TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera:...
Transcript of TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera:...
![Page 1: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/1.jpg)
TFHE - Chimera: How to combine fully homomorphic encryptionschemes? Application: Feature selection
N. Gama2,3, M. Georgieva 1,2
1 2 2
Joint work with: C. Boura, D. Jetchev, S. Carpov, J.R. Troncoso, I.Chillotti et.al.
1 / 53
![Page 2: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/2.jpg)
Fully Homomorphic Encryption
Plan
1 Fully Homomorphic Encryption
2 Learning with error over the Torus
3 The framework Chimera
4 Application: feature selection
2 / 53
![Page 3: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/3.jpg)
Fully Homomorphic Encryption
The idea
Is it possible to manipulate the data without decryption?
3 / 53
![Page 4: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/4.jpg)
Fully Homomorphic Encryption
The idea
3 / 53
![Page 5: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/5.jpg)
Fully Homomorphic Encryption
Homomorphic encryption
Given (c1, c2, . . . , ck) = (E(m1), E(m2), . . . , E(mk))
The homomorphic computation consists to computeE(f(m1,m2, . . . ,mk)) without decryption.
A scheme that can homomorphically evaluate all function is saidFully Homomorphic
4 / 53
![Page 6: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/6.jpg)
Fully Homomorphic Encryption
Examples: homomorphic schemes
Multiplicatively homomorphic : RSA
c1 = me1 mod N et c2 = me2 mod N
Eval(c1, c2) = c1.c2 = (m1.m2)e mod N = E(m1.m2) mod N
Additively homomorphic : Paillier
c1 = gm1rn1 mod n2 et c2 = gm2rn2 mod n2
Eval(c1, c2) = c1.c2 = gm1+m2 (r1.r2)n mod n2 = E(m1 +m2) mod n2
Fully homomorphic : homomorphic for both addition and multiplication
5 / 53
![Page 7: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/7.jpg)
Fully Homomorphic Encryption
Model of computations
1 Integer arithmetic
2 Approximated (Fixed-point) computations
3 Binary, circuit computations
6 / 53
![Page 8: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/8.jpg)
Fully Homomorphic Encryption
Integer arithmetic
Given encrypted m1,m2 ∈ Z, compute:
m1 Dec( m1 +hom m2 ) = Dec( m1+m2 )
−→
m2 Dec( m1 ∗hom m2 ) = Dec( m1∗m2 )
Possibility to do SIMD arithmetic:
Given encrypted m1,m2 ∈ ZN :element-wise addition m1 +m2
element-wise product m1 ∗m2
permutations σ(m1)
Usually, arbitrary precision integers are not FHE friendly:arithmetic modulo some mid-size p(e.g. p = 232, like ints in C)if so, be aware of overflows:(e.g. 230 + 230 = −231 in C)
7 / 53
![Page 9: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/9.jpg)
Fully Homomorphic Encryption
Floating point computations
In physics, we use real or complex numbers, but care only about order of magnitudes:
Example:If the height of a person must be known ± 1cm, the radius of the earth can be given ± 10km. Inboth case, we just care about the 3 most significant decimal digits.
m1,m2 ∈ R
m1 MSB(Dec( m1 +hom m2 )) = MSB(Dec( m1+m2 ))
−→
m2 MSB(Dec( m1 ∗hom m2 )) = MSB(Dec( m1∗m2 ))
8 / 53
![Page 10: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/10.jpg)
Fully Homomorphic Encryption
There are two models: Fixed points and Floating point
Floating point (float, double in C):
x = m.2τ , with m ∈ 2−ρ.Z and 12 ≤ |m| < 1
τ = dlog2(x)e data dependent and not public (not FHE-friendly)The exponent is always in sync with the dataex: (1.23 · 10−4) ∗ (7.24 · 10−4) = (8.90 · 10−8)
Fixed point:
x = m.2τ , with m ∈ 2−ρ.Z and 0 ≤ |m| < 1,τ is public, thus FHE-friendlyRisk of overflow (τ too small)Risk of underflow (τ too large)ex: (0.000123 · 100) ∗ (0.000724 · 100) = (0.000000 · 100)
Plaintext parameters:ρ ∈ N: bits of precision of the plaintext (≈ 15 bits)τ ∈ Z: slot exponent (order of magnitude of the complex values in each slot)
9 / 53
![Page 11: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/11.jpg)
Fully Homomorphic Encryption
Fixed point
Here again, we would like:
(possibly SIMD) Fixed point addition(possibly SIMD) Fixed point multiplicationpermutations
Addition is much tricker than you think!
Given (m1, τ1), (m2, τ2), and τ .How do you compute m.2τ = m1.2τ1 +m2.2τ2 with ρ bits of precision?Addition requires right shift and roundings, which are non-linear!
