary homomorphic encryption schemes still results in significant data expansion and computationally expensive operations. There have been attempts to remedy this by packing multiple messages in a single encryption. For example, some fully homomorphic encryption (FHE) schemes, such as CKKS [6], natively support Single Instruction, Multiple Data (SIMD) operations. Forother schemes, such as BGV [7], FV [8], and B / FV [Bra12], packing techniquessupporting SIMD operations have been developed [9]. These optimizations enable users to achieve improved amortized runtimes. In TFHE, see, e.g., [CGGI20], however, the structure of operations does not align with SIMD packing; see also FHEW in [4] which is a type of TFHE. Specifically, TFHE requires handling Learning With Errors (LWE) ciphertexts, although Generalized LWE (GLWE) ciphertexts are used internally in some algorithms, such as in the Programmable Bootstrapping (PBS). In contrast, BGV, FV, B / FV, and CKKS rely directly on GLWE ciphertexts, which allow for the reuse of the same mask randomness (k·N integers) across N messages. TFHE lacks a variant of bootstrapping that relies solely on GLWE ciphertexts, thereby preventing the exploitation of these more compact ciphertexts. The straightforward packing solution in TFHE involves using a packing key- switching technique to pack LWE samples into a GLWE structure. Similar to BGV, FV,B / FV, and CKKS, this allows the reuse of the same mask randomness. However, on thisGLWE structure, only linear operations can be performed. To execute a PBS, one must first extract each message from the GLWE ciphertext back into LWE format through several sample extractions, perform PBS on each LWE ciphertext individually, and then repack them into a single GLWE using the packing key-switching process once more. While TFHE bootstrapping achieves low latency, improving its throughput remains an active area of research. Advancements in this area would enable TFHE to support amortized computations, which is particularly advantageous in real-world applications where batch processing is feasible, such as in neural network evaluations using FHE. SUMMARY It would be advantageous to have an improved ciphertext type that supports packing of multiple messages in a single ciphertext. A cryptographic, computer-implemented method for homomorphiccomputation, a system for homomorphic computation, and computer-readable media aredescribed in the accompanying claims. Specific embodiments of the invention are set forth in the dependent claims. Some embodiments are directed to a cryptographic method for homomorphiccomputation. The method works on multiple messages encrypted in a single packedGLWE ciphertext. The packed GLWE ciphertext comprises a mask and a body. Eachvalue in the body is associated with a different secret key and corresponds to a messagein the multiple messages. Various homomorphic operation can be performed on the packed GLWE ciphertext. The encryption phase of contemporary homomorphic encryption schemes still leads to a significant data expansion and computationally expensive operations. To mitigate these properties of homomorphic encryption, techniques have been developed to pack multiple messages into one ciphertext, such that one homomorphic operation operates on multiple messages at the same time. Embodiments use a new ciphertext format that allows to encode and encrypt multiple messages into one ciphertext. All homomorphic operations of the traditional TFHE scheme and its variants can be used with this new ciphertext format. In comparison with traditional packing methods that use the ring learning with error format, the packing format of this invention offers more flexibility. Homomorphic computation systems are electronic, and may comprise one or more electronic devices, in particular one or more computers. An aspect of the invention is a computation method. An embodiment of the method may be implemented on a computer as a computer implemented method, or in dedicated hardware, or in a combination of both. Executable code for an embodiment ofthe method may be stored on a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Preferably, the computer program product comprises non- transitory program code stored on a computer readable medium for performing an embodiment of the method when said program product is executed on a computer. In an embodiment, the computer program comprises computer program code adapted to perform all or part of the steps of an embodiment of the method when the computer program is run on a computer. Preferably, the computer program is embodied on a computer readable medium. Another aspect of the presently disclosed subject matter is a method of making the computer program available for downloading. For example, a method according to the embodiment may comprise uploading the computer program to a server, enabling the computer program to be downloaded from this server, and facilitating the download of the computer program from the server. BRIEF DESCRIPTION OF DRAWINGS Further details, aspects, and embodiments will be described, by way of example only, with reference to the drawings. Elements in the figures are illustrated for simplicity and clarity and have not necessarily been drawn to scale. In the figures, elements which correspond to elements already described may have the same reference numerals. In the drawings, Figure 1a schematically shows an example of an embodiment of a homomorphic system, Figure 1b schematically shows an example of an embodiment of a homomorphic system, Figure 2 schematically shows an example of an embodiment of a packed GLWE ciphertext, Figure 3 schematically shows an example of an embodiment of a packed GGSW ciphertext, Figure 4 shows a graph comparing amortized cost of embodiments,Figure 5 schematically shows an example of an embodiment of a method forhomomorphic computation, Figure 6a schematically shows a computer readable medium having a writablepart comprising a computer program according to an embodiment, Figure 6b schematically shows a representation of a processor systemaccording to an embodiment. Reference signs list The following list of references and abbreviations corresponds to figures 1a-3, 6a-6b, and is provided for facilitating the interpretation of the drawings and shall notbe construed as limiting the claims.100, 102 a homomorphic system110 a homomorphic computation system110.1, 110.2 a homomorphic computation system120 a client system111, 121 a processor system112, 122 storage113, 123 communication interface172 a computer networka packed GLWE ciphertext210 a mask211-223 values taken from a ring220 a body221-223 values taken from a ring231-233 a masking operation240 multiple secret keys241-243 a secret key241.1-243.3 a secret key value250 multiple messages251-253 a message300 a packed GGSW ciphertext310 a key correction part320 a message correction part311-313 a packed GLev ciphertext321-323 a packed GLev ciphertext350 multiple messages351-353 a message1000, 1001 a computer readable medium1010 a writable part1020 a computer program1110 integrated circuit(s)1120 a processing unit1122 a memory1124 a dedicated integrated circuit1126 a communication element1130 an interconnect1140 a processor systemDESCRIPTION OF EMBODIMENTS While the presently disclosed subject matter is susceptible of embodiment in many different forms, there are shown in the drawings and will herein be described in detail one or more specific embodiments, with the understanding that the present disclosure is to be considered as exemplary of the principles of the presently disclosed subject matter and not intended to limit it to the specific embodiments shown and described. In the following, for the sake of understanding, elements of embodiments are described in operation. However, it will be apparent that the respective elements are arranged to perform the functions being described as performed by them. Further, the subject matter that is presently disclosed is not limited to the embodiments only, but also includes every other combination of features described herein or recited in mutually different dependent claims. Fully Homomorphic Encryption (FHE) is a family of encryption schemes allowing computations to be performed over encrypted data. FHE schemes use noisy ciphertexts for security reasons, e.g., ciphertexts containing some randomness. This noise grows after every homomorphic operation, and, if not controlled, it can compromise the message and prevent correct decryption. A technique called bootstrapping, e.g., see [1], allows noise reduction when it grows too large, using a public key, sometimes called the bootstrapping key. By using bootstrapping frequently to reduce noise, an arbitrary number of homomorphic operations can be performed. Unfortunately though, bootstrapping remains expensive in terms of both execution time and memory usage. The noise of a freshly encrypted ciphertext is a small random value drawnfrom a given distribution ^(^) parametrized by a parameter ^ and added to the messageduring encryption. Whenever operations are performed over ciphertexts, the randomness which is part of the ciphertexts is modified as a side effect. The relationship between the input noise and the output noise of an operation is modeled by what is referred to as a noise formula, e.g., a formula modeling and / or describing the evolution of noise during the computation of the operation. For convenience, it is assumed herein that the distribution ^ is a centeredNormal distribution with a standard deviation ^. Note however, that it could be extended to other noise distributions. For example, the distribution may be a uniform noise distribution. During operations over ciphertexts, the distribution of the noise inside a ciphertext typically changes. When it is stated that a sample contains more noise than another, this means that the noise inside the ciphertext is drawn from a normal distribution with a larger standard deviation. The TFHE scheme, see e.g., [2], [3], [4], distinguishes itself from other FHEschemes by supporting an efficient bootstrapping. The term TFHE-like schemes refers tofully homomorphic encryption schemes that include a bootstrapping algorithm, capableof taking as input a ciphertext and outputting a ciphertext of the same message withreduced noise and programmable meaning that a univariate function can be evaluatedsimultaneously as the noise is being reduced. This is referred to as Programmable bootstrapping (PBS). For example, the bootstrapping algorithm may evaluate the homomorphicdecryption of the input ciphertext in the exponent of a polynomial. The bootstrapping typically comprises 3 steps: Modulus switching (MS)Blind rotation, (BR) Sample extraction, (SE) In an embodiment, a TFHE PBS outputs a ciphertext with an amount a noiselevel, or noise level, independent of the input ciphertext noise.The algorithms described herein may use several parameters. In experimentsthat were conducted, the LWE dimension (^) took a wide range of values: from 400(small precision) to 2048 (big precision, corresponding to approximately 20 bits). Thepolynomial size (^) took power-of-two values between 2^and 2^^. Note that other valuesthat are not a power of 2 are also possible. The GLWE dimension (^) was between 1 and6. The decomposition log base (^) and the level (ℓ) took values between 1 and 64; forexample, one may take the product of log base (^) and level (ℓ) to be equal to thelogarithm of the ciphertext modulus. Ciphertexts encrypted using contemporary homomorphic encryption schemes tend to be significantly larger than the plaintext they encrypt. Understanding the bandwidth limits of homomorphic encryption is not only theoretically interesting but also practical, as a high-rate homomorphic encryption scheme would benefit several applications, such as private information retrieval. One example of a high-rate homomorphic encryption scheme is the one proposed by Damgård and Jurik

[0010] . However, the Damgård-Jurik cryptosystem is only additively homomorphic, relatively expensive, and insecure against quantum computers. Methods for compressing GSW ciphertexts have been described in

[0011] ,

[0012] . However, the compressed format is no longer a GSW ciphertext and supports onlyadditive homomorphic operations and multiplication with a small, encrypted scalar.Another scheme

