We describe a working implementation of a variant of Gentry's fully homomorphic encryption scheme (STOC 2009), similar to the variant used in an earlier implementation effort by Smart and Vercauteren (PKC 2010). Smart and Vercauteren implemented the underlying "somewhat homomorphic" scheme, but were not able to implement the bootstrapping functionality that is needed to get the complete scheme to work. We show a number of optimizations that allow us to implement all aspects of the scheme, including the bootstrapping functionality.

Our main optimization is a key-generation method for the underlying somewhat homomorphic encryption, that does not require full polynomial inversion. This reduces the asymptotic complexity from O(n2.5) to O(n1.5) when working with dimension-n lattices (and practically reducing the time from many hours/days to a few seconds/minutes). Other optimizations include a batching technique for encryption, a careful analysis of the degree of the decryption polynomial, and some space/time trade-offs for the fully-homomorphic scheme.

We tested our implementation with lattices of several dimensions, corresponding to several security levels. From a "toy" setting in dimension 512, to "small," "medium," and "large" settings in dimensions 2048, 8192, and 32768, respectively. The public-key size ranges in size from 70 Megabytes for the "small" setting to 2.3 Gigabytes for the "large" setting. The time to run one bootstrapping operation (on a 1-CPU 64- bit machine with large memory) ranges from 30 seconds for the "small" setting to 30 minutes for the "large" setting.

/pdf/implementing-gentry-s-fully-homomorphic-encryption-scheme-3u9mecyvkt.pdf

Implementing Gentry's fully-homomorphic encryption scheme

Legacy encryption systems depend on sharing a key (public or private) among the peers involved in exchanging an encrypted message. However, this approach poses privacy concerns. The users or service providers with the key have exclusive rights on the data. Especially with popular cloud services, control over the privacy of the sensitive data is lost. Even when the keys are not shared, the encrypted material is shared with a third party that does not necessarily need to access the content. Moreover, untrusted servers, providers, and cloud operators can keep identifying elements of users long after users end the relationship with the services. Indeed, Homomorphic Encryption (HE), a special kind of encryption scheme, can address these concerns as it allows any third party to operate on the encrypted data without decrypting it in advance. Although this extremely useful feature of the HE scheme has been known for over 30 years, the first plausible and achievable Fully Homomorphic Encryption (FHE) scheme, which allows any computable function to perform on the encrypted data, was introduced by Craig Gentry in 2009. Even though this was a major achievement, different implementations so far demonstrated that FHE still needs to be improved significantly to be practical on every platform. Therefore, this survey focuses on HE and FHE schemes. First, we present the basics of HE and the details of the well-known Partially Homomorphic Encryption (PHE) and Somewhat Homomorphic Encryption (SWHE), which are important pillars for achieving FHE. Then, the main FHE families, which have become the base for the other follow-up FHE schemes, are presented. Furthermore, the implementations and recent improvements in Gentry-type FHE schemes are also surveyed. Finally, further research directions are discussed. This survey is intended to give a clear knowledge and foundation to researchers and practitioners interested in knowing, applying, and extending the state-of-the-art HE, PHE, SWHE, and FHE systems.

https://dl.acm.org/doi/pdf/10.1145/3214303

A Survey on Homomorphic Encryption Schemes: Theory and Implementation

Legacy encryption systems depend on sharing a key (public or private) among the peers involved in exchanging an encrypted message. However, this approach poses privacy concerns. Especially with popular cloud services, the control over the privacy of the sensitive data is lost. Even when the keys are not shared, the encrypted material is shared with a third party that does not necessarily need to access the content. Moreover, untrusted servers, providers, and cloud operators can keep identifying elements of users long after users end the relationship with the services. Indeed, Homomorphic Encryption (HE), a special kind of encryption scheme, can address these concerns as it allows any third party to operate on the encrypted data without decrypting it in advance. Although this extremely useful feature of the HE scheme has been known for over 30 years, the first plausible and achievable Fully Homomorphic Encryption (FHE) scheme, which allows any computable function to perform on the encrypted data, was introduced by Craig Gentry in 2009. Even though this was a major achievement, different implementations so far demonstrated that FHE still needs to be improved significantly to be practical on every platform. First, we present the basics of HE and the details of the well-known Partially Homomorphic Encryption (PHE) and Somewhat Homomorphic Encryption (SWHE), which are important pillars of achieving FHE. Then, the main FHE families, which have become the base for the other follow-up FHE schemes are presented. Furthermore, the implementations and recent improvements in Gentry-type FHE schemes are also surveyed. Finally, further research directions are discussed. This survey is intended to give a clear knowledge and foundation to researchers and practitioners interested in knowing, applying, as well as extending the state of the art HE, PHE, SWHE, and FHE systems.

