15
Homomorphic Encryption Standard: TFHE API Mariya Georgieva August 17, 2019 1/9

Homomorphic Encryption Standard: TFHE API...N. Gama and M. Georgieva Model of computations 1Binary, circuit computations 2Integer arithmetic computation 3Approximated (Fixed-point)

  • Upload
    others

  • View
    2

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Homomorphic Encryption Standard: TFHE API...N. Gama and M. Georgieva Model of computations 1Binary, circuit computations 2Integer arithmetic computation 3Approximated (Fixed-point)

Homomorphic Encryption Standard TFHE API

Mariya Georgieva

August 17 2019

1 9

TFHE API Introduction

TFHE Fast Fully Homomorphic Encryption over the Torus

TFHE API draft shared to the mailing list (11 July 2019)(S Carpov I Chillotti N Gama M Georgieva)httpsdocsgooglecomdocumentd1aUGdIlBijYebos8gNO2cS3HFCR90JVLwAWzBctUN3msedit

ParametersData Encoding and CiphertextsSecret-Key EncryptionPublic-Key EncryptionLeveled Homomorphic Encryption OperationsBootstrapped Homomorphic Encryption Operations

TFHE open source libraryhttpstfhegithubio

2 9

TFHE parameters

Security parameter λNoise rate α ndash (auto-deduced in bootstrapped mode)Ring dimension n ndash (auto-deduced in bootstrapped and leveled mode)

In bootstrapped modeThe values of α and n are derived from the security parameter λ by the library in order to enablefull bootstrapping cycle

In leveled modeα serves as a measure for the number of homomorphic operations that can be run on a ciphertextbefore saturating the noise The ring dimension n is then determined by the security level λ

3 9

Data Encoding and Ciphertexts

TLWE ciphertexts encrypt plaintext in TT = R mod 1(Torus arithmetic as a Z - module)3 middot 06 = 08 mod 1external product by integers

Polynomial versionTRLWE ciphertexts encrypt plaintext in TN [X]TRGSW ciphertexts encrypt plaintext in ZN [X]

TN [X] = R[X] mod XN + 1 mod 1(Torus polynomial arithmetic as a ZN [X] - module)(2X + 3) middot (04X + 05) = (02X + 07) mod X2 + 1 mod 1external product by integers polynomail

4 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

5 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

5 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

5 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

5 9

TFHE API Operations

Leveled Homomorphic Encryption OperationsThe basic operations are

TLWE TRLWE TRGSW linear combinationsTRGSW-TRLWE external product

Some useful derived operationTRGSW-TRLWE-TRLWE privateoblivious selector (CMux)BlindRotate

Bootstrapped Homomorphic Encryption OperationsConstant gates Zero OneUnary gate NotBinary gates And Or Xor Xnor AndNot OrNot Nor NandTernary gate Mux

6 9

General internal product in BFV and CKKS

Internal product requires to evaluate a polynomail in s

(b1 minus sa1)(b2 minus sa2) = b1b2 minus (b1a2 + b2a1)s+ a1a2s2

The term s2dedicated relinearizationkeyswitch techniques (2011 )but in fact TRGSW provides the multiplication by s

The meaning of a1a2sublattices ai are exact multiples of 1

pfor a fixed small p

small ball ai is bounded

7 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

8 9

Questions

Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio

Model of computations1 Binary circuit computations

2 Integer arithmetic computation

3 Approximated (Fixed-point) computation

Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic

bull BFV (Seal Palisade) massively parallel small depth polynomials

bull CKKS (HEAAN) massively parallel floating point arithmetic

bull TFHE FHEW single eval boolean logic comparison threshold

How we can represent all plaintexts over the TN [X]

TN [X]+

noise

Ciphertext(a b)

Integers(ZpZ)n

Fixed point

C

CircuitsB = (0 1)

Homomorphic operations hierarchy

TRLWEx + y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSW ax for secret aExternal product

a isin 0 1

cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = spolynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

Circuits over the TN [X] (AND)

58

38

0 1

0=(01)(10)

14 = (0 0)3

4 = (1 1)0

1

Integers and fixed-point over the TN [X]0

2p

1p

BFV

m2τ +

minus 12L

12L

1q

CKKS

Linear combination with secret coefficients (0 1)

TRGSW(s1) TRGSW(s2) TRGSW(sn)

timesXa1

times1

timesXa2

times1

timesXan

times1

()1

0

1

0

1

0 sumsiai mod 2N

TRLWE TRLWE

Linear combination with secret coefficient s

Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s

HowTo evaluate a polynomial in s

bull dedicated relinearizationkeyswitch techniques (2011 )

bull But in fact TRGSW provides

C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)

9 9

Page 2: Homomorphic Encryption Standard: TFHE API...N. Gama and M. Georgieva Model of computations 1Binary, circuit computations 2Integer arithmetic computation 3Approximated (Fixed-point)

