Homomorphic Encryption Standard: TFHE API...N. Gama and M. Georgieva Model of computations 1Binary,...
Transcript of Homomorphic Encryption Standard: TFHE API...N. Gama and M. Georgieva Model of computations 1Binary,...
Homomorphic Encryption Standard TFHE API
Mariya Georgieva
August 17 2019
1 9
TFHE API Introduction
TFHE Fast Fully Homomorphic Encryption over the Torus
TFHE API draft shared to the mailing list (11 July 2019)(S Carpov I Chillotti N Gama M Georgieva)httpsdocsgooglecomdocumentd1aUGdIlBijYebos8gNO2cS3HFCR90JVLwAWzBctUN3msedit
ParametersData Encoding and CiphertextsSecret-Key EncryptionPublic-Key EncryptionLeveled Homomorphic Encryption OperationsBootstrapped Homomorphic Encryption Operations
TFHE open source libraryhttpstfhegithubio
2 9
TFHE parameters
Security parameter λNoise rate α ndash (auto-deduced in bootstrapped mode)Ring dimension n ndash (auto-deduced in bootstrapped and leveled mode)
In bootstrapped modeThe values of α and n are derived from the security parameter λ by the library in order to enablefull bootstrapping cycle
In leveled modeα serves as a measure for the number of homomorphic operations that can be run on a ciphertextbefore saturating the noise The ring dimension n is then determined by the security level λ
3 9
Data Encoding and Ciphertexts
TLWE ciphertexts encrypt plaintext in TT = R mod 1(Torus arithmetic as a Z - module)3 middot 06 = 08 mod 1external product by integers
Polynomial versionTRLWE ciphertexts encrypt plaintext in TN [X]TRGSW ciphertexts encrypt plaintext in ZN [X]
TN [X] = R[X] mod XN + 1 mod 1(Torus polynomial arithmetic as a ZN [X] - module)(2X + 3) middot (04X + 05) = (02X + 07) mod X2 + 1 mod 1external product by integers polynomail
4 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
5 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
5 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
5 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
5 9
TFHE API Operations
Leveled Homomorphic Encryption OperationsThe basic operations are
TLWE TRLWE TRGSW linear combinationsTRGSW-TRLWE external product
Some useful derived operationTRGSW-TRLWE-TRLWE privateoblivious selector (CMux)BlindRotate
Bootstrapped Homomorphic Encryption OperationsConstant gates Zero OneUnary gate NotBinary gates And Or Xor Xnor AndNot OrNot Nor NandTernary gate Mux
6 9
General internal product in BFV and CKKS
Internal product requires to evaluate a polynomail in s
(b1 minus sa1)(b2 minus sa2) = b1b2 minus (b1a2 + b2a1)s+ a1a2s2
The term s2dedicated relinearizationkeyswitch techniques (2011 )but in fact TRGSW provides the multiplication by s
The meaning of a1a2sublattices ai are exact multiples of 1
pfor a fixed small p
small ball ai is bounded
7 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
8 9
Questions
Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio
Model of computations1 Binary circuit computations
2 Integer arithmetic computation
3 Approximated (Fixed-point) computation
Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic
bull BFV (Seal Palisade) massively parallel small depth polynomials
bull CKKS (HEAAN) massively parallel floating point arithmetic
bull TFHE FHEW single eval boolean logic comparison threshold
How we can represent all plaintexts over the TN [X]
TN [X]+
noise
Ciphertext(a b)
Integers(ZpZ)n
Fixed point
C
CircuitsB = (0 1)
Homomorphic operations hierarchy
TRLWEx + y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSW ax for secret aExternal product
a isin 0 1
cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = spolynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
Circuits over the TN [X] (AND)
58
38
0 1
0=(01)(10)
14 = (0 0)3
4 = (1 1)0
1
Integers and fixed-point over the TN [X]0
2p
1p
BFV
m2τ +
minus 12L
12L
1q
CKKS
Linear combination with secret coefficients (0 1)
TRGSW(s1) TRGSW(s2) TRGSW(sn)
timesXa1
times1
timesXa2
times1
timesXan
times1
()1
0
1
0
1
0 sumsiai mod 2N
TRLWE TRLWE
Linear combination with secret coefficient s
Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s
HowTo evaluate a polynomial in s
bull dedicated relinearizationkeyswitch techniques (2011 )
bull But in fact TRGSW provides
C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)
9 9
TFHE API Introduction
TFHE Fast Fully Homomorphic Encryption over the Torus
TFHE API draft shared to the mailing list (11 July 2019)(S Carpov I Chillotti N Gama M Georgieva)httpsdocsgooglecomdocumentd1aUGdIlBijYebos8gNO2cS3HFCR90JVLwAWzBctUN3msedit
