Multi-key FHE Research Articles

FINALLY: A Multi-Key FHE Scheme Based on NTRU and LWE

Multi-key fully homomorphic encryption (MKFHE), a generalization of fully homomorphic encryption (FHE), enables a computation over encrypted data under multiple keys. The first MKFHE schemes were based on the NTRU primitive, however these early NTRU based FHE schemes were found to be insecure due to the problem of over-stretched parameters. Recently, in the case of standard (non-multi key) FHE a secure version, called FINAL, of NTRU has been found. In this work we extend FINAL to an MKFHE scheme, this allows us to benefit from some of the performance advantages provided by NTRU based primitives. Thus, our scheme provides competitive performance against current state-of-the-art multi-key TFHE, in particular reducing the computational complexity from quadratic to linear in the number of keys.

Scooby: Improved multi-party homomorphic secret sharing based on FHE

In this paper we present new constructions of multi-party homomorphic secret sharing (HSS) based on a new primitive that we call homomorphic encryption with decryption to shares (HEDS). Our first scheme, which we call Scooby, is based on many popular fully homomorphic encryption (FHE) schemes with a linear decryption property. Scooby achieves an n-party HSS for general circuits with complexity O(|F|+log⁡n), as opposed to O(n2⋅|F|) for the prior best construction based on multi-key FHE. Scooby relies on a trusted setup procedure, and can be based on (ring)-LWE with a super-polynomial modulus-to-noise ratio. In our second construction, Scrappy, assuming any generic FHE plus HSS for NC1-circuits, we obtain a HEDS scheme which does not require a super-polynomial modulus. While these schemes all require FHE, in another instantiation, Shaggy, we show how it is also possible to obtain multi-party HSS without FHE, instead relying on the DCR assumption to obtain 4-party HSS for constant-degree polynomials.

Round efficient privacy-preserving federated learning based on MKFHE

Federated learning (FL) was created with the intention of enabling collaborative training of models without the need for direct data exchange. However, data leakage remains an issue in FL. Multi-Key Fully Homomorphic Encryption (MKFHE) is a promising technique that allows computations on ciphertexts encrypted by different parties. MKFHE’s aptitude to handle multi-party data makes it an ideal tool for implementing privacy-preserving federated learning.We present a multi-hop MKFHE with compact ciphertext. MKFHE allows computations on data encrypted by different parties. In MKFHE, the compact ciphertext means that the size of the ciphertext is independent of the number of parties. The multi-hop property means that parties can dynamically join the homomorphic computation at any time. Prior MKFHE schemes were limited by their inability to combine these desirable properties. To address this limitation, we propose a multi-hop MKFHE scheme with compact ciphertext based on the random sample common reference string(CRS). We construct our scheme based on the residue number system (RNS) variant CKKS17 scheme, which enables efficient homomorphic computation over complex numbers due to the RNS representations of numbers.We construct a round efficient privacy-preserving federated learning based on our multi-hop MKFHE. In FL, there is always the possibility that some clients may drop out during the computation. Previous HE-based FL methods did not address this issue. However, our approach takes advantage of multi-hop MKFHE that users can join dynamically and constructs an efficient federated learning scheme that reduces interactions between parties. Compared to other HE-based methods, our approach reduces the number of interactions during a round from 3 to 2. Furthermore, in situations where some users fail, we are able to reduce the number of interactions from 3 to just 1.

Multi-key fully homomorphic encryption from NTRU and (R)LWE with faster bootstrapping

Multi-Key Fully Homomorphic Encryption (MKFHE) supports homomorphic evaluation on ciphertexts encrypted under different keys, guaranteeing data privacy in the case of multiple mutually untrusted parties. In ASIACRYPT 2019, Chen et al. designed an LWE-based MKFHE scheme, which evaluates a boolean gate on ciphertexts followed by a bootstrapping procedure in the dynamic multi-key setting. In this paper, we propose a new MKFHE scheme from NTRU and (R)LWE, achieving better bootstrapping performance. To that end, we adapt Chen et al.'s bootstrapping algorithm to the NTRU setting and construct an efficient conversion from multi-key NTRU to multi-key RLWE ciphertexts. With appropriate parameter choice, our scheme avoids the sublattice attacks that broke previous NTRU-based MKFHE schemes. Finally, we implement a proof-of-concept of our construction and conduct experiments to test its performance. Our experiments indicate that gate bootstrapping in our scheme for 2 parties takes 0.18 seconds, which is faster than with Chen et al. by around 5.3 times, but unfortunately does not scale beyond that. It is however practical for uses such as oblivious neural network inference.