TFHE API Introduction

TFHE Fast Fully Homomorphic Encryption over the Torus

TFHE API draft shared to the mailing list (11 July 2019)(S Carpov I Chillotti N Gama M Georgieva)httpsdocsgooglecomdocumentd1aUGdIlBijYebos8gNO2cS3HFCR90JVLwAWzBctUN3msedit

ParametersData Encoding and CiphertextsSecret-Key EncryptionPublic-Key EncryptionLeveled Homomorphic Encryption OperationsBootstrapped Homomorphic Encryption Operations

TFHE open source libraryhttpstfhegithubio

2 9

TFHE parameters

Security parameter λNoise rate α ndash (auto-deduced in bootstrapped mode)Ring dimension n ndash (auto-deduced in bootstrapped and leveled mode)

In bootstrapped modeThe values of α and n are derived from the security parameter λ by the library in order to enablefull bootstrapping cycle

In leveled modeα serves as a measure for the number of homomorphic operations that can be run on a ciphertextbefore saturating the noise The ring dimension n is then determined by the security level λ

3 9

Data Encoding and Ciphertexts

TLWE ciphertexts encrypt plaintext in TT = R mod 1(Torus arithmetic as a Z - module)3 middot 06 = 08 mod 1external product by integers

Polynomial versionTRLWE ciphertexts encrypt plaintext in TN [X]TRGSW ciphertexts encrypt plaintext in ZN [X]

TN [X] = R[X] mod XN + 1 mod 1(Torus polynomial arithmetic as a ZN [X] - module)(2X + 3) middot (04X + 05) = (02X + 07) mod X2 + 1 mod 1external product by integers polynomail

4 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

5 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

5 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

5 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

5 9

TFHE API Operations

Leveled Homomorphic Encryption OperationsThe basic operations are

TLWE TRLWE TRGSW linear combinationsTRGSW-TRLWE external product

Some useful derived operationTRGSW-TRLWE-TRLWE privateoblivious selector (CMux)BlindRotate

Bootstrapped Homomorphic Encryption OperationsConstant gates Zero OneUnary gate NotBinary gates And Or Xor Xnor AndNot OrNot Nor NandTernary gate Mux

6 9

General internal product in BFV and CKKS

Internal product requires to evaluate a polynomail in s

(b1 minus sa1)(b2 minus sa2) = b1b2 minus (b1a2 + b2a1)s+ a1a2s2

The term s2dedicated relinearizationkeyswitch techniques (2011 )but in fact TRGSW provides the multiplication by s

The meaning of a1a2sublattices ai are exact multiples of 1

pfor a fixed small p

small ball ai is bounded

7 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

8 9

Questions

Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio

Model of computations1 Binary circuit computations

2 Integer arithmetic computation

3 Approximated (Fixed-point) computation

Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic

bull BFV (Seal Palisade) massively parallel small depth polynomials

bull CKKS (HEAAN) massively parallel floating point arithmetic

bull TFHE FHEW single eval boolean logic comparison threshold

How we can represent all plaintexts over the TN [X]

TN [X]+

noise

Ciphertext(a b)

Integers(ZpZ)n

Fixed point

C

CircuitsB = (0 1)

Homomorphic operations hierarchy

TRLWEx + y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSW ax for secret aExternal product

a isin 0 1

cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = spolynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

Circuits over the TN [X] (AND)

58

38

0 1

0=(01)(10)

14 = (0 0)3

4 = (1 1)0

1

Integers and fixed-point over the TN [X]0

2p

1p

BFV

m2τ +

minus 12L

12L

1q

CKKS

Linear combination with secret coefficients (0 1)

TRGSW(s1) TRGSW(s2) TRGSW(sn)

timesXa1

times1

timesXa2

times1

timesXan

times1

()1

0

1

0

1

0 sumsiai mod 2N

TRLWE TRLWE

Linear combination with secret coefficient s

Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s

HowTo evaluate a polynomial in s

bull dedicated relinearizationkeyswitch techniques (2011 )

bull But in fact TRGSW provides

C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)

9 9

Page 3: Homomorphic Encryption Standard: TFHE API...N. Gama and M. Georgieva Model of computations 1Binary, circuit computations 2Integer arithmetic computation 3Approximated (Fixed-point)

TFHE parameters

Security parameter λNoise rate α ndash (auto-deduced in bootstrapped mode)Ring dimension n ndash (auto-deduced in bootstrapped and leveled mode)

In bootstrapped modeThe values of α and n are derived from the security parameter λ by the library in order to enablefull bootstrapping cycle

In leveled modeα serves as a measure for the number of homomorphic operations that can be run on a ciphertextbefore saturating the noise The ring dimension n is then determined by the security level λ

3 9

Data Encoding and Ciphertexts

TLWE ciphertexts encrypt plaintext in TT = R mod 1(Torus arithmetic as a Z - module)3 middot 06 = 08 mod 1external product by integers

Polynomial versionTRLWE ciphertexts encrypt plaintext in TN [X]TRGSW ciphertexts encrypt plaintext in ZN [X]

