Stream Ciphers: A Practical Solution for Efficient Homomorphic-Ciphertext Compression

Abstract

In typical applications of homomorphic encryption, the first step consists for Alice to encrypt some plaintext m under Bob's public key pk and to send the ciphertext c = HE pk (m) to some third-party evaluator Charlie. This paper specifically considers that first step, i.e. the problem of transmitting c as efficiently as possible from Alice to Charlie. As previously noted, a form of compression is achieved using hybrid encryption. Given a symmetric encryption scheme E, Alice picks a random key k and sends a much smaller ciphertext c = (HE pk (k), E k (m)) that Charlie decompresses homomorphically into the original c using a decryption circuit C E −1 . In this paper, we revisit that paradigm in light of its concrete implementation constraints; in particular E is chosen to be an additive IV-based stream cipher. We investigate the performances offered in this context by Trivium, which belongs to the eSTREAM portfolio, and we also propose a variant with 128-bit security: Kreyvium. We show that Trivium, whose security has been firmly established for over a decade, and the new variant Kreyvium have an excellent performance.

Optimization of Bootstrapping in Circuits

“…On the other hand, computing an and gate requires a multiplication of the ciphertexts, and makes the noise growth noticeably larger [20]. This is why the cryptographic community introduced the simplified model of Section 1.1 and started building circuits for which the noise does not increase too much in this model [1,7].…”

“…In this paper, we say that the noise level of a ciphertext is in [0, L], where L is the parameter of the FHE scheme. In previous works, the level was either in [1, max ] [24,29], or in [9, max ] [20], 7 where max = L + 1. This is equivalent: = 0 should not be interpreted to mean that a ciphertext is noise-free, but that the amount of noise the ciphertext contains results from a bootstrapping operation.…”

“…In all efficient implementations of FHE schemes [4,5,11,16,20,21,25,30], non-linear gates (and) introduce much more additional noise than linear gates (not and xor), hence a simplified model where evaluation of linear gates do not increase the noise; see, e.g., [1,7,20,24,29].…”

Practical personalized genomics in the encrypted domain

“…Since the seminal work of Gentry [11], introducing the first fully homomorphic encryption (FHE) many other simpler and more efficient schemes have been proposed [10], [6], [5]. The HE based solutions have been applied to secure outsourcing of computation that involves genome data.…”

A note on generalization of bent boolean functions

“…Nowadays, the concept of biased inputs are used to analyze the cryptographic properties of some symmetric ciphers. For example, Maitra et al [15,16] analyzed the bias of Walsh-Hadamard transform of the filter function of FLIP [1,2] over a restricted domain where input vectors are not independent and identically distributed. They showed in Table IV [16,Section IV.A] that the bounds provided by the biased Walsh-Hadamard transforms are better than those obtained by Carlet et al [2].…”