Homomorphic Encryption Tutorial Shai Halevi IBM August 2013
Homomorphic Encryption Tutorial Shai Halevi ― IBM August 2013
Computing on Encrypted Data I want to delegate processing of my data, without giving away access to it.
Outsourcing Computation “I want to delegate the computation to the cloud, “I want to delegate the computation to the cloud” but the cloud shouldn’t see my input” Enc(x) f Enc[f(x)] Client (Input: x) Server/Cloud (Function: f)
Privacy Homomorphisms • Rivest-Adelman-Dertouzos 1978 Plaintext space P x 1 x 2 ci Enc(xi) * y Ciphertext space C c 1 c 2 # y Dec(d) d Example: RSA_encrypt(e, N)(x) = xe mod N x 1 e x x 2 e = (x 1 x x 2) e mod N “Somewhat Homomorphic”: can compute some functions on encrypted data, but not all
“Fully Homomorphic” Encryption for which we can compute arbitrary functions on the encrypted data Enc(x) Eval Enc(f(x)) f
Some Notations An encryption scheme: (Key. Gen, Enc, Dec) Plaintext-space = {0, 1} (pk, sk) Key. Gen($), c Encpk(b), b Decsk(c) Semantic security [GM’ 84]: (pk, Encpk(0)) (pk, Encpk(1)) means indistinguishable by efficient algorithms 6
Homomorphic Encryption (HE) H = {Key. Gen, Enc, Dec, Eval} c* Evalpk(f, c) c* Homomorphic: Decsk(Evalpk( f, Encpk(x))) = f(x) c* may not look like a “fresh” ciphertext As long as it decrypts to f(x) Compact: Decrypting c* easier than computing f Otherwise we could use Evalpk (f, c)=(f, c) and Decsk(f, c) = f(Decsk(c)) Technically, |c*| independent of the complexity of f 7
![Fully Homomorphic Encryption First plausible candidate in [Gen’ 09] Security from hard problems in](http://slidetodoc.com/presentation_image_h/1734b6d26d526fafee6cbd6e5c73d43f/image-8.jpg "Fully Homomorphic Encryption First plausible candidate in [Gen’ 09] Security from hard problems in")
Fully Homomorphic Encryption First plausible candidate in [Gen’ 09] Security from hard problems in ideal lattices Polynomially slower than computing in the clear Big polynomial though Many advances since Other hardness assumptions LWE, RLWE, NTRU, approximate-GCD More efficient Other “Advanced properties” Multi-key, Identity-based, … 8
![This Talk Regev-like somewhat-homomorphic encryption Adding homomorphism to [Reg’ 05] cryptosystem Security based on](http://slidetodoc.com/presentation_image_h/1734b6d26d526fafee6cbd6e5c73d43f/image-9.jpg "This Talk Regev-like somewhat-homomorphic encryption Adding homomorphism to [Reg’ 05] cryptosystem Security based on")
This Talk Regev-like somewhat-homomorphic encryption Adding homomorphism to [Reg’ 05] cryptosystem Security based on LWE, Ring-LWE Based on [BV’ 11, BGV’ 12, B’ 12] Bootstrapping to get FHE [Gen’ 09] Packed ciphertexts for efficiency Based on [SV’ 11, BGV’ 12, GHS’ 12] Not in this talk: a new LWE-based scheme [Gentry-Sahai-Waters CRYPTO 2013] 9
![Learning with Errors [Reg’ 05]](http://slidetodoc.com/presentation_image_h/1734b6d26d526fafee6cbd6e5c73d43f/image-10.jpg "Learning with Errors [Reg’ 05]")
Learning with Errors [Reg’ 05]
![Regev’s Cryptosystem [Reg’ 05]](http://slidetodoc.com/presentation_image_h/1734b6d26d526fafee6cbd6e5c73d43f/image-11.jpg "Regev’s Cryptosystem [Reg’ 05]")
Regev’s Cryptosystem [Reg’ 05]
Additive Homomorphism 12
![How to Multiply [BV’ 11, B’ 12]](http://slidetodoc.com/presentation_image_h/1734b6d26d526fafee6cbd6e5c73d43f/image-13.jpg "How to Multiply [BV’ 11, B’ 12]")
How to Multiply [BV’ 11, B’ 12]
![How to Multiply [BV’ 11, B’ 12]](http://slidetodoc.com/presentation_image_h/1734b6d26d526fafee6cbd6e5c73d43f/image-14.jpg "How to Multiply [BV’ 11, B’ 12]")
How to Multiply [BV’ 11, B’ 12]
Somewhat Homomorphic Encryption 15
![FHE via Bootstrapping [Gen’ 09] So far, circuits of pre-determined depth x 1 x](http://slidetodoc.com/presentation_image_h/1734b6d26d526fafee6cbd6e5c73d43f/image-16.jpg "FHE via Bootstrapping [Gen’ 09] So far, circuits of pre-determined depth x 1 x")