Multi-key Fully Homomorphic Encryption without CRS from RLWE

Fully Homomorphic Encryption (FHE) is a powerful encryption system in cloud computing that allows homomorphic computations on encrypted data without decrypting them. Multi-key fully homomorphic encryption (MFHE), as an extension to FHE, allows homomorphic computations on ciphertexts encrypted under different keys. However, most MFHE schemes require a Common Random/Reference String (CRS), while the few that do not are based on the Learning With Errors (LWE) problem, which means that they can only deal with single bit plaintext. Consequently, MFHE schemes based on the Ring Learning With Errors (RLWE) problem are more desirable, as they can handle polynomial plaintext. Requiring the CRS seems to weaken the semantic definition of MFHE, where all users generate their own keys independently. In this paper, we study the RLWE-based MFHE in the CRS model and propose the first RLWE-based MFHE without a CRS. To this end, we remove the CRS by designing a relinearization algorithm without a CRS. Like previous MFHE schemes, our RLWE-based MFHE without CRS has a simple 1-round threshold decryption, which implies a 3-round secure MPC protocol in the plain model from the RLWE assumption.

Maliciously circuit-private multi-key FHE and MPC based on LWE

In this paper, we construct multi-key homomorphic and fully homomorphic encryption (resp. MKHE and MKFHE) schemes with malicious circuit privacy. Our schemes are based on learning with errors (LWE) besides appropriate circular security assumptions. In contrast, the previous maliciously circuit-private MKFHE scheme by Chongchitmate and Ostrovsky (PKC, 2017) is based on the non-standard decisional small polynomial ratio (DSPR) assumption with a super-polynomial modulus, besides ring learning with errors and circular security assumptions. We note that it was shown by Albrecht et al. (CRYPTO, 2016) that there exists a sub-exponential time attack against this type of DSPR assumption. The main building block of our maliciously circuit-private MKFHE scheme is a (plain) MKFHE scheme by Brakerski et al. (TCC, 2017), and the security of our schemes is proven under the hardness of LWE with sub-exponential modulus-to-noise ratio and circular security assumptions related to the Brakerski et al. scheme. Furthermore, based on our MKFHE schemes, we construct four-round multi-party computation (MPC) protocols with circuit privacy against a semi-honest server and malicious clients in the plain model. The protocols are obtained by combining our schemes with a maliciously sender-private oblivious transfer protocol and a circuit garbling scheme, all of which can be instantiated only assuming LWE.

An Examination of Multi-Key Fully Homomorphic Encryption and Its Applications

With the rapid development of the Internet of Things (IoT) technology, the security problems it faces are increasingly prominent and have attracted much attention in industry and the academy. Traditional IoT architecture comes with security risks. Illegal intrusion of attackers into the network layer disrupts the availability of data. The untrusted transmission environment increases the difficulty of users sharing private data, and various outsourced computing and application requirements bring the risk of privacy leakage. Multi-key fully homomorphic encryption (MKFHE) realizes operations between ciphertexts under different key encryption and has great application potential. Since 2012, the first MKFHE scheme LTV12 has been extended from fully homomorphic encryption (FHE) and has ignited the enthusiasm of many cryptographic researchers due to its lattice-based security and quantum-resistant properties. According to its corresponding FHE scheme, the MKFHE schemes can be divided into four kinds: Gentry–Sahai–Water (GSW), number theory research unit (NTRU), Brakerski–Gentry–Vaikuntanathan (BGV), and FHE over the tour (TFHE). Efficiency and cost are urgent issues for MKFHE. New schemes are mainly improved versions of existing schemes. The improvements are mostly related to the four parts of MKFHE: security assumption, key generation, plaintext encryption, and ciphertext processing. We classified MKFHE schemes according to the improved partial schemes, and we present some improved techniques and the applications of MKFHE.

A multikey fully homomorphic encryption privacy protection protocol based on blockchain for edge computing system

SummaryIn order to protect private data in edge computing system and ensure that ciphertexts encrypted under different keys can be processed in the cloud, we propose a privacy protection protocol for edge computing, which is based on blockchain technology and multikey fully homomorphic encryption (MFHE). By constructing a Merkle hash tree and saving the Merkle root node to the blockchain, the integrity of the data in edge nodes is protected. For the data with high computational complexity in edge nodes, the GSW fully homomorphic encryption scheme is employed to process the encrypted private data of a single edge node by the CMS. The LinkAlgo algorithm is applied to link different keys by the relation between them, which enables the CMS to process the encrypted private data of multiple edge nodes. The security analysis and performance evaluation of the proposed privacy protection protocol show that our protocol has high security and good efficiency.

