Efficient Fully Homomorphic Encryption from (Standard) LWE

Abstract

We present a fully homomorphic encryption scheme that is based solely on the (standard) learning with errors (LWE) assumption. Applying known results on LWE, the security of our scheme is based on the worst-case hardness of "short vector problems" on arbitrary lattices.Our construction improves on previous works in two aspects:1. We show that "somewhat homomorphic" encryption can be based on LWE, using a new relinearization technique. In contrast, all previous schemes relied on complexity assumptions related to ideals in various rings.2. We deviate from the "squashing paradigm" used in all previous works. We introduce a new dimension-modulus reduction technique, which shortens the ciphertexts and reduces the decryption complexity of our scheme, without introducing additional assumptions.Our scheme has very short ciphertexts and we therefore use it to construct an asymptotically efficient LWE-based single-server private information retrieval (PIR) protocol. The communication complexity of our protocol (in the public-key model) is k · polylog(k) + log |DB| bits per single-bit query (here, k is a security parameter).

SHIELD: Scalable Homomorphic Implementation of Encrypted Data-Classifiers

“…Previous constructions of RLWE-based FHE schemes include [9], [10], [24]. One of the drawbacks of these schemes is the need to maintain a so-called "modulus chain" which increases the size of the prime number and consequently increases the ring dimension for the same security level.…”

“…1 are re-formatted to reduce the number of modulus operations needed. The N-point inverse NTT equation is shown in (10). The final inverse NTT engine can be seen if Fig.…”

“…Our data-classifier takes the idea of PIR one step forward, it homomorphically computes on the encrypted data retrieved by the PIR to obtain useful pieces of information. Other PIR constructions [2], [10], [19], [21], [31], [44] cannot implement data-classifiers the way we do because they either: (a) cannot compute with the PIR responses, or, (b) their plaintext field is only mod 2 (or modulo a small prime, for efficiency purposes) and thus they cannot do integer addition as required by (14). Our HE on the other hand has the advantage of being able to use the full modulo-q domain for plaintext additions.…”

“…This is the standard notion of security for FHE schemes as in [10], [22], [23]. The algorithms in Section 5 are secure against external attackers.…”

“…Starting with Gentry's mathematical breakthrough constructing the first plausible FHE scheme [22], [23], we have seen rapid development in the theory and implementation of homomorphic encryption (HE) schemes. HE schemes can now be based on a variety of cryptographic assumptions -approximate greatest common divisors [16], [18], learning with errors (LWE) [9], [10], [12], [25], and Ring-LWE (RLWE) [11], [24], [32].…”