Skip to main content
SpringerLink
Log in

Design and implementation of low-depth pairing-based homomorphic encryption scheme

  • Regular Paper
  • Published:
Journal of Cryptographic Engineering Aims and scope Submit manuscript

Abstract

Homomorphic encryption allows to carry out operations on encrypted data. In this paper, we focus on the design of a scheme based on pairings and elliptic curves, that is able to handle applications where the number of multiplication is not too high, with interesting practical efficiency when compared to lattice-based solutions. The starting point is the Boneh–Goh–Nissim (BGN for short) encryption scheme (Boneh et al. in Kilian J (ed) Theory of cryptography, second theory of cryptography conference, TCC 2005, Cambridge, MA, USA, February 10–12, 2005), which enables the homomorphic evaluation of polynomials of degree at most 2 on ciphertexts. In our scheme, we use constructions coming from Freeman (Gilbert H (ed) Advances in cryptology—EUROCRYPT 2010, 29th annual international conference on the theory and applications of cryptographic techniques, French Riviera, May 30–June 3, 2010) and Catalano and Fiore (Ray I, Li N, Kruegel C (eds) Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, Denver, CO, USA, October 12–16, 2015), to propose a variant of the \({\text {BGN}}\) scheme that can handle the homomorphic evaluation of polynomials of degree at most 4. We discuss both the mathematical structure of the scheme and its implementation. We provide simulation results, showing the relevance of this solution for applications requiring a low multiplicative depth, and give relative comparison with respect to lattice-based homomorphic encryption schemes.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2

Similar content being viewed by others

Notes

  1. k is the embedding degree with respect to a prime number r such that \(r \mid \# E(\mathbb {F}_p)\) and \(r \not \mid p\) (i.e., the smallest integer such that \(p^k = 1 \mod r\)). The curve is said pairing-friendly if k is small and r is large. In \({\text {BGN-F}}\) and \({\text {BGN-F-CF}}\), r is the group order of \(\mathbb {G}\) and \(\mathbb {H}\). In our implementation, \(r = \# E(\mathbb {F}_p)\) since Barreto–Naehrig curves have prime order.

  2. In all these variants of the \({\text {BGN}}\) scheme, decryption requires to compute discrete logarithms in groups of large prime order r. Thus, plaintext space size n should vary logarithmically with r to have a polynomial-time in n decryption algorithm such as Pollard’s kangaroo algorithm [1, p. 4].

  3. In the family of the \({\text {BGN}}\) variants, multiplication and even certain addition modify ciphertext space. For this reason, decryption algorithm and homomorphic operations differ for each level.

  4. We can divide it into 4 matrices of order 2. The \((i,j)^{\text {th}}\) block is equal to \(a_{i,j}\mathcal {B}\) with \(\mathcal {A}=(a_{i,j})_{i,j\in \{1,2\}}\).

  5. If it is not the case, we multiply homomorphically the other terms by \({\text {Enc}}(1)\), an encryption of bit 1. More generally, this is applied several times when we compute the sum of ciphertexts with several levels of difference.

  6. We can obtain level 4 ciphertexts with product of two level 2 ciphertexts, but no product between a level 1 ciphertext and a level 3 ciphertext is defined.

  7. In the equality, the ratio is well defined if the numerator is a multiple of the denominator. Its value is equal to the scalar factor between the two points, modulo 2. This is the case here since \(u_1\) and \(v_1\) belongs, respectively, to the kernels of \(\pi _1\) and \(\pi _2~\) [2, p. 58].

  8. Available on https://github.com/herumi/mcl/#benchmark and [39, p. 618].

  9. https://github.com/shaih/HElib.

  10. http://sealcrypto.org/.

  11. https://github.com/CryptoExperts/FV-NFLlib, commit 4474b00.

  12. https://bitbucket.org/malb/lwe-estimator, commit eb45a74.

  13. See https://www.keylength.com/.

  14. We choose to employ asymmetric pairings to compute homomorphic product of fresh ciphertexts. The use of symmetric pairings would change the computational hardness assumption [2].

  15. The website https://gitlab.inria.fr/dldb/discretelogdb.git covets to list discrete logarithms records in finite fields.

