Modern techniques in somewhat homomorphic encryption

1 Introduction

From a historical perspective, the term “homomorphism” was first introduced in cryptography by Rivest, Adleman, and Dertouzos in 1978 as a solution to the problem of performing calculations on encrypted data without necessarily decrypting it. Since then, an increasing number of researchers have sought to design such schemes to support as many operations as possible. These attempts can be essentially divided into three categories based on the type and the number of operations allowed on the encrypted data.

• Partially homomorphic encryption (PHE) schemes, which allow an unlimited number of operations of a single type (e.g., an unlimited number of additions or multiplications).

• Somewhat homomorphic encryption (SWHE) schemes, which allow various types of operations but only in a limited number.

• Fully homomorphic encryption (FHE) schemes, which allow an unlimited number of operations of any type.

In this context, and more generally in the field of homomorphic cryptography, Gentry’s work in 2009 marked a significant turning point. Gentry demonstrated how it is possible to construct an FHE scheme from an SWHE scheme using the bootstrapping technique, thereby giving a significant boost to the construction of new SWHE schemes. Prior to 2009, SWHE schemes in the literature were standalone algorithms, conceived as intermediate results leading toward the definition of an FHE scheme. However, since 2009, SWHE schemes have become an integral part of FHE schemes. Consequently, advancements in somewhat homomorphic cryptography after 2009 are often indistinguishable from those in fully homomorphic cryptography.

In this work, we first distinguish between SWHE schemes introduced before 2009, which we refer to as first-generation schemes, and schemes developed after Gentry’s work. Regarding first-generation schemes, we focus particularly on the BGN (Boneh, Goh, and Nissim) algorithm from 2005, considered a milestone in the development of somewhat homomorphic cryptography. Among the algorithms developed after 2009, considerable attention is given to schemes based on the well-known “learning with errors (LWEs)” problem (e.g., FV, Brakerski-Gentry-Vaikuntanathan (BGV), NTRU-like), which are currently considered among the most secure and promising. This research line also includes the Cheon-Kim-Kim-Song (CKKS) scheme, notable for its ability to operate on real and complex numbers (as opposed to integers, like previous examples), making it particularly suitable for applications such as machine learning.

Finally, a different approach to the SWHE problem is described, with a scheme based on integers and the Approximate-Greatest Common Divisor (AGCD) problem.

2 Classic SWHE schemes

In the literature on homomorphic encryption schemes, one of the earliest attempts at SWHE is represented by the Polly Cracker scheme [2]. This scheme allows both multiplication and addition operations on encrypted texts. However, the size of the encrypted text grows exponentially when performing such operations, making the scheme impractical from a practical standpoint. In particular, the multiplication operation turns out to be particularly costly. Subsequently, more efficient variants of this scheme have been proposed [3,4], but almost all of them have later been found to be vulnerable to attacks. Therefore, these early schemes are either insecure or impractical. Another attempt was made by Sander et al. [5] in 1999. This scheme also allows for evaluating both types of operation, but the size of the encrypted text increases multiplicatively with each multiplication. This limits the depth of circuits that can be homomorphically evaluated. Further improvements following the path taken by Sander, Young, and Yung were made by Ishai and Paskin in 2007 [6] and by Melchor et al. in 2008 [7], but without definitively overcoming the problem of the growth of the size of the encrypted text. The BGN algorithm (Boneh, Goh, Nissim) of 2005, on the other hand, overcomes these limitations, allowing homomorphic evaluation of an arbitrary number of additions plus one multiplication, while keeping the size of the encrypted text constant. Given the importance that the BGN algorithm has had in the development of homomorphic cryptography, in this article we will provide its explicit mathematical description.

3 BGN scheme

Introduced in 2005 by Boneh et al. [8], the BGN algorithm marks a milestone in the history of homomorphic cryptography. The security of the BGN scheme relies on the difficulty of the so-called Subgroup Decision Problem, which involves determining whether a certain element of a group G of order n = p ⋅ q , with p and q distinct prime numbers, belongs to the subgroup of G with order p .

Below are the main phases of the BGN operation.

Given a security parameter κ ∈ N , we choose two κ -bit primes p and q and compute n = p q . We consider:

• G and G ′ as cyclic groups of order n ;

• g as a generator of G ;

• e : G × G → G ′ as a bilinear map such that e ( g , g ) is a generator of G ′ .

