Multivariate lattices for encrypted image processing

Number Theoretic Transforms for Secure Signal Processing

“…We particularize the NTT for its application to the cryptosystems presented in [7] and [13]. In that case, the cryptosystems require the use of a ring R q = Z q [z]/(1 + z n ), where q is prime, and n is a power of 2.…”

“…Along with the linear convolution, the circular or cyclic convolution is frequently used in signal processing. To implement a linear convolution with an RLWE cryptosystem [7], [30] and its extensions [13], we need a value of n large enough to store the result of the convolution. Moreover, the cyclic convolution poses additional problems as the modular function f (z) = 1+z n in the cryptosystem only allows for negacyclic convolutions [31].…”

“…This procedure can also be applied to any other transform with a similar structure, with the difference of having to work with rounded real or complex numbers. In fact, we could separately operate with the real and imaginary parts of the signals or even embed complex numbers in the cryptosystem [13] by incorporating a modular function f (w) = 1 + w 2 . Hence, we can use the same procedure to implement the encrypted versions of the corresponding real or complex transforms, but working over complex 2N -th roots of unity; hence, by applying a pre-and post-processing step we get to homomorphically perform a DFT with only one cyclic convolution, or one DCT with two cyclic convolutions (for the DCT we would resort to Euler's formula to represent the cosines as a combination of complex roots of unity).…”

“…For the purpose of avoiding pre-and post-processing in the cleartexts, we can employ a relinearization primitive [7], [42], [43], commonly used in key switching algorithms to reduce the size of the encryptions after a multiplication: when multiplying two ciphertexts c = (c 0 , c 1 ) and c = (c 0 , c 1 ) from the cryptosystems [7], [30] and [13], the number of elements of the resulting ciphertext is increased c = (c 0 , c 1 , c 2 ). Hence, c could be decrypted as c 0 + c 1 s + c 2 s 2 , which can be seen as a quadratic function of s.…”

“…This section exemplifies the use of the primitives and algorithms presented in previous sections by proposing a set of practical tools and applications, which comprise matrix operations, Cyclic Redundancy Check (CRC) codes, changes in sampling rate and linear transforms; we also show how they can be seamlessly adopted within any RLWE-based cryptosystem [7], [30], by taking advantage of its polynomial structure. For simplicity, we assume that all signals have only one independent variable (univariate) but the methods can be easily extended to the multivariate case [13].…”