  16. In other words, the trace \(t = p + 1 - r\) should be small (compared to p and r).

References

  1. Boneh, D., Goh, E.-J., Nissim, K.: Evaluating 2-DNF formulas on ciphertexts. In: Kilian, J. (ed.) Theory of Cryptography, Second Theory of Cryptography Conference, TCC 2005, Cambridge, MA, USA, February 10–12, 2005, Proceedings, Volume 3378 of Lecture Notes in Computer Science, pp. 325–341. Springer (2005)

  2. Freeman, D.M.: Converting pairing-based cryptosystems from composite-order groups to prime-order groups. In: Gilbert, H. (ed.) Advances in Cryptology—EUROCRYPT 2010, 29th Annual International Conference on the Theory and Applications of Cryptographic Techniques, French Riviera, May 30–June 3, 2010. Proceedings, Volume 6110 of Lecture Notes in Computer Science, pp. 44–61. Springer (2010)

  3. Catalano, D., Fiore, D.: Using linearly-homomorphic encryption to evaluate degree-2 functions on encrypted data. In: Ray, I., Li, N., Kruegel, C. (eds.) Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, Denver, CO, USA, October 12–16, 2015, pp. 1518–1529. ACM (2015)

  4. Paillier, P.: Public-key cryptosystems based on composite degree residuosity classes. In: Proceedings of Advances in Cryptology EUROCRYPT 1999, Number 1592 in LNCS, pp. 223–238 (1999)

  5. ElGamal, T.: A public key cryptosystem and a signature scheme based on discrete logarithms. IEEE Trans. Inf. Theory 31(4), 469–472 (1985)

    Article  MathSciNet  MATH  Google Scholar 

  6. Boneh, D.: The decision Diffie–Hellman problem. In: Proceedings of the Third International Symposium on Algorithmic Number Theory, ANTS-III, London, UK, pp. 48–63. Springer (1998)

  7. El Mrabet, N., Joye, M.: Guide to Pairing-Based Cryptography. CRC Press, Boca Raton (2017)

    Book  MATH  Google Scholar 

  8. Gentry, C.: Fully homomorphic encryption using ideal lattices. STOC 9, 169–178 (2009)

    Article  MathSciNet  MATH  Google Scholar 

  9. Gentry, C.: A fully homomorphic encryption scheme. Ph.D. thesis, Stanford University (2009)

  10. Bianchi, T., Piva, A., Barni, M.: On the implementation of the discrete Fourier transform in the encrypted domain. IEEE Trans. Inf. Forensics Secur. 4(1), 86–97 (2009)

    Article  Google Scholar 

  11. Aguilar-Melchor, C., Gaborit, P., Herranz, J.: Additively homomorphic encryption with d-operand multiplications. In: Advances in Cryptology—CRYPTO 2010, pp. 138–154. Springer (2010)

  12. Lauter, K., López-Alt, A., Naehrig, M.: Private computation on encrypted genomic data. In: International Conference on Cryptology and Information Security in Latin America, pp. 3–27. Springer (2014)

  13. van Dijk, M., Gentry, C., Halevi, S., Vaikuntanathan, V.: Fully homomorphic encryption over the integers. In: Advances in cryptology—EUROCRYPT 2010, pp. 24–43. Springer (2010)

  14. Smart, N.P., Vercauteren, F.: Fully homomorphic encryption with relatively small key and ciphertext sizes. In: International Workshop on Public Key Cryptography, pp. 420–443. Springer (2010)

  15. Naehrig, M., Lauter, K.E., Vaikuntanathan, V.: Can homomorphic encryption be practical? In: ACM CCSW, pp. 113–124. ACM (2011)

  16. Gentry, C., Halevi, S., Smart, N.P.: Fully homomorphic encryption with polylog overhead. In: Advances in Cryptology—EUROCRYPT 2012, pp. 465–482. Springer (2012)

  17. Gentry, C., Halevi, S.: Fully homomorphic encryption without squashing using depth-3 arithmetic circuits. In: 2011 IEEE 52nd Annual Symposium on Foundations of Computer Science (FOCS), pp. 107–109. IEEE (2011)

