Bootstrapping (with Small Error Growth) Chris Peikert University of Michigan HEAT Summer School 12 Oct 2015 1 / 14
Fully Homomorphic Encryption [RAD’78,Gentry’09] ◮ FHE lets you do this: µ Eval ( f ) f ( µ ) A cryptographic “holy grail” with countless applications. First solved in [Gentry’09] , followed by [vDGHV’10,BV’11a,BV’11b,BGV’12,B’12,GSW’13,. . . ] 2 / 14
Fully Homomorphic Encryption [RAD’78,Gentry’09] ◮ FHE lets you do this: µ Eval ( f ) f ( µ ) A cryptographic “holy grail” with countless applications. First solved in [Gentry’09] , followed by [vDGHV’10,BV’11a,BV’11b,BGV’12,B’12,GSW’13,. . . ] ◮ “Naturally occurring” schemes are somewhat homomorphic (SHE): can only evaluate functions of an a priori bounded depth. µ Eval ( f ) f ( µ ) Eval ( g ) g ( f ( µ )) 2 / 14
Fully Homomorphic Encryption [RAD’78,Gentry’09] ◮ FHE lets you do this: µ Eval ( f ) f ( µ ) A cryptographic “holy grail” with countless applications. First solved in [Gentry’09] , followed by [vDGHV’10,BV’11a,BV’11b,BGV’12,B’12,GSW’13,. . . ] ◮ “Naturally occurring” schemes are somewhat homomorphic (SHE): can only evaluate functions of an a priori bounded depth. µ Eval ( f ) f ( µ ) Eval ( g ) g ( f ( µ )) ◮ Thus far, “bootstrapping” is required to achieve unbounded FHE. 2 / 14
Bootstrapping: SHE → FHE [Gentry’09] ◮ Homomorphically evaluate the SHE decryption function to “refresh” a ciphertext µ , allowing further homomorphic operations. 3 / 14
Bootstrapping: SHE → FHE [Gentry’09] ◮ Homomorphically evaluate the SHE decryption function to “refresh” a ciphertext µ , allowing further homomorphic operations. ◮ Decrypting µ as a function of sk : � � µ Dec · , µ sk 3 / 14
Bootstrapping: SHE → FHE [Gentry’09] ◮ Homomorphically evaluate the SHE decryption function to “refresh” a ciphertext µ , allowing further homomorphic operations. ◮ Decrypting µ as a function of sk : � � µ Dec · , µ sk ◮ Homomorphically decrypting µ on sk : � � � � µ Eval Dec · , µ sk 3 / 14
Bootstrapping: SHE → FHE [Gentry’09] ◮ Homomorphically evaluate the SHE decryption function to “refresh” a ciphertext µ , allowing further homomorphic operations. ◮ Decrypting µ as a function of sk : � � µ Dec · , µ sk ◮ Homomorphically decrypting µ on sk : � � � � µ Eval Dec · , µ sk ◮ Runtime of Eval ( Dec ) is controlled by complexity of Dec. 3 / 14
Bootstrapping: SHE → FHE [Gentry’09] ◮ Homomorphically evaluate the SHE decryption function to “refresh” a ciphertext µ , allowing further homomorphic operations. ◮ Decrypting µ as a function of sk : � � µ Dec · , µ sk ◮ Homomorphically decrypting µ on sk : � � � � µ Eval Dec · , µ sk ◮ Runtime of Eval ( Dec ) is controlled by complexity of Dec. Error growth of Eval ( Dec ) determines strength of cryptographic assumption – e.g., initial LWE noise “rate” of sk . 3 / 14
Bootstrapping: SHE → FHE [Gentry’09] ◮ Homomorphic decryption of µ on sk : � � � � µ Eval Dec · , µ sk 4 / 14
Bootstrapping: SHE → FHE [Gentry’09] ◮ Homomorphic decryption of µ on sk : � � � � µ Eval Dec · , µ sk ◮ Runtime: quasi-linear ˜ O ( λ ) using rings [GHS’12,AP’13] 4 / 14
Bootstrapping: SHE → FHE [Gentry’09] ◮ Homomorphic decryption of µ on sk : � � � � µ Eval Dec · , µ sk ◮ Runtime: quasi-linear ˜ O ( λ ) using rings [GHS’12,AP’13] ◮ Error growth using [BGV’12,B’12,GSW’13] : 4 / 14
Bootstrapping: SHE → FHE [Gentry’09] ◮ Homomorphic decryption of µ on sk : � � � � µ Eval Dec · , µ sk ◮ Runtime: quasi-linear ˜ O ( λ ) using rings [GHS’12,AP’13] ◮ Error growth using [BGV’12,B’12,GSW’13] : ⋆ Homom Addition: Error grows additively. 4 / 14
Bootstrapping: SHE → FHE [Gentry’09] ◮ Homomorphic decryption of µ on sk : � � � � µ Eval Dec · , µ sk ◮ Runtime: quasi-linear ˜ O ( λ ) using rings [GHS’12,AP’13] ◮ Error growth using [BGV’12,B’12,GSW’13] : ⋆ Homom Addition: Error grows additively. ⋆ Homom Multiplication: Error grows by poly( λ ) factor. 4 / 14
Bootstrapping: SHE → FHE [Gentry’09] ◮ Homomorphic decryption of µ on sk : � � � � µ Eval Dec · , µ sk ◮ Runtime: quasi-linear ˜ O ( λ ) using rings [GHS’12,AP’13] ◮ Error growth using [BGV’12,B’12,GSW’13] : ⋆ Homom Addition: Error grows additively. ⋆ Homom Multiplication: Error grows by poly( λ ) factor. ◮ Known boolean decryption circuits have logarithmic O (log λ ) depth. 4 / 14
