On the Security of Multikey Homomorphic Encryption

Lee, Hyangsook; Park, Jeongeun

doi:10.1007/978-3-030-35199-1_12

Cited by 9 publications

(17 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Brakerski and Perlman [8] proposed the shorter size of ciphertext which has linear growth on the number of users at first. Then other FHE primitives were naturally transformed to multikey variants such as multikey BGV [18], multikey TFHE [7], [19], and multikey BFV, and CKKS [6] with linear growth ciphertext length.…”

Section: B Related Workmentioning

confidence: 99%

“…For MKHE security with multiple decryptor, it is recommended to prove that the scheme is secure against both internal adversary and external adversaries [19]. However, we only care of the internal adversary which is one of participants for evaluation keys, since the keys are not used for decryption process.…”

Section: Securitymentioning

confidence: 99%

“…but it may leak output information to the one who watch the public channel and run the public algorithm on its own, hence, it is modified to an algorithm requiring a valid secret key as an input to achieve output privacy of multikey ciphertext [19].…”

Section: Appendix Security Of Proposed Schemementioning

confidence: 99%

“…(1) If the output privacy is not concerned such as standard MPC protocol or users employ their own secure channel, they can use the one round distributed decryption protocol [7] with noise flooding technique. (2) To achieve the output privacy through public channels, users use a decryption protocol suggested in [19], with re-encrypting the output of PartDec. It requires more communication cost than (1).…”

Section: Appendix Security Of Proposed Schemementioning

confidence: 99%

See 3 more Smart Citations

Homomorphic Encryption for Multiple Users With Less Communications

Park¹

2021

IEEE Access

Self Cite

View full text Add to dashboard Cite

Keeping privacy for every entity in outsourced computation is always a crucial issue. For efficient secure computation, homomorphic encryption (HE) can be one of nice solutions. Especially, multikey homomorphic encryption (MKHE) which allows homomorphic evaluation on encrypted data under different keys can be one of the simplest solutions for a secure computation which handles multiple users' data. However, the current main problem of MKHE is that the dimension of its evaluated ciphertext relies on the number of users. To solve this problem, there are several variants of multikey homomorphic encryption schemes to keep the size of ciphertext constant for a fixed number of users. However, users interact one another before computation to provide their inputs, which increases setup complexity. Moreover, all the existing MKHE schemes and their variants have unique benefits which cannot be easily achieved at the same time in one scheme. In other words, each type of scheme has a suitable computational scenario to put its best performance. In this paper, we suggest more efficient evaluation key generation algorithm for the existing variants of MKHE schemes which have no ciphertext expansion for a fixed number of users. Our method only requires a very simple and minor pre-processing; distributing public keys, which is not counted as a round at all in many other applications. As a result, participants have less communication, computation, and memory cost in online phase. Moreover, we provide a practical conversion algorithm between the two types of schemes in order to efficiently utilize both schemes' advantages together in more various applications. We also provide detailed comparison among similar results so that users can choose a suitable scheme for their homomorphic encryption based application scenarios.

show abstract

Section: B Related Workmentioning

confidence: 99%

Section: Securitymentioning

confidence: 99%

Section: Appendix Security Of Proposed Schemementioning

confidence: 99%

Section: Appendix Security Of Proposed Schemementioning

confidence: 99%

See 2 more Smart Citations

Homomorphic Encryption for Multiple Users With Less Communications

Park¹

2021

IEEE Access

Self Cite

View full text Add to dashboard Cite

show abstract

“…In fact, the practical HE schemes [4]- [6] and their variants [7]- [9] use a naive digit decomposition algorithm and heuristically assume that each output coefficient of such algorithm independently follows a subgaussian distribution for practical purpose. Then they analyze the output quality by using the benefits of subgaussian sampling such as Pythagorean additivity.…”

Section: Introductionmentioning

confidence: 99%

Efficient Lattice Gadget Decomposition Algorithm With Bounded Uniform Distribution

2021

Self Cite

View full text Add to dashboard Cite

A gadget decomposition algorithm is commonly used in many advanced lattice cryptography applications which support homomorphic operations over ciphertexts to control the noise growth. For a special structure of a gadget, the algorithm is digit decomposition. If such algorithm samples from a subgaussian distribution, that is, the output is randomized, it gives more benefits on output quality. One of the important advantages is Pythagorean additivity which makes the resulting noise contained in a ciphertext grow much less than naive digit decomposition. Therefore, the error analysis becomes cleaner and tighter than the use of other measures like Euclidean norm and infinity norm. Even though such advantage can also be achieved by use of discrete Gaussian sampling, it is not attractive for practical performance due to a large factor in resulting noise and the complex computation of the exponential function, whereas a more relaxed probability condition is required for a subgaussian distribution. Nevertheless, subgaussian sampling has barely received an attention so far, thus no practical algorithms was implemented before an efficient algorithm is presented by Genis et al., recently. In this paper, we present a practically efficient gadget decomposition algorithm where output follows a subgaussian distribution. We parallelize the existing practical subgaussian gadget decomposition algorithm, using a bounded uniform distribution. Our algorithm is divided into two independent subalgorithms and only one algorithm depends on the input. Therefore, the other algorithm can be considered as precomputation. As an experimental result, our algorithm performs over 50% better than the existing algorithm.

show abstract