10 / 53
![Page 12: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/12.jpg)
Fully Homomorphic Encryption
Fixed point
Here again, we would like:
(possibly SIMD) Fixed point addition(possibly SIMD) Fixed point multiplicationpermutations
Addition is much tricker than you think!
Given (m1, τ1), (m2, τ2), and τ .How do you compute m.2τ = m1.2τ1 +m2.2τ2 with ρ bits of precision?Addition requires right shift and roundings, which are non-linear!
10 / 53
![Page 13: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/13.jpg)
Fully Homomorphic Encryption
Circuit computations
b1, b2 ∈ {0, 1}
b1 Dec( b1 ⊕hom b2 ) = Dec( b1⊕b2 )
−→
b2 Dec( b1 ∧hom b2 ) = Dec( b1∧b2 )
3 kind of interesting circuits:
boolean gates (fully boolean): NAND, AND, OR, NOT, XOR, MUXlookup tables (mixed): given (v0, . . . , vn) and i, return videcision diagrams, or automata (also mixed): everytime you read a bit, you update aninternal state. Return some info about the arrival state, or on the whole path.
A few examples:e.g. given the bits of x, compute x mod 7e.g. given public integers (ai) and encrypted bits of s, compute
∑(aisi) mod 1024
11 / 53
![Page 14: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/14.jpg)
Fully Homomorphic Encryption
Interesting example: The comparison circuit
12 / 53
![Page 15: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/15.jpg)
Fully Homomorphic Encryption
Interesting example: The comparison circuit
12 / 53
![Page 16: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/16.jpg)
Fully Homomorphic Encryption
Interesting example: The comparison circuit
12 / 53
![Page 17: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/17.jpg)
Fully Homomorphic Encryption
Interesting example: The comparison circuit
12 / 53
![Page 18: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/18.jpg)
Fully Homomorphic Encryption
Interesting example: The comparison circuit
12 / 53
![Page 19: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/19.jpg)
Fully Homomorphic Encryption
Interesting example: The comparison circuit
12 / 53
![Page 20: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/20.jpg)
Learning with error over the Torus
Plan
1 Fully Homomorphic Encryption
2 Learning with error over the Torus
3 The framework Chimera
4 Application: feature selection
13 / 53
![Page 21: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/21.jpg)
Learning with error over the Torus
Reel/Complex polynomials
RN [X] = R[X]/(XN + 1): the ring of polynomials with reel coefficients modulo XN + 1CN [X] = C[X]/(XN + 1): the ring of polynomials with complex coefficients modulo XN + 1
Examples: N = 2
(1.2 + 2.3X) · (3.2 + 4.1X) = 3.84 + 12.28X + 9.43X2 = 12.28X − 5.59 mod (X2 + 1)
(RN [X],+,×) and (CN [X],+,×) are well defined as Ring4 (RN [X],+) and (CN [X],+) are groups4 It is a Ring: x×y is defined!
14 / 53
![Page 22: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/22.jpg)
Learning with error over the Torus
Coefficient and Slot packing
Coefficient packing
m =N−1∑i=0
mi ·Xi ∼ m = (m0,m1, . . . ,mN−1)
with mi ∈ C for all i = 0, 1, . . . , N − 1
m0 m1 m2 . . . mN−2 mN−1
Slot packing
XN + 1 =N−1∏i=0
(X − ωi) ∼ m = (m(ω0),m(ω1), . . . ,m(ωN−1))
with ωi ∈ C for all i = 0, 1, . . . , N − 1
m(ω0) m(ω1) m(ω2) . . . m(ωN−2) m(ωN−1)
15 / 53
![Page 23: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/23.jpg)
Learning with error over the Torus
Coefficient and Slot packing
Coefficient packing
m =N−1∑i=0
mi ·Xi ∼ m = (m0,m1, . . . ,mN−1)
with mi ∈ C for all i = 0, 1, . . . , N − 1
m0 m1 m2 . . . mN−2 mN−1
Slot packing
XN + 1 =N−1∏i=0
(X − ωi) ∼ m = (m(ω0),m(ω1), . . . ,m(ωN−1))
with ωi ∈ C for all i = 0, 1, . . . , N − 1
m(ω0) m(ω1) m(ω2) . . . m(ωN−2) m(ωN−1)
15 / 53
![Page 24: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/24.jpg)
Learning with error over the Torus
Morphism between coefficient and slot packing
MorphismThere exists morphism to switch between the coefficient and slot representation!(Vandermonde, DFT,...)
V DM =
1 ω1
0 · · · ωN−10
1 ω11 · · · ωN−1
1...
... · · ·...