One possible construction of such groups for an n > 3 without square factors and not divisible by 3 is as follows. Let l be the smallest integer such that p = l n − 1 is prime and p ≡ 2 ( mod 3 ) . Consider a supersingular elliptic curve y 2 = x 3 + 1 . Since p ≡ 2 ( mod 3 ) , the number of F p -rational points on this curve is p + 1 = l n , forming a group. Take G as the subgroup of order n of this group. Finally, if G ′ is the subgroup of F p 2 * of order n , then the Weil pairing on the curve ensures the existence of the desired bilinear form.

Given ( p , q , G , G ′ , e ) and g as a generator of G , we choose another random generator u of G and compute h = u q , which will be a generator of the subgroup of G of order p . The public key is then p k = ( n , g , h , G , G ′ , e ) , while the private key is s k = p .

Suppose we want to encrypt an element m ∈ Z 2 . We simply choose a random element r from Z n and use the public key p k = ( n , g , h , G , G ′ , e ) to generate the encryption c of m , defined as follows:

To decrypt c , we use s k = p to compute:

At this point, we simply calculate the discrete logarithm m = log g p ( c p ) , for example, using Pollard’s lambda algorithm, to retrieve the message. Note that for this step to be feasible, the message space must be chosen small enough.

As mentioned earlier, BGN supports any number of homomorphic additions. Given m , m ˜ ∈ Z 2 and their respective encryptions c = E ( m ) = g m h r , c ˜ = E ( m ˜ ) = g m ˜ h r ˜ , anyone can construct a valid encryption c add for m + m ˜ by choosing s randomly from Z n and computing:

where r add = r + r ˜ + s . It is clear that the obtained result is indeed an encryption of m + m ˜ :

and we can calculate its discrete logarithm to obtain m + m ˜ .

Regarding homomorphic multiplication, the structure of BGN allows only one such operation through the bilinear map e . Let g ′ = e ( g , g ) ∈ G ′ and h ′ = e ( g , h ) ∈ G ′ . By assumption, o r d ( g ′ ) = n , while, due to the bilinearity of e , o r d ( h ′ ) = p . Also, write h = g α q for some α ∈ Z . Given two encrypted texts c , c ˜ ∈ G as mentioned earlier, we can compute the encryption c mult of m ⋅ m ˜ by choosing s ∈ Z n randomly and setting:

Clearly, as r is chosen, r mult is also uniformly distributed in Z n . Thus, c mult is an encryption for m ⋅ m ˜ . However, now c mult is in G ′ rather than G , so although decryption and homomorphic addition are still possible, homomorphic multiplication is not.

4 SWHE schemes based on LWE

LWE, initially introduced by Oded Regev as an extension of the “learning from parity with error” problem, is considered one of the most challenging problems to solve even for quantum computers. Regev himself reduced the complexity of some of the most well-known lattice problems, such as shortest vector problem (SVP), to LWE. This implies that if an algorithm were found to efficiently solve LWE, the same algorithm would also solve SVP efficiently. Since then, LWE has become one of the most studied and promising problems in the field of post-quantum cryptography. In this section, we will delve into the workings of the main SWHE schemes based on LWE.

In the context of homomorphic cryptography, the fame of this problem is largely due to its use in constructing SWHE and FHE schemes. A fundamental step in this regard was taken in 2011 by Brakerski and Vaikuntanathan [9]. The description of the algorithm they constructed (called BV) is reported in Section 5.

Subsequently, in 2013, Lyubashevsky et al. [10] proposed a significant improvement of LWE, introducing a variant called ring-LWE (RLWE), which shifts the problem into the context of polynomial rings. Since then, several researchers have worked to transfer the BV algorithm into this new environment, with the aim of achieving performance improvements. In this direction, we particularly mention the work of Fan and Vercauteren (FV scheme) [11] and BGV scheme [12].

A completely different approach to building an SWHE scheme using well-known lattice problems was presented by López-Alt et al. in 2012 in [13], with an algorithm inspired by the famous NTRU. NTRU-Encrypt is an example of a lattice-based cryptosystem that has already been extensively tested and strongly standardized, but whose homomorphic properties have only recently been recognized. In Section 8, we will describe this approach in more detail along with some encountered challenges.

