Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1,...
Transcript of Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1,...
![Page 1: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/1.jpg)
Fixed-Point Arithmetic in SHE Schemes
Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1,
Adrian Waller2
1University of Bristol
2Thales UK Research & Technology
July 6, 2016
![Page 2: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/2.jpg)
Outline
Motivation
Encoding integers and fixed-point numbers
Lower bounds on ring parameters
Application to homomorphic image processing
Conclusion
![Page 3: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/3.jpg)
Motivation
![Page 4: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/4.jpg)
Somewhat Homomorphic Encryption
Huge improvement in efficiency of FHE schemes since 2009.
Yet, practical FHE schemes seem out of reach.
Goal: to obtain practical SHE schemes for a given class of functions.
![Page 5: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/5.jpg)
Somewhat Homomorphic Encryption
Huge improvement in efficiency of FHE schemes since 2009.
Yet, practical FHE schemes seem out of reach.
Goal: to obtain practical SHE schemes for a given class of functions.
![Page 6: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/6.jpg)
Somewhat Homomorphic Encryption
Huge improvement in efficiency of FHE schemes since 2009.
Yet, practical FHE schemes seem out of reach.
Goal: to obtain practical SHE schemes for a given class of functions.
![Page 7: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/7.jpg)
Problem 1
Problem 1: how to encode/decode data types of an application into
an SHE scheme?
Application: emulate fixed point arithmetic.
Target SHE schemes: ring-based SHE schemes
I currently among the most efficient,
I plaintext space R = Z[x ]/(Φm(X ), p).
Encoding considerably effects efficiency
I working with binary circuits is usually inefficient in practice.
![Page 8: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/8.jpg)
Problem 1
Problem 1: how to encode/decode data types of an application into
an SHE scheme?
Application: emulate fixed point arithmetic.
Target SHE schemes: ring-based SHE schemes
I currently among the most efficient,
I plaintext space R = Z[x ]/(Φm(X ), p).
Encoding considerably effects efficiency
I working with binary circuits is usually inefficient in practice.
![Page 9: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/9.jpg)
Problem 1
Problem 1: how to encode/decode data types of an application into
an SHE scheme?
Application: emulate fixed point arithmetic.
Target SHE schemes: ring-based SHE schemes
I currently among the most efficient,
I plaintext space R = Z[x ]/(Φm(X ), p).
Encoding considerably effects efficiency
I working with binary circuits is usually inefficient in practice.
![Page 10: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/10.jpg)
Problem 1
Problem 1: how to encode/decode data types of an application into
an SHE scheme?
Application: emulate fixed point arithmetic.
Target SHE schemes: ring-based SHE schemes
I currently among the most efficient,
I plaintext space R = Z[x ]/(Φm(X ), p).
Encoding considerably effects efficiency
I working with binary circuits is usually inefficient in practice.
![Page 11: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/11.jpg)
Problem 2
The parameters of an SHE scheme depends upon
I multiplicative depth,
I plaintext modulus p and degree of the ring d ,
I security level
Problem 2: derive lower bounds on
I plaintext modulus p
F to ensure no wrap around the modulus p,
I degree of the ring d
F to ensure no wrap around the modulus Φm(X ),
![Page 12: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/12.jpg)
Problem 2
The parameters of an SHE scheme depends upon
I multiplicative depth,
I plaintext modulus p and degree of the ring d ,
I security level
Problem 2: derive lower bounds on
I plaintext modulus p
F to ensure no wrap around the modulus p,
I degree of the ring d
F to ensure no wrap around the modulus Φm(X ),
![Page 13: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/13.jpg)
Problem 2
The parameters of an SHE scheme depends upon
I multiplicative depth,
I plaintext modulus p and degree of the ring d ,
I security level
Problem 2: derive lower bounds on
I plaintext modulus p
F to ensure no wrap around the modulus p,
I degree of the ring d
F to ensure no wrap around the modulus Φm(X ),
![Page 14: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/14.jpg)
Problem 2
The parameters of an SHE scheme depends upon
I multiplicative depth,
I plaintext modulus p and degree of the ring d ,
I security level
Problem 2: derive lower bounds on
I plaintext modulus p
F to ensure no wrap around the modulus p,
I degree of the ring d
F to ensure no wrap around the modulus Φm(X ),
![Page 15: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/15.jpg)
Problem 1: Encoding data types
![Page 16: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/16.jpg)
Encoding integers: Scalar encoding
Integer encoded as the constant term.
p must be greater than the largest integer occurring.