TN [X] = R[X] mod XN + 1 mod 1(Torus polynomial arithmetic as a ZN [X] - module)(2X + 3) middot (04X + 05) = (02X + 07) mod X2 + 1 mod 1external product by integers polynomail

4 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

5 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

5 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

5 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

5 9

TFHE API Operations

Leveled Homomorphic Encryption OperationsThe basic operations are

TLWE TRLWE TRGSW linear combinationsTRGSW-TRLWE external product

Some useful derived operationTRGSW-TRLWE-TRLWE privateoblivious selector (CMux)BlindRotate

Bootstrapped Homomorphic Encryption OperationsConstant gates Zero OneUnary gate NotBinary gates And Or Xor Xnor AndNot OrNot Nor NandTernary gate Mux

6 9

General internal product in BFV and CKKS

Internal product requires to evaluate a polynomail in s

(b1 minus sa1)(b2 minus sa2) = b1b2 minus (b1a2 + b2a1)s+ a1a2s2

The term s2dedicated relinearizationkeyswitch techniques (2011 )but in fact TRGSW provides the multiplication by s

The meaning of a1a2sublattices ai are exact multiples of 1

pfor a fixed small p

small ball ai is bounded

7 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

8 9

Questions

Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio

Model of computations1 Binary circuit computations

2 Integer arithmetic computation

3 Approximated (Fixed-point) computation

Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic

bull BFV (Seal Palisade) massively parallel small depth polynomials

bull CKKS (HEAAN) massively parallel floating point arithmetic

bull TFHE FHEW single eval boolean logic comparison threshold

How we can represent all plaintexts over the TN [X]

TN [X]+

noise

Ciphertext(a b)

Integers(ZpZ)n

Fixed point

C

CircuitsB = (0 1)

Homomorphic operations hierarchy

TRLWEx + y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSW ax for secret aExternal product

a isin 0 1

cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = spolynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

Circuits over the TN [X] (AND)

58

38

0 1

0=(01)(10)

14 = (0 0)3

4 = (1 1)0

1

Integers and fixed-point over the TN [X]0

2p

1p

BFV

m2τ +

minus 12L

12L

1q

CKKS

Linear combination with secret coefficients (0 1)

TRGSW(s1) TRGSW(s2) TRGSW(sn)

timesXa1

times1

timesXa2

times1

timesXan

times1

()1

0

1

0

1

0 sumsiai mod 2N

TRLWE TRLWE

Linear combination with secret coefficient s

Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s

HowTo evaluate a polynomial in s

bull dedicated relinearizationkeyswitch techniques (2011 )

bull But in fact TRGSW provides

C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)

9 9

Page 4: Homomorphic Encryption Standard: TFHE API...N. Gama and M. Georgieva Model of computations 1Binary, circuit computations 2Integer arithmetic computation 3Approximated (Fixed-point)

Data Encoding and Ciphertexts

TLWE ciphertexts encrypt plaintext in TT = R mod 1(Torus arithmetic as a Z - module)3 middot 06 = 08 mod 1external product by integers

Polynomial versionTRLWE ciphertexts encrypt plaintext in TN [X]TRGSW ciphertexts encrypt plaintext in ZN [X]

TN [X] = R[X] mod XN + 1 mod 1(Torus polynomial arithmetic as a ZN [X] - module)(2X + 3) middot (04X + 05) = (02X + 07) mod X2 + 1 mod 1external product by integers polynomail

4 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

5 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

5 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

5 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

5 9

TFHE API Operations

Leveled Homomorphic Encryption OperationsThe basic operations are

TLWE TRLWE TRGSW linear combinationsTRGSW-TRLWE external product

Some useful derived operationTRGSW-TRLWE-TRLWE privateoblivious selector (CMux)BlindRotate

Bootstrapped Homomorphic Encryption OperationsConstant gates Zero OneUnary gate NotBinary gates And Or Xor Xnor AndNot OrNot Nor NandTernary gate Mux

6 9

General internal product in BFV and CKKS

Internal product requires to evaluate a polynomail in s

(b1 minus sa1)(b2 minus sa2) = b1b2 minus (b1a2 + b2a1)s+ a1a2s2

The term s2dedicated relinearizationkeyswitch techniques (2011 )but in fact TRGSW provides the multiplication by s

The meaning of a1a2sublattices ai are exact multiples of 1

pfor a fixed small p

small ball ai is bounded

7 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

8 9

Questions

Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio

Model of computations1 Binary circuit computations

2 Integer arithmetic computation

3 Approximated (Fixed-point) computation

Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic

bull BFV (Seal Palisade) massively parallel small depth polynomials

bull CKKS (HEAAN) massively parallel floating point arithmetic

bull TFHE FHEW single eval boolean logic comparison threshold

How we can represent all plaintexts over the TN [X]

TN [X]+

noise

Ciphertext(a b)

Integers(ZpZ)n

Fixed point

C

CircuitsB = (0 1)