5 BV scheme

The underlying idea behind Gentry’s construction is to exploit the difficulty of certain problems related to the so-called ideal lattices (a particular family of lattices). Ideals are mathematical objects that naturally appear in the context of homomorphic cryptography, as they are closed by definition under both addition and multiplication (while a generic lattice is closed only under addition). Despite the widespread use of lattices in cryptography, ideal lattices are a specific category about which we know relatively little. After Gentry, several constructions of FHE have been based on his approach, but although promising, these early “second-generation” schemes have never truly become practical.

In the study by Brakerski and Vaikuntanathan [9], however, the authors introduced a scheme, which we will refer to as BV from now on, whose security is based on generic lattice problems (not necessarily ideal lattices). In particular, the security of this system is solely based on the complexity of LWE, a problem that is widely studied and considered “reliable.” Furthermore, the definition of this scheme does not directly depend on lattices, making it easier to understand and implement.

6 Schemes based on RLWE

One of the most important algorithms that managed to adapt the Brakerski and Vaikuntanathan scheme and bring it into the context of the RLWE problem was described by Fan and Vercauteren in [11]. In this way, it was possible to obtain an SWHE scheme with a smaller key space compared to BV and faster computations. Since this scheme is essentially an adaptation of the BV algorithm, we will not provide the explicit details of the individual phases, but we will only describe the new setting in which it operates.

The mathematical environment in which Fan and Vercauteren define their scheme is the ring of polynomials R = Z [ x ] ⁄ ( f ( x ) ) , where f ( x ) ∈ Z [ x ] is a monic irreducible polynomial of degree d . Usually, f ( x ) is the minimal polynomial of a primitive m th root of unity, namely, a cyclotomic polynomial ϕ m ( x ) . The most common choice is f ( x ) = x d + 1 with d = 2 n .

Let q > 1 be an integer, and let Z q be the set of integers in the interval ( − q ⁄ 2 , q ⁄ 2 ] (not to be confused with the ring Z q ). Consider the set R q of polynomials in R with coefficients in Z q . All arithmetic of the FV scheme will take place in the ring R and the set R q . Given a ∈ Z , denote by [ a ] q the unique integer in Z q such that [ a ] q ≡ a ( mod q ) . Similarly, if a ∈ R , let [ a ] q be the element of R obtained by applying [ ⋅ ] q to all its coefficients.

As in the scheme of Brakerski and Vaikuntanathan, to define the RLWE problem, it is necessary to consider a distribution over R . The basic idea is to use the Gaussian distribution over integers to define a distribution over R . The most natural approach to do this is simply to select polynomials in R by choosing coefficients according to the Gaussian distribution. This approach is not applicable in the general case, but it works if f ( x ) = x d + 1 with d = 2 n . The RLWE problem, in its decisional version, can then be stated as follows.

The RLWE problem can be reduced (via a quantum algorithm) to the SVP problem on an ideal lattice. Moreover, it is possible to choose s ∈ R q according to the distribution χ and not necessarily uniformly, without compromising security. Finally, it has been shown that the complexity of the problem does not depend on the exact form of q , which can therefore be chosen simply as a power of 2.

Another significant step toward a practical SWHE scheme is the BGV scheme (Brakersi-Gentry-Vaikuntanathan), introduced in [12]. This scheme, like FV, bases its security on the RLWE problem, but unlike its predecessors, it significantly improves performance thanks to a noise management technique called “modulus switching.” The setting from which Brakersi et al. start is the same as the FV scheme. As seen, in order to decrypt a ciphertext encrypted with the BV scheme (or equivalently with the FV scheme), it is necessary for the accumulated noise during homomorphic operations to be less than q ⁄ 2 . Furthermore, the sum of two ciphertexts with noise less than or equal to B results in a ciphertext whose noise is at most 2 B . Multiplication of the same ciphertexts would result in a ciphertext with an error in the order of B 2 . By iteratively using the modulus switching technique, the BGV scheme manages to keep the noise level substantially constant, provided that the modulus size ( q according to previous notation) is sacrificed and therefore gradually sacrificing the remaining homomorphic capabilities of the system. The essence of modulus switching can be summarized in the following lemma. The notations are the same used before.

In short, this lemma ensures that a user who does not know the secret key s , but knows a bound on its norm, can transform a ciphertext c modulo q into a different ciphertext c ′ modulo p while preserving the correctness of the scheme, i.e., [ ⟨ c ′ , s ⟩ ] p = [ ⟨ c , s ⟩ ] q ( mod 2 ) . This transformation simply involves scaling by a factor p ⁄ q and appropriately approximating. Furthermore, if the norm of s is sufficiently small, and p is sufficiently small compared to q , then the noise in the ciphertext is reduced. With this technique, a user can control the noise during the execution of the scheme, without knowing the secret key and without the need to introduce a public homomorphic evaluation key as in the BV scheme.