For a regular circuit of
I multiplicative depth: M
I No. of additions per multiplicative depth: A,
I and for inputs in [−L, . . . , L]
p > 2 · 2A(2M+1−2) · L2M .
![Page 17: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/17.jpg)
Encoding integers: Scalar encoding
Integer encoded as the constant term.
p must be greater than the largest integer occurring.
For a regular circuit of
I multiplicative depth: M
I No. of additions per multiplicative depth: A,
I and for inputs in [−L, . . . , L]
p > 2 · 2A(2M+1−2) · L2M .
![Page 18: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/18.jpg)
Encoding integers: Scalar encoding
Integer encoded as the constant term.
p must be greater than the largest integer occurring.
For a regular circuit of
I multiplicative depth: M
I No. of additions per multiplicative depth: A,
I and for inputs in [−L, . . . , L]
p > 2 · 2A(2M+1−2) · L2M .
![Page 19: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/19.jpg)
Encoding integers: Non-balanced base-B encoding
Integer encoded as a polynomial corresponding to base-B expansion.
I coefficients in [0, ..,B − 1].
Example: 19 7→ 2 · X 2 + 1, when base B = 3.
Smaller-sized coefficients compared to scalar encoding.
Every coefficient has the same sign.
![Page 20: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/20.jpg)
Encoding integers: Non-balanced base-B encoding
Integer encoded as a polynomial corresponding to base-B expansion.
I coefficients in [0, ..,B − 1].
Example: 19 7→ 2 · X 2 + 1, when base B = 3.
Smaller-sized coefficients compared to scalar encoding.
Every coefficient has the same sign.
![Page 21: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/21.jpg)
Encoding integers: Non-balanced base-B encoding
Integer encoded as a polynomial corresponding to base-B expansion.
I coefficients in [0, ..,B − 1].
Example: 19 7→ 2 · X 2 + 1, when base B = 3.
Smaller-sized coefficients compared to scalar encoding.
Every coefficient has the same sign.
![Page 22: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/22.jpg)
Encoding integers: Non-balanced base-B encoding
Integer encoded as a polynomial corresponding to base-B expansion.
I coefficients in [0, ..,B − 1].
Example: 19 7→ 2 · X 2 + 1, when base B = 3.
Smaller-sized coefficients compared to scalar encoding.
Every coefficient has the same sign.
![Page 23: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/23.jpg)
Encoding integers: Balanced base-B encoding
Integer encoded as a polynomial corresponding to base-B expansion.
I coefficients instead in [−(B − 1)/2, . . . , (B − 1)/2].
Example: 19 7→ X 3 − X 2 − X − 1, when bal. base B = 3.
Tradeoff : size of coefficients and the degree of encodings.
B = 3 turns out be optimal.
Deriving bounds on the size of coefficients is more challenging.
![Page 24: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/24.jpg)
Encoding integers: Balanced base-B encoding
Integer encoded as a polynomial corresponding to base-B expansion.
I coefficients instead in [−(B − 1)/2, . . . , (B − 1)/2].
Example: 19 7→ X 3 − X 2 − X − 1, when bal. base B = 3.
Tradeoff : size of coefficients and the degree of encodings.
B = 3 turns out be optimal.
Deriving bounds on the size of coefficients is more challenging.
![Page 25: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/25.jpg)
Encoding integers: Balanced base-B encoding
Integer encoded as a polynomial corresponding to base-B expansion.
I coefficients instead in [−(B − 1)/2, . . . , (B − 1)/2].
Example: 19 7→ X 3 − X 2 − X − 1, when bal. base B = 3.
Tradeoff : size of coefficients and the degree of encodings.
B = 3 turns out be optimal.
Deriving bounds on the size of coefficients is more challenging.
![Page 26: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/26.jpg)
Encoding integers: Balanced base-B encoding
Integer encoded as a polynomial corresponding to base-B expansion.
I coefficients instead in [−(B − 1)/2, . . . , (B − 1)/2].
Example: 19 7→ X 3 − X 2 − X − 1, when bal. base B = 3.
Tradeoff : size of coefficients and the degree of encodings.
B = 3 turns out be optimal.
Deriving bounds on the size of coefficients is more challenging.
![Page 27: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/27.jpg)
Encoding integers: Balanced base-B encoding
Integer encoded as a polynomial corresponding to base-B expansion.
I coefficients instead in [−(B − 1)/2, . . . , (B − 1)/2].
Example: 19 7→ X 3 − X 2 − X − 1, when bal. base B = 3.