ParametersData Encoding and CiphertextsSecret-Key EncryptionPublic-Key EncryptionLeveled Homomorphic Encryption OperationsBootstrapped Homomorphic Encryption Operations
TFHE open source libraryhttpstfhegithubio
2 9
TFHE parameters
Security parameter λNoise rate α ndash (auto-deduced in bootstrapped mode)Ring dimension n ndash (auto-deduced in bootstrapped and leveled mode)
In bootstrapped modeThe values of α and n are derived from the security parameter λ by the library in order to enablefull bootstrapping cycle
In leveled modeα serves as a measure for the number of homomorphic operations that can be run on a ciphertextbefore saturating the noise The ring dimension n is then determined by the security level λ
3 9
Data Encoding and Ciphertexts
TLWE ciphertexts encrypt plaintext in TT = R mod 1(Torus arithmetic as a Z - module)3 middot 06 = 08 mod 1external product by integers
Polynomial versionTRLWE ciphertexts encrypt plaintext in TN [X]TRGSW ciphertexts encrypt plaintext in ZN [X]
TN [X] = R[X] mod XN + 1 mod 1(Torus polynomial arithmetic as a ZN [X] - module)(2X + 3) middot (04X + 05) = (02X + 07) mod X2 + 1 mod 1external product by integers polynomail
4 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
5 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
5 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
5 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
5 9
TFHE API Operations
Leveled Homomorphic Encryption OperationsThe basic operations are
TLWE TRLWE TRGSW linear combinationsTRGSW-TRLWE external product
Some useful derived operationTRGSW-TRLWE-TRLWE privateoblivious selector (CMux)BlindRotate
Bootstrapped Homomorphic Encryption OperationsConstant gates Zero OneUnary gate NotBinary gates And Or Xor Xnor AndNot OrNot Nor NandTernary gate Mux
6 9
General internal product in BFV and CKKS
Internal product requires to evaluate a polynomail in s
(b1 minus sa1)(b2 minus sa2) = b1b2 minus (b1a2 + b2a1)s+ a1a2s2
The term s2dedicated relinearizationkeyswitch techniques (2011 )but in fact TRGSW provides the multiplication by s
The meaning of a1a2sublattices ai are exact multiples of 1
pfor a fixed small p
small ball ai is bounded
7 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
8 9
Questions
Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio
Model of computations1 Binary circuit computations
2 Integer arithmetic computation
3 Approximated (Fixed-point) computation
Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic
bull BFV (Seal Palisade) massively parallel small depth polynomials
bull CKKS (HEAAN) massively parallel floating point arithmetic
bull TFHE FHEW single eval boolean logic comparison threshold
How we can represent all plaintexts over the TN [X]
TN [X]+
noise
Ciphertext(a b)
Integers(ZpZ)n
Fixed point
C
CircuitsB = (0 1)
Homomorphic operations hierarchy
TRLWEx + y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSW ax for secret aExternal product
a isin 0 1
cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = spolynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
Circuits over the TN [X] (AND)
58
38
0 1
0=(01)(10)
14 = (0 0)3
4 = (1 1)0
1
Integers and fixed-point over the TN [X]0
2p
1p
BFV
m2τ +
minus 12L
12L
1q
CKKS
Linear combination with secret coefficients (0 1)
TRGSW(s1) TRGSW(s2) TRGSW(sn)
timesXa1
times1
timesXa2
times1
timesXan
times1
()1
0
1
0
1
0 sumsiai mod 2N
TRLWE TRLWE
Linear combination with secret coefficient s
Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s
HowTo evaluate a polynomial in s
bull dedicated relinearizationkeyswitch techniques (2011 )
bull But in fact TRGSW provides
C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)
9 9
TFHE parameters
Security parameter λNoise rate α ndash (auto-deduced in bootstrapped mode)Ring dimension n ndash (auto-deduced in bootstrapped and leveled mode)
In bootstrapped modeThe values of α and n are derived from the security parameter λ by the library in order to enablefull bootstrapping cycle
In leveled modeα serves as a measure for the number of homomorphic operations that can be run on a ciphertextbefore saturating the noise The ring dimension n is then determined by the security level λ
3 9
Data Encoding and Ciphertexts
TLWE ciphertexts encrypt plaintext in TT = R mod 1(Torus arithmetic as a Z - module)3 middot 06 = 08 mod 1external product by integers
Polynomial versionTRLWE ciphertexts encrypt plaintext in TN [X]TRGSW ciphertexts encrypt plaintext in ZN [X]
TN [X] = R[X] mod XN + 1 mod 1(Torus polynomial arithmetic as a ZN [X] - module)(2X + 3) middot (04X + 05) = (02X + 07) mod X2 + 1 mod 1external product by integers polynomail