Homomorphic operations hierarchy

TRLWEx + y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSW ax for secret aExternal product

a isin 0 1

cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = spolynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

Circuits over the TN [X] (AND)

58

38

0 1

0=(01)(10)

14 = (0 0)3

4 = (1 1)0

1

Integers and fixed-point over the TN [X]0

2p

1p

BFV

m2τ +

minus 12L

12L

1q

CKKS

Linear combination with secret coefficients (0 1)

TRGSW(s1) TRGSW(s2) TRGSW(sn)

timesXa1

times1

timesXa2

times1

timesXan

times1

()1

0

1

0

1

0 sumsiai mod 2N

TRLWE TRLWE

Linear combination with secret coefficient s

Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s

HowTo evaluate a polynomial in s

bull dedicated relinearizationkeyswitch techniques (2011 )

bull But in fact TRGSW provides

C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)

9 9

Page 5: Homomorphic Encryption Standard: TFHE API...N. Gama and M. Georgieva Model of computations 1Binary, circuit computations 2Integer arithmetic computation 3Approximated (Fixed-point)

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

5 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

5 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

5 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

5 9

TFHE API Operations

Leveled Homomorphic Encryption OperationsThe basic operations are

TLWE TRLWE TRGSW linear combinationsTRGSW-TRLWE external product

Some useful derived operationTRGSW-TRLWE-TRLWE privateoblivious selector (CMux)BlindRotate

Bootstrapped Homomorphic Encryption OperationsConstant gates Zero OneUnary gate NotBinary gates And Or Xor Xnor AndNot OrNot Nor NandTernary gate Mux

6 9

General internal product in BFV and CKKS

Internal product requires to evaluate a polynomail in s

(b1 minus sa1)(b2 minus sa2) = b1b2 minus (b1a2 + b2a1)s+ a1a2s2

The term s2dedicated relinearizationkeyswitch techniques (2011 )but in fact TRGSW provides the multiplication by s

The meaning of a1a2sublattices ai are exact multiples of 1

pfor a fixed small p

small ball ai is bounded

7 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

8 9

Questions

Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio

Model of computations1 Binary circuit computations

2 Integer arithmetic computation

3 Approximated (Fixed-point) computation

Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic

bull BFV (Seal Palisade) massively parallel small depth polynomials

bull CKKS (HEAAN) massively parallel floating point arithmetic

bull TFHE FHEW single eval boolean logic comparison threshold

How we can represent all plaintexts over the TN [X]

TN [X]+

noise

Ciphertext(a b)

Integers(ZpZ)n

Fixed point

C

CircuitsB = (0 1)

Homomorphic operations hierarchy

TRLWEx + y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSW ax for secret aExternal product

a isin 0 1

cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = spolynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

Circuits over the TN [X] (AND)

58

38

0 1

0=(01)(10)

14 = (0 0)3

4 = (1 1)0

1

Integers and fixed-point over the TN [X]0

2p

1p

BFV

m2τ +

minus 12L

12L

1q

CKKS

Linear combination with secret coefficients (0 1)

TRGSW(s1) TRGSW(s2) TRGSW(sn)

timesXa1

times1

timesXa2

times1

timesXan

times1

()1

0

1

0

1

0 sumsiai mod 2N

TRLWE TRLWE

Linear combination with secret coefficient s

Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s

HowTo evaluate a polynomial in s

bull dedicated relinearizationkeyswitch techniques (2011 )

bull But in fact TRGSW provides

C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)

9 9

Page 6: Homomorphic Encryption Standard: TFHE API...N. Gama and M. Georgieva Model of computations 1Binary, circuit computations 2Integer arithmetic computation 3Approximated (Fixed-point)

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

5 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

5 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

5 9

TFHE API Operations

Leveled Homomorphic Encryption OperationsThe basic operations are

TLWE TRLWE TRGSW linear combinationsTRGSW-TRLWE external product

Some useful derived operationTRGSW-TRLWE-TRLWE privateoblivious selector (CMux)BlindRotate

Bootstrapped Homomorphic Encryption OperationsConstant gates Zero OneUnary gate NotBinary gates And Or Xor Xnor AndNot OrNot Nor NandTernary gate Mux

6 9

General internal product in BFV and CKKS

Internal product requires to evaluate a polynomail in s

(b1 minus sa1)(b2 minus sa2) = b1b2 minus (b1a2 + b2a1)s+ a1a2s2

The term s2dedicated relinearizationkeyswitch techniques (2011 )but in fact TRGSW provides the multiplication by s

The meaning of a1a2sublattices ai are exact multiples of 1

pfor a fixed small p

small ball ai is bounded

7 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

8 9

Questions

Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio

Model of computations1 Binary circuit computations

2 Integer arithmetic computation

3 Approximated (Fixed-point) computation

Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic

bull BFV (Seal Palisade) massively parallel small depth polynomials

bull CKKS (HEAAN) massively parallel floating point arithmetic

bull TFHE FHEW single eval boolean logic comparison threshold

How we can represent all plaintexts over the TN [X]