Tradeoff : size of coefficients and the degree of encodings.
B = 3 turns out be optimal.
Deriving bounds on the size of coefficients is more challenging.
![Page 28: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/28.jpg)
Encoding fixed-point numbers: Scaled integer encoding
Fixed-point number encoded as an integer scaled down by a power of
a base B.
y = y+.y− 7→ (q(X ), i), y = q(B) ∗ B−i ,
where the integer itself is represented by a balanced base-B encoding.
Example: 6.33 . . . = 19× 3−1 7→ (X 3 − X 2 + 1, 1), when bal. base
B = 3.
![Page 29: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/29.jpg)
Encoding fixed-point numbers: Scaled integer encoding
Fixed-point number encoded as an integer scaled down by a power of
a base B.
y = y+.y− 7→ (q(X ), i), y = q(B) ∗ B−i ,
where the integer itself is represented by a balanced base-B encoding.
Example: 6.33 . . . = 19× 3−1 7→ (X 3 − X 2 + 1, 1), when bal. base
B = 3.
![Page 30: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/30.jpg)
Encoding fixed-point numbers: Scaled integer encoding
Addition +:
(q(X ), i) + (q′(X ), i ′) =: (Q, I ).
(Q, I ) =
(q + q′ · X i−i ′ , i) if i > i ′
(q′ + q · X i ′−i , i ′) if i ′ ≥ i .
Multiplication ×:
(q(X ), i) × (q′(X ), i ′) = (q(X ) · q′(X ), i + i ′).
![Page 31: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/31.jpg)
Encoding fixed-point numbers: Scaled integer encoding
Addition +:
(q(X ), i) + (q′(X ), i ′) =: (Q, I ).
(Q, I ) =
(q + q′ · X i−i ′ , i) if i > i ′
(q′ + q · X i ′−i , i ′) if i ′ ≥ i .
Multiplication ×:
(q(X ), i) × (q′(X ), i ′) = (q(X ) · q′(X ), i + i ′).
![Page 32: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/32.jpg)
Encoding fixed-point numbers: Scaled integer encoding
Let R1 = {(q, i) | q ∈ Z[X ]/Φm(X ), i ∈ Z/φ(m)Z}.
R1 is a ring w.r.t. + and ×.
Disadvantage: Keep track of the exponent i in the clear for every
ciphertext
I not an issue if the evaluated circuit is public.
Bounds: same as the balanced base integer representation
![Page 33: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/33.jpg)
Encoding fixed-point numbers: Scaled integer encoding
Let R1 = {(q, i) | q ∈ Z[X ]/Φm(X ), i ∈ Z/φ(m)Z}.
R1 is a ring w.r.t. + and ×.
Disadvantage: Keep track of the exponent i in the clear for every
ciphertext
I not an issue if the evaluated circuit is public.
Bounds: same as the balanced base integer representation
![Page 34: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/34.jpg)
Encoding fixed-point numbers: Scaled integer encoding
Let R1 = {(q, i) | q ∈ Z[X ]/Φm(X ), i ∈ Z/φ(m)Z}.
R1 is a ring w.r.t. + and ×.
Disadvantage: Keep track of the exponent i in the clear for every
ciphertext
I not an issue if the evaluated circuit is public.
Bounds: same as the balanced base integer representation
![Page 35: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/35.jpg)
Encoding fixed-point numbers: Scaled integer encoding
Let R1 = {(q, i) | q ∈ Z[X ]/Φm(X ), i ∈ Z/φ(m)Z}.
R1 is a ring w.r.t. + and ×.
Disadvantage: Keep track of the exponent i in the clear for every
ciphertext
I not an issue if the evaluated circuit is public.
Bounds: same as the balanced base integer representation
![Page 36: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/36.jpg)
Encoding fixed-point numbers: Fractional encoding
Proposed by [Dowlin et al. 2015].
Closely related to Laurent polynomial representation.
Suppose we are working in Z[X ]/(X n + 1).
y = y+.y− 7→∑i≤I+
bi · X i +∑
0<i≤I−b−i · X−i (mod X n + 1),
Since −X n ≡ 1 (mod X n + 1),
y = y+.y− 7→∑i≤I+
bi · X i −∑
0<i≤I−b−i · X n−i (mod X n + 1).
![Page 37: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/37.jpg)
Encoding fixed-point numbers: Fractional encoding
Proposed by [Dowlin et al. 2015].
Closely related to Laurent polynomial representation.
