1. A Brief Story of Computing on Private Data Ten H Lai Ohio State University

2. Agenda Computing on private data Fully homomorphic encryption (FHE) Gentry’s bootstrapping theorem Our result

3. FHE: The Holy Grail of Cryptography

4. Cloud Computing ServersStoragesNetworksApplications

5. 天上有多少星星 城裡有多少姑娘 但人間只有一個妳 天上只有一顆月亮

6. Cloud Computing 6 Cloud server Internet Encrypt

7. Computing on private data 7 Cloud server Internet Encrypt

8. Computing on private data Cloud 8  A question proposed by Rivest, Aldeman, Dertouzos in 1978 (one year after RSA was invented).

9. C-Homomorphism

10. C-homomorphic

11. RSA is multiplicatively homomorphic

12. Fully Homomorphic Encryption (FHE)

15. 15

16. 16

17. 17

18. 18 Bootstrapping

19. 19 m m sk A Decrypt m encrypted under a pink key pk A Evaluate Decrypt m

20. m m sk A m m Decrypt Evaluate Decrypt 20 Encrypt under a blue key pk B Evaluate Decrypt

21. sk A NAND m 1 NAND m 2 NAND-augmented Decrypt circuit: 21 m1m1 m2m2

22. Decrypt sk A c 1 sk A c 2 NAND m 1 NAND m 2 Evaluate 22 fresh m1m1 m2m2

23. 23 m 1 NAND m 2 23 fresh m1m1 m2m2 sk A Under a pink key PK A Under a blue key PK B

24. 24 m1m1 m2m2 m 1 NAND m 2 Increased noise

25. 25

26. sk A m 1 m 2 m 1 NAND m 2 Evaluate Decrypt-NAND sk A m 3 m 4 m 3 NAND m 4 Evaluate Decrypt-NAND m 1 NAND m 2 m 3 NAND m 4 Evaluate Decrypt-NAND sk B (m 1 NAND m 2 ) NAND (m 3 NAND m 4 ) 26

27. sk A m 1 m 2 m 1 NAND m 2 Evaluate Decrypt-NAND sk A m 3 m 4 m 3 NAND m 4 Evaluate Decrypt-NAND m 1 NAND m 2 m 3 NAND m 4 Evaluate Decrypt-NAND sk B (m 1 NAND m 2 ) NAND (m 3 NAND m 4 ) 27

28. 28 Decrypt NAND

29. 29

30. 30 Encryption key Decryption key Evaluation key

31. 31 Decrypt

32. 32

33. 33 Encryption key Decryption key Evaluation key

34. 34

35. 35

36. … level d level 1 36

37. … Decrypt circuits level d level 1 37

38. Decrypt circuits … 38

39. 39

40. 40

41. 41 Encryption key Decryption key Evaluation key

42. 42

43. 43

44. 44 Decrypt NAND

45. 45

46. 46 Secret-key independent, Computationally intensive, Done with encryption Secret-key dependent Decryption algorithm

47. 47

48. 48 FHE is still in its infantry

49. Multi-Key/Multi-Scheme FHE

50. Single-key FHE 50

51. Is Multi-key FHE Possible? 51

52. Is Multi-scheme FHE Possible? 52

53. 53

54. 54

55. 55

56. 56

57. Evaluate circuit C Evaluate(C) Problem

58. Eval(C) If under pk 1 C

59. Eval(C) Eval( Eval(C) ) Under pk 2 C

60. Evaluate(C) ? C

61. ?

62. 62

63. Trivial encryptions

64. Eval(C) Eval( Eval(C) ) Summary of ideas C

65. 65 C

69. 69