TN [X]+

noise

Ciphertext(a b)

Integers(ZpZ)n

Fixed point

C

CircuitsB = (0 1)

Homomorphic operations hierarchy

TRLWEx + y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSW ax for secret aExternal product

a isin 0 1

cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = spolynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

Circuits over the TN [X] (AND)

58

38

0 1

0=(01)(10)

14 = (0 0)3

4 = (1 1)0

1

Integers and fixed-point over the TN [X]0

2p

1p

BFV

m2τ +

minus 12L

12L

1q

CKKS

Linear combination with secret coefficients (0 1)

TRGSW(s1) TRGSW(s2) TRGSW(sn)

timesXa1

times1

timesXa2

times1

timesXan

times1

()1

0

1

0

1

0 sumsiai mod 2N

TRLWE TRLWE

Linear combination with secret coefficient s

Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s

HowTo evaluate a polynomial in s

bull dedicated relinearizationkeyswitch techniques (2011 )

bull But in fact TRGSW provides

C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)

9 9

Page 7: Homomorphic Encryption Standard: TFHE API...N. Gama and M. Georgieva Model of computations 1Binary, circuit computations 2Integer arithmetic computation 3Approximated (Fixed-point)

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

5 9

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

5 9

TFHE API Operations

Leveled Homomorphic Encryption OperationsThe basic operations are

TLWE TRLWE TRGSW linear combinationsTRGSW-TRLWE external product

Some useful derived operationTRGSW-TRLWE-TRLWE privateoblivious selector (CMux)BlindRotate

Bootstrapped Homomorphic Encryption OperationsConstant gates Zero OneUnary gate NotBinary gates And Or Xor Xnor AndNot OrNot Nor NandTernary gate Mux

6 9

General internal product in BFV and CKKS

Internal product requires to evaluate a polynomail in s

(b1 minus sa1)(b2 minus sa2) = b1b2 minus (b1a2 + b2a1)s+ a1a2s2

The term s2dedicated relinearizationkeyswitch techniques (2011 )but in fact TRGSW provides the multiplication by s

The meaning of a1a2sublattices ai are exact multiples of 1

pfor a fixed small p

small ball ai is bounded

7 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

8 9

Questions

Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio

Model of computations1 Binary circuit computations

2 Integer arithmetic computation

3 Approximated (Fixed-point) computation

Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic

bull BFV (Seal Palisade) massively parallel small depth polynomials

bull CKKS (HEAAN) massively parallel floating point arithmetic

bull TFHE FHEW single eval boolean logic comparison threshold

How we can represent all plaintexts over the TN [X]

TN [X]+

noise

Ciphertext(a b)

Integers(ZpZ)n

Fixed point

C

CircuitsB = (0 1)

Homomorphic operations hierarchy

TRLWEx + y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSW ax for secret aExternal product

a isin 0 1

cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = spolynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

Circuits over the TN [X] (AND)

58

38

0 1

0=(01)(10)

14 = (0 0)3

4 = (1 1)0

1

Integers and fixed-point over the TN [X]0

2p

1p

BFV

m2τ +

minus 12L

12L

1q

CKKS

Linear combination with secret coefficients (0 1)

TRGSW(s1) TRGSW(s2) TRGSW(sn)

timesXa1

times1

timesXa2

times1

timesXan

times1

()1

0

1

0

1

0 sumsiai mod 2N

TRLWE TRLWE

Linear combination with secret coefficient s

Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s

HowTo evaluate a polynomial in s

bull dedicated relinearizationkeyswitch techniques (2011 )

bull But in fact TRGSW provides

C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)

9 9

Page 8: Homomorphic Encryption Standard: TFHE API...N. Gama and M. Georgieva Model of computations 1Binary, circuit computations 2Integer arithmetic computation 3Approximated (Fixed-point)

Homomorphic operations hierarchy in TFHE

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

5 9

TFHE API Operations

Leveled Homomorphic Encryption OperationsThe basic operations are

TLWE TRLWE TRGSW linear combinationsTRGSW-TRLWE external product

Some useful derived operationTRGSW-TRLWE-TRLWE privateoblivious selector (CMux)BlindRotate

Bootstrapped Homomorphic Encryption OperationsConstant gates Zero OneUnary gate NotBinary gates And Or Xor Xnor AndNot OrNot Nor NandTernary gate Mux

6 9

General internal product in BFV and CKKS

Internal product requires to evaluate a polynomail in s

(b1 minus sa1)(b2 minus sa2) = b1b2 minus (b1a2 + b2a1)s+ a1a2s2

The term s2dedicated relinearizationkeyswitch techniques (2011 )but in fact TRGSW provides the multiplication by s