FHE via Bootstrapping [Gen’ 09] So far, circuits of pre-determined depth x 1 x 2 … C C(x 1, x 2 , …, xt) xt 16
![FHE via Bootstrapping [Gen’ 09] So far, circuits of pre-determined depth x 1 x](http://slidetodoc.com/presentation_image_h/1734b6d26d526fafee6cbd6e5c73d43f/image-17.jpg "FHE via Bootstrapping [Gen’ 09] So far, circuits of pre-determined depth x 1 x")
FHE via Bootstrapping [Gen’ 09] So far, circuits of pre-determined depth x 1 x 2 … C C(x 1, x 2 , …, xt) xt Can eval y=C(x 1, x 2…, xn) when xi’s are “fresh” But y is an “evaluated ciphertext” Can still be decrypted But eval C’(y) will increase noise too much 17
![FHE via Bootstrapping [Gen’ 09] So far, circuits of pre-determined depth x 1 x](http://slidetodoc.com/presentation_image_h/1734b6d26d526fafee6cbd6e5c73d43f/image-18.jpg "FHE via Bootstrapping [Gen’ 09] So far, circuits of pre-determined depth x 1 x")
FHE via Bootstrapping [Gen’ 09] So far, circuits of pre-determined depth x 1 x 2 … C C(x 1, x 2 , …, xt) xt Bootstrapping to handle deeper circuits We have a noisy evaluated ciphertext y Want to get another y with less noise 18
![FHE via Bootstrapping [Gen’ 09] For ciphertext c, consider Dc(sk) = Decsk(c) Hope: Dc(*)](http://slidetodoc.com/presentation_image_h/1734b6d26d526fafee6cbd6e5c73d43f/image-19.jpg "FHE via Bootstrapping [Gen’ 09] For ciphertext c, consider Dc(sk) = Decsk(c) Hope: Dc(*)")
FHE via Bootstrapping [Gen’ 09] For ciphertext c, consider Dc(sk) = Decsk(c) Hope: Dc(*) is a low-depth circuit (on input sk) Include in the public key also Encpk(sk) c y sk 1 sk 2 … skn Requires “circular security” Dc c’ Dc(sk) = Decsk(c) = y Homomorphic computation applied only to the “fresh” encryption of sk 19
![FHE via Bootstrapping [Gen’ 09] Similarly define Mc , c (sk) = Decsk(c 1)∙Decsk(c](http://slidetodoc.com/presentation_image_h/1734b6d26d526fafee6cbd6e5c73d43f/image-20.jpg "FHE via Bootstrapping [Gen’ 09] Similarly define Mc , c (sk) = Decsk(c 1)∙Decsk(c")
FHE via Bootstrapping [Gen’ 09] Similarly define Mc , c (sk) = Decsk(c 1)∙Decsk(c 1) 1 y 1 c 1 sk 2 … skn 2 y 2 c 2 Mc 1, c 2 c’ Mc 1, c 2(sk) = Decsk(c 1) x Decsk(c 2) = y 1 x y 2 Homomorphic computation applied only to the “fresh” encryption of sk 20
(In)Efficiency of This Scheme 21
Better Efficiency with Ring-LWE 22
Ciphertext Packing 23
Plaintext Algebra
Plaintext Slots
x x x 1 x 2 x 3 x 4 x 5 x 6 x 7 1 0 0 1 0 x 8 x 9 x 10 x 11 x 12 x 13 0 1 1 0 = x 14 = x 1 0 0 x 4 0 x 6 0 + 0 x 9 x 10 0 x 12 0 x 14 x 1 x 9 x 10 x 4 x 12 x 6 x 14 1 We will use this later
![Homomorphic SIMD [SV’ 11]](http://slidetodoc.com/presentation_image_h/1734b6d26d526fafee6cbd6e5c73d43f/image-27.jpg "Homomorphic SIMD [SV’ 11]")
Homomorphic SIMD [SV’ 11]
Beyond SIMD Computation To reduce overhead for a single computation: Pack all input bits in just a few ciphertexts Compute while keeping everything packed How to do this? February 27, 2021 28
+ + + + + So you want to compute some function… × × + + + × + × × × × × 1 x 2 x 3 x 4 x 5 0 + + + 1 x 7 x 8 x 9 x 10 x 11 x 12 1 x 14 x 15 x 16 x 17 x 18 x 19 1 x 22 x 23 x 24 x 25 x 26 Input bits
+ + + + + So you want to compute some function using SIMD… × + + × × + + × × × 1 x 2 x 3 x 4 x 5 x 1 x 2 x 3 x 4 x 5 0 + + + 1 x 7 x 8 x 9 x 10 x 11 x 12 x 7 x 8 x 9 x 10 x 11 x 12 1 x 14 x 15 x 16 x 17 x 18 x 19 1 x 22 x 23 x 24 x 25 x 26 x 21 x 22 x 23 x 24 x 25 x 26 Input bits
Routing Values Between Levels We need to map this x 1 x 2 x 3 x 4 x 5 0 x 7 x 8 x 9 x 10 x 11 x 12 x 15 x 16 x 17 x 18 x 19 1 x 22 x 23 x 24 x 25 x 26 1 x 14 + + + + Into that x 1 x 3 x 5 x 7 x 9 x 11 1 x 15 x 17 x 19 x 21 x 23 x 25 x 2 x 4 0 x 8 x 10 x 12 x 14 x 16 x 18 1 x 22 x 24 x 26 Is there a natural operation on polynomials that moves values between slots?
Using Automorphisms February 27, 2021 32
Homomorphic Automorphism February 27, 2021 33
Summary of RLWE HE encryption February 27, 2021 34
- Slides: 34