Practical (F)HE Part III – Bootstrapping

1. FHE+MMAPs Summer School, Paris Practical (F)HE Part III – Bootstrapping Shai Halevi

2. FHE+MMAPs Summer School, Paris Reminder: Operation Cost • Cost measured in time, added-noise * “Moderate” noise even for multiplying by a 0-1 constant vector

3. FHE+MMAPs Summer School, Paris Recryption for BGV [GHS’12c, AP’13,HS’15] • Decryption formula is • Observation: For close to a large -power, this formula can be simplified • Roughly if then

4. FHE+MMAPs Summer School, Paris Simplified Decryption • Notations: for an integer in base-p encoding • is the thdigit, an integer in • are digits through ,in • Lemma: Forplaintext space mod and modulus with , let be an integer with , , then • For odd we have, • For we have,

5. FHE+MMAPs Summer School, Paris Simplified Decryption • The term for is only needed to handle negative in ’s complement • Proof (for , positive ): • for small • and are small, so no carry bits from 1 to •  the same bit is added to and to • Also, bit of is zero • 

6. FHE+MMAPs Summer School, Paris Recryption for BGV • Assume for now , no packing • Choose |noise| • Simplified decryption process is • Store wrt plaintext space • Computing homomorphically is easy • Harder to extraction homomorphically

7. FHE+MMAPs Summer School, Paris Homomorphic Bit-Extraction • We have (wrtptxt space mod-) • Want to compute for • Is there an arithmetic circuit modulo that transforms to ? • Not really, the output LBS in mod- arithmetic circuit depends only on the input LSBs • We could do it with divide-by-2 gates • But can we implement them homomorphically?

8. FHE+MMAPs Summer School, Paris Homomorphic “Restricted Division” • With plaintext space mod , consider a ciphertext, encrypting some plainetxt • Suppose we know that is divisible by • Let , then • encypts wrt plaintext space mod

9. FHE+MMAPs Summer School, Paris [GHS12c] Homomorphic Bit-Extraction • We can divide-by-2 homomorphically if we know that the plaintext is even • Observation: squaring times keep LSB, zero-out the bits above it • then • is even and • Setting , we have • divisible by 4 and • Setting , we have • Etc.

10. FHE+MMAPs Summer School, Paris [AP13] Homomorphic Bit-Extraction • We have integer , want to extract • // invariant: • For to : • For to // remove low bits, one by one • // is even • // we are left with the ’th bit • Output

11. FHE+MMAPs Summer School, Paris Homomorphic Digit-Extraction () • We have integer , want to extract • // invariant: • For to : • For to // remove low digits • ?? • // • // we are left with the ’th digit • Output This does not work

12. FHE+MMAPs Summer School, Paris [HS15] Homomorphic Digit-Extraction () • We have integer , want to extract • // invariant: • For to : • For to // remove low digits • // • // we are left with the ’th digit • Output Exists degree- polynomial that works

13. FHE+MMAPs Summer School, Paris [HS15] Homomorphic Digit-Extraction () • We have integer , want to extract • // invariant: • For to : • For to // remove low digits • // • // we are left with the ’th digit • Output • We use a variant of the Paterson-Stockmeyerprocedure for efficient evaluation of plaintext polynomial on a ciphertext

14. FHE+MMAPs Summer School, Paris Recryption of Non-Packed Ciphertext • Store wrt plaintext space • Recryption process computes: • For we have another term

15. FHE+MMAPs Summer School, Paris Recryptionof Packed Ciphertexts • We still want to use the same procedure • (assuming =1) • , what are ? • is represented in the decoding basis by a vector of coefficienct from • represented by the LSB’s of all these coefficients • Similarly for • We use the decoding basis here since we need the coefficients to be small

16. FHE+MMAPs Summer School, Paris Packed Homomorphic Digit-extraction • We have want • Need to apply the digit-extraction procedure homomorphically to the coefficients of • But operations on are applied to the message slots in , not its coefficients • E.g., computing doesn’t square the individual coefficients separately

17. FHE+MMAPs Summer School, Paris Packed Homomorphic Digit-extraction • We have want • The [GHS12c] procedure: • Lin1: Move the coefficients of to plaintext slots • Nonlin: Apply digit-extraction in slots • Lin2: Move the coefficients back to get result • The non-linear step is exactly as before • Efficient implementation of the linear transformations is a challenge

18. FHE+MMAPs Summer School, Paris Packed Homomorphic MSB-extraction • “Generic linear transformation” for Lin1, Lin2? • Work quadratic in , inefficient • The [AP13] optimizations: • Decompose Lin1, Lin2 to FFT-like sparse transformations (using “ring switching”) • Work , mult-by-const depth • The [HS15] implementation • Similar decomposition (no “ring switching”) • Concrete depth 2-3, work ~