NP = PCP(log n, 1) and
related results crucially depend upon the close connection
between the probability with which a function passes a
low degree test and the
distance of this function to the nearest degree
d polynomial. In this paper
we study a test proposed by Rubinfeld and Sudan [30]. The
strongest previously known connection for this test states that
a function passes the test with probability δ for some δ >
7/8 iff the function has agreement ≈ δ with a polynomial of
degree d. We present a new,
and surprisingly strong, analysis which shows that the preceding
statement is true for arbitrarily small ≈, provided the field
size is polynomially larger than d/δ. The analysis uses a
version of Hilbert
irreducibility, a tool of algebraic geometry. As a consequence we obtain an alternate construction for
the following proof system: A constant prover 1-round proof
system for NP languages in which the verifier uses
O(log n) random bits, receives answers of
size O(log
n) bits, and has an error
probability of at most % MathType!Translator!2!1!AMS LaTeX.tdl!TeX -- AMS-LaTeX!
% MathType!MTEF!2!1!+-
% feaafeart1ev1aaatCvAUfeBSn0BKvguHDwzZbqefeKCPfgBGuLBPn
% 2BKvginnfarmqr1ngBPrgitLxBI9gBamXvP5wqSXMqHnxAJn0BKvgu
% HDwzZbqegm0B1jxALjhiov2DaeHbuLwBLnhiov2DGi1BTfMBaebbnr
% fifHhDYfgasaacH8qrps0lbbf9q8WrFfeuY-Hhbbf9v8qqaqFr0xc9
% pk0xbba9q8WqFfea0-yr0RYxir-Jbba9q8aq0-yq-He9q8qqQ8frFv
% e9Fve9Ff0dmeaabaqaciGacaGaaeqabaWaaqaafaaakeaacaaIYaWa
% aWbaaSqabeaacqGHsislciGGSbGaai4BaiaacEgadaahaaadbeqaai
% aaigdacqGHsislcqGHiiIZaaWccaWGUbaaaaaa!4CB1!
 $$
2^{{ - \log ^{{1 - \in }} n}} 
$$
 . Such a proof system,
which implies the NP-hardness of approximating Set Cover to
within Ω(log n) factors, has
already been obtained by Raz and Safra [29]. Raz and Safra
obtain their result by giving a strong analysis, in the sense
described above, of a new low-degree test that they
present. A second consequence of our analysis is a self
tester/corrector for any buggy program that (supposedly)
computes a polynomial over a finite field. If the program is
correct only on δ fraction of inputs where % MathType!Translator!2!1!AMS LaTeX.tdl!TeX -- AMS-LaTeX!
% MathType!MTEF!2!1!+-
% feaafeart1ev1aaatCvAUfeBSn0BKvguHDwzZbqefeKCPfgBGuLBPn
% 2BKvginnfarmqr1ngBPrgitLxBI9gBamXvP5wqSXMqHnxAJn0BKvgu
% HDwzZbqegm0B1jxALjhiov2DaeHbuLwBLnhiov2DGi1BTfMBaebbnr
% fifHhDYfgasaacH8qrps0lbbf9q8WrFfeuY-Hhbbf9v8qqaqFr0xc9
% pk0xbba9q8WqFfea0-yr0RYxir-Jbba9q8aq0-yq-He9q8qqQ8frFv
% e9Fve9Ff0dmeaabaqaciGacaGaaeqabaWaaqaafaaakeaacqaH0oaz
% cqGH9aqpcaaIXaGaai4lamaaemaabaGaamOraaGaay5bSlaawIa7am
% aaCaaaleqabaGaeyicI4maaOGaeSOAI0JaaGimaiaac6cacaaI1aaa
% aa!50F9!
 $$
\delta = 1/{\left| F \right|}^{ \in } \ll 0.5
$$
 , then the
tester/corrector determines δ and generates % MathType!Translator!2!1!AMS LaTeX.tdl!TeX -- AMS-LaTeX!
% MathType!MTEF!2!1!+-
% feaafeart1ev1aaatCvAUfeBSn0BKvguHDwzZbqefeKCPfgBGuLBPn
% 2BKvginnfarmqr1ngBPrgitLxBI9gBamXvP5wqSXMqHnxAJn0BKvgu
% HDwzZbqegm0B1jxALjhiov2DaeHbuLwBLnhiov2DGi1BTfMBaebbnr
% fifHhDYfgasaacH8qrps0lbbf9q8WrFfeuY-Hhbbf9v8qqaqFr0xc9
% pk0xbba9q8WqFfea0-yr0RYxir-Jbba9q8aq0-yq-He9q8qqQ8frFv
% e9Fve9Ff0dmeaabaqaciGacaGaaeqabaWaaqaafaaakeaacaWGpbWa
% aeWaaeaadaWcaaqaaiaaigdaaeaacqaH0oazaaaacaGLOaGaayzkaa
% aaaa!4880!
 $$
O{\left( {\frac{1}
{\delta }} \right)}
$$
 values for every input,
such that one of them is the correct output. In fact, our
results yield something stronger: Given the buggy program, we
can construct 
% MathType!Translator!2!1!AMS LaTeX.tdl!TeX -- AMS-LaTeX!
% MathType!MTEF!2!1!+-
% feaafeart1ev1aaatCvAUfeBSn0BKvguHDwzZbqefeKCPfgBGuLBPn
% 2BKvginnfarmqr1ngBPrgitLxBI9gBamXvP5wqSXMqHnxAJn0BKvgu
% HDwzZbqegm0B1jxALjhiov2DaeHbuLwBLnhiov2DGi1BTfMBaebbnr
% fifHhDYfgasaacH8qrps0lbbf9q8WrFfeuY-Hhbbf9v8qqaqFr0xc9
% pk0xbba9q8WqFfea0-yr0RYxir-Jbba9q8aq0-yq-He9q8qqQ8frFv
% e9Fve9Ff0dmeaabaqaciGacaGaaeqabaWaaqaafaaakeaacaWGpbWa
% aeWaaeaadaWcaaqaaiaaigdaaeaacqaH0oazaaaacaGLOaGaayzkaa
% aaaa!4880!
 $$
O{\left( {\frac{1}
{\delta }} \right)}
$$
 randomized programs such that one of them is
correct on every input, with high probability. Such a strong
self-corrector is a useful tool in complexity theory—with some
applications known.

