TFHE: Fast Fully Homomorphic Encryption Over the Torus

Abstract

This work describes a fast fully homomorphic encryption scheme over the torus (TFHE), that revisits, generalizes and improves the fully homomorphic encryption (FHE) based on GSW and its ring variants. The simplest FHE schemes consist in bootstrapped binary gates. In this gate bootstrapping mode, we show that the scheme FHEW of [29] can be expressed only in terms of external product between a GSW and a LWE ciphertext. As a consequence of this result and of other optimizations, we decrease the running time of their bootstrapping from 690ms to 13ms single core, using 16MB bootstrapping key instead of 1GB, and preserving the security parameter. In leveled homomorphic mode, we propose two methods to manipulate packed data, in order to decrease the ciphertext expansion and to optimize the evaluation of look-up tables and arbitrary functions in RingGSW based homomorphic schemes. We also extend the automata logic, introduced in [31], to the efficient leveled evaluation of weighted automata, and present a new homomorphic counter called TBSR, that supports all the elementary operations that occur in a multiplication. These improvements speed-up the evaluation of most arithmetic functions in a packed leveled mode, with a noise overhead that remains additive. We finally present a new circuit bootstrapping that converts LWE ciphertexts into low-noise RingGSW ciphertexts in just 137ms, which makes the leveled mode of TFHE composable, and which is fast enough to speed-up arithmetic functions, compared to the gate bootstrapping approach. Finally, we provide an alternative practical analysis of LWE based schemes, which directly relates the security parameter to the error rate This work was done while I. Chillotti was a PhD student in the Laboratoire de Mathématiques de Versailles, UVSQ (Versailles, France) and while M. Georgieva worked in Gemalto (Meudon, France). of LWE and the entropy of the LWE secret key, and we propose concrete parameter sets and timing comparison for all our constructions.

A Bitwise Design and Implementation for Privacy-Preserving Data Mining: From Atomic Operations to Advanced Algorithms

“…In 2017, Ilaria Chillotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachène proposed TFHE [14] library which is an improved version of FHEW [15] library. It has the bit-by-bit encryption scheme similar to Gentry's initial FHE [3].…”

“…e atomic operations include Addition, 2's Complement, Subtraction, Equivalent Comparison, Large and Small Comparison, Shift, Absolute, Multiplication, and Division. Note that Addition, Subtraction, and Multiplication among these atomic operations have already been introduced in the literature [14,17]. However, other atomic operations have rarely been studied although they are highly significant for numerical computation.…”

“…For the multiple linear regression (d > 1), we set the initial values to (N, d, l, p) � (10, 2, 16, 1) for the experiment. e dataset consists of feature vectors x 1 � [2,4,5,6,8,10,13,16,17,19], x 2 � [3,5,6,7,8,11,14,15,18,20], and a target variable y � [5,9,12,14,15,18,24,26,30, 32] with 10 data created artificially, and it takes 1047 seconds with 0.01 running rate. e iteration proceeded 50 steps to converge θ � (− 0.952, 1.094, 3.331) with threshold value, ε � 0.1.…”

Security for Distributed Deep Neural Networks: Towards Data Confidentiality & Intellectual Property Protection

“…The vast majority of HE schemes allow operations on integers [Halevi andShoup, 2014, SEAL, 2018] , while others use booleans [Chillotti et al, 2018] or floating point numbers [Cheon et al, 2018, SEAL, 2018. In the case of integer supporting HE schemes, rational numbers can be approximated using fixedpoint arithmetic by scaling with a scaling factor and rounding.…”

Fast Homomorphic Evaluation of Deep Discretized Neural Networks

“…In practice, it is often used as a somewhat homomorphic scheme. The second one, TFHE [CGGI16a], features a very efficient bootstrapping operation but, as a downside, this has to be applied after every gate computation. This library is more efficient than HElib when used for realizing an FHE.…”