Transciphering Framework for Approximate Homomorphic Encryption.

Homomorphic encryption (HE) is a promising cryptographic primitive that enables computation over encrypted data, with a variety of applications including medical, genomic, and financial tasks. In Asiacrypt 2017, Cheon et al. proposed the 𝖢𝖪𝖪𝖲 scheme to efficiently support approximate computation over encrypted data of real numbers. HE schemes including 𝖢𝖪𝖪𝖲 , nevertheless, still suffer from slow encryption speed and large ciphertext expansion compared to symmetric cryptography. In this paper, we propose a novel hybrid framework, dubbed 𝖱𝗍𝖥 (Real-to-Finite-field) framework, that supports 𝖢𝖪𝖪𝖲 . The main idea behind this construction is to combine the 𝖢𝖪𝖪𝖲 and the 𝖥𝖵 homomorphic encryption schemes, and use a stream cipher using modular arithmetic in between. As a result, real numbers can be encrypted without significant ciphertext expansion or computational overload on the client side. As an instantiation of the stream cipher in our framework, we propose a new HE-friendly cipher, dubbed 𝖧𝖤𝖱𝖠 , and extensively analyze its security and efficiency. The main feature of 𝖧𝖤𝖱𝖠 is that it uses a simple randomized key schedule. Compared to recent HE-friendly ciphers such as 𝖥𝖫𝖨𝖯 and 𝖱𝖺𝗌𝗍𝖺 using randomized linear layers, 𝖧𝖤𝖱𝖠 requires a smaller number of random bits. For this reason, 𝖧𝖤𝖱𝖠 significantly outperforms existing HE-friendly ciphers on both the client and the server sides. With the 𝖱𝗍𝖥 transciphering framework combined with 𝖧𝖤𝖱𝖠 at the 128-bit security level, we achieve small ciphertext expansion ratio with a range of 1.23 to 1.54, which is at least 23 times smaller than using (symmetric) 𝖢𝖪𝖪𝖲 -only, assuming the same precision bits and the same level of ciphertexts at the end of the framework. We also achieve 1.6 s and 21.7 MB/s for latency and throughput on the client side, which are 9085 times and 17.8 times faster than the 𝖢𝖪𝖪𝖲 -only environment, respectively.