  18. Coron, J.-S., Naccache, D., Tibouchi, M.: Public key compression and modulus switching for fully homomorphic encryption over the integers. In: Advances in Cryptology—EUROCRYPT 2012, pp. 446–464. Springer (2012)

  19. Fan, J., Vercauteren, F.: Somewhat practical fully homomorphic encryption. IACR Cryptol. ePrint Arch. 2012, 144 (2012)

    Google Scholar 

  20. Gentry, C., Sahai, A., Waters, B.: Homomorphic encryption from learning with errors: conceptually-simpler, asymptotically-faster, attribute-based. In: Advances in Cryptology—CRYPTO 2013, pp. 75–92. Springer (2013)

  21. Bos, J.W., Lauter, K., Loftus, J., Naehrig, M.: Improved security for a ring-based fully homomorphic encryption scheme. In: International Conference On Cryptography and Coding. Springer (December 2013)

  22. Brakerski, Z., Gentry, C., Vaikuntanathan, V.: (Leveled) Fully homomorphic encryption without bootstrapping. TOCT 6(3), 13 (2014)

    Article  MathSciNet  MATH  Google Scholar 

  23. Brakerski, Z., Vaikuntanathan, V.: Lattice-based FHE as secure as PKE. In: Proceedings of the 5th Conference on Innovations in Theoretical Computer Science—ITCS 2014, pp. 1–12. ACM (2014)

  24. Khedr, A., Gulak, G., Vaikuntanathan, V.: SHIELD: scalable homomorphic implementation of encrypted data-classifiers. IEEE Trans. Comput. 65, 2848–2858 (2015)

    Article  MathSciNet  MATH  Google Scholar 

  25. Doröz, Y., Sunar, B.: Flattening NTRU for evaluation key free homomorphic encryption. Cryptology ePrint Archive, Report 2016/315 (2016)

  26. Chillotti, I., Gama, N., Georgieva, M., Izabachène, M.: Faster fully homomorphic encryption: bootstrapping in less than 0.1 seconds. In: Advances in Cryptology—ASIACRYPT 2016—22nd International Conference on the Theory and Application of Cryptology and Information Security, Hanoi, Vietnam, December 4–8, 2016, Proceedings, Part I, pp. 3–33 (2016)

  27. Armknecht, F., Sadeghi, A.-R.: A new approach for algebraically homomorphic encryption. IACR Cryptol. ePrint Arch. 2008, 422 (2008)

    Google Scholar 

  28. Guruswami, V., Sudan, M.: Improved decoding of Reed–Solomon and algebraic-geometric codes. In: 39th Annual Symposium on Foundations of Computer Science, 1998. Proceedings, pp. 28–37. IEEE (1998)

  29. Augot, D., Finiasz, M.: A public key encryption scheme based on the polynomial reconstruction problem. In: Advances in Cryptology—EUROCRYPT 2003, pp. 645–645 (2003)

  30. Kiayias, A., Yung, M.: Directions in polynomial reconstruction based cryptography. IEICE Trans. Fundam. Electron. Commun. Comput. Sci. 87(5), 978–985 (2004)

    Google Scholar 

  31. Regev, O.: On lattices, learning with errors, random linear codes, and cryptography. J. ACM (JACM) 56(6), 34 (2009)

    Article  MathSciNet  MATH  Google Scholar 

  32. Lyubashevsky, V., Peikert, C., Regev, O.: Advances in Cryptology—EUROCRYPT 2010: 29th Annual International Conference on the Theory and Applications of Cryptographic Techniques, French Riviera, May 30–June 3, 2010. Proceedings, Chapter On Ideal Lattices and Learning with Errors over Rings, pp. 1–23. Springer, Berlin (2010)

  33. Guillevic, A.: Arithmetic of pairings on algebraic curves for cryptography. Theses, Ecole Normale Supérieure de Paris - ENS Paris (December 2013)

  34. Guillevic, A.: Comparing the pairing efficiency over composite-order and prime-order elliptic curves. In: Applied Cryptography and Network Security—11th International Conference, ACNS 2013, Banff, AB, Canada, June 25–28, 2013. Proceedings, pp. 357–372 (2013)