[0013] constructs a rate-1 FHE scheme, but like

[0011] , this scheme is not fully homomorphic. This scheme can be designed to support a predetermined number of homomorphic operations, but the compressed format remains a leveled homomorphic encryption scheme. The present disclosure introduces a compressed format that allows PBS operations and is thus fully homomorphic in the compressed format. Figure 1a schematically shows an example of an embodiment of ahomomorphic computation system 110 and of an embodiment of a client system 120. Homomorphic computation system 110 and client system 120 may be part of a homomorphic system 100. For example, homomorphic system 100 may be used in scenarios where data privacy is important, such as in cloud computing environments where sensitive data needs to be processed without revealing its contents to the computation system. Homomorphic computation system 110 is configured to perform homomorphic operations on encrypted data. Specifically, it is designed to receive one or more packed ciphertexts that each encrypt multiple messages. These packed ciphertexts are typically lattice-based and may comprise noise. In particular, the packed ciphertexts may be based on the Learning With Errors problem or the Ring Learning With Errors problem, also known as the General Learning With Errors problem. The packed ciphertext may comprise multiple elements, which may be taken from some ring, e.g., an integer or polynomial ring. The packed ciphertexts may also be based on the Learning with Rounding problem. The system can perform homomorphic operations on packed ciphertexts, operating on multiple messages simultaneously. Client system 120 is configured to encrypt plaintext messages into one or more packed ciphertexts and send them to homomorphic computation system 110. Client system 120 may also generate and send auxiliary key material that computation system 110 might need to perform homomorphic operations on the packed ciphertexts, e.g., key switching keys and the like. Client system 120 is configured to receive encrypted results from computation system 110, and decrypt the results. Homomorphic computation system 110 is configured to perform various homomorphic operations on packed ciphertexts. The packed ciphertexts may be obtained from client system 120, or they may be the result of homomorphic operations, e.g., the packed ciphertexts may be intermediate results. The homomorphic operations for which homomorphic computation system 110 is configured may include one or more of thefollowing non-limited list:1. Scalar multiplication of the packed ciphertext 2. Computing linear combinations of multiple packed ciphertexts 3. Performing modulus switches 4. Evaluating lookup tables on the multiple messages, including the ability to apply different lookup tables to different messages within the same packed ciphertext 5. Reducing noise for the multiple messages encrypted in the packed ciphertext 6. Computing external products on a packed ciphertext 7. Executing packed conditional multiplication (cmux) operations 8. Performing key switches 9. Homomorphically permuting the multiple messages encrypted in the packed ciphertext 11. Performing secret homomorphic linear operations by computing linear combinations of messages in single or multiple packed ciphertexts This system allows for secure computation on sensitive data without revealing the underlying information to the computing party, thereby maintaining data privacy and confidentiality throughout the computation process. The ability to perform various operations on packed ciphertexts, including lookup table evaluations, noise reduction, secret permutations, and secret linear operations directly on packed ciphertexts can improve the efficiency of the system. Homomorphic computation system 110 may comprise a processor system 111, a storage 112, and a communication interface 113. Client system 120 may comprise a processor system 121, a storage 122, and a communication interface 123. In the various embodiments of communication interfaces 113 and / or 123, the communication interfaces may be selected from various alternatives. For example, the interface may be a network interface to a local or wide area network, e.g., the Internet, a storage interface to an internal or external data storage, an application interface (API), etc. Storage 112 and 122 may be, e.g., electronic storage, magnetic storage, etc. The storage may comprise local storage, e.g., a local hard drive or electronic memory. Storage 112 and 122 may comprise non-local storage, e.g., cloud storage. In the lattercase, storage 112 and 122 may comprise a storage interface to the non-local storage.Storage may comprise multiple discrete sub-storages together making up storage 112 and 122. Storage 112 and / or 122 may be non-transitory storage. For example, storage 112 and / or 122 may store data in the presence of power such as a volatile memory device, e.g., a Random Access Memory (RAM). For example, storage 112 and / or 122 may store data in the presence of power as well as outside the presence of power such as a non- volatile memory device, e.g., Flash memory. Storage may comprise a volatile writable part, say a RAM, a non-volatile writable part, e.g., Flash. Storage may comprise a non- volatile non-writable part, e.g., ROM. The systems 110 and 120 may communicate internally, with each other, with other devices, external storage, input devices, output devices, and / or one or more sensors over a computer network. The computer network may be an internet, an intranet, a LAN, a WLAN, a WAN, etc. The computer network may be the Internet. The systems 110 and 120 may comprise a connection interface which is arranged to communicate within homomorphic system 100 or outside of homomorphic system 100 as needed. For example, the connection interface may comprise a connector, e.g., a wired connector, e.g., an Ethernet connector, an optical connector, etc., or a wireless connector, e.g., an antenna, e.g., a Wi-Fi, 4G or 5G antenna. The communication interface 113 may be used to send or receive digital data, e.g., packed ciphertexts for homomorphic computation. The communication interface 123 may be used to send or receive digital data, e.g., plaintext data to be encrypted into packed ciphertexts or encrypted results to be decrypted. Homomorphic computation system 110 and client system 120 may have a user interface, which may include well-known elements such as one or more buttons, a keyboard, display, touch screen, etc. The user interface may be arranged for accommodating user interaction for performing tasks such as initiating homomorphic computations on packed ciphertexts or viewing decrypted results. The execution of systems 110 and 120 may be implemented in a processor system. The systems 110 and 120 may comprise functional units to implement aspects of embodiments. The functional units may be part of the processor system. For example, functional units shown herein may be wholly or partially implemented in computer instructions that are stored in a storage of the device and executable by the processor system. The processor system may comprise one or more processor circuits, e.g., microprocessors, CPUs, GPUs, etc. Systems 110 and 120 may comprise multiple processors. A processor circuit may be implemented in a distributed fashion, e.g., as multiple sub-processor circuits. For example, systems 110 and 120 may use cloud computing. Typically, the homomorphic computation system 110 and client system 120 each comprise one or more microprocessors which execute appropriate software stored at the device; for example, that software may have been downloaded and / or stored in a corresponding memory, e.g., a volatile memory such as RAM or a non-volatile memory such as Flash. Instead of using software to implement a function, the systems 110 and 120 may, in whole or in part, be implemented in programmable logic, e.g., as field- programmable gate array (FPGA). The systems may be implemented, in whole or in part, as a so-called application-specific integrated circuit (ASIC), e.g., an integrated circuit (IC) customized for their particular use. For example, the circuits may be implemented in CMOS, e.g., using a hardware description language such as Verilog, VHDL, etc. In particular, homomorphic computation system 110 and server 120 may comprise circuits, e.g., for cryptographic processing, and / or arithmetic processing. In hybrid embodiments, functional units are implemented partially in hardware, e.g., as coprocessors, e.g., cryptographic coprocessors, and partially in software stored and executed on the device.Figure 1b schematically shows an example of an embodiment of ahomomorphic system 102. System 102 may comprise multiple client systems; shown are homomorphic computation system 110.1 and 110.2. Homomorphic system 100 may comprise multiple computation systems, shown is computation system 120. The systems are connected through a computer network 172, e.g., the Internet.The homomorphic computation systems 110 and client system 120 may be according toan embodiment. Below, an example of a packed ciphertext is disclosed, which can be used for homomorphic computation. Figure 2 schematically shows an example of an embodiment of a packedGLWE ciphertext 200. A packed GLWE ciphertext is also referred to as a PACK-GLWEciphertext. In this document, we focus on extending GLWE but we could also extend (G)LWR [BPR12], everything presented next works immediately with (G)LWR, the onlydifference lies in the encryption algorithm which leverage a modulus switch to create therandomness in the ciphertext instead of explicitly adding noise to the body.Packed ciphertext 200 encrypts multiple messages 250 in a single packed GLWE ciphertext 200. Shown here are messages 251, 252, and 253 in multiple messages 250; there may be two messages or more than 3 messages instead. Packed ciphertext 200 comprises a mask 210 and a body 220. Mask 210 and a body 220 each comprise multiple values, taken from a finite ring. Typically, the ring iseither also referred to a ℤ / ^ℤ or ℤ^[^] / (^^ + 1)), also referred to as ℜ^,^.. Here ^may be a power of 2, e.g., 2^^ or 2^^. It is not necessary for ^ to be a power of 2,although this a convenient choice. Here ^ is a parameter, e.g., 1024.Note that we define everything on but we could have defined everythingon the torus T / ℤ . It is made possible because there is an isomorphism between and .The sizes of mask 210 and body 220 do not need to be equal, and typically arenot. For example, for packed LWE the number of values in mask 210 is usually higherthan the number of values in body 220. For example, a usual size for the mask for a packedLWE ciphertext is between 800-1000—though both larger and smaller masks are possible. For a packed GLWE on the other hand, the size of the mask is usually between 1 and 4—again larger sizes being possible. In both cases, the size of the body will be at least 2, and typically at most 20—although larger body sizes are possible, and may in fact be preferred for some applications. Figure 2 shows values 211, 212, and 213 in mask 210, and values 221, 222, and 223 in body 220. The number of values in body 220 is equal to the number of messages 250 that are in the packed ciphertext. For example, packed ciphertext 200 may be represented as a vector or array, e.g., by concatenating the values in mask 210 and body 220. For example, the packedGLWE ciphertext may be represented as (^^, ⋯ , ^^, ^^, … , ^^), comprising a mask(^^, ⋯ , ^^) and a body (^^, … , ^^). As shown body 220 has body values 221, 222, and223, while mask 210 has mask values 211, 212, and 213. Body and / or mask can havemore than 3 values. The body could have two values. The mask could have 1 or 2 values. Each value in the body is associated with a different secret key and corresponds to a different message in the multiple messages. As shown in figure 2, body value 221 corresponds to secret key 241, and message 251; body value 222 corresponds to secret key 242, and message 252; body value 223 corresponds to secret key 243, and message 253. The secret keys have the same length as mask 210, with values taken from the ring. In some embodiments additional restrictions are placed on secret key values, e.g.,only binary, or ternary values, or values selected from a distribution, e.g., Gaussiandistribution. A value in the body is obtained from masking the corresponding message with the mask 210 and the associated secret key. The same mask is used to mask the multiplemessages. For example, using mask 210 and the associated secret key, a masking valuemay be computed, typically as the dot product of a key and mask 210. The masking value is added to an encoding of the message to which noise is also added. A small amount of noise is important to avoid the system from being fully linear. Encoding of the message is typically done by taking a multiple of the message, e.g., by multiplying with a power of 2. For example, a packed GLWE ciphertext for multiple messages ^^, ... , ^^encrypted under keys ^ = (^^, … , ^^) may be defined as a set of values, e.g., a vector, wherein^^ ∈ ℜ^,^ is a polynomial of noise terms^^ ∈ ℜ^,^ is a polynomial of the mask^^ ∈ ℜ^,^ is a polynomial secret key having polynomials ^^,^ for 1 ≤ ^ ≤ ^.The polynomial of noise terms may be drawn from a noise distribution, suchas a Gaussian distribution. Instead of adding a noise polynomial, one could use a learning with rounding type ciphertext. For example, a packed GLWR ciphertext for multiple messages ^^, ... , ^^encrypted under keys ^ = (^^, … , ^^) may be defined as a packed GLWE ciphertext withpolynomials defined on with q^ > q on which we apply a modulus switch to castthe polynomials from into ℜ^,^ i.e, we apply x: → Round(^ ^^x) on each coefficientof each polynomial in the body, and optionally also in the mask. If one chooses on q′ correctly, the noise introduced by the modulus switch is big enough for the security to hold and after a correct encryption. For example, one may obtain a GLWR ciphertext by starting with ^, wherein the Round function is applied to all coefficients of ^^, and optionally also toall coefficients ^^. After this operation the elements in the GLWR ciphertext are elementsof ℜ^,^. Apacked GLWR ciphertext is indistinguishable from a packed GLWEciphertext. Accordingly, all the operations defined herein for packed GLWE ciphertextsmay also be applied to a packed GLWR ciphertext. A packed GLWR ciphertext is compatible with a packed GGWS ciphertext, as further expanded below. Here the messages are encoded to allow later decryption in the presence ofnoise. That is, messages are encoded values of the true messages. Forexample, one way to encode a message is to select them from a subset andmultiply them with a multiplier △, e.g., add △ ^^ in the above formula for the body,wherein the message is chosen from a message space, which is a subspace of Other known encoding types known from the art can be applied here. An important type of packed GLWE ciphertexts is wherein the polynomialshave degree zero. This corresponds to taking the exponent ^ = 1, in the definition ofIn this case the various values may be taken from a non-polynomial