1 ω1N−1 · · · ωN−1
N−1
.
A complex polynomial mod XN + 1 carries N complex slots.A real polynomial mod XN + 1 carries N/2 complex slots.
The VDM matrix is hermitian (orthonormal for the complex): slots are small ⇔ coeffs are small.
16 / 53
![Page 25: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/25.jpg)
Learning with error over the Torus
Integer plaintext space
ZN [X] = Z[X]/(XN + 1): the ring of polynomials with integer coefficients module XN + 1
Examples: N = 2
(1 + 2X) · (3 + 4X) = 3 + 10X + 8X2 = 10X − 5 mod (X2 + 1)
Attention, some additional constraints are needed to define slots
17 / 53
![Page 26: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/26.jpg)
Learning with error over the Torus
The torus T
(T,+, ·) = R mod 1 is a Z-module (· : Z× T→ T a valid external product)4 It is a group x+ y mod 1, and −x mod 14 It is a Z-module: 0 · 1
2 = 0 is defined!
8 It is not a Ring: 0× 12 is not defined!
0
12
14
34
18 / 53
![Page 27: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/27.jpg)
Learning with error over the Torus
The torus T
(T,+, ·) = R mod 1 is a Z-module (· : Z× T→ T a valid external product)4 It is a group x+ y mod 1, and −x mod 14 It is a Z-module: 0 · 1
2 = 0 is defined!
8 It is not a Ring: 0× 12 is not defined!
0
12
14
34
18 / 53
![Page 28: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/28.jpg)
Learning with error over the Torus
The torus T
(T,+, ·) = R mod 1 is a Z-module (· : Z× T→ T a valid external product)4 It is a group x+ y mod 1, and −x mod 14 It is a Z-module: 0 · 1
2 = 0 is defined!
8 It is not a Ring: 0× 12 is not defined!
0
12
14
34
18 / 53
![Page 29: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/29.jpg)
Learning with error over the Torus
The torus T
(T,+, ·) = R mod 1 is a Z-module (· : Z× T→ T a valid external product)4 It is a group x+ y mod 1, and −x mod 14 It is a Z-module: 0 · 1
2 = 0 is defined!
8 It is not a Ring: 0× 12 is not defined!
0
12
14
34
18 / 53
![Page 30: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/30.jpg)
Learning with error over the Torus
Torus polynomials TN [X]
(TN [X],+, ·) is a ZN [X]-moduleHere, ZN [X] = Z[X] mod (XN + 1)And TN [X] = R[X] mod (XN + 1) mod 1
Examples
(1 + 2X) · ( 13 + 4
7X) =( 421 + 5
21X) mod (X2 + 1) mod 1
19 / 53
![Page 31: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/31.jpg)
Learning with error over the Torus
Torus polynomials TN [X]
(TN [X],+, ·) is a ZN [X]-moduleHere, ZN [X] = Z[X] mod (XN + 1)And TN [X] = R[X] mod (XN + 1) mod 1
Examples
(1 + 2X) · ( 13 + 4
7X) =( 421 + 5
21X) mod (X2 + 1) mod 1
19 / 53
![Page 32: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/32.jpg)
Learning with error over the Torus
Torus polynomials TN [X]
(TN [X],+, ·) is a ZN [X]-moduleHere, ZN [X] = Z[X] mod (XN + 1)And TN [X] = R[X] mod (XN + 1) mod 1
Examples
(1 + 2X) · ( 13 + 4
7X) =( 421 + 5
21X) mod (X2 + 1) mod 1
19 / 53
![Page 33: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/33.jpg)
Learning with error over the Torus
LWE Encryption over the torus (T = R/Z = R mod 1)
1/32/3
0
Example: M = {0, 1/3, 2/3} mod 1
µ = 1/3 mod 1 ∈ M
20 / 53
![Page 34: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/34.jpg)
Learning with error over the Torus
LWE Encryption over the torus (T = R/Z = R mod 1)
message ciphertext key lin. combin. productTLWE T
1/32/3
0
Example: M = {0, 1/3, 2/3} mod 1
µ = 1/3 mod 1 ∈ M
( , ϕ)
1 ϕ = µ + Gaussian Error2 Random mask a ∈ Tn
20 / 53
