Fully Homomorphic Encryption (FHE) By: Matthew Eilertson.

Fully Homomorphic Encryption (FHE) By: Matthew Eilertson

Overview FHE, origins, why we care? Background Discussion First Implementation (Craig Gentry) – Somewhat Homomorphic Encryption (SWHE) – Bootstrapping Recent Improvement (Craig Gentry Et al) – Replacing Bootstrapping

Computing on Encrypted Data Storing my files on the cloud – Encrypt them to protect my information – Search through them for emails with “homomorphic” in the subject line Cloud should return only these (encrypted) messages, w/o knowing the key Private Internet search – Encrypt my query, send to Google – I still want to get the same results Results would be encrypted too

Fully Homomorphic Encryption Function f x Enc(x) Eval: f, Enc(x)  Enc(f(x)) homomorphic evaluation Knows nothing of x. [Rivest-Adleman-Dertouzos’78] 4 of 32

Fully Homomorphic Encryption ► First Defined: “Privacy homomorphism” [RAD’78] – their motivation: searching encrypted data 5 of 32

Fully Homomorphic Encryption ► First Defined: “Privacy homomorphism” [RAD’78] ► Limited Variants: – GM & Paillier: additively homomorphic – RSA & El Gamal: multiplicatively homomorphic – their motivation: searching encrypted data c 1 = m 1 e c 2 = m 2 e c n = m n e X c* = c 1 c 2 …c n = (m 1 m 2 …m n ) e mod N 6 of 32

Public-key Encryption Three procedures: KeyGen, Enc, Dec – (sk,pk)  KeyGen($) Generate random public/secret key-pair – c  Enc pk (m) Encrypt a message with the public key – m  Dec sk (c) Decrypt a ciphertext with the secret key E.g., RSA: c  m e mod N, m  c d mod N – (N,e) public key, d secret key

Homomorphic Public-key Encryption Also another procedure: Eval – c*  Eval pk ( , c 1,…,c n ) –  a Boolean circuit with ADD, MULT mod 2 Encryption of inputs m 1,…,m n to  Circuit Encryption of output value m*=  (m 1,…,m n )

An Analogy: Alice’s Jewelry Store Alice’s workers need to assemble raw materials into jewelry But Alice is worried about theft How can the workers process the raw materials without having access to them?

An Analogy: Alice’s Jewelry Store Alice puts materials in locked glove box – For which only she has the key Workers assemble jewelry in the box Alice unlocks box to get “results”

The Analogy Enc: putting things inside the box – Anyone can do this (imagine a mail-drop) – c i  Enc pk (m i ) Dec: Taking things out of the box – Only Alice can do it, requires the key – m*  Dec sk (c*) Eval: Assembling the jewelry – Anyone can do it, computing on ciphertext – c*  Eval pk ( , c 1,…,c n ) m* =  (m 1,…,m n ) is “the ring”, made from “raw materials” m 1,…,m n

Secret key: large odd number p 0p2p3p-3p-2p-p

Secret key: large odd number p To Encrypt a bit b: – pick a (random) “large” multiple of p, say q·p 0p2p3p-3p-2p-p

Secret key: large odd number p To Encrypt a bit b: – pick a (random) “large” multiple of p, say q·p – pick a (random) “small” number 2·r+b 0p2p3p-3p-2p-p (this is even if b=0, and odd if b=1) the “noise” = 2·r+b

Secret key: large odd number p To Encrypt a bit b: – pick a (random) “large” multiple of p, say q·p – pick a (random) “small” number 2·r+b – Ciphertext c = q·p+2·r+b 0p2p3p-3p-2p-p (this is even if b=0, and odd if b=1) the “noise” = 2·r+b

Secret key: large odd number p To Encrypt a bit b: – pick a (random) “large” multiple of p, say q·p – pick a (random) “small” number 2·r+b – Ciphertext c = q·p+2·r+b 0p2p3p-3p-2p-p (this is even if b=0, and odd if b=1) the “noise” = 2·r+b To Decrypt a ciphertext c: Taking c mod p recovers the noise

How secure is this? … if there were no noise (think r=0) 0p2p3p-3p-2p-p the “noise” = 2·r+b … and I give you two encryptions of 0 (q 1 p & q 2 p) … then you can recover the secret key p = GCD(q 1 p, q 2 p)

How secure is this? … but if there is noise 0p2p3p-3p-2p-p the “noise” = 2·r+b … the GCD attack doesn’t work … and neither does any attack (we believe) … this is called the approximate GCD assumption