ring, e.g., e.g., the values in the secret key ^^,^, the values in the mask ^^, the values in the body, etc. The inventors realized that the security implied by the Learning With Errors problem or the more general Ring Learning With Errors problem, also known asGeneralized learning with errors, can be extended to packed GLWE values, in particularif the keys used for the different messages are different, e.g., independently selected from the key distribution. The inventors note that a specific embodiment, one could allow a relationshipbetween the keys ^^, … , ^^ and thus reduce the amount of key material. For example, onecould select a random seed and generate the keys therefrom, e.g., using a key derivation function. Preferably, a cryptographically secure key derivation function is used. However, generally speaking a relationship between keys could reduce the security of the system, and accordingly, it is preferred to select the keys independently, e.g., by random or pseudorandom selection. In case pseudorandom selection is used, preferably, a cryptographically secure random number generator is used. The inventors realized that packed ciphertexts, in particular packed GLWEciphertexts, are suitable for performing a homomorphic operation, that can act on themultiple messages at the same time. A homomorphic operation performs a mathematical transformation or function directly on encrypted data in such a way that the operation carried out on the ciphertexts results in an encrypted form of the output of the corresponding operation on the plaintexts. Note that the operation is applied to all the encrypted messages simultaneously in a single computational step, rather than being performed on eachmessage individually. Conventionally, a homomorphic operation would be performed oneach encrypted message separately, on a per-message basis, with each message undergoing an individual transformation. In an embodiment, however, the homomorphic operation acts directly on the group of messages in a single step, treating the group as a whole rather than as discrete units. Furthermore, the group of body values corresponding to each message is associated with only a single mask. In an embodiment, the homomorphic operation computes on one mask for the whole body instead of separatemasks for each message / body value.The homomorphic operation does not need access to the plaintext version of the messages, nor to the secret keys 240 that were used to encrypt them, although auxiliary key material may be used in the homomorphic operations, e.g., key switching keys and the like. The auxiliary key material may be produced by a device with access to keys 240, e.g., client system 120. For example, the homomorphic operation may comprise computing a scalarmultiple of the packed GLWE ciphertext, e.g., a public integer scalar ^ multiplied witheach encrypted message. This can be done by multiplying each of the values in mask and body with the scalar. Another homomorphic operation that can be extended to a packed GLWE is computing a linear combination of the multiple packed GLWE ciphertexts. In particular, two or more packed GLWE ciphertexts can be added or subtracted by adding or subtracting component wise. Another important operation that extends to packed ciphertexts such as these is the modulus switch, wherein each of the values in the maskand body are scaled. For example, the scaling may be performed on elements in eithere.g., because the packed GLWE ciphertext values is non-polynomial, or on the polynomial coefficient taken from ℤ^. Typically, the scaling is performed from a larger power of 2 to a smaller power of 2. However, more advanced homomorphic operations can be extended to packed GLWE ciphertexts as well. As further discussed herein, the inventors have demonstrated that a wide range of homomorphic operations can be applied to packed GLWE ciphertexts, leveraging the advantages that packing multiple messages in one ciphertext brings. These operations include both transformations, such as scalar multiplication and linear combinations, as well as more complex processes, such as evaluating lookup tables or performing noise reduction across multiple messages. Additionally, advanced operations like external products and key switches are also feasible with packed GLWE ciphertexts, even without requiring access to theplaintexts or secret keys used for encryption. For external products, a packed GLWEciphertext may be multiplied with a packed GGSW ciphertext. A key switch, also referred to as a PACK-key switch, takes as input a packed GLWE ciphertext and outputs a packed GLWE ciphertext, using auxiliary key switching keys. The output packed GLWE ciphertext encrypts the same multiple messages as the input packed GLWE ciphertext but under a different key as indicated by the auxiliary key switching keys. The latter is a very useful operation to have in a homomorphic computation system. Aparticularly interesting operation, which is particularly possible for apacked ciphertext but not for an unpacked sequence of ciphertexts for the corresponding messages is homomorphic permutations. In a homomorphic permutation, the messages are permuted according to a secret permutation unknown to the homomorphic computation system. Another operation specific for packed ciphertexts such as these are secretlinear operations. Here, a linear operation that acts on multiple messages ishomomorphically performed. In this case, not only the data that is operated upon remains secret to the computation system, but also the particular homomorphic operation that is performed. This is advantageous as linear operations, such as matrix multiplications, are used in neural networks, and this helps keep the neural network weights secret from the computation network. Embodiments of another type of packed ciphertext are described with reference to figure 3. Figure 3 schematically shows an example of an embodiment of a packedGGSW ciphertext 300. Having a packed GGSW ciphertext is important as it allowsexternal products. This in turn allows the construction of a cmux, programmablebootstrapping, and the like.Shown in figure 3 is a packed GGSW ciphertext 300. Packed GGSWciphertext 300 encrypts multiple messages 350, so that they can be multiplied in anexternal product with multiple messages encrypted in a packed GLWE ciphertext. For example, a packed GLWE ciphertext 200 encrypting messages 250 could be externally multiplied with a packed GGSW ciphertext 300 encrypting messages 350. In the special case of an external product in a bootstrapping, both packed GLWE ciphertext 200 and packed GGSW ciphertext 300 are encrypted with the same multiple keys 240, though in a different manner, in the general case there is no such restriction. Packed GGSW ciphertext 300 comprises two parts, loosely called, a keycorrection part 310 and a message correction part 320. Key correction part 310 is chosento ensure that secret key terms cancel in the external product, while the messagecorrection part 320 ensures a correct result is still achieved.Ciphertext 300, in particular parts 310 and 320, comprises multiple packedGLev ciphertexts. For key correction part 310, packed GLev ciphertexts 311-313 areshown, and for message correction part 320, packed GLev ciphertexts 321-323 are shown.There may be two GLev ciphertexts, or more than 3. In the packed GLevs, the messages are divided by a series of powers of aparameter. A packed GLev ciphertext, also referred to as PACK-GLev, for multiplemessages comprises a sequence of packed GLWE ciphertexts for the multiple messages divided by powers of a parameter ^. The messages that are encrypted in these GLev are derived from the messages 350. Conceptually, a packed GLev ciphertext can be thought of as a packed GLWE;however, using multiple packed GLWE ciphertexts where the messages are divided byincreasing powers of a parameter ^ helps to control the noise.Packed GLev ciphertexts, e.g., a sequence of multiple GLWEs for the sameset of messages but divided by a series of powers of a parameter ^, are applied to messages that are corrected with the secret key so that the external product works out. A packed GGSW ciphertext is thus a sequence of multiple packed GLevs forthe same set of messages, partitioned into two collections of packed GLevs: the keycorrection part and the message correction part. In particular, it was found that to create the packed GLev ciphertexts for thekey correction part for a particular set of messages, e.g., for messages up to ^^, eachmessage is multiplied with a one of the polynomial of its respective secret key. These arethe same secret keys up to ^^ that are also used in an encrypted packed GLWE thatform the packed GLev. In particular, what works is to multiply each message up to^^ in the first packed GLev 311 with the first polynomial of the keys ^^ up to ^^, tomultiply each message up to ^^ in the second packed GLev 312 with the secondpolynomial of the keys up to ^^, and so on; e.g., multiply the messages in the i-thGLev with the i-th polynomial of the keys. In particular, in an embodiment themultiplication also includes a multiplication with -1. There are other ways to make the external multiplication work, e.g., use thepolynomials or the digits of the secret keys in another order, e.g., multiply with a differentnumber than -1, and so on. It turns out that the key correction part 310 in itself is not sufficient to make the external product work, and considerable research was needed to find a message correction part 320 that would make the external product for packed ciphertext come out right. In an embodiment, the message correction part 320 for a packed GGSW ciphertext comprises a sequence of packed GLev ciphertexts, wherein each packed GLev ciphertext corresponds to one message of the multiple messages in the packed GGSW ciphertext. Shown in figure 3, the first packed GLev ciphertext 321 is applied to the message ^^, for its first message, but to the message 0 for all the other messages; the second packed GLev ciphertext 322 is applied to the message ^^, for its second message, but to the message0 for all the other messages. In particular, the i-th packed GLev ciphertext is applied tothe message ^^, for its i-th message, but to the message 0 for all the other messages. It turns out that variations are possible, for example, a different order of the messages, a different multiplier—the above uses each message times 1, but one could take -1, if one were to make the appropriate corrections. Accordingly, if a packed GLWE encrypts the messages ^^ up to ^^, and apacked GGSW ciphertext encrypts the messages ^^ up to ^^, then the external productbetween them will encrypt the messages ^^^^ up to ^^^^. Typically, an encryptedGGSW is prepared by a client device, as it has access to the secret key. Nevertheless, the ability to perform multiplications on multiple operands opens up various other operations, e.g., noise reduction, blind rotation, programmable bootstrapping, and so on. In addition, the packed nature of these ciphertexts allows new homomorphic operations that were notpossible before or very costly, e.g., blind permutation, blind linear operations, where eventhe operation being performed is secret to the homomorphic computation system. Below, a mathematical description is given for one particular embodiment.A packed GLev ciphertext, also referred to as PACK-GLev, for multiplemessages, e.g., ^^ ∈ may be defined as follows Here the ^ is a parameter, to control noise. The sequence of powers runs from exponent1 to exponent ^ > 1. The number of powers used, also referred to as the number of levels,determines an amount of noise control. The amount of noise control needed, and thus the number of power depends on the applications and other parameters. The number of levels may be determined either mathematically or empirically. Parameter ^ has an impact on both the noise and the cost of the computation,while ^ mostly has impact on the noise. Many values will lead to a working system, andconventional values can be used. In practice, the parameter ^ is selected using anoptimization that minimizes the cost of the computation with noise constraints toguarantee security and correctness with a sufficiently high probability, e.g., a failureprobability of 2^^^or less, 2^^^or less, or 2^^^^or less, etc. For a ciphertext modulusof ^ = 2^^, a typical values for ^ is 2 but could also be more than 20.A packed GGSW ciphertext, also referred to as PACK-GGSW, for multiplemessages may be defined a collection of PACK-GLev samples as follows This allows an external product between the packed GLWE ciphertext and a packed GGSW ciphertext, which is a homomorphic operation. To perform external product the packed GLWE ciphertext may bedecomposed, e.g., using radix decomposition, and computing the dot product of the decomposed packed GLWE ciphertext and the packed GGSW ciphertext, obtaining a packed GLWE encryption of the multiplication of the multiple messages encrypted in the packed GLWE ciphertext and the corresponding multiple messages in the packed GGSW ciphertext. In an embodiment, the homomorphic computation system computes a controlled multiplexer operation, also referred to as cmux on a packed GLWE ciphertext. For example, given two packed GLWE ciphertexts ^^and ^^and a series of control bits^, e.g., comprising bits ^^, .. , ^^, the CMUX operator acts as a selector to choose betweenthe messages in ^^and ^^. Here the first bit ^^selects between the first message in ^^and^^, the second bit ^^ selects between the second message in ^^ and ^^, and so on; the i-thbit selecting between the i-th message in the packed ciphertexts. In an embodiment, the controlled multiplexor may be implemented using an external product. For example, with packed GLWE ciphertexts ^^and ^^, and a packedGGSW encryption ℭ^ of the control bits ^ = (^^, ^^, .. , ^^) with each bit in ^^. Then thecmux can be computed through an external product as ^^^^(ℭ^, ^^, ^^) = ^^ + ℭ^ ⊡ (^^ − ^^)Having a controlled multiplexer, that operates on the messages in a packed ciphertext, one can execute a programmable bootstrapping algorithm, that isconventionally known on the level of a GLWE encryption for a single message, butperforms it in parallel for each of the messages in a packed GLWE encryption. This mayuse as auxiliary key material the encryption as packed GGSW the bit of the secret keys 240. For example, the first packed GGSW may encrypt the first bits, 241.1, 242.1, 243.1, etc.; the second packed GGSW may encrypt the second bits, 241.2, 242.2, 243.2, etc., and so on. Instead of bits, one may advantageously use ternary values, e.g., -1, 0, 1. For example, a programmable bootstrapping on packed values may comprise a series of three algorithms: (i) Switch Modulus, (ii) Blind Rotate, and (iii) SampleExtract. It is often followed by a packed GLWE Key Switching algorithm.The modulus switching is typically performed prior to the blind rotationprocedure. For example, the switch modulus algorithm may scale by 2^ / ^ and rounds,e.g., to perform the operation Round[2^(^ ^^^ ^) / ^]. Other modulus switch operationsare possible, for example, one may adopt the modulus switch defined in