![Page 35: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/35.jpg)
Learning with error over the Torus
LWE Encryption over the torus (T = R/Z = R mod 1)
message ciphertext key lin. combin. productTLWE T Tn+1
1/32/3
0
Example: M = {0, 1/3, 2/3} mod 1
µ = 1/3 mod 1 ∈ M
a
(a, ϕ)
secret key: s ∈ {0, 1}n
1 ϕ = µ + Gaussian Error2 Random mask a ∈ Tn
20 / 53
![Page 36: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/36.jpg)
Learning with error over the Torus
LWE Encryption over the torus (T = R/Z = R mod 1)
message ciphertext key lin. combin. productTLWE T Tn+1
1/32/3
0
Example: M = {0, 1/3, 2/3} mod 1
µ = 1/3 mod 1 ∈ M
a
(a, ϕ)
a
(a, b)
b = s · a+ ϕ
secret key: s ∈ {0, 1}n
1 ϕ = µ + Gaussian Error2 Random mask a ∈ Tn
20 / 53
![Page 37: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/37.jpg)
Learning with error over the Torus
LWE Encryption over the torus (T = R/Z = R mod 1)
message ciphertext key lin. combin. productTLWE T Tn+1 Bn
1/32/3
0
Example: M = {0, 1/3, 2/3} mod 1
µ = 1/3 mod 1 ∈ M
a
(a, ϕ)
a
(a, b)
secret key: s ∈ {0, 1}n
ϕ = b− s · a
1 Unlock the representation (a, ϕ)2 Round ϕ to the nearest message µ ∈M
20 / 53
![Page 38: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/38.jpg)
Learning with error over the Torus
LWE Encryption over the torus (T = R/Z = R mod 1)
message ciphertext key lin. combin. productTLWE T Tn+1 Bn
a
(a, ϕ)
a
(a, b)
secret key: s ∈ {0, 1}n
ϕ = b− s · a1/32/3
0
1 Unlock the representation (a, ϕ)2 Round ϕ to the nearest message µ ∈M
20 / 53
![Page 39: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/39.jpg)
Learning with error over the Torus
LWE Encryption over the torus
message ciphertext key lin. combin. productTLWE T Tn+1 Bn
TRLWE TN [X] TN [X]k+1 BN [X]k
a a′ a′′+ =
b′′b b′
x a′′ = x · a+ y · a′
b′′ = x · b+ y · b′y
a a′′a′+ =
ϕ′′ϕ ϕ′ ϕ′′ = x · ϕ+ y · ϕ′x y
α′′α = stdev(ϕ) α′ α′′2 = x2α2 + y2α′2
21 / 53
![Page 40: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/40.jpg)
Learning with error over the Torus
LWE Encryption over the torus
message ciphertext key lin. combin. productTLWE T Tn+1 Bn 4 8
TRLWE TN [X] TN [X]k+1 BN [X]k 4 8
a a′ a′′+ =
b′′b b′
x a′′ = x · a+ y · a′
b′′ = x · b+ y · b′y
a a′′a′+ =
ϕ′′ϕ ϕ′ ϕ′′ = x · ϕ+ y · ϕ′x y
α′′α = stdev(ϕ) α′ α′′2 = x2α2 + y2α′2
21 / 53
![Page 41: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/41.jpg)
Learning with error over the Torus
message ciphertext key lin. combin. productTLWE T Tn+1 Bn 4 8
TRLWE TN [X] TN [X]k+1 BN [X]k 4 8
TRGSW ZN [X] `-vector of TRLWE BN [X]k
TR(GSW) ciphertexts of µ ∈ ZN [X]
TRGSW(µ) =
TRLWEK(K · µ2 )TRLWEK(K · µ4 )TRLWEK(K · µ8 )TRLWEK(1 · µ2 )TRLWEK(1 · µ4 )TRLWEK(1 · µ8 )
1 Internal Product (classical): � : TRGSW× TRGSW −→ TRGSW
2 External product (Asiacrypt 2016): � : TRGSW× TRLWE −→ TRLWE(µA, µb) 7−→ µA · µb(εA, εb) 7−→ ||µA||1 ∗ εb +O(εA)
If ||µA||1 = 1 the noise propagation is linear!
22 / 53
![Page 42: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/42.jpg)
Learning with error over the Torus
message ciphertext key lin. combin. productTLWE T Tn+1 Bn 4 8
TRLWE TN [X] TN [X]k+1 BN [X]k 4 8
TRGSW ZN [X] `-vector of TRLWE BN [X]k 4 4
TR(GSW) ciphertexts of µ ∈ ZN [X]
TRGSW(µ) =
TRLWEK(K · µ2 )TRLWEK(K · µ4 )TRLWEK(K · µ8 )TRLWEK(1 · µ2 )TRLWEK(1 · µ4 )TRLWEK(1 · µ8 )
1 Internal Product (classical): � : TRGSW× TRGSW −→ TRGSW
2 External product (Asiacrypt 2016): � : TRGSW× TRLWE −→ TRLWE(µA, µb) 7−→ µA · µb(εA, εb) 7−→ ||µA||1 ∗ εb +O(εA)
If ||µA||1 = 1 the noise propagation is linear!