Suppose we are working in Z[X ]/(X n + 1).
y = y+.y− 7→∑i≤I+
bi · X i +∑
0<i≤I−b−i · X−i (mod X n + 1),
Since −X n ≡ 1 (mod X n + 1),
y = y+.y− 7→∑i≤I+
bi · X i −∑
0<i≤I−b−i · X n−i (mod X n + 1).
![Page 38: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/38.jpg)
Encoding fixed-point numbers: Fractional encoding
Proposed by [Dowlin et al. 2015].
Closely related to Laurent polynomial representation.
Suppose we are working in Z[X ]/(X n + 1).
y = y+.y− 7→∑i≤I+
bi · X i +∑
0<i≤I−b−i · X−i (mod X n + 1),
Since −X n ≡ 1 (mod X n + 1),
y = y+.y− 7→∑i≤I+
bi · X i −∑
0<i≤I−b−i · X n−i (mod X n + 1).
![Page 39: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/39.jpg)
Encoding fixed-point numbers: Fractional encoding
Proposed by [Dowlin et al. 2015].
Closely related to Laurent polynomial representation.
Suppose we are working in Z[X ]/(X n + 1).
y = y+.y− 7→∑i≤I+
bi · X i +∑
0<i≤I−b−i · X−i (mod X n + 1),
Since −X n ≡ 1 (mod X n + 1),
y = y+.y− 7→∑i≤I+
bi · X i −∑
0<i≤I−b−i · X n−i (mod X n + 1).
![Page 40: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/40.jpg)
Encoding fixed-point numbers: Fractional encoding
Example: in Z[X ]/(X 8 + 1) and bal. base B = 3,
I 6.33 . . . 7→ −X 7 + X 2 − X .
Advantage: ”Dispenses away” the need for tracking the exponent
I need to separate coefficients in integer and fractional parts.
Disadvantage
I works only in power-of-two cyclotomic rings,
I no slots for SIMD operations.
Addition and Multiplication: as in R2 := Z[X ]/(X n + 1).
Bounds: seems more complicated than the scaled integer case?
![Page 41: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/41.jpg)
Encoding fixed-point numbers: Fractional encoding
Example: in Z[X ]/(X 8 + 1) and bal. base B = 3,
I 6.33 . . . 7→ −X 7 + X 2 − X .
Advantage: ”Dispenses away” the need for tracking the exponent
I need to separate coefficients in integer and fractional parts.
Disadvantage
I works only in power-of-two cyclotomic rings,
I no slots for SIMD operations.
Addition and Multiplication: as in R2 := Z[X ]/(X n + 1).
Bounds: seems more complicated than the scaled integer case?
![Page 42: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/42.jpg)
Encoding fixed-point numbers: Fractional encoding
Example: in Z[X ]/(X 8 + 1) and bal. base B = 3,
I 6.33 . . . 7→ −X 7 + X 2 − X .
Advantage: ”Dispenses away” the need for tracking the exponent
I need to separate coefficients in integer and fractional parts.
Disadvantage
I works only in power-of-two cyclotomic rings,
I no slots for SIMD operations.
Addition and Multiplication: as in R2 := Z[X ]/(X n + 1).
Bounds: seems more complicated than the scaled integer case?
![Page 43: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/43.jpg)
Encoding fixed-point numbers: Fractional encoding
Example: in Z[X ]/(X 8 + 1) and bal. base B = 3,
I 6.33 . . . 7→ −X 7 + X 2 − X .
Advantage: ”Dispenses away” the need for tracking the exponent
I need to separate coefficients in integer and fractional parts.
Disadvantage
I works only in power-of-two cyclotomic rings,
I no slots for SIMD operations.
Addition and Multiplication: as in R2 := Z[X ]/(X n + 1).
Bounds: seems more complicated than the scaled integer case?
![Page 44: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/44.jpg)
Encoding fixed-point numbers: Fractional encoding
Example: in Z[X ]/(X 8 + 1) and bal. base B = 3,
I 6.33 . . . 7→ −X 7 + X 2 − X .
Advantage: ”Dispenses away” the need for tracking the exponent
I need to separate coefficients in integer and fractional parts.
Disadvantage
I works only in power-of-two cyclotomic rings,
I no slots for SIMD operations.
Addition and Multiplication: as in R2 := Z[X ]/(X n + 1).
Bounds: seems more complicated than the scaled integer case?
