Homomorphic AES evaluation using the modified LTV scheme

Abstract

Since its introduction more than a decade ago the homomorphic properties of the NTRU encryption scheme have gone largely ignored. A variant of NTRU proposed by Stehlé and Steinfeld was recently extended into a full fledged multi-key fully homomorphic encryption scheme by López-Alt, Tromer and Vaikuntanathan (LTV). This NTRU based FHE presents a viable alternative to the currently dominant BGV style FHE schemes. While the scheme appears to be more efficient, a full implementation and comparison to BGV style implementations has been missing in the literature. In this work, we develop a customized implementation of the LTV. First parameters are selected to yield an efficient and yet secure LTV instantiation. We present an analysis of the noise growth that allows us to formulate a modulus cutting strategy for arbitrary circuits. Furthermore, we introduce a specialization of the ring structure that allows us to drastically reduce the public key size making evaluation of deep circuits such as the AES block cipher viable on a standard computer with a reasonable amount of memory. Moreover, with the modulus specialization the need for key switching is eliminated. Finally, we present a generic bit-sliced implementation of the LTV scheme that embodies a number of optimizations. To assess the performance of the scheme we homomorphically evaluate the full 10 round AES circuit in 29 h with 2048 message slots resulting in 51 s per AES block evaluation time.

Which Ring Based Somewhat Homomorphic Encryption Scheme is Best?

“…The various schemes have been used/defined in various papers: for example one can find BGV in [3,8,9], FV in [6], NTRU in [5,14] and YASHE in [1]. In all four schemes we shall use a chain of moduli for our homomorphic evaluation 2 by choosing L "small primes"…”

“…In addition not all papers utilize all optimizations and improvements available. For example papers on the NTRU scheme [5,14], and its scale invariant version YASHE [1], rarely, if at all, make mention of the use of SIMD techniques. Papers working on scale invariant systems [6,1] usually focus on plaintext moduli of two, and discount larger moduli.…”

“…The schemes we have studied are BGV, whose details can be found in [3,8,9], and its scale-invariant version [6] (called FV in what follows), the basic NTRU scheme [5,14], and its scale-invariant version YASHE [1]. A previous study [12] only compared FV and YASHE, restricted to small plaintext spaces (in particular characteristic two), and did not consider the various variants in relation to key switching and modulus switching which we consider.…”

Toward Practical Homomorphic Evaluation of Block Ciphers Using Prince

“…Lastly, the authors advocate use of the Chinese Remainder Theorem on the message space to improve the flexibility of the scheme. In [15] Doröz, Hu and Sunar propose another implementation based on the ATV scheme [10]. Similar to earlier proposals the implementation is batched, bit-sliced and features modulus switching techniques.…”

“…-we present a leveled homomorphic implementation of the Prince cipher. Our implementation makes use of the NTRU based library developed by Doröz, Hu and Sunar [15]. Specifically, we optimize the Prince cipher for shallow circuit implementation, and based on the depth characteristics, chose optimal but secure parameters for the library to evaluate Prince efficiently.…”