4 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
5 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
5 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
5 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
5 9
TFHE API Operations
Leveled Homomorphic Encryption OperationsThe basic operations are
TLWE TRLWE TRGSW linear combinationsTRGSW-TRLWE external product
Some useful derived operationTRGSW-TRLWE-TRLWE privateoblivious selector (CMux)BlindRotate
Bootstrapped Homomorphic Encryption OperationsConstant gates Zero OneUnary gate NotBinary gates And Or Xor Xnor AndNot OrNot Nor NandTernary gate Mux
6 9
General internal product in BFV and CKKS
Internal product requires to evaluate a polynomail in s
(b1 minus sa1)(b2 minus sa2) = b1b2 minus (b1a2 + b2a1)s+ a1a2s2
The term s2dedicated relinearizationkeyswitch techniques (2011 )but in fact TRGSW provides the multiplication by s
The meaning of a1a2sublattices ai are exact multiples of 1
pfor a fixed small p
small ball ai is bounded
7 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
8 9
Questions
Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio
Model of computations1 Binary circuit computations
2 Integer arithmetic computation
3 Approximated (Fixed-point) computation
Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic
bull BFV (Seal Palisade) massively parallel small depth polynomials
bull CKKS (HEAAN) massively parallel floating point arithmetic
bull TFHE FHEW single eval boolean logic comparison threshold
How we can represent all plaintexts over the TN [X]
TN [X]+
noise
Ciphertext(a b)
Integers(ZpZ)n
Fixed point
C
CircuitsB = (0 1)
Homomorphic operations hierarchy
TRLWEx + y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSW ax for secret aExternal product
a isin 0 1
cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = spolynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
Circuits over the TN [X] (AND)
58
38
0 1
0=(01)(10)
14 = (0 0)3
4 = (1 1)0
1
Integers and fixed-point over the TN [X]0
2p
1p
BFV
m2τ +
minus 12L
12L
1q
CKKS
Linear combination with secret coefficients (0 1)
TRGSW(s1) TRGSW(s2) TRGSW(sn)
timesXa1
times1
timesXa2
times1
timesXan
times1
()1
0
1
0
1
0 sumsiai mod 2N
TRLWE TRLWE
Linear combination with secret coefficient s
Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s
HowTo evaluate a polynomial in s
bull dedicated relinearizationkeyswitch techniques (2011 )
bull But in fact TRGSW provides
C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)
9 9
Data Encoding and Ciphertexts
TLWE ciphertexts encrypt plaintext in TT = R mod 1(Torus arithmetic as a Z - module)3 middot 06 = 08 mod 1external product by integers
Polynomial versionTRLWE ciphertexts encrypt plaintext in TN [X]TRGSW ciphertexts encrypt plaintext in ZN [X]
TN [X] = R[X] mod XN + 1 mod 1(Torus polynomial arithmetic as a ZN [X] - module)(2X + 3) middot (04X + 05) = (02X + 07) mod X2 + 1 mod 1external product by integers polynomail
4 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
5 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
5 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
5 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
5 9
TFHE API Operations
Leveled Homomorphic Encryption OperationsThe basic operations are
TLWE TRLWE TRGSW linear combinationsTRGSW-TRLWE external product
Some useful derived operationTRGSW-TRLWE-TRLWE privateoblivious selector (CMux)BlindRotate
Bootstrapped Homomorphic Encryption OperationsConstant gates Zero OneUnary gate NotBinary gates And Or Xor Xnor AndNot OrNot Nor NandTernary gate Mux
6 9
General internal product in BFV and CKKS
Internal product requires to evaluate a polynomail in s
(b1 minus sa1)(b2 minus sa2) = b1b2 minus (b1a2 + b2a1)s+ a1a2s2
The term s2dedicated relinearizationkeyswitch techniques (2011 )but in fact TRGSW provides the multiplication by s
The meaning of a1a2sublattices ai are exact multiples of 1
pfor a fixed small p
small ball ai is bounded
7 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
8 9
Questions
Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio
Model of computations1 Binary circuit computations
2 Integer arithmetic computation
3 Approximated (Fixed-point) computation
Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic
bull BFV (Seal Palisade) massively parallel small depth polynomials
bull CKKS (HEAAN) massively parallel floating point arithmetic
bull TFHE FHEW single eval boolean logic comparison threshold
How we can represent all plaintexts over the TN [X]
