Abstract
A gadget decomposition algorithm can invert a specific gadget matrix and produce an output with specific statistical properties. Such algorithms are commonly used in GSW-type homomorphic encryption schemes, like TFHE, to enable homomorphic multiplication on ciphertexts while controlling noise growth.
In this paper, we propose a new decomposition algorithm that has lower noise growth compared to existing algorithms. Our work is inspired by Genise et al.’s algorithm [EUROCRYPT 2018] and can be considered an improved version of their algorithm. Our decomposition procedure is designed using the idea of Babai’s nearest plane algorithm. Our experimental result show that both the noise growth and efficiency are superior to Genise et al.’s algorithm, and Zhang-Yu’s algorithm [PKC 2022].
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Notes
- 1.
While our algorithm may have lost the “randomness” present in Genise et al.’s algorithm, it is worth noting that in homomorphic encryption algorithms, such as the commonly used Digit Decomposition, “randomness” is not necessary for a decomposition.
- 2.
Assumes the GSO has entries each presented in O(n) bits.
- 3.
The reason for randomly selecting u from \(\mathbb {Z}_q\) is that, in the GSW-type homomorphic encryption scheme [15], the decomposition algorithm typically operates on an element randomly chosen from \(\mathbb {Z}_q\) based on the LWE assumption.
References
PALISADE Lattice Cryptography Library (release 1.11.5) (2021). https://palisade-crypto.org/
Alperin-Sheriff, J., Peikert, C.: Faster bootstrapping with polynomial error. In: Garay, J.A., Gennaro, R. (eds.) CRYPTO 2014. LNCS, vol. 8616, pp. 297–314. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-662-44371-2_17
Babai, L.: On Lovász’ lattice reduction and the nearest lattice point problem. In: Mehlhorn, K. (ed.) STACS 1985. LNCS, vol. 182, pp. 13–20. Springer, Heidelberg (1985). https://doi.org/10.1007/BFb0023990
Bonte, C., Iliashenko, I., Park, J., Pereira, H.V.L., Smart, N.P.: FINAL: faster FHE instantiated with NTRU and LWE. IACR Cryptology ePrint Archive, p. 74 (2022). https://eprint.iacr.org/2022/074
Brakerski, Z., Gentry, C., Vaikuntanathan, V.: (Leveled) fully homomorphic encryption without bootstrapping. In: Goldwasser, S. (ed.) Innovations in Theoretical Computer Science 2012, Cambridge, MA, USA, 8–10 January 2012, pp. 309–325. ACM (2012)
Chen, Y., Nguyen, P.Q.: BKZ 2.0: better lattice security estimates. In: Lee, D.H., Wang, X. (eds.) ASIACRYPT 2011. LNCS, vol. 7073, pp. 1–20. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-25385-0_1
Cheon, J.H., Kim, A., Kim, M., Song, Y.: Homomorphic encryption for arithmetic of approximate numbers. In: Takagi, T., Peyrin, T. (eds.) ASIACRYPT 2017. LNCS, vol. 10624, pp. 409–437. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-70694-8_15
Chillotti, I., Gama, N., Georgieva, M., Izabachène, M.: Faster fully homomorphic encryption: bootstrapping in less than 0.1 seconds. In: Cheon, J.H., Takagi, T. (eds.) ASIACRYPT 2016. LNCS, vol. 10031, pp. 3–33. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-53887-6_1
Dai, W., et al.: Implementation and evaluation of a lattice-based key-policy ABE scheme. IEEE Trans. Inf. Forensics Secur. 13(5), 1169–1184 (2018)
Ducas, L., Micciancio, D.: FHEW: bootstrapping homomorphic encryption in less than a second. In: Oswald, E., Fischlin, M. (eds.) EUROCRYPT 2015. LNCS, vol. 9056, pp. 617–640. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-46800-5_24
Fan, J., Vercauteren, F.: Somewhat practical fully homomorphic encryption. IACR Cryptology ePrint Archive 2012, 144 (2012). http://eprint.iacr.org/2012/144
Genise, N., Micciancio, D.: Faster Gaussian sampling for trapdoor lattices with arbitrary modulus. In: Nielsen, J.B., Rijmen, V. (eds.) EUROCRYPT 2018. LNCS, vol. 10820, pp. 174–203. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-78381-9_7
Genise, N., Micciancio, D., Polyakov, Y.: Building an efficient lattice gadget toolkit: subgaussian sampling and more. In: Ishai, Y., Rijmen, V. (eds.) EUROCRYPT 2019. LNCS, vol. 11477, pp. 655–684. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-17656-3_23
Gentry, C.: Fully homomorphic encryption using ideal lattices. In: Proceedings of the 41st Annual ACM Symposium on Theory of Computing, STOC 2009, Bethesda, MD, USA, 31 May–2 June 2009, pp. 169–178 (2009)