[0033] ,

[0028] , or [BPR24]. This operation may be performed on each value in a packed GLWE ciphertexts, e.g., on elements in ^^The Blind Rotate algorithm homomorphically applies a rotation over thecoefficients of polynomials stored in a packed GLWE ciphertext. It is used to blindly puta desired coefficient in the constant term. This algorithm takes as input a (possibly trivial)packed GLWE ciphertext ^^ encrypting a series of test polynomials ^^(^) each of degree^ − 1, and which encodes a lookup table, where the i-th coefficient represents the i-thvalue in the lookup table. The algorithms further takes a packed LWE ciphertext as input. The lookup tables will be applied to the corresponding messages in the packed LWE ciphertext. The algorithm starts by initializing an accumulator, as a packed GLWE, wherein the messages may be ^^^^^^(^), here ^^is the value in the body corresponding to the i-th message in the input packed LWE ciphertext and the i-th lookup table. For example, the accumulator may be initialized as a packed GLWE test polynomial. Using the encrypted digits of the secret keys, the algorithm successively updates theaccumulator. ^^^ ← ^^^^^ℭ^, ^^^, ^^^ ⋅ ^^^, ^, here ^^ refers to the j-th value in themask of the input packed LWE ciphertext. The output is a packed GLWE ciphertext encrypting a rotation of the testpolynomials over as many positions as indicated by the packed LWE input. Given this apacked LWE ciphertext may be constructed by sample extraction, extracting the constant terms of the packed GLWE ciphertext. After the blind rotation and sample extraction, the resulting packed LWE ciphertext may be encrypted with a secret key that is different from the one used on input. In order to return to the original key, one may perform a key-switching operation. This operation is optional. The programmable bootstrapping may be used for the evaluation of a lookup table on the multiple messages. This may be a different lookup table for each message. Two or more, or even all messages may share the same lookup table. For example, a reduction of the noise for the multiple messages encrypted in a packed LWE ciphertext may be performed, e.g., using the programmable bootstrapping. A packed key switch, also referred to as a PACK-key switch, takes as input a packed GLWE ciphertext and outputs a packed GLWE ciphertext. The packed key switchuses auxiliary key switching keys. The output packed GLWE ciphertext encrypts the same multiple messages as the input packed GLWE ciphertext but under a different key as indicated by the auxiliary key switching keys. Apacked external product may also be used to implement other operations ona packed GLWE. In particular, an external product may homomorphically permute themultiple messages encrypted in the packed GLWE ciphertext. Likewise a linear operation may be performed. Below several further optional refinements, details, and embodiments are illustrated. Notations Let ^ be a positive integer, referred to as the ciphertext modulus. The ringdenotes ℤ / ^ℤ. Let ^ be a power of two, representing the degree of quotient polynomial.Then, we note the ring ℤ^[^] / (^^ + 1). It is strictly speaking not necessary for ^to be a power of 2, though this simplifies implementations. Embodiments provide a new type of ciphertext that packs multiple messages into one ciphertext. This ciphertext type is compatible with classical FHE operators (PBS, linear operations, keyswitch, etc.), while offering new operations not previouslysupported or very costly to compute, e.g., blinded permutations, blinded linear operations,e.g., blind matrix multiplications. In a blinded operation, the homomorphic computation system not only does not know the data on which it is operating, but also does not know the operation it is performing. Furthermore, the packed ciphertext format introduced hereallows a different lookup table to be evaluated for each packed message during one PBS.In conventional TFHE-like schemes, the encryption procedure significantly increases the size of the data. A packed ciphertext according to an embodiment, reuses the LWE mask and thus reduces the data expansion. In conventional TFHE-like schemes, performing a PBS over ^ ciphertextstypically requires repeating the PBS process ^ times. The new method described hereincurs an additive cost for handling multiple messages instead of a multiplicative one.Already with packing two messages in one ciphertext, embodiments have advantagescompared to the state of the art. Traditional homomorphic encryption, based on the GLWE problem or its variants, involves a mask and a body. The mask is the randomness used to hide the message, while the body contains the actual message. Embodiments of the packed ciphertext format reduce data expansion by reusing the mask to encrypt multiplemessages. A packed ciphertext may be generated by producing multiple bodies with thesame mask, while using a different key for each message to maintain security. Rather than encrypting each message in its own ciphertext, embodiments enable multiple messages to be encrypted in one extended ciphertext. In order for the encryption to still be secure, preferably one uses a different key for each message that is packed in the same packed ciphertext. This implies that one will have as many different keys as messages that one wants to encrypt. In some cases, there could be some relationships between the keys. For example, all keys could be generated from a common seed using a key derivation function. Nevertheless, in practice all keys are different, so that as many different keysare used as there are messages in a packed ciphertext. If generation from a seed or the likeis used, preferably, a cryptographically strong key derivation function is used, e.g., based on a cryptographically strong hash function. The new format supports traditional ciphertext operations (e.g., PBS, linear operations, keyswitch), enabling amortized computations. By extending programmablebootstrapping to the packed format, multiple messages can be processed simultaneously.Moreover, the packed PBS operation permits different lookup tables to be applied todifferent messages, a flexibility that cannot be achieved by previous packing methods. Recent improvements and adaptations to TFHE operations can also beextended to the packed format. For example, following the framework outlined in

[0022] ,an extension of NGS-based bootstrapping for LWE samples can be applied to PACK-LWE samples, thus boosting the performance of amortized packed PBS operations.In this section, we give examples of ciphertexts in the packed format andexplain how the usual (T)FHE operations, such as PBS, linear operations, keyswitch, etc., can be performed on them. First, we define the ciphertext types of this invention which allow packingmultiple messages into one ciphertext. All common types of ciphertexts of TFHE-likeschemes can be extended to support the packed ciphertext. In particular, a GLWE can beextended to a PACK-GLWE, a GLev

[0023] can be extended to a PACK-GLev and aGGSW to a PACK-GGSW. PACK-GLWE APACK-GLWE ciphertext encrypted under ^ = (^^, … , ^^) may be defined as(^^, ⋯ , ^^, ^^, … , ^^) with where the mask ^ is the same for all the values in the body, which are eachencrypting a different message. As usual with TFHE, ^^ ∈ ℜ^,^ is a polynomial of noise terms sampled from one of the usualdistributions (Gaussian distribution, a uniform distribution, ...) ^^ ∈ ℜ^,^ is a polynomial called "mask" and its coefficients are sampleduniformly in ℤ / ^ℤ with ^ an integer called the ciphertext modulus (ex: ^ = 2^^ or ^ =2^^) ^^ ∈ ℜ^,^ is a polynomial secret key, sampled from one of the usualdistributions (Binary, ternary, gaussians, ...) Instead of encoding the messages by multiplying with a parameter ^, e.g., a power of two, or a divisor of the ciphertext modulus, other types of message encoding may be used. APACK-GLWE ciphertext allows one to encrypt ^ ciphertexts in a smallerdataformat than the original GLWE encryption. Where the ciphertext representation of ^messages in the conventional data format require ^(^ + 1) elements of theciphertext representation in the packed format only requires (^ + ^) elements of ℜ^,^.PACK-GLev APACK-GLev ciphertext maybe defined as follow a collection of PACK-GLev samples and may be defined as follows if ^ = 1 then a PACK-GLWE is a traditional GLWE, a PACK-GLev is atraditional GLev and a PACK-GGSW is a traditional GGSW. In an embodiment, we have^ > 1.If ^ = 1, a GLWE ciphertext is an LWE ciphertext. Everything explainedabove has a special case called PACK-LWE where ^ = 1.A further special case, is where ^ = 1 and ^ > 1, a GLWE ciphertext is anRLWE ciphertext, accordingly, the above can be adapted to obtain an PACK-RLWE ciphertext. The core of the present disclosure is to extend traditional FHE operators to work with these new ciphertext types. As multiple messages may be included in one packed ciphertext, batch FHE operator evaluation can be performed, resulting in advantageous amortized timings. In particular, by extending the PBS operation to the packed ciphertext format, lookup table evaluation or noise reduction may be performedon multiple messages in parallel. The packed data format not only enables parallelevaluation of the PBS on multiple messages, but also provides more flexibility thanprevious packing methods. Defining the accumulator in packed data format allows forlookup table evaluation of different lookup tables on the various messages of the packed ciphertexts. Below it is explained how to modify the usual algorithms to support these newciphertext types. Linear Operations Linear operations on GLWE ciphertexts, e.g., as described in

[0024] , can beextended to packed ciphertexts. Given ^ integer polynomials ^^, … , ^^ with ^^ ∈ℜ, ∀1 ≤ ^ ≤ ^, ^ PACK-GLWE ciphertexts ^^^, … , ^^^ with ^^^ ∈ The added noise of the linear operation on packed ciphertexts is the same asthe added noise for the usual linear operations, see