19. FHE+MMAPs Summer School, Paris • Another basis of • Similar to the decoding basis, geometry a bit worse • A bit easier to understand and explain • Let s.t. the ’s are co-prime • Then Using the “Powerful Basis” [LPR14]

20. FHE+MMAPs Summer School, Paris Using the “Powerful Basis” [LPR14] • An element represented as • Equivalently as a univariate polynomial using • with • Move the ’s to the slots and back

21. FHE+MMAPs Summer School, Paris • is an ’th root of unity in • We have • We use the following isomorphism between and : • Let be a representative set for • , contains one element from each coset • Then Recall the Plaintext Slots

22. FHE+MMAPs Summer School, Paris • Input: with the ’s in the slots • I.e., the vector includes all the coefficients • Note that for each , so it describes of the coefficients of • The mapping is one-to-one • The order in which the ’s are packed in the slots of is up to us to decide The Lin2 Transformation

23. FHE+MMAPs Summer School, Paris • Input: with the ’s in the slots • Output: the element itself • The slots containing • The transformation that we compute on the slots is multi-point polynomial-evaluation • Input: coefficients of • Output: evaluation of in the roots of unity The Lin2 Transformation

24. FHE+MMAPs Summer School, Paris Our Linear Transformations • Lin2 is a multi-point polynomial evaluation • Decompose Lin2 into 1D transforms by viewing as multi-variate polynomial • For each , this is multi-point evaluation over all the assignments • Computing for all the ’s in parallel,one for every column in the hypercube

25. FHE+MMAPs Summer School, Paris Our Linear Transformations • Lin2 is a multi-point polynomial evaluation • Decompose Lin2 into 1D transforms by viewing as multi-variate polynomial • For each , this is multi-point evaluation over all the assignments • Computing for all the ’s in parallel, one for every column in the hypercube • We choose the representatives T such thatonly ranges over elements mod • even though • Implies some constraints on (and a careful choice of )

26. FHE+MMAPs Summer School, Paris Our Linear Transformations • Lin2 is a multi-point poly-eval • Decompose into 1D transforms along the different dimensions of the hypercube • Each is itself a multi-point polynomial-evaluation • Typically 2-3 such 1D transforms • Multi-by-constant depth of 2-3 (rather than 1) • # of 1D-rotations “in spirit” is or (vs. ) • In practice we save a factor of ~50 • Lin1 is the inverse of Lin2

27. FHE+MMAPs Summer School, Paris Our Linear Transformations • Lin2 is a multi-point poly-eval • Decompose into 1D transforms along the different dimensions of the hypercube • Some of these transformations are -linear but not -linear • Our homomorphic operations act on slots • How to implement -linear transofmrations?

28. FHE+MMAPs Summer School, Paris Implementing -Linear Functions • Use Frobeniusautomorphism • We can implement for any • Most ’s rotate the slots, but acts on each slot separately as Frobeniusmap • If and then • Similarly, denote , then

29. FHE+MMAPs Summer School, Paris Linearized Polynomials • Let be -linear, then there exists constants s.t. • In our case, we need a combination of slot-rotations (as per our “generic linear map”) and -linear transformations on the slots • Denote rotate-slots-by- by

30. FHE+MMAPs Summer School, Paris Implementing Our -Linear Maps • We need • is some -linear map on the slots • Can be implemented as • automorphisms (expensive) • mult-by-const and additions (cheap) • Depth 1 mult-by-constant

31. FHE+MMAPs Summer School, Paris A Better Implementation • Compute rotations, • Then inner products, • Then automorphism, • Only automorphism, not

32. FHE+MMAPs Summer School, Paris Packed Homomorphic Digit-extraction • We have want • Lin1: Move the coefficients of to plaintext slots • Nonlin: Apply digit-extraction in slots • Lin2: Move the coefficients back to get result • Lin1, Lin2 implemented via sparse decomposition into 1D transforms • The non-linear step is exactly as before efficient bootstrapping of packed ciphertexts

33. FHE+MMAPs Summer School, Paris • Tested our implementation in many settings • Targeted 10 remaining levels after recryption Performance (Feb 2015)

34. FHE+MMAPs Summer School, Paris • Tested our implementation in many settings • Targeted 10 remaining levels after recryption Performance (Feb 2015) • Recryption takes as little as 10-12 levels • - Requires a very sparse key, is this safe?

35. FHE+MMAPs Summer School, Paris C'est Tout