Improved low-degree testing and its applications

This paper presents TumbleBit, a new unidirectional unlinkable payment hub that is fully compatible with today’s Bitcoin protocol. TumbleBit allows parties to make fast, anonymous, off-blockchain payments through an untrusted intermediary called the Tumbler. TumbleBit’s anonymity properties are similar to classic Chaumian eCash: no one, not even the Tumbler, can link a payment from its payer to its payee. Every payment made via TumbleBit is backed by bitcoins, and comes with a guarantee that Tumbler can neither violate anonymity, nor steal bitcoins, nor “print money” by issuing payments to itself. We prove the security of TumbleBit using the real/ideal world paradigm and the random oracle model. Security follows from the standard RSA assumption and ECDSA unforgeability. We implement TumbleBit, mix payments from 800 users and show that TumbleBit’s offblockchain payments can complete in seconds.

TumbleBit: An Untrusted Bitcoin-Compatible Anonymous Payment Hub.

/pdf/sec-x-2-recommended-elliptic-curve-domain-parameters-54wojro6fg.pdf

SEC X.2: Recommended Elliptic Curve Domain Parameters

Focusing on servers that process many signatures or ciphertexts, this paper proposes two techniques for parallel computing with SIMD, which significantly enhances the speed of elliptic curve scalar multiplication. We also evaluate one of them based on a real implementation on a Pentium III, which incorporates the SIMD architecture. The results show that the proposed method is about 4.4 times faster than the conventional method.

Elliptic Curve Arithmetic Using SIMD

PROBLEM TO BE SOLVED: To provide an arithmetic program on a finite field for making a computer perform a function of expanding the possibility of further accelerating the operation on the finite field by using a basis whose operation cost is small. SOLUTION: In the arithmetic program on a finite field, a finite field having q elements is set to GF(q), q=p 2 , v is one of the elements of GF(p), a check trident symbol α satisfies α 2 +v=0, and the basis is [α, α 2 ]. First, an extension field element input section 10 receives the input of the elements of the finite field GF(q) represented by using the elements of the finite field GF(p), and sends the elements of the finite field GF(p) constituting the inputted elements of the finite field GF(q) to an extension field element operation section 20. The extension field element operation section 20 to which the elements of the finite field GF(p) are sent performs the arithmetic operation among elements of the finite field GF(p) constituting the inputted elements of the finite field GF(q), calculates the operation result on the finite field GF(q). An operation result outputting section 30 outputs the operation result by using the elements of the elements of the finite field GF(p). COPYRIGHT: (C)2005,JPO&NCIPI

Arithmetic unit on finite field and arithmetic program on finite field

One way of improving efficiency of Gentry's fully homomorphic encryption is controlling the number of operations, but our recollection is that any scheme which controls the bound has not proposed.

In this paper, we propose a key generation algorithm for Gentry's homomorphic encryption scheme that controls the bound of the circuit depth by using the relation between the circuit depth and the eigenvalues of a basis of a lattice. We present experimental results that show that the proposed algorithm is practical. We discuss security of the basis of the lattices generated by the algorithm for practical use.

An improvement of key generation algorithm for Gentry's homomorphic encryption scheme

This paper presents new algorithms for the Tate pairing on a prime field. Recently, many pairing-based cryptographic schemes have been proposed. However, computing pairings incurs a high computational cost and represents the bottleneck to using pairings in actual protocols. This paper shows that the proposed algorithms reduce the cost of multiplication and inversion on an extension field, and reduce the number of calculations of the extended finite field. This paper also discusses the optimal algorithm to be used for each pairing parameter and shows that the total computational cost is reduced by 50% if k = 6 and 57% if k = 8.

Tetsutaro Kobayashi

Papers

SEC X.2: Recommended Elliptic Curve Domain Parameters

Elliptic Curve Arithmetic Using SIMD

Arithmetic unit on finite field and arithmetic program on finite field

An improvement of key generation algorithm for Gentry's homomorphic encryption scheme

Efficient Algorithms for Tate Pairing