![Page 45: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/45.jpg)
Problem 2: bounding size of coefficients
![Page 46: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/46.jpg)
Upper bounds on coefficients
Problem: compute max. size of coefficients in encodings given
I circuit description,
I bounds on input numbers
Our contribution:
I efficient computational procedure to bound arbitrary circuits
F precisely determining max. values can be very expensive,
I closed form upper bounds for regular circuits.
![Page 47: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/47.jpg)
Upper bounds on coefficients
Problem: compute max. size of coefficients in encodings given
I circuit description,
I bounds on input numbers
Our contribution:
I efficient computational procedure to bound arbitrary circuits
F precisely determining max. values can be very expensive,
I closed form upper bounds for regular circuits.
![Page 48: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/48.jpg)
Upper bounds on coefficients
Two cases:
I balanced base-3 integer encoding ≡ scaled integer encoding,
I fractional encoding (modulo X n + 1) for fixed-point numbers.
![Page 49: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/49.jpg)
Equivalence: scaled integer vs. fractional encoding
Ring R1 of scaled integer encodings
I R1 := {(q, i) | q ∈ Z[X ]/(X n + 1), i ∈ Z/nZ)} .
Ring R2 of fractional encodings
I R2 := Z[X ]/(X n + 1).
R1 is isomorphic to R2
Ψ :
R1 → R2
(q := qI · X i + qF , i) 7→ qI − qF · X n−i
![Page 50: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/50.jpg)
Equivalence: scaled integer vs. fractional encoding
Ring R1 of scaled integer encodings
I R1 := {(q, i) | q ∈ Z[X ]/(X n + 1), i ∈ Z/nZ)} .
Ring R2 of fractional encodings
I R2 := Z[X ]/(X n + 1).
R1 is isomorphic to R2
Ψ :
R1 → R2
(q := qI · X i + qF , i) 7→ qI − qF · X n−i
![Page 51: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/51.jpg)
Equivalence: scaled integer vs. fractional encoding
Ring R1 of scaled integer encodings
I R1 := {(q, i) | q ∈ Z[X ]/(X n + 1), i ∈ Z/nZ)} .
Ring R2 of fractional encodings
I R2 := Z[X ]/(X n + 1).
R1 is isomorphic to R2
Ψ :
R1 → R2
(q := qI · X i + qF , i) 7→ qI − qF · X n−i
![Page 52: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/52.jpg)
Equivalence: scaled integer vs. fractional encoding
Example: encoding 6.33
I using balanced base-3 representation and Z[X ]/(X 8 + 1),
I scaled integer encoding (R1): (X 3 − X 2 + 1, 1),
I fractional encoding (R2): −X 7 + X 2 − X ,
![Page 53: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/53.jpg)
Equivalence: scaled integer vs. fractional encoding
Example: encoding 6.33
I using balanced base-3 representation and Z[X ]/(X 8 + 1),
I scaled integer encoding (R1): (X 3 − X 2 + 1, 1),
I fractional encoding (R2): −X 7 + X 2 − X ,
![Page 54: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/54.jpg)
Equivalence: scaled integer vs. fractional encoding
Example: encoding 6.33
I using balanced base-3 representation and Z[X ]/(X 8 + 1),
I scaled integer encoding (R1): (X 3 − X 2 + 1, 1),
I fractional encoding (R2): −X 7 + X 2 − X ,
![Page 55: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/55.jpg)
Equivalence: scaled integer vs. fractional encoding
Example: encoding 6.33
I using balanced base-3 representation and Z[X ]/(X 8 + 1),
I scaled integer encoding (R1): (X 3 − X 2 + 1, 1),
I fractional encoding (R2): −X 7 + X 2 − X ,
![Page 56: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/56.jpg)
Equivalence: scaled integer vs. fractional encoding
Example: encoding 6.33
I using balanced base-3 representation and Z[X ]/(X 8 + 1),
I scaled integer encoding (R1): (X 3 − X 2 + 1, 1),
I fractional encoding (R2): −X 7 + X 2 − X ,
(X 3 − X 2 + 1) · (−X 7) = −X 7 + X 2 − X (mod X 8 + 1).
Note: infinity norm of intermediate polynomials is identical for any
circuit.
Suffices to analyse only the integer case.
![Page 57: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/57.jpg)
Equivalence: scaled integer vs. fractional encoding
Example: encoding 6.33
I using balanced base-3 representation and Z[X ]/(X 8 + 1),
I scaled integer encoding (R1): (X 3 − X 2 + 1, 1),
I fractional encoding (R2): −X 7 + X 2 − X ,
(X 3 − X 2 + 1) · (−X 7) = −X 7 + X 2 − X (mod X 8 + 1).