  35. Freeman, D., Scott, M., Teske, E.: A taxonomy of pairing-friendly elliptic curves. J. Cryptol. 23(2), 224–280 (2009)

    Article  MathSciNet  MATH  Google Scholar 

  36. Naehrig, M., Niederhagen, R., Schwabe, P.: New software speed records for cryptographic pairings. In: Abdalla, M., Barreto, P.S.L.M. (eds.) Progress in Cryptology—LATINCRYPT 2010, First International Conference on Cryptology and Information Security in Latin America, Puebla, Mexico, August 8–11, 2010, Proceedings, Volume 6212 of Lecture Notes in Computer Science, pp. 109–123. Springer (2010)

  37. Vercauteren, F.: Optimal pairings. IEEE Trans. Inf. Theory 56(1), 455–461 (2010)

    Article  MathSciNet  MATH  Google Scholar 

  38. Enge, A., Milan, J.: Security, Privacy, and Applied Cryptography Engineering: 4th International Conference, SPACE 2014, Pune, India, October 18–22, 2014. Proceedings, Chapter Implementing Cryptographic Pairings at Standard Security Levels, pp. 28–46. Springer, Cham (2014)

  39. Azarderakhsh, R., Fishbein, D., Grewal, G., Hu, S., Jao, D., Longa, P., Verma, R.: Fast software implementations of bilinear pairings. IEEE Trans. Dependable Secur. Comput. 14(6), 605–619 (2017)

    Article  Google Scholar 

  40. Mitsunari, S.: A fast implementation of the optimal ate pairing over BN curve on intel haswell processor. IACR Cryptol. ePrint Arch. 2013, 362 (2013)

    Google Scholar 

  41. Aranha, D.F., Barreto, P.S.L.M., Longa, P., Ricardini, J.E.: The realm of the pairings. In: International Conference on Selected Areas in Cryptography, pp. 3–25. Springer (2013)

  42. Zavattoni, E., Perez, L.J.D., Mitsunari, S., Sánchez-Ramí-rez, A.H., Teruya, T., Rodrí-guez-Henrí-quez, F.: Software implementation of an attribute-based encryption scheme. IEEE Trans. Comput. 64(5), 1429–1441 (2015)

    Article  MathSciNet  MATH  Google Scholar 

  43. Bonnoron, G., Fontaine, C., Gogniat, G., Herbert, V., Lapôtre, V., Migliore, V., Roux-Langlois, A.: Somewhat/Fully Homomorphic Encryption: Implementation Progresses and Challenges, pp. 68–82. Springer, Cham (2017)

    MATH  Google Scholar 

  44. Albrecht, M., Bai, S., Ducas, L.: A subfield lattice attack on overstretched NTRU assumptions: cryptanalysis of some FHE and Graded Encoding Schemes. Cryptology ePrint Archive, Report 2016/127 (2016)

  45. Kirchner, P., Fouque, P.-A.: Comparison between Subfield and Straightforward Attacks on NTRU. Cryptology ePrint Archive, 2016/717 (2016)

  46. Migliore, V., Bonnoron, G., Fontaine, C.: Determination and exploration of practical parameters for the latest Somewhat Homomorphic Encryption (SHE) Schemes. Working paper or preprint (October 2016)

  47. Aguilar-Melchor, C.: Private Communication

  48. Chen, H., Laine, K., Player, R.: Simple encrypted arithmetic library-seal v2. 1. IACR Cryptology ePrint Archive, 2017:224 (2017)

  49. Galbraith, S., Hess, F., Vercauteren, F.: Hyperelliptic pairings. Pair. Based Cryptogr. Pair. 2007, 108–131 (2007)

    MathSciNet  MATH  Google Scholar 

  50. Kim, T., Barbulescu, R.: Extended tower number field sieve: a new complexity for the medium prime case. In: Annual Cryptology Conference, pp. 543–571. Springer (2016)