[0024] for the noise formula.Modulus Switch The traditional modulus switch (see

[0024] ) can be extended to work on packedciphertexts, e.g., PACK-LWE ciphertexts or PACK-GLWE ciphertexts.Let ^^ = (^^, … , ^^ , ^^, … , ^^), a PACK-LWE ciphertext. The modulusswitching outputs a ciphertext ^^′ = (^^′, … , ^^′, ^^′, … , ^^′) such that^′ ← ^^^^⋅^^ ^ ^ ^^for 1 ≤ ^ ≤ ^^^ As almost all FHE operators, the modulus switch adds some noise to the input ciphertext. In this case, the added noise is the same as for the usual modulus switch.See

[0025] for the noise formula and its proof. Instead of 2^ in the above formula, otherintegers may be used. External Product An external product may be defined using a PACK-GGSW (see above).Given ^a PACK-GLWE ciphertext encrypted under ^ = (^^, … , ^^) such that ^^ =^ defined as above,one can perform a traditional external product (e.g., rounding of each polynomial, (radix)decomposition of each polynomial using for example

[0022] and dot product between the decomposed polynomials and the PACK-GGSW). In the end, we get a PACK-GLWEciphertext encrypting (^^ ∙ ^^, … , ^^ ∙ For example, one may use the following algorithm 1. Compute ^′^ by rounding each polynomial ^^ at the ^ log^ ℬ bit.2. Decompose ^′^ using for example a radix decomposition as explainedin [10,22] to get coefficients of ^′^,^in ^^ℬ, … ,ℬ ^, define ^^∗ = (^^ , … , ^^ ^ ^^ ^,^ ^,^)3. Compute and return The noise added by this new packed external product is slightly bigger than the noise of a traditional external product. In practice, the first step adds the same amount of noise than in the traditional external product and the second step is noiseless. Thedifference lies in the third step where the dot product is larger (sum of (^ + ^) ⋅ ^elements) than in the traditional external product (sum of (^ + 1) ⋅ ^ elements).Generally, having more noise may be disadvantageous, as larger parameters may be required compared to a traditional external product to maintain the same level of correctness. However, even though larger parameters may be selected (e.g., a larger level^), this packed external product processes w messages simultaneously instead of requiringw traditional external products. Below is a brief comparison in terms of cost between thetraditional external product and the new packed external product: Traditional: (^ + 1) ⋅ (^ + 1) (i)FFTs and (^ + 1)^ ⋅ ^ ⋅ ^ complexmultiplications Packed: (^ + ^) ⋅ (^ + 1) (i)FFTs and (^ + ^)^ ⋅ ^ ⋅ ^ complexmultiplications Amortized Packed: ⋅ ^ complexmultiplications. As long as ^ remains relatively small (say at most 10, at most 20 or at most50), the amortized packed external product is better than doing several traditional external product. CMUX Using the external product the conventional cmux operation can be extendedto a packed cmux using the packed external product. See

[0024] for details on the cmux.Keyswitch The keyswitch can be extended in a similar manner to the external product. Here, the construction of a packed keyswitch is described, which takes as input a PACK- LWE ciphertext and outputs a PACK-LWE ciphertext. However, the same approach may be applied to transition from a PACK-GLWE ciphertext to a PACK-GLWE ciphertext or from a PACK-LWE ciphertext to a PACK-GLWE ciphertext. For further discussion of different keyswitch variants (public and private), see

[0024] .Given a PACK-LWE ciphertext ^^^^ ∈ PACK-^^^^(^^, … , ^^) ⊂ ℤ^^^encrypted under ^ = (^^, … , ^^) such that ^^ = ands.t. we can compute ^^′ (resp. ^^′) by rounding each ^^ (resp. ^^) at the ^ ⋅ log^^ bitdecompose ^^′ (res. ^^′) using for instance a radix decomposition, to get ^^′ = ^^^^^ is a PACK-LWE ciphertext encrypting (^^, ⋯ , ^^) under ^′.The noise of the packed keyswitch is the same as the noise of a traditional keyswitch and the cost is slightly bigger: Traditional: ^ ⋅ ^ ⋅ (^′ + 1) multiplicationsPacked: ^ ⋅ ^ ⋅ (^′ + ^) multiplicationsThe approach presented above can be used to adapt all keyswitch techniques found in the literature, including those introduced in

[0027] . Blind Rotate The blind rotate can be extended to a packed blind rotate using the packedcmux. See

[0024] for details on the blind rotate. Alternatively, the blind rotation can beperformed by using automorphisms as described in

[0029] , hence the packed extendedautomorphisms can be used to perform the packed blind rotation. The traditional blind rotate performs a blind rotation on a lookup table, which can be encrypted or not. The rotation depends on the message in the input LWE ciphertext. The packed blind rotate can do the same, but instead of rotating one lookuptable, ^ lookup tables may be rotated using each message in the input PACK-LWEciphertext. Sample Extract The sample extract can be immediately extended to a packed sample extract. A sample extract extracts an LWE ciphertext from a GLWE ciphertext. The new packed sample extract extracts a PACK-LWE ciphertext from a PACK-GLWE ciphertext.See

[0024] for details on the sample extract. PBS Using the operations described above one can implement a packed PBS using: a PACK-modulus switch (see above) a PACK-blind rotate (see above) aPACK sample extract (see above).Given a PACK-LWE ciphertext ^^^^ ∈ ^^^^(^^, ⋯ , and ^ lookupat the end of the PACK-PBS, we get ^^^^^∈ ), e.g., a PACK-LWE ciphertext encrypting evaluations of thelookup tables on each message.Here, we explained how to extend the traditional TFHE PBS. The same can be done on every improvements of the TFHE PBS (for instance:

[0023] ,

[0025] ,

[0030] ,

[0031] ,

[0032] ,

[0033] ,

[0034] , and its variants: the automorphism PBS

[0020] , the PBS using NTRU

[0022] Automorphism The evaluation of automorphisms can be extended to a packed automorphismby applying the automorphism map on every element of the PACK-^^^^ separately. Ifdesired, one can subsequently perform a PACK-^^^^ to PACK-^^^^ key switching.See

[0028] for details on the automorphism evaluation. As the evaluation of theautomorphism map can be done on each component of the PACK-^^^^ in parallel andthe evaluation of the map ^^is basically a permutation on the coefficients of the elements of ℜ, the cost of this part of the computation is negligible. In addition, as ^^is a norm- preserving map, it does not introduce a noise increase in the ciphertext. Hence the noise increase of the evaluation of an automorphism is equal to the noise increase of aPACK-^^^^ to PACK-^^^^ key switching.In an embodiment, an automorphism, e.g., an GLWE automorphism is appliedto a packed GLWE ciphertext by applying the automorphism on every element of thepacked GLWE ciphertext separately. If desired, a key switching can be performedsubsequently. For example, a blind rotation may be performed using such automorphisms. Other operations The packed keyswitch presented above can also be used to homomorphicallyconvert a traditional LWE ciphertext to a PACK-LWE ciphertext. The only difference with the previously defined key switching lies in the definition of the PACK-GLev ciphertexts, we may use as key switching key ^^ ^,^ (^ ∈ PACK-^^^^^ (0, … ,0 , ^^, 0, … ,0 ) ⊂ ℤ^⋅ ^^^^),^ ^ ^^^ ^^^with 1 ≤ ^ ≤ ^, the index where one wants to put the message. The rest of the algorithmis the same. If one wants to fill all the message slots, one can apply the algorithm abovefor all possible values of ^ and add the resulting ciphertexts. In the same manner, one cango from an LWE ciphertext to a PACK-GLWE ciphertext or from a GLWE ciphertext to a PACK-GLWE ciphertext, etc. Filling more than one slot can be done using an additional addition, hence the noise will increase. However, addition does not increase the noise much, hence the noise increase is small. Hidden permutations Hidden permutations can be performed by performing an external product, or a private key switch with specific key switching keys. More specifically to permute slot^ and ^ with 1 ≤ ^ < ^ ≤ ^ of a PACK-GLWE ciphertext encrypting messages ^^, ⋯ , µ^,one can permute the slot ^ and ^ in the PACK-GLev ciphertexts, taking = 1, ∀1 ≤ ^ ≤^). As an example, we can use the following auxiliary material to permute the first and the second message: After the external product, the messages in the resulting PACK-GLWEciphertext will be the same as the input ciphertext times the messages ^^, ⋯ , ^_^ hiddenin ^^ but with a permutation on the slots ^ and ^. With the example above, one would get^^ ⋅ ⋅ ^^, ⋯ , ^^ ⋅ ^^ instead of ⋅ ^^, ^^ ⋅ ^^, ⋯ , ^^ ⋅ ^^ This permutation ishidden in the sense that only the user that created the packed GGSW knows about it. Morethan 2 slots, can be permuted in one external product by permutating more columns duringthe PACK-GGSW ciphertext creation. In particular, one can apply any permutation of ^elements. For example, the permutation can be applied in the message correction part,wherein messages are placed in a message slot according to the permutation. Hidden linear operations Similar to hidden permutations, one can perform a hidden linear operation by performing an external product with a specific packed GGSW. The auxiliary materialneeded for the hidden linear operation is created by computing a linear equation withhidden permutation GGSW. Using this auxiliary material to perform an external product,the resulting ciphertext will have in one or multiple of its slots have the result of a linear operation performed on the messages of the original slots. For example: If one considers^^^ = and ^^^ is the GGSW defined above to permutate slot 1and 2 of ^^^. Then by setting ^^^^^_^^ = ^^^^ + ^^^^ and performing the externalproduct of ^^ = PACK-^^^^^(^^, … , with ^^^^^_^^, one gets as result Embodiments will have an important impact on use cases with substantial input data. The advantages are twofold: they allow use cases to benefit from parallel computation and lead to a compressed data format for the encrypted data. The parallelism offered by embodiments can be used to evaluate the same look-up table on multiple messages or to evaluate different look-up tables on different messages within the same homomorphic operation. Parallel evaluation is advantageous, for example, in homomorphic neural network inference, such as a model to classify medical data, detect fraudulent credit card transactions, predict voting behavior, or create heat maps. Secondly, the compressing property of embodiments may reduce the memory overhead, as homomorphic encryption leads to significant data expansion, which can bereduced by working in the packed format. Specifically, this compressing property can beparticularly useful in applications where encrypted data needs to be stored, such as database applications, e.g., private information retrieval or blockchain applications, or in applications where encrypted data is transferred from one party to another as compression reduces the volume of data transferred. Furthermore, hidden permutations can be leveraged to provide reassurance that the server is indeed evaluating the requested circuit. By embedding hidden permutations in the circuit and placing control values in one or more specific slots of the input ciphertexts, the user may verify that the result of the computation in the control slots is consistent with expected values. In other words, knowing the circuit and control values, the user can predict part of the output and use this knowledge to ensure the server evaluated the correct circuit. Figure 4 shows a graph 500 comparing amortized cost of embodiments. At501 different precisions are indicated in bit, ranging from 2 bit precision to 8 bit precision. At 502 a percentage change (in %) is indicated. Various embodiments are compared with a traditional implementation described in [CJP21], referred in the figures as ‘CJP’. Specifically, we focus on set of operations including: linear operations, keyswitch, and PBS, and we compare the amortized cost of using PACK-LWE ciphertexts with that of using traditional LWE ciphertexts. As one can see, in terms of amortized costs, best results are obtained for smallprecision, e.g., precision at most 6 bits. Increasing the number of slots ^ does not alwaysgive the best results for amortized costs.In an embodiment, the number of slots at least 2, and / or at most 10.In an embodiment, the number of slots is at least 2, and at most 8, and the precision is at least 2 and at most 8 In an embodiment, the precision is least 2 bits, at most 6 bits, and the number of slots is at least 2. In an embodiment, the precision is least 2 bits, at most 6 bits, and the number of slots is at least 2 and at most 50. In an embodiment, the precision is 2 bits, and the number of slots is at least 2. In an embodiment, the precision is 2 bits, and the number of slots is at least 2 and at most 50. In an embodiment, the precision is at least 2 bits, at most 6 bits, and the number of slots is between 2 and 8 (inclusive). In an embodiment, the precision is 8 bits or more, and the number of slots is between 2 and 6 (inclusive). REFERENCES The papers below are included herein by reference. In particular, references cited herein for a particular purpose are included in particular for that purpose. [1] C. Gentry, “Fully homomorphic encryption using ideal lattices,” in Proceedings of the 41st annual ACM symposium on theory of computing, STOC 2009,bethesda, MD, USA, may 31 - june 2, 2009, 2009, pp. 169–178. Available:http: / / doi.acm.org / 10.1145 / 1536414.1536440 [2] I. Chillotti, N. Gama, M. Georgieva, and M. Izabachène, “Faster fully homomorphic encryption: Bootstrapping in less than 0.1 seconds,” in Advances incryptology - ASIACRYPT 2016 - 22nd international conference on the theory andapplication of cryptology and information security, hanoi, vietnam, december 4-8, 2016, proceedings, part I, 2016, pp.3–33. Available: https: / / doi.org / 10.1007 / 978-3-662-53887- 6_1 [3] I. Chillotti, N. Gama, M. Georgieva, and M. Izabachène, “Faster packed homomorphic operations and efficient circuit bootstrapping for TFHE,” inAdvances in cryptology - ASIACRYPT 2017 - 23rd international conference on thetheory and applications of cryptology and information security, hong kong, china, december 3-7, 2017, proceedings, part I, 2017, pp. 377–408. Available: https: / / doi.org / 10.1007 / 978-3-319-70694-8_14 [4] L. Ducas and D. Micciancio, “FHEW: Bootstrapping homomorphic encryption in less than a second,” in Advances in cryptology -EUROCRYPT 2015 - 34th annual international conference on the theory and applicationsof cryptographic techniques, sofia, bulgaria, april 26-30, 2015, proceedings, part I, 2015, pp.617–640. Available: https: / / doi.org / 10.1007 / 978-3-662-46800-5_24 [5] C. Gentry, A. Sahai, and B. Waters, “Homomorphic encryption from learning with errors: Conceptually-simpler, asymptotically-faster, attribute-based,” IACR Cryptology ePrint Archive, vol. 2013, p. 340, 2013, Available: http: / / eprint.iacr.org / 2013 / 340 [6] J. H. Cheon, A. Kim, M. Kim, and Y. S. Song, “Homomorphic encryption for arithmetic of approximate numbers,” in Advances in cryptology -ASIACRYPT 2017 - 23rd international conference on the theory and applications ofcryptology and information security, hong kong, china, december 3-7, 2017, proceedings, part I, 2017, pp.409–437. Available: https: / / doi.org / 10.1007 / 978-3-319-70694-8_15 [7] Z. Brakerski, C. Gentry, and V. Vaikuntanathan, “(Leveled) fully homomorphic encryption without bootstrapping,” in Innovations in theoretical computer science 2012, cambridge, MA, USA, january 8-10, 2012, 2012, pp.309–325. Available: http: / / doi.acm.org / 10.1145 / 2090236.2090262 [8] J. Fan and F. Vercauteren, “Somewhat practical fully homomorphic encryption,” IACR Cryptology ePrint Archive, vol. 2012, p. 144, 2012, Available: http: / / eprint.iacr.org / 2012 / 144 [9] N. P. Smart and F. Vercauteren, “Fully homomorphic SIMD operations,” Des. Codes Cryptography, vol. 71, no. 1, pp. 57–81, 2014, Available: https: / / doi.org / 10.1007 / s10623-012-9720-4