Note: infinity norm of intermediate polynomials is identical for any
circuit.
Suffices to analyse only the integer case.
![Page 58: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/58.jpg)
Equivalence: scaled integer vs. fractional encoding
Example: encoding 6.33
I using balanced base-3 representation and Z[X ]/(X 8 + 1),
I scaled integer encoding (R1): (X 3 − X 2 + 1, 1),
I fractional encoding (R2): −X 7 + X 2 − X ,
(X 3 − X 2 + 1) · (−X 7) = −X 7 + X 2 − X (mod X 8 + 1).
Note: infinity norm of intermediate polynomials is identical for any
circuit.
Suffices to analyse only the integer case.
![Page 59: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/59.jpg)
Bounding integer-valued arithmetic circuits
Suppose there are t distinct input ranges [−Li , . . . , Li ].
di : degree of corresponding balanced base-3 encoding polynomials.
Input encoding polynomials have infinity norm 1.
Define
c[(d1,e1),...,(dt ,et)] =∥∥∥ t∏
i=1
(1 + x + x2 + . . .+ xdi )ei∥∥∥∞.
![Page 60: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/60.jpg)
Bounding integer-valued arithmetic circuits
Suppose there are t distinct input ranges [−Li , . . . , Li ].
di : degree of corresponding balanced base-3 encoding polynomials.
Input encoding polynomials have infinity norm 1.
Define
c[(d1,e1),...,(dt ,et)] =∥∥∥ t∏
i=1
(1 + x + x2 + . . .+ xdi )ei∥∥∥∞.
![Page 61: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/61.jpg)
Bounding integer-valued arithmetic circuits
Suppose there are t distinct input ranges [−Li , . . . , Li ].
di : degree of corresponding balanced base-3 encoding polynomials.
Input encoding polynomials have infinity norm 1.
Define
c[(d1,e1),...,(dt ,et)] =∥∥∥ t∏
i=1
(1 + x + x2 + . . .+ xdi )ei∥∥∥∞.
![Page 62: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/62.jpg)
Bounding integer-valued arithmetic circuits
Suppose there are t distinct input ranges [−Li , . . . , Li ].
di : degree of corresponding balanced base-3 encoding polynomials.
Input encoding polynomials have infinity norm 1.
Define
c[(d1,e1),...,(dt ,et)] =∥∥∥ t∏
i=1
(1 + x + x2 + . . .+ xdi )ei∥∥∥∞.
![Page 63: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/63.jpg)
Bounding integer-valued arithmetic circuits
Upper bound is of the form
LP =∑
e1,...,et
a[(d1,e1),...,(dt ,et)] · c[(d1,e1),...,(dt ,et)],
![Page 64: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/64.jpg)
Bounding integer-valued arithmetic circuits
Compute the bounds iteratively
LP =∑
e1,...,et
a[(d1,e1),...,(dt ,et)] · c[(d1,e1),...,(dt ,et)],
LP′ =∑
e′1,...,e′t
a[(d1,e′1),...,(dt ,e′t)] · c[(d1,e′1),...,(dt ,e′t)],
![Page 65: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/65.jpg)
Bounding integer-valued arithmetic circuits
Compute the bounds iteratively
LP+P′ = LP + LP′ ,
LP·P′ =∑
e1,...,et ,e′1,...,e′t
(a[(d1,e1),...,(dt ,et)] · a[(d1,e′1),...,(dt ,e′t)]
)·(
c[(d1,e1+e′1),...,(dt ,et+e′t)]
)
![Page 66: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/66.jpg)
Bounding integer-valued arithmetic circuits
Iteratively bounding
c[(d1,e1),...,(dt ,et)] =∥∥∥ t∏
i=1
(1 + x + x2 + . . .+ xdi )ei∥∥∥∞.
using the relation
c[(d1,e1),...,(dt ,et)] ≤ (dk · ek + 1) · cdk ,ek · c[(d1,e′1),...,(dt ,e′t)],
where e ′i = ei except that e ′k = 0.
Partial order: di · ei ≤ (di+1 · ei+1).
![Page 67: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/67.jpg)
Bounding integer-valued arithmetic circuits
Iteratively bounding
c[(d1,e1),...,(dt ,et)] =∥∥∥ t∏
i=1
(1 + x + x2 + . . .+ xdi )ei∥∥∥∞.
using the relation
c[(d1,e1),...,(dt ,et)] ≤ (dk · ek + 1) · cdk ,ek · c[(d1,e′1),...,(dt ,e′t)],
where e ′i = ei except that e ′k = 0.