The meaning of a1a2sublattices ai are exact multiples of 1

pfor a fixed small p

small ball ai is bounded

7 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

8 9

Questions

Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio

Model of computations1 Binary circuit computations

2 Integer arithmetic computation

3 Approximated (Fixed-point) computation

Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic

bull BFV (Seal Palisade) massively parallel small depth polynomials

bull CKKS (HEAAN) massively parallel floating point arithmetic

bull TFHE FHEW single eval boolean logic comparison threshold

How we can represent all plaintexts over the TN [X]

TN [X]+

noise

Ciphertext(a b)

Integers(ZpZ)n

Fixed point

C

CircuitsB = (0 1)

Homomorphic operations hierarchy

TRLWEx + y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSW ax for secret aExternal product

a isin 0 1

cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = spolynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

Circuits over the TN [X] (AND)

58

38

0 1

0=(01)(10)

14 = (0 0)3

4 = (1 1)0

1

Integers and fixed-point over the TN [X]0

2p

1p

BFV

m2τ +

minus 12L

12L

1q

CKKS

Linear combination with secret coefficients (0 1)

TRGSW(s1) TRGSW(s2) TRGSW(sn)

timesXa1

times1

timesXa2

times1

timesXan

times1

()1

0

1

0

1

0 sumsiai mod 2N

TRLWE TRLWE

Linear combination with secret coefficient s

Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s

HowTo evaluate a polynomial in s

bull dedicated relinearizationkeyswitch techniques (2011 )

bull But in fact TRGSW provides

C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)

9 9

Page 9: Homomorphic Encryption Standard: TFHE API...N. Gama and M. Georgieva Model of computations 1Binary, circuit computations 2Integer arithmetic computation 3Approximated (Fixed-point)

TFHE API Operations

Leveled Homomorphic Encryption OperationsThe basic operations are

TLWE TRLWE TRGSW linear combinationsTRGSW-TRLWE external product

Some useful derived operationTRGSW-TRLWE-TRLWE privateoblivious selector (CMux)BlindRotate

Bootstrapped Homomorphic Encryption OperationsConstant gates Zero OneUnary gate NotBinary gates And Or Xor Xnor AndNot OrNot Nor NandTernary gate Mux

6 9

General internal product in BFV and CKKS

Internal product requires to evaluate a polynomail in s

(b1 minus sa1)(b2 minus sa2) = b1b2 minus (b1a2 + b2a1)s+ a1a2s2

The term s2dedicated relinearizationkeyswitch techniques (2011 )but in fact TRGSW provides the multiplication by s

The meaning of a1a2sublattices ai are exact multiples of 1

pfor a fixed small p

small ball ai is bounded

7 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

8 9

Questions

Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio

Model of computations1 Binary circuit computations

2 Integer arithmetic computation

3 Approximated (Fixed-point) computation

Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic

bull BFV (Seal Palisade) massively parallel small depth polynomials

bull CKKS (HEAAN) massively parallel floating point arithmetic

bull TFHE FHEW single eval boolean logic comparison threshold

How we can represent all plaintexts over the TN [X]

TN [X]+

noise

Ciphertext(a b)

Integers(ZpZ)n

Fixed point

C

CircuitsB = (0 1)

Homomorphic operations hierarchy

TRLWEx + y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSW ax for secret aExternal product

a isin 0 1

cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = spolynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

Circuits over the TN [X] (AND)

58

38

0 1

0=(01)(10)

14 = (0 0)3

4 = (1 1)0

1

Integers and fixed-point over the TN [X]0

2p

1p

BFV

m2τ +

minus 12L

12L

1q

CKKS

Linear combination with secret coefficients (0 1)

TRGSW(s1) TRGSW(s2) TRGSW(sn)

timesXa1

times1

timesXa2

times1

timesXan

times1

()1

0

1

0

1

0 sumsiai mod 2N

TRLWE TRLWE

Linear combination with secret coefficient s

Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s

HowTo evaluate a polynomial in s

bull dedicated relinearizationkeyswitch techniques (2011 )

bull But in fact TRGSW provides

C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)

9 9

Page 10: Homomorphic Encryption Standard: TFHE API...N. Gama and M. Georgieva Model of computations 1Binary, circuit computations 2Integer arithmetic computation 3Approximated (Fixed-point)

General internal product in BFV and CKKS

Internal product requires to evaluate a polynomail in s

(b1 minus sa1)(b2 minus sa2) = b1b2 minus (b1a2 + b2a1)s+ a1a2s2

The term s2dedicated relinearizationkeyswitch techniques (2011 )but in fact TRGSW provides the multiplication by s

The meaning of a1a2sublattices ai are exact multiples of 1

pfor a fixed small p

small ball ai is bounded

7 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

8 9

Questions

Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio

Model of computations1 Binary circuit computations

2 Integer arithmetic computation

3 Approximated (Fixed-point) computation

Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic

bull BFV (Seal Palisade) massively parallel small depth polynomials

bull CKKS (HEAAN) massively parallel floating point arithmetic

bull TFHE FHEW single eval boolean logic comparison threshold

How we can represent all plaintexts over the TN [X]

TN [X]+

noise

Ciphertext(a b)