Gentry, C., Sahai, A., Waters, B.: Homomorphic encryption from learning with errors: conceptually-simpler, asymptotically-faster, attribute-based. In: Canetti, R., Garay, J.A. (eds.) CRYPTO 2013. LNCS, vol. 8042, pp. 75–92. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-40041-4_5
Jeon, S., Lee, H., Park, J.: Efficient lattice gadget decomposition algorithm with bounded uniform distribution. IEEE Access 9, 17429–17437 (2021)
Kluczniak, K.: NTRU-v-um: secure fully homomorphic encryption from NTRU with small modulus. In: Yin, H., Stavrou, A., Cremers, C., Shi, E. (eds.) Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, CCS 2022, Los Angeles, CA, USA, 7–11 November 2022, pp. 1783–1797. ACM (2022)
Lenstra, A.K., Lenstra, H.W., Lov sz, L.: Factoring polynomials with rational coefficients. Mathematische Annalen 261(4) (1982)
Lyubashevsky, V., Peikert, C., Regev, O.: A toolkit for ring-LWE cryptography. In: Johansson, T., Nguyen, P.Q. (eds.) EUROCRYPT 2013. LNCS, vol. 7881, pp. 35–54. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-38348-9_3
Nguyen, P.Q.: The LLL Algorithm: Survey and Applications (2010)
Vershynin, R.: Introduction to the non-asymptotic analysis of random matrices. In: Eldar, Y.C., Kutyniok, G. (eds.) Compressed Sensing, pp. 210–268. Cambridge University Press (2012)
Zhang, S., Yu, Y.: Towards a simpler lattice gadget toolkit. In: Hanaoka, G., Shikata, J., Watanabe, Y. (eds.) PKC 2022. LNCS, vol. 13177, pp. 498–520. Springer, Cham (2022). https://doi.org/10.1007/978-3-030-97121-2_18
Acknowledgments
This paper is supported by the Cloud Security Key Technology Research Key Laboratory of Shenzhen (No. ZDSY20200811143600002). Authors thank the anonymous ISPEC’23 reviewers for helpful comments.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Appendices
A Nearest Plane Algorithm
Babai’s Nearest Plane Algorithm [3] is given in Algorithm 3. The inputs for this algorithm is a lattice basis \(\textbf{B}\), its GSO \(\tilde{\textbf{B}}\), and a target \(\textbf{t}\in \mathbb {R}^n\). It returns a lattice point \(\textbf{x}\) such that \(\textbf{x}-\textbf{t}\in \mathcal {P}_{1/2}(\mathcal {\textbf{B}})\). The correctness can be checked by represented \(\textbf{x}\) and \(\textbf{t}\) in the GSO basis \(\tilde{\textbf{B}}\). One can verify that the coordinate (coefficient of \(\tilde{\textbf{b}}_i\)) of \(\textbf{x}-\textbf{t}\) is \(c_i-\lfloor c_i\rceil <1/2\).
B Decomposition in CRT Form
For \(q=\Pi _{j=1}^rq_j\), each coprime factor \(q_j\) fix the base-\(b_j\) gadget vector \(\textbf{g}_j^T=(1,b_j,\cdots ,b_j^{k_j-1})\) with \(k_j=\lceil log_{b_j} (q_j)\rceil \). An element \(u\in \mathbb {Z}_q\) can be represented as its Chinese Remainder Theorem form (CRT form) as (\(u\mod q_1,\cdots ,u\mod q_r)=(u_1,\cdots ,u_r)\in \mathbb {Z}_{q_1}\times \cdots \times \mathbb {Z}_{q_r}\). Then, for this CRT form, the decomposition algorithm can be performed for every \(\textbf{g}^{-1}_j\). Samping in CRT form for \((u_1,\cdots ,u_r)\) is given in Algorithm 4. The result is given in the following theorem.
Theorem 4
Let q have factorization \(q=\Pi _{j=1}^rq_j\) into coprime factors \(\{q_j\}\), \((b_j)_{j=1}^r\) be an r-tuple of base such that \(b_j<q_j\), and let \(k=\sum k_j\) with \(k_j=\lceil log_{b_j}q_j\rceil \). Then, there exists subgaussian decomposition algorithm can be performed in-parallel with r processors, each using time and space \(O(k_i)\) and with parameter at most \(\frac{max_j(b_j)+1}{2}\sqrt{2\pi }\).
Since except for the \(\textbf{g}^{-1}_j\) component, the Algorithm 4 is same with the Algorithm 4 in [13], for more details about the decomposition in CRT form, please see [13].
Rights and permissions
Copyright information
© 2023 The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd.
About this paper
Cite this paper
Liu, C., Liu, B. (2023). A New Gadget Decomposition Algorithm with Less Noise Growth in HE Schemes. In: Meng, W., Yan, Z., Piuri, V. (eds) Information Security Practice and Experience. ISPEC 2023. Lecture Notes in Computer Science, vol 14341. Springer, Singapore. https://doi.org/10.1007/978-981-99-7032-2_19
Download citation
DOI: https://doi.org/10.1007/978-981-99-7032-2_19
Published:
Publisher Name: Springer, Singapore
Print ISBN: 978-981-99-7031-5
Online ISBN: 978-981-99-7032-2
eBook Packages: Computer ScienceComputer Science (R0)