Partial order: di · ei ≤ (di+1 · ei+1).
![Page 68: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/68.jpg)
Bounding integer-valued arithmetic circuits
Finally, bounding
cd ,e =∥∥∥(1 + x + x2 + . . .+ xd)e
∥∥∥∞.
Simple bounds: (d+1)e
d ·e+1 ≤ cd ,e ≤ (d + 1)e .
Tighter bound [Mattner & Roos 2008]: If e 6= 2 or d ∈ {1, 2, 3},
then
cd ,e <
√6
π · d · e · (d + 2)· (d + 1)e .
![Page 69: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/69.jpg)
Bounding integer-valued arithmetic circuits
Finally, bounding
cd ,e =∥∥∥(1 + x + x2 + . . .+ xd)e
∥∥∥∞.
Simple bounds: (d+1)e
d ·e+1 ≤ cd ,e ≤ (d + 1)e .
Tighter bound [Mattner & Roos 2008]: If e 6= 2 or d ∈ {1, 2, 3},
then
cd ,e <
√6
π · d · e · (d + 2)· (d + 1)e .
![Page 70: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/70.jpg)
Bounding integer-valued arithmetic circuits
Finally, bounding
cd ,e =∥∥∥(1 + x + x2 + . . .+ xd)e
∥∥∥∞.
Simple bounds: (d+1)e
d ·e+1 ≤ cd ,e ≤ (d + 1)e .
Tighter bound [Mattner & Roos 2008]: If e 6= 2 or d ∈ {1, 2, 3},
then
cd ,e <
√6
π · d · e · (d + 2)· (d + 1)e .
![Page 71: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/71.jpg)
Bounding integer-valued arithmetic circuits
They also show that
lime→∞
√e · cd ,e
(d + 1)e=
√6
π · d · (d + 2).
![Page 72: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/72.jpg)
Bounding integer-valued arithmetic circuits
For a regular circuit having
I M levels of multiplication,
I A additions per multiplicative level,
I max. initial degree of encodings d = dlog(2 · L + 1)/ log 3e − 1,
BM,A = cd,2M · 2A(2M+1−2),
![Page 73: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/73.jpg)
Bounding integer-valued arithmetic circuits
For a regular circuit having
I M levels of multiplication,
I A additions per multiplicative level,
I max. initial degree of encodings d = dlog(2 · L + 1)/ log 3e − 1,
BM,A <
√6
π · 2M · d(d + 2)· (d + 1)2
M
· 2A(2M+1−2).
I For an SHE scheme
p > 2 · BM,A, deg(R) > 2M · d .
![Page 74: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/74.jpg)
Bounding integer-valued arithmetic circuits
For a regular circuit having
I M levels of multiplication,
I A additions per multiplicative level,
I max. initial degree of encodings d = dlog(2 · L + 1)/ log 3e − 1,
BM,A <
√6
π · 2M · d(d + 2)· (d + 1)2
M
· 2A(2M+1−2).
I For an SHE scheme
p > 2 · BM,A, deg(R) > 2M · d .
![Page 75: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/75.jpg)
Bounding integer-valued arithmetic circuits
Concrete bounds for p (in bits) and deg(R) for 20-bit inputs:
M 1 2 3 4 5
A = 0 5 12 26 55 114
A = 1 7 18 40 85 176
A = 2 9 24 54 115 238
A = 3 11 30 68 145 300
A = 4 13 36 82 175 362
A = 5 15 42 96 205 424
deg(R) 24 48 96 192 384
![Page 76: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/76.jpg)
Application: homomorphic image processing
![Page 77: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/77.jpg)
Homomorphic image processing
FFT - Hadamard product - iFFT: standard image processing pipeline.
We performed a homomorphic evaluation of this pipeline
I matrix for Hadamard product was also encrypted,
I encrypted inputs were complex numbers
F FFT and HAD inputs: 8-bits precision,
F precision of roots of unity is variable - result to be within 32-bits
precision.
The whole operation is non-linear
I cannot apply additive homomorphic schemes.
![Page 78: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/78.jpg)
Homomorphic image processing
FFT - Hadamard product - iFFT: standard image processing pipeline.
We performed a homomorphic evaluation of this pipeline
I matrix for Hadamard product was also encrypted,
I encrypted inputs were complex numbers
F FFT and HAD inputs: 8-bits precision,
F precision of roots of unity is variable - result to be within 32-bits
precision.
