The GINX method in TFHE enables low-latency ciphertext bootstrapping with relatively small bootstrapping keys but is limited to binary or ternary key distributions. In contrast, the AP method supports arbitrary key distributions, albeit at the cost of significantly larger bootstrapping keys. Building on AP, automorphism-based methods, introduced in LMK+ (EUROCRYPT 2023), achieve smaller key sizes. However, each automorphism application necessitates a key switch, introducing additional computational overhead and noise accumulation. This paper advances automorphism-based methods in two important ways. First, it proposes a novel traversal blind rotation algorithm that optimizes the number of key switches for a given key material. Second, it introduces a new external product that is automorphism-parametrized and seamlessly applies an automorphism to one of the input ciphertexts. Together, these techniques substantially reduce the number of key switches, resulting in faster bootstrapping and improved noise control. As an independent contribution, we introduce a comprehensive theoretical framework for analyzing the expected number of automorphism key switches. The predictions of this framework perfectly align with the results of extensive numerical experiments, demonstrating its practical relevance. In typical settings, by leveraging additional key material, the LLW+ approach (TCHES 2024) reduces the number of key switches by 17% compared to LMK+. Our combined techniques achieve a 46% reduction using similar key material and can eliminate an arbitrary large number (e.g., more than 99% ) of key switches with only a moderate ( 9× ) increase in key material size. As a result, the total bootstrapping runtime is decreased by more than 34% .

Certain applications of fully homomorphic encryption (such as transciphering, universal thresholdizers, and PIR) require randomness while operating over encrypted data. This randomness has to be obliviously generated in the encrypted domain and remain encrypted throughout the computation. Moreover, it should be guaranteed that independent-looking random coins can be obliviously generated for different computations. In this work, we consider the homomorphic evaluation of pseudorandom functions (PRFs) with a focus on practical lattice-based candidates. In the homomorphic PRF evaluation setting, given a fully homomorphic encryption of the PRF secret key.., it should be possible to homomorphically compute encryptions of PRF evaluations {PRFs(x(i))}(i=1)(M) for public inputs {(x(i))}(i=1)(M). We consider this problem for PRF families based on the hardness of the LearningWith-Rounding (LWR) problem introduced by Banerjee, Peikert, and Rosen (EUROCRYPT 2012). We build on a random oracle variant of a PRF construction suggested by Banerjee et al. and demonstrate that it can be evaluated using only two sequential programmable bootstraps in the TFHE homomorphic encryption scheme. We also describe several modifications of this PRF-which we prove as secure as the original function-that support homomorphic evaluations using only one programmable bootstrap per slot. Numerical experiments were conducted using practically relevant FHE parameter sets from the TFHE-rs library. Our benchmarks show that a throughput of about 1000 encrypted pseudorandom bits per second (resp. 900 encrypted pseudorandom bits per second) can be achieved on an AWS hpc7a.96xlarge machine (resp. on a standard laptop with an Apple M2 chip), on a single thread. The PRF evaluation keys in our experiments have sizes roughly 40% and 60% of a bootstrapping key.

There are two security notions for FHE schemes: the traditional notion of IND-CPA and a more stringent notion of IND-CPAD. These notions are equivalent when FHE schemes are perfectly correct. However, for schemes with negligible failure probability, the FHE parameters required to achieve IND-CPAD security can be much larger than those needed to obtain IND-CPA security. This paper uses the notion of ciphertext drift in order to understand the practical difference between IND-CPA and IND-CPAD security in schemes such as FHEW, TFHE, and FINAL. This notion allows us to define a modulus switching operation (the main culprit for the difference in parameters) such that one does not require adapting IND-CPA cryptographic parameters to meet the IND-CPAD security level. Further, the extra cost incurred by the new techniques has no noticeable performance impact in practical applications. The paper also formally defines a stronger version for IND-CPAD security called sIND-CPAD, which is proved to be strictly separated from the IND-CPAD notion. Criterion for turning an IND-CPAD secure public-key encryption scheme into an sIND-CPAD one is also provided.

Managing noise growth is a central challenge in fully homomorphic encryption (FHE). Gadget decomposition mitigates this by representing elements as vectors whose inner product with a gadget vector approximately reconstructs the original value. Radix-based decompositions support approximation but CRT-based ones have, so far, required exactness. We introduce, for the first time, CRT-based gadget decompositions in the approximate setting, combining the benefits of approximate decompositions with the structural advantages of CRT-based methods. This enables efficient blind rotation and (programmable) bootstrapping in TFHE using only native arithmetic while increasing parallelism. On a typical FPGA (17-bit multipliers), our approach achieves a speedup of over 2× and approximately 50% lower area than comparable radix-based approximate designs. The methodology also reduces bandwidth, memory, and compute in settings with large ciphertext moduli (e.g., 128-bit), benefiting both hardware and software implementations.

Fully homomorphic encryption allows directly processing encrypted data without having to decrypt it. The result of the computation is encrypted, typically under the same key. This unique feature offers a strong form of privacy. A service provider can so provide the same service but without ever seeing the user’s data. Examples of application include [privacy-preserving] preventive medicine, facial recognition or voice assistants. Fully homomorphic encryption can also be used to solve the privacy issues of the blockchain. This paper introduces a public-key variant of fully homomorphic encryption scheme TFHE. The output ciphertexts are of LWE type and compatible with TFHE. Interestingly, the public key is much shorter and the resulting ciphertexts are less noisy. The security of the scheme holds under the standard RLWE assumption. Several variations and extensions are also described. The proposed scheme has been integrated in fhEVM, a protocol enabling developers to create encrypted on-chain smart contracts.

