Fixed-Point Arithmetic in SHE Schemes

Abstract

Abstract. The purpose of this paper is to investigate fixed-point arithmetic in ring-based Somewhat Homomorphic Encryption (SHE) schemes. We provide three main contributions: firstly, we investigate the representation of fixed-point numbers. We analyse the two representations from Dowlin et al, representing a fixed-point number as a large integer (encoded as a scaled polynomial) versus a polynomial-based fractional representation. We show that these two are, in fact, isomorphic by presenting an explicit isomorphism between the two that enables us to map the parameters from one representation to another. Secondly, given a computation and a bound on the fixed-point numbers used as inputs and scalars within the computation, we achieve a way of producing lower bounds on the plaintext modulus p and the degree of the ring d needed to support complex homomorphic operations. Finally, as an application of these bounds, we investigate homomorphic image processing.

Faster Homomorphic Evaluation of Discrete Fourier Transforms

“…This need to process real and complex arithmetic homomorphically has led some authors to propose encoding methods for such numbers [4][5][6] in the context of encryption schemes based on Ring-LWE. Such schemes are typified by the BGV scheme [3].…”

“…Writing R p and R q for the ring reduced modulo p and q respectively, we have that R p represents the space of all possible plaintexts and R 2 q is the ciphertext space. The first methodology [5,6] to perform homomorphic operations on real numbers (and hence complex numbers) used a fixed point representation based on the polynomial expansion of the real number with respect to some "base". This polynomial is then embedded into the plaintext space, and homomorphic operations on the polynomials map into homomorphic operations on the underlying fixed point number.…”

“…These two increases imply lower bounds on the degree of the ring R and on the plaintext modulus p. It should be noted that we therefore need to track both noise growth (as in all SHE operations) as well as plaintext growth in such an encoding. See [5] where this growth in coefficient sizes of the representing polynomials is considered in depth. This method uses (in most cases) a single ciphertext to represent a single real number, thus no ciphertext "packing", i.e.…”

“…In both [4] and [5] this ability to homomorphically evaluate on real and complex numbers is demonstrated via a toy example of evaluating a simple image processing pipeline consisting of a DFT, followed by the multiplication of a secret Hadamard transform, followed by an inverse DFT. The results in [4] is particularly interesting, especially when throughput is considered.…”

“…If the coefficients a i are selected to be relatively small then the methodology in [5] can be applied to estimate the associated coefficient growth of the encoding polynomials as homomorphic operations are performed. Finding suitably small a i values can be obtained for an arbitrary complex number via the use of the LLL algorithm [11], in a relatively standard way.…”