TN [X]+
noise
Ciphertext(a b)
Integers(ZpZ)n
Fixed point
C
CircuitsB = (0 1)
Homomorphic operations hierarchy
TRLWEx + y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSW ax for secret aExternal product
a isin 0 1
cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = spolynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
Circuits over the TN [X] (AND)
58
38
0 1
0=(01)(10)
14 = (0 0)3
4 = (1 1)0
1
Integers and fixed-point over the TN [X]0
2p
1p
BFV
m2τ +
minus 12L
12L
1q
CKKS
Linear combination with secret coefficients (0 1)
TRGSW(s1) TRGSW(s2) TRGSW(sn)
timesXa1
times1
timesXa2
times1
timesXan
times1
()1
0
1
0
1
0 sumsiai mod 2N
TRLWE TRLWE
Linear combination with secret coefficient s
Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s
HowTo evaluate a polynomial in s
bull dedicated relinearizationkeyswitch techniques (2011 )
bull But in fact TRGSW provides
C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)
9 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
5 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
5 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
5 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
5 9
TFHE API Operations
Leveled Homomorphic Encryption OperationsThe basic operations are
TLWE TRLWE TRGSW linear combinationsTRGSW-TRLWE external product
Some useful derived operationTRGSW-TRLWE-TRLWE privateoblivious selector (CMux)BlindRotate
Bootstrapped Homomorphic Encryption OperationsConstant gates Zero OneUnary gate NotBinary gates And Or Xor Xnor AndNot OrNot Nor NandTernary gate Mux
6 9
General internal product in BFV and CKKS
Internal product requires to evaluate a polynomail in s
(b1 minus sa1)(b2 minus sa2) = b1b2 minus (b1a2 + b2a1)s+ a1a2s2
The term s2dedicated relinearizationkeyswitch techniques (2011 )but in fact TRGSW provides the multiplication by s
The meaning of a1a2sublattices ai are exact multiples of 1
pfor a fixed small p
small ball ai is bounded
7 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
8 9
Questions
Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio
Model of computations1 Binary circuit computations
2 Integer arithmetic computation
3 Approximated (Fixed-point) computation
Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic
bull BFV (Seal Palisade) massively parallel small depth polynomials
bull CKKS (HEAAN) massively parallel floating point arithmetic
bull TFHE FHEW single eval boolean logic comparison threshold
How we can represent all plaintexts over the TN [X]
TN [X]+
noise
Ciphertext(a b)
Integers(ZpZ)n
Fixed point
C
CircuitsB = (0 1)
Homomorphic operations hierarchy
TRLWEx + y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSW ax for secret aExternal product
a isin 0 1
cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = spolynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
Circuits over the TN [X] (AND)
58
38
0 1
0=(01)(10)
14 = (0 0)3
4 = (1 1)0
1
Integers and fixed-point over the TN [X]0
2p
1p
BFV
m2τ +
minus 12L
12L
1q
CKKS
Linear combination with secret coefficients (0 1)
TRGSW(s1) TRGSW(s2) TRGSW(sn)
timesXa1
times1
timesXa2
times1
timesXan
times1
()1
0
1
0
1
0 sumsiai mod 2N
TRLWE TRLWE
Linear combination with secret coefficient s
Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s
HowTo evaluate a polynomial in s
bull dedicated relinearizationkeyswitch techniques (2011 )
bull But in fact TRGSW provides
C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)
9 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
5 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
5 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
5 9
TFHE API Operations
Leveled Homomorphic Encryption OperationsThe basic operations are
TLWE TRLWE TRGSW linear combinationsTRGSW-TRLWE external product
Some useful derived operationTRGSW-TRLWE-TRLWE privateoblivious selector (CMux)BlindRotate
Bootstrapped Homomorphic Encryption OperationsConstant gates Zero OneUnary gate NotBinary gates And Or Xor Xnor AndNot OrNot Nor NandTernary gate Mux
6 9
General internal product in BFV and CKKS
Internal product requires to evaluate a polynomail in s
(b1 minus sa1)(b2 minus sa2) = b1b2 minus (b1a2 + b2a1)s+ a1a2s2
The term s2dedicated relinearizationkeyswitch techniques (2011 )but in fact TRGSW provides the multiplication by s
The meaning of a1a2sublattices ai are exact multiples of 1
pfor a fixed small p
small ball ai is bounded
7 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
8 9
Questions
Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio
Model of computations1 Binary circuit computations
2 Integer arithmetic computation
3 Approximated (Fixed-point) computation
Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic
bull BFV (Seal Palisade) massively parallel small depth polynomials
bull CKKS (HEAAN) massively parallel floating point arithmetic
bull TFHE FHEW single eval boolean logic comparison threshold
How we can represent all plaintexts over the TN [X]
TN [X]+
noise
Ciphertext(a b)
Integers(ZpZ)n
Fixed point
C
CircuitsB = (0 1)
Homomorphic operations hierarchy
TRLWEx + y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSW ax for secret aExternal product
a isin 0 1
cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = spolynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
Circuits over the TN [X] (AND)
58
38
0 1
0=(01)(10)
14 = (0 0)3
4 = (1 1)0
1
Integers and fixed-point over the TN [X]0
2p
1p
BFV
m2τ +
minus 12L
12L
1q
CKKS
Linear combination with secret coefficients (0 1)
TRGSW(s1) TRGSW(s2) TRGSW(sn)
timesXa1
times1
timesXa2
times1
timesXan
times1
()1
0
1
0
1
0 sumsiai mod 2N
TRLWE TRLWE
Linear combination with secret coefficient s
Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s
HowTo evaluate a polynomial in s
bull dedicated relinearizationkeyswitch techniques (2011 )
bull But in fact TRGSW provides
C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)
9 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
5 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
5 9
TFHE API Operations
Leveled Homomorphic Encryption OperationsThe basic operations are
TLWE TRLWE TRGSW linear combinationsTRGSW-TRLWE external product
Some useful derived operationTRGSW-TRLWE-TRLWE privateoblivious selector (CMux)BlindRotate
Bootstrapped Homomorphic Encryption OperationsConstant gates Zero OneUnary gate NotBinary gates And Or Xor Xnor AndNot OrNot Nor NandTernary gate Mux
6 9
General internal product in BFV and CKKS
Internal product requires to evaluate a polynomail in s
(b1 minus sa1)(b2 minus sa2) = b1b2 minus (b1a2 + b2a1)s+ a1a2s2
The term s2dedicated relinearizationkeyswitch techniques (2011 )but in fact TRGSW provides the multiplication by s
The meaning of a1a2sublattices ai are exact multiples of 1
pfor a fixed small p
small ball ai is bounded
7 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
8 9
Questions
Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio
Model of computations1 Binary circuit computations
2 Integer arithmetic computation
3 Approximated (Fixed-point) computation
Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic
bull BFV (Seal Palisade) massively parallel small depth polynomials
bull CKKS (HEAAN) massively parallel floating point arithmetic
bull TFHE FHEW single eval boolean logic comparison threshold
How we can represent all plaintexts over the TN [X]
TN [X]+
noise
Ciphertext(a b)
Integers(ZpZ)n
Fixed point
C
CircuitsB = (0 1)
Homomorphic operations hierarchy
TRLWEx + y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSW ax for secret aExternal product
a isin 0 1
cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = spolynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
Circuits over the TN [X] (AND)
58
38
0 1
0=(01)(10)
14 = (0 0)3
4 = (1 1)0
1
Integers and fixed-point over the TN [X]0
2p
1p
BFV
m2τ +
minus 12L
12L
1q
CKKS
Linear combination with secret coefficients (0 1)
TRGSW(s1) TRGSW(s2) TRGSW(sn)
timesXa1
times1
timesXa2
times1
timesXan
times1
()1
0
1
0
1
0 sumsiai mod 2N
TRLWE TRLWE
Linear combination with secret coefficient s
Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s
HowTo evaluate a polynomial in s
bull dedicated relinearizationkeyswitch techniques (2011 )
bull But in fact TRGSW provides
C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)
9 9
Homomorphic operations hierarchy in TFHE
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
5 9
TFHE API Operations
Leveled Homomorphic Encryption OperationsThe basic operations are
TLWE TRLWE TRGSW linear combinationsTRGSW-TRLWE external product
Some useful derived operationTRGSW-TRLWE-TRLWE privateoblivious selector (CMux)BlindRotate
Bootstrapped Homomorphic Encryption OperationsConstant gates Zero OneUnary gate NotBinary gates And Or Xor Xnor AndNot OrNot Nor NandTernary gate Mux
6 9
General internal product in BFV and CKKS
Internal product requires to evaluate a polynomail in s
(b1 minus sa1)(b2 minus sa2) = b1b2 minus (b1a2 + b2a1)s+ a1a2s2
The term s2dedicated relinearizationkeyswitch techniques (2011 )but in fact TRGSW provides the multiplication by s