7 CKKS scheme

All the SWHE schemes seen so far are built to naturally support arithmetic of integers or binaries. However, since for various applications, such as machine learning, it is necessary to operate on real/complex numbers, there is a need for a scheme that can homomorphically handle approximated data. It is worth noting that even the FV and BGV schemes described previously are capable of evaluating homomorphic operations on real numbers, but this requires the introduction of sophisticated and often inefficient encoding procedures. The CKKS algorithm, introduced in [14], is instead an SWHE algorithm specifically designed to deal with this type of data and is considered the most efficient SWHE algorithm for applications involving such data.

From a formal point of view, the operation of CKKS has many similarities with other RLWE-based schemes, especially with BGV. However, in terms of security, there is an important difference between CKKS and BGV. In fact, Li and Micciancio [15] exhibited an attack against CKKS that exploits its decryption function, whose approximate results weaken the complexity of the RLWE problem. In the best-case scenario, through a simple algebraic manipulation, this attack allows the secret key to be recovered in a single attempt. Both FV and BGV are secure against this attack. In response to this vulnerability, Li and Micciancio [15] therefore proposed modifying the encryption function of CKKS, adding additional noise to the ciphertexts, so as not to weaken the underlying RLWE problem.

8 NTRU-based schemes

NTRU-Encrypt is a cryptosystem proposed by Hoffstein et al. [16] in 1998, and is one of the first attempts at lattice-based cryptography. Compared to RSA and GGH (Goldreich–Goldwasser–Halevi) cryptosystems, NTRU shows greater efficiency both in terms of hardware and software implementation. However, for 15 years, until the work of Stehlé and Steinfeld [17], there were doubts about its actual security. In this work, the authors succeeded, by introducing modifications to the original algorithm, in reducing the security of NTRU to the RLWE problem. This increased researchers’ interest in this scheme significantly. Furthermore, in 2012, both López-Alt et al. and Gentry independently observed how the NTRU scheme naturally possesses homomorphic properties. In particular, in [13], López-Alt et al. propose modifications to the classic NTRU algorithm to obtain an SWHE scheme. The mathematical environment in which this scheme operates is the same as that of the FV and BGV schemes. Let R = Z [ x ] ⁄ ( x d + 1 ) , where d is a power of 2, q is an odd prime number, and χ is a “ B -bounded” distribution over R , i.e., the coefficients of the polynomials selected through the distribution χ must be less than B , where B is a relatively small number compared to q . Let Z q be the set of integers in the interval ( − q ⁄ 2 , q ⁄ 2 ] and R q be the set of polynomials in R with coefficients in Z q . As mentioned earlier, given a polynomial a ∈ R , [ a ] q denotes the element of R obtained by applying the reduction [ ⋅ ] q to all its coefficients.

For key generation, the algorithm involves selecting two polynomials f ′ and g through the distribution χ , and setting f ≔ 2 f ′ + 1 , so that f ≡ 1 ( mod 2 ) . Let f − 1 be the inverse of f in R q (if f were not invertible in R q , the algorithm involves reselecting f ′ ). The public key of the scheme is the polynomial h ≔ [ 2 g f − 1 ] q ∈ R q , while the private key is f . To encrypt a message m ∈ Z 2 , it is necessary to select two polynomials s and e through χ and compute

To decrypt the ciphertext c using the secret key f , it is sufficient to compute [ f c ] q ( mod 2 ) . In fact,

At this point if we assume that [ 2 g s + 2 f e + f m ] q = 2 g s + 2 f e + f m , then

By choosing the parameters appropriately, it is possible to ensure that decryption actually works correctly (i.e., there is no reduction modulo q in the calculation of f c ). As is easy to observe, this scheme possesses homomorphic properties. However, with each operation on the ciphertexts, the error increases (especially in the case of multiplications), thus imposing a limit on the depth of the circuit to be evaluated.