Integers(ZpZ)n

Fixed point

C

CircuitsB = (0 1)

Homomorphic operations hierarchy

TRLWEx + y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSW ax for secret aExternal product

a isin 0 1

cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = spolynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

Circuits over the TN [X] (AND)

58

38

0 1

0=(01)(10)

14 = (0 0)3

4 = (1 1)0

1

Integers and fixed-point over the TN [X]0

2p

1p

BFV

m2τ +

minus 12L

12L

1q

CKKS

Linear combination with secret coefficients (0 1)

TRGSW(s1) TRGSW(s2) TRGSW(sn)

timesXa1

times1

timesXa2

times1

timesXan

times1

()1

0

1

0

1

0 sumsiai mod 2N

TRLWE TRLWE

Linear combination with secret coefficient s

Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s

HowTo evaluate a polynomial in s

bull dedicated relinearizationkeyswitch techniques (2011 )

bull But in fact TRGSW provides

C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)

9 9

Page 11: Homomorphic Encryption Standard: TFHE API...N. Gama and M. Georgieva Model of computations 1Binary, circuit computations 2Integer arithmetic computation 3Approximated (Fixed-point)

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

8 9

Questions

Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio

Model of computations1 Binary circuit computations

2 Integer arithmetic computation

3 Approximated (Fixed-point) computation

Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic

bull BFV (Seal Palisade) massively parallel small depth polynomials

bull CKKS (HEAAN) massively parallel floating point arithmetic

bull TFHE FHEW single eval boolean logic comparison threshold

How we can represent all plaintexts over the TN [X]

TN [X]+

noise

Ciphertext(a b)

Integers(ZpZ)n

Fixed point

C

CircuitsB = (0 1)

Homomorphic operations hierarchy

TRLWEx + y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSW ax for secret aExternal product

a isin 0 1

cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = spolynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

Circuits over the TN [X] (AND)

58

38

0 1

0=(01)(10)

14 = (0 0)3

4 = (1 1)0

1

Integers and fixed-point over the TN [X]0

2p

1p

BFV

m2τ +

minus 12L

12L

1q

CKKS

Linear combination with secret coefficients (0 1)

TRGSW(s1) TRGSW(s2) TRGSW(sn)

timesXa1

times1

timesXa2

times1

timesXan

times1

()1

0

1

0

1

0 sumsiai mod 2N

TRLWE TRLWE

Linear combination with secret coefficient s

Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s

HowTo evaluate a polynomial in s

bull dedicated relinearizationkeyswitch techniques (2011 )

bull But in fact TRGSW provides

C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)

9 9

Page 12: Homomorphic Encryption Standard: TFHE API...N. Gama and M. Georgieva Model of computations 1Binary, circuit computations 2Integer arithmetic computation 3Approximated (Fixed-point)

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

8 9

Questions

Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio

Model of computations1 Binary circuit computations

2 Integer arithmetic computation

3 Approximated (Fixed-point) computation

Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic

bull BFV (Seal Palisade) massively parallel small depth polynomials

bull CKKS (HEAAN) massively parallel floating point arithmetic

bull TFHE FHEW single eval boolean logic comparison threshold

How we can represent all plaintexts over the TN [X]

TN [X]+

noise

Ciphertext(a b)

Integers(ZpZ)n

Fixed point

C

CircuitsB = (0 1)

Homomorphic operations hierarchy

TRLWEx + y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSW ax for secret aExternal product

a isin 0 1

cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = spolynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

Circuits over the TN [X] (AND)

58

38

0 1

0=(01)(10)

14 = (0 0)3

4 = (1 1)0

1

Integers and fixed-point over the TN [X]0

2p

1p

BFV

m2τ +

minus 12L

12L

1q

CKKS

Linear combination with secret coefficients (0 1)

TRGSW(s1) TRGSW(s2) TRGSW(sn)

timesXa1

times1

timesXa2

times1

timesXan

times1

()1

0

1

0

1

0 sumsiai mod 2N

TRLWE TRLWE

Linear combination with secret coefficient s

Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s

HowTo evaluate a polynomial in s

bull dedicated relinearizationkeyswitch techniques (2011 )

bull But in fact TRGSW provides

C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)

9 9

Page 13: Homomorphic Encryption Standard: TFHE API...N. Gama and M. Georgieva Model of computations 1Binary, circuit computations 2Integer arithmetic computation 3Approximated (Fixed-point)

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

8 9

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

8 9

Questions

Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio

Model of computations1 Binary circuit computations

2 Integer arithmetic computation

3 Approximated (Fixed-point) computation

Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic

bull BFV (Seal Palisade) massively parallel small depth polynomials

bull CKKS (HEAAN) massively parallel floating point arithmetic

bull TFHE FHEW single eval boolean logic comparison threshold

How we can represent all plaintexts over the TN [X]

TN [X]+

noise

Ciphertext(a b)

Integers(ZpZ)n

Fixed point

C

CircuitsB = (0 1)