  51. Hitt, L.: On the minimal embedding field. Pair. Based Cryptogr. Pair. 2007, 294–301 (2007)

    MathSciNet  MATH  Google Scholar 

  52. Lenstra, A.K., Lenstra Jr., H.W., Manasse, M.S., Pollard, J.M.: The number field sieve. In: The Development of the Number Field Sieve, pp. 11–42. Springer (1993)

  53. Menezes, A., Sarkar, P., Singh, S.: Challenges with assessing the impact of NFS advances on the security of pairing-based cryptography. In: Proceedings of Mycrypt (2016)

  54. Barbulescu, R., Duquesne, S.: Updating key size estimations for pairings. Cryptology ePrint Archive, Report 2017/334, (2017). http://eprint.iacr.org/2017/334

  55. Duquesne, S., El Mrabet, N., Haloui, S., Rondepierre, F.: Choosing and generating parameters for low level pairing implementation on BN curves (2015)

  56. Khandaker, Md.A.-A., Nanjo, Y., Ghammam, L., Duquesne, S., Nogami, Y., Kodera, Y.: Efficient optimal ate pairing at 128-bit security level. In: International Conference in Cryptology in India, pp. 186–205. Springer (2017)

  57. Aranha, D.: Pairings are not dead, just resting. 21st Workshop on Elliptic Curve Cryptography, https://ecc2017.cs.ru.nl/slides/ecc2017-aranha.pdf (November 2017)

  58. Che, H., Han, K., Zhicong, H., Jalali, A., Laine, K.: Simple Encrypted Arithmetic Library—SEAL (v2.3.0). Technical report (December 2017)

Download references

Acknowledgements

We sincerely thank Aurore Guillevic for our discussions concerning the security estimation of our scheme according to the last attacks published. This work has been funded by Region Bretagne under grant AAP PME 2014, 14006192.

Author information

Authors and Affiliations

  1. CEA Paris-Saclay, Paris, France

    Vincent Herbert

  2. CNRS UMR 6285 Lab-STICC and IMT-Atlantique, Brest, France

    Bhaskar Biswas & Caroline Fontaine

Authors
  1. Vincent Herbert
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Bhaskar Biswas
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Caroline Fontaine
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Bhaskar Biswas.

Additional information

Vincent Herbert: This work was done while the author was at CNRS, UMR 6285 Lab-STICC.

Appendices

Low-multiplicative-depth Boolean circuits

We treat bit per bit encryption. Circuits are rewritten with two operators: \(\veebar \) (exclusive disjunction) and \(\wedge \). They can be written under different forms depending on operation order.

1.1 Binary data

Table 11 supplies constraints on ciphertext levels with typical examples of low-multiplicative-depth circuits.

Notation: ciphertexts a (resp. b, c, d) with level \(L_1\) (resp. level \(L_2, L_3, L_4\)), ciphertexts x (resp. y) with level \(M_1\) (resp. level \(M_2\)).

In \({\text {BGN-F-CF}}\), no multiplication is defined with a factor having a level \(\ge 3\). Therefore, operands level is limited according to multiplicative depth.

Table 11 Ciphertext levels with some low-multiplicative-depth circuits. Notations are given in Sect. A.1
Full size table

1.2 Integer data

Data are n-bits integers. Input ciphertexts have level \(L=1\).

  • Adder \(a_{n-1}\ldots a_0+b_{n-1}\ldots b_0 \mod 2^n\) In terms of multiplicative depth, the hardest part is the evaluation of the carry which enables to compute the most significant bit (\({\text {MSB}}\)) of the sum modulo \(2^n\). Let us compute the \({\text {MSB}}\) with \(n=3\), which is the maximal value for \({\text {BGN-F-CF}}\). Then, it can be written:

    $$\begin{aligned} a_2 \veebar b_2 \veebar ((a_1 \wedge b_1) \wedge (a_0 \wedge b_0)) . \end{aligned}$$

    The Boolean circuit has multiplicative depth \(\lceil \log _2 2(n-1) \rceil =2\). The corresponding ciphertext is the sum of three ciphertexts of level \(2(n-1)L=4\). Indeed, to add ciphertexts, we need to have ciphertexts of the same level. In this case \(a_2\) and \(b_2\) have level L but \(((a_1 \wedge b_1) \wedge (a_0 \wedge b_0))\) has level 4. To increment the level of a ciphertext, we multiply it homomorphically by an encryption of 1.

