Homomorphic Encryption for Multiple Users With Less Communications

Abstract

Keeping privacy for every entity in outsourced computation is always a crucial issue. For efficient secure computation, homomorphic encryption (HE) can be one of nice solutions. Especially, multikey homomorphic encryption (MKHE) which allows homomorphic evaluation on encrypted data under different keys can be one of the simplest solutions for a secure computation which handles multiple users' data. However, the current main problem of MKHE is that the dimension of its evaluated ciphertext relies on the number of users. To solve this problem, there are several variants of multikey homomorphic encryption schemes to keep the size of ciphertext constant for a fixed number of users. However, users interact one another before computation to provide their inputs, which increases setup complexity. Moreover, all the existing MKHE schemes and their variants have unique benefits which cannot be easily achieved at the same time in one scheme. In other words, each type of scheme has a suitable computational scenario to put its best performance. In this paper, we suggest more efficient evaluation key generation algorithm for the existing variants of MKHE schemes which have no ciphertext expansion for a fixed number of users. Our method only requires a very simple and minor pre-processing; distributing public keys, which is not counted as a round at all in many other applications. As a result, participants have less communication, computation, and memory cost in online phase. Moreover, we provide a practical conversion algorithm between the two types of schemes in order to efficiently utilize both schemes' advantages together in more various applications. We also provide detailed comparison among similar results so that users can choose a suitable scheme for their homomorphic encryption based application scenarios.

Efficient TFHE Bootstrapping in the Multiparty Setting

“…Notice that obtaining this secret key structure from existing lattice-based HE schemes is already well known and simple in a common random string (CRS) model [4], [5], [19]. For example, following the same notation as in subsection III-A, the ciphertext LWE s1 (0) + • • • + LWE sk (0) can be decrypted using the secret key s provided that the same mask a was used for all parties as the masks of these k LWE ciphertexts 3 .…”

“…For example, following the same notation as in subsection III-A, the ciphertext LWE s1 (0) + • • • + LWE sk (0) can be decrypted using the secret key s provided that the same mask a was used for all parties as the masks of these k LWE ciphertexts 3 . We follow the most communication efficient MPHE protocol [5], which can be described as follows:…”

“…We generate the local bootstrapping key similarly to [5], however, the instantiation is a bit different in order to minimize the noise. We adapt the typical technique, which transforms a private-key ciphertext into a public-key ciphertext.…”

“…However, it requires a setup phase where users must interact at least once to generate their common public key, which is not necessary in MKHE. Therefore, both approaches have distinct advantages and there are different applications where each can have better performance than the other, as analyzed in [5]. For example, if there are already predefined inputs for a function which a server is going to compute, such as the training of a machine learning model, MPHE outperforms MKHE.…”

“…Mouchet et al [4], introduce a MPHE construction requiring two rounds between participants. In [5], the author improved upon [4] by designing a non-interactive algorithm, once the public keys are already known. The setup phase (generation of the common keys) of the above works has practical computation time and memory consumption.…”