Revisiting Homomorphic Encryption Schemes for Finite Fields

Abstract

The Brakerski-Gentry-Vaikuntanathan (BGV) and Brakerski/ Fan-Vercauteren (BFV) schemes are the two main homomorphic encryption (HE) schemes to perform exact computations over finite fields and integers. Although the schemes work with the same plaintext space, there are significant differences in their noise management, algorithms for the core homomorphic multiplication operation, message encoding, and practical usability. The main goal of our work is to revisit both schemes, focusing on closing the gap between the schemes by improving their noise growth, computational complexity of the core algorithms, and usability. The other goal of our work is to provide both theoretical and experimental performance comparison of BGV and BFV.More precisely, we propose an improved variant of BFV where the encryption operation is modified to significantly reduce the noise growth, which makes the BFV noise growth somewhat better than for BGV (in contrast to prior results showing that BGV has smaller noise growth for larger plaintext moduli). We also modify the homomorphic multiplication procedure, which is the main bottleneck in BFV, to reduce its algorithmic complexity. Our work introduces several other novel optimizations, including lazy scaling in BFV homomorphic multiplication and an improved BFV decryption procedure in the Residue Number System (RNS) representation. We also develop a usable variant of BGV as a more efficient alternative to BFV for common practical scenarios.We implement our improved variants of BFV and BGV in PALISADE and evaluate their experimental performance for several benchmark computations. The experimental results suggest that our BGV implementation is faster for intermediate and large plaintext moduli, which are often used in practical scenarios with ciphertext packing, while our BFV implementation is faster for small plaintext moduli.

Verifiable Encodings for Secure Homomorphic Analytics

“…When decrypted, the resulting ciphertext reveals the result of the computation as if it were executed on the plaintexts. Trending lattice-based HE schemes, e.g., BFV [53], [71] and BGV [22], [79], rely on the hardness of the learning with errors (LWE) [117] or ring-LWE (RLWE) [96] problems. Such schemes approach fully homomorphic encryption (FHE) as they can support unbounded number of additions and multiplications due to a bootstrapping operation [78], and they are implemented in several cryptographic libraries [121], [113], [49].…”

“…Our work focuses on lattice-based HE schemes that support modular arithmetic in a field Z t , e.g., the BGV and BFV schemes that are under standardisation [5]. These schemes share the same plaintext algebra and differ only in the plaintext data-representation and encryption-noise management (see [79]). For completeness, we describe briefly the BFV scheme used in this work.…”

“…Indeed, several commercial cloud providers are currently considering the deployment of HE for services that include sensitive information such as medical and financial data [6], [68], [67], [75], [101], [116]. In particular, lattice-based homomorphic encryption schemes (e.g., BFV [53], [79] and BGV [22], [79]) have gained popularity due to the wide range of supported computations and their efficiency. These schemes have been used in numerous applications such as medical research [36], [80], [92], database queries [20], and machine learning [69], [93], [34], [24].…”

BASALISC: Flexible Asynchronous Hardware Accelerator for Fully Homomorphic Encryption

“…We need an auxiliary data structure called key switching matrix, which is essentially a set of encryptions of 𝒔 under 𝒔 ′ . A high level description of various key switching methods is given in Appendix B by Kim et al [25]. BASALISC implements the hybrid key switching method from Appendix B.2.3, which we review here.…”

Survey on Fully Homomorphic Encryption, Theory and Applications

“…Latterly, Kim, Polyakov and Zucca [91] proposed several optimizations to the FV and the BGV schemes and suggest a different approach to compute the ciphertext modulus of the BGV scheme, which does not require dynamic noise estimation. In this setting, their FV variant has better noise growth than BGV for all plaintext moduli but their FV variant is faster than BGV only for small plaintexts, while BGV is faster for intermediate and large plaintexts.…”