  • Test \(a_{n-1}\ldots a_0==b_{n-1}\ldots b_0.\) With \({\text {BGN-F-CF}}\), we can manage up to \(n=4\) bits with the circuit of depth \(\lceil log_2(n) \rceil =2\):

    $$\begin{aligned}&((a_{3} \veebar b_{3}) \veebar 1) \wedge ((a_{2} \veebar b_{2}) \veebar 1) \\&\quad \wedge ((a_{1} \veebar b_{1}) \veebar 1) \wedge ((a_{0} \veebar b_{0}) \veebar 1). \end{aligned}$$

    The output is a ciphertext of level \(nL=4\).

1.3 Evaluation circuit

We compare SEAL v2.1, SEAL v2.3, FV-NFLlib and \({\text {BGN-F-CF}}\) on the same 2-depth test circuit, the results are given in Tables 8 and 9.

The homomorphic circuit is a toy example. It takes as input an encrypted letter and homomorphically changes lower-case letter into upper-case letter. Precomputation and postcomputation are done. Generally, they can be solutions to decrease the multiplicative depth of the homomorphic circuit. In this example, the homomorphic circuit tests characterwise if the character is a lower-case letter or not.

Let the input character, encoded in extended \({\text {ASCII}}\), be written as \(\lambda \). We denote the bits of \(\lambda +31\) as \(n_9n_8n_7n_6n_5n_4n_3n_2n_1\) and the bits of \(\lambda +5\), as \(o_9o_8o_7o_6o_5o_4o_3o_2o_1\). We precompute \(n_8\), \(n_9\) and \(o_8\). On plaintexts, the lower-case test consists in the Boolean expression:

$$\begin{aligned} n_8 \wedge \lnot n_9 \wedge \lnot o_8 \end{aligned}$$

We evaluate a corresponding homomorphic circuit:

$$\begin{aligned} {\text {Enc}}(n_8) \boxtimes ({\text {Enc}}(\mathbf{1}) \boxplus {\text {Enc}}(n_9)) \boxtimes ({\text {Enc}}(\mathbf{1}) \boxplus {\text {Enc}}(o_8)) \end{aligned}$$

The results for this circuit gives the insight of how the schemes compare with each other. The trend should remain similar for other circuits. Note that precomputation and postcomputation time are taken into account in Tables 8 and 9.

Parameter choices of SEAL and FV-NFLlib

We compare our construction of \({\text {BGN-F-CF}}\) with SEAL v2.1, SEAL v2.3 and FV-NFLlib which are implementations of the Fan–Vercauteren scheme [19]. It is worth noting that the parameter choices and their effect on security and performance of both the lattice-based schemes, SEAL v2.1, SEAL v2.3 and FV-NFLlib, are not yet definitive. We compared the schemes for a given security level.

The tool we used for security estimation of the lattice-based schemes, by Martin Albrecht and is available at https://bitbucket.org/malb/lwe-estimator, commit eb45a74. Note this is an upper level security estimator not considering the dedicated attacks on definitive schemes. We compare the three schemes for a given security level of about 100-bits.

Let n be the plaintext modulus, q be the coefficient modulus and \(\sigma \) be the standard deviation of the Gaussian noise (terms used from [48, 58]). Regev gave a lemma [31] to define the noise parameter \(\alpha \), which can be expressed as:

$$\begin{aligned} \alpha = \dfrac{\sqrt{2\pi }\sigma }{q}. \end{aligned}$$

  • \(n = 2048\),

  • \(q = 2^{74} - 2^{14} + 1\),

  • \(\sigma = 65\).

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Herbert, V., Biswas, B. & Fontaine, C. Design and implementation of low-depth pairing-based homomorphic encryption scheme. J Cryptogr Eng 9, 185–201 (2019). https://doi.org/10.1007/s13389-018-0192-y

Download citation

  • Received:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s13389-018-0192-y

Keywords

Search

Navigation