[0010] I. Damgård and M. Jurik, “A generalisation, a simplification and some applications of paillier’s probabilistic public-key system,” in Public key cryptography: 4th international workshop on practice and theory in public key cryptosystems, PKC 2001 cheju island, korea, february 13–15, 2001 proceedings 4, Springer, 2001, pp.119–136.

[0011] C. Gentry and S. Halevi, “Compressible FHE with applications to PIR,” 2019, pp.438–464. doi: 10.1007 / 978-3-030-36033-7_17

[0012] C. B. Gentry and S. Halevi, “Compressible (f)HE with applications to PIR” Available: https: / / patents.google.com / patent / US20200403772A1 / en

[0013] Z. Brakerski, N. Döttling, S. Garg, and G. Malavolta, “Leveraging linear decryption: Rate-1 fully-homomorphic encryption and time-lock puzzles,” in Theory of cryptography conference, Springer, 2019, pp.407–437.

[0014] Z. Liu and Y. Wang, “Amortized functional bootstrapping in less than 7 ms, with o~(1) polynomial multiplications,” in International conference on the theory and application of cryptology and information security, Springer, 2023, pp.101– 132.

[0015] Z. Liu and Y. Wang, “Relaxed functional bootstrapping: A new perspective on BGV / BFV bootstrapping,” Cryptology ePrint Archive, 2024.

[0016] F.-H. Liu and H. Wang, “Batch bootstrapping i: A new framework for SIMD bootstrapping in polynomial modulus,” in Annual international conference on the theory and applications of cryptographic techniques, Springer-Verlag, 2023. doi: 10.1007 / 978-3-031-30620-4_11

[0017] F.-H. Liu and H. Wang, “Batch bootstrapping II: Bootstrapping inpolynomial modulus only requires ^^(1) FHE multiplications in amortization,” in Annualinternational conference on the theory and applications of cryptographic techniques, Springer-Verlag, 2023. doi: 10.1007 / 978-3-031-30620-4_12

[0018] D. Micciancio and J. Sorrell, “Ring packing and amortized FHEW bootstrapping,” Cryptology ePrint Archive, 2018.

[0019] A. Guimarães, H. V. Pereira, and B. Van Leeuwen, “Amortized bootstrapping revisited: Simpler, asymptotically-faster, implemented,” in International conference on the theory and application of cryptology and information security, Springer, 2023, pp.3–35.

[0020] G. De Micheli, D. Kim, D. Micciancio, and A. Suhl, “Faster amortized FHEW bootstrapping using ring automorphisms,” in IACR international conference on public-key cryptography, Springer, 2024, pp.322–353.

[0021] Zama, “TFHE-rs: A Pure Rust Implementation of the TFHE Scheme for Boolean and Integer Arithmetics Over Encrypted Data.” 2023. Available: https: / / github.com / zama-ai / tfhe-rs

[0022] C. Bonte, I. Iliashenko, J. Park, H. V. Pereira, and N. P. Smart, “FINAL: Faster FHE instantiated with NTRU and LWE,” in International conference on the theory and application of cryptology and information security, Springer, 2022, pp. 188–215.

[0023] I. Chillotti, D. Ligier, J.-B. Orfila, and S. Tap, “Improvedprogrammable bootstrapping with larger precision and efficient arithmetic circuitsfor TFHE,” in Advances in cryptology – ASIACRYPT 2021, M. Tibouchi and H. Wang,Eds., Cham: Springer International Publishing, 2021, pp.670–699.

[0024] I. Chillotti, N. Gama, M. Georgieva, and M. Izabachène, “TFHE: Fast fully homomorphic encryption over the torus,” J. Cryptol., vol.33, no.1, pp.34–91, 2020, doi: 10.1007 / s00145-019-09319-x. Available: https: / / doi.org / 10.1007 / s00145-019- 09319-x

[0025] L. Bergerat et al., “Parameter optimization & larger precision for (t) FHE,” Cryptology ePrint Archive, 2022.

[0026] M. Joye, “Balanced non-adjacent forms,” in Advances in cryptology–ASIACRYPT 2021: 27th international conference on the theory and application of cryptology and information security, singapore, december 6–10, 2021,proceedings, part III 27, Springer, 2021, pp. 553–576.

[0027] H. Chen, W. Dai, M. Kim, and Y. Song, “Efficient homomorphic conversion between (ring) LWE ciphertexts,” in International conference on applied cryptography and network security, Springer, 2021, pp.460–479.

[0028] Y. Lee et al., “Efficient FHEW bootstrapping with small evaluation keys, and applications to threshold homomorphic encryption.” Cryptology ePrintArchive, Paper 2022 / 198, 2022. doi: doi.org / 10.1007 / 978-3-031-30620-4_8. Available:https: / / eprint.iacr.org / 2022 / 198

[0029] Y. Lee et al., “Efficient FHEW bootstrapping with small evaluation keys, and applications to threshold homomorphic encryption,” in Annual international conference on the theory and applications of cryptographic techniques, Springer, 2023, pp.227–256.

[0030] S. Carpov, M. Izabachène, and V. Mollimard, “New techniques for multi-value input homomorphic evaluation and applications,” in Cryptographers’ track at the RSA conference, Springer, 2019, pp.106–126.

[0031] M. Joye and P. Paillier, “Blind rotation in fully homomorphic encryption with extended keys,” in International symposium on cyber security, cryptology, and machine learning, Springer, 2022, pp.1–18.

[0032] T. Zhou, X. Yang, L. Liu, W. Zhang, and N. Li, “Faster bootstrapping with multiple addends,” IEEE Access, vol.6, pp.49868–49876, 2018.

[0033] K. H. Lee and J. W. Yoon, “Discretization error reduction for high precision torus fully homomorphic encryption,” in IACR international conference on public-key cryptography, Springer, 2023, pp.33–62.