Fully homomorphic encryption: A case study

Fully Homomorphic Encryption (FHE) is the holy grail of encrypted communications. It opens the door to several advanced functionalities to overcome the security and trust issues of the IT world. After 2009, once Craig Gentry had shown that FHE could be achieved, a study in this field boomed, and significant improvement was made in identifying more efficient and realistic programs. FHE is primitive cryptography that enables arbitrary functions to be calculated via encrypted data. These systems are applicable in different ways since they permit users to encrypt their private information securely while still outsourcing the processing of protected data without fearing disclosing the real data. In 2012, LTV12 presented the first multi-key FHE system and demonstrated the possibility of using multi-key systems in somewhat homomorphic encryption (SHE). Like in the one key context, there have been many advances in the field, but no effort has been made to develop the multi-key methods. This paper presents a discussion of FHE and MKFHE with a specific focus on the current techniques and three implementations, comprising the first in the multi-key setups, to the extent of our understanding.

A Blockchain-Based Secure Multi-Party Computation Scheme with Multi-Key Fully Homomorphic Proxy Re-Encryption

At present, secure multi-party computing is an effective solution for organizations and institutions that want to derive greater value and benefit from the collaborative computing of their data. Most current secure multi-party computing solutions use encryption schemes that are not resistant to quantum attacks, which is a security risk in today’s quickly growing quantum computing, and, when obtaining results, the result querier needs to collect the private keys of multiple data owners to jointly decrypt them, or there needs to be an interaction between the data owner and the querier during the decryption process. Based on the NTRU cryptosystem, which is resistant to quantum computing attacks and has a simple and easy-to-implement structure, and combined with multi-key fully homomorphic encryption (MKFHE) and proxy re-encryption, this paper proposes a secure multi-party computing scheme based on NTRU-type multi-key fully homomorphic proxy re-encryption in the blockchain environment, using the blockchain as trusted storage and a trusted execution environment to provide data security for multi-party computing. The scheme meets the requirements of being verifiable, conspiracy-proof, individually decryptable by the querier, and resistant to quantum attacks.

Secure and efficient multi-key FHE scheme supporting multi-bit messages from LWE preserving non-interactive decryption

Secure and efficient multi-key FHE scheme supporting multi-bit messages from LWE preserving non-interactive decryption

A secure multi-party computation protocol without CRS supporting multi-bit encryption.

To solve the problems in the existing fully homomorphic encryption (FHE)-based secure multi-party computation (SMC) protocols such as low efficiency, the FHE scheme that supports multi-bit encryption was modified during the generation of the public key so that the users could generate their public keys independently without the common random string (CRS) matrix. Further, a multi-bit Gentry-Sahai-Waters scheme (MGSW) scheme without CRS was constructed. The modified LinkAlgo algorithm was adopted to expand the single-key ciphertext into the multi-key ciphertext and simplify the way of generating the expanded ciphertext. In this way, a multi-key FHE (MFHE) scheme was achieved based on the MGSW scheme. Finally, a three-round SMC protocol without CRS was constructed using the MFHE scheme and the decisional learning with errors (DLWE) assumption, which was secure in the semi-malicious model. Compared to the existing protocols, the protocol proposed herein can support multi-bit encryption and is found with smaller ciphertext size and lower storage overhead and generate the expanded ciphertext in a simpler way. Overall performance is better than existing protocols.

Multi-key Fully Homomorphic Encryption from Additive Homomorphism

Abstract Fully homomorphic encryption (FHE) allows direct computations over the encrypted data without access to the decryption. Hence multi-key FHE is well suitable for secure multiparty computation. Recently, Brakerski et al. (TCC 2019 and EUROCRYPT 2020) utilized additively homomorphic encryption to construct FHE schemes with different properties. Motivated by their work, we are attempting to construct multi-key FHE schemes via additively homomorphic encryption. In this paper, we propose a general framework of constructing multi-key FHE, combining the additively homomorphic encryption with specific multiparty computation protocols constructed from encryption switching protocol. Concretely, every involved party encrypts his plaintexts with an additively homomorphic encryption under his own public key. Then the ciphertexts are evaluated by suitable multiparty computation protocols performed by two cooperative servers without collusion. Furthermore, an instantiation with an ElGamal variant scheme is presented. Performance comparisons show that our multi-key FHE from additively homomorphic encryption is more efficient and practical.