22 / 53
![Page 43: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/43.jpg)
Learning with error over the Torus
message ciphertext key lin. combin. productTLWE T Tn+1 Bn 4 8
TRLWE TN [X] TN [X]k+1 BN [X]k 4 8
TRGSW ZN [X] `-vector of TRLWE BN [X]k 4 4
TR(GSW) ciphertexts of µ ∈ ZN [X]
TRGSW(µ) =
TRLWEK(K · µ2 )TRLWEK(K · µ4 )TRLWEK(K · µ8 )TRLWEK(1 · µ2 )TRLWEK(1 · µ4 )TRLWEK(1 · µ8 )
1 Internal Product (classical): � : TRGSW× TRGSW −→ TRGSW
2 External product (Asiacrypt 2016): � : TRGSW× TRLWE −→ TRLWE(µA, µb) 7−→ µA · µb(εA, εb) 7−→ ||µA||1 ∗ εb +O(εA)
If ||µA||1 = 1 the noise propagation is linear!
22 / 53
![Page 44: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/44.jpg)
The framework Chimera
Plan
1 Fully Homomorphic Encryption
2 Learning with error over the Torus
3 The framework Chimera
4 Application: feature selection
23 / 53
![Page 45: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/45.jpg)
The framework Chimera
How choose the homomorphic scheme?
Strengths of HE libraries
BGV/Helib: SIMD finite field arithmeticB/FV, Seal: SIMD vector mod p
HEAAN: SIMD fixed point arithmeticTFHE: single evaluation, boolean logic,comparison, threshold, complex circuitsetc...
How to get all the benefits without thelimitations?
Solution: ChimeraUnified plaintext space over the TorusSwitch between ciphertext representationsImplement bridges between TFHE, B/FVand HEAAN
24 / 53
![Page 46: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/46.jpg)
The framework Chimera
How we can represent all plaintexts over the TN [X]?
TN [X]+
noise?
Ciphertext
(a, b)
Integers
(Z/pZ)n
Fixed point
C
CircuitsB = (0, 1)
25 / 53
![Page 47: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/47.jpg)
The framework Chimera
Circuit
TN [X]+
noise?
Ciphertext
(a, b)
Integers
(Z/pZ)n
Fixed point
C
CircuitsB = (0, 1)
26 / 53
![Page 48: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/48.jpg)
The framework Chimera
Circuit: CMux
CMux(C, d1, d0) = C � (d1 − d0) + d0
TRGSW
TRLWE
TRLWE
C
d0
d1
0
1
CMux(C,d1,d0)TRLWE
27 / 53
![Page 49: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/49.jpg)
The framework Chimera
LUT evaluation
LookUp Tables (LUT) to evaluate arbitrary functions:
f : Bd −→ Ts
x = (x0, . . . , xd−1) 7−→ f(x) = (f0(x), . . . , fs−1(x))
Example with d = 3 and s = 2
x0 x1 x2 f0 f10 0 0 0.5 0.31 0 0 0.25 0.70 1 0 0.1 0.611 1 0 0.83 0.90 0 1 0.23 0.471 0 1 0.67 0.420 1 1 0.78 0.121 1 1 0.35 0.95
Evaluation via MUX tree
0
1
c
d0
d1
c?d1 : d0
28 / 53
![Page 50: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/50.jpg)
The framework Chimera
LUT evaluation
LookUp Tables (LUT) to evaluate arbitrary functions:
f : Bd −→ Ts
x = (x0, . . . , xd−1) 7−→ f(x) = (f0(x), . . . , fs−1(x))
Example with d = 3 and s = 2
x0 x1 x2 f0 f10 0 0 0.5 0.31 0 0 0.25 0.70 1 0 0.1 0.611 1 0 0.83 0.90 0 1 0.23 0.471 0 1 0.67 0.420 1 1 0.78 0.121 1 1 0.35 0.95
Evaluation via MUX tree
0
1
c
d0
d1
c?d1 : d0
28 / 53
![Page 51: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/51.jpg)
The framework Chimera
LUT evaluation
LookUp Tables (LUT) to evaluate arbitrary functions:
f : Bd −→ Ts
x = (x0, . . . , xd−1) 7−→ f(x) = (f0(x), . . . , fs−1(x))
Example with d = 3 and s = 2
x0 x1 x2 f0 f10 0 0 0.5 0.31 0 0 0.25 0.70 1 0 0.1 0.611 1 0 0.83 0.90 0 1 0.23 0.471 0 1 0.67 0.420 1 1 0.78 0.121 1 1 0.35 0.95
Evaluation via MUX tree
0
1
c
d0
d1
c?d1 : d0
28 / 53
![Page 52: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/52.jpg)
The framework Chimera
LUT evaluation
How to evaluate it?
x0 . . . xd−1 f0 . . . fs−1
0 . . . 0 σ0,0 . . . σs−1,0 σj,0
1 . . . 0 σ0,1 . . . σs−1,1 σj,1
0 . . . 0 σ0,2 . . . σs−1,2 σj,2
1 . . . 0 σ0,3 . . . σs−1,3 σj,3
.... . . ...