Bootstrapping: SHE → FHE [Gentry’09] ◮ Homomorphic decryption of µ on sk : � � � � µ Eval Dec · , µ sk ◮ Runtime: quasi-linear ˜ O ( λ ) using rings [GHS’12,AP’13] ◮ Error growth using [BGV’12,B’12,GSW’13] : ⋆ Homom Addition: Error grows additively. ⋆ Homom Multiplication: Error grows by poly( λ ) factor. ◮ Known boolean decryption circuits have logarithmic O (log λ ) depth. ⇒ Quasi-polynomial λ O (log λ ) error growth & lattice approx factors. = 4 / 14
Bootstrapping: SHE → FHE [Gentry’09] ◮ Homomorphic decryption of µ on sk : � � � � µ Eval Dec · , µ sk ◮ Runtime: quasi-linear ˜ O ( λ ) using rings [GHS’12,AP’13] ◮ Error growth using [BGV’12,B’12,GSW’13] : ⋆ Homom Addition: Error grows additively. ⋆ Homom Multiplication: Error grows by poly( λ ) factor. ◮ Known boolean decryption circuits have logarithmic O (log λ ) depth. ⇒ Quasi-polynomial λ O (log λ ) error growth & lattice approx factors. = Can we do better?? 4 / 14
Agenda for the Talk 1 Branching program bootstrapping with (large) polynomial runtime and error growth [BrakerskiVaikuntanathan’14] 5 / 14
Agenda for the Talk 1 Branching program bootstrapping with (large) polynomial runtime and error growth [BrakerskiVaikuntanathan’14] 2 Arithmetic bootstrapping with small polynomial runtime and growth [Alperin-SheriffPeikert’14] 5 / 14
Agenda for the Talk 1 Branching program bootstrapping with (large) polynomial runtime and error growth [BrakerskiVaikuntanathan’14] 2 Arithmetic bootstrapping with small polynomial runtime and growth [Alperin-SheriffPeikert’14] 3 Fast ( < 1s) ring-based implementation [DucasMicciancio’15] 5 / 14
Somewhat Homomorphic Encryption [GentrySahaiWaters’13] ◮ Recall “gadget” matrix G over Z q [MP’12] : for any matrix A over Z q , G − 1 ( A ) is short (over Z ) G · G − 1 ( A ) = A (mod q ) . and 6 / 14
Somewhat Homomorphic Encryption [GentrySahaiWaters’13] ◮ Recall “gadget” matrix G over Z q [MP’12] : for any matrix A over Z q , G − 1 ( A ) is short (over Z ) G · G − 1 ( A ) = A (mod q ) . and ◮ Ciphertext encrypting µ ∈ Z under s is a Z q -matrix C satisfying sC = µ · sG + e ≈ µ · sG (mod q ) . 6 / 14
Somewhat Homomorphic Encryption [GentrySahaiWaters’13] ◮ Recall “gadget” matrix G over Z q [MP’12] : for any matrix A over Z q , G − 1 ( A ) is short (over Z ) G · G − 1 ( A ) = A (mod q ) . and ◮ Ciphertext encrypting µ ∈ Z under s is a Z q -matrix C satisfying sC = µ · sG + e ≈ µ · sG (mod q ) . ◮ Homomorphic add: C 1 ‘ C 2 := C 1 + C 2 . 6 / 14
Somewhat Homomorphic Encryption [GentrySahaiWaters’13] ◮ Recall “gadget” matrix G over Z q [MP’12] : for any matrix A over Z q , G − 1 ( A ) is short (over Z ) G · G − 1 ( A ) = A (mod q ) . and ◮ Ciphertext encrypting µ ∈ Z under s is a Z q -matrix C satisfying sC = µ · sG + e ≈ µ · sG (mod q ) . ◮ Homomorphic add: C 1 ‘ C 2 := C 1 + C 2 . ◮ Homomorphic mult: C 1 d C 2 := C 1 · G − 1 ( C 2 ) . 6 / 14
Somewhat Homomorphic Encryption [GentrySahaiWaters’13] ◮ Recall “gadget” matrix G over Z q [MP’12] : for any matrix A over Z q , G − 1 ( A ) is short (over Z ) G · G − 1 ( A ) = A (mod q ) . and ◮ Ciphertext encrypting µ ∈ Z under s is a Z q -matrix C satisfying sC = µ · sG + e ≈ µ · sG (mod q ) . ◮ Homomorphic add: C 1 ‘ C 2 := C 1 + C 2 . ◮ Homomorphic mult: C 1 d C 2 := C 1 · G − 1 ( C 2 ) . s · C 1 · G − 1 ( C 2 ) = ( µ 1 · sG + e 1 ) · G − 1 ( C 2 ) 6 / 14
Somewhat Homomorphic Encryption [GentrySahaiWaters’13] ◮ Recall “gadget” matrix G over Z q [MP’12] : for any matrix A over Z q , G − 1 ( A ) is short (over Z ) G · G − 1 ( A ) = A (mod q ) . and ◮ Ciphertext encrypting µ ∈ Z under s is a Z q -matrix C satisfying sC = µ · sG + e ≈ µ · sG (mod q ) . ◮ Homomorphic add: C 1 ‘ C 2 := C 1 + C 2 . ◮ Homomorphic mult: C 1 d C 2 := C 1 · G − 1 ( C 2 ) . s · C 1 · G − 1 ( C 2 ) = ( µ 1 · sG + e 1 ) · G − 1 ( C 2 ) = µ 1 · sC 2 + e 1 · G − 1 ( C 2 ) 6 / 14
Recommend
More recommend
