Packing Techniques for Homomorphic Encryption Schemes Scott Thompson CSCI-762 4/28/2016

Outline Homomorphic Encryption Definitions and Applications Brief history and types HE Schemes Computing on larger plaintext inputs Packing Techniques Direct Binary Galois Field Encoding Smart and Vercauteren Method External Chinese Remainder Theorem Comparison and Conclusion

What is Homomorphic Encryption? Homomorphic Encryption: provides the ability to preform computations on encrypted data. Untrusted parties can interpret encrypted requests and return an encrypted result without ever decrypting. An Evaluate function takes inputs of a function and ciphertext and outputs an encrypted ciphertext equivalent to the plaintext being evaluated by the function.

Why is it Important?  Truly Secure Cloud Computing  Encrypted Search Queries  Privacy Protection  Multiparty Computations  Each party has private info but together compute a result that is known to all parties ConfidentialityIntegrity Availability

SWHE vs FHE

Types of FHE Schemes  Lattice-based  First type purposed (2009)  Very large public key sizes and ciphertext  Similar theory as error correcting codes  Security from sparse subset sum problem (SSSP) or shortest vector problem (SVP)  Integer-based  Introduced by Dijk [3] (2010)  Theoretically simpler alternative to lattice based schemes  Includes a public key compression technique to reduce public key size from over 2GB to 10MB  Performance has been improved from a batching scheme [2]  Encrypts multiple plaintext bits into one ciphertext  Learning-with-errors (LWE)  Also extended to ring-learning-with-errors (RLWE) to increase efficiency (2011)  Current research focus of FHE  First purposed by Oded Regev

Ciphertext Packing  Pack multiple plaintext bits into a single ciphertext  Also referred to as batching  Improves efficiency by computing on more than one bit at a time  Interested in homomorphically computing on larger inputs.

Binary Galois Field Encoding

Smart and Vercauteren Method Goal: provide a scheme that supports Single Instruction Multiple Data (SIMD) operations and operations on large finite fields of characteristic two FHE scheme that would support operations on more than one bit at a time.

Smart and Vercauteren Method

Permutations Moves element from one ciphertext slot to another In SIMD operations, only elements in the same slot are operated on Complex permutation networks are required to link operations together Cloning is also needed

External use of CRT Purposed in the YASHE [4] scheme, 2013 Takes large input value and encrypts residues of smaller moduli into multiple ciphertexts. All ciphertexts are evaluated and the decrypted residues are recombined by inverse CRT Separates encoding process from the crypto system Provides more parallelism than the SV technique No requirement of permutations all elements are separated by their unique modulus

Conclusions Use of CRT outside of a homomorphic cryptosystem is just as effective and greatly simplifies computations External CRT can be applied to any scheme that supports the use of a generic plaintext modulus Removes the need to set scheme parameters to meet input data size

Questions

References [1] N. Smart and F. Vercauteren, "Fully homomorphic SIMD operations", in Designs, codes, and Cryptography 2012 [2] N. J. H. Cheon, J. S. Coron, J. Kim, M. S. Lee, L. T., M. Tibouchi, and A. Yun, "Batch Fully Homomorphic Encryption over the Integers", in Advances in Cryptology - EUROCRYPT 2013 [3] Z. Brakerski, V. Vaikuntanathan, and C. Gentry, "Fully Homomorphic Encryption without Bootstrapping", in Innovations in Theoretical Computer Science, 2012 [4] J. Bos, K. Lauter, J. Loftus, and M. Naehrig, "Improved Security for a Ring-Based Fully Homomorphic Encryption Scheme“, 2013