When HEAAN Meets FV: A New Somewhat Homomorphic Encryption with Reduced Memory Overhead

Abstract

We demonstrate how to reduce the memory overhead of somewhat homomorphic encryption (SHE) while computing on numerical data. We design a hybrid SHE scheme that exploits the packing algorithm of the $\mathtt {HEAAN}$ scheme and the variant of the $\mathtt {FV}$ scheme by Bootland et al. The ciphertext size of the resulting scheme is 3–18 times smaller than in $\mathtt {HEAAN}$ to compute polynomial functions of depth 4 while packing a small number of data values. Furthermore, our scheme has smaller ciphertexts even with larger packing capacities (256–2048 values).

Appendices

A Examples of b

As shown in Sect. 5, the plaintext space parameter b must be an mth power residue modulo $b^{n/m} + 1$ and its m root must be efficiently computable to allow the $\mathtt {HEAAN}$ encoding of complex numbers. Here we present a collection of these parameters for given practical choices of the ring dimension n and the packing capacity m.

Table 6. Examples of b such that b is an m-th power residue modulo $b^{n/m}+1$ for practical choices of m and n. Numbers in parentheses are equal to $\left\lfloor \log _2 (b^{n/m}+1) \right\rfloor$, which is the maximal coefficient size of $\mathtt {HEAAN}$ encodings. For each b we precomputed its m-th root using several calls of the Tonelli-Shanks algorithm (square_root_mod_prime) in SageMath.

B Results of experiments

The following tables present the detailed encoding and encryption parameters used in the experiments conducted in Sect. 7. This data is the full version of Tables 1, 2, 3, 4 and 5 from Sect. 7. In all the tables, $\varDelta$ denotes the packing scale, n is the dimension of the cyclotomic ring R and b is the constant term of the plaintext modulus. The total running time is averaged over 10 runs (Tables 7, 8, 9, 10 and 11).

Table 7. Encryption parameters to compute the logistic function in the interval $[-2.1, 2.1]$. The (*) symbol indicates that the maximal number of slots supported by the plaintext space is $2^6$ for our scheme.

Table 8. Encryption parameters to compute the sine in the interval $[-\pi , \pi ]$. The (*) symbol indicates that the maximal number of slots supported by the plaintext space is $2^6$ for our scheme.

Table 9. Encryption parameters to compute $e^x$ in the interval $[-2.3,2.3]$. The (*) symbol indicates that the maximal number of slots supported by the plaintext space is $2^5$ for our scheme.

Table 10. Encryption parameters to compute $x^{16}$ in the interval $[-2.1,2.1]$. The (*) symbol indicates that the maximal number of slots supported by the plaintext space is $2^5$ for our scheme.

Table 11. Encryption parameters to compute $x^2$ in the interval $(-2^{15}, 2^{15})$. The (*) symbol indicates that the maximal number of slots supported by the plaintext space is $2^5$ for our scheme.