......
......
0 . . . 1 σ0,2d−4 . . . σs−1,2d−4 σj,2d−4
1 . . . 1 σ0,2d−3 . . . σs−1,2d−3 σj,2d−3
0 . . . 1 σ0,2d−2 . . . σs−1,2d−2 σj,2d−2
1 . . . 1 σ0,2d−1 . . . σs−1,2d−1 σj,2d−1
0
1
0
1
0
1
0
1
0
1
0
1
. . .0
1oj
fj x0 x1 . . . xd−1
29 / 53
![Page 53: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/53.jpg)
The framework Chimera
LUT evaluation: Batching and Packing
Packing data in TRLWE
TLWE: messages m ∈ TTRLWE: messages m ∈ TN [X]
m =N−1∑i=0
mi ·Xi ∼ m = (m0,m1, . . . ,mN−1)
with mi ∈ T for all i = 0, 1, . . . , N − 1
m0 m1 m2 . . . mN−2 mN−1
30 / 53
![Page 54: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/54.jpg)
The framework Chimera
LUT evaluation: Batching and Vertical Packing
Batching (Horizontal Packing)
Pack the outputs in a TRLWE ciphertext (green box)
x0 . . . xd−1 f0 . . . fs−1
0 . . . 0 σ0,0 . . . σs−1,0
1 . . . 0 σ0,1 . . . σs−1,1
0 . . . 0 σ0,2 . . . σs−1,2
1 . . . 0 σ0,3 . . . σs−1,3
.... . . ...
......
...
0 . . . 1 σ0,2d−4 . . . σs−1,2d−4
1 . . . 1 σ0,2d−3 . . . σs−1,2d−3
0 . . . 1 σ0,2d−2 . . . σs−1,2d−2
1 . . . 1 σ0,2d−1 . . . σs−1,2d−1
0
1
0
1
0
1
0
1
0
1
0
1
. . .0
1σ0 . . . σs−1
x0 x1 . . . xd−1
31 / 53
![Page 55: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/55.jpg)
The framework Chimera
The noise in FHE
Animation Circuit
32 / 53
![Page 56: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/56.jpg)
The framework Chimera
Bootstrapping
Gentry’s breakthtough idea : refresh the ciphertext by evaluating the decryption circuithomomorphically (using the decryption key bits in encrypted form).
c1
c`
ciphertext
secret key
c2
...
...
message
bits
bits
k1
kn
0
k2
Decryptioncircuit(public)
33 / 53
![Page 57: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/57.jpg)
The framework Chimera
Bootstrapping
Gentry’s breakthtough idea : refresh the ciphertext by evaluating the decryption circuithomomorphically (using the decryption key bits in encrypted form).
c1
c`
ciphertext
secret key
c2
...
...
message
bits
bits
k1
kn
0
k2
Decryptioncircuit(public)
encrypted
encrypted
Decryptioncircuit(public)
hom.
33 / 53
![Page 58: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/58.jpg)
The framework Chimera
Gate Bootstrapping (TLWE to TLWE)
0
12
14
34 [. . . ]
v0
v1
v2
vi
vi+1
v2N−1
Bootstrapping algorithm of (a, b)
1. Start from (a trivial) TRLWE ciphertext of message. v0 + v1X + · · ·+ vN−1X
N−1
. N coefs mod XN + 1 can be viewed as 2N coefs mod X2N − 1 s.t. . vN+i = −vi2. Rotate it by t = −ϕs(a, b) positions using external product.3. Extract the constant term (which encrypts vp).
34 / 53
![Page 59: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/59.jpg)
The framework Chimera
Circuit: Blindrotate
TRGSW(s1) TRGSW(s2) TRGSW(sn)
×Xa1
×1
×Xa2
×1
×Xan
×1
(...)1
0
1
0
1
0 ∑si.ai mod 2N
TRLWE TRLWE
35 / 53
![Page 60: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/60.jpg)
The framework Chimera
Exemple AND
58
38
0 1
0=(0,1)/(1,0)
14 = (0, 0)3
4 = (1, 1)0
1
ANDSum + BlindRotate
NAND, OR, NOT ...
36 / 53
![Page 61: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/61.jpg)
The framework Chimera
Integers
TN [X]+
noise?