Multi-key FHE without ciphertext-expansion in two-server model

Multi-key FHE without ciphertext-expansion in two-server model

Efficient multi‐key fully homomorphic encryption over prime cyclotomic rings with fewer relinearisations

Multi-key fully homomorphic encryption (MKFHE) allows computations on ciphertexts encrypted by different users, which can be applied to implement secure multi-party computing (MPC). The current NTRU-based MKFHE has the following two drawbacks: One is that the relinearisation process during homomorphic evaluation is so complicated that the corresponding computation time is costly. The other is that a class of subfield attacks are proposed and affects the security of NTRU schemes over power-of-2 cyclotomic rings for large moduli q, especially for the NTRU-based fully homomorphic encryption (FHE) schemes. In this work, an efficient MKFHE scheme is proposed over prime cyclotomic rings with fewer relinearisations, which seems a good choice because of its potential to resist a subfield attack. More specifically, the time of the relinearisation process is reduced by half in homomorphic evaluations by separating the homomorphic multiplication and the relinearisation process (implementing two homomorphic multiplication operations together before relinearisation), while in current NTRU-type MKFHE schemes, these two processes are usually performed together. The error bound of the basic function components is re-analysed over prime cyclotomic rings in the average case, which can be used in the error analysis of our scheme. We construct an efficient NTRU-based single-key FHE scheme and an efficient MKFHE scheme over prime cyclotomic rings through relinearisation and modulus-switching techniques. The MKFHE scheme proposed has the on-the-fly property and has a tight ciphertext size compared with the GSW-type and BGV-type MKFHE schemes. An experiment shows that the homomorphic evaluation of the optimised single-key FHE scheme proposed is 1.9 times faster than an efficient NTRU-type MKFHE DHS16 proposed at DCC 2016.

Compressible Multikey and Multi-Identity Fully Homomorphic Encryption

With the development of new computing models such as cloud computing, user’s data are at the risk of being leaked. Fully homomorphic encryption (FHE) provides a possible way to fundamentally solve the problem. It enables a third party who does not know anything about the secret key and plaintexts to homomorphically perform any computable functions on the corresponding ciphertexts. In 2009, Gentry proposed the first FHE scheme. After that, its inefficiency has always been a bottleneck of the development of practical schemes and applications. At TCC 2019, Gentry and Halevi proposed the first compressible FHE scheme that enables the ratio of plaintext size to the ciphertext size (i.e., the compression rate) to reach1−εfor any smallε>0under the standard learning with errors (LWE) assumption. However, it is only a single-key one, where the homomorphic evaluation can only be performed over ciphertexts encrypted under the same key. Compared with single-key FHE, multikey FHE is more practical. Multikey FHE enables ciphertexts encrypted under different public keys to be homomorphically computed without having to decrypt these ciphertexts using their own private keys. In addition, in a multi-identity FHE scheme, only identity information and public parameters are required when encrypting, which simplifies certificate-based key management in public key infrastructure. In this paper, a new compressible ciphertext expansion technique is proposed. Then, we use this technique to construct a compressible multikey FHE scheme and a compressible multi-identity FHE scheme to overcome the bottleneck of bandwidth inefficiency in the multikey and multi-identity settings. The two schemes proposed in this paper make it possible that the objects of homomorphic operation can be the ciphertexts encrypted under different keys or different identities before compression, thus solving the single-key defect of the work of Gentry and Halevi.

Dynamic multi-key FHE in symmetric key setting from LWE without using common reference matrix

We propose a dynamic (leveled) multi-key Fully Homomorphic Encryption (FHE) scheme under the learning with errors (LWE) assumption. Multi-key FHE in a dynamic setting is the most versatile variant of FHE which requires no information about the participating parties prior to key generation. In addition, it also introduces inputs from new parties into the computation. Designing dynamic multi-key FHE without blowing up the storage and ciphertext size of homomorphic computation is a challenging task. Unlike the existing LWE based multi-key FHE, our design does not use any common reference matrix in common parameter which seems to strengthen the power of using MFHE to allow users to generate their own keys independently. The ciphertext length and public key size of our construction are comparable to the existing similar works. We use only one component in the public extension key, resulting efficient extension of the ciphertexts under additional secret keys. The ciphertext in our design is generated using the FHE scheme of Gentry, Sahai, and Waters with no additional components, allowing efficient homomorphic evaluation. Our scheme is proven to be secure under standard LWE assumption without using circular security. More interestingly, our multi-key FHE is dynamic while maintaining ciphertext compactness.

