F1: A Fast and Programmable Accelerator for Fully Homomorphic Encryption

Abstract

Fully Homomorphic Encryption (FHE) allows computing on encrypted data, enabling secure offloading of computation to untrusted servers. Though it provides ideal security, FHE is expensive when executed in software, 4 to 5 orders of magnitude slower than computing on unencrypted data. These overheads are a major barrier to FHE's widespread adoption.We present F1, the first FHE accelerator that is programmable, i.e., capable of executing full FHE programs. F1 builds on an indepth architectural analysis of the characteristics of FHE computations that reveals acceleration opportunities. F1 is a wide-vector processor with novel functional units deeply specialized to FHE primitives, such as modular arithmetic, number-theoretic transforms, and structured permutations. This organization provides so much compute throughput that data movement becomes the key bottleneck. Thus, F1 is primarily designed to minimize data movement. Hardware provides an explicitly managed memory hierarchy and mechanisms to decouple data movement from execution. A novel compiler leverages these mechanisms to maximize reuse and schedule off-chip and on-chip data movement.We evaluate F1 using cycle-accurate simulation and RTL synthesis. F1 is the first system to accelerate complete FHE programs, and outperforms state-of-the-art software implementations by gmean 5,400× and by up to 17,000×. These speedups counter most of FHE's overheads and enable new applications, like real-time private deep learning in the cloud. CCS CONCEPTS• Computer systems organization → Parallel architectures; • Security and privacy → Cryptography.

Client-optimized algorithms and acceleration for encrypted compute offloading

“…The future is bright for encrypted computing as system support matures. While FHE was once many orders of magnitude too slow to be practical [26], the performance gap has narrowed to the point of practicality with new work on hardware acceleration, such as F1 [64] (which was concurrent with our work). Moving forward, our community is likely to see improvements on many fronts.…”

“…Server costs are consistently high. Existing, complementary work aims to reduce server costs with HE algorithms [6,8,36,41,47,55] and hardware [59,63,64,70] but neglects client costs. In contrast, CHOCO's primary goal is to reduce the client's time and communication costs.…”

“…Some prior work used hardware to accelerate kernels for lattice-based cryptography schemes [21,44,57,62], including current state-of-art HE schemes [7,13,23,26]. Others accelerate HE directly [37,46,55,59,64,70], focusing primarily on hardware NTT and server-side operations. As we show in Figure 2, NTT acceleration helps but is insufficient.…”

MATCHA: A Fast and Energy-Efficient Accelerator for Fully Homomorphic Encryption over the Torus

“…A TFHE accelerator is different from the accelerators designed for other FHE schemes such as BGV, BFV, and CKKS in two points. First, although few prior accelerators [19] support BGV and CKKS bootstrapping along a tiny multiplicative depth datapath, most prior works [15,18,20] design hardware accelerators to process leveled BFV or CKKS homomorphic operations without bootstrapping. However, a TFHE accelerator must perform bootstrapping at the end of each TFHE gate.…”

“…Depth-first FFT. Most prior FHE accelerators [18][19][20] perform NTTs and INTTs by the Cooley-Tukey data flow that introduces irregular memory accesses particularly in its bit-reversal stage. In order to remove the bit-reversal overhead, a prior ideal-latticebased cryptographic accelerator [13] uses the Cooley-Tukey flow for NTTs and the Gentlemen-Sande flow for INTTs.…”