Fully Homomorphic Encryption Craig Gentry IBM T J

Fully Homomorphic Encryption Craig Gentry IBM T. J. Watson Research Center March 2017 Spring School on Lattice-Based Crypto, Oxford

Learning with Errors (LWE)

Solving Linear Equations A s = b (mod q)

y s i o N Solving Linear Equations A s + e = b (mod q)

The Learning with Errors (LWE) Problem [Regev 2005] B b = t. B+e

Why Do We Think LWE Is Hard? v 2’ v 1’ v 2 0 v 1

Why Do We Think LWE Is Hard?

LWE-Based Encryption [Regev ‘ 05]

Regev’s Cryptosystem A = B b = t. B+e

Security

Leveled FHE Based on LWE Focusing on the Gentry-Sahai-Waters (GSW) scheme. (Brakerski and Vaikuntanathan were the first to construct HE based on LWE. )

Properties of Regev’s Scheme

Matrix Version of Regev m … m + c 1 = Enc(0) c 2 = Enc(0) = … C m cn = Enc(0) m st (1 Attempt)

Approximate Eigenvector Homomorphisms New Noise

Controlling the Noise New Noise

The Gadget Matrix

Flattening Ciphertexts via Gadget Matrix Security of new encryption follows from Regev. New Noise is small.

Summary of GSW HE Scheme

Identity-Based HE

Identity-Based FHE (IBFHE)

GSW IBE → IBFHE Compiler CID = + C’ID

Attribute-Based FHE (ABFHE)

Multi-Key HE Slides from Daniel Wichs

Multi-Key HE

Multi-Key Version of GSW

Expanded Ciphertexts A 1 = B b 1 = t 1 B+e 1 A 2 = B b 2 = t 2 B+e 2

Bootstrapping GSW

Evaluating an Actual Decryption Circuit

Barrington’s Theorem

Width-5 Permutation Branching Programs A 1, 0 A 2, 0 A 3, 0 A 4, 0 A 5, 0 A 6, 0 A 7, 0 A 8, 0 A 9, 0 A 1, 1 A 2, 1 A 3, 1 A 4, 1 A 5, 1 A 6, 1 A 7, 1 A 8, 1 A 9, 1 0

Width-5 Permutation Branching Programs A 1, 0 A 2, 0 A 3, 0 A 4, 0 A 5, 0 A 6, 0 A 7, 0 A 8, 0 A 9, 0 A 1, 1 A 2, 1 A 3, 1 A 4, 1 A 5, 1 A 6, 1 A 7, 1 A 8, 1 A 9, 1 0 1

Width-5 Permutation Branching Programs A 1, 0 A 2, 0 A 3, 0 A 4, 0 A 5, 0 A 6, 0 A 7, 0 A 8, 0 A 9, 0 A 1, 1 A 2, 1 A 3, 1 A 4, 1 A 5, 1 A 6, 1 A 7, 1 A 8, 1 A 9, 1 0 1 1 0

Brakerski and Vaikuntanathan’s Insight

Bootstrapping GSW is Fast

Thank You! Questions? E M I T I RE D P X E ?