The whole operation is non-linear
I cannot apply additive homomorphic schemes.
![Page 79: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/79.jpg)
Homomorphic image processing
FFT - Hadamard product - iFFT: standard image processing pipeline.
We performed a homomorphic evaluation of this pipeline
I matrix for Hadamard product was also encrypted,
I encrypted inputs were complex numbers
F FFT and HAD inputs: 8-bits precision,
F precision of roots of unity is variable - result to be within 32-bits
precision.
The whole operation is non-linear
I cannot apply additive homomorphic schemes.
![Page 80: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/80.jpg)
Homomorphic image processing
FFT - Hadamard product - iFFT: standard image processing pipeline.
We performed a homomorphic evaluation of this pipeline
I matrix for Hadamard product was also encrypted,
I encrypted inputs were complex numbers
F FFT and HAD inputs: 8-bits precision,
F precision of roots of unity is variable - result to be within 32-bits
precision.
The whole operation is non-linear
I cannot apply additive homomorphic schemes.
![Page 81: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/81.jpg)
Homomorphic image processing
We use mixed Fourier transform instead of FFT
I tradeoff: depth vs. number of scalar multiplications,
I greater depth means longer modulus chain in SHE scheme and hence
slower.
![Page 82: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/82.jpg)
Homomorphic image processing
Concrete parameters for the FFT-Hadamard-iFFT pipeline:
FFT B = 1 B =√n NFT B = n
log2 p deg(R) log2 p deg(R) log2 p deg(R)
n ≥ ≥ ≥ ≥ ≥ ≥
16 54 190 37 118 25 46
64 74 248 49 146 29 44
256 93 298 61 170 33 42
1024 112 340 72 190 37 40
![Page 83: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/83.jpg)
Homomorphic image processing
Timing results (in sec) using HElib running on a 6-core cluster:
HElib Amortization CPU Amortized
n B deg(R) log2 q Levels Amount Time Time
16 1 32768 710 33 172 188 1.09
16 4 32768 451 19 277 147 0.53
16 16 16384 192 9 356 106 0.3
64 8 32768 622 30 224 1500 6.69
64 64 16384 192 10 372 1582 4.25
256 256 16384 278 11 390 34876 89.4
![Page 84: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/84.jpg)
Conclusion
![Page 85: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/85.jpg)
Conclusion
We investigated the growth of coefficients and the degree for various
encoding schemes.
Proved the equivalence of scaled integer and fractional encodings for
fixed-point numbers.
Computed concrete bounds for regular circuits.
Implemented homomorphic evaluation of FFT-Hadamard
product-iFFT pipeline used in image processing.
![Page 86: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/86.jpg)
Conclusion
We investigated the growth of coefficients and the degree for various
encoding schemes.
Proved the equivalence of scaled integer and fractional encodings for
fixed-point numbers.
Computed concrete bounds for regular circuits.
Implemented homomorphic evaluation of FFT-Hadamard
product-iFFT pipeline used in image processing.
![Page 87: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/87.jpg)
Conclusion
We investigated the growth of coefficients and the degree for various
encoding schemes.
Proved the equivalence of scaled integer and fractional encodings for
fixed-point numbers.
Computed concrete bounds for regular circuits.
Implemented homomorphic evaluation of FFT-Hadamard
product-iFFT pipeline used in image processing.
![Page 88: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/88.jpg)
Conclusion
We investigated the growth of coefficients and the degree for various
encoding schemes.
Proved the equivalence of scaled integer and fractional encodings for
fixed-point numbers.
Computed concrete bounds for regular circuits.
Implemented homomorphic evaluation of FFT-Hadamard
product-iFFT pipeline used in image processing.
![Page 89: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/89.jpg)
Future Work
Improve the current bounds for coefficient growth.
SIMD implementation of FFT-Hadamard product-iFFT pipeline for
scaled integer encoding.
![Page 90: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/90.jpg)
Future Work
Improve the current bounds for coefficient growth.
SIMD implementation of FFT-Hadamard product-iFFT pipeline for
scaled integer encoding.
![Page 91: Fixed-Point Arithmetic in SHE Schemes · Fixed-Point Arithmetic in SHE Schemes Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1, Adrian Waller2 1University of Bristol 2Thales](https://reader035.fdocuments.us/reader035/viewer/2022071003/5fc051e82dbb7d2a707786f2/html5/thumbnails/91.jpg)
Thank You!