A Full RNS Variant of FV Like Somewhat Homomorphic Encryption Schemes

Abstract

Abstract. Since Gentry's breakthrough work in 2009, homomorphic cryptography has received a widespread attention. Implementation of a fully homomorphic cryptographic scheme is however still highly expensive. Somewhat Homomorphic Encryption (SHE) schemes, on the other hand, allow only a limited number of arithmetical operations in the encrypted domain, but are more practical. Many SHE schemes have been proposed, among which the most competitive ones rely on (Ring-) Learning With Error (RLWE) and operations occur on high-degree polynomials with large coe cients. This work focuses in particular on the Chinese Remainder Theorem representation (a.k.a. Residue Number Systems) applied to large coe cients. In SHE schemes like that of Fan and Vercauteren (FV), such a representation remains hardly compatible with procedures involving coe cient-wise division and rounding required in decryption and homomorphic multiplication. This paper suggests a way to entirely eliminate the need for multi-precision arithmetic, and presents techniques to enable a full RNS implementation of FV-like schemes. For dimensions between 2 11 and 2 15 , we report speed-ups from 5⇥ to 20⇥ for decryption, and from 2⇥ to 4⇥ for multiplication.

Efficient Reductions in Cyclotomic Rings - Application to Ring-LWE Based FHE Schemes

“…More recently, Bajard et al have provided a full RNS variant of FV [3]. We briefly recall how this RNS variant works.…”

“…During this procedure, the RNS representations of the input polynomials are extended to bases with larger dynamic ranges so as to compute the products over R instead of over R q . Moreover, the division operation is achievable using [3,Section 4.4]. Finally, one has to convert the three-element ciphertext back to a two-element ciphertext, through a process called relinearization.…”

“…The scheme introduced by Brakerski, Gentry and Vainkuntanathan [8] shares many features of FV, and can be similarly adapted to the techniques in [3]. A secret-key is also defined to be a "small" polynomial s ∈ R q , and ciphertexts correspond to pairs (c 0 , c 1 ) ∈ R 2 , but messages are encrypted in the Least Significant Bits (LSBs) of (6):…”

“…It starts by recovering c in power basis from the NTT representation outputted by (3). Then it consecutively reduces c of degree 2n−2 by X m −1 and the sparse polynomial Q sp .…”

“…In order to improve efficiency, an approximate extension is used [3] and thus the norm of the polynomials is bounded by is given in Proposition 1 whose proof can directly be derivated from the one of [3].…”