Dynamic Multi-Key FHE in Asymmetric Key Setting From LWE

Multi-key Fully homomorphic encryption (MFHE) schemes allow computation on the encrypted data under different keys. However, traditional multi-key FHE schemes based on Learning with errors (LWE) have the undesirable property that is the number of keys has to be fixed in advance. A dynamic multi-key FHE scheme is the most versatile variant which the information about the participants is not required before key generation. To support further homomorphic computation on extended ciphertexts and ciphertexts encrypted under additional keys, Peikert and Shiehian (TCC ’16) proposed a leveled dynamic multi-key FHE scheme. Nevertheless, it introduces the circular-security assumption for the LWE parameters to ensure its security, which provides weaker security to the scheme. The problem of how to construct a LWE-based dynamic multi-key FHE scheme is still open. To address the above problem, in this work, we present a dynamic multi-key FHE scheme based on the LWE assumption in public key setting. The ciphertext can be extended and performed homomorphic evaluation with the ciphertexts encrypted under additional keys. Compared with current constructions, our proposed method requires fewer “local” memory and the process of ciphertext extension is distributed. Our proposed method provides a new way to extend the ciphertext such that the ciphertext homomorphism computation is more efficient. Our scheme is proven to be secure under standard LWE assumptions without using the circular-security assumption.

Fully Dynamic Multi-Key FHE Without Gaussian Noise

Fully dynamic multi-key fully homomorphic encryption (FHE) that allows an unlimited number of homomorphic operations for unconstrained parties. That is to say, it supports performing as many computational procedures on inputs (which are encrypted by an unrestricted number of parties) as needed. The existed fully dynamic multi-key FHE scheme is based on the learning with errors (LWE) problem. However, the LWE problem suffers from the intricate and laborious Gaussian sampling which extremely weakens the schemes’ efficiencies. What’s more, it has been lately revealed that Gaussian sampling creates lots of possible side-channel vulnerabilities that result in the disclosure of secret keys. The paper proposed a fully dynamic multi-key FHE that based on the learning with rounding (LWR) problem which leaves out the time-consuming Gaussian sampling required in the LWE problem while sustaining almost the same security level.

Modified multi-key fully homomorphic encryption based on NTRU cryptosystem without key-switching

The Multi-Key Fully Homomorphic Encryption (MKFHE) based on the NTRU cryptosystem is an important alternative to the post-quantum cryptography due to its simple scheme form, high efficiency, and fewer ciphertexts and keys. In 2012, Lopez-Alt et al. proposed the first NTRU-type MKFHE scheme, the LTV12 scheme, using the key-switching and modulus-reduction techniques, whose security relies on two assumptions: the Ring Learning With Error (RLWE) assumption and the Decisional Small Polynomial Ratio (DSPR) assumption. However, the LTV12 and subsequent NTRU-type schemes are restricted to the family of power-of-2 cyclotomic rings, which may affect the security in the case of subfield attacks. Moreover, the key-switching technique of the LTV12 scheme requires a circular application of evaluation keys, which causes rapid growth of the error and thus affects the circuit depth. In this paper, an NTRU-type MKFHE scheme over prime cyclotomic rings without key-switching is proposed, which has the potential to resist the subfield attack and decrease the error exponentially during the homomorphic evaluating process. First, based on the RLWE and DSPR assumptions over the prime cyclotomic rings, a detailed analysis of the factors affecting the error during the homomorphic evaluations in the LTV12 scheme is provided. Next, a Low Bit Discarded & Dimension Expansion of Ciphertexts (LBD&DEC) technique is proposed, and the inherent homomorphic multiplication decryption structure of the NTRU is proposed, which can eliminate the key-switching operation in the LTV12 scheme. Finally, a leveled NTRU-type MKFHE scheme is developed using the LBD&DEC and modulus-reduction techniques. The analysis shows that the proposed scheme compared to the LTV12 scheme can decrease the magnitude of the error exponentially and minimize the dimension of ciphertexts.