(Leveled) fully homomorphic encryption without bootstrapping

Abstract

We present a novel approach to fully homomorphic encryption (FHE) that dramatically improves performance and bases security on weaker assumptions. A central conceptual contribution in our work is a new way of constructing leveled fully homomorphic encryption schemes (capable of evaluating arbitrary polynomial-size circuits), without Gentry's bootstrapping procedure.Specifically, we offer a choice of FHE schemes based on the learning with error (LWE) or Ring LWE (RLWE) problems that have 2 λ security against known attacks. We construct:• A leveled FHE scheme that can evaluate depth-L arithmetic circuits (composed of fan-in 2 gates) usingÕ(λ·L 3 ) per-gate computation. That is, the computation is quasi-linear in the security parameter. Security is based on RLWE for an approximation factor exponential in L. This construction does not use the bootstrapping procedure.• A leveled FHE scheme that can evaluate depth-L arithmetic circuits (composed of fanin 2 gates) usingÕ(λ 2 ) per-gate computation, which is independent of L. Security is based on RLWE for quasi-polynomial factors. This construction uses bootstrapping as an optimization.We obtain similar results for LWE, but with worse performance. All previous (leveled) FHE schemes required a per-gate computation ofΩ(λ 3.5 ), and all of them relied on sub-exponential hardness assumptions.We introduce a number of further optimizations to our scheme based on the Ring LWE assumption. As an example, for circuits of large width -e.g., where a constant fraction of levels have width Ω(λ) -we can reduce the per-gate computation of the bootstrapped version toÕ(λ), independent of L, by batching the bootstrapping operation.At the core of our construction is a much more effective approach for managing the noise level of lattice-based ciphertexts as homomorphic operations are performed, using new techniques recently introduced by Brakerski and Vaikuntanathan

SHIELD: Scalable Homomorphic Implementation of Encrypted Data-Classifiers

“…For example consider (1), the noise grows to O(B · vn log q · |S|) in the worst case, or O(B · vn log q|S|) in the typical case. This is in contrast to O(B · (n log q) log v |S|) when using the Brakerski-GentryVaikuntanathan [9] encryption scheme, implemented in IBM HElib. Indeed, such expressions, as in (1), are far from atypical -they occur quite naturally in evaluating decision trees and PIR-like functions as will be discussed in Section 5.…”

“…Previous constructions of RLWE-based FHE schemes include [9], [10], [24]. One of the drawbacks of these schemes is the need to maintain a so-called "modulus chain" which increases the size of the prime number and consequently increases the ring dimension for the same security level.…”

“…Based on [9], Halevi and Shoup designed a homomorphic encryption library "IBM HElib" [24], [27], but due to the need of some additional large data structures and functions, the performance of their library has large execution time. A performance comparison between our library and the IBM HElib library is presented in Section 6.…”

“…Starting with Gentry's mathematical breakthrough constructing the first plausible FHE scheme [22], [23], we have seen rapid development in the theory and implementation of homomorphic encryption (HE) schemes. HE schemes can now be based on a variety of cryptographic assumptions -approximate greatest common divisors [16], [18], learning with errors (LWE) [9], [10], [12], [25], and Ring-LWE (RLWE) [11], [24], [32].…”

A Full Homomorphic Message Authenticator with Improved Efficiency

“…The first fully homomorphic encryption [1], [2] scheme developed by C. Gentry make it possible to perform arbitrary computation over outsourced data at the same time the privacy of the outsourced data is kept. After C. Gentry's construction, many full homomorphic encryption schemes have been developed [3]- [10].…”