XORing two encrypted bits: 0p2p3p-3p-2p-p the “noise” = 2·r+b – c 1 = q 1 ·p + (2·r 1 + b 1 ) – c 2 = q 2 ·p + (2·r 2 + b 2 )

XORing two encrypted bits: 0p2p3p-3p-2p-p the “noise” = 2·r+b – c 1 = q 1 ·p + (2·r 1 + b 1 ) – c 1 +c 2 = p·(q 1 + q 2 ) + 2·(r 1 +r 2 ) + (b 1 +b 2 ) – c 2 = q 2 ·p + (2·r 2 + b 2 )

XORing two encrypted bits: 0p2p3p-3p-2p-p the “noise” = 2·r+b – c 1 = q 1 ·p + (2·r 1 + b 1 ) – c 1 +c 2 = p·(q 1 + q 2 ) + 2·(r 1 +r 2 ) + (b 1 +b 2 ) Odd if b 1 =0, b 2 =1 (or) b 1 =1, b 2 =0 Even if b 1 =0, b 2 =0 (or) b 1 =1, b 2 =1 – c 2 = q 2 ·p + (2·r 2 + b 2 )

XORing two encrypted bits: 0p2p3p-3p-2p-p the “noise” = 2·r+b – c 1 = q 1 ·p + (2·r 1 + b 1 ) – c 1 +c 2 = p·(q 1 + q 2 ) + 2·(r 1 +r 2 ) + (b 1 +b 2 ) lsb= b 1 XOR b 2 – c 2 = q 2 ·p + (2·r 2 + b 2 )

ANDing two encrypted bits: 0p2p3p-3p-2p-p the “noise” = 2·r+b – c 1 = q 1 ·p + (2·r 1 + b 1 ) – c 2 = q 2 ·p + (2·r 2 + b 2 ) – c 1 c 2 = p·(c 2 ·q 1 +c 1 ·q 2 -q 1 ·q 2 ) + 2·(r 1 r 2 +r 1 b 2 +r 2 b 1 ) + b 1 b 2

ANDing two encrypted bits: 0p2p3p-3p-2p-p the “noise” = 2·r+b – c 1 = q 1 ·p + (2·r 1 + b 1 ) lsb= b 1 AND b 2 – c 2 = q 2 ·p + (2·r 2 + b 2 ) – c 1 c 2 = p·(c 2 ·q 1 +c 1 ·q 2 -q 1 ·q 2 ) + 2·(r 1 r 2 +r 1 b 2 +r 2 b 1 ) + b 1 b 2

0p2p3p-3p-2p-p the “noise” = 2·r+b the noise grows!

0p2p3p-3p-2p-p the “noise” = 2·r+b the noise grows! – c 1 +c 2 = p·(q 1 + q 2 ) + 2·(r 1 +r 2 ) + (b 1 +b 2 ) noise= 2 * (initial noise)

0p2p3p-3p-2p-p the “noise” = 2·r+b the noise grows! – c 1 +c 2 = p·(q 1 + q 2 ) + 2·(r 1 +r 2 ) + (b 1 +b 2 ) noise= 2 * (initial noise) noise = (initial noise) 2 – c 1 c 2 = p·(c 2 ·q 1 +c 1 ·q 2 -q 1 ·q 2 ) + 2·(r 1 r 2 +r 1 b 2 +r 2 b 1 ) + b 1 b 2

0173451-51-34-17 noise=-14 the noise grows! … so what’s the problem? 20

0173451-51-34-17 noise=-14 the noise grows! … so what’s the problem? 20 decryption will recover noise’=3

0173451-51-34-17 noise=-14 the noise grows! … so what’s the problem? 20 If the |noise| > p/2, then … decryption will output an incorrect bit decryption will recover noise’=3

So, what….? … we can do lots of additions and … some multiplications (= a “somewhat homomorphic” encryption)

So, what….? … we can do lots of additions and … some multiplications … enough to do many useful tasks, e.g., database search, spam filtering etc. (= a “somewhat homomorphic” encryption)

A Recent Breakthrough Genty09: A bootstrapping technique Somewhat homomorphic → Fully homomorphic Gentry also described a candidate “bootstrappable” scheme – Based on ideal lattices Scheme E can evaluate its own decryption circuit Scheme E* can evaluate any circuit

Getting From SWHE to FHE Bootstrapping – A term invented by Gentry to describe an encryption scheme that can evaluate its own (slightly augmented) decryption circuit.