On-line/off-line encryption schemes enable the fast encryption of a message from a pre-computed coupon. The paradigm was put forward in the case of digital signatures. This work introduces a compact public-key additively homomorphic encryption scheme. The scheme is semantically secure under the decisional composite residuosity (DCR) assumption. Compared to Paillier cryptosystem, it merely requires one or two integer additions in the on-line phase and no increase in the ciphertext size. This work also introduces a compact on-line/off-line trapdoor commitment scheme featuring the same fast on-line phase. Finally, applications to chameleon signatures are presented.

The AFRICACRYPT 2023 proceedings focuses on Post-quantum cryptography Symmetric cryptography, Cryptanalysis, Lattice-based cryptography and much more.

Most solutions for fully homomorphic encryption rely on hard lattice problems. Accordingly, the resulting ciphertexts must contain a certain level of noise to guarantee the security of the encryption. Running homomorphic operations on these noisy ciphertexts in turn further increases the noise level in the resulting ciphertexts. If the noise exceeds a given threshold, the ciphertexts are no longer decryptable. Bootstrapping enables to deal with this issue by resetting the noise present in a ciphertext to a nominal level. Certain fully homomorphic encryption schemes require the use of binary keys for the bootstrapping operation. This paper describes how to extend the underlying blind rotation so as to efficiently support a wider number of key formats. It also investigates a multi-digit approach wherein multiple key digits are processed concurrently. All in all, the proposed solutions offer more flexibility in the parameter selection and yield a variety of new trade-offs for better performance.

All known instantiations for fully homomorphic encryption (FHE) produce noisy ciphertexts and rely on a technique called bootstrapping to reduce the noise so as to enable an arbitrary number of homomorphic operations. Bootstrapping is the main performance bottleneck and arguably the biggest obstacle to widespread adoption of FHE. Among the FHE schemes, TFHE and its variations present the appealing property of having a bootstrapping procedure---as well as its extension to programmable bootstrapping---that is relatively light-weight. The essential operations consist of a series of multiplications in (Z/qZ)[X]/(X^N+1). While the NTT is seemingly the natural candidate for evaluating these multiplications in a fast and exact way, it restricts the possible choices for and . To the authors' knowledge, all current implementations of TFHE with a power of two actually employ the FFT over the complex numbers instead. This introduces real numbers to the otherwise purely discrete algorithms, including all the drawbacks of the need to approximate them using finite precision. This work studies the avenues available to apply the NTT in the context of TFHE-like schemes. In particular, it considers various combinations of coefficient rings and quotient polynomials that are compatible with the requirements of the underlying scheme. Importantly, this work provides methods for adapting the (programmable) bootstrapping to quotient polynomials beyond power-of-two cyclotomics. As a side effect, it also demonstrates how this may enhance the programmability of the bootstrapping.

NTRU- ν -um is a fully homomorphic encryption schemes making use of NTRU as a building block. NTRU- ν -um comes originally in two versions: a first instantiation working with polynomials modulo X N − 1 with N a prime [cyclic version] and a second instantiation working with polynomials modulo X N + 1 with N a power of two [negacyclic version]. The cyclic version is now deprecated. This work shows that the cyclic version of NTRU- ν -um is not secure. Specifically, it does not provide indistinguishability of encryptions. More critically, the scheme leaks the underlying private LWE keys. Source code for mounting the attacks is provided. The attacks were practically validated on the given parameter sets.

First posed as a challenge in 1978 by Rivest et al., fully homomorphic encryption—the ability to evaluate any function over encrypted data—was only solved in 2009 in a breakthrough result by Gentry (Commun. ACM, 2010). After a decade of intense research, practical solutions have emerged and are being pushed for standardization. This paper explains the inner-workings of TFHE, a torus-based fully homomorphic encryption scheme. More exactly, it describes its implementation on a discretized version of the torus. It also explains in detail the technique of the programmable bootstrapping. Numerous examples are provided to illustrate the various concepts and definitions.

In many cases, machine learning and privacy are perceived to be at odds. Privacy concerns are especially relevant when the involved data are sensitive. This paper deals with the privacy-preserving inference of deep neural networks. We report on first experiments with a new library implementing a variant of the TFHE fully homomorphic encryption scheme. The underlying key technology is the programmable bootstrapping. It enables the homomorphic evaluation of any function of a ciphertext, with a controlled level of noise. Our results indicate for the first time that deep neural networks are now within the reach of fully homomorphic encryption. Importantly, in contrast to prior works, our framework does not necessitate re-training the model.

First posed as a challenge in 1978 by Rivest et al. [RAD78], fully homomorphic encryption—the ability to evaluate any function over encrypted data— was only solved in 2009 in a breakthrough result by Gentry [Gen09, Gen10]. After a decade of intense research, practical solutions have emerged and are being pushed for standardization. This guide is intended to practitioners. It explains the inner-workings of TFHE [CGGI20], a torus-based fully homomorphic encryption scheme. More exactly, it describes its implementation on a discretized version of the torus. It also explains in detail the technique of the programmable bootstrapping.

Fully homomorphic encryption (FHE) extends traditional encryption schemes. It allows one to directly compute on encrypted data without requiring access to the decryption key. This paper introduces CONCRETE, an open-source library developed in Rust that builds on the state-of-art TFHE cryptosystem. It provides a userfriendly interface making FHE easy to integrate. The library deals with inputs of arbitrary format and comes with an extensive set of operations to play with ciphertexts, including a programmable bootstrapping. CONCRETE is available on GitHub at URL https:// github.com/zama-ai/concrete and on https://crates.io.