Fully Homomorphic Encryption without Modulus Switching from Classical GapSVP

Abstract

We present a new tensoring technique for LWE-based fully homomorphic encryption. While in all previous works, the ciphertext noise grows quadratically (B → B 2 · poly(n)) with every multiplication (before "refreshing"), our noise only grows linearly (B → B · poly(n)).We use this technique to construct a scale-invariant fully homomorphic encryption scheme, whose properties only depend on the ratio between the modulus q and the initial noise level B, and not on their absolute values.Our scheme has a number of advantages over previous candidates: It uses the same modulus throughout the evaluation process (no need for "modulus switching"), and this modulus can take arbitrary form. In addition, security can be classically reduced from the worst-case hardness of the GapSVP problem (with quasi-polynomial approximation factor), whereas previous constructions could only exhibit a quantum reduction from GapSVP.

On Key Recovery Attacks Against Existing Somewhat Homomorphic Encryption Schemes

“…In this paper, we continue the line of work of [LMSV12,ZPS12] to present key recovery attacks for the schemes [BV11b,BV11a,GSW13,Bra12]. Our attacks can also be applied to the SHE scheme in [BGV12].…”

“…In this paper, we showed that the SHE schemes from [BV11b,BV11a,BGV12,Bra12,GSW13] suffer from key recovery attacks when the attacker is given access to the decryption oracle. Combining the results from [LMSV12,ZPS12], we now know that most existing SHE schemes suffer from key recovery attacks, and so they are not IND-CCA1 secure.…”

“…(3) The third category starts with Brakerski and Vaikuntanathan [BV11b,BV11a]. More variants appear in [NLV11,BGV12,GHS12b,Bra12,GSW13]. The security of these schemes are based on the learning with errors (LWE) and on the ring-learning with errors (RLWE) problems.…”

“…In this section, we describe a key recovery attack against the SHE scheme from [Bra12]. The scheme uses, as a building block, Regev's [Reg05] public-key encryption scheme.…”

“…The scheme uses, as a building block, Regev's [Reg05] public-key encryption scheme. It is then enough to show a key recovery attack on Regev's scheme since the full [Bra12] can be attacked exactly as the basic Regev's encryption scheme (the only differences between the two schemes are in the evaluation step which is missing in Regev's scheme). Let's first recall Regev's encryption scheme.…”