Faster Fully Homomorphic Encryption

Stehlé, Damien; Steinfeld, Ron

doi:10.1007/978-3-642-17373-8_22

Cited by 212 publications

(112 citation statements)

References 22 publications

Supporting

Mentioning

109

Contrasting

Unclassified

Order By: Relevance

“…Our technique can also be applied to Gentry's original scheme and its variants [Gen09a,Gen09b,Gen10,SV10,SS10]. It may also be applied to the FHE scheme "based on the integers" of van Dijk et al [DGHV10] and its improvements (see [CS15] and references therein).…”

Section: Application To Some Fhe Schemesmentioning

confidence: 99%

Sanitization of FHE Ciphertexts

Ducas¹,

Stehlé²

2016

Advances in Cryptology – EUROCRYPT 2016

Self Cite

View full text Add to dashboard Cite

Abstract. By definition, fully homomorphic encryption (FHE) schemes support homomorphic decryption, and all known FHE constructions are bootstrapped from a Somewhat Homomorphic Encryption (SHE) scheme via this technique. Additionally, when a public key is provided, ciphertexts are also re-randomizable, e.g., by adding to them fresh encryptions of 0. From those two operations we devise an algorithm to sanitize a ciphertext, by making its distribution canonical. In particular, the distribution of the ciphertext does not depend on the circuit that led to it via homomorphic evaluation, thus providing circuit privacy in the honestbut-curious model. Unlike the previous approach based on noise flooding, our approach does not degrade much the security/efficiency trade-off of the underlying FHE. The technique can be applied to all lattice-based FHE proposed so far, without substantially affecting their concrete parameters.

show abstract

Section: Application To Some Fhe Schemesmentioning

confidence: 99%

Sanitization of FHE Ciphertexts

Ducas¹,

Stehlé²

2016

Advances in Cryptology – EUROCRYPT 2016

Self Cite

View full text Add to dashboard Cite

show abstract

“…To prevent lattice attacks against the sparse subsetsum problem, one must have Θ 2 = γ · ω(log λ); see [7,16] for more details. One can then take…”

Section: Implementation Of Dghv With Compressed Public Keymentioning

confidence: 99%

Public Key Compression and Modulus Switching for Fully Homomorphic Encryption over the Integers

Coron

Naccache²,

Tibouchi

2012

Advances in Cryptology – EUROCRYPT 2012

172

153

View full text Add to dashboard Cite

Abstract.We describe a compression technique that reduces the public key size of van Dijk, Gentry, Halevi and Vaikuntanathan's (DGHV) fully homomorphic scheme over the integers fromÕ(λ 7 ) toÕ(λ 5 ). Our variant remains semantically secure, but in the random oracle model. We obtain an implementation of the full scheme with a 10.1 MB public key instead of 802 MB using similar parameters as in [7]. Additionally we show how to extend the quadratic encryption technique of [7] to higher degrees, to obtain a shorter public-key for the basic scheme.This paper also describes a new modulus switching technique for the DGHV scheme that enables to use the new FHE framework without bootstrapping from Brakerski, Gentry and Vaikuntanathan with the DGHV scheme. Finally we describe an improved attack against the Approximate GCD Problem on which the DGHV scheme is based, with complexitỹ O(2 ρ ) instead ofÕ(2 3ρ/2 ).

show abstract

“…To date, there exist three types of variants: schemes based on ideal lattices [32,33,12], schemes based on integers [34,6] and schemes based on (ring) learning with errors [4,14,3,13], among which, Gentry and Halevi's scheme [12] is one of the most efficient implementations. The authors also proposed four different challenges for their scheme.…”

Section: Thomas Plantard Et Almentioning

confidence: 99%

LLL for ideal lattices: re-evaluation of the security of Gentry–Halevi’s FHE scheme

Plantard

Susilo

Zhang

2014

Des. Codes Cryptogr.

View full text Add to dashboard Cite

The LLL algorithm, named after its inventors, Lenstra, Lenstra and Lovász, is one of themost popular lattice reduction algorithms in the literature. In this paper, we propose the first variant of LLL algorithm that is dedicated for ideal lattices, namely, the iLLL algorithm. Our iLLL algorithm takes advantage of the fact that within LLL procedures, previously reduced vectors can be re-used for further reductions. Using this method, we prove that the iLLL is at least as fast as the LLL algorithm, and it outputs a basis with the same quality. We also provide a heuristic approach that accelerates the re-use method. As a result, in practice, our algorithm can be approximately eight times faster than LLL algorithm for typical scenarios where lattice dimension is between 100 and 150. When applying our algorithm to the Gentry-Halevi's fully homomorphic challenges, we are able to solve the toy challenge within 24 days using a 2.66GHz CPU, while with the classical LLL algorithm, it takes 32 days. Further, assuming a 4.0GHz CPU, we predict to reduce the basis in 15.7 years for the small challenges, while previous best prediction was 45 years. LLL for Ideal LatticesRe-evaluation of the Security of Gentry-Halevi's FHE Scheme Thomas Plantard · Willy Susilo · Zhenfei Zhang the date of receipt and acceptance should be inserted later Abstract The LLL algorithm, named after its inventors, Lenstra, Lenstra and Lovász, is one of the most popular lattice reduction algorithms in the literature. In this paper, we propose the first variant of LLL algorithm that is dedicated for ideal lattices, namely, the iLLL algorithm. Our iLLL algorithm takes advantage of the fact that within LLL procedures, previously reduced vectors can be re-used for further reductions. Using this method, we prove that the iLLL is at least as fast as the LLL algorithm, and it outputs a basis with the same quality. We also provide a heuristic approach that accelerates the re-use method. As a result, in practice, our algorithm can be approximately 8 times faster than LLL algorithm for typical scenarios where lattice dimension is between 100 and 150. When applying our algorithm to the Gentry-Halevi's fully homomorphic challenges, we are able to solve the toy challenge within 24 days using a 2.66GHz CPU, while with the classical LLL algorithm, it takes 32 days. Further, assuming a 4.0GHz CPU, we predict to reduce the basis in 15.7 years for the small challenges, while previous best prediction was 45 years.

show abstract

Faster Fully Homomorphic Encryption

Cited by 212 publications

References 22 publications

Sanitization of FHE Ciphertexts

Sanitization of FHE Ciphertexts

Public Key Compression and Modulus Switching for Fully Homomorphic Encryption over the Integers

LLL for ideal lattices: re-evaluation of the security of Gentry–Halevi’s FHE scheme

Contact Info

Product

Resources

About