The scheme proposed by López-Alt et al. also represents a new type of SWHE, called “Multikey SWHE,” as it has the ability to evaluate ciphertexts with different and independent keys. In other words, each user can encrypt data with their own public key, and a third party can perform operations homomorphically on all these data. The only interaction required among the various users is the sharing of a common secret key, which depends on all the individual secret keys and which will then be used to decrypt the encrypted data. Suppose, for example, there are two users encrypting two messages m 1 , m 2 using their own public keys h i ≔ [ 2 g i f i − 1 ] q , obtaining the two ciphertexts

i = 1 , 2 . Let f 1 , 2 ≔ f 1 ⋅ f 2 be the common secret key of the two users. It is then possible to decrypt the two ciphertexts c 1 + c 2 and c 1 ⋅ c 2 using the key f 1 , 2 by calculating

and

Therefore, since f 1 = f 2 = 1 ( mod 2 ) , assuming that the error associated with these two ciphertexts has not exceeded the maximum threshold of q ⁄ 2 , we have that

and

Obviously, in this case too, the error in the ciphertexts increases with each operation, and therefore, the correctness of decryption will only hold for a limited number of operations. What López-Alt et al. demonstrate in [13] is that the scheme can correctly evaluate circuits of approximately depth ε log ( n ) , with q = 2 n ε and B polynomial in n .

Despite the efficiency properties derived from NTRU, and the property of being a multikey scheme, some limitations have prevented this scheme from asserting itself compared to others based on LWE. One of the problems to consider regarding the scheme by López-Alt et al. are its starting assumptions, namely, the complexity of the RLWE and DSPR (decisional small polynomial ratio) problems. While RLWE has been widely studied and is now considered a standard, the assumption about the complexity of DSPR is less reassuring. For this reason, several researchers have tried to modify the scheme to remove the dependence on DSPR, but these attempts have resulted in the reintroduction of public evaluation keys and other complicated procedures, thus making the scheme inefficient. By reintroducing the DSPR problem, it is possible to obtain seemingly usable versions of these schemes. However, in 2016, Albrecht et al. in [18] showed an attack (based on lattices) on every SWHE scheme based on NTRU that uses the DSRP assumption. As a consequence, when the modulus q of these schemes is large compared to the dimension n , the scheme is not secure. At the same time, to increase the depth of the evaluable circuits, it is necessary to consider larger moduli, and consequently larger dimensions (to make the system secure). This problem has made SWHE schemes based on NTRU noncompetitive compared to other schemes based on RLWE. Research in this area is therefore trying to overcome this problem, for example, by further reducing the growth of errors during circuit evaluation, in order to keep the ratio between modulus and scheme dimension relatively low [19].

9 Somewhat homomorphic schemes based on integers

In 2010, 1 year after the famous Gentry scheme, van Dijk et al. [20] presented a new SWHE scheme whose security is based on the AGCD problem, namely, the problem of recovering an odd integer p , knowing a set of values x i = q i p + r i . Consequently, the scheme is defined over integers, and one of its strengths is certainly its conceptual simplicity. The various phases of this scheme can be summarized as follows. Let p be a sufficiently large prime number representing the secret key of the scheme. Given a message m ∈ Z 2 , choose a sufficiently large prime number q and a number r sufficiently small compared to p . Then m can be encrypted as c = E ( m ) = m + 2 r + p q . If m + 2 r < p ⁄ 2 , the ciphertext can be decrypted simply by computing m = ( c ( mod p ) ) ( mod 2 ) . Therefore, as in the previous schemes, the presence of an “error” term means that the number of performable homomorphic operations is not unlimited. The homomorphic properties of the scheme can be observed as follows. With respect to addition, it holds that

Clearly, E ( m 1 ) + E ( m 2 ) still belongs to the space of ciphertexts, and it can be decrypted if ∣ ( m 1 + m 2 ) + 2 ( r 1 + r 2 ) ∣ < p ⁄ 2 . Since both r 1 and r 2 are relatively small compared to p , several additions on ciphertexts can be performed before the error exceeds the threshold of p ⁄ 2 .

With respect to multiplication, we can write

which will be decryptable if ∣ m 1 m 2 + 2 ( m 1 r 2 + m 2 r 1 + 2 r 1 r 2 ) ∣ < p ⁄ 2 . Performing a multiplication on ciphertexts, we observe that the error grows exponentially, greatly limiting the number of multiplications that can be performed.

As mentioned, the scheme introduced by van Dijk et al. is extremely simple, but as observed, it is also inefficient. Over the years, several attempts have been made to improve the efficiency of this type of schemes; however, a level has not yet been reached that makes these algorithms applicable in practice.