Ciphertext
(a, b)
Integers
(Z/pZ)n
Fixed point
C
CircuitsB = (0, 1)
37 / 53
![Page 62: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/62.jpg)
The framework Chimera
BFV scheme (encoding)
ZN [X] mod p: the ring of polynomials with integer mod p coefficients module XN + 1If XN + 1 has N roots mod p, Z/pZN is isomorphic to ZN [X] mod p (analogue of thecomplex slots, but mod p).
Examples: N = 2, p = 5
coeffs: (1 + X) · (3 + 4X) = 3 + 7X + 4X2 = 4 + 2X mod (X2 + 1) mod 5Roots of X2 + 1 mod 5: green: X=2, blue: X=3slots: [3, 4] · [1, 0] = [3, 0] mod 5
Coefficient to slot representation
In BFV: p should verify some conditions (never power of 2)In BGV: any p (work in extended fields)
38 / 53
![Page 63: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/63.jpg)
The framework Chimera
BFV scheme (encoding)
(Z/pZ)N ' ZN [X] mod p '1pZN [X] mod 1
The plaintext spaceM is composed by exact multiples of 1p.
0
2p
1p
Plaintext addition (µ1(X), µ2(X))
µ1(X) + µ2(X) := µ1(X) + µ2(X) mod 1.
Plaintext product (Montgomery) (µ1(X), µ2(X))
µ1(X) �p µ2(X) := p · µ1(X) · µ2(X) mod 1.
39 / 53
![Page 64: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/64.jpg)
The framework Chimera
Problem of lift
Examples: p = 3, µ1 = 13 and µ1 = 2
3
Exact product: 3(I1 + 13 )(I2 + 2
3 ) = I + 23 = + 2
3 mod 1, for all I1, I2 integersProduct with noise and small element: 3 ∗ 5.33333 ∗ 10.66665 = 170.6662Product with noise and big element: 3 ∗ 12345678.33333 ∗ 7654321.66665 = −.839 . . .
We need a small representative of the plaintext to keep the result correct.We should lift the ciphertext to small representative in R[X] (all coefficients in [−1/2, 1/2)).1p� noise
40 / 53
![Page 65: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/65.jpg)
The framework Chimera
Homomorphic operations
Homomorphic addition c1 = (a1, b1), c2 = (a2, b2)
(a, b) = (a1 + a2, b1 + b2)
Homomorphic product c1 = (a1, b1), c2 = (a2, b2)
p(b1 − s.a1)(b2 − s.a2) = (p.b1.b2)︸ ︷︷ ︸C0
−s. (p.a1.b2 + p.a2.b1)︸ ︷︷ ︸C1
+s2. (p.a1.a2)︸ ︷︷ ︸C2
= (b− s.a)
Relinearize the term (p.a1.a2)s2 using the external product:
c1 �p c2 = (C1, C0)− TRGSW (s) � (C2, 0)
41 / 53
![Page 66: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/66.jpg)
The framework Chimera
Fixed point
TN [X]+
noise?
Ciphertext
(a, b)
Integers
(Z/pZ)n
Fixed point
C
CircuitsB = (0, 1)
42 / 53
![Page 67: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/67.jpg)
The framework Chimera
HEAAN
m2τ + ε
− 12L
12L
0 1-1
y = lift(x)y = 1
2π sin(2πx)
Domain [− 12L, 12L
] mod 1
- 12
12
Continuous approach
x× y = Lift(x) ∗ Lift(y) mod 1.4 This approach can preserve (or reduce) the interval [− 1
2L ,1
2L ]4 Lift is a periodic function: approx by sinus (or other Fourier serie) wherever it matters...8 ...but sinus can only be approx by a polynomial, which recursively requires a product.
43 / 53
![Page 68: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/68.jpg)
The framework Chimera
Fixed point: HEAAN
m2τ + ε
− 12L
12L
1q
Discrete approach
round a, b (and thus µ) on exact multiples of 1qwhere q ≈ 2L+ρ.
4 Brings us in the ring 1qZN [X] mod 1 (avoids lifting)
4 Exact Montgomery product q(b1 − sa1)(b2 − sa2)8 Blows up the interval [− 1
2L ,1
2L ]→ [− 12L−ρ ,
12L−ρ ]...
...works a leveled number of times.