RSA&friends MANY mult ZERO add Fully homomorphic MANY add MANY mult WE ARE HERE!

Fully homomorphic MANY add MANY mult WE ARE HERE! [bootstrapping] … but how? The “bootstrapping method” … If you can go a (large) part of the way, then you can go all the way. RSA&friends MANY mult ZERO add

noise=0 noise=p/2 Let’s think… … What is the best noise-reduction procedure? … something that kills all noise … and recovers the message Decryption! Ctxt = Enc(b)Secret key Decrypt b

noise=0 noise=p/2 Let’s think… … What is the best noise-reduction procedure? … something that kills all noise … and recovers the message Decryption! Secret key Decrypt b Fn. that acts on ciphertext and eliminates noise Ctxt = Enc(b)

noise=0 noise=p/2 Let’s think… … What is the best noise-reduction procedure? … something that kills all noise … and recovers the message Decryption! Secret key Decrypt b Ctxt = Enc(b) But I can’t give the secret key out for free!

noise=0 noise=p/2 Let’s think… Secret key Decrypt b But I can’t give the secret key out for free! Ctxt = Enc(b) … I want to reduce noise without letting you decrypt

noise=0 noise=p/2 KEY IDEA: … I cannot release the secret key (lest everyone sees my data) … but I can release Enc(secret key) Secret key Decrypt b Ctxt = Enc(b)

noise=0 noise=p/2 KEY IDEA: … I cannot release the secret key (lest everyone sees my data) … but I can release Enc(secret key) … called “Circular Encryption” Secret key Decrypt b Ctxt = Enc(b)

noise=0 noise=p/2 KEY IDEA: … I cannot release the secret key (lest everyone sees my data) … but I can release Enc(secret key) … called “Circular Encryption” Decrypt b Ctxt = Enc(b)Enc(Secret key)

noise=0 noise=p/2 KEY IDEA: … I cannot release the secret key (lest everyone sees my data) … but I can release Enc(secret key) Enc(Secret key) Decrypt b … Homomorphically evaluate the decryption ckt!!! Ctxt = Enc(b) … Now, to reduce noise …

noise=0 noise=p/2 KEY IDEA: … I cannot release the secret key (lest everyone sees my data) … but I can release Enc(secret key) Enc(Secret key) Decrypt … Homomorphically evaluate the decryption ckt!!! Ctxt = Enc(b) … Now, to reduce noise … Enc(b)

noise=0 noise=p/2 KEY IDEA: … I cannot release the secret key (lest everyone sees my data) … but I can release Enc(secret key) Enc(Secret key) Decrypt … the input Enc(b) and output Enc(b) have different noise levels … Ctxt = Enc(b) KEY OBSERVATION: Enc(b)

noise=0 noise=p/2 KEY IDEA: … I cannot release the secret key (lest everyone sees my data) … but I can release Enc(secret key) Enc(Secret key) Decrypt Regardless of the noise in the input Enc(b)… Ctxt = Enc(b) KEY OBSERVATION: Enc(b) the noise level in the output Enc(b) is FIXED

Bottomline: whenever noise level increases beyond a limit … noise=0 noise=p/2 … use bootstrapping to reset it to a fixed level

noise=0 noise=p/2 Bootstrapping requires homomorphically evaluating the decryption circuit …

Lots of new Encryption Schemes … simpler, more secure, more efficient e.g., [Brakerski, Vaikuntanathan 2012] Dramatic Efficiency Improvements

Slide and Paper Credits Slides – Craig Gentry, Winter School on Lattice-Based Cryptography and Applications Bar-Ilan University, Israel 19/2/2012-22/2/2012 – Vinod Vaikuntanathan, University of Toronto Papers – Easy FHE, Craig Gentry https://crypto.stanford.edu/craig/easy-fhe.pdf https://crypto.stanford.edu/craig/easy-fhe.pdf – FHE over Integers http://eprint.iacr.org/2009/616.pdf http://eprint.iacr.org/2009/616.pdf

Fully Homomorphic Encryption (FHE) By: Matthew Eilertson.

Similar presentations

Presentation on theme: "Fully Homomorphic Encryption (FHE) By: Matthew Eilertson."— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

Fully Homomorphic Encryption (FHE) By: Matthew Eilertson.

Similar presentations

Presentation on theme: "Fully Homomorphic Encryption (FHE) By: Matthew Eilertson."— Presentation transcript:

Similar presentations

About project

Feedback