[0034] A. Guimarães, E. Borin, and D. F. Aranha, “Revisiting the functional bootstrap in TFHE,” IACR Trans. Cryptogr. Hardw. Embed. Syst., vol.2021, no.2, pp.229–253, 2021. [CJP21] laria Chillotti, Marc Joye, and Pascal Paillier. Programmablebootstrappingenables efficient homomorphic inference of deep neural networks. In S. Dolevet al., editors,Cyber Security Cryptography and Machine Learning (CSCML2021), volume 12716 ofLecture Notes in Computer Science, pages 1–19. Springer,2021.doi:10.1007 / 978-3-030-78086-9_1 [Bra12] Zvika Brakerski. Fully homomorphic encryption without modulusswitching from classical gapsvp. In Annual Cryptology Conference, pages 868–886. Springer, 2012 [CGGI20] I. Chillotti, N. Gama, M. Georgieva, and M. Izabachène. TFHE:Fast Fully Homomorphic Encryption over the Torus. In Journal of Cryptology, volume33, pages 34–91 (2020) [BPR24] Nicolas Bon, David Pointcheval, and Matthieu Rivain. Optimized Homomorphic Evaluation of Boolean Functions. https: / / eprint.iacr.org / 2023 / 1589 [BPR12] Banerjee, A., Peikert, C., Rosen, A. (2012). Pseudorandom Functions and Lattices. In: Pointcheval, D., Johansson, T. (eds) Advances in Cryptology– EUROCRYPT 2012. EUROCRYPT 2012. Lecture Notes in Computer Science, vol7237. Springer, Berlin, Heidelberg. https: / / doi.org / 10.1007 / 978-3-642-29011-4_42Figure 5 schematically shows an example of an embodiment of acryptographic method (500) for homomorphic computation. Method 500 may becomputer implemented and comprises- receiving (410) multiple messages encrypted in a single packed GLWEciphertext (PACK-GLWE), … , ^^)), the packed GLWE ciphertextcomprising a mask (^^, ⋯ , ^^) and a body (^^, … , ^^), the mask comprising multiplevalues taken from a ring (ℤ^ = ℤ / ^ℤ; ℜ^,^ = ℤ^[^] / (^^ + 1)), the body comprisingmultiple values taken from the ring, each value in the body being associated with a different secret key and corresponding to a message in the multiple messages, wherein the value in the body is obtained from masking the corresponding message with the mask and the associated secret key, the same mask being used to mask the multiple messages,- performing (420) a homomorphic operation on the packed GLWEciphertext, the homomorphic operation operating on the multiple messages at the same time. Many different ways of executing the method are possible, as will be apparent to a person skilled in the art. For example, the order of the steps can be performed in the shown order, but the order of the steps can be varied or some steps may be executed in parallel. Moreover, in between steps other method steps may be inserted. The inserted steps may represent refinements of the method such as described herein, or may be unrelated to the method. For example, some steps may be executed, at least partially, in parallel. Moreover, a given step may not have finished completely before a next step is started. Embodiments of the method may be executed using software, which comprises instructions for causing a processor system to perform an embodiment of method 500. Software may only include those steps taken by a particular sub-entity of the system. The software and / or other data according to an embodiment may be stored in a non-transitory storage medium, such as a hard disk, a floppy, a memory, an optical disc, read only memory, random access memory, CD-ROMs, magnetic tape, optical datastorage devices, etc. Transitory signals and carrier waves are excluded from non-transitory media. The software may be sent as a transitory signal along a wire, or wireless, e.g., sent as a transitory signal over a data network, e.g., the Internet. For example, signals and / or carrier waves may serve as a transitory medium for carrying information. For example, a modulated electromagnetic wave may carry a signal bearing the software and / or other data according to an embodiment. The software may be made available for download and / or for remote usage on a server. Embodiments of the method may be executed using a bitstream arranged to configure programmable logic, e.g., a field-programmable gate array (FPGA), to performan embodiment of the method.It will be appreciated that the presently disclosed subject matter also extends to computer programs, particularly computer programs on or in a carrier, adapted for putting the presently disclosed subject matter into practice. The program may be in the form of source code, object code, a code intermediate source, and object code such as partially compiled form, or in any other form suitable for use in the implementation of an embodiment of the method. An embodiment relating to a computer program product comprises computer executable instructions corresponding to each of the processing steps of at least one of the methods set forth. These instructions may be subdivided into subroutines and / or be stored in one or more files that may be linked statically or dynamically. Another embodiment relating to a computer program product comprisescomputer executable instructions corresponding to each of the devices, units and / or partsof at least one of the systems and / or products set forth. Figure 6a shows a computer readable medium 1000 having a writable part1010, and a computer readable medium 1001 also having a writable part. Computer readable medium 1000 is shown in the form of an optically readable medium. Computer readable medium 1001 is shown in the form of an electronic memory, in this case a memory card. Computer readable medium 1000 and 1001 may store data 1020 wherein the data may indicate instructions, which when executed by a processor system, cause a processor system to perform an embodiment of a homomorphic computation method, according to an embodiment. The computer program 1020 may be embodied on the computer readable medium 1000 as physical marks or by magnetization of the computer readable medium 1000. However, any other suitable embodiment is conceivable as well. Furthermore, it will be appreciated that, although the computer readable medium 1000 is shown here as an optical disc, the computer readable medium 1000 may be any suitable computer readable medium, such as a hard disk, solid state memory, flash memory, etc., and may be non-recordable or recordable. The computer program 1020 comprises instructions for causing a processor system to perform an embodiment of said homomorphic computation method. Figure 6b shows in a schematic representation of a processor system 1140according to an embodiment. The processor system comprises one or more integrated circuits 1110. The architecture of the one or more integrated circuits 1110 is schematically shown in Figure 6b. Circuit 1110 comprises a processing unit 1120, e.g., a CPU, for running computer program components to execute a method according to an embodiment and / or implement its modules or units. Circuit 1110 comprises a memory 1122 for storing programming code, data, etc. Part of memory 1122 may be read-only. Circuit 1110 may comprise a communication element 1126, e.g., an antenna, connectors or both, and the like. Circuit 1110 may comprise a dedicated integrated circuit 1124 for performing part or all of the processing defined in the method. Processor 1120, memory 1122, dedicated IC 1124 and communication element 1126 may be connected to each other via aninterconnect 1130, say a bus. The processor system 1140 may be arranged for contactand / or contact-less communication, using an antenna and / or connectors, respectively. For example, in an embodiment, processor system 1140, e.g., the homomorphic computation system may comprise a processor circuit and a memory circuit, the processor being arranged to execute software stored in the memory circuit. For example, the processor circuit may be an Intel Core i7 processor, ARM Cortex-R8, etc. In an embodiment, the processor circuit may be ARM Cortex M0. The memory circuit may be an ROM circuit, or a non-volatile memory, e.g., a flash memory. The memory circuit may be a volatile memory, e.g., an SRAM memory. In the latter case, the device may comprise a non-volatile software interface, e.g., a hard drive, a network interface, etc., arranged for providing the software. While system 1140 is shown as including one of each described component,the various components may be duplicated in various embodiments. For example, theprocessing unit 1120 may include multiple microprocessors that are configured toindependently execute the methods described herein or are configured to performelements or subroutines of the methods described herein such that the multiple processorscooperate to achieve the functionality described herein. Further, where the system 1140 is implemented in a cloud computing system, the various hardware components may belong to separate physical systems. For example, the processor 1120 may include a first processor in a first server and a second processor in a second server. The following clauses represent advantageous embodiments. Clause 1. A cryptographic, computer-implemented method (500) forhomomorphic computation , comprising -receiving (410) multiple messages encrypted in a single packed GLWE orGLWR ciphertext, ^^ , ^^, … , ^^)), the packed GLWE or GLWR ciphertextcomprising a mask (^^, ⋯ , ^^) and a body (^^, … , ^^), the mask comprising multiplevalues taken from a ring (ℤ^ = ℤ / ^ℤ; ℜ^,^ = ℤ^[^] / (^^ + 1)), the body comprisingmultiple values taken from the ring, each value in the body being associated with a different secret key and corresponding to a message in the multiple messages, wherein the value in the body is obtained from masking the corresponding message with the mask and the associated secret key, the same mask being used to mask the multiple messages, -performing (420) a homomorphic operation on the packed GLWE orGLWR ciphertext, the homomorphic operation operating on the multiple messages at the same time. Clause 2. A method for homomorphic computation as in Clause 1, wherein- the homomorphic operation comprises a scalar multiple of the packedGLWE or GLWR ciphertext, and / or -receiving the packed ciphertext comprises receiving multiple packedGLWE or GLWR ciphertexts, the homomorphic operation comprising computing a linear combination of the multiple packed GLWE or GLWR ciphertexts. Clause 3. A method for homomorphic computation as in any one of thepreceding clauses, wherein the ring is ℤ / ^ℤ or ℤ^[^] / (^^ + 1)), and the homomorphicoperation comprises a modulus switch, wherein each of the values in the mask and body are scaled. Clause 4. A method for homomorphic computation as in any one of thepreceding clauses, wherein a packed GLWE or GLWR ciphertext for multiple messagesencrypted under keys ^ = (^^, … , ^^) is defined as (^^, ⋯ , … , ^^),wherein wherein^^ ∈ ℜ^,^ is a polynomial of noise terms^^ ∈ ℜ^,^ is a polynomial of the mask^^ ∈ ℜ^,^ is a polynomial secret key having polynomials ^^,^ for 1 ≤ ^ ≤ ^.Clause 5. A method for homomorphic computation as in any one of thepreceding clauses, wherein the polynomial degree of the packed GLWE or GLWRciphertext is 0 (^ = 1).Clause 6. A method for homomorphic computation as in any one of thepreceding clauses, wherein the homomorphic operation comprises -the evaluation of a lookup table on the multiple messages, or- the evaluation of different lookup tables on the multiple messagesClause 7. A method for homomorphic computation as in any one of thepreceding clauses, wherein the homomorphic operation comprises a reduction of the noise for the multiple messages encrypted in the packed ciphertext. Clause 8. A method for homomorphic computation as in any one of thepreceding clauses, wherein the homomorphic operation comprises an external product between the packed GLWE or GLWR ciphertext, and a further packed ciphertext. Clause 9. A method for homomorphic computation as in any one of thepreceding clauses, wherein -a packed GLev ciphertext for multiple messages comprises a sequence ofpacked GLWE or GLWR ciphertexts for the multiple messages divided by powers of a parameter ^, -a packed GGSW ciphertext for multiple messages comprises a sequenceof packed GLev ciphertexts for the multiple messages multiplied with a digit of the corresponding secret key, or its negative, followed by a sequence of packed GLev ciphertexts, wherein each packed GLev ciphertext corresponds to one message of the multiple messages in the packed GGSW ciphertext, or to its negative, with the remaining messages in the packed GLev ciphertext set to zero, -wherein the homomorphic operation comprises an external productbetween the packed GLWE or GLWR ciphertext and a packed GGSW ciphertext.Clause 10. A method for homomorphic computation as in any one of thepreceding clauses, wherein- a packed GLev ciphertext for multiple messages ^^ ∈ -a packed GGSW ciphertext for multiple messages is defined as ^^ ∈ as a collection of packed samples as follows -wherein the homomorphic operation comprises an external productbetween the packed GLWE or GLWR ciphertext and a packed GGSW ciphertext.Clause 11. A method for homomorphic computation as in Clause 9 or 10,wherein the external product comprises decomposing the packed GLWE or GLWR ciphertext, e.g., a radix decomposition, and computing the dot product of the decomposedpacked GLWE or GLWR ciphertext and the packed GGSW ciphertext, obtaining apacked GLWE encryption of the multiplication of the multiple messages encrypted in thepacked GLWE or GLWR ciphertext and the corresponding multiple messages in thepacked GGSW ciphertext. Clause 12. A method for homomorphic computation as in any one of thepreceding clauses, wherein the homomorphic operation comprises a packed cmux operation. Clause 13. A method for homomorphic computation as in any one of thepreceding clauses, wherein the homomorphic operation comprises a packed key switch,taking as input the packed GLWE or GLWR ciphertext and outputting a packed GLWEor GLWR ciphertext, using auxiliary key switching keys, the output packed GLWE orGLWR ciphertext encrypting the same multiple messages as the input packed GLWE orGLWR ciphertext but under a different key as indicated by the auxiliary key switchingkeys. Clause 14. A method for homomorphic computation as in any one of thepreceding clauses, wherein the homomorphic operation comprises a homomorphic permutation of the multiple messages encrypted in the packed GLWE or GLWR ciphertext. Clause 15. A method for homomorphic computation as in any one of thepreceding clauses, wherein the homomorphic operation comprises an external product that homomorphically permutes the multiple messages encrypted in the packed GLWE or GLWR ciphertext. Clause 16. A method for homomorphic computation as in any one of thepreceding clauses, wherein the homomorphic operation comprises a homomorphic linear operation by computing a linear combination of the messages in a single or multiple packed GLWE or GLWR ciphertexts. Clause 17. A method as in any one of the preceding clauses, comprisingapplying a automorphism to the packed GLWE or GLWR ciphertext by applying theautomorphism on every element of the packed GLWE or GLWR ciphertext separately, inparticular, wherein a blind rotation is performed using such automorphisms. Clause 18. A system for homomorphic computation comprising: one or moreprocessors; and one or more storage devices storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations for -receiving multiple messages encrypted in a single packed GLWE orGLWR ciphertext, ^^ , ^^, … , ^^)), the packed GLWE or GLWR ciphertextcomprising a mask (^^, ⋯ , ^^) and a body the mask comprising multiplevalues taken from a ring (ℤ^ = ℤ / ^ℤ; ℜ^,^ = ℤ^[^] / (^^ + 1)), the body comprisingmultiple values taken from the ring, each value in the body being associated with a different secret key and corresponding to a message in the multiple messages, wherein the value in the body is obtained from masking the corresponding message with the mask and the associated secret key, the same mask being used to mask the multiple messages,- performing a homomorphic operation on the packed GLWE or GLWRciphertext, the homomorphic operation operating on the multiple messages at the same time. Clause 19. One or more non-transitory computer-readable media and / or oneor more transitory computer-readable media storing computer-executable instructions that, when executed by a computing system, cause the computing system to perform the method according to any one of clauses 1-17. It should be noted that the above-mentioned embodiments illustrate rather than limit the presently disclosed subject matter, and that those skilled in the art will be able to design many alternative embodiments. In the claims, any reference signs placed between parentheses shall not beconstrued as limiting the claim. Use of the verb ‘comprise’ and its conjugations does notexclude the presence of elements or steps other than those stated in a claim. The article ‘a’ or ‘an’ preceding an element does not exclude the presence of a plurality of such elements. Expressions such as “at least one of” when preceding a list of elements represent a selection of all or of any subset of elements from the list. For example, the expression, “at least one of A, B, and C” should be understood as including only A, only B, only C, both A and B, both A and C, both B and C, or all of A, B, and C. The presently disclosed subject matter may be implemented by hardware comprising several distinct elements, and by a suitably programmed computer. In the device claim enumerating several parts, several of these parts may be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage. In the claims references in parentheses refer to reference signs in drawings of exemplifying embodiments or to formulas of embodiments, thus increasing the intelligibility of the claim. These references shall not be construed as limiting the claim.