44 / 53
![Page 69: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/69.jpg)
The framework Chimera
Unifying the plaintext space in RLWE-schemes
45 / 53
![Page 70: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/70.jpg)
The framework Chimera
Bridges between LWE based schemes
T
TN [X ]
∆P =1p
ZN [X ]∆P
∆P =1
X−p
Ball∞( 12ℓ ) CN
2
TLWE
TRLWEB/FV
B/FV-Slot
B/FV-BigNum
TFHE Gate bootstrap
B/FV bootstrap
HEAAN bootstrap
TLWETLWE
HEAAN-Slot
HEAAN
46 / 53
![Page 71: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/71.jpg)
Application: feature selection
Plan
1 Fully Homomorphic Encryption
2 Learning with error over the Torus
3 The framework Chimera
4 Application: feature selection
47 / 53
![Page 72: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/72.jpg)
Application: feature selection
Application Idash
Goal:Develop a secure parallel outsourcing solution to compute Genome Wide Association Studies(GWAS) based on logistic regression using homomorphically encrypted data.
SX Y
Patient 1
Patient n
intercept
age
weightgender
1
1 1
01
covariates target
sisi
SPNi
m>10000
Input:X ∈Mn,k+1(R) input matrixy ∈ Bn binary vectorS ∈Mn,m(R) assumed binary
Output:stat ∈ Rm
Key points of our solution:Make plaintext algorithm FHE friendlyUse hybrid homomorphic encryption
48 / 53
![Page 73: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/73.jpg)
Application: feature selection
Application Idash
Goal:Develop a secure parallel outsourcing solution to compute Genome Wide Association Studies(GWAS) based on logistic regression using homomorphically encrypted data.
SX Y
Patient 1
Patient n
intercept
age
weightgender
1
1 1
01
covariates target
sisi
SPNi
m>10000
Input:X ∈Mn,k+1(R) input matrixy ∈ Bn binary vectorS ∈Mn,m(R) assumed binary
Output:stat ∈ Rm
Key points of our solution:Make plaintext algorithm FHE friendlyUse hybrid homomorphic encryption
48 / 53
![Page 74: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/74.jpg)
Application: feature selection
Algorithm in plaintext
49 / 53
![Page 75: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/75.jpg)
Application: feature selection
Algorithm in plaintext
continuous non-polynomial functions
(Approx numbers, or Lookup tables)
for loops
(better with fast bootstrapping)
49 / 53
![Page 76: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/76.jpg)
Application: feature selection
Algorithm in plaintext
continuous non-polynomial functions
(Approx numbers, or Lookup tables)
for loops
(better with fast bootstrapping)
individual non-linear operations in small dimension
(lookup tables)
multiplication with fresh ciphertexts
(better with TFHE’s external product)
49 / 53
![Page 77: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/77.jpg)
Application: feature selection
Algorithm in plaintext
continuous non-polynomial functions
(Approx numbers, or Lookup tables)
for loops
(better with fast bootstrapping)
individual non-linear operations in small dimension
(lookup tables)
multiplication with fresh ciphertexts
(better with TFHE’s external product)
continuous function batched on a large vector
very large dimension
(fully packed SIMD)
49 / 53
![Page 78: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/78.jpg)
Application: feature selection
Algorithm in plaintext
continuous non-polynomial functions
(Approx numbers, or Lookup tables)
for loops
(better with fast bootstrapping)
individual non-linear operations in small dimension
(lookup tables)
multiplication with fresh ciphertexts
(better with TFHE’s external product)
continuous function batched on a large vector
very large dimension
(fully packed SIMD)
Which fully homomoprhic scheme should we choose?
49 / 53
![Page 79: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/79.jpg)
Application: feature selection
Hybrid homomorphic encryption: Chimera
1 Initial Logreg on matrix X and vector yadapt lib TFHE + logreg
2 Large-scale linear algebra computationsimplement Chimera (version 2 of TFHE)
3 Batch Logarithm computationadapt lib HEAAN
50 / 53
![Page 80: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/80.jpg)
Application: feature selection
Benchmarks
Steps Timing (4 cores) Timing (96 cores) RAMKeyGen 5.5 mins 2.0 mins 4.4 GBEncryption 7.2 mins 1.3 mins 8.6 GBCloud Computation 3h06 10.2 mins 7.8 GB
Input ciphertext: 5GB (enc X, y, S)Final ciphertext: 640KB (enc numerator + denominator)
51 / 53
![Page 81: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/81.jpg)
Application: feature selection
Numerical Accuracy (FHE has noise)
-10
-5
0
5
10
-10 -5 0 5 10
actual vs. computedy=x
52 / 53
![Page 82: TFHE-Chimera: Howtocombinefullyhomomorphicencryption ... · TFHE-Chimera: Howtocombinefullyhomomorphicencryption schemes? Application: Featureselection N.Gama 2,3,M.Georgieva1 1 2](https://reader036.fdocuments.in/reader036/viewer/2022081422/5f0624f87e708231d416836a/html5/thumbnails/82.jpg)
Application: feature selection
Questions?
53 / 53