Homomorphic encryption (HE), which enables computation on ciphertexts without any leakage, rise as a most promising solution for privacy-preserving data processing, including secure machine learning and secure out-sourcing computation. Despite the extensive applicability of HE, the current constructions are sometimes considered as impractical due to its inefficiency. In this paper, we propose improvements on the linear transformation in bootstrapping, a technique allowing the infinite number of operation for HE, and homomorphic discrete Fourier transformation (DFT) using batch homomorphic encryption. We observe that the multiplication of a sparse diagonal matrix and ciphertext of a vector can be done within O(1) homomorphic computations. This observation induces the faster algorithm for linear transformation in bootstrapping and homomorphic DFT. To achieve this, we use Cooley-Tukey matrix factorization and construct a new recursive factorization of the linear transformation in bootstrapping. Our method with radix r only requires O(r log r n) constant vector multiplication and O( √ r log r n) rotations by consuming O(log r n) depth when the input vector size is n. The previous method used in the library, a library that implements homomorphic encryption for approximate computation, requires O(n) and O( √ n), respectively. To show the performance improvement, we implement our method on top of the library. Our implementation, along with further few techniques, of these algorithms show the significant improvements compared to the previous algorithm. New homomorphic DFT with length 2 14 only takes about 8s which results 150 times faster than the previous method. Furthermore, the bootstrapping takes about 2 minutes for C 32768 plaintext space with 8-bit precision, which takes 26 hours with same bit precision using the previous method.INDEX TERMS Cryptography, data privacy, encryption, public key.

The dual attack is one of the most efficient attack algorithms for learning with errors (LWE) problem. Recently, an efficient variant of the dual attack for sparse and small secret LWE was reported by Albrecht (Eurocrypt 2017), which forces some LWE-based cryptosystems, especially fully homomorphic encryptions (FHE), to change parameters. In this paper, we propose a new hybrid of dual and meet-in-themiddle (MITM) attack, which outperforms the improved variant on the same LWE parameter regime. To this end, we adapt the MITM attack for NTRU due to Odlyzko to LWE and give a rigorous analysis for it. The performance of our MITM attack depends on the relative size of error and modulus, and hence, for a large modulus LWE samples, our MITM attack works well for quite large error. We then combine our MITM attack with Albrecht's observation that understands the dual attack as a dimension-error tradeoff, which finally yields our hybrid attack. We also implement a sage module that estimates the attack complexity of our algorithm upon LWE-estimator, and our attack shows significant performance improvement for the LWE parameter for FHE. For example, for the LWE problem with dimension n = 2 15 , modulus q = 2 628 , and ternary secret key with Hamming weight 64 which is one parameter set used for HEAAN bootstrapping (Eurocrypt 2018), our attack takes 2 112.5 operations and 2 70.6 bit memory, while the previous best attack requires 2 127.2 operations as reported by the LWE-estimator. INDEX TERMS Cryptanalysis, fully homomorphic encryption, learning with errors, meet-in-the-middle.

No abstract

The approximate greatest common divisor problem (ACD) and its variants have been used to construct many cryptographic primitives. In particular, the variants of the ACD problem based on Chinese remainder theorem (CRT) are being used in the constructions of a batch fully homomorphic encryption to encrypt multiple messages in one ciphertext. Despite the utility of the CRT-variant scheme, the algorithms that secures its security foundation have not been probed well enough.In this paper, we propose two algorithms and the results of experiments in which the proposed algorithms were used to solve the variant problem. Both algorithms take the same time complexity $\begin{array}{} \displaystyle 2^{\tilde{O}(\frac{\gamma}{(\eta-\rho)^2})} \end{array}$ up to a polynomial factor to solve the variant problem for the bit size of samples γ, secret primes η, and error bound ρ. Our algorithm gives the first parameter condition related to η and γ size. From the results of the experiments, it has been proved that the proposed algorithms work well both in theoretical and experimental terms.