Claims

CLAIMS Claim 1. A cryptographic, computer-implemented method (500) for homomorphic computation , comprising- receiving (410) multiple messages encrypted in a single packed GLWE orGLWR ciphertext,^^ , ^^, … , ^^)), the packed GLWE or GLWR ciphertextcomprising a mask (^^, ⋯ , ^^) and a body (^^, … , ^^), the mask comprising multiplevalues taken from a ring (ℤ^ = ℤ / ^ℤ; ℜ^,^ = ℤ^[^] / (^^ + 1)), the body comprisingmultiple values taken from the ring, each value in the body being associated with a different secret key and corresponding to a message in the multiple messages, wherein the value in the body is obtained from masking the corresponding message with the mask and the associated secret key, the same mask being used to mask the multiple messages,wherein a packed GLWE or GLWR ciphertext for multiple messages ^^, ... , ^^encrypted under keys ^ = (^^, … , ^^) is defined as (^^, ⋯ , ^^, ^^, … , ^^), wherein ^^ =≤^ ≤ ^, wherein a round function is applied to all coefficients of ^^, wherein^^ ∈ ℜ^,^ is a polynomial of noise terms^^ ∈ ℜ^,^ is a polynomial of the mask^^ ∈ ℜ^,^ is a polynomial secret key having polynomials ^^,^ for 1 ≤ ^ ≤ ^,- performing (420) a homomorphic operation on the packed GLWE orGLWR ciphertext, the homomorphic operation operating on the multiple messages at thesame time, wherein the homomorphic operation comprises- the evaluation of a lookup table on the multiple messages, or- the evaluation of different lookup tables on the multiple messages.Claim 2. A method for homomorphic computation as in Claim 1, wherein- the homomorphic operation comprises a scalar multiple of the packedGLWE or GLWR ciphertext, and / or- the method comprises receiving at least one further packed GLWE orGLWR ciphertext, the received packed ciphertext and the at least one further packedGLWE or GLWR ciphertext together forming multiple packed GLWE or GLWRciphertexts, the homomorphic operation comprising computing a linear combination of the multiple packed GLWE or GLWR ciphertexts.Claim 3. A method for homomorphic computation as in any one of the preceding claims,wherein the ring is ℤ / ^ℤ or ℤ^[^] / (^^ + 1)), and the homomorphic operation comprisesa modulus switch, wherein each of the values in the mask and body are scaled. Claim 4. A method for homomorphic computation as in any one of the preceding claims,wherein the homomorphic operation comprises a reduction of the noise for the multiplemessages encrypted in the packed ciphertext. Claim 5. A method for homomorphic computation as in any one of the preceding claims, wherein the homomorphic operation comprises an external product between the received packed GLWE or GLWR ciphertext, and a further packed GGSW ciphertext. Claim 6. A method for homomorphic computation as in any one of the preceding claims, wherein- a packed GLev ciphertext for multiple messages comprises a sequence ofpacked GLWE or GLWR ciphertexts for the multiple messages divided by powers of a parameter ^,- a packed GGSW ciphertext for multiple messages comprises a sequenceof packed GLev ciphertexts for the multiple messages multiplied with a digit of the corresponding secret key, or its negative, followed by a sequence of packed GLev ciphertexts, wherein each packed GLev ciphertext corresponds to one message of the multiple messages in the packed GGSW ciphertext, or to its negative, with the remaining messages in the packed GLev ciphertext set to zero,- wherein the homomorphic operation comprises an external productbetween the packed GLWE or GLWR ciphertext and a packed GGSW ciphertext.Claim 7. A method for homomorphic computation as in any one of the preceding claims, wherein- a packed GLev ciphertext for multiple messages ^^ ∈- a packed GGSW ciphertext for multiple messages is defined as ^^ ∈as a collection of packed GLev samples as follows- wherein the homomorphic operation comprises an external productbetween the packed GLWE or GLWR ciphertext and a packed GGSW ciphertext.Claim 8. A method for homomorphic computation as in Claim 6 or 7, wherein the externalproduct comprises decomposing the packed GLWE or GLWR ciphertext, e.g., a radix decomposition, and computing the dot product of the decomposed packed GLWE orGLWR ciphertext and the packed GGSW ciphertext, obtaining a packed GLWEencryption of the multiplication of the multiple messages encrypted in the packed GLWEor GLWR ciphertext and the corresponding multiple messages in the packed GGSWciphertext. Claim 9. A method for homomorphic computation as in any one of the preceding claims, wherein the homomorphic operation comprises a packed cmux operation. Claim 10. A method for homomorphic computation as in any one of the preceding claims, wherein the homomorphic operation comprises a packed key switch, taking as input thepacked GLWE or GLWR ciphertext and outputting a packed GLWE or GLWRciphertext, using auxiliary key switching keys, the output packed GLWE or GLWRciphertext encrypting the same multiple messages as the input packed GLWE or GLWRciphertext but under a different key as indicated by the auxiliary key switching keys.Claim 11. A method for homomorphic computation as in any one of the preceding claims, wherein the homomorphic operation comprises a homomorphic permutation of the multiple messages encrypted in the packed GLWE or GLWR ciphertext.Claim 12. A method for homomorphic computation as in any one of the preceding claims, wherein the homomorphic operation comprises an external product that homomorphically permutes the multiple messages encrypted in the packed GLWE or GLWR ciphertext. Claim 13. A method for homomorphic computation as in any one of the preceding claims, wherein the homomorphic operation comprises a homomorphic linear operation by computing a linear combination of the messages in a single or multiple packed GLWE or GLWR ciphertexts. Claim 14. A method as in any one of the preceding claims, comprising applying aautomorphism to the packed GLWE or GLWR ciphertext by applying the automorphismon every element of the packed GLWE or GLWR ciphertext separately, in particular,wherein a blind rotation is performed using such automorphisms.Claim 15. A method as in any one of the preceding claims, wherein the round function isapplied to all coefficients of ^^. Claim 16. A system for homomorphic computation comprising: one or more processors; and one or more storage devices storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations for- receiving multiple messages encrypted in a single packed GLWE orGLWR ciphertext,^^ , ^^, … , ^^)), the packed GLWE or GLWR ciphertextcomprising a mask (^^, ⋯ , ^^) and a body (^^, … , ^^), the mask comprising multiplevalues taken from a ring (ℤ^ = ℤ / ^ℤ; ℜ^,^ = ℤ^[^] / (^^ + 1)), the body comprisingmultiple values taken from the ring, each value in the body being associated with a different secret key and corresponding to a message in the multiple messages, wherein the value in the body is obtained from masking the corresponding message with the mask and the associated secret key, the same mask being used to mask the multiple messages,wherein a packed GLWE or GLWR ciphertext for multiple messages ^^, ... , ^^encrypted under keys ^ = (^^, … , ^^) is defined as (^^, ⋯ , ^^, ^^, … , ^^), wherein ^^ =≤^ ≤ ^, wherein a round function is applied to all coefficients of ^^, wherein^^ ∈ ℜ^,^ is a polynomial of noise terms^^ ∈ ℜ^,^ is a polynomial of the mask^^ ∈ ℜ^,^ is a polynomial secret key having polynomials ^^,^ for 1 ≤ ^ ≤ ^,- performing a homomorphic operation on the packed GLWE or GLWRciphertext, the homomorphic operation operating on the multiple messages at the sametime, wherein the homomorphic operation comprises- the evaluation of a lookup table on the multiple messages, or- the evaluation of different lookup tables on the multiple messages.Claim 17. One or more non-transitory computer-readable media and / or one or more transitory computer-readable media storing computer-executable instructions that, when executed by a computing system, cause the computing system to perform the method according to any one of Claims 1-15.

Images