The meaning of a1a2sublattices ai are exact multiples of 1
pfor a fixed small p
small ball ai is bounded
7 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
8 9
Questions
Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio
Model of computations1 Binary circuit computations
2 Integer arithmetic computation
3 Approximated (Fixed-point) computation
Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic
bull BFV (Seal Palisade) massively parallel small depth polynomials
bull CKKS (HEAAN) massively parallel floating point arithmetic
bull TFHE FHEW single eval boolean logic comparison threshold
How we can represent all plaintexts over the TN [X]
TN [X]+
noise
Ciphertext(a b)
Integers(ZpZ)n
Fixed point
C
CircuitsB = (0 1)
Homomorphic operations hierarchy
TRLWEx + y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSW ax for secret aExternal product
a isin 0 1
cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = spolynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
Circuits over the TN [X] (AND)
58
38
0 1
0=(01)(10)
14 = (0 0)3
4 = (1 1)0
1
Integers and fixed-point over the TN [X]0
2p
1p
BFV
m2τ +
minus 12L
12L
1q
CKKS
Linear combination with secret coefficients (0 1)
TRGSW(s1) TRGSW(s2) TRGSW(sn)
timesXa1
times1
timesXa2
times1
timesXan
times1
()1
0
1
0
1
0 sumsiai mod 2N
TRLWE TRLWE
Linear combination with secret coefficient s
Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s
HowTo evaluate a polynomial in s
bull dedicated relinearizationkeyswitch techniques (2011 )
bull But in fact TRGSW provides
C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)
9 9
TFHE API Operations
Leveled Homomorphic Encryption OperationsThe basic operations are
TLWE TRLWE TRGSW linear combinationsTRGSW-TRLWE external product
Some useful derived operationTRGSW-TRLWE-TRLWE privateoblivious selector (CMux)BlindRotate
Bootstrapped Homomorphic Encryption OperationsConstant gates Zero OneUnary gate NotBinary gates And Or Xor Xnor AndNot OrNot Nor NandTernary gate Mux
6 9
General internal product in BFV and CKKS
Internal product requires to evaluate a polynomail in s
(b1 minus sa1)(b2 minus sa2) = b1b2 minus (b1a2 + b2a1)s+ a1a2s2
The term s2dedicated relinearizationkeyswitch techniques (2011 )but in fact TRGSW provides the multiplication by s
The meaning of a1a2sublattices ai are exact multiples of 1
pfor a fixed small p
small ball ai is bounded
7 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
8 9
Questions
Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio
Model of computations1 Binary circuit computations
2 Integer arithmetic computation
3 Approximated (Fixed-point) computation
Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic
bull BFV (Seal Palisade) massively parallel small depth polynomials
bull CKKS (HEAAN) massively parallel floating point arithmetic
bull TFHE FHEW single eval boolean logic comparison threshold
How we can represent all plaintexts over the TN [X]
TN [X]+
noise
Ciphertext(a b)
Integers(ZpZ)n
Fixed point
C
CircuitsB = (0 1)
Homomorphic operations hierarchy
TRLWEx + y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSW ax for secret aExternal product
a isin 0 1
cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = spolynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
Circuits over the TN [X] (AND)
58
38
0 1
0=(01)(10)
14 = (0 0)3
4 = (1 1)0
1
Integers and fixed-point over the TN [X]0
2p
1p
BFV
m2τ +
minus 12L
12L
1q
CKKS
Linear combination with secret coefficients (0 1)
TRGSW(s1) TRGSW(s2) TRGSW(sn)
timesXa1
times1
timesXa2
times1
timesXan
times1
()1
0
1
0
1
0 sumsiai mod 2N
TRLWE TRLWE
Linear combination with secret coefficient s
Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s
HowTo evaluate a polynomial in s
bull dedicated relinearizationkeyswitch techniques (2011 )
bull But in fact TRGSW provides
C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)
9 9
General internal product in BFV and CKKS
Internal product requires to evaluate a polynomail in s
(b1 minus sa1)(b2 minus sa2) = b1b2 minus (b1a2 + b2a1)s+ a1a2s2
The term s2dedicated relinearizationkeyswitch techniques (2011 )but in fact TRGSW provides the multiplication by s
The meaning of a1a2sublattices ai are exact multiples of 1
pfor a fixed small p
small ball ai is bounded
7 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
8 9
Questions
Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio
Model of computations1 Binary circuit computations
2 Integer arithmetic computation
3 Approximated (Fixed-point) computation
Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic
bull BFV (Seal Palisade) massively parallel small depth polynomials
bull CKKS (HEAAN) massively parallel floating point arithmetic
bull TFHE FHEW single eval boolean logic comparison threshold
How we can represent all plaintexts over the TN [X]
TN [X]+
noise
Ciphertext(a b)
Integers(ZpZ)n
Fixed point
C
CircuitsB = (0 1)
Homomorphic operations hierarchy
TRLWEx + y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSW ax for secret aExternal product
a isin 0 1
cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = spolynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
Circuits over the TN [X] (AND)
58
38
0 1
0=(01)(10)
14 = (0 0)3
4 = (1 1)0
1
Integers and fixed-point over the TN [X]0
2p
1p
BFV
m2τ +
minus 12L
12L
1q
CKKS
Linear combination with secret coefficients (0 1)
TRGSW(s1) TRGSW(s2) TRGSW(sn)
timesXa1
times1
timesXa2
times1
timesXan
times1
()1
0
1
0
1
0 sumsiai mod 2N
TRLWE TRLWE
Linear combination with secret coefficient s
Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s
HowTo evaluate a polynomial in s
bull dedicated relinearizationkeyswitch techniques (2011 )
bull But in fact TRGSW provides
C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)
9 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
8 9
Questions
Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio
Model of computations1 Binary circuit computations
2 Integer arithmetic computation
3 Approximated (Fixed-point) computation
Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic
bull BFV (Seal Palisade) massively parallel small depth polynomials
bull CKKS (HEAAN) massively parallel floating point arithmetic
bull TFHE FHEW single eval boolean logic comparison threshold
How we can represent all plaintexts over the TN [X]
TN [X]+
noise
Ciphertext(a b)
Integers(ZpZ)n
Fixed point
C
CircuitsB = (0 1)
Homomorphic operations hierarchy
TRLWEx + y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSW ax for secret aExternal product
a isin 0 1
cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = spolynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
Circuits over the TN [X] (AND)
58
38
0 1
0=(01)(10)
14 = (0 0)3
4 = (1 1)0
1
Integers and fixed-point over the TN [X]0
2p
1p
BFV
m2τ +
minus 12L
12L
1q
CKKS
Linear combination with secret coefficients (0 1)
TRGSW(s1) TRGSW(s2) TRGSW(sn)
timesXa1
times1
timesXa2
times1
timesXan
times1
()1
0
1
0
1
0 sumsiai mod 2N
TRLWE TRLWE
Linear combination with secret coefficient s
Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s
HowTo evaluate a polynomial in s
bull dedicated relinearizationkeyswitch techniques (2011 )
bull But in fact TRGSW provides
C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)
9 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
8 9
Questions
Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio
Model of computations1 Binary circuit computations
2 Integer arithmetic computation
3 Approximated (Fixed-point) computation
Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic
bull BFV (Seal Palisade) massively parallel small depth polynomials
bull CKKS (HEAAN) massively parallel floating point arithmetic
bull TFHE FHEW single eval boolean logic comparison threshold
How we can represent all plaintexts over the TN [X]
TN [X]+
noise
Ciphertext(a b)
Integers(ZpZ)n
Fixed point
C
CircuitsB = (0 1)
Homomorphic operations hierarchy
TRLWEx + y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSW ax for secret aExternal product
a isin 0 1
cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = spolynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
Circuits over the TN [X] (AND)
58
38
0 1
0=(01)(10)
14 = (0 0)3
4 = (1 1)0
1
Integers and fixed-point over the TN [X]0
2p
1p
BFV
m2τ +
minus 12L
12L
1q
CKKS
Linear combination with secret coefficients (0 1)
TRGSW(s1) TRGSW(s2) TRGSW(sn)
timesXa1
times1
timesXa2
times1
timesXan
times1
()1
0
1
0
1
0 sumsiai mod 2N
TRLWE TRLWE
Linear combination with secret coefficient s
Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s
HowTo evaluate a polynomial in s
bull dedicated relinearizationkeyswitch techniques (2011 )
bull But in fact TRGSW provides
C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)
9 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
8 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
8 9
Questions
Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio
Model of computations1 Binary circuit computations
2 Integer arithmetic computation
3 Approximated (Fixed-point) computation
Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic
bull BFV (Seal Palisade) massively parallel small depth polynomials
bull CKKS (HEAAN) massively parallel floating point arithmetic
bull TFHE FHEW single eval boolean logic comparison threshold
How we can represent all plaintexts over the TN [X]
TN [X]+
noise
Ciphertext(a b)
Integers(ZpZ)n
Fixed point
C
CircuitsB = (0 1)
Homomorphic operations hierarchy
TRLWEx + y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSW ax for secret aExternal product
a isin 0 1
cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = spolynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
Circuits over the TN [X] (AND)
58
38
0 1
0=(01)(10)
14 = (0 0)3
4 = (1 1)0
1
Integers and fixed-point over the TN [X]0
2p
1p
BFV
m2τ +
minus 12L
12L
1q
CKKS
Linear combination with secret coefficients (0 1)
TRGSW(s1) TRGSW(s2) TRGSW(sn)
timesXa1
times1
timesXa2
times1
timesXan
times1
()1
0
1
0
1
0 sumsiai mod 2N
TRLWE TRLWE
Linear combination with secret coefficient s
Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s
HowTo evaluate a polynomial in s
bull dedicated relinearizationkeyswitch techniques (2011 )
bull But in fact TRGSW provides
C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)
9 9
Homomorphic operations hierarchy
TRLWEx+ y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSWax for secret aExternal product
a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = s polynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
8 9
Questions
Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio
Model of computations1 Binary circuit computations
2 Integer arithmetic computation
3 Approximated (Fixed-point) computation
Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic
bull BFV (Seal Palisade) massively parallel small depth polynomials
bull CKKS (HEAAN) massively parallel floating point arithmetic
bull TFHE FHEW single eval boolean logic comparison threshold
How we can represent all plaintexts over the TN [X]
TN [X]+
noise
Ciphertext(a b)
Integers(ZpZ)n
Fixed point
C
CircuitsB = (0 1)
Homomorphic operations hierarchy
TRLWEx + y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSW ax for secret aExternal product
a isin 0 1
cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = spolynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
Circuits over the TN [X] (AND)
58
38
0 1
0=(01)(10)
14 = (0 0)3
4 = (1 1)0
1
Integers and fixed-point over the TN [X]0
2p
1p
BFV
m2τ +
minus 12L
12L
1q
CKKS
Linear combination with secret coefficients (0 1)
TRGSW(s1) TRGSW(s2) TRGSW(sn)
timesXa1
times1
timesXa2
times1
timesXan
times1
()1
0
1
0
1
0 sumsiai mod 2N
TRLWE TRLWE
Linear combination with secret coefficient s
Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s
HowTo evaluate a polynomial in s
bull dedicated relinearizationkeyswitch techniques (2011 )
bull But in fact TRGSW provides
C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)
9 9
Questions
Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio
Model of computations1 Binary circuit computations
2 Integer arithmetic computation
3 Approximated (Fixed-point) computation
Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic
bull BFV (Seal Palisade) massively parallel small depth polynomials
bull CKKS (HEAAN) massively parallel floating point arithmetic
bull TFHE FHEW single eval boolean logic comparison threshold
How we can represent all plaintexts over the TN [X]
TN [X]+
noise
Ciphertext(a b)
Integers(ZpZ)n
Fixed point
C
CircuitsB = (0 1)
Homomorphic operations hierarchy
TRLWEx + y xminus yax for public a isin ZN [X]
small integer linear combinations
TRGSW ax for secret aExternal product
a isin 0 1
cmux (selector)blindrotate (timesXsecret ν)(automata)
TFHE Gates API
nand andor xor mux
individual bits
a = spolynomials in s(internal products)
Sublattice Small Ball(modular ring) (real ring)
CKKS APIfixed point slots
slots addslots multslots rotate
BFV APIslots mod p
slots addslots multslots rotate
Circuits over the TN [X] (AND)
58
38
0 1
0=(01)(10)
14 = (0 0)3
4 = (1 1)0
1
Integers and fixed-point over the TN [X]0
2p
1p
BFV
m2τ +
minus 12L
12L
1q
CKKS
Linear combination with secret coefficients (0 1)
TRGSW(s1) TRGSW(s2) TRGSW(sn)
timesXa1
times1
timesXa2
times1
timesXan
times1
()1
0
1
0
1
0 sumsiai mod 2N
TRLWE TRLWE
Linear combination with secret coefficient s
Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s
HowTo evaluate a polynomial in s
bull dedicated relinearizationkeyswitch techniques (2011 )
bull But in fact TRGSW provides
C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)
9 9