Homomorphic operations hierarchy

TRLWEx + y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSW ax for secret aExternal product

a isin 0 1

cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = spolynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

Circuits over the TN [X] (AND)

58

38

0 1

0=(01)(10)

14 = (0 0)3

4 = (1 1)0

1

Integers and fixed-point over the TN [X]0

2p

1p

BFV

m2τ +

minus 12L

12L

1q

CKKS

Linear combination with secret coefficients (0 1)

TRGSW(s1) TRGSW(s2) TRGSW(sn)

timesXa1

times1

timesXa2

times1

timesXan

times1

()1

0

1

0

1

0 sumsiai mod 2N

TRLWE TRLWE

Linear combination with secret coefficient s

Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s

HowTo evaluate a polynomial in s

bull dedicated relinearizationkeyswitch techniques (2011 )

bull But in fact TRGSW provides

C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)

9 9

Page 14: Homomorphic Encryption Standard: TFHE API...N. Gama and M. Georgieva Model of computations 1Binary, circuit computations 2Integer arithmetic computation 3Approximated (Fixed-point)

Homomorphic operations hierarchy

TRLWEx+ y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSWax for secret aExternal product

a isin 0 1 cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = s polynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

8 9

Questions

Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio

Model of computations1 Binary circuit computations

2 Integer arithmetic computation

3 Approximated (Fixed-point) computation

Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic

bull BFV (Seal Palisade) massively parallel small depth polynomials

bull CKKS (HEAAN) massively parallel floating point arithmetic

bull TFHE FHEW single eval boolean logic comparison threshold

How we can represent all plaintexts over the TN [X]

TN [X]+

noise

Ciphertext(a b)

Integers(ZpZ)n

Fixed point

C

CircuitsB = (0 1)

Homomorphic operations hierarchy

TRLWEx + y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSW ax for secret aExternal product

a isin 0 1

cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = spolynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

Circuits over the TN [X] (AND)

58

38

0 1

0=(01)(10)

14 = (0 0)3

4 = (1 1)0

1

Integers and fixed-point over the TN [X]0

2p

1p

BFV

m2τ +

minus 12L

12L

1q

CKKS

Linear combination with secret coefficients (0 1)

TRGSW(s1) TRGSW(s2) TRGSW(sn)

timesXa1

times1

timesXa2

times1

timesXan

times1

()1

0

1

0

1

0 sumsiai mod 2N

TRLWE TRLWE

Linear combination with secret coefficient s

Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s

HowTo evaluate a polynomial in s

bull dedicated relinearizationkeyswitch techniques (2011 )

bull But in fact TRGSW provides

C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)

9 9

Page 15: Homomorphic Encryption Standard: TFHE API...N. Gama and M. Georgieva Model of computations 1Binary, circuit computations 2Integer arithmetic computation 3Approximated (Fixed-point)

Questions

Join the poster session to discuss about a generic APIToward a generic geometric API for FHEN Gama and M Georgieva httpstfhegithubio

Model of computations1 Binary circuit computations

2 Integer arithmetic computation

3 Approximated (Fixed-point) computation

Some HE libraries and their strengthbull BGV (Helib) massively parallel finite field arithmetic

bull BFV (Seal Palisade) massively parallel small depth polynomials

bull CKKS (HEAAN) massively parallel floating point arithmetic

bull TFHE FHEW single eval boolean logic comparison threshold

How we can represent all plaintexts over the TN [X]

TN [X]+

noise

Ciphertext(a b)

Integers(ZpZ)n

Fixed point

C

CircuitsB = (0 1)

Homomorphic operations hierarchy

TRLWEx + y xminus yax for public a isin ZN [X]

small integer linear combinations

TRGSW ax for secret aExternal product

a isin 0 1

cmux (selector)blindrotate (timesXsecret ν)(automata)

TFHE Gates API

nand andor xor mux

individual bits

a = spolynomials in s(internal products)

Sublattice Small Ball(modular ring) (real ring)

CKKS APIfixed point slots

slots addslots multslots rotate

BFV APIslots mod p

slots addslots multslots rotate

Circuits over the TN [X] (AND)

58

38

0 1

0=(01)(10)

14 = (0 0)3

4 = (1 1)0

1

Integers and fixed-point over the TN [X]0

2p

1p

BFV

m2τ +

minus 12L

12L

1q

CKKS

Linear combination with secret coefficients (0 1)

TRGSW(s1) TRGSW(s2) TRGSW(sn)

timesXa1

times1

timesXa2

times1

timesXan

times1

()1

0

1

0

1

0 sumsiai mod 2N

TRLWE TRLWE

Linear combination with secret coefficient s

Internal product requires (b1 minus sa1)(b2 minus sa2) to evaluate a poly in s

HowTo evaluate a polynomial in s

bull dedicated relinearizationkeyswitch techniques (2011 )

bull But in fact TRGSW provides

C1 Pα C2 = (C1 C0